🐛🧑‍💻 - Optional Check Run publication fails without actionable diagnostics in the commit workflow

Is there an existing issue for this?

I have searched the existing issues.

Related #718 records the same warning as a secondary observation during size reconciliation, and #727 records it during a separate progress-evidence failure. This issue isolates the optional Check Run publication stage and its missing diagnostic information. Please consolidate shared diagnostic work if appropriate while retaining this exact reproducer and credential-routing evidence.

Which actions are affected?

Commits

Which platforms are affected?

Linux

Description

Copilot logs Could not publish the optional GitHub Check Run. without the failed operation, check name, source head, sanitized provider status/request identifier, or a useful recovery. In the observed run the actual underlying cause is impossible to determine from the log. The warning is separate from the required progress stage failure reported in #727, so resolving missing binary patches would not establish whether check publication works.

Consumer: public vypdev/zstandard, issue vypdev/zstandard#171, PR vypdev/zstandard#172. Failing job: https://github.com/vypdev/zstandard/actions/runs/40338528076/job/121626513660, UTC 2026-10-26 14:20:30.

Expected: optional evidence publication remains optional and cannot mask an earlier required-stage result, but failures identify the stage, immutable target and safe provider diagnostic. Generated workflows should either supply the supported check-publication credential/permissions or explicitly explain the unsupported credential route and recovery. Do not infer a transient provider outage or ask for broader credentials without identifying the actual failure. Do not log credentials, authentication headers or unsanitized provider bodies.

Actual: the only output is the generic sentence. The catch explicitly logs only the converted error's .message, discarding other potentially useful structured context. No provider status or request reference is visible beside the warning. We have not established a GitHub outage, missing permission, PAT type, or connection between this failure and the earlier progress failure.

Reproducing the issue

Inspect run 40338528076, job 121626513660, exact consumer head 4ac3c633f45166acd2b14c169fe675b6e640d1a6. It executes the installed generated copilot_commit.yml and vypdev/copilot@v3 at the revision below.
Observe the distinct progression: CheckProgressUseCase reports unavailable binary patches; PR-owned push Bugbot is skipped; result/configuration publication finishes; optional Check Run publication logs the generic warning; final step failure renders the earlier progress error. The progress error is independently reproducible and is not attributed to Check Run publication.
Inspect the executed completion code: publishCopilotEvidence selects process.env.COPILOT_EVIDENCE_TOKEN?.trim() || execution.tokens.token, calls evidencePort.publish, catches any error, and logs only toApplicationError(..., 'provider.unavailable', 'Could not publish the optional GitHub Check Run.').message.
Inspect the consumer workflow at the immutable head: https://github.com/vypdev/zstandard/blob/4ac3c633f45166acd2b14c169fe675b6e640d1a6/.github/workflows/copilot_commit.yml. Job permissions are contents: read; the Action input token is secrets.PAT; there is no COPILOT_EVIDENCE_TOKEN mapping. These are variable names, not secret values.
The executed revision's generated commit workflow template has the same shape: contents: read, token: secrets.PAT, and no dedicated evidence-token environment mapping. This is an observed configuration boundary for maintainers to assess, not proof that GITHUB_TOKEN was used or that a particular permission caused the failure. The source fallback uses the Action's configured PAT unless an evidence token is supplied.
Compare the successful PR-owned Copilot / Review check at this same consumer head. Other lanes publishing a check do not prove this separate commit-lane credential route works.

The original provider failure cannot be recreated deterministically from the available public logs because its details were not retained. Suggested upstream fault injection, not executed by the reporter: reject the evidence publish boundary with permission denied, rate limiting, unavailable provider and invalid immutable target errors, then assert that each yields a distinct sanitized optional-stage diagnostic while preserving the original required-stage completion result. Cover an absent explicit evidence token, a valid dedicated token, and no secret leakage.

copilot Version

3.10.5. vypdev/copilot@v3 resolved to 39679e26a22b40a5a4a40e8f167f46273157182e in the runner download log. Self-hosted Linux runner group vypdev, labels self-hosted, codex, Linux. The consumer retains Action version-tag references; the exact SHA here identifies executed source only.

Relevant Log Output

2026-10-26T14:20:23.8783527Z GitHub omitted a required file patch from the pinned comparison. Progress was not assessed and existing state was retained.
2026-10-26T14:20:24.3212587Z Skipping push Bugbot analysis because pull request #172 owns review for this head.
2026-10-26T14:20:28.0302000Z Executing StoreConfigurationUseCase.
2026-10-26T14:20:30.0250816Z Configuration stored. Finishing.
2026-10-26T14:20:30.2723945Z Could not publish the optional GitHub Check Run.
2026-10-26T14:20:30.2757783Z Impact: Progress was not assessed because GitHub omitted a required file patch.
Error code: validation.evidence-unavailable
Retained state: Existing progress labels and published assessments were preserved; no model assessment was made.
Retryable: No
Reference: 8ee13d41-3952-4c5b-8bda-6bc8ff9672d4

That final error reference belongs to the progress failure, not to the optional Check Run warning. There is no separate provider reference shown for check publication.

Additional context and comments

The maintainer explicitly requested detailed upstream reports for all anomalous Copilot behavior. Copilot maintainers own diagnosis and implementation. The consumer has not modified generated workflows, token selection, permissions, credentials, policy or check statuses to suppress this warning. No credential contents were accessed or included in this report. This report does not authorize an upstream release or a consumer workaround.

Acceptance should preserve optional publication semantics, truthful required-stage failure and idempotent check identity at the exact head, while making unsupported configuration and provider failures actionable and distinguishable. A warning should name the unavailable evidence surface without making a successful project test appear failed or an unassessed result appear complete.

@vypbot

Hi! I’m @vypbot, the Copilot assistant for this repository.

I can answer questions, explain the codebase, propose implementation and test plans, review issues and pull requests for potential bugs or security problems, and help authorized maintainers apply changes.

Try /copilot help to see the available commands, or mention @vypbot with your question.

Additional occurrence during the authorized zstandard1.5.2 publication recovery:

Consumer: vypdev/zstandard, launcher issue170, operation df2ae6c3-f7df-4fe4-ae59-80a5793c4727.
Promotion PR174 merged normally at2026-10-27T01:03:48Z after58 successful checks and the expected neutral approval assessment. Source 7f4425b839a4b34dafc36fbf3d9d00bc2a880e07; accepted production/tag aca7c1162962d59a2c7287871c95868e34c97e0e; both trees 789027915e3accfd3d6646df4eb0b40d13da4af8.
Package workflow 40430400481, attempt1. Its tag/candidate validation succeeds. Its publisher job121946510169 fails independently in a consumer-owned nested SDK setup before any package command: setup-dart's optional matcher resolves to the parent composite's missing dart-analyzer.json.
Failure reporter job121947168212, runner ubuntu-runner-4, invokes single-action: failed_deployment_action, issue170, version1.5.2, the matching operation ID and the existing PAT secret. Core resolves vypdev/copilot@v3 to 39679e26a22b40a5a4a40e8f167f46273157182e in this run. No credential value is included here.

Observed log sequence, UTC:

01:07:13.0007652 User from token (vypbot) matches actor. Executing single action: failed_deployment_action.
01:07:18.0547175 Publishing result: 1 result(s), 1 step(s), 1 error(s).
01:07:18.0553912 Generic result publication skipped: this single action owns its user-facing presentation.
01:07:18.0559957 Configuration persistence skipped: this single action does not modify execution configuration.
01:07:18.3415195 Could not publish the optional GitHub Check Run.
01:07:18.3440102 Impact: The workflow could not complete the requested operation.
Error code: workflow.failed
Action: Inspect the current state and retry the failed step.
Retained state: Existing persisted state and completed external effects were preserved.
Retryable: Yes
Reference: 207d7338-35f3-4e75-b736-279124d5e933

The durable publication failure is correctly retained: state revision6, phase blocked, category publication, retryable: true, previous phase publishing, exact source/production/tag and promotion PR preserved, publicationVerified: false. This follow-up does not attribute the primary consumer failure, the intentional failure result, or the reporter's red outcome to the optional-check warning. It supplies another concrete context for the same missing optional Check Run diagnostics: the warning still provides no underlying HTTP status, API error or safe request correlation information. We cannot determine which credential or permission caused it from this log and have not changed credentials, Copilot code/generated workflows, or approval policy.

Expected: actionable, redacted details for this optional check-publication warning, clearly distinguishable from the intentionally recorded upstream publication failure. Core changes remain with your maintainers; the separate consumer SDK/matcher correction is being prepared in zstandard.

Additional reproduction of the same missing optional-check diagnostic in the consumer1.5.3 failure-reporting lane:

Run: https://github.com/vypdev/zstandard/actions/runs/40449489903
Reporter job: https://github.com/vypdev/zstandard/actions/runs/40449489903/job/122014412947
Exact production/tag commit: 60ac0b924549e3bfc14d45ab217bdc42519bbe64, immutable v1.5.3; operation 1c7de59b-a676-4b59-9e03-db65d3a5ebb9, issue175, promotion PR176.
Action: failed_deployment_action, vypdev/copilot@v3 resolved to 39679e26a22b40a5a4a40e8f167f46273157182e (3.10.5), Linux ubuntu-runner-2.
Existing reporter permissions remain contents: read, issues: write; Action token remains secrets.PAT. No credential type/content or underlying provider permission failure is inferred.

2026-10-27T04:43:45.4023120Z Publishing result: 1 result(s), 1 step(s), 1 error(s).
2026-10-27T04:43:45.4031026Z Generic result publication skipped: this single action owns its user-facing presentation.
2026-10-27T04:43:45.6887231Z Could not publish the optional GitHub Check Run.
2026-10-27T04:43:45.6912911Z Impact: The workflow could not complete the requested operation.
Error code: workflow.failed
Action: Inspect the current state and retry the failed step.
Retryable: Yes
Reference: 12e4fa7a-7f56-4126-b40d-d0913b9d0f33

The durable operation correctly became blocked, revision6, categorypublication, retryabletrue, previousPhasepublishing, publicationVerifiedfalse, retaining its source/production/tag identities. The reporter is intentionally red for the reported package failure; that is not being reported as an additional engine bug.

The primary package failure is explicit and unrelated: eight packages published successfully; pub.dev rejected zstandard_cli with publishing from github is not enabled. Its private administrator setting is being corrected. We do not attribute that error, the deliberate failure-reporting result or the final workflow error reference to optional Check Run publication. The optional warning still lacks its own failed check operation/identity and sanitized provider status or request identifier. Existing upstream diagnostic work should retain this additional single-action completion route. No consumer Copilot code, generated workflow, credentials, policy or permissions were changed to suppress it.

Implementation plan

Current status: Ready to start. No action is required from maintainers before implementation.

Define a safe Check Run failure diagnostic
- Capture the operation, check name, immutable head SHA, and sanitized provider status or request identifier at the evidence adapter boundary.
- Exclude credentials, authentication headers, and unsanitized provider response bodies.
Preserve optional publication semantics
- Update `publishCopilotEvidence` to log the structured diagnostic without changing the required-stage result or its failure presentation.
- Keep stable Check Run identity and use the existing summary as the evidence fallback.
Clarify credential routing in generated workflows
- Review the commit workflow template and provide the supported `checks: write` evidence-token route where available.
- When a workflow cannot provide that route, explain the limitation and recovery in its generated guidance.
Add focused failure and routing coverage
- Inject permission, rate-limit, provider-unavailable, and invalid-target failures; verify each produces a distinct sanitized warning.
- Cover absent and dedicated evidence tokens, stable identity at the exact head, and preservation of any earlier required-stage failure.
Update user-facing documentation
- Document optional Check Run behavior, supported credential routing, diagnostic fields, and recovery guidance in the relevant docs.

Acceptance: Tests verify that each injected Check Run failure emits a distinct sanitized warning naming the operation, check, and exact head with safe provider context when available; optional publication never alters an earlier required-stage result, stable identity is retained, and no credential or unsanitized provider body is logged.

Need something else? Mention the bot with a question or use /copilot help.

Issue closed — historical progress

Current status: closed as completed.

The last estimate is retained below as history. Closure does not certify a new percentage, tests, or branch alignment.

Action required: none for this closed issue. If work continues, reopen the issue; a fresh assessment can update this same card.

Last assessment before closure (historical)

Progress: 75% — in progress

> Current status: [R1] Copilot logs Could not publish the optional GitHub Check Run. without the failed operation, check name, source head, sanitized provider status/request identifier, or a useful recovery. In the observed run the actual underlying cause is impossible to determine from the log. The warning is separate from the required progress stage failure reported in #727, so resolving missing binary patches would not establish whether check publication works. — The patches add a closed provider error boundary and diagnostics naming the operation, check, exact head, credential route, and safe status/request reference when available. They also add actionable guidance while excluding raw provider text and credentials.
[R2] Expected: optional evidence publication remains optional and cannot mask an earlier required-stage result, but failures identify the stage, immutable target and safe provider diagnostic. Generated workflows should either supply the supported check-publication credential/permissions or explicitly explain the unsupported credential route and recovery. Do not infer a transient provider outage or ask for broader credentials without identifying the actual failure. Do not log credentials, authentication headers or unsanitized provider bodies. — Completion logs and appends an optional publication warning without changing the required result; commit workflows add step-scoped evidence-token routing and Checks write permission. Documentation describes
[untrusted content truncated]

Next: [R4] "acceptance": "Tests verify that each injected Check Run failure emits a distinct sanitized warning naming the operation, check, and exact head with safe provider context when available; optional publication never alters an earlier required-stage result, stable identity is retained, and no credential or unsanitized provider body is logged." — Independent execution evidence is needed to verify the acceptance tests for injected failures, safe diagnostics, preserved required results, stable identity, and absence of credential or raw-body leakage.

Issue closed: synchronization recommendation retired

No branch synchronization is required for this closed issue.

The previous recommendation is historical. Issue closure does not certify that the branches are synchronized.

Navigation Menu

Repository navigation

🐛🧑‍💻 - Optional Check Run publication fails without actionable diagnostics in the commit workflow #728

Is there an existing issue for this?

Which actions are affected?

Which platforms are affected?

Description

Reproducing the issue

copilot Version

Relevant Log Output

Additional context and comments

2 remaining items

Implementation plan

Issue closed — historical progress

Last assessment before closure (historical)

Progress: 75% — in progress

Issue closed: synchronization recommendation retired

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

🐛🧑‍💻 - Optional Check Run publication fails without actionable diagnostics in the commit workflow #728

Description

Is there an existing issue for this?

Which actions are affected?

Which platforms are affected?

Description

Reproducing the issue

copilot Version

Relevant Log Output

Additional context and comments

Activity

vypbot commented on Oct 26, 2026

efraespada commented on Oct 27, 2026

efraespada commented on Oct 27, 2026

2 remaining items

vypbot commented on Oct 27, 2026

Implementation plan

vypbot commented on Oct 28, 2026

Issue closed — historical progress

Last assessment before closure (historical)

Progress: 75% — in progress

vypbot commented on Oct 28, 2026

Issue closed: synchronization recommendation retired

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions