3
0
Fork 0
mirror of https://github.com/Z3Prover/z3 synced 2026-08-02 20:23:27 +00:00

Route Clang-Tidy Warning Fixer to report-run artifacts and issue-based diff proposals (#10350)

This updates the Clang-Tidy Warning Fixer to run after
`clang-tidy-warning-report.yml` completes, consume that run’s warning
artifacts, and produce assignment-ready fix proposals as GitHub issues.
It replaces the previous self-build/PR-creation flow with
artifact-driven analysis and diff-first issue output.

- **Trigger + execution model**
- Switched workflow trigger from scheduled standalone runs to
`workflow_run` on **Clang-Tidy Warning Report** completion (with manual
dispatch retained).
- Keeps fixer analysis scoped to diagnostics from the originating report
run.

- **Artifact-driven diagnostics input**
  - Removed in-fixer prebuild/clang-tidy compilation step.
- Updated agent instructions to resolve source run ID, list/download the
warning artifact, extract logs, and analyze
`warnings.txt`/`combined.log` from that artifact.

- **Output contract: PR → Issue**
- Replaced safe output target from `create-pull-request` to
`create-issue`.
  - Issue content now requires:
    - warning summary,
    - skipped-warning rationale,
    - proposed fixes as full unified diffs,
    - assignment-ready checklist entries.

- **Workflow/runtime alignment**
  - Regenerated lockfile to match source workflow changes.
- Added Actions toolset/permissions needed for run/artifact retrieval in
the agent runtime.

```yaml
on:
  workflow_run:
    workflows: ["Clang-Tidy Warning Report"]
    types: [completed]
    branches: [master]
```

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
This commit is contained in:
Copilot 2026-08-01 13:02:16 -07:00 committed by GitHub
parent 94825a132e
commit 373dbb2633
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 117 additions and 180 deletions

View file

@ -1,5 +1,5 @@
# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"00e3e90ad443f3bdf1e1d64cfde76a1a99e664033ebdb1c9632209f80a76c70a","body_hash":"849ec2c9cf00feb97d4bec3c03bff1e8ffe720f5f93d3a4c8e87fccee54656db","compiler_version":"v0.83.4","strict":true,"agent_id":"copilot","engine_versions":{"copilot":"1.0.75"}}
# gh-aw-manifest: {"version":1,"secrets":["COPILOT_GITHUB_TOKEN","GH_AW_CI_TRIGGER_TOKEN","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/cache/restore","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/cache/save","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/checkout","sha":"3d3c42e5aac5ba805825da76410c181273ba90b1","version":"v7.0.1"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"820762786026740c76f36085b0efc47a31fe5020","version":"v7.0.0"},{"repo":"actions/setup-python","sha":"5fda3b95a4ea91299a34e894583c3862153e4b97","version":"v7.0.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"},{"repo":"github/gh-aw-actions/setup","sha":"v0.83.4","version":"v0.83.4"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.27.42","digest":"sha256:26a8af4e5566485b02f52af59ee03803ae798271a9619d4767e94d07806deb9b","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.27.42@sha256:26a8af4e5566485b02f52af59ee03803ae798271a9619d4767e94d07806deb9b"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.42","digest":"sha256:944f2686c9ab9bec338fd14b662461662f77cd12cd0ea8a3e7cb8c0987cd1607","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.42@sha256:944f2686c9ab9bec338fd14b662461662f77cd12cd0ea8a3e7cb8c0987cd1607"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.27.42","digest":"sha256:42dfeb649c680a8558cd5423dbc530b653a69413e35ffbe5e71da5d48c94bdf0","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.27.42@sha256:42dfeb649c680a8558cd5423dbc530b653a69413e35ffbe5e71da5d48c94bdf0"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.4.6","digest":"sha256:fecabec51bbc41f2ad61076d6bcd9a36ef23b142e672a444e054d37fc29de93c","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.4.6@sha256:fecabec51bbc41f2ad61076d6bcd9a36ef23b142e672a444e054d37fc29de93c"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:a8082161d7dceda14b68f32eb39d0eaa96b825d07f5895b096afab9d9e0c7748","pinned_image":"ghcr.io/github/gh-aw-node@sha256:a8082161d7dceda14b68f32eb39d0eaa96b825d07f5895b096afab9d9e0c7748"},{"image":"ghcr.io/github/github-mcp-server:v1.7.0","digest":"sha256:c491ffdf6f4c85cb5397021bc655edb8ab825c6f5f568e7597d77a1bd7c4d308","pinned_image":"ghcr.io/github/github-mcp-server:v1.7.0@sha256:c491ffdf6f4c85cb5397021bc655edb8ab825c6f5f568e7597d77a1bd7c4d308"}]}
# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"e7e8802235cbafe4d90c2bc2ff1a4facdcf1ee7fb168c73863e34958a1ee42d4","body_hash":"cc7079a34a6d232ac3a85711db4b44eacde3dc50aa01fc5afe20407347f96f17","compiler_version":"v0.83.4","strict":true,"agent_id":"copilot","engine_versions":{"copilot":"1.0.75"}}
# gh-aw-manifest: {"version":1,"secrets":["COPILOT_GITHUB_TOKEN","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/cache/restore","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/cache/save","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/checkout","sha":"3d3c42e5aac5ba805825da76410c181273ba90b1","version":"v7.0.1"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"820762786026740c76f36085b0efc47a31fe5020","version":"v7.0.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"},{"repo":"github/gh-aw-actions/setup","sha":"v0.83.4","version":"v0.83.4"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.27.42","digest":"sha256:26a8af4e5566485b02f52af59ee03803ae798271a9619d4767e94d07806deb9b","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.27.42@sha256:26a8af4e5566485b02f52af59ee03803ae798271a9619d4767e94d07806deb9b"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.42","digest":"sha256:944f2686c9ab9bec338fd14b662461662f77cd12cd0ea8a3e7cb8c0987cd1607","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.42@sha256:944f2686c9ab9bec338fd14b662461662f77cd12cd0ea8a3e7cb8c0987cd1607"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.27.42","digest":"sha256:42dfeb649c680a8558cd5423dbc530b653a69413e35ffbe5e71da5d48c94bdf0","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.27.42@sha256:42dfeb649c680a8558cd5423dbc530b653a69413e35ffbe5e71da5d48c94bdf0"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.4.6","digest":"sha256:fecabec51bbc41f2ad61076d6bcd9a36ef23b142e672a444e054d37fc29de93c","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.4.6@sha256:fecabec51bbc41f2ad61076d6bcd9a36ef23b142e672a444e054d37fc29de93c"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:a8082161d7dceda14b68f32eb39d0eaa96b825d07f5895b096afab9d9e0c7748","pinned_image":"ghcr.io/github/gh-aw-node@sha256:a8082161d7dceda14b68f32eb39d0eaa96b825d07f5895b096afab9d9e0c7748"},{"image":"ghcr.io/github/github-mcp-server:v1.7.0","digest":"sha256:c491ffdf6f4c85cb5397021bc655edb8ab825c6f5f568e7597d77a1bd7c4d308","pinned_image":"ghcr.io/github/github-mcp-server:v1.7.0@sha256:c491ffdf6f4c85cb5397021bc655edb8ab825c6f5f568e7597d77a1bd7c4d308"}]}
# This file was automatically generated by gh-aw (v0.83.4). DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md
#
# ___ _ _
@ -23,11 +23,10 @@
#
# For more information: https://github.github.com/gh-aw/introduction/overview/
#
# Compiles Z3 with clang-tidy, analyzes build warnings and errors, and creates PRs with safe fixes
# Analyzes clang-tidy warning artifacts and files GitHub issues with proposed fixes as git diffs
#
# Secrets used:
# - COPILOT_GITHUB_TOKEN
# - GH_AW_CI_TRIGGER_TOKEN
# - GH_AW_GITHUB_MCP_SERVER_TOKEN
# - GH_AW_GITHUB_TOKEN
# - GITHUB_TOKEN
@ -40,7 +39,6 @@
# - actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
# - actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 (source v9)
# - actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
# - actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
# - actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
# - github/gh-aw-actions/setup@v0.83.4
#
@ -54,8 +52,6 @@
name: "Clang-Tidy Warning Fixer"
on:
schedule:
- cron: "9 21 * * *" # Friendly format: daily (scattered)
# skip-if-match: is:pr is:open in:title "[clang-tidy]" # Skip-if-match processed as search check in pre-activation job
workflow_dispatch:
inputs:
@ -64,6 +60,14 @@ on:
description: "Agent caller context (used internally by Agentic Workflows)."
required: false
type: string
workflow_run:
# zizmor: ignore[dangerous-triggers] - workflow_run trigger is secured with role and fork validation
branches:
- master
types:
- completed
workflows:
- Clang-Tidy Warning Report
permissions: {}
@ -75,7 +79,10 @@ run-name: "Clang-Tidy Warning Fixer"
jobs:
activation:
needs: pre_activation
if: needs.pre_activation.outputs.activated == 'true'
# zizmor: ignore[dangerous-triggers] - workflow_run trigger is secured with role and fork validation
if: >
(needs.pre_activation.outputs.activated == 'true') && (github.event_name != 'workflow_run' || github.event.workflow_run.repository.id == github.repository_id &&
(!(github.event.workflow_run.repository.fork)))
runs-on: ubuntu-slim
permissions:
actions: read
@ -245,6 +252,7 @@ jobs:
GH_AW_EXPR_802A9F6A: ${{ github.event.issue.number || (fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_type == 'issue' && fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_number) }}
GH_AW_EXPR_FF1D34CE: ${{ github.event.comment.id || fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').comment_id }}
GH_AW_GITHUB_ACTOR: ${{ github.actor }}
GH_AW_GITHUB_EVENT_WORKFLOW_RUN_ID: ${{ github.event.workflow_run.id }}
GH_AW_GITHUB_REPOSITORY: ${{ github.repository }}
GH_AW_GITHUB_RUN_ID: ${{ github.run_id }}
GH_AW_GITHUB_WORKFLOW: ${{ github.workflow }}
@ -253,23 +261,20 @@ jobs:
run: |
bash "${RUNNER_TEMP}/gh-aw/actions/create_prompt_first.sh"
{
cat << 'GH_AW_PROMPT_a12b000ae128b391_EOF'
cat << 'GH_AW_PROMPT_ed9e3b37a434eff3_EOF'
<system>
GH_AW_PROMPT_a12b000ae128b391_EOF
GH_AW_PROMPT_ed9e3b37a434eff3_EOF
cat "${RUNNER_TEMP}/gh-aw/prompts/xpia.md"
cat "${RUNNER_TEMP}/gh-aw/prompts/temp_folder_prompt.md"
cat "${RUNNER_TEMP}/gh-aw/prompts/markdown.md"
cat "${RUNNER_TEMP}/gh-aw/prompts/safe_outputs_prompt.md"
cat << 'GH_AW_PROMPT_a12b000ae128b391_EOF'
cat << 'GH_AW_PROMPT_ed9e3b37a434eff3_EOF'
<safe-output-tools>
Tools: create_pull_request, missing_tool, missing_data, noop
GH_AW_PROMPT_a12b000ae128b391_EOF
cat "${RUNNER_TEMP}/gh-aw/prompts/safe_outputs_create_pull_request.md"
cat << 'GH_AW_PROMPT_a12b000ae128b391_EOF'
Tools: create_issue, missing_tool, missing_data, noop
</safe-output-tools>
GH_AW_PROMPT_a12b000ae128b391_EOF
GH_AW_PROMPT_ed9e3b37a434eff3_EOF
cat "${RUNNER_TEMP}/gh-aw/prompts/mcp_cli_tools_prompt.md"
cat << 'GH_AW_PROMPT_a12b000ae128b391_EOF'
cat << 'GH_AW_PROMPT_ed9e3b37a434eff3_EOF'
<github-context>
The following GitHub context information is available for this workflow:
{{#if github.actor}}
@ -298,18 +303,19 @@ jobs:
{{/if}}
</github-context>
GH_AW_PROMPT_a12b000ae128b391_EOF
GH_AW_PROMPT_ed9e3b37a434eff3_EOF
cat "${RUNNER_TEMP}/gh-aw/prompts/github_mcp_tools_with_safeoutputs_prompt.md"
cat << 'GH_AW_PROMPT_a12b000ae128b391_EOF'
cat << 'GH_AW_PROMPT_ed9e3b37a434eff3_EOF'
</system>
{{#runtime-import .github/workflows/build-warning-fixer.md}}
GH_AW_PROMPT_a12b000ae128b391_EOF
GH_AW_PROMPT_ed9e3b37a434eff3_EOF
} > "$GH_AW_PROMPT"
- name: Interpolate variables and render templates
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
env:
GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
GH_AW_ENGINE_ID: "copilot"
GH_AW_GITHUB_EVENT_WORKFLOW_RUN_ID: ${{ github.event.workflow_run.id }}
GH_AW_GITHUB_REPOSITORY: ${{ github.repository }}
GH_AW_GITHUB_WORKFLOW: ${{ github.workflow }}
GH_AW_GITHUB_WORKSPACE: ${{ github.workspace }}
@ -328,6 +334,7 @@ jobs:
GH_AW_EXPR_802A9F6A: ${{ github.event.issue.number || (fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_type == 'issue' && fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_number) }}
GH_AW_EXPR_FF1D34CE: ${{ github.event.comment.id || fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').comment_id }}
GH_AW_GITHUB_ACTOR: ${{ github.actor }}
GH_AW_GITHUB_EVENT_WORKFLOW_RUN_ID: ${{ github.event.workflow_run.id }}
GH_AW_GITHUB_REPOSITORY: ${{ github.repository }}
GH_AW_GITHUB_RUN_ID: ${{ github.run_id }}
GH_AW_GITHUB_WORKFLOW: ${{ github.workflow }}
@ -350,6 +357,7 @@ jobs:
GH_AW_EXPR_802A9F6A: process.env.GH_AW_EXPR_802A9F6A,
GH_AW_EXPR_FF1D34CE: process.env.GH_AW_EXPR_FF1D34CE,
GH_AW_GITHUB_ACTOR: process.env.GH_AW_GITHUB_ACTOR,
GH_AW_GITHUB_EVENT_WORKFLOW_RUN_ID: process.env.GH_AW_GITHUB_EVENT_WORKFLOW_RUN_ID,
GH_AW_GITHUB_REPOSITORY: process.env.GH_AW_GITHUB_REPOSITORY,
GH_AW_GITHUB_RUN_ID: process.env.GH_AW_GITHUB_RUN_ID,
GH_AW_GITHUB_WORKFLOW: process.env.GH_AW_GITHUB_WORKFLOW,
@ -392,6 +400,7 @@ jobs:
if: needs.activation.outputs.daily_ai_credits_exceeded != 'true'
runs-on: ubuntu-latest
permissions:
actions: read
contents: read
copilot-requests: write
issues: read
@ -465,13 +474,6 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- name: Setup Python
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
with:
python-version: '3.12'
- name: Prebuild and collect clang diagnostics
run: "set -o pipefail\nmkdir -p /tmp/gh-aw/agent\n\nmissing_tools=0\ncommand -v clang >/dev/null 2>&1 || missing_tools=1\ncommand -v clang-tidy >/dev/null 2>&1 || missing_tools=1\ncommand -v cmake >/dev/null 2>&1 || missing_tools=1\ncommand -v ninja >/dev/null 2>&1 || missing_tools=1\ncommand -v python3 >/dev/null 2>&1 || missing_tools=1\nif [ \"$missing_tools\" -eq 1 ]; then\n sudo apt-get update -y\n sudo apt-get install -y clang clang-tidy cmake ninja-build python3\nfi\n\nrm -rf build\n\nconfigure_status=0\nbuild_status=0\n\nCC=clang CXX=clang++ cmake -GNinja -S . -B build \\\n -DCMAKE_BUILD_TYPE=Debug \\\n -DCMAKE_EXPORT_COMPILE_COMMANDS=ON \\\n -DCMAKE_CXX_CLANG_TIDY=clang-tidy \\\n 2>&1 | tee /tmp/gh-aw/agent/clang-tidy-configure.log || configure_status=$?\n\nif [ \"$configure_status\" -eq 0 ]; then\n cmake --build build --target shell test-z3 -k 0 \\\n 2>&1 | tee /tmp/gh-aw/agent/clang-tidy-build.log || build_status=$?\nelse\n printf 'configure failed; build skipped\\n' | tee /tmp/gh-aw/agent/clang-tidy-build.log\n build_status=125\nfi\n\ngrep -nE 'warning:|error:|clang-tidy' /tmp/gh-aw/agent/clang-tidy-build.log \\\n > /tmp/gh-aw/agent/clang-tidy-diagnostics.txt || true\n\n{\n echo \"configure_status=$configure_status\"\n echo \"build_status=$build_status\"\n} > /tmp/gh-aw/agent/prebuild-status.txt\n"
shell: bash
- name: Configure Git credentials
env:
@ -531,43 +533,33 @@ jobs:
mkdir -p "${RUNNER_TEMP}/gh-aw/safeoutputs"
mkdir -p /tmp/gh-aw/safeoutputs
mkdir -p /tmp/gh-aw/mcp-logs/safeoutputs
cat > "${RUNNER_TEMP}/gh-aw/safeoutputs/config.json" << 'GH_AW_SAFE_OUTPUTS_CONFIG_7961ea29efc7290e_EOF'
{"create_pull_request":{"expires":24,"if_no_changes":"ignore","labels":["code-quality","clang-tidy","automation"],"max":1,"max_patch_files":100,"max_patch_size":4096,"protect_top_level_dot_folders":true,"protected_files":["package.json","bun.lockb","bunfig.toml","deno.json","deno.jsonc","deno.lock","global.json","NuGet.Config","Directory.Packages.props","mix.exs","mix.lock","go.mod","go.sum","stack.yaml","stack.yaml.lock","pom.xml","build.gradle","build.gradle.kts","settings.gradle","settings.gradle.kts","gradle.properties","package-lock.json","yarn.lock","pnpm-lock.yaml","npm-shrinkwrap.json","requirements.txt","Pipfile","Pipfile.lock","pyproject.toml","setup.py","setup.cfg","Gemfile","Gemfile.lock","uv.lock","CODEOWNERS","DESIGN.md","README.md","CONTRIBUTING.md","CHANGELOG.md","SECURITY.md","CODE_OF_CONDUCT.md","AGENTS.md","CLAUDE.md","GEMINI.md"],"protected_files_policy":"request_review","reviewers":["copilot"],"title_prefix":"[clang-tidy] "},"create_report_incomplete_issue":{},"missing_data":{},"missing_tool":{},"noop":{"max":1,"report-as-issue":"false"},"report_incomplete":{}}
GH_AW_SAFE_OUTPUTS_CONFIG_7961ea29efc7290e_EOF
cat > "${RUNNER_TEMP}/gh-aw/safeoutputs/config.json" << 'GH_AW_SAFE_OUTPUTS_CONFIG_84c85a1abf33a97b_EOF'
{"create_issue":{"labels":["code-quality","clang-tidy","automation"],"max":1,"title_prefix":"[clang-tidy] "},"create_report_incomplete_issue":{},"missing_data":{},"missing_tool":{},"noop":{"max":1,"report-as-issue":"false"},"report_incomplete":{}}
GH_AW_SAFE_OUTPUTS_CONFIG_84c85a1abf33a97b_EOF
- name: Generate Safe Outputs Tools
env:
GH_AW_TOOLS_META_JSON: |
{
"description_suffixes": {
"create_pull_request": " CONSTRAINTS: Maximum 1 pull request(s) can be created. Title will be prefixed with \"[clang-tidy] \". Labels [\"code-quality\" \"clang-tidy\" \"automation\"] will be automatically added. Reviewers [\"copilot\"] will be assigned."
"create_issue": " CONSTRAINTS: Maximum 1 issue(s) can be created. Title will be prefixed with \"[clang-tidy] \". Labels [\"code-quality\" \"clang-tidy\" \"automation\"] will be automatically added."
},
"repo_params": {},
"dynamic_tools": []
}
GH_AW_VALIDATION_JSON: |
{
"create_pull_request": {
"create_issue": {
"defaultMax": 1,
"fields": {
"base": {
"type": "string",
"sanitize": true,
"maxLength": 128
},
"body": {
"required": true,
"type": "string",
"sanitize": true,
"maxLength": 65000
"maxLength": 65000,
"minLength": 20
},
"branch": {
"required": true,
"type": "string",
"sanitize": true,
"maxLength": 256
},
"draft": {
"type": "boolean"
"fields": {
"type": "array"
},
"labels": {
"type": "array",
@ -575,10 +567,16 @@ jobs:
"itemSanitize": true,
"itemMaxLength": 128
},
"parent": {
"issueOrPRNumber": true
},
"repo": {
"type": "string",
"maxLength": 256
},
"temporary_id": {
"type": "string"
},
"title": {
"required": true,
"type": "string",
@ -703,7 +701,7 @@ jobs:
mkdir -p "$HOME/.copilot"
GH_AW_NODE=$(which node 2>/dev/null || command -v node 2>/dev/null || echo node)
cat << GH_AW_MCP_CONFIG_4dd92588edb04041_EOF | "$GH_AW_NODE" "${RUNNER_TEMP}/gh-aw/actions/start_mcp_gateway.cjs"
cat << GH_AW_MCP_CONFIG_bcbb445f12830b86_EOF | "$GH_AW_NODE" "${RUNNER_TEMP}/gh-aw/actions/start_mcp_gateway.cjs"
{
"mcpServers": {
"github": {
@ -714,7 +712,7 @@ jobs:
"GITHUB_HOST": "${GITHUB_SERVER_URL}",
"GITHUB_PERSONAL_ACCESS_TOKEN": "${GITHUB_MCP_SERVER_TOKEN}",
"GITHUB_READ_ONLY": "1",
"GITHUB_TOOLSETS": "context,repos,issues,pull_requests"
"GITHUB_TOOLSETS": "context,repos,issues,pull_requests,actions"
},
"guard-policies": {
"allow-only": {
@ -765,7 +763,7 @@ jobs:
"startupTimeout": 120
}
}
GH_AW_MCP_CONFIG_4dd92588edb04041_EOF
GH_AW_MCP_CONFIG_bcbb445f12830b86_EOF
- name: Mount MCP servers as CLIs
id: mount-mcp-clis
continue-on-error: true
@ -1010,9 +1008,8 @@ jobs:
needs.activation.outputs.daily_ai_credits_exceeded == 'true')
runs-on: ubuntu-slim
permissions:
contents: write
contents: read
issues: write
pull-requests: write
concurrency:
group: "gh-aw-conclusion-build-warning-fixer"
cancel-in-progress: false
@ -1246,8 +1243,6 @@ jobs:
GH_AW_MODEL_NOT_SUPPORTED_ERROR: ${{ needs.agent.outputs.model_not_supported_error }}
GH_AW_HTTP_400_RESPONSE_ERROR: ${{ needs.agent.outputs.http_400_response_error }}
GH_AW_ENGINE_API_HOSTS: "api.enterprise.githubcopilot.com,api.githubcopilot.com,api.business.githubcopilot.com,api.individual.githubcopilot.com"
GH_AW_CODE_PUSH_FAILURE_ERRORS: ${{ needs.safe_outputs.outputs.code_push_failure_errors }}
GH_AW_CODE_PUSH_FAILURE_COUNT: ${{ needs.safe_outputs.outputs.code_push_failure_count }}
GH_AW_LOCKDOWN_CHECK_FAILED: ${{ needs.activation.outputs.lockdown_check_failed }}
GH_AW_OAUTH_TOKEN_CHECK_FAILED: ${{ needs.activation.outputs.oauth_token_check_failed }}
GH_AW_STALE_LOCK_FILE_FAILED: ${{ needs.activation.outputs.stale_lock_file_failed }}
@ -1367,7 +1362,7 @@ jobs:
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
env:
WORKFLOW_NAME: "Clang-Tidy Warning Fixer"
WORKFLOW_DESCRIPTION: "Compiles Z3 with clang-tidy, analyzes build warnings and errors, and creates PRs with safe fixes"
WORKFLOW_DESCRIPTION: "Analyzes clang-tidy warning artifacts and files GitHub issues with proposed fixes as git diffs"
HAS_PATCH: ${{ needs.agent.outputs.has_patch }}
with:
script: |
@ -1570,9 +1565,8 @@ jobs:
if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
runs-on: ubuntu-slim
permissions:
contents: write
contents: read
issues: write
pull-requests: write
timeout-minutes: 45
env:
GH_AW_AGENT_AIC: ${{ needs.agent.outputs.aic }}
@ -1596,8 +1590,8 @@ jobs:
code_push_failure_errors: ${{ steps.process_safe_outputs.outputs.code_push_failure_errors }}
create_discussion_error_count: ${{ steps.process_safe_outputs.outputs.create_discussion_error_count }}
create_discussion_errors: ${{ steps.process_safe_outputs.outputs.create_discussion_errors }}
created_pr_number: ${{ steps.process_safe_outputs.outputs.created_pr_number }}
created_pr_url: ${{ steps.process_safe_outputs.outputs.created_pr_url }}
created_issue_number: ${{ steps.process_safe_outputs.outputs.created_issue_number }}
created_issue_url: ${{ steps.process_safe_outputs.outputs.created_issue_url }}
process_safe_outputs_processed_count: ${{ steps.process_safe_outputs.outputs.processed_count }}
process_safe_outputs_temporary_id_map: ${{ steps.process_safe_outputs.outputs.temporary_id_map }}
steps:
@ -1629,25 +1623,6 @@ jobs:
mkdir -p /tmp/gh-aw/
find "/tmp/gh-aw/" -type f -print
echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT"
- name: Download patch artifact
continue-on-error: true
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
name: agent
path: /tmp/gh-aw/
- name: Checkout repository
if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: true
token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
- name: Configure Git credentials
if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
env:
GITHUB_REPOSITORY: ${{ github.repository }}
GITHUB_SERVER_URL: ${{ github.server_url }}
GIT_TOKEN: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
run: bash "${RUNNER_TEMP}/gh-aw/actions/configure_git_credentials.sh"
- name: Configure GH_HOST for enterprise compatibility
id: ghes-host-config
shell: bash
@ -1666,8 +1641,7 @@ jobs:
GH_AW_ALLOWED_DOMAINS: "api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,github.com,host.docker.internal,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,ppa.launchpad.net,raw.githubusercontent.com,registry.npmjs.org,s.symcb.com,s.symcd.com,security.ubuntu.com,telemetry.enterprise.githubcopilot.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com,www.googleapis.com"
GITHUB_SERVER_URL: ${{ github.server_url }}
GITHUB_API_URL: ${{ github.api_url }}
GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"create_pull_request\":{\"expires\":24,\"if_no_changes\":\"ignore\",\"labels\":[\"code-quality\",\"clang-tidy\",\"automation\"],\"max\":1,\"max_patch_files\":100,\"max_patch_size\":4096,\"protect_top_level_dot_folders\":true,\"protected_files\":[\"package.json\",\"bun.lockb\",\"bunfig.toml\",\"deno.json\",\"deno.jsonc\",\"deno.lock\",\"global.json\",\"NuGet.Config\",\"Directory.Packages.props\",\"mix.exs\",\"mix.lock\",\"go.mod\",\"go.sum\",\"stack.yaml\",\"stack.yaml.lock\",\"pom.xml\",\"build.gradle\",\"build.gradle.kts\",\"settings.gradle\",\"settings.gradle.kts\",\"gradle.properties\",\"package-lock.json\",\"yarn.lock\",\"pnpm-lock.yaml\",\"npm-shrinkwrap.json\",\"requirements.txt\",\"Pipfile\",\"Pipfile.lock\",\"pyproject.toml\",\"setup.py\",\"setup.cfg\",\"Gemfile\",\"Gemfile.lock\",\"uv.lock\",\"CODEOWNERS\",\"DESIGN.md\",\"README.md\",\"CONTRIBUTING.md\",\"CHANGELOG.md\",\"SECURITY.md\",\"CODE_OF_CONDUCT.md\",\"AGENTS.md\",\"CLAUDE.md\",\"GEMINI.md\"],\"protected_files_policy\":\"request_review\",\"reviewers\":[\"copilot\"],\"title_prefix\":\"[clang-tidy] \"},\"create_report_incomplete_issue\":{},\"missing_data\":{},\"missing_tool\":{},\"noop\":{\"max\":1,\"report-as-issue\":\"false\"},\"report_incomplete\":{}}"
GH_AW_CI_TRIGGER_TOKEN: ${{ secrets.GH_AW_CI_TRIGGER_TOKEN }}
GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"create_issue\":{\"labels\":[\"code-quality\",\"clang-tidy\",\"automation\"],\"max\":1,\"title_prefix\":\"[clang-tidy] \"},\"create_report_incomplete_issue\":{},\"missing_data\":{},\"missing_tool\":{},\"noop\":{\"max\":1,\"report-as-issue\":\"false\"},\"report_incomplete\":{}}"
with:
github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
script: |

View file

@ -1,11 +1,16 @@
---
name: Clang-Tidy Warning Fixer
description: Compiles Z3 with clang-tidy, analyzes build warnings and errors, and creates PRs with safe fixes
description: Analyzes clang-tidy warning artifacts and files GitHub issues with proposed fixes as git diffs
on:
schedule: daily
workflow_run:
workflows: ["Clang-Tidy Warning Report"]
types: [completed]
branches:
- master
workflow_dispatch:
skip-if-match: 'is:pr is:open in:title "[clang-tidy]"'
permissions:
actions: read
contents: read
issues: read
pull-requests: read
@ -13,12 +18,10 @@ permissions:
tracker-id: clang-tidy-warning-fixer
safe-outputs:
report-failure-as-issue: false
create-pull-request:
create-issue:
title-prefix: "[clang-tidy] "
labels: [code-quality, clang-tidy, automation]
reviewers: [copilot]
expires: 1d
if-no-changes: ignore
max: 1
missing-tool:
create-issue: true
noop:
@ -26,7 +29,7 @@ safe-outputs:
network: defaults
tools:
github:
toolsets: [default]
toolsets: [default, actions]
bash: [":*"]
timeout-minutes: 90
strict: true
@ -37,64 +40,20 @@ steps:
with:
persist-credentials: false
- name: Prebuild and collect clang diagnostics
shell: bash
run: |
set -o pipefail
mkdir -p /tmp/gh-aw/agent
missing_tools=0
command -v clang >/dev/null 2>&1 || missing_tools=1
command -v clang-tidy >/dev/null 2>&1 || missing_tools=1
command -v cmake >/dev/null 2>&1 || missing_tools=1
command -v ninja >/dev/null 2>&1 || missing_tools=1
command -v python3 >/dev/null 2>&1 || missing_tools=1
if [ "$missing_tools" -eq 1 ]; then
sudo apt-get update -y
sudo apt-get install -y clang clang-tidy cmake ninja-build python3
fi
rm -rf build
configure_status=0
build_status=0
CC=clang CXX=clang++ cmake -GNinja -S . -B build \
-DCMAKE_BUILD_TYPE=Debug \
-DCMAKE_EXPORT_COMPILE_COMMANDS=ON \
-DCMAKE_CXX_CLANG_TIDY=clang-tidy \
2>&1 | tee /tmp/gh-aw/agent/clang-tidy-configure.log || configure_status=$?
if [ "$configure_status" -eq 0 ]; then
cmake --build build --target shell test-z3 -k 0 \
2>&1 | tee /tmp/gh-aw/agent/clang-tidy-build.log || build_status=$?
else
printf 'configure failed; build skipped\n' | tee /tmp/gh-aw/agent/clang-tidy-build.log
build_status=125
fi
grep -nE 'warning:|error:|clang-tidy' /tmp/gh-aw/agent/clang-tidy-build.log \
> /tmp/gh-aw/agent/clang-tidy-diagnostics.txt || true
{
echo "configure_status=$configure_status"
echo "build_status=$build_status"
} > /tmp/gh-aw/agent/prebuild-status.txt
---
# Clang-Tidy Warning Fixer
You are an AI agent that uses pre-collected clang-tidy diagnostics, reviews warnings and errors, and creates a pull request with conservative fixes when you can do so safely.
You are an AI agent that uses pre-collected clang-tidy warning artifacts, proposes conservative fixes, and creates a GitHub issue with ready-to-apply git diffs.
## Current Context
- **Repository**: ${{ github.repository }}
- **Workflow**: ${{ github.workflow }}
- **Workspace**: ${{ github.workspace }}
- **Prebuild status file**: `/tmp/gh-aw/agent/prebuild-status.txt`
- **Prebuild configure log**: `/tmp/gh-aw/agent/clang-tidy-configure.log`
- **Prebuild build log**: `/tmp/gh-aw/agent/clang-tidy-build.log`
- **Prebuild diagnostics list**: `/tmp/gh-aw/agent/clang-tidy-diagnostics.txt`
- **Trigger run ID**: `${{ github.event.workflow_run.id }}`
- **Expected source workflow**: `clang-tidy-warning-report.yml` (`Clang-Tidy Warning Report`)
- **Local artifact extraction path**: `/tmp/gh-aw/clang-tidy-warning-report`
## Your Task
@ -104,24 +63,39 @@ This workflow is only for `Z3Prover/z3`.
If `${{ github.repository }}` is not `Z3Prover/z3`, call `noop` immediately with a short explanation.
### 1. Review prebuild results before taking action
### 1. Download artifacts from `clang-tidy-warning-report.yml`
This workflow already ran a prebuild with clang-tidy before agent mode. Start by inspecting:
- `/tmp/gh-aw/agent/prebuild-status.txt`
- `/tmp/gh-aw/agent/clang-tidy-configure.log`
- `/tmp/gh-aw/agent/clang-tidy-build.log`
- `/tmp/gh-aw/agent/clang-tidy-diagnostics.txt`
Use GitHub MCP tools (not `gh`) to retrieve artifacts from the triggering run.
If prebuild configuration failed, inspect the configure log and call `noop` with a clear summary unless you can make an obvious, local, semantics-preserving fix.
1. Determine source run ID:
- If `${{ github.event.workflow_run.id }}` is present, use it.
- For manual dispatch, call `github-mcp-server-actions_list` (`list_workflow_runs`) for workflow `clang-tidy-warning-report.yml` and select the latest `completed` run.
2. List run artifacts with `github-mcp-server-actions_list` (`list_workflow_run_artifacts`).
3. Find artifact `clang-tidy-warning-report-<run_id>`.
4. Get the download URL with `github-mcp-server-actions_get` (`download_workflow_run_artifact`).
5. Download and extract locally:
```bash
mkdir -p /tmp/gh-aw/clang-tidy-warning-report
curl -L "$ARTIFACT_URL" -o /tmp/gh-aw/clang-tidy-warning-report/artifact.zip
unzip -o /tmp/gh-aw/clang-tidy-warning-report/artifact.zip -d /tmp/gh-aw/clang-tidy-warning-report
ls -la /tmp/gh-aw/clang-tidy-warning-report
```
Expect files such as `warnings.txt`, `build.log`, `configure.log`, `combined.log`, and `status.txt`.
### 2. Extract actionable diagnostics
Analyze `/tmp/gh-aw/agent/clang-tidy-diagnostics.txt` and `/tmp/gh-aw/agent/clang-tidy-build.log`, focusing on diagnostics emitted during this workflow run.
Analyze artifact files from this run:
- `/tmp/gh-aw/clang-tidy-warning-report/warnings.txt`
- `/tmp/gh-aw/clang-tidy-warning-report/build.log`
- `/tmp/gh-aw/clang-tidy-warning-report/combined.log`
- `/tmp/gh-aw/clang-tidy-warning-report/status.txt`
Use commands like:
```bash
grep -nE 'warning:|error:|clang-tidy' /tmp/gh-aw/agent/clang-tidy-build.log | head -200
grep -nE 'warning:|error:|clang-tidy' /tmp/gh-aw/clang-tidy-warning-report/combined.log | head -300
```
Classify findings into:
@ -155,61 +129,50 @@ Examples of usually safe fixes:
Do **not** change behavior, APIs, ownership, solver logic, or performance-sensitive code unless the fix is obviously semantics-preserving.
### 4. Apply fixes conservatively
### 4. Draft fixes conservatively as patch proposals
When you are confident, edit the relevant files and keep the patch minimal.
For each high-confidence warning, draft the smallest safe change as a unified diff proposal.
Rules:
- fix only warnings you fully understand
- do not batch unrelated cleanups
- preserve formatting and local style
- if a finding is uncertain, skip it instead of guessing
- prefer one focused diff hunk per warning
- do not propose broad refactors or behavioral changes
### 5. Rebuild and confirm the fixes
### 5. Document proposed fixes as git diffs
After making changes, rerun the same configure/build sequence if needed and always rerun at least:
For each proposed fix, include:
- file path
- warning being fixed
- rationale
- a fenced unified diff block (` ```diff ... ``` `)
Also include one consolidated patch section that can be directly applied:
```bash
cmake --build build --target shell test-z3 -k 0 2>&1 | tee /tmp/gh-aw/agent/clang-tidy-build-after.log
./build/test-z3 /a
git apply - << 'EOF'
[all diff hunks]
EOF
```
If the rebuilt logs still contain actionable warnings, you may fix another small set if you remain confident. Otherwise stop.
### 6. Create a GitHub issue with fixes
### 6. Provide git diff details for GitHub issue contexts
Create exactly one issue using `create-issue` when there are actionable warnings.
When this workflow is dispatched from a GitHub issue context (for example via `aw_context` with `item_type == "issue"`), always include patch details to make PR creation easy:
Issue content must include:
- source workflow run link (`clang-tidy-warning-report.yml` run ID)
- summary counts by warning type
- list of skipped warnings with reasons
- proposed fixes as unified diffs (full diff text, not prose only)
- short assignment-ready checklist for Copilot (one checkbox per proposed fix)
```bash
git status --short
git diff --stat
git diff
```
If changes were made, include the full unified diff in your final response in a fenced `diff` block and summarize changed files explicitly.
### 7. Create the pull request
If you made safe fixes, create a pull request using `create-pull-request`.
Use a title describing the warnings fixed, for example:
- `Fix clang-tidy warnings in parser code`
- `Fix clang-tidy override and unused warnings`
The PR body should include:
- that the workflow compiled Z3 with clang-tidy
- the build command that was used
- the files changed
- the warnings or errors fixed
- confirmation that you rebuilt and ran `./build/test-z3 /a`
- a brief note for any remaining warnings you intentionally skipped
If there are no safe fixes to make, call `noop` with a short summary of what you built and what you found.
If no actionable warnings are found, or artifacts are missing/corrupt, call `noop` with a concise explanation.
## Guidelines
- Be conservative and high-confidence only.
- Prefer no PR over a risky PR.
- Prefer no issue over risky or speculative patch suggestions.
- Keep fixes surgical and easy to review.
- Validate every change by rebuilding.
- Focus on diagnostics produced by this workflow run, not on unrelated code quality ideas.
- Focus only on diagnostics produced by the referenced `clang-tidy-warning-report.yml` run.