Skip to content

Reduce Actions workflow list response payloads - #3047

Merged
tommaso-moro merged 1 commit into
mainfrom
tommaso-moro-actions-minimal-types
Aug 10, 2026
Merged

Reduce Actions workflow list response payloads#3047
tommaso-moro merged 1 commit into
mainfrom
tommaso-moro-actions-minimal-types

Conversation

@tommaso-moro

@tommaso-moro tommaso-moro commented Aug 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Summary

  • Return dedicated minimal response types from list_workflow_runs and list_workflow_jobs.
  • Preserve the existing response envelopes while removing heavyweight nested objects, node IDs, and redundant REST endpoint URLs from list items.
  • Retain the identifiers and diagnostic fields needed to inspect a run, select relevant runs/jobs, retrieve logs, and operate on a run through subsequent MCP tool calls.

Field contract

list_workflow_runs

Retained top-level fields: id, name, display_title, workflow_id, run_number, run_attempt, event, status, conclusion, head_branch, head_sha, path, html_url, created_at, updated_at, run_started_at.

Dropped top-level fields: node_id, check_suite_id, check_suite_node_id, url, jobs_url, logs_url, check_suite_url, artifacts_url, cancel_url, rerun_url, previous_attempt_url, workflow_url, repository, head_repository.

Nested field Retained Dropped or compressed Reason
pull_requests PR numbers Full pull request objects; all nested fields except number The number is sufficient to call pull request tools; full PR objects duplicate a large amount of separately retrievable data.
actor, triggering_actor login, id, profile_url (from html_url), avatar_url All other user fields and API URLs These fields preserve identity and navigation without embedding full user profiles.
head_commit message All other commit fields head_sha remains top-level for commit/check lookup; the message preserves commit intent.
referenced_workflows path, sha, ref Nothing All fields are retained because they identify the reusable workflow and resolved version.

The list envelope remains { "total_count": ..., "workflow_runs": [...] }.

list_workflow_jobs

Retained job fields: id, run_id, name, workflow_name, status, conclusion, head_branch, head_sha, html_url, run_attempt, runner_id, runner_name, runner_group_id, runner_group_name, labels, steps, created_at, started_at, completed_at.

Dropped job fields: run_url, node_id, url, check_run_url.

Every job-step field remains: name, status, conclusion, number, started_at, and completed_at. Runner and runner-group metadata is also retained for self-hosted-runner diagnosis.

The existing outer jobs response envelope and nested total_count/jobs result are preserved.

Why these fields are safe to remove from list responses

  • Current Actions tools accept repository coordinates plus workflow, run, job, or artifact IDs—not REST endpoint URLs.
  • Run id, workflow workflow_id/path, job id, and head_sha preserve the supported tool-chaining paths.
  • repository and head_repository duplicate the repository context supplied to the tool and can be retrieved separately when needed.
  • Node IDs and check-suite identifiers are not inputs to any current Actions follow-up tool. Check-oriented lookup uses the retained head_sha.
  • Human-facing html_url values remain, while repeated API endpoint URLs are removed.

Measured response-size reduction

Measurements use minified JSON from representative fixtures containing nested repository data, actors, one pull request, a head commit, one referenced workflow, runner/group metadata, and two job steps. Actual savings vary with populated nested fields and the number of steps.

Response Before After Bytes saved Reduction
1 workflow run 4,342 B 1,015 B 3,327 B 76.6%
10 workflow runs 43,106 B 9,836 B 33,270 B 77.2%
1 workflow job 1,205 B 908 B 297 B 24.6%
10 workflow jobs 11,736 B 8,766 B 2,970 B 25.3%
10 runs and 10 jobs combined 54,842 B 18,602 B 36,240 B 66.1%

The job reduction is intentionally smaller because all step fields and all runner/group metadata remain available.

Testing

  • script/lint
  • script/test
  • script/generate-docs

@tommaso-moro
Minimize Actions workflow list responses
b9231fd 
Return compact response types for workflow run and workflow job lists while retaining diagnostic, step, and runner metadata.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 0eecbca7-7271-4a04-8d28-d952c27ed9c1
@tommaso-moro
tommaso-moro marked this pull request as ready for review August 10, 2026 14:01
@tommaso-moro
tommaso-moro requested a review from a team as a code owner August 10, 2026 14:01
Copilot AI balanced review requested due to automatic review settings August 10, 2026 14:01
Copilot AI reviewed Aug 10, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Reduces GitHub Actions list payload sizes while preserving fields needed for diagnostics and follow-up tool calls.

Changes:

  • Adds minimal workflow-run, job, step, and response types.
  • Converts Actions list responses to minimal representations.
  • Adds conversion and handler-level tests.
Show a summary per file
File Description
pkg/github/minimal_types.go Defines and converts minimal Actions response types.
pkg/github/actions.go Returns minimal workflow run and job lists.
pkg/github/actions_test.go Updates list-handler response tests.
pkg/github/actions_minimal_test.go Tests field retention and payload trimming.

Review details

Tip

Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

  • Files reviewed: 4/4 changed files
  • Comments generated: 0
  • Review effort level: Balanced

mattdholloway
mattdholloway approved these changes Aug 10, 2026
View reviewed changes

@mattdholloway mattdholloway left a comment •
edited
Loading

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good to go! Great spot

@tommaso-moro
tommaso-moro merged commit eff4c3c into main Aug 10, 2026
20 checks passed
@tommaso-moro
tommaso-moro deleted the tommaso-moro-actions-minimal-types branch August 10, 2026 14:13
@github-actions github-actions Bot mentioned this pull request Aug 20, 2026
Closed
Copilot AI mentioned this pull request Aug 21, 2026
Merged
social4hyq pushed a commit to social4hyq/homebrew-core that referenced this pull request Sep 20, 2026
HarmonybrewBot HarmonybrewBot
!17166 merge bump-github-mcp-server-1.10.0 into main
f6385a3 
github-mcp-server 1.10.0

Created-by: HarmonybrewBot
Commit-by: HarmonybrewBot
Merged-by: HarmonybrewBot
Description: Created by `brew bump`

---

Created with `brew bump-formula-pr`.<details>
  <summary>release notes</summary>
  <pre>## Highlights

v1.10.0 is a substantial security, reliability, and compatibility release for the GitHub MCP Server.

### Safer by default

- Added confirmed repository deletion with form elicitation and protected multi-round-trip state ([#3076](github/github-mcp-server#3076)).
- Restricted bearer credentials to configured GitHub authorities ([#3056](github/github-mcp-server#3056)).
- Enforced HTTPS for GitHub Enterprise hosts ([#3069](github/github-mcp-server#3069)).
- Made invalid static `--tools` configuration fail closed ([#3050](github/github-mcp-server#3050)).
- Hardened lockdown, request limits, cache isolation, URL traversal, and response sanitization ([#3109](github/github-mcp-server#3109), [#3112](github/github-mcp-server#3112), [#3113](github/github-mcp-server#3113), [#3111](github/github-mcp-server#3111), [#3108](github/github-mcp-server#3108), [#3114](github/github-mcp-server#3114), [#3110](github/github-mcp-server#3110)).

### Better GitHub Enterprise Server compatibility

- `list_issues` and `search_issues` now degrade safely when issue custom-field GraphQL types are unavailable ([#3086](github/github-mcp-server#3086), [#2897](github/github-mcp-server#2897)).
- `list_issues` now returns assignee logins and stable empty arrays for unassigned issues ([#3064](github/github-mcp-server#3064)).
- Validation failures expose safe ruleset details when supplied by the GitHub API ([#3081](github/github-mcp-server#3081)).

### Safer repository file operations

- `get_file_contents` now identifies symbolic links and clearly labels dereferenced content.
- Symbolic-link writes require explicit `allow_symlink_write: true` opt-in ([#3071](github/github-mcp-server#3071)).
- Fixed binary MCP resources being base64-encoded twice ([#3098](github/github-mcp-server#3098)).

### More reliable tool contracts

- Corrected `add_issue_comment` input modes ([#3085](github/github-mcp-server#3085)).
- `issue_write.issue_fields[].delete: false` is now a valid no-op for strict-schema clients ([#3077](github/github-mcp-server#3077)).
- Zero-parameter tools accept an omitted `arguments` property while rejecting explicit `null` and malformed JSON ([#3099](github/github-mcp-server#3099)).
- Notification subscription tools explicitly advertise destructive behavior ([#2936](github/github-mcp-server#2936)).
- Copilot review-request denials now return actionable guidance instead of a bare 404 ([#3119](github/github-mcp-server#3119)).

### Projects, Actions, and efficiency

- Added Project view lifecycle operations and visible-field configuration ([#2961](github/github-mcp-server#2961), [#2988](github/github-mcp-server#2988)).
- Reduced Actions and other successful response payloads ([#3047](github/github-mcp-server#3047), [#3055](github/github-mcp-server#3055)).
- Improved sanitization performance and refreshed UI/build dependencies ([#3120](github/github-mcp-server#3120), [#3100](github/github-mcp-server#3100)).

### Behavior changes to note

- Unknown static `--tools` names now prevent startup.
- Symbolic-link updates require explicit opt-in.
- Requests cannot relax server-enforced lockdown.
- Oversized HTTP request bodies are rejected early.
- `add_issue_comment` performs stricter mutually exclusive mode validation.
- Repository deletion requires an eligible modern MCP client, form elicitation support, and the appropriate scopes.

## What's Changed
* Reduce Actions workflow list response payloads by @tommaso-moro in github/github-mcp-server#3047
* Use minimal response types for tool results by @tommaso-moro in github/github-mcp-server#3055
* Add basic project view management by @zwick in github/github-mcp-server#2961
* Add visible fields to project views by @zwick in github/github-mcp-server#2988
* fix(actions): avoid malformed response on log download failure by @SamMorrowDrums in github/github-mcp-server#3066
* fix(security): enforce HTTPS for gh-host/GITHUB_HOST to prevent cleartext credentials by @SamMorrowDrums in github/github-mcp-server#3069
* Reject unsupported subscription streams by @SamMorrowDrums in github/github-mcp-server#3073
* build(deps): bump distroless/base-debian12 from `348dac1` to `76b3162` by @dependabot[bot] in github/github-mcp-server#3088
* build(deps): bump golang from 1.25.12-alpine to 1.25.13-alpine by @dependabot[bot] in github/github-mcp-server#3087
* build(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.0 by @dependabot[bot] in github/github-mcp-server#3089
* build(deps): bump the npm_and_yarn group across 1 directory with 2 updates by @dependabot[bot] in github/github-mcp-server#3007
* build(deps): bump docker/login-action from 4.4.0 to 4.6.0 by @dependabot[bot] in github/github-mcp-server#3005
* Add confirmed repository deletion tool by @SamMorrowDrums in github/github-mcp-server#3076
* fix(issues): validate add_issue_comment input modes by @SamMorrowDrums in github/github-mcp-server#3085
* Fix static --tools validation fallback by @Mahmoud772122777 in github/github-mcp-server#3050
* Attach GitHub token only to configured GitHub hosts by @SyedAnas01 in github/github-mcp-server#3056
* Show ruleset violation details when create_branch fails by @Hashim1999164 in github/github-mcp-server#3081
* fix(notifications): mark subscription tools destructive by @SamMorrowDrums in github/github-mcp-server#2936
* Fix binary resource blob encoding by @SamMorrowDrums in github/github-mcp-server#3098
* Return assignees from list_issues by @tgockel in github/github-mcp-server#3064
* Fix list_issues on GHES schemas without issue fields by @SamMorrowDrums in github/github-mcp-server#3086
* Fix omitted tool arguments by @SamMorrowDrums in github/github-mcp-server#3099
* Clarify symlink behavior for repository file reads and writes by @theinfosecguy in github/github-mcp-server#3071
* fix(issues): allow delete:false in issue_write issue_fields by @tgockel in github/github-mcp-server#3077
* Handle unsupported issueFieldValues enrichment in search_issues by @kerobbi in github/github-mcp-server#2897
* build(deps): clear UI dependency alerts by @SamMorrowDrums in github/github-mcp-server#3100
* fix(lockdown): harden pull_request_read get_commits handling by @SamMorrowDrums in github/github-mcp-server#3109
* fix(http): make server lockdown mode an upper bound over requests by @SamMorrowDrums in github/github-mcp-server#3112
* Centralize sanitization of untrusted GitHub response fields by @SamMorrowDrums in github/github-mcp-server#3114
* Filter invisible Unicode after HTML entity normalization by @SamMorrowDrums in github/github-mcp-server#3110
* fix(raw): reject traversal segments when constructing raw content URLs by @SamMorrowDrums in github/github-mcp-server#3108
* refactor: condense lockdown comments in GetPullRequestCommits by @SamMorrowDrums in github/github-mcp-server#3115
* Limit HTTP request bodies before MCP middleware parsing by @SamMorrowDrums in github/github-mcp-server#3111
* fix(lockdown): isolate repo-access cache per caller identity by @SamMorrowDrums in github/github-mcp-server#3113
* perf(sanitize): make clean text allocation-free on the hot path by @SamMorrowDrums in github/github-mcp-server#3120
* test(sanitize): drop the optimization scaffolding by @SamMorrowDrums in github/github-mcp-server#3121
* fix(copilot): explain review request denials instead of forwarding a bare 404 by @dylanpulver in github/github-mcp-server#3119
* build(deps): bump the npm_and_yarn group across 1 directory with 4 updates by @dependabot[bot] in github/github-mcp-server#3091

## New Contributors
* @Mahmoud772122777 made their first contribution in github/github-mcp-server#3050
* @SyedAnas01 made their first contribution in github/github-mcp-server#3056
* @Hashim1999164 made their first contribution in github/github-mcp-server#3081
* @tgockel made their first contribution in github/github-mcp-server#3064
* @theinfosecguy made their first contribution in github/github-mcp-server#3071
* @dylanpulver made their first contribution in github/github-mcp-server#3119

**Full Changelog**: https://github.com/github/github-mcp-

See merge request: Harmonybrew/homebrew-core!17166
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort, defaults to Balanced
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@mattdholloway mattdholloway mattdholloway approved these changes
+1 more reviewer
@alirezainanlosalehi7-lgtm alirezainanlosalehi7-lgtm alirezainanlosalehi7-lgtm approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@tommaso-moro @mattdholloway @alirezainanlosalehi7-lgtm