feat(bug-fix): add label-driven bug-fix agentic workflow by BenBtg · Pull Request #3258 · github/spec-kit

BenBtg · 2026-06-30T14:09:51Z

Summary

Adds a bug-fix agentic workflow (gh-aw) as stage 2 of the assess → fix → test bug pipeline, mirroring the existing bug-assess stage. When a maintainer applies the bug-fix label to an issue, the workflow recovers the slug and remediation contract from the prior bug-assess assessment comment, applies the fix, and opens a draft pull request plus a summary comment for human review.

The workflow is intentionally decoupled from Spec Kit specifics: it consumes the assessment from the issue comment rather than any .specify/ files or specify-CLI tooling, so it can be lifted into any repository running the matching bug-assess stage.

What's included

.github/workflows/bug-fix.md — authored markdown workflow, compiled to .github/workflows/bug-fix.lock.yml with gh aw compile (v0.79.8, matching the existing locks).
Label-gated trigger: only runs when the added label is bug-fix (github.event.label.name == 'bug-fix').
Delivery: create-pull-request safe-output opens a draft PR ([bug-fix] prefix, labels bug-fix/automated) plus a single summary comment linking the PR. Uses Refs # (not Closes) since the test stage and human review still follow.
Slug/contract reuse: recovers BUG_SLUG and the remediation/files/tests contract from the bug-assess comment.
No prior assessment → stops and comments asking a maintainer to run bug-assess first (needs-assessment label); never guesses a fix.
Safety: scoped permissions (agent job is read-only; PR creation is isolated), untrusted-input / URL-safety guardrails consistent with bug-assess, minimal-change scope, no destructive commands. Maintainer remains the gatekeeper — no unattended automation.

Acceptance criteria

bug-fix markdown workflow added under .github/workflows/ and compiled to its .lock.yml
Triggered by applying the bug-fix label; gated so it only runs for that label
Generates a fix using shared bug logic, decoupled from Spec Kit specifics
Maintainer remains the gatekeeper; draft PR, no unattended automation
Output (draft PR + comment) posted back to the issue

Validation

gh aw compile bug-fix → 0 errors, 0 warnings
markdownlint-cli2 on bug-fix.md → 0 errors
checkout action pin aligned to v7.0.0 in the lock body to match sibling locks

Deployment note (action required before live use)

The bug-fix trigger label must exist so the issues: labeled event can fire — same as bug-assess. It has been created on this repo (#d93f0b, description "Trigger the bug-fix agentic workflow"). For reference, the equivalent command is:

gh label create bug-fix --repo github/spec-kit \
  --color d93f0b --description "Trigger the bug-fix agentic workflow"

The status labels the workflow applies (needs-assessment, needs-reproduction, fix-proposed, fix-blocked) auto-create on first use via GitHub's add-labels API, so only the trigger label needs pre-creating.

Testing notes

Static + structural validation (done):

gh aw compile bug-fix → 0 errors / 0 warnings; markdownlint-cli2 clean.
The compiled on: trigger block is byte-identical to the already-deployed bug-assess.lock.yml and add-community-extension.lock.yml (issue-only, types: [labeled], label filtering via job condition). Same 7-job structure and permission isolation (read-only agent job; writes via the isolated safe_outputs job).
A gh aw trial install dry-run confirmed the workflow compiles, installs, and becomes ACTIVE in a host repo.

On gh aw trial (why no automated end-to-end run is included): gh aw trial --clone-repo cannot drive an issue-only, label-gated workflow — in clone-repo mode it invokes the workflow_dispatch API, which returns HTTP 422 because this workflow (like its siblings) declares no workflow_dispatch trigger. Adding workflow_dispatch purely for trial-ability was rejected to preserve consistency with bug-assess and to keep the trigger surface tight. The authentic way to exercise it is the live label flow in a sandbox repo: create an issue, post a bug-assess-style assessment comment carrying the slug, then apply the bug-fix label.

If validating in a sandbox, useful workarounds observed during trial install: pass an absolute workflow path; enable host-repo Actions PR-approval permission; use a GitHub-noreply git email (avoids GH007 on push); and --disable-security-scanner (the defensive "ignore previous instructions" text in the Untrusted-Input guardrail trips a false-positive prompt-injection flag).

Refs #3238

This PR was authored by GitHub Copilot (model: Claude Opus 4.8) on behalf of @BenBtg.

Fixes: #3238

Add a `bug-fix` gh-aw workflow as stage 2 of the assess -> fix -> test bug pipeline, mirroring the existing `bug-assess` stage. It triggers when a maintainer applies the `bug-fix` label, recovers the slug and remediation contract from the prior bug-assess assessment comment, applies the fix, and opens a draft pull request plus a summary comment for human review. The workflow is intentionally decoupled from Spec Kit specifics: it consumes the assessment from the issue comment rather than any `.specify/` files, so it is portable to other repositories running the matching bug-assess stage. - .github/workflows/bug-fix.md authored and compiled to bug-fix.lock.yml - Label-gated trigger (github.event.label.name == 'bug-fix') - Draft PR via create-pull-request safe-output; scoped permissions - Untrusted-input / URL-safety guardrails consistent with bug-assess - Maintainer remains the gatekeeper; no unattended automation Refs #3238 Assisted-by: GitHub Copilot (model: Claude Opus 4.8, autonomous) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Adds a new label-driven bug-fix agentic workflow (stage 2 of the assess → fix → test pipeline) that consumes the prior bug-assess issue comment as its contract, applies the proposed remediation, and opens a draft PR plus a single summary comment for maintainer review.

Changes:

Added .github/workflows/bug-fix.md defining the bug-fix stage behavior, guardrails, and safe-outputs (draft PR + comment + status labels).
Added compiled workflow .github/workflows/bug-fix.lock.yml generated via gh aw compile (v0.79.8) for execution in GitHub Actions.

Show a summary per file

File	Description
.github/workflows/bug-fix.md	New authored gh-aw markdown workflow that parses the latest `bug-assess` comment and produces a draft PR + issue comment.
.github/workflows/bug-fix.lock.yml	Generated/locked GitHub Actions workflow corresponding to `bug-fix.md` (pins actions/images, expands guardrails/runtime wiring).

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 1/2 changed files
Comments generated: 1
Review effort level: Low

Copilot

Review details

Files reviewed: 1/2 changed files
Comments generated: 1
Review effort level: Low

Address Copilot review feedback on PR #3258: - Trim tools.bash to the inspect set plus a small test-runner set (pytest, npm, go, cargo, dotnet), dropping package-manager/build tools (pip, npx, pnpm, yarn, mvn, gradle, make, bundle, rake, ruby, node) to reduce blast radius under prompt injection. - Set create-pull-request.protected-files.policy: blocked so edits to sensitive files (dependency manifests, README/CHANGELOG/SECURITY, etc.) block PR creation, matching the stronger contract used by the other PR-creating workflows in this repo. Refs #3238 Assisted-by: GitHub Copilot (model: Claude Opus 4.8, autonomous) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

Copilot

Review details

Files reviewed: 1/2 changed files
Comments generated: 3
Review effort level: Low

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

The Copilot autofix commits edited bug-fix.md (verdict phrasing, Assisted-by trailer) but did not recompile the lock, leaving body_hash stale. Since the workflow runs with strict integrity, the runtime-imported bug-fix.md must match the lock's recorded body_hash. Recompiled with gh-aw v0.79.8 (checkout pin kept at v7.0.0 to match sibling locks); the only change is the body_hash. Assisted-by: GitHub Copilot (model: Claude Opus 4.8, autonomous) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot

Review details

Files reviewed: 1/2 changed files
Comments generated: 0 new
Review effort level: Low

Copilot

Review details

Files reviewed: 1/2 changed files
Comments generated: 2
Review effort level: Low

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Assisted-by: GitHub Copilot (model: Claude Opus 4.8, autonomous)

Copilot

Review details

Files reviewed: 1/2 changed files
Comments generated: 1
Review effort level: Low

Copilot

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

Copilot

Review details

Files reviewed: 1/2 changed files
Comments generated: 0 new
Review effort level: Low

Copilot

Review details

Files reviewed: 1/2 changed files
Comments generated: 0 new
Review effort level: Low

…tence Address Copilot feedback about missing status labels causing runtime failures. The workflow previously instructed unconditional application of `needs-assessment`, `fix-blocked`, and `fix-proposed`. In repositories where those labels are not pre-created, `add_labels` fails and can break the run. Updated Steps 1/3/4/8 to require existence checks before adding those labels: - add the label only if it exists - otherwise skip labeling and explicitly note that in the comment This preserves the status-label UX when labels exist while keeping execution robust in repos that have not created every optional status label yet. Recompiled with gh-aw v0.79.8 and kept checkout v7.0.0 pin fixups. Assisted-by: GitHub Copilot (model: Claude Opus 4.8, autonomous) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

BenBtg · 2026-07-01T15:40:42Z

Addressed the latest Copilot thread in commit : status labels are now conditional on label existence, and the workflow skips missing labels with an explicit note instead of failing.

@copilot review

Posted by GitHub Copilot (model: Claude Opus 4.8) on behalf of @BenBtg.

BenBtg · 2026-07-01T15:40:57Z

Addressed the latest Copilot thread in commit 193f440: status labels are now conditional on label existence, and the workflow skips missing labels with an explicit note instead of failing.

@copilot review

Posted by GitHub Copilot (model: Claude Opus 4.8) on behalf of @BenBtg.

The previous conditional-label pass updated Steps 1/3/4/8 but missed the `needs-reproduction` case in Step 3. Add the same existence check so the label is only applied when it already exists in the repository, matching the pattern used for `needs-assessment`, `fix-blocked`, and `fix-proposed`. Note: lock file needs recompiling with `gh aw compile bug-fix` before merge. Assisted-by: GitHub Copilot (model: claude-opus-4-8, autonomous)

Copilot · 2026-07-01T15:45:44Z

Addressed the latest Copilot thread in commit : status labels are now conditional on label existence, and the workflow skips missing labels with an explicit note instead of failing.

@copilot review...

Reviewed the current state of bug-fix.md. One gap found from the previous conditional-label pass: the needs-reproduction case in Step 3 was still unconditionally adding the label, unlike needs-assessment, fix-blocked, and fix-proposed which all received the existence-check treatment. Fixed in the latest commit — Step 3 now reads "If the needs-reproduction label exists in this repository, add it; otherwise skip labeling and note that in the comment."

The lock file needs recompiling with gh aw compile bug-fix before merge (markdown body changed).

Posted on behalf of @BenBtg by GitHub Copilot (model: claude-opus-4-8).

Copilot

Review details

Files reviewed: 1/2 changed files
Comments generated: 0 new
Review effort level: Low

Copilot

Review details

Files reviewed: 1/2 changed files
Comments generated: 0 new
Review effort level: Low

Copilot AI review requested due to automatic review settings June 30, 2026 14:09

Copilot started reviewing on behalf of BenBtg June 30, 2026 14:10 View session

Copilot AI reviewed Jun 30, 2026

View reviewed changes

Comment thread .github/workflows/bug-fix.md Outdated

BenBtg requested a review from Copilot June 30, 2026 14:51

Copilot started reviewing on behalf of BenBtg June 30, 2026 14:52 View session

Copilot AI reviewed Jun 30, 2026

View reviewed changes

Comment thread .github/workflows/bug-fix.md

BenBtg marked this pull request as ready for review June 30, 2026 18:48

BenBtg requested a review from mnriem as a code owner June 30, 2026 18:48

Copilot AI review requested due to automatic review settings June 30, 2026 18:48

Copilot started reviewing on behalf of BenBtg June 30, 2026 18:49 View session

Copilot AI reviewed Jun 30, 2026

BenBtg requested a review from Copilot June 30, 2026 22:25

BenBtg self-assigned this Jun 30, 2026

Copilot started reviewing on behalf of BenBtg June 30, 2026 22:36 View session

Copilot AI reviewed Jun 30, 2026

View reviewed changes

Comment thread .github/workflows/bug-fix.md

Comment thread .github/workflows/bug-fix.md Outdated

Comment thread .github/workflows/bug-fix.md Outdated

Potential fix for pull request finding

ab6717c

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Copilot AI review requested due to automatic review settings June 30, 2026 22:43

BenBtg and others added 2 commits June 30, 2026 23:43

Potential fix for pull request finding

03a1f71

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Potential fix for pull request finding

3c3fcd3

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Copilot started reviewing on behalf of BenBtg June 30, 2026 22:43 View session

Copilot AI reviewed Jun 30, 2026

View reviewed changes

BenBtg requested a review from Copilot June 30, 2026 22:48

Copilot started reviewing on behalf of BenBtg June 30, 2026 22:49 View session

Copilot AI reviewed Jun 30, 2026

View reviewed changes

Comment thread .github/workflows/bug-fix.md Outdated

Comment thread .github/workflows/bug-fix.md Outdated

Potential fix for pull request finding

dc34ad0

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Copilot AI review requested due to automatic review settings June 30, 2026 23:45

Potential fix for pull request finding

2ce55fa

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Copilot started reviewing on behalf of BenBtg July 1, 2026 14:16 View session

Merge origin/main into benbtg-feat-3238-bug-fix-workflow

1ba53c6

Assisted-by: GitHub Copilot (model: Claude Opus 4.8, autonomous)

Copilot AI reviewed Jul 1, 2026

View reviewed changes

Comment thread .github/workflows/bug-fix.md

Copilot AI review requested due to automatic review settings July 1, 2026 14:20

Copilot AI reviewed Jul 1, 2026

BenBtg requested a review from Copilot July 1, 2026 15:21

Copilot started reviewing on behalf of BenBtg July 1, 2026 15:22 View session

Copilot AI reviewed Jul 1, 2026

View reviewed changes

BenBtg marked this pull request as ready for review July 1, 2026 15:28

BenBtg requested a review from Copilot July 1, 2026 15:28

Copilot started reviewing on behalf of BenBtg July 1, 2026 15:28 View session

Copilot AI reviewed Jul 1, 2026

View reviewed changes

Copilot started work on behalf of BenBtg July 1, 2026 15:41 View session

Copilot AI review requested due to automatic review settings July 1, 2026 15:45

BenBtg removed the request for review from Copilot July 1, 2026 15:45

Copilot finished work on behalf of BenBtg July 1, 2026 15:46

Copilot started work on behalf of BenBtg July 1, 2026 15:46 View session

Copilot finished work on behalf of BenBtg July 1, 2026 15:47

mnriem requested a review from Copilot July 1, 2026 16:59

Copilot started reviewing on behalf of mnriem July 1, 2026 17:00 View session

Copilot AI reviewed Jul 1, 2026

View reviewed changes

BenBtg requested a review from Copilot July 1, 2026 17:15

Copilot started reviewing on behalf of BenBtg July 1, 2026 17:15 View session

Copilot AI reviewed Jul 1, 2026

View reviewed changes

BenBtg merged commit c34a505 into main Jul 1, 2026
16 checks passed

Uh oh!

Conversation

BenBtg commented Jun 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

What's included

Acceptance criteria

Validation

Deployment note (action required before live use)

Testing notes

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Review details

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Review details

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Review details

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Review details

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Review details

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Review details

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Review details

Uh oh!

BenBtg commented Jul 1, 2026

Uh oh!

BenBtg commented Jul 1, 2026

Uh oh!

Copilot AI commented Jul 1, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Review details

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Review details

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

BenBtg commented Jun 30, 2026 •

edited

Loading