[PR Triage Report] PR Triage Report — 2026-08-01 (Run 30699849911)

[github-actions]

PR Triage Report — github/gh-aw

Run: §30699849911 · Date: 2026-08-01

Triaged 13 open PRs authored by app/github-copilot.

Executive Summary

Metric	Count
Total triaged	13
Drafts	6
Ready for review	7
fast_track	6
batch_review	1
defer	6
auto_merge / close	0

Distribution

By category: bug (7) · feature (3) · docs (1) · chore (1) · refactor (1)
By risk: low (4) · medium (7) · high (1)
By priority: low (2) · medium (10) · high (1)
By action: fast_track (6) · batch_review (1) · defer (6)

Top-Priority PRs

#	Title	Score	Risk	Action
#49450	Escape MCP env secrets to prevent heredoc JSON corruption	83	high	fast_track
#49474	Fix create_pull_request rewrite/push parity	68	medium	fast_track
#49527	Distinct XML marker for threat detection engine errors	68	medium	fast_track
#49451	Honour workflow_dispatch + aw_context in checkout_pr_branch.cjs	66	medium	fast_track
#49477	Allow add-labels to opt out of pull-requests:write	64	medium	fast_track
#49495	Forward timeout-minutes to codex/gemini/pi/antigravity	65	medium	defer (CI blocked)

Auto-Merge Candidates

None this run — no PR met the low-risk + high-quality + CI-passing bar for auto-merge.

Fast-Track Items

6 PRs recommended for expedited review

• fix: escape MCP env secrets with \${VAR} for non-Copilot engines to prevent heredoc JSON corruption #49450 — Secret leakage/JSON-corruption risk in MCP env substitution (high risk, high priority, score 83). Part of safe-outputs-fixes batch.
• Fix create_pull_request rewrite/push parity for excluded files and base drift #49474 — create_pull_request patch/push parity bug. Batch: safe-outputs-fixes.
• fix: use distinct XML marker for threat detection engine errors vs real threats #49527 — Distinguishes tooling failures from real security threats in detection output; copilot CI check passed.
• fix: honour workflow_dispatch + aw_context in checkout_pr_branch.cjs #49451 — Fixes silent checkout skip for workflow_dispatch + aw_context; CI fully green.
• Allow add-labels to opt out of pull-requests: write #49477 — Least-privilege token scoping for add-labels. Batch: safe-outputs-fixes.

Batch Opportunities

safe-outputs-fixes (4 PRs): #49477, #49474, #49451, #49450 — all touch safe-outputs correctness/security paths (labels permissions, PR-push parity, checkout handling, MCP secret handling). Recommend reviewing together as one PR train given shared surface area.

Close Candidates

None — no PRs identified as stale, superseded, or invalid this run.

Key Trends & Next Actions

Details

• 6 of 13 PRs are still drafts with no CI signal yet (fix(schema): add antigravity to engine.id descriptions and examples #49558, fix: correct Squid access.log path and add runtime presence detection #49557, chore: add .github/CODEOWNERS with path-based review routing for security-sensitive paths #49556, refactor: migrate remaining RunGHWithHost call sites to RunGHContextWithHost #49554, Normalize eval outputs to binary YES/NO #49553, fix: target current checkout subdirectory in Configure Git credentials steps #49524) — deferred pending undraft/CI.
• engine: forward timeout-minutes to execution step for codex, gemini, pi, antigravity #49495 has a blocked CI status and a very large diff (180 files, mostly regenerated .lock.yml) — needs investigation before it can be fast-tracked despite fixing a real bug.
• The safe-outputs-fixes batch (4 PRs) represents the highest-value cluster this run and should be prioritized as a group.
• fix: escape MCP env secrets with \${VAR} for non-Copilot engines to prevent heredoc JSON corruption #49450 is the single highest-priority item (score 83) due to a potential secret-corruption/security issue.
• No PRs matched the OpenTelemetry/otel/otlp/telemetry customer-triage rule this run (checked fix: correct Squid access.log path and add runtime presence detection #49557 due to "observability" in its title — it concerns Squid firewall logs, not OpenTelemetry).

Next run: re-check #49495 CI-blocked status, re-check drafts (#49558/49557/49556/49554/49553/49524) for undraft/CI progress, and confirm safe-outputs-fixes batch review outcome.

Generated by 🔧 PR Triage Agent · auto · 49.2 AIC · ⌖ 8.64 AIC · ⊞ 8K · ◷

• expires on Aug 2, 2026, 4:39 AM UTC-08:00

[github-actions]

This issue is being closed as outdated. A newer issue has been created: #49605

View newer issue

---

This action was performed automatically by the PR Triage Agent workflow.