[copilot-pr-merged-report] Daily Copilot PR Merged Report - 2026-03-31

[github-actions[bot]]

🤖 Daily Copilot PR Merged Report — 2026-03-31

Analysis Period: 2026-03-30 15:35 UTC → 2026-03-31 15:35 UTC (last 24 hours, merged PRs only)

---

Summary

Metric	Value
Total Merged PRs	41
Total Lines Added	8,468
Total Lines Deleted	9,717
Net Code Change	−1,249 lines
PRs with Test Activity	16 (39%)
Unique Test Files Touched	35

---

💡 Insights

• High velocity day: 41 merged PRs in 24 hours, spanning security fixes, feature additions, documentation, and large-scale workflow recompilation. Activity spanned a ~23-hour window.
• Net negative code: The −1,249 net change is dominated by PR #23509 (−4,369 net) which removed legacy APM/codemod code, and #23561 (−434 net) which simplified security checks. Both represent healthy dead code removal.
• Strong test coverage: 16 out of 41 PRs (39%) included test file modifications, with notable additions in MCP Gateway auth, version update validation, and permissions.

---

⭐ Notable PRs

Category	PR	Description
🔐 Security	#23735	Closed @mention neutralization bypass via invisible Unicode chars
🚀 Feature	#23575	Added version update check for compile-agentic activation (+1,080 lines)
🚀 Feature	#23611	MCP Gateway: Added upstream OIDC authentication
🚀 Feature	#23608	Added trusted-users to MCP Gateway guard policy
🚀 Feature	#23600	Allow extra permissions on github-app token for org-level API
🧹 Cleanup	#23509	Removed legacy APM dependencies (−4,677 deletions)

---

All 41 Merged Pull Requests

PR #	Title	+Added	−Deleted	Test Files	Merged At
#23735	fix: close @mention neutralization bypass via invisible chars	+80	−1	2	14:25 UTC
#23721	Remove unused integrityLevelOrder variable to fix lint	+0	−9	0	13:35 UTC
#23720	Skip update_cache_memory job when agent job is skipped	+235	−83	1	13:24 UTC
#23711	chore: bump gh-aw-firewall (AWF) to v0.25.5	+1,218	−1,213	0	13:13 UTC
#23707	refactor: eliminate semanticVersion duplicate struct and findGitRoot passthrough	+120	−133	6	13:25 UTC
#23706	Improve test quality: scripts/lint_error_messages_test.go	+245	−34	1	13:22 UTC
#23703	Fix engine failure message: include engine ID and use blob URL	+225	−18	0	12:53 UTC
#23702	fix: move protected files details section inside alert block	+23	−23	0	12:52 UTC
#23697	chore: update @sentry/mcp-server to 0.31.0	+17	−17	0	12:43 UTC
#23694	feat: add Release Punter workflow	+151	−0	0	12:50 UTC
#23685	fix(functional-pragmatist): replace make+len patterns for CodeQL	+12	−13	0	12:20 UTC
#23676	Recompile workflows to sync lock files with source markdown	+206	−206	0	11:57 UTC
#23647	fix: correct YAML indentation for detection job permissions block	+81	−1	1	05:34 UTC
#23645	Fix qmd indexing job failure due to TypeScript peer dependency conflict	+11	−11	0	05:26 UTC
#23644	chore: bump @playwright/mcp 0.0.68→0.0.69 and MCP Gateway v0.2.9→v0.2.10	+364	−364	0	05:33 UTC
#23635	docs: add Releases and Versioning reference page	+155	−1	0	04:11 UTC
#23633	Add CI job to test install-gh-aw.sh with stable release	+100	−5	0	04:05 UTC
#23632	fix: sync install.sh with install-gh-aw.sh and update test for stable version default	+3	−3	1	04:08 UTC
#23628	feat: default to stable version and resolve aliases in install-gh-aw.sh	+39	−5	0	03:50 UTC
#23627	feat: add approval-label cookie to all workflows with min-integrity: approved	+317	−283	0	05:01 UTC
#23626	Add release alias map to releases.json	+39	−6	0	03:06 UTC
#23625	fix(instructions-janitor): use GitHub MCP get_latest_release instead of git describe	+30	−28	0	02:55 UTC
#23624	fix: remove unused APM constants and references	+25	−82	0	03:06 UTC
#23613	fix(daily-doc-updater): add cookie-label approval and Step 1d	+47	−34	0	01:06 UTC
#23611	MCP Gateway: Add upstream OIDC authentication to schema, spec, and compiler	+549	−2	3	02:04 UTC
#23610	fix(safeoutputs): add required: ["labels"] to add_labels inputSchema	+6	−2	0	02:04 UTC
#23608	feat: add trusted-users to MCP Gateway guard policy	+509	−123	2	01:39 UTC
#23604	fix: restore actions/setup in upload_assets job after git branch switch (dev mode)	+230	−0	0	23:47 UTC
#23600	feat: Allow extra permissions on tools.github.github-app token for org-level API	+569	−116	1	00:35 UTC
#23599	[actions] Update GitHub Actions versions - 2026-03-30	+228	−228	0	23:21 UTC
#23588	feat: group all concatenations in "Create prompt with built-in context"	+72	−998	0	21:33 UTC
#23587	fix: restore actions/setup after cross-repo checkout in safe_outputs job	+417	−11	0	21:36 UTC
#23586	fix(step-names): align cache-memory git setup step with Setup <component> convention	+79	−79	1	21:34 UTC
#23585	docs: fix sitemap and RSS feed 404s	+6	−0	0	21:34 UTC
#23575	feat: add version update check for compile-agentic activation	+1,080	−0	2	22:39 UTC
#23574	fix: preserve read-all permissions when copilot-requests feature is enabled	+257	−6	2	19:33 UTC
#23571	fix: use git add --sparse to handle sparse-checkout on orphan branch first run	+32	−2	1	18:19 UTC
#23570	Add read role support to compiler; align docs with compiler behavior	+5	−5	0	18:20 UTC
#23562	refactor: eliminate duplicate GitHub host resolution and circular-dependency workaround	+4	−87	1	16:58 UTC
#23561	fix(security): remove timestamp check, rely solely on frontmatter hash for lock file integrity	+374	−808	3	17:52 UTC
#23509	feat: add shared/apm.md shared workflow with Microsoft APM support	+308	−4,677	7	01:23 UTC

Code & Test Metrics Breakdown

Test Coverage

• Total unique test files touched: 35
  • Go tests (*_test.go): 29 files
  • JavaScript tests (*.test.cjs): 6 files
• PRs with test activity: 16 of 41 (39%)

Top PRs by Test File Coverage

PR	Test Files Modified	Focus Area
#23509	7	APM cleanup
#23707	6	Refactoring
#23611	3	MCP Gateway OIDC
#23561	3	Security (hash integrity)
#23574	2	Permissions fix
#23575	2	Version update check
#23608	2	MCP Gateway guard policy

Workflow Execution

Token consumption data is not directly available via the GitHub Actions API. Workflow execution time is used as a proxy for resource usage, but was not collected for this report.

---

References:

• §23805742994

AI generated by Daily Copilot PR Merged Report · history

• expires on Apr 1, 2026, 3:40 PM UTC