Avoid GHES masking of cross-job workflow outputs by Copilot · Pull Request #66678 · github/gh-aw

Copilot · 2026-10-07T19:57:18Z

GHES can blank activation outputs whose values match registered secrets. Downstream jobs then request unprefixed artifacts or receive an empty target repository, even when the activation outputs are declared.

Artifact names: Compute the existing workflow-call prefix in each downstream job after Setup Scripts. Downloads and uploads use ${{ steps.artifact-prefix.outputs.prefix }}agent rather than a cross-job prefix output.
Repository resolution: Resolve the host repository within downstream jobs. Checkout, GitHub App, and dispatch paths fall back to activation outputs and GitHub context if local resolution is empty.
Dev-mode checkouts: Restore the local setup action after downstream jobs replace the workspace, preserving its post-step.

Fixes Cross-Job Output Masking #38345

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot

🟡 Changes recommended

Attempt-dependent local prefixes cause partial reruns to request artifacts that successful upstream jobs never uploaded.

1 open finding

Retry-varying artifact prefixes break partial workflow reruns · New

What changed in this PR

This PR makes compiled reusable workflows more resilient to GHES secret masking of cross-job outputs, addressing #38345.

Changes:

Compute artifact prefixes locally in downstream jobs.
Resolve target repositories locally with activation and GitHub-context fallbacks.
Restore development-mode setup actions after workspace replacement and update regression tests.

File	Description
pkg/workflow/threat_detection_job_test.go	Expect local detection artifact prefixes.
pkg/workflow/safe_outputs_jobs.go	Use repository-name fallbacks for App tokens.
pkg/workflow/safe_outputs_config_runtime.go	Add dispatch repository fallbacks.
pkg/workflow/safe_output_helpers_test.go	Expect local agent artifact prefixes.
pkg/workflow/safe_jobs.go	Add local setup and development-mode restoration.
pkg/workflow/safe_jobs_test.go	Check prefix computation before downloads.
pkg/workflow/publish_code_coverage.go	Initialize local coverage artifact prefixes.
pkg/workflow/publish_code_coverage_test.go	Check coverage setup ordering.
pkg/workflow/notify_comment_work_queue_test.go	Update work-queue artifact expectations.
pkg/workflow/notify_comment_test.go	Update conclusion artifact expectations.
pkg/workflow/notify_comment_conclusion_helpers.go	Add conclusion App repository fallbacks.
pkg/workflow/github_app_owner_derivation.go	Use resilient repository expressions.
pkg/workflow/github_app_owner_derivation_test.go	Update repository fallback assertions.
pkg/workflow/create_code_scanning_alert.go	Add local setup and action restoration.
pkg/workflow/compiler_yaml_step_generation.go	Generate downstream prefix and repository steps.
pkg/workflow/compiler_yaml_checkout.go	Use repository fallbacks for checkout.
pkg/workflow/compiler_workflow_call.go	Centralize local prefix and repository expressions.
pkg/workflow/compiler_workflow_call_test.go	Test downstream setup generation.
pkg/workflow/compiler_safe_outputs_steps.go	Add mention-token repository fallbacks.
pkg/workflow/compiler_safe_outputs_job.go	Update downloads, token fallbacks, and setup ordering.
pkg/workflow/compiler_safe_outputs_job_test.go	Check local resolution and restoration ordering.
pkg/workflow/compiler_main_job_helpers.go	Expose the agent’s locally computed prefix.
pkg/workflow/compiler_experiments_test.go	Expect local experiment artifact prefixes.
pkg/workflow/agentic_output_test.go	Update mention-token fallback expectations.

🧠 Review effort: Balanced

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

Copilot · 2026-10-07T23:51:54Z

 func (c *Compiler) generateSetupStepForJob(jobName string, data *WorkflowData, setupActionRef string, destination string, enableArtifactClient bool, traceID string, parentSpanID string, artifactClientCondition string) []string {
 	steps := c.generateSetupStepWithArtifactClientCondition(data, setupActionRef, destination, enableArtifactClient, traceID, parentSpanID, artifactClientCondition)
+	if data != nil && hasWorkflowCallTrigger(data.On) && jobName != "activation" && jobName != "pre_activation" {
+		steps = append(steps, generateArtifactPrefixStep()...)


The GHES path now uses retry-stable prefixes, while non-GHES jobs continue to consume the producer’s prefix output. I added a regression test for attempts 1 and 2. Fixed in d024eb1.

gh-aw-bot · 2026-10-07T22:41:32Z

@copilot address the following outstanding work in one pass:

Update this branch with the latest main using make merge-main, resolving any conflicts and preserving the intended changes.
Review (pkg/workflow/compiler_yaml_step_generation.go:224): Computing a fresh prefix in every downstream job breaks partial reruns of workflow_call workflows. actions/setup/sh/compute_artifact_prefix.sh includes GITHUB_RUN_ATTEMPT in the hash. If activation succeeds on attempt 1 and a failed agent or detection job reruns on attempt 2 without activation, its download now requests an attempt-2 artifact that was never uploaded. The same mismatch affects downstream jobs consuming retained agent artifacts. Resolve download names from the producer's attempt or artifact metadata without relying on maskable cross-job outputs, or use retry-stable names wi... - Avoid GHES masking of cross-job workflow outputs #66678 (comment)

Push the necessary fixes, reply to each listed review thread and resolve it when addressed. Ignore feedback already answered or resolved. Use the pr-finisher skill and stop when only human review or CI remains; do not trigger CI.

Sous-chef head: d2cf978
Sous-chef work: 3dfe952b08a0003a5d25cd3bcab40bb1043f74f02c5af115bf5f24b947fab7c8
Sous-chef state: a82fbb912e4a19dbdeb6e8fd0b469c135807e94e4bdda09d1d55e6c7691d2f5f

Generated by 👨‍🍳 PR Sous Chef · pi · haiku45 · 3.24 AIC · ⌖ 12.7 AIC · ⊞ 1K · ◷
_{Comment /souschef to run again}

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

…put-masking Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

pelikhan · 2026-10-07T23:11:35Z

@copilot enable this mode when ghes: true

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

…put-masking Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-10-07T23:51:54Z

@copilot enable this mode when ghes: true

The downstream artifact-prefix and repository-resolution behavior is now enabled only for ghes: true; non-GHES workflows retain producer outputs. Fixed in d024eb1.

Initial plan

bde23f4

Copilot AI assigned Copilot and pelikhan Oct 7, 2026

Copilot started work on behalf of pelikhan October 7, 2026 20:01 View session

Copilot AI linked an issue Oct 7, 2026 that may be closed by this pull request

Cross-Job Output Masking #38345

Open

Copilot AI and others added 2 commits October 7, 2026 20:17

Compute downstream workflow-call outputs locally

958fb7a

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Restore dev-mode setup action after downstream checkouts

d2cf978

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Fix cross-job output masking issue~~ Avoid GHES masking of cross-job workflow outputs Oct 7, 2026

Copilot finished work on behalf of pelikhan October 7, 2026 20:29

Copilot AI requested a review from pelikhan October 7, 2026 20:29

github-actions Bot mentioned this pull request Oct 7, 2026

[Contribution Check Report] Contribution Check — 2026-10-07 #66396

Closed

pelikhan marked this pull request as ready for review October 7, 2026 22:15

Copilot AI balanced review requested due to automatic review settings October 7, 2026 22:15

Copilot started reviewing on behalf of pelikhan October 7, 2026 22:15 View session

Copilot AI reviewed Oct 7, 2026

View reviewed changes

github-actions Bot mentioned this pull request Oct 7, 2026

[pr-sous-chef] 🍳 PR Sous Chef Summary: 4 PRs nudged toward completion #66387

Closed

Copilot started work on behalf of gh-aw-bot October 7, 2026 22:42 View session

Copilot AI and others added 2 commits October 7, 2026 22:50

Regenerate workflow locks for current compiler changes

dbf253b

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Merge remote-tracking branch 'origin/main' into copilot/cross-job-out…

1959228

…put-masking Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot started work on behalf of pelikhan October 7, 2026 23:12 View session

Copilot AI and others added 3 commits October 7, 2026 23:15

Stabilize workflow-call artifact names across retries

3f0ede1

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Merge remote-tracking branch 'origin/main' into copilot/cross-job-out…

1a90261

…put-masking Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Apply remaining changes

b26c776

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot finished work on behalf of gh-aw-bot October 7, 2026 23:36

Copilot AI requested a review from gh-aw-bot October 7, 2026 23:36

Copilot AI and others added 2 commits October 7, 2026 23:42

Gate workflow-call prefix workaround on GHES

5b9b874

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Merge concurrent GHES and lint fixes

d024eb1

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan October 7, 2026 23:56

This was referenced Oct 8, 2026

[PR Triage Report] PR triage report — 2026-10-08 #66727

Closed

[pr-sous-chef] PR Sous Chef Progress: PR #66708 #66743

Closed

pelikhan closed this Oct 8, 2026

github-actions Bot mentioned this pull request Oct 8, 2026

[PR Triage Report] PR triage report - 2026-10-08 #66810

Closed

jaroslawgajewski mentioned this pull request Oct 9, 2026

Downstream jobs read needs.activation.outputs.target_repo, but activation does not declare it in most workflows #67175

Closed

Copilot AI mentioned this pull request Oct 9, 2026

Add fallbacks for downstream activation repository outputs #67244

Merged

Navigation Menu

Repository navigation

Avoid GHES masking of cross-job workflow outputs - #66678

Avoid GHES masking of cross-job workflow outputs#66678
pelikhan with Copilot wants to merge 10 commits into
mainfrom
copilot/cross-job-output-masking

Copilot AI commented Oct 7, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Oct 7, 2026

Uh oh!

gh-aw-bot commented Oct 7, 2026

Uh oh!

pelikhan commented Oct 7, 2026

Uh oh!

Copilot AI commented Oct 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

Copilot AI commented Oct 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Copilot AI Oct 7, 2026

Choose a reason for hiding this comment

Uh oh!

gh-aw-bot commented Oct 7, 2026

Uh oh!

pelikhan commented Oct 7, 2026

Uh oh!

Copilot AI commented Oct 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Copilot AI commented Oct 7, 2026 •

edited

Loading