[copilot-pr-merged-report] Daily Copilot PR Merged Report - 2026-04-10

[github-actions[bot]]

🤖 Daily Copilot PR Merged Report - 2026-04-10

Summary

Analysis Period: 2026-04-09T15:27Z → 2026-04-10T15:27Z (last 24 hours)
Total Merged PRs: 26
Total Lines Added: 15,101
Total Lines Deleted: 12,796
Net Code Change: +2,305 lines

💡 Insights

• High-volume infrastructure day: PRs feat: update actions/github-script to v9.0.0 with builtin getOctokit #25553 (actions/github-script v9 bump) and Fix silent startup crash in Copilot engine by pinning CLI to v1.0.20 #25499/Pin copilot to v1.0.20 #25623/chore: bump CLI versions — Claude Code 2.1.98, Copilot 1.0.22 (unpin), Gemini 0.37.1 #25577 (CLI version pins/bumps) dominated the line count with mass lockfile regenerations. These are structural updates, not raw logic additions.
• Strong security focus: Three security-oriented PRs were merged — security: fix agent-stdio.log world-readable exposure and MCP gateway token leakage in redaction pipeline #25618 (agent log world-readable exposure + MCP token redaction), Add ValidateHeredocContent checks to 5 user-controlled heredoc sites #25510 (heredoc injection hardening), and Fix write-to-read codemod incorrectly converting id-token and copilot-requests permissions #25604 (permissions codemod fix). Test coverage accompanied all three.
• 12 of 26 PRs (46%) included test files, demonstrating healthy testing culture — particularly notable for bug fixes.

Merged Pull Requests (26)

PR #	Title	Lines Added	Lines Deleted	Test Files	Merged At
#25484	feat(safe-outputs): add allowed-events filter to submit-pull-request-review	327	5	2	15:33Z
#25499	Fix silent startup crash in Copilot engine by pinning CLI to v1.0.20	502	501	0	16:08Z
#25508	fix: remove invalid permission-discussions from GitHub App token fields	29	6	2	17:38Z
#25510	Add ValidateHeredocContent checks to 5 user-controlled heredoc sites	198	7	2	18:37Z
#25507	Wire up dead MCP config schema validation	234	10	1	19:06Z
#25524	Fix TestStepOrderingValidation_SecretRedactionBeforeUploads: tighten assertion	4	2	1	19:22Z
#25540	feat(otel): propagate parent span ID through aw_context for cross-job trace hierarchy	94	2	1	22:26Z
#25532	Remove deprecated add-comment.discussion (singular) in favor of discussions: true/false	214	43	2	22:26Z
#25542	fix: add proxy-args to stdio_mcp_tool schema top-level properties	7	0	0	22:29Z
#25541	[actions] Update GitHub Actions versions - 2026-04-09	33	33	0	22:32Z
#25556	refactor(static-analysis-report): build gh-aw from source instead of installing a release	27	35	0	00:14Z
#25560	Optimize Functional Pragmatist workflow token usage (~54% prompt reduction)	538	846	0	00:41Z
#25553	feat: update actions/github-script to v9.0.0 with builtin getOctokit	8,422	9,132	0	01:38Z
#25561	Normalize report formatting: add shared/reporting.md import to two daily workflows	27	23	0	01:51Z
#25571	feat: improve frontmatter hash checker with debug logging and failure propagation	1,552	192	0	05:04Z
#25577	chore: bump CLI versions — Claude Code 2.1.98, Copilot 1.0.22, Gemini 0.37.1	718	714	0	05:26Z
#25581	fix: handle race condition when PR is merged before agent job checks out branch	204	0	1	09:56Z
#25607	fix: apply Q's weekly workflow improvements + prevent git misuse in Q prompt	41	71	0	11:16Z
#25604	Fix write-to-read codemod incorrectly converting id-token and copilot-requests permissions	152	48	1	11:21Z
#25609	cli: try squash merge first, fall back to merge commit if not allowed	26	5	0	11:25Z
#25589	fix: introduce SupportsNativeAgentFile capability; move Claude agent-file injection to compiler	192	130	2	11:39Z
#25623	Pin copilot to v1.0.20	506	502	0	11:50Z
#25636	test: add regression coverage for .github/agents/ root-relative import path	66	0	1	12:43Z
#25639	fix(smoke-gemini): trigger on "smoke" label instead of "water"	21	21	0	14:34Z
#25628	refactor: centralize close-flow logic into shared createCloseEntityHandler factory	356	460	1	14:56Z
#25618	security: fix agent-stdio.log world-readable exposure and MCP gateway token leakage in redaction pipeline	611	8	0	14:58Z

Code Generation Metrics

• Total Lines Added: 15,101
• Total Lines Deleted: 12,796
• Net Change: +2,305 lines

Test Coverage

• PRs with test files: 12 / 26 (46%)
• Total test files touched: 17
  • Go tests (*_test.go): 13
  • JavaScript tests (*.test.cjs): 4
• Notable: 4 security/bug-fix PRs (Add ValidateHeredocContent checks to 5 user-controlled heredoc sites #25510, fix: remove invalid permission-discussions from GitHub App token fields #25508, Fix write-to-read codemod incorrectly converting id-token and copilot-requests permissions #25604, security: fix agent-stdio.log world-readable exposure and MCP gateway token leakage in redaction pipeline #25618) included accompanying tests

Workflow Execution

Token consumption data is not directly available via the GitHub API. Workflow execution time is used as a proxy for resource usage.

Note: The large additions/deletions on #25553 reflect mass lockfile regeneration from upgrading actions/github-script to v9 across all workflows (~200+ files), not new logic. Similarly, #25499/#25577/#25623 represent version pin updates propagated across all lock files.

---

References:

• §24250466152

Generated by Daily Copilot PR Merged Report · ● 985.7K · ◷

• expires on Apr 11, 2026, 3:32 PM UTC

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-04-11T15:32:06.620Z.

Closed by Workflow