Add emergency yank process for unsafe threat detection releases by Copilot · Pull Request #32 · github/gh-aw-threat-detection

Copilot · 2026-05-07T19:14:08Z

Inspect unresolved Copilot review threads
Review yank workflow, lifecycle docs, and lifecycle validation
Run baseline lint/test/lifecycle validation
Support no-safe-replacement yanks in the manual workflow
Update maintainer docs for replacement and no-replacement yank paths
Run lint/test/lifecycle validation and secret scan
Run automated review/security checks

Agent-Logs-Url: https://github.com/github/gh-aw-threat-detection/sessions/12f810e1-d6c2-4df2-b9f0-09cae2d660ce Co-authored-by: davidslater <12449447+davidslater@users.noreply.github.com>

Copilot

Pull request overview

Adds an “emergency yank” capability to the threat-detection release lifecycle so maintainers can mark unsafe releases as yanked, keep audit artifacts, prevent latest from resolving to unsafe versions, and document/validate the lifecycle metadata that gh-aw must consult before execution.

Changes:

Introduces a lifecycle registry (releases/threat-detection-lifecycle.json) plus Go-based validation tests for lifecycle/yank metadata correctness.
Adds a manual Yank Release workflow to mark a release as yanked, retag latest to a safe replacement, and update GitHub Release metadata accordingly.
Updates spec/docs and the promote workflow to incorporate lifecycle-state checks and document yank semantics.

Show a summary per file

File	Description
specs/threat-detection-spec.md	Adds lifecycle/yank requirements to the threat detection spec and renumbers security requirements.
releases/threat-detection-lifecycle.json	Adds initial lifecycle registry file (schema v1) to be consumed by `gh-aw` and maintainer workflows.
releases/lifecycle_test.go	Adds validation logic/tests for registry schema, yanked metadata requirements, and replacement constraints.
README.md	Documents release lifecycle concepts and the emergency yank behavior at a high level.
Makefile	Adds `validate-lifecycle` target to run lifecycle registry validation tests.
DEVGUIDE.md	Documents lifecycle registry expectations and a step-by-step emergency yank process for maintainers.
.github/workflows/yank-release.yml	Adds a manual workflow to perform the yank: validate tags/digests, update registry, retag `latest`, and update GitHub Releases.
.github/workflows/promote-release.yml	Blocks promotion of `yanked`/`obsolete` releases to `latest` based on the lifecycle registry.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 8/8 changed files
Comments generated: 2

Agent-Logs-Url: https://github.com/github/gh-aw-threat-detection/sessions/85fb37b4-0ed2-455c-9ca1-a156a74d65bb Co-authored-by: davidslater <12449447+davidslater@users.noreply.github.com>

davidslater · 2026-05-08T00:04:17Z

@copilot resolve the merge conflicts in this pull request

Copilot

Copilot's findings

Files reviewed: 8/8 changed files
Comments generated: 2

Agent-Logs-Url: https://github.com/github/gh-aw-threat-detection/sessions/827177cf-9662-48f1-8ea5-bffe053ed198 Co-authored-by: davidslater <12449447+davidslater@users.noreply.github.com>

Co-authored-by: davidslater <12449447+davidslater@users.noreply.github.com>

Agent-Logs-Url: https://github.com/github/gh-aw-threat-detection/sessions/827177cf-9662-48f1-8ea5-bffe053ed198 Co-authored-by: davidslater <12449447+davidslater@users.noreply.github.com>

Copilot · 2026-05-08T00:12:20Z

@copilot resolve the merge conflicts in this pull request

Resolved the merge conflicts with main and pushed the final follow-up in 55abf15. The PR now has current main in its history and no conflict markers remain.

Agent-Logs-Url: https://github.com/github/gh-aw-threat-detection/sessions/d9664543-c97b-4b2a-a73c-25db1a57db4d Co-authored-by: davidslater <12449447+davidslater@users.noreply.github.com>

Copilot

Copilot's findings

Files reviewed: 7/7 changed files
Comments generated: 1

+
+          validate_tag() {
+            local tag="$1"
+            if ! echo "$tag" | grep -Eq '^v[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?(\+[0-9A-Za-z.-]+)?$'; then


Initial plan

59cd791

Copilot AI assigned Copilot and davidslater May 7, 2026

Copilot started work on behalf of davidslater May 7, 2026 19:14 View session

Copilot AI linked an issue May 7, 2026 that may be closed by this pull request

[Plan]: Add emergency yank process for unsafe threat detection releases #30

Open

4 tasks

Copilot AI and others added 2 commits May 7, 2026 19:19

Add emergency yank release process

d88ee3f

Agent-Logs-Url: https://github.com/github/gh-aw-threat-detection/sessions/12f810e1-d6c2-4df2-b9f0-09cae2d660ce Co-authored-by: davidslater <12449447+davidslater@users.noreply.github.com>

Address yank workflow review feedback

48d63b1

Agent-Logs-Url: https://github.com/github/gh-aw-threat-detection/sessions/12f810e1-d6c2-4df2-b9f0-09cae2d660ce Co-authored-by: davidslater <12449447+davidslater@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Add an emergency yank process for unsafe threat detection releases~~ Add emergency yank process for unsafe threat detection releases May 7, 2026

Copilot finished work on behalf of davidslater May 7, 2026 19:23

Copilot AI requested a review from davidslater May 7, 2026 19:23

davidslater marked this pull request as ready for review May 7, 2026 19:42

Copilot AI review requested due to automatic review settings May 7, 2026 19:42

Merge branch 'main' into copilot/add-emergency-yank-process

bb92ed7

Copilot started reviewing on behalf of davidslater May 7, 2026 19:43 View session

Copilot AI reviewed May 7, 2026

View reviewed changes

Comment thread releases/lifecycle_test.go Outdated

Comment thread DEVGUIDE.md Outdated

github-actions Bot mentioned this pull request May 7, 2026

Smoke Test: Copilot - 25525744608 #35

Closed

Copilot started work on behalf of davidslater May 7, 2026 23:47 View session

Require yanked release image digests

f8efde0

Agent-Logs-Url: https://github.com/github/gh-aw-threat-detection/sessions/85fb37b4-0ed2-455c-9ca1-a156a74d65bb Co-authored-by: davidslater <12449447+davidslater@users.noreply.github.com>

Copilot finished work on behalf of davidslater May 7, 2026 23:50

Merge branch 'main' into copilot/add-emergency-yank-process

a05f669

davidslater requested a review from Copilot May 8, 2026 00:01

Copilot started reviewing on behalf of davidslater May 8, 2026 00:02 View session

Copilot started work on behalf of davidslater May 8, 2026 00:04 View session

Copilot AI reviewed May 8, 2026

View reviewed changes

Comment thread .github/workflows/yank-release.yml

Comment thread DEVGUIDE.md Outdated

Copilot AI and others added 3 commits May 8, 2026 00:08

Resolve main merge conflicts

24fb3da

Agent-Logs-Url: https://github.com/github/gh-aw-threat-detection/sessions/827177cf-9662-48f1-8ea5-bffe053ed198 Co-authored-by: davidslater <12449447+davidslater@users.noreply.github.com>

Merge main into emergency yank branch

e506d25

Co-authored-by: davidslater <12449447+davidslater@users.noreply.github.com>

Address merge validation review

55abf15

Agent-Logs-Url: https://github.com/github/gh-aw-threat-detection/sessions/827177cf-9662-48f1-8ea5-bffe053ed198 Co-authored-by: davidslater <12449447+davidslater@users.noreply.github.com>

Copilot finished work on behalf of davidslater May 8, 2026 00:13

Merge branch 'main' into copilot/add-emergency-yank-process

aa1119c

Copilot started work on behalf of davidslater May 8, 2026 00:22 View session

Support yanks without safe replacement

cfcf16f

Agent-Logs-Url: https://github.com/github/gh-aw-threat-detection/sessions/d9664543-c97b-4b2a-a73c-25db1a57db4d Co-authored-by: davidslater <12449447+davidslater@users.noreply.github.com>

Copilot finished work on behalf of davidslater May 8, 2026 00:27

davidslater requested a review from Copilot May 8, 2026 00:29

Copilot started reviewing on behalf of davidslater May 8, 2026 00:30 View session

Copilot AI reviewed May 8, 2026

View reviewed changes

Comment thread .github/workflows/yank-release.yml

validate_tag() {

local tag="$1"

if ! echo "$tag" | grep -Eq '^v[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?(\+[0-9A-Za-z.-]+)?$'; then

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add emergency yank process for unsafe threat detection releases#32

Add emergency yank process for unsafe threat detection releases#32
Copilot wants to merge 11 commits intomainfrom
copilot/add-emergency-yank-process

Copilot AI commented May 7, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

davidslater commented May 8, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI commented May 8, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

Copilot AI commented May 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Copilot's findings

Uh oh!

Uh oh!

Uh oh!

davidslater commented May 8, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot's findings

Uh oh!

Uh oh!

Uh oh!

Copilot AI commented May 8, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot's findings

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented May 7, 2026 •

edited

Loading