[adhoc-qa] 2026-10-20 QA Report

[github-actions[bot]]

Findings

• No change from yesterday's report (#12014): check-action-pins CI check still fails on main — python3 .github/scripts/check_action_pins.py reproduces 29 mismatches, same actions/setup-node v7.0.0→v7.1.0 drift (and github/codeql-action/upload-sarif in one file) vs. recorded gh-aw-manifest SHAs. Same root cause/class of problem as the closed #10258 (local gh aw toolchain divergence). Added a brief confirmation comment to #12014 instead of opening a new issue.
• Still can't fix it myself: gh extension install github/gh-aw fails with a TLS certificate verification error in this sandbox (tls: failed to verify certificate: x509: certificate is not valid for any names), and repo policy forbids hand-editing .lock.yml.
• ./build.sh (Debug) succeeds cleanly on main @ 9e447e0 — full restore+build, 0 errors/warnings, ~7m24s.
• Checked open PRs (#11980, #11990, #12027–#12031) and recent commits — nothing indicates a new regression.
• No open [adhoc-qa] discussion needed closing beyond the one already current (#12014); earlier ones are already closed/stale per repo history.

Commands used

• git log --oneline -5, git status
• github list_discussion_categories, list_discussions (Q&A), get_discussion (#12014)
• python3 .github/scripts/check_action_pins.py — reproduced 29-mismatch failure locally
• github search_issues (check-action-pins queries) — confirmed #10258 is the closed related root-cause issue, no new open issue needed
• github actions_list (list_workflow_runs for check-action-pins.yml) — confirmed ongoing failures through run #537
• which gh, gh extension list, gh extension install github/gh-aw — confirmed TLS cert failure persists
• ./build.sh (Debug, full restore+build) — succeeded
• github list_pull_requests (open PRs) — scanned for anything new

No web searches were performed. No bash commands were refused by policy.

Warning

Firewall blocked 94 domains

The following domains were blocked by the firewall during workflow execution:

• 0t3vsblobprodcus362.vsblob.vsassets.io
• 11vvsblobprodcus336.vsblob.vsassets.io
• 1javsblobprodcus364.vsblob.vsassets.io
• 1k9vsblobprodcus379.vsblob.vsassets.io
• 1oavsblobprodcus350.vsblob.vsassets.io
• 1p7vsblobprodcus324.vsblob.vsassets.io
• 1s1vsblobprodcus386.vsblob.vsassets.io
• 2kmvsblobprodcus39.vsblob.vsassets.io
• 2zrvsblobprodcus388.vsblob.vsassets.io
• 37bvsblobprodcus311.vsblob.vsassets.io
• 37cvsblobprodcus359.vsblob.vsassets.io
• 4m6vsblobprodcus384.vsblob.vsassets.io
• 4myvsblobprodcus32.vsblob.vsassets.io
• 4vyvsblobprodcus361.vsblob.vsassets.io
• 4zjvsblobprodcus390.vsblob.vsassets.io
• 51yvsblobprodcus36.vsblob.vsassets.io
• 5dkvsblobprodcus355.vsblob.vsassets.io
• 5rqvsblobprodcus385.vsblob.vsassets.io
• 6s7vsblobprodcus313.vsblob.vsassets.io
• 7k6vsblobprodcus337.vsblob.vsassets.io
• 7tjvsblobprodcus341.vsblob.vsassets.io
• 80zvsblobprodcus35.vsblob.vsassets.io
• 8xbvsblobprodcus382.vsblob.vsassets.io
• 96bvsblobprodcus338.vsblob.vsassets.io
• ajhvsblobprodcus363.vsblob.vsassets.io
• api.github.com
• bcnvsblobprodcus378.vsblob.vsassets.io
• builds.dotnet.microsoft.com
• c50vsblobprodcus330.vsblob.vsassets.io
• c78vsblobprodcus322.vsblob.vsassets.io
• cflvsblobprodcus383.vsblob.vsassets.io
• ci.dot.net
• ckzvsblobprodcus347.vsblob.vsassets.io
• d0svsblobprodcus381.vsblob.vsassets.io
• data.nuget.org
• dlbvsblobprodcus316.vsblob.vsassets.io
• e7bvsblobprodcus348.vsblob.vsassets.io
• fdpvsblobprodcus345.vsblob.vsassets.io
• frdvsblobprodcus327.vsblob.vsassets.io
• gbsvsblobprodcus365.vsblob.vsassets.io
• gervsblobprodcus329.vsblob.vsassets.io
• h6tvsblobprodcus346.vsblob.vsassets.io
• i1qvsblobprodcus353.vsblob.vsassets.io
• ibzvsblobprodcus369.vsblob.vsassets.io
• imzvsblobprodcus368.vsblob.vsassets.io
• jd4vsblobprodcus366.vsblob.vsassets.io
• josvsblobprodcus372.vsblob.vsassets.io
• jrqvsblobprodcus343.vsblob.vsassets.io
• k0ivsblobprodcus356.vsblob.vsassets.io
• k4kvsblobprodcus344.vsblob.vsassets.io
• kgfvsblobprodcus314.vsblob.vsassets.io
• kh4vsblobprodcus325.vsblob.vsassets.io
• kijvsblobprodcus387.vsblob.vsassets.io
• kmuvsblobprodcus389.vsblob.vsassets.io
• kxqvsblobprodcus376.vsblob.vsassets.io
• l49vsblobprodcus358.vsblob.vsassets.io
• l7avsblobprodcus319.vsblob.vsassets.io
• ljcvsblobprodcus317.vsblob.vsassets.io
• lylvsblobprodcus31.vsblob.vsassets.io
• m16vsblobprodcus374.vsblob.vsassets.io
• m6xvsblobprodcus342.vsblob.vsassets.io
• m8dvsblobprodcus37.vsblob.vsassets.io
• mfjvsblobprodcus373.vsblob.vsassets.io
• n3kvsblobprodcus335.vsblob.vsassets.io
• nn8vsblobprodcus340.vsblob.vsassets.io
• o3svsblobprodcus318.vsblob.vsassets.io
• ofvvsblobprodcus315.vsblob.vsassets.io
• p2ovsblobprodcus312.vsblob.vsassets.io
• pc2vsblobprodcus360.vsblob.vsassets.io
• pdfvsblobprodcus380.vsblob.vsassets.io
• pe3vsblobprodcus354.vsblob.vsassets.io
• pe4vsblobprodcus351.vsblob.vsassets.io
• pkgs.dev.azure.com
• pkvvsblobprodcus321.vsblob.vsassets.io
• rcxvsblobprodcus328.vsblob.vsassets.io
• releaseassets.githubusercontent.com
• s4uvsblobprodcus326.vsblob.vsassets.io
• s8mvsblobprodcus38.vsblob.vsassets.io
• se1vsblobprodcus349.vsblob.vsassets.io
• sqdvsblobprodcus333.vsblob.vsassets.io
• st8vsblobprodcus339.vsblob.vsassets.io
• tphvsblobprodcus375.vsblob.vsassets.io
• u3hvsblobprodcus371.vsblob.vsassets.io
• u6ovsblobprodcus377.vsblob.vsassets.io
• ukkvsblobprodcus352.vsblob.vsassets.io
• uy6vsblobprodcus34.vsblob.vsassets.io
• v53vsblobprodcus320.vsblob.vsassets.io
• vb4vsblobprodcus33.vsblob.vsassets.io
• vwvvsblobprodcus334.vsblob.vsassets.io
• x3yvsblobprodcus370.vsblob.vsassets.io
• xupvsblobprodcus332.vsblob.vsassets.io
• yluvsblobprodcus367.vsblob.vsassets.io
• yttvsblobprodcus357.vsblob.vsassets.io
• ytvvsblobprodcus310.vsblob.vsassets.io

[!TIP]
api.github.com is blocked because GitHub API access uses the built-in GitHub tools by default. Instead of adding api.github.com to network.allowed, use tools.github.mode: gh-proxy for direct pre-authenticated GitHub CLI access without requiring network access to api.github.com:

tools:
  github:
    mode: gh-proxy

See GitHub Tools for more information on gh-proxy mode.

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "0t3vsblobprodcus362.vsblob.vsassets.io"
    - "11vvsblobprodcus336.vsblob.vsassets.io"
    - "1javsblobprodcus364.vsblob.vsassets.io"
    - "1k9vsblobprodcus379.vsblob.vsassets.io"
    - "1oavsblobprodcus350.vsblob.vsassets.io"
    - "1p7vsblobprodcus324.vsblob.vsassets.io"
    - "1s1vsblobprodcus386.vsblob.vsassets.io"
    - "2kmvsblobprodcus39.vsblob.vsassets.io"
    - "2zrvsblobprodcus388.vsblob.vsassets.io"
    - "37bvsblobprodcus311.vsblob.vsassets.io"
    - "37cvsblobprodcus359.vsblob.vsassets.io"
    - "4m6vsblobprodcus384.vsblob.vsassets.io"
    - "4myvsblobprodcus32.vsblob.vsassets.io"
    - "4vyvsblobprodcus361.vsblob.vsassets.io"
    - "4zjvsblobprodcus390.vsblob.vsassets.io"
    - "51yvsblobprodcus36.vsblob.vsassets.io"
    - "5dkvsblobprodcus355.vsblob.vsassets.io"
    - "5rqvsblobprodcus385.vsblob.vsassets.io"
    - "6s7vsblobprodcus313.vsblob.vsassets.io"
    - "7k6vsblobprodcus337.vsblob.vsassets.io"
    - "7tjvsblobprodcus341.vsblob.vsassets.io"
    - "80zvsblobprodcus35.vsblob.vsassets.io"
    - "8xbvsblobprodcus382.vsblob.vsassets.io"
    - "96bvsblobprodcus338.vsblob.vsassets.io"
    - "ajhvsblobprodcus363.vsblob.vsassets.io"
    - "api.github.com"
    - "bcnvsblobprodcus378.vsblob.vsassets.io"
    - "builds.dotnet.microsoft.com"
    - "c50vsblobprodcus330.vsblob.vsassets.io"
    - "c78vsblobprodcus322.vsblob.vsassets.io"
    - "cflvsblobprodcus383.vsblob.vsassets.io"
    - "ci.dot.net"
    - "ckzvsblobprodcus347.vsblob.vsassets.io"
    - "d0svsblobprodcus381.vsblob.vsassets.io"
    - "data.nuget.org"
    - "dlbvsblobprodcus316.vsblob.vsassets.io"
    - "e7bvsblobprodcus348.vsblob.vsassets.io"
    - "fdpvsblobprodcus345.vsblob.vsassets.io"
    - "frdvsblobprodcus327.vsblob.vsassets.io"
    - "gbsvsblobprodcus365.vsblob.vsassets.io"
    - "gervsblobprodcus329.vsblob.vsassets.io"
    - "h6tvsblobprodcus346.vsblob.vsassets.io"
    - "i1qvsblobprodcus353.vsblob.vsassets.io"
    - "ibzvsblobprodcus369.vsblob.vsassets.io"
    - "imzvsblobprodcus368.vsblob.vsassets.io"
    - "jd4vsblobprodcus366.vsblob.vsassets.io"
    - "josvsblobprodcus372.vsblob.vsassets.io"
    - "jrqvsblobprodcus343.vsblob.vsassets.io"
    - "k0ivsblobprodcus356.vsblob.vsassets.io"
    - "k4kvsblobprodcus344.vsblob.vsassets.io"
    - "kgfvsblobprodcus314.vsblob.vsassets.io"
    - "kh4vsblobprodcus325.vsblob.vsassets.io"
    - "kijvsblobprodcus387.vsblob.vsassets.io"
    - "kmuvsblobprodcus389.vsblob.vsassets.io"
    - "kxqvsblobprodcus376.vsblob.vsassets.io"
    - "l49vsblobprodcus358.vsblob.vsassets.io"
    - "l7avsblobprodcus319.vsblob.vsassets.io"
    - "ljcvsblobprodcus317.vsblob.vsassets.io"
    - "lylvsblobprodcus31.vsblob.vsassets.io"
    - "m16vsblobprodcus374.vsblob.vsassets.io"
    - "m6xvsblobprodcus342.vsblob.vsassets.io"
    - "m8dvsblobprodcus37.vsblob.vsassets.io"
    - "mfjvsblobprodcus373.vsblob.vsassets.io"
    - "n3kvsblobprodcus335.vsblob.vsassets.io"
    - "nn8vsblobprodcus340.vsblob.vsassets.io"
    - "o3svsblobprodcus318.vsblob.vsassets.io"
    - "ofvvsblobprodcus315.vsblob.vsassets.io"
    - "p2ovsblobprodcus312.vsblob.vsassets.io"
    - "pc2vsblobprodcus360.vsblob.vsassets.io"
    - "pdfvsblobprodcus380.vsblob.vsassets.io"
    - "pe3vsblobprodcus354.vsblob.vsassets.io"
    - "pe4vsblobprodcus351.vsblob.vsassets.io"
    - "pkgs.dev.azure.com"
    - "pkvvsblobprodcus321.vsblob.vsassets.io"
    - "rcxvsblobprodcus328.vsblob.vsassets.io"
    - "releaseassets.githubusercontent.com"
    - "s4uvsblobprodcus326.vsblob.vsassets.io"
    - "s8mvsblobprodcus38.vsblob.vsassets.io"
    - "se1vsblobprodcus349.vsblob.vsassets.io"
    - "sqdvsblobprodcus333.vsblob.vsassets.io"
    - "st8vsblobprodcus339.vsblob.vsassets.io"
    - "tphvsblobprodcus375.vsblob.vsassets.io"
    - "u3hvsblobprodcus371.vsblob.vsassets.io"
    - "u6ovsblobprodcus377.vsblob.vsassets.io"
    - "ukkvsblobprodcus352.vsblob.vsassets.io"
    - "uy6vsblobprodcus34.vsblob.vsassets.io"
    - "v53vsblobprodcus320.vsblob.vsassets.io"
    - "vb4vsblobprodcus33.vsblob.vsassets.io"
    - "vwvvsblobprodcus334.vsblob.vsassets.io"
    - "x3yvsblobprodcus370.vsblob.vsassets.io"
    - "xupvsblobprodcus332.vsblob.vsassets.io"
    - "yluvsblobprodcus367.vsblob.vsassets.io"
    - "yttvsblobprodcus357.vsblob.vsassets.io"
    - "ytvvsblobprodcus310.vsblob.vsassets.io"

See Network Configuration for more information.

🤖 Automated content by GitHub Copilot. Generated by the Adhoc QA workflow. · copilot · auto · 75.3 AIC · ⌖ 5.8 AIC · ⊞ 12.7K · [◷]( · ◷)

_{Add this agentic workflow to your repo}

To install this agentic workflow, run

gh aw add githubnext/agentics/workflows/adhoc-qa.md@main

• expires on Oct 27, 2026, 5:59 AM UTC

[github-actions[bot]]

No new findings since this report. check_action_pins.py still reports the same actions/setup-node pin drift (already tracked in the earlier report). Main is now at e3d67c4. Nothing new to file.

🤖 Automated content by GitHub Copilot. Generated by the Adhoc QA workflow. · copilot · auto · 31 AIC · ⌖ 0.518 AIC · ⊞ 12.8K · [◷]( · ◷)

_{Add this agentic workflow to your repo}

To install this agentic workflow, run

gh aw add githubnext/agentics/workflows/adhoc-qa.md@main