feat(bug-fix): add label-driven bug-fix agentic workflow by BenBtg · Pull Request #3258 · github/spec-kit

BenBtg · 2026-06-30T14:09:51Z

Summary

Adds a bug-fix agentic workflow (gh-aw) as stage 2 of the assess → fix → test bug pipeline, mirroring the existing bug-assess stage. When a maintainer applies the bug-fix label to an issue, the workflow recovers the slug and remediation contract from the prior bug-assess assessment comment, applies the fix, and opens a draft pull request plus a summary comment for human review.

The workflow is intentionally decoupled from Spec Kit specifics: it consumes the assessment from the issue comment rather than any .specify/ files or specify-CLI tooling, so it can be lifted into any repository running the matching bug-assess stage.

What's included

.github/workflows/bug-fix.md — authored markdown workflow, compiled to .github/workflows/bug-fix.lock.yml with gh aw compile (v0.79.8, matching the existing locks).
Label-gated trigger: only runs when the added label is bug-fix (github.event.label.name == 'bug-fix').
Delivery: create-pull-request safe-output opens a draft PR ([bug-fix] prefix, labels bug-fix/automated) plus a single summary comment linking the PR. Uses Refs # (not Closes) since the test stage and human review still follow.
Slug/contract reuse: recovers BUG_SLUG and the remediation/files/tests contract from the bug-assess comment.
No prior assessment → stops and comments asking a maintainer to run bug-assess first (needs-assessment label); never guesses a fix.
Safety: scoped permissions (agent job is read-only; PR creation is isolated), untrusted-input / URL-safety guardrails consistent with bug-assess, minimal-change scope, no destructive commands. Maintainer remains the gatekeeper — no unattended automation.

Acceptance criteria

bug-fix markdown workflow added under .github/workflows/ and compiled to its .lock.yml
Triggered by applying the bug-fix label; gated so it only runs for that label
Generates a fix using shared bug logic, decoupled from Spec Kit specifics
Maintainer remains the gatekeeper; draft PR, no unattended automation
Output (draft PR + comment) posted back to the issue

Validation

gh aw compile bug-fix → 0 errors, 0 warnings
markdownlint-cli2 on bug-fix.md → 0 errors
checkout action pin aligned to v7.0.0 in the lock body to match sibling locks

Deployment note (action required before live use)

The bug-fix trigger label must exist so the issues: labeled event can fire — same as bug-assess. It has been created on this repo (#d93f0b, description "Trigger the bug-fix agentic workflow"). For reference, the equivalent command is:

gh label create bug-fix --repo github/spec-kit \
  --color d93f0b --description "Trigger the bug-fix agentic workflow"

The status labels the workflow applies (needs-assessment, needs-reproduction, fix-proposed, fix-blocked) auto-create on first use via GitHub's add-labels API, so only the trigger label needs pre-creating.

Testing notes

Static + structural validation (done):

gh aw compile bug-fix → 0 errors / 0 warnings; markdownlint-cli2 clean.
The compiled on: trigger block is byte-identical to the already-deployed bug-assess.lock.yml and add-community-extension.lock.yml (issue-only, types: [labeled], label filtering via job condition). Same 7-job structure and permission isolation (read-only agent job; writes via the isolated safe_outputs job).
A gh aw trial install dry-run confirmed the workflow compiles, installs, and becomes ACTIVE in a host repo.

On gh aw trial (why no automated end-to-end run is included): gh aw trial --clone-repo cannot drive an issue-only, label-gated workflow — in clone-repo mode it invokes the workflow_dispatch API, which returns HTTP 422 because this workflow (like its siblings) declares no workflow_dispatch trigger. Adding workflow_dispatch purely for trial-ability was rejected to preserve consistency with bug-assess and to keep the trigger surface tight. The authentic way to exercise it is the live label flow in a sandbox repo: create an issue, post a bug-assess-style assessment comment carrying the slug, then apply the bug-fix label.

If validating in a sandbox, useful workarounds observed during trial install: pass an absolute workflow path; enable host-repo Actions PR-approval permission; use a GitHub-noreply git email (avoids GH007 on push); and --disable-security-scanner (the defensive "ignore previous instructions" text in the Untrusted-Input guardrail trips a false-positive prompt-injection flag).

Refs #3238

This PR was authored by GitHub Copilot (model: Claude Opus 4.8) on behalf of @BenBtg.

Fixes: #3238

Add a `bug-fix` gh-aw workflow as stage 2 of the assess -> fix -> test bug pipeline, mirroring the existing `bug-assess` stage. It triggers when a maintainer applies the `bug-fix` label, recovers the slug and remediation contract from the prior bug-assess assessment comment, applies the fix, and opens a draft pull request plus a summary comment for human review. The workflow is intentionally decoupled from Spec Kit specifics: it consumes the assessment from the issue comment rather than any `.specify/` files, so it is portable to other repositories running the matching bug-assess stage. - .github/workflows/bug-fix.md authored and compiled to bug-fix.lock.yml - Label-gated trigger (github.event.label.name == 'bug-fix') - Draft PR via create-pull-request safe-output; scoped permissions - Untrusted-input / URL-safety guardrails consistent with bug-assess - Maintainer remains the gatekeeper; no unattended automation Refs #3238 Assisted-by: GitHub Copilot (model: Claude Opus 4.8, autonomous) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Adds a new label-driven bug-fix agentic workflow (stage 2 of the assess → fix → test pipeline) that consumes the prior bug-assess issue comment as its contract, applies the proposed remediation, and opens a draft PR plus a single summary comment for maintainer review.

Changes:

Added .github/workflows/bug-fix.md defining the bug-fix stage behavior, guardrails, and safe-outputs (draft PR + comment + status labels).
Added compiled workflow .github/workflows/bug-fix.lock.yml generated via gh aw compile (v0.79.8) for execution in GitHub Actions.

Show a summary per file

File	Description
.github/workflows/bug-fix.md	New authored gh-aw markdown workflow that parses the latest `bug-assess` comment and produces a draft PR + issue comment.
.github/workflows/bug-fix.lock.yml	Generated/locked GitHub Actions workflow corresponding to `bug-fix.md` (pins actions/images, expands guardrails/runtime wiring).

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 1/2 changed files
Comments generated: 1
Review effort level: Low

Copilot

Review details

Files reviewed: 1/2 changed files
Comments generated: 1
Review effort level: Low

Address Copilot review feedback on PR #3258: - Trim tools.bash to the inspect set plus a small test-runner set (pytest, npm, go, cargo, dotnet), dropping package-manager/build tools (pip, npx, pnpm, yarn, mvn, gradle, make, bundle, rake, ruby, node) to reduce blast radius under prompt injection. - Set create-pull-request.protected-files.policy: blocked so edits to sensitive files (dependency manifests, README/CHANGELOG/SECURITY, etc.) block PR creation, matching the stronger contract used by the other PR-creating workflows in this repo. Refs #3238 Assisted-by: GitHub Copilot (model: Claude Opus 4.8, autonomous) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

Copilot

Review details

Files reviewed: 1/2 changed files
Comments generated: 3
Review effort level: Low

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

The Copilot autofix commits edited bug-fix.md (verdict phrasing, Assisted-by trailer) but did not recompile the lock, leaving body_hash stale. Since the workflow runs with strict integrity, the runtime-imported bug-fix.md must match the lock's recorded body_hash. Recompiled with gh-aw v0.79.8 (checkout pin kept at v7.0.0 to match sibling locks); the only change is the body_hash. Assisted-by: GitHub Copilot (model: Claude Opus 4.8, autonomous) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot

Review details

Files reviewed: 1/2 changed files
Comments generated: 0 new
Review effort level: Low

Copilot

Review details

Files reviewed: 1/2 changed files
Comments generated: 2
Review effort level: Low

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

BenBtg · 2026-07-01T13:35:45Z

Addressed the open Copilot finding in 9e5bdfb.

The workflow no longer hard-codes the assessment author as github-actions[bot].
Step 1 now selects the most recent assessment comment that appears workflow-authored by combining:

bot/service-account authorship, and
expected bug-assess structure (assessment header plus remediation/files/tests sections).

This keeps the anti-spoofing intent while making the workflow portable to repos where bug-assess posts through a different service account token.

Recompiled with gh-aw v0.79.8; lock body hash updated accordingly.

Posted by GitHub Copilot (model: Claude Opus 4.8) on behalf of @BenBtg.

Copilot

Review details

Files reviewed: 1/2 changed files
Comments generated: 1
Review effort level: Low

Address Copilot feedback on Step 5 consistency around network-dependent checks. The workflow previously listed `go test ./...` and `cargo test` as examples while also forbidding network-dependent commands, which could be ambiguous on clean runners. Updated Step 5 to: - keep those commands as examples only when dependencies are already present - explicitly disallow dependency-fetch/install commands during verification (go mod download/go get/cargo fetch/npm|pnpm|yarn install) Recompiled with gh-aw v0.79.8 and kept checkout v7.0.0 pin fixups. Assisted-by: GitHub Copilot (model: Claude Opus 4.8, autonomous) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Assisted-by: GitHub Copilot (model: Claude Opus 4.8, autonomous)

Copilot

Review details

Files reviewed: 1/2 changed files
Comments generated: 1
Review effort level: Low

Copilot

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

Copilot

Review details

Files reviewed: 1/2 changed files
Comments generated: 0 new
Review effort level: Low

Copilot

Review details

Files reviewed: 1/2 changed files
Comments generated: 0 new
Review effort level: Low

…tence Address Copilot feedback about missing status labels causing runtime failures. The workflow previously instructed unconditional application of `needs-assessment`, `fix-blocked`, and `fix-proposed`. In repositories where those labels are not pre-created, `add_labels` fails and can break the run. Updated Steps 1/3/4/8 to require existence checks before adding those labels: - add the label only if it exists - otherwise skip labeling and explicitly note that in the comment This preserves the status-label UX when labels exist while keeping execution robust in repos that have not created every optional status label yet. Recompiled with gh-aw v0.79.8 and kept checkout v7.0.0 pin fixups. Assisted-by: GitHub Copilot (model: Claude Opus 4.8, autonomous) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

BenBtg · 2026-07-01T15:40:42Z

Addressed the latest Copilot thread in commit : status labels are now conditional on label existence, and the workflow skips missing labels with an explicit note instead of failing.

@copilot review

Posted by GitHub Copilot (model: Claude Opus 4.8) on behalf of @BenBtg.

BenBtg · 2026-07-01T15:40:57Z

Addressed the latest Copilot thread in commit 193f440: status labels are now conditional on label existence, and the workflow skips missing labels with an explicit note instead of failing.

@copilot review

Posted by GitHub Copilot (model: Claude Opus 4.8) on behalf of @BenBtg.

The previous conditional-label pass updated Steps 1/3/4/8 but missed the `needs-reproduction` case in Step 3. Add the same existence check so the label is only applied when it already exists in the repository, matching the pattern used for `needs-assessment`, `fix-blocked`, and `fix-proposed`. Note: lock file needs recompiling with `gh aw compile bug-fix` before merge. Assisted-by: GitHub Copilot (model: claude-opus-4-8, autonomous)

Copilot · 2026-07-01T15:45:44Z

Addressed the latest Copilot thread in commit : status labels are now conditional on label existence, and the workflow skips missing labels with an explicit note instead of failing.

@copilot review...

Reviewed the current state of bug-fix.md. One gap found from the previous conditional-label pass: the needs-reproduction case in Step 3 was still unconditionally adding the label, unlike needs-assessment, fix-blocked, and fix-proposed which all received the existence-check treatment. Fixed in the latest commit — Step 3 now reads "If the needs-reproduction label exists in this repository, add it; otherwise skip labeling and note that in the comment."

The lock file needs recompiling with gh aw compile bug-fix before merge (markdown body changed).

Posted on behalf of @BenBtg by GitHub Copilot (model: claude-opus-4-8).

Copilot AI review requested due to automatic review settings June 30, 2026 14:09

Copilot started reviewing on behalf of BenBtg June 30, 2026 14:10 View session

Copilot AI reviewed Jun 30, 2026

View reviewed changes

Comment thread .github/workflows/bug-fix.md Outdated

BenBtg requested a review from Copilot June 30, 2026 14:51

Copilot started reviewing on behalf of BenBtg June 30, 2026 14:52 View session

Copilot AI reviewed Jun 30, 2026

View reviewed changes

Comment thread .github/workflows/bug-fix.md

BenBtg marked this pull request as ready for review June 30, 2026 18:48

BenBtg requested a review from mnriem as a code owner June 30, 2026 18:48

Copilot AI review requested due to automatic review settings June 30, 2026 18:48

Copilot started reviewing on behalf of BenBtg June 30, 2026 18:49 View session

Copilot AI reviewed Jun 30, 2026

BenBtg requested a review from Copilot June 30, 2026 22:25

BenBtg self-assigned this Jun 30, 2026

Copilot started reviewing on behalf of BenBtg June 30, 2026 22:36 View session

Copilot AI reviewed Jun 30, 2026

View reviewed changes

Comment thread .github/workflows/bug-fix.md

Comment thread .github/workflows/bug-fix.md Outdated

Comment thread .github/workflows/bug-fix.md Outdated

Potential fix for pull request finding

ab6717c

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Copilot AI review requested due to automatic review settings June 30, 2026 22:43

BenBtg and others added 2 commits June 30, 2026 23:43

Potential fix for pull request finding

03a1f71

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Potential fix for pull request finding

3c3fcd3

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Copilot started reviewing on behalf of BenBtg June 30, 2026 22:43 View session

Copilot AI reviewed Jun 30, 2026

View reviewed changes

BenBtg requested a review from Copilot June 30, 2026 22:48

Copilot started reviewing on behalf of BenBtg June 30, 2026 22:49 View session

Copilot AI reviewed Jun 30, 2026

View reviewed changes

Comment thread .github/workflows/bug-fix.md Outdated

Comment thread .github/workflows/bug-fix.md Outdated

Potential fix for pull request finding

dc34ad0

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Copilot AI review requested due to automatic review settings June 30, 2026 23:45

Potential fix for pull request finding

2ce55fa

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

BenBtg marked this pull request as draft July 1, 2026 13:41

BenBtg requested a review from Copilot July 1, 2026 13:56

Copilot started reviewing on behalf of BenBtg July 1, 2026 13:56 View session

Copilot AI reviewed Jul 1, 2026

View reviewed changes

Comment thread .github/workflows/bug-fix.md Outdated

BenBtg requested a review from Copilot July 1, 2026 14:15

Copilot started reviewing on behalf of BenBtg July 1, 2026 14:16 View session

Merge origin/main into benbtg-feat-3238-bug-fix-workflow

1ba53c6

Assisted-by: GitHub Copilot (model: Claude Opus 4.8, autonomous)

Copilot AI reviewed Jul 1, 2026

View reviewed changes

Comment thread .github/workflows/bug-fix.md

Copilot AI review requested due to automatic review settings July 1, 2026 14:20

Copilot AI reviewed Jul 1, 2026

BenBtg requested a review from Copilot July 1, 2026 15:21

Copilot started reviewing on behalf of BenBtg July 1, 2026 15:22 View session

Copilot AI reviewed Jul 1, 2026

View reviewed changes

BenBtg marked this pull request as ready for review July 1, 2026 15:28

BenBtg requested a review from Copilot July 1, 2026 15:28

Copilot started reviewing on behalf of BenBtg July 1, 2026 15:28 View session

Copilot AI reviewed Jul 1, 2026

View reviewed changes

Copilot started work on behalf of BenBtg July 1, 2026 15:41 View session

Copilot AI review requested due to automatic review settings July 1, 2026 15:45

BenBtg removed the request for review from Copilot July 1, 2026 15:45

Copilot finished work on behalf of BenBtg July 1, 2026 15:46

Copilot started work on behalf of BenBtg July 1, 2026 15:46 View session

Copilot finished work on behalf of BenBtg July 1, 2026 15:47

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(bug-fix): add label-driven bug-fix agentic workflow#3258

feat(bug-fix): add label-driven bug-fix agentic workflow#3258
BenBtg wants to merge 17 commits into
mainfrom
benbtg-feat-3238-bug-fix-workflow

BenBtg commented Jun 30, 2026 •

edited

Loading

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Copilot AI left a comment

Uh oh!

Uh oh!

BenBtg commented Jul 1, 2026

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Copilot AI left a comment

Copilot AI left a comment

BenBtg commented Jul 1, 2026

BenBtg commented Jul 1, 2026

Copilot AI commented Jul 1, 2026

Labels

4 participants

Uh oh!

Conversation

BenBtg commented Jun 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

What's included

Acceptance criteria

Validation

Deployment note (action required before live use)

Testing notes

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Review details

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot AI left a comment

Choose a reason for hiding this comment

Review details

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Review details

Copilot AI left a comment

Choose a reason for hiding this comment

Review details

Uh oh!

Uh oh!

BenBtg commented Jul 1, 2026

Copilot AI left a comment

Choose a reason for hiding this comment

Review details

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Review details

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot AI left a comment

Choose a reason for hiding this comment

Review details

Copilot AI left a comment

Choose a reason for hiding this comment

Review details

BenBtg commented Jul 1, 2026

BenBtg commented Jul 1, 2026

Copilot AI commented Jul 1, 2026

Labels

4 participants

BenBtg commented Jun 30, 2026 •

edited

Loading