[adhoc-qa] 2026-10-17 QA Report

[github-actions[bot]]

Findings

• New problem found: check-action-pins CI check has failed on every push to main since 2026-10-15T06:38 (5+ consecutive failures: runs #511, #515, #517, #526, #527, last success was #508-ish at 2026-10-14T16:45). Root cause: dependabot PR #11943 (actions/setup-node 7.0.0→7.1.0) rewrote uses: lines in 30 .lock.yml files without recompiling via gh aw compile, leaving gh-aw-manifest headers stale; a similar github/codeql-action/upload-sarif bump left malicious-code-scan.lock.yml with a v4.38.2/v4.38.3 mismatch (36 problems reported by check_action_pins.py).
• No create_issue safe-output tool is available in this workflow, so I could not file a new GitHub issue for this regression. Instead I added a detailed comment to the most recent prior [adhoc-qa] discussion (#11942) describing the root cause, evidence, and suggested fix (recompile affected workflows on the pinned gh aw toolchain and commit the corrected lock files).
• Could not attempt the fix myself: no network/certificate access in this sandbox to install the pinned gh aw CLI, and repo policy forbids hand-editing .lock.yml files.
• Reviewed 10 open PRs (#11983, #11991, #11990, #11978, #11984, #11980, #11305, #9725, #8585, #8580) — nothing else indicates a regression needing follow-up.
• No close_discussion safe-output tool is available, so prior open [adhoc-qa] discussions could not be closed programmatically (same limitation noted in prior reports).

Commands, searches, and pages used

• git log --oneline, git status — confirm clean working tree, latest commit
• github list_discussions / github get_discussion (#11965, #11942) — review prior QA reports
• github get_commit (e51893b, 020c8c6, 7e4cc82) — inspect recent commits
• github list_pull_requests, github pull_request_read (#11943) — identify the dependabot bump PR
• github actions_list / github actions_get (list_workflow_runs for main, check-action-pins.yml; get_workflow_run; list_workflow_jobs) — found 5 consecutive check-action-pins failures
• github get_job_logs (job 116974088546) — retrieved full "Action pin audit failed with 36 problem(s)" output
• github issue_read (#10258) — confirmed this is a distinct/new recurrence of a previously-fixed class of problem, not a reopen of that issue
• github search_issues (several queries) — confirmed no existing open issue tracks this specific regression
• grep/bash on .github/workflows/*.lock.yml and .github/aw/actions-lock.json — verified the exact SHA/version mismatch locations
• gh extension install github/gh-aw (attempted) — failed due to TLS certificate verification error in this sandbox; could not regenerate lock files
• ./build.sh --help — confirmed local toolchain is otherwise usable; full -pack -test run was out of scope for this pass

No web searches were performed. No bash commands were refused by policy (the gh aw extension install failed due to a network/TLS issue, not a policy refusal).

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

• api.github.com
• releaseassets.githubusercontent.com

[!TIP]
api.github.com is blocked because GitHub API access uses the built-in GitHub tools by default. Instead of adding api.github.com to network.allowed, use tools.github.mode: gh-proxy for direct pre-authenticated GitHub CLI access without requiring network access to api.github.com:

tools:
  github:
    mode: gh-proxy

See GitHub Tools for more information on gh-proxy mode.

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.github.com"
    - "releaseassets.githubusercontent.com"

See Network Configuration for more information.

🤖 Automated content by GitHub Copilot. Generated by the Adhoc QA workflow. · copilot · auto · 170.3 AIC · ⌖ 7.03 AIC · ⊞ 12.9K · [◷]( · ◷)

_{Add this agentic workflow to your repo}

To install this agentic workflow, run

gh aw add githubnext/agentics/workflows/adhoc-qa.md@main

• expires on Oct 24, 2026, 5:53 AM UTC

[github-actions[bot]]

No new findings — repo state is unchanged since this report (still on commit e51893b). Re-ran python .github/scripts/check_action_pins.py and confirmed the same root cause persists: the dependabot actions/setup-node 7.0.0→7.1.0 bump (PR #11943) and a codeql-action v4.38.2/v4.38.3 mismatch left gh-aw-manifest headers stale across 30+ .lock.yml files, still failing check-action-pins on every push to main (still no fix merged). Reviewed current open PRs — nothing new needing follow-up. As before, no create_issue/close_discussion safe-output tools are available in this workflow, so I can't file a tracking issue or close prior QA discussions programmatically.

🤖 Automated content by GitHub Copilot. Generated by the Adhoc QA workflow. · copilot · auto · 36.6 AIC · ⌖ 6.2 AIC · ⊞ 12.9K · [◷]( · ◷)

_{Add this agentic workflow to your repo}

To install this agentic workflow, run

gh aw add githubnext/agentics/workflows/adhoc-qa.md@main

[github-actions[bot]]

2026-10-19 QA check-in — still unresolved since the previous report.

check-action-pins.yml (.github/scripts/check_action_pins.py) still fails on main with the same 36 problems: actions/setup-node resolves to two SHAs (v7.0.0 vs v7.1.0) across all 39 .lock.yml files, and github/codeql-action/upload-sarif mismatches in malicious-code-scan.lock.yml (v4.38.2 vs v4.38.3). No lock files were touched in main since this was first flagged here on 2026-10-17 (verified via python3 .github/scripts/check_action_pins.py locally today — identical output). This is the same local-gh aw-vs-CI-toolchain divergence class as the closed microsoft/testfx#10258. Still unable to regenerate locks myself: gh extension install github/gh-aw fails with a TLS certificate error in this sandbox, and repo policy forbids hand-editing .lock.yml.

No other new regressions found; ./build.sh succeeds cleanly on main (ef4ea6d).

Warning

Firewall blocked 94 domains

The following domains were blocked by the firewall during workflow execution:

• 0t3vsblobprodcus362.vsblob.vsassets.io
• 11vvsblobprodcus336.vsblob.vsassets.io
• 1javsblobprodcus364.vsblob.vsassets.io
• 1k9vsblobprodcus379.vsblob.vsassets.io
• 1oavsblobprodcus350.vsblob.vsassets.io
• 1p7vsblobprodcus324.vsblob.vsassets.io
• 1s1vsblobprodcus386.vsblob.vsassets.io
• 2kmvsblobprodcus39.vsblob.vsassets.io
• 2zrvsblobprodcus388.vsblob.vsassets.io
• 37bvsblobprodcus311.vsblob.vsassets.io
• 37cvsblobprodcus359.vsblob.vsassets.io
• 4m6vsblobprodcus384.vsblob.vsassets.io
• 4myvsblobprodcus32.vsblob.vsassets.io
• 4vyvsblobprodcus361.vsblob.vsassets.io
• 4zjvsblobprodcus390.vsblob.vsassets.io
• 51yvsblobprodcus36.vsblob.vsassets.io
• 5dkvsblobprodcus355.vsblob.vsassets.io
• 5rqvsblobprodcus385.vsblob.vsassets.io
• 6s7vsblobprodcus313.vsblob.vsassets.io
• 7k6vsblobprodcus337.vsblob.vsassets.io
• 7tjvsblobprodcus341.vsblob.vsassets.io
• 80zvsblobprodcus35.vsblob.vsassets.io
• 8xbvsblobprodcus382.vsblob.vsassets.io
• 96bvsblobprodcus338.vsblob.vsassets.io
• ajhvsblobprodcus363.vsblob.vsassets.io
• api.github.com
• bcnvsblobprodcus378.vsblob.vsassets.io
• builds.dotnet.microsoft.com
• c50vsblobprodcus330.vsblob.vsassets.io
• c78vsblobprodcus322.vsblob.vsassets.io
• cflvsblobprodcus383.vsblob.vsassets.io
• ci.dot.net
• ckzvsblobprodcus347.vsblob.vsassets.io
• d0svsblobprodcus381.vsblob.vsassets.io
• data.nuget.org
• dlbvsblobprodcus316.vsblob.vsassets.io
• e7bvsblobprodcus348.vsblob.vsassets.io
• fdpvsblobprodcus345.vsblob.vsassets.io
• frdvsblobprodcus327.vsblob.vsassets.io
• gbsvsblobprodcus365.vsblob.vsassets.io
• gervsblobprodcus329.vsblob.vsassets.io
• h6tvsblobprodcus346.vsblob.vsassets.io
• i1qvsblobprodcus353.vsblob.vsassets.io
• ibzvsblobprodcus369.vsblob.vsassets.io
• imzvsblobprodcus368.vsblob.vsassets.io
• jd4vsblobprodcus366.vsblob.vsassets.io
• josvsblobprodcus372.vsblob.vsassets.io
• jrqvsblobprodcus343.vsblob.vsassets.io
• k0ivsblobprodcus356.vsblob.vsassets.io
• k4kvsblobprodcus344.vsblob.vsassets.io
• kgfvsblobprodcus314.vsblob.vsassets.io
• kh4vsblobprodcus325.vsblob.vsassets.io
• kijvsblobprodcus387.vsblob.vsassets.io
• kmuvsblobprodcus389.vsblob.vsassets.io
• kxqvsblobprodcus376.vsblob.vsassets.io
• l49vsblobprodcus358.vsblob.vsassets.io
• l7avsblobprodcus319.vsblob.vsassets.io
• ljcvsblobprodcus317.vsblob.vsassets.io
• lylvsblobprodcus31.vsblob.vsassets.io
• m16vsblobprodcus374.vsblob.vsassets.io
• m6xvsblobprodcus342.vsblob.vsassets.io
• m8dvsblobprodcus37.vsblob.vsassets.io
• mfjvsblobprodcus373.vsblob.vsassets.io
• n3kvsblobprodcus335.vsblob.vsassets.io
• nn8vsblobprodcus340.vsblob.vsassets.io
• o3svsblobprodcus318.vsblob.vsassets.io
• ofvvsblobprodcus315.vsblob.vsassets.io
• p2ovsblobprodcus312.vsblob.vsassets.io
• pc2vsblobprodcus360.vsblob.vsassets.io
• pdfvsblobprodcus380.vsblob.vsassets.io
• pe3vsblobprodcus354.vsblob.vsassets.io
• pe4vsblobprodcus351.vsblob.vsassets.io
• pkgs.dev.azure.com
• pkvvsblobprodcus321.vsblob.vsassets.io
• rcxvsblobprodcus328.vsblob.vsassets.io
• releaseassets.githubusercontent.com
• s4uvsblobprodcus326.vsblob.vsassets.io
• s8mvsblobprodcus38.vsblob.vsassets.io
• se1vsblobprodcus349.vsblob.vsassets.io
• sqdvsblobprodcus333.vsblob.vsassets.io
• st8vsblobprodcus339.vsblob.vsassets.io
• tphvsblobprodcus375.vsblob.vsassets.io
• u3hvsblobprodcus371.vsblob.vsassets.io
• u6ovsblobprodcus377.vsblob.vsassets.io
• ukkvsblobprodcus352.vsblob.vsassets.io
• uy6vsblobprodcus34.vsblob.vsassets.io
• v53vsblobprodcus320.vsblob.vsassets.io
• vb4vsblobprodcus33.vsblob.vsassets.io
• vwvvsblobprodcus334.vsblob.vsassets.io
• x3yvsblobprodcus370.vsblob.vsassets.io
• xupvsblobprodcus332.vsblob.vsassets.io
• yluvsblobprodcus367.vsblob.vsassets.io
• yttvsblobprodcus357.vsblob.vsassets.io
• ytvvsblobprodcus310.vsblob.vsassets.io

[!TIP]
api.github.com is blocked because GitHub API access uses the built-in GitHub tools by default. Instead of adding api.github.com to network.allowed, use tools.github.mode: gh-proxy for direct pre-authenticated GitHub CLI access without requiring network access to api.github.com:

tools:
  github:
    mode: gh-proxy

See GitHub Tools for more information on gh-proxy mode.

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "0t3vsblobprodcus362.vsblob.vsassets.io"
    - "11vvsblobprodcus336.vsblob.vsassets.io"
    - "1javsblobprodcus364.vsblob.vsassets.io"
    - "1k9vsblobprodcus379.vsblob.vsassets.io"
    - "1oavsblobprodcus350.vsblob.vsassets.io"
    - "1p7vsblobprodcus324.vsblob.vsassets.io"
    - "1s1vsblobprodcus386.vsblob.vsassets.io"
    - "2kmvsblobprodcus39.vsblob.vsassets.io"
    - "2zrvsblobprodcus388.vsblob.vsassets.io"
    - "37bvsblobprodcus311.vsblob.vsassets.io"
    - "37cvsblobprodcus359.vsblob.vsassets.io"
    - "4m6vsblobprodcus384.vsblob.vsassets.io"
    - "4myvsblobprodcus32.vsblob.vsassets.io"
    - "4vyvsblobprodcus361.vsblob.vsassets.io"
    - "4zjvsblobprodcus390.vsblob.vsassets.io"
    - "51yvsblobprodcus36.vsblob.vsassets.io"
    - "5dkvsblobprodcus355.vsblob.vsassets.io"
    - "5rqvsblobprodcus385.vsblob.vsassets.io"
    - "6s7vsblobprodcus313.vsblob.vsassets.io"
    - "7k6vsblobprodcus337.vsblob.vsassets.io"
    - "7tjvsblobprodcus341.vsblob.vsassets.io"
    - "80zvsblobprodcus35.vsblob.vsassets.io"
    - "8xbvsblobprodcus382.vsblob.vsassets.io"
    - "96bvsblobprodcus338.vsblob.vsassets.io"
    - "ajhvsblobprodcus363.vsblob.vsassets.io"
    - "api.github.com"
    - "bcnvsblobprodcus378.vsblob.vsassets.io"
    - "builds.dotnet.microsoft.com"
    - "c50vsblobprodcus330.vsblob.vsassets.io"
    - "c78vsblobprodcus322.vsblob.vsassets.io"
    - "cflvsblobprodcus383.vsblob.vsassets.io"
    - "ci.dot.net"
    - "ckzvsblobprodcus347.vsblob.vsassets.io"
    - "d0svsblobprodcus381.vsblob.vsassets.io"
    - "data.nuget.org"
    - "dlbvsblobprodcus316.vsblob.vsassets.io"
    - "e7bvsblobprodcus348.vsblob.vsassets.io"
    - "fdpvsblobprodcus345.vsblob.vsassets.io"
    - "frdvsblobprodcus327.vsblob.vsassets.io"
    - "gbsvsblobprodcus365.vsblob.vsassets.io"
    - "gervsblobprodcus329.vsblob.vsassets.io"
    - "h6tvsblobprodcus346.vsblob.vsassets.io"
    - "i1qvsblobprodcus353.vsblob.vsassets.io"
    - "ibzvsblobprodcus369.vsblob.vsassets.io"
    - "imzvsblobprodcus368.vsblob.vsassets.io"
    - "jd4vsblobprodcus366.vsblob.vsassets.io"
    - "josvsblobprodcus372.vsblob.vsassets.io"
    - "jrqvsblobprodcus343.vsblob.vsassets.io"
    - "k0ivsblobprodcus356.vsblob.vsassets.io"
    - "k4kvsblobprodcus344.vsblob.vsassets.io"
    - "kgfvsblobprodcus314.vsblob.vsassets.io"
    - "kh4vsblobprodcus325.vsblob.vsassets.io"
    - "kijvsblobprodcus387.vsblob.vsassets.io"
    - "kmuvsblobprodcus389.vsblob.vsassets.io"
    - "kxqvsblobprodcus376.vsblob.vsassets.io"
    - "l49vsblobprodcus358.vsblob.vsassets.io"
    - "l7avsblobprodcus319.vsblob.vsassets.io"
    - "ljcvsblobprodcus317.vsblob.vsassets.io"
    - "lylvsblobprodcus31.vsblob.vsassets.io"
    - "m16vsblobprodcus374.vsblob.vsassets.io"
    - "m6xvsblobprodcus342.vsblob.vsassets.io"
    - "m8dvsblobprodcus37.vsblob.vsassets.io"
    - "mfjvsblobprodcus373.vsblob.vsassets.io"
    - "n3kvsblobprodcus335.vsblob.vsassets.io"
    - "nn8vsblobprodcus340.vsblob.vsassets.io"
    - "o3svsblobprodcus318.vsblob.vsassets.io"
    - "ofvvsblobprodcus315.vsblob.vsassets.io"
    - "p2ovsblobprodcus312.vsblob.vsassets.io"
    - "pc2vsblobprodcus360.vsblob.vsassets.io"
    - "pdfvsblobprodcus380.vsblob.vsassets.io"
    - "pe3vsblobprodcus354.vsblob.vsassets.io"
    - "pe4vsblobprodcus351.vsblob.vsassets.io"
    - "pkgs.dev.azure.com"
    - "pkvvsblobprodcus321.vsblob.vsassets.io"
    - "rcxvsblobprodcus328.vsblob.vsassets.io"
    - "releaseassets.githubusercontent.com"
    - "s4uvsblobprodcus326.vsblob.vsassets.io"
    - "s8mvsblobprodcus38.vsblob.vsassets.io"
    - "se1vsblobprodcus349.vsblob.vsassets.io"
    - "sqdvsblobprodcus333.vsblob.vsassets.io"
    - "st8vsblobprodcus339.vsblob.vsassets.io"
    - "tphvsblobprodcus375.vsblob.vsassets.io"
    - "u3hvsblobprodcus371.vsblob.vsassets.io"
    - "u6ovsblobprodcus377.vsblob.vsassets.io"
    - "ukkvsblobprodcus352.vsblob.vsassets.io"
    - "uy6vsblobprodcus34.vsblob.vsassets.io"
    - "v53vsblobprodcus320.vsblob.vsassets.io"
    - "vb4vsblobprodcus33.vsblob.vsassets.io"
    - "vwvvsblobprodcus334.vsblob.vsassets.io"
    - "x3yvsblobprodcus370.vsblob.vsassets.io"
    - "xupvsblobprodcus332.vsblob.vsassets.io"
    - "yluvsblobprodcus367.vsblob.vsassets.io"
    - "yttvsblobprodcus357.vsblob.vsassets.io"
    - "ytvvsblobprodcus310.vsblob.vsassets.io"

See Network Configuration for more information.

🤖 Automated content by GitHub Copilot. Generated by the Adhoc QA workflow. · copilot · auto · 171.2 AIC · ⌖ 4.41 AIC · ⊞ 12.7K · [◷]( · ◷)

_{Add this agentic workflow to your repo}

To install this agentic workflow, run

gh aw add githubnext/agentics/workflows/adhoc-qa.md@main