Cover regex-shaped MCP gateway masks in artifact redaction by Copilot · Pull Request #66041 · github/gh-aw

Copilot · 2026-10-06T05:54:25Z

In v0.90.3, secret redaction could fail with an invalid regular expression when a runtime mask contained generated MCP gateway shell text. The failure removed artifact sources instead of uploading sanitized files.

Redaction behavior: The current implementation matches runtime masks literally rather than compiling them as regexes; no production change is included.
Regression coverage: Add an end-to-end case with multiline, regex-shaped gateway text. It checks that both the agent log and a JSONL artifact are sanitized without a redaction failure or source deletion.

Fixes Secret redaction fails with invalid regular expression on v0.90.3 #65833

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

github-actions · 2026-10-06T06:06:50Z

🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer

github-actions · 2026-10-06T06:06:51Z

✅ PR Code Quality Reviewer completed the code quality review.

No GitHub write was possible from the shell because safeoutputs execution was permission-gated.

🔎 Code quality review by PR Code Quality Reviewer

github-actions · 2026-10-06T06:07:01Z

✅ Ponytail Reviewer completed successfully!

Lean already. Ship.

Generated by Ponytail Reviewer for #66041

github-actions · 2026-10-06T06:07:05Z

✅ Test Quality Sentinel completed test quality analysis.

Test Quality Sentinel skipped because pre-fetch PR data was unavailable: unable to fetch test file diff

🧪 Test quality analysis by Test Quality Sentinel

github-actions · 2026-10-06T06:07:07Z

✅ Design Decision Gate 🏗️ completed the design decision gate check. See the comment below for the result and any generated ADR draft.

No ADR enforcement needed for PR #66041: the PR does not carry the 'implementation' label and has 0 new lines in business logic directories (1 file changed, threshold 100).

🏗️ ADR gate enforced by Design Decision Gate 🏗️

Copilot

Copilot review overview

🟢 Approval recommended

The focused regression test accurately covers the reported failure and expected sanitization behavior.

Review effort: Balanced
Findings: None

What changed in this PR

Adds regression coverage ensuring regex-shaped, multiline MCP gateway masks are treated literally during artifact redaction.

Changes:

Tests sanitization of agent logs and JSONL artifacts.
Verifies redaction completes without warnings, failures, or source deletion.

File	Description
`actions/setup/js/runtime_mask_publication.test.cjs`	Adds end-to-end regression coverage for multiline gateway masks.

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

github-actions

Reviewed the added regression test for regex-shaped multiline MCP gateway masks.

Findings: None blocking. The test is well-targeted: it exercises redactMaskedValues/redactArtifactMaskedValues with mask text containing regex metacharacters ((?:, \", +) and embedded newlines, confirming literal (non-regex) matching sanitizes both the agent-stdio log and a JSONL artifact without triggering core.setFailed/core.warning or deleting the source. Verified locally — test passes.

This is a test-only change (no production code modified), consistent with the PR description. No action needed.

🧵 Reviewed using Impeccable skills by Impeccable Skills Reviewer · copilot · sonnet50 · 28.4 AIC · ⌖ 14 AIC · ⊞ 8.2K

github-actions

Skills-Based Review 🧠

Applied /tdd — no actionable issues found; approving.

📋 Analysis

This is a focused, test-only regression addition (no production code changes), consistent with the PR description.

Verification performed: I manually traced the redaction pipeline (collectAddMaskedValues → redactMaskedValues / redactArtifactMaskedValues) against the new regex-shaped, multiline mask value and confirmed the implementation produces exactly the outputs asserted in the new test (***\n***\n***\n for the stdio log, {"body":"***\n***\n***"} for the JSON source). This confirms secrets are matched literally (not compiled as a regex), which is the behavior the regression guards against.

TDD review (/tdd):

✅ Descriptive test name reads as a specification: "sanitizes regex-shaped multiline gateway text without removing artifacts"
✅ Mirrors the existing sibling test ("oversized runtime masks") in structure and assertion style — consistent with codebase conventions
✅ Exercises a real edge case (regex metacharacters (?:, $, unescaped quotes, embedded newlines) that caused the original production bug (#65833)
✅ Asserts both the absence of failure (setFailed/warning not called) and the positive sanitization outcome — good coverage of both the regression symptom and the fix
No gaps identified; no further test cases needed for this change's scope

Positive highlights:

✅ Clean reuse of existing write/redactSources test harness helpers
✅ Good regression coverage without introducing unnecessary production complexity

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer · copilot · sonnet50 · 45.2 AIC · ⌖ 13.4 AIC · ⊞ 10.2K
_{Comment /matt to run again}

github-actions · 2026-10-06T06:15:50Z

Comment Memory

Peek at saved memory (pr-code-quality-reviewer)

reviewed_at: 2026-10-06T06:08:11Z
review_event: REQUEST_CHANGES
top_themes:
  - regression-fixture-does-not-match-real-gateway-mask
files_reviewed:
  - actions/setup/js/runtime_mask_publication.test.cjs
comment_count: 1

Note

This comment is managed by comment memory.

Expand the saved memory block to view or edit the persistent context for this thread.
Edit only the text inside the backtick fences; workflow metadata and the footer are regenerated automatically.

Learn more about comment memory

🔎 Code quality review by PR Code Quality Reviewer · copilot · gpt54 · 35.4 AIC · ⌖ 5.57 AIC · ⊞ 21.1K · ◷
_{Comment /review to run again}

github-actions

Request changes

This PR only adds regression coverage, and the new test currently targets a synthetic patch fragment instead of the real gateway mask shape that broke redaction.

Blocking theme

The added fixture keeps ${MCP_GATEWAY_AGENT_ID} unresolved and includes leading + diff markers on subsequent lines. Because of that, it does not demonstrate that the rendered multiline gateway shell text from the actual setup path can be redacted safely end to end, which is the whole point of the regression.

🔎 Code quality review by PR Code Quality Reviewer · copilot · gpt54 · 35.4 AIC · ⌖ 5.57 AIC · ⊞ 21.1K
_{Comment /review to run again}

github-actions · 2026-10-06T06:15:54Z

  });

+  it("sanitizes regex-shaped multiline gateway text without removing artifacts", async () => {
+    const mask = '(?:${MCP_GATEWAY_AGENT_ID}\\"\\\n+          export MCP_GATEWAY_AGENT_ID\n+          export MCP_GATEWAY_PAYLOAD_DIR="/tmp/gh-aw/mcp-payloads"';


This fixture does not model the runtime mask that actually broke redaction, so the regression can pass while the production case stays untested.

💡 Why this blocks merge

The new mask literal still contains the unresolved ${MCP_GATEWAY_AGENT_ID} placeholder and prefixes the following lines with + diff markers, but the real value passed through ::add-mask:: is the rendered gateway shell text, not a patch fragment. As written, this test mostly proves we can redact this synthetic string shape; it does not prove #65833 stays fixed for the actual multiline gateway payload.

Please build the fixture from the real rendered shell snippet (or the exact failing payload from the bug) instead of embedding diff artifacts. Even a small helper such as const mask = actualGatewayLines.join( ) would make this exercise the same text shape production emits.

Updated in $(git rev-parse --short HEAD): the fixture now uses the rendered gateway export lines, with the runtime agent ID concretely expanded and no diff markers. The log and JSONL assertions verify sanitization without source removal.

done

gh-aw-bot · 2026-10-06T09:16:05Z

@copilot address the following outstanding work in one pass:

Update this branch with the latest main using make merge-main, resolving any conflicts and preserving the intended changes.
Review (actions/setup/js/runtime_mask_publication.test.cjs:123): This fixture does not model the runtime mask that actually broke redaction, so the regression can pass while the production case stays untested. - Cover regex-shaped MCP gateway masks in artifact redaction #66041 (comment)

Push the necessary fixes, reply to each listed review thread and resolve it when addressed. Ignore feedback already answered or resolved. Use the pr-finisher skill and stop when only human review or CI remains; do not trigger CI.

Sous-chef head: 84683ff
Sous-chef work: 607daee8cf7b9bb11d705cc9c88e4aaccf61703f44b2ae95c0d9fc3c3e49660d
Sous-chef state: dd9da342c91de21122614641f3ef2a3433b0b1dac42ca80b084cc9078822daf0

Generated by 👨‍🍳 PR Sous Chef · pi · haiku45 · 10 AIC · ⌖ 5.77 AIC · ⊞ 1K · ◷
_{Comment /souschef to run again}

…daction-issue Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

github-actions · 2026-10-06T19:25:43Z

🎉 This pull request is included in a new release.

Release: v0.91.2

Initial plan

3e174f3

Copilot AI assigned Copilot and pelikhan Oct 6, 2026

Copilot started work on behalf of pelikhan October 6, 2026 05:54 View session

Copilot AI linked an issue Oct 6, 2026 that may be closed by this pull request

Secret redaction fails with invalid regular expression on v0.90.3 #65833

Closed

test: cover regex-shaped multiline runtime masks in artifact redaction

84683ff

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Fix secret redaction failure with invalid regex in v0.90.3~~ Cover regex-shaped MCP gateway masks in artifact redaction Oct 6, 2026

Copilot finished work on behalf of pelikhan October 6, 2026 06:02

Copilot AI requested a review from pelikhan October 6, 2026 06:02

pelikhan marked this pull request as ready for review October 6, 2026 06:05

Copilot AI balanced review requested due to automatic review settings October 6, 2026 06:05

Copilot started reviewing on behalf of pelikhan October 6, 2026 06:05 View session

Copilot AI reviewed Oct 6, 2026

View reviewed changes

github-actions Bot approved these changes Oct 6, 2026

View reviewed changes

github-actions Bot mentioned this pull request Oct 6, 2026

[aw] No-Op Runs #65943

Open

github-actions Bot previously requested changes Oct 6, 2026

View reviewed changes

github-actions Bot mentioned this pull request Oct 6, 2026

[pr-sous-chef] PR Sous Chef — #65979 nudged #65986

Closed

Copilot started work on behalf of gh-aw-bot October 6, 2026 09:16 View session

Copilot AI and others added 2 commits October 6, 2026 09:22

Merge remote-tracking branch 'origin/main' into copilot/fix-secret-re…

647d5e3

…daction-issue Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

test: use rendered MCP gateway mask fixture

cf91258

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot finished work on behalf of gh-aw-bot October 6, 2026 09:36

Copilot AI requested a review from gh-aw-bot October 6, 2026 09:36

pelikhan merged commit 348b496 into main Oct 6, 2026
2 checks passed

pelikhan deleted the copilot/fix-secret-redaction-issue branch October 6, 2026 11:44

Conversation

Copilot AI commented Oct 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟢 Approval recommended

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Skills-Based Review 🧠

Uh oh!

github-actions Bot commented Oct 6, 2026

Comment Memory

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Request changes

Uh oh!

github-actions Bot Oct 6, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 6, 2026

Choose a reason for hiding this comment

Uh oh!

gh-aw-bot commented Oct 6, 2026

Uh oh!

Uh oh!

github-actions Bot commented Oct 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Copilot AI commented Oct 6, 2026 •

edited

Loading

github-actions Bot commented Oct 6, 2026 •

edited

Loading

github-actions Bot commented Oct 6, 2026 •

edited

Loading

github-actions Bot commented Oct 6, 2026 •

edited

Loading

github-actions Bot commented Oct 6, 2026 •

edited

Loading

github-actions Bot commented Oct 6, 2026 •

edited

Loading