Skip to content

fix(gh-aw): preserve ownership metadata through broad gitignore rules #2113

New issue
New issue
Closed
#2116
Closed
fix(gh-aw): preserve ownership metadata through broad gitignore rules#2113
#2116
Labels
gh-awGitHub Agentic Workflows integrationsquadSquad triage inbox — Lead will assign to a membersquad:git-specialistAssigned to git-specialist (Git Specialist)

Description

@bradygaster
bradygaster
opened on Sep 29, 2026

Problem

A clean hosted Squad installation at source 59bedd0ba58247bff2fbb7b5412be877b40d2e14 failed closed because a consumer repository's broad packages/ ignore rule also ignored required ownership metadata under .github/aw/packages/.

The documented staging command git add -- .github/aw silently omitted .github/aw/packages/bradygaster-squad-workflows-3632054824e8.json. Hosted bootstrap then reported Package ownership metadata is missing.

Evidence

The temporary installation was reverted and the fixture's default-branch tree restored exactly. No fixture PR was merged.

Required behavior

  • Enlistment/install guidance and automation must detect required generated package ownership metadata ignored by consumer rules.
  • Required metadata must be staged explicitly and verifiably, using the narrowest safe force-add behavior when needed.
  • Installation must fail before commit/push if any manifest-owned file is absent from the staged tree.
  • Do not force-add unrelated ignored files or weaken package ownership verification.
  • Canonical/package/template skill copies and relevant tests must remain synchronized.

Acceptance evidence

  • Regression fixture with a broad packages/ ignore rule stages exactly the required .github/aw/packages/*.json ownership file.
  • Negative tests prove unrelated ignored files remain unstaged and missing ownership metadata fails closed.
  • Hosted backend bootstrap proceeds past package ownership verification from a new immutable merged SHA.
  • No PAT, App, private key, custom token, new secret, environment, or external service is introduced.

#2074/#2069 remain orthogonal.

Activity

  1. bradygaster
    added
    squadSquad triage inbox — Lead will assign to a member
    gh-awGitHub Agentic Workflows integration
    squad:git-specialistAssigned to git-specialist (Git Specialist)
    on Sep 29, 2026

  2. github-actions commented on Sep 29, 2026

    @github-actions
    github-actionsBot
    on Sep 29, 2026 – with GitHub Actions
    Contributor

    📋 Assigned to git-specialist (Git Specialist)

    Issue: #2113 — fix(gh-aw): preserve ownership metadata through broad gitignore rules

    git-specialist will pick this up in the next Copilot session.

    For Copilot coding agent: If enabled, this issue will be worked automatically.
    Otherwise, start a Copilot session and say:
    git-specialist, work on issue #2113

  3. bradygaster
    added 2 commits that reference this issue on Sep 29, 2026

    Merge dev deterministic bootstrap fix into ownership staging

    94d2b8f

    docs(changeset): record verified gh-aw ownership staging

    38cdda3
  4. bradygaster
    closed this as completedin #2116on Sep 29, 2026

  5. bradygaster commented on Sep 30, 2026

    @bradygaster
    bradygaster
    on Sep 30, 2026
    CollaboratorAuthor

    Final immutable preflight and install-PR evidence (not hosted acceptance)

    Source: 93aec83accb44e08c39e4a799f13b55208215a13, including merged #2118. This supersedes the earlier f67bee5a preflight.

    Proven: trusted source preflight; schema-v2 8 workflows / 17 runtime resources / 1 skill; both workflow-level and package-root provenance strict compile and digest verification; immutable gh-aw v0.89.21 setup/setup-cli pin 924af5fdc64061cfbf66fb584c8b07e2ac230c60; exactly the two documented diagnostic headers and the 8-success/2-warning summary. Both provenance compiles emitted byte-identical diagnostics. All three real consumer installs passed strict install and staged-index verification with exactly 46 required paths and no optional editor/maintenance extras. Backend ownership JSON was included despite its broad packages/ ignore rule. Enlistment tests: 85 passed; native review workflow/control tests: 17 passed.

    Fixture Fresh open, unmerged audit PR Exact head Exact untouched base
    backend octodemo/zava-social-backend-template-20260928092124#9 8bb53644ba0729e084a6f3030cb4f5413f350cbd 8fcaef5532bbb0a7baa770c04fd6cd1065967aa7
    frontend octodemo/zava-social-frontend-template-20260928092124#8 b5f611a9db1dbd425544d21bf55c8c240e26b204 1213623adc5eaa8669d78bc994a8624f37d5d952
    queue octodemo/zava-social-queue-worker-template-20260928092124#14 1be606cf5095062faff701f0a77a5c417b928dea a96d37615a17a7265d16f9561fe0dc6e09efc538
    • backend: installed tree cd21b9fd9f0b597b497de00ac440aa492551caa8; 46-file inventory SHA-256 43c2151f781f90a068b4173060952e207bbdc712a86f93f7783144f2195e1a9a.
    • frontend: installed tree 8654bc9f6ccef2249b023a8230f259f8e707f267; 46-file inventory SHA-256 2c2c0fb5a8b221519d88735a278ccb79825534aafe318957efaee8b4a91c6424.
    • queue: installed tree c2d4a431edc8fe632ec937959c1f9e1ed2f97335; 46-file inventory SHA-256 08c1e379f1634cfc53407ddde4f0c99aca17a55d218a16dab7c0f7363f966fec.

    Checks and runs at capture

    Run links below identify exact run ID/attempt. All seven bootstrap jobs (pre_activation, activation, agent, safe_outputs, detection, Materialize validated Squad bootstrap, conclusion) were skipped, not passed. The separate copilot-pull-request-reviewer and github-advanced-security checks were still running; no completed review is claimed.

    Human boundary and preservation

    No fixture PR was merged, no default branch was pushed, and no alternate bootstrap trigger was used. The original default SHA/tree/settings, all pre-existing branches (including Dependabot), preserved evidence PRs, and existing issues were verified unchanged. Preserved PRs: octodemo/zava-social-backend-template-20260928092124#3 and octodemo/zava-social-backend-template-20260928092124#8; octodemo/zava-social-frontend-template-20260928092124#3 and octodemo/zava-social-frontend-template-20260928092124#7; octodemo/zava-social-queue-worker-template-20260928092124#9 and octodemo/zava-social-queue-worker-template-20260928092124#13. Only one fresh installation branch and PR per fixture was added. No PAT, dedicated App, private key, custom token, new secret, reviewer environment, or external service was introduced.

    Still unproven until an explicitly authorized human installation merge: hosted bootstrap ownership validation and deterministic materialization, Cast/research safe outputs, automatic native Squad Review review job and logical verdict, exact run/attempt relay and downstream cleanup, and queue negative/recovery/idempotency scenarios. Copilot PR review is not a substitute for that native Squad Review evidence. These install PRs do not establish end-to-end acceptance, and no acceptance issue is being closed or recommended for closure. Docs PR #2100 remains unchanged.

  6. huangyingting
    added a commit that references this issue on Oct 1, 2026

    fix(gh-aw): preserve ownership staging with bounded index verification (

    f67bee5
  7. bradygaster
    added a commit that references this issue on Oct 20, 2026

    chore(release): promote dev to main (v1.1.0) (#2241)

    c24da2a
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    gh-awGitHub Agentic Workflows integrationsquadSquad triage inbox — Lead will assign to a membersquad:git-specialistAssigned to git-specialist (Git Specialist)

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions