[vypbot]

🚀 Production promotion

Purpose: accept the prepared change in production.

Origin	Prepared source	Destination	Publication
develop@​f5f462b	release/3.10.0@​4b72ffc	master	Package status: not published

Ready before review

• ✅ Build and release validation
• ✅ Package smoke test
• ⏳ Protected-branch checks and reviews

After merge

• After merge, Copilot will tag and publish the accepted production commit.
• Development reconciliation: develop.

Compare changes · Release control center

Technical details

Operation 3de836ba-3d6a-4b37-9cd2-1d00bc48d24a; strategy production-lineage; merge mode auto.

[docs-page]

To preview the documentation for this pull request, visit the following URL:

docs.page/vypdev/copilot~668

Documentation is deployed and generated using docs.page

[vypbot]

Copilot approval · Human review needed

Status: This pull request is outside the configured approval scope.
Completed: 1/1 observed checks succeeded; Bugbot unverified.
Action required: Ask a human reviewer to decide.
Impact: No new approval is confirmed for this revision.
See checks

Technical evidence

Revision: 4b72ffc6d83f; base: f7f68e699a7f; reason: scope.

[efraespada]

Review evidence for this candidate:

• 4b72ffc addresses both release(3.10.0): promote to master #666 corrections: the original default/role Cursor-provider condition now gates the caller Secret grant AND the initial Action environment. Four source/distributed callback regressions failed before the fix and now pass. The SDD historical decision explicitly distinguishes rejected consumer reusable dependency hooks from the supported Copilot-owned coordinator. All 397 affected workflow/migration tests and static/spec/docs/package/build gates passed.
• d33064a already restricts native request cleanup to successfully created requests in validated sessions. Three regressions reproduced the old deletion and pass; success/failure cases assert owned cleanup. All 93 native runner/protocol/controller/post tests passed. Earlier release-review SDD path/configuration-marker fixes remain included.
• GitHub supports $/ for action steps AND reusable workflow calls at the executing workflow's own repository/commit, without checkout. Official announcement: https://github.blog/changelog/2026-07-30-reference-same-repository-actions-with-self-repository-syntax/ . GitHub.com and runner >=2.336.0 are documented requirements. It is not a placeholder or workspace-relative reference.
• The fixture's poisoned candidate dist/index.js deliberately survives all deferred post steps to prove captured source-runtime execution. .github/actions/copilot-native-cleanup-check/post.cjs is registered first/runs last, removes that exact ignored dist directory, and asserts staging/runtime cleanup. Removing it in fixture() finally would weaken acceptance. It passed on all three platforms at the preceding candidate.
• RepoWise is intentionally optional/manual. docs/development/testing.mdx:107-112 explicitly says PRs/pushes/merge groups do not launch it and it must not be required. docs/development/release-process.mdx:37-40 agrees; live master rules require only CI Check (GitHub Actions App 15368). The generic merge_group checklist applies to REQUIRED checks.
• prepare-source-verification is a coordinator-local bootstrap flag guarded by github.repository == 'vypdev/copilot', not a root Action input/managed Variable. Maintenance normalizes root Action/Variable bindings; its digest still retains every workflow byte, including that flag.
• Source/setup callers remain 32/28 lines; native same-job setup, source pinning, five-minute steps, 300-second readiness and final post cleanup remain unchanged.

Official preparation has passed build/package validation and isolated package smoke. The source is now frozen. Current-head applicable checks and complete review with no unresolved findings are required before merge.

[efraespada]

/copilot findings

[codecov-commenter]

Codecov Report

❌ Patch coverage is 94.74622% with 59 lines in your changes missing coverage. Please review.
✅ Project coverage is 94.13%. Comparing base (f7f68e6) to head (4b72ffc).

Files with missing lines	Patch %	Lines
...c/infrastructure/native_verification_controller.ts	89.53%	5 Missing and 13 partials ⚠️
src/infrastructure/verification_setup_snapshot.ts	83.92%	2 Missing and 7 partials ⚠️
...rc/infrastructure/native_verification_candidate.ts	86.66%	1 Missing and 3 partials ⚠️
src/infrastructure/native_verification_protocol.ts	87.87%	0 Missing and 4 partials ⚠️
src/manager/description/configuration_markers.ts	91.66%	0 Missing and 4 partials ⚠️
src/infrastructure/setup_verification_action.ts	95.16%	0 Missing and 3 partials ⚠️
src/infrastructure/verification_setup_result.ts	90.32%	1 Missing and 2 partials ⚠️
src/infrastructure/verification_setup_runner.ts	96.07%	0 Missing and 2 partials ⚠️
...ication/usecases/actions/initial_setup_workflow.ts	50.00%	0 Missing and 1 partial ⚠️
...ation/usecases/sdd/pre_branch_sdd_gate_use_case.ts	95.83%	1 Missing ⚠️
... and 10 more

Additional details and impacted files

@@            Coverage Diff             @@
##           master     #668      +/-   ##
==========================================
+ Coverage   94.10%   94.13%   +0.02%     
==========================================
  Files         950      974      +24     
  Lines       30548    31635    +1087     
  Branches     8965     9289     +324     
==========================================
+ Hits        28748    29780    +1032     
- Misses        704      715      +11     
- Partials     1096     1140      +44     

Files with missing lines	Coverage Δ
src/actions/github_action.ts	95.72% <100.00%> (+0.23%)	⬆️
src/actions/github_action_execution.ts	93.75% <ø> (ø)
src/actions/local_action_configuration_sections.ts	86.00% <ø> (ø)
src/actions/local_action_execution.ts	92.30% <ø> (ø)
src/application/contracts/input_keys.ts	100.00% <ø> (ø)
src/application/contracts/setup_documentation.ts	100.00% <ø> (ø)
src/application/errors/bugbot_mutation_error.ts	100.00% <100.00%> (ø)
...tion/policies/application_error_message_catalog.ts	100.00% <100.00%> (ø)
.../policies/application_error_presentation_policy.ts	100.00% <100.00%> (ø)
src/application/policies/bugbot_message_catalog.ts	100.00% <100.00%> (ø)
... and 90 more

... and 2 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[vypbot]

Current status: 5 findings originating in this review require attention.
Last reconciled on 4b72ffc. See aggregate Bugbot status.

🤖 Bugbot review snapshot

Bugbot reported 5 potential problems when commit 4b72ffc was analyzed. This snapshot is historical; use the status block above for current state. 5 findings are linked to changed code.

Findings

• high: Secret prefilter misses Unicode case-insensitive matches — scripts/repowise_history.py:81
• high: The setup action can access the job token — specs/repository-verification-setup-hooks.md:223
• medium: Invalid reusable workflow path prevents comment workflows from running — .github/workflows/copilot_issue_comment.yml:10
• medium: Create the fixture runtime directory before writing — src/tooling/__tests__/fixtures/verification_native_fixture.ts:70
• medium: RepoWise no longer runs automatically on pushes or pull requests — .github/workflows/repowise.yml:4

[vypbot]

Bugbot: 5 findings need attention

Current status: 5 findings require attention on 4b72ffc.

Action: Review the linked threads or comment /copilot fix all.

Findings

• open — Invalid reusable workflow path prevents comment workflows from running
• open — RepoWise no longer runs automatically on pushes or pull requests
• open — Secret prefilter misses Unicode case-insensitive matches
• open — The setup action can access the job token
• open — Create the fixture runtime directory before writing

Pull request · Verified commit · Workflow run

[efraespada]

/copilot dismiss "scripts/repowise_history.py:SecretPrefilter-search-unicode-long-s" "specs/repository-verification-setup-hooks.md:security:native-setup-token-access" ".github/workflows/copilot_issue_comment.yml:10:invalid-local-reusable-workflow-reference" "verification_native_fixture.ts:70:missing-dist-directory" ".github/workflows/repowise.yml:4:removed-automatic-code-health-triggers"

[vypbot]

5 findings were dismissed.