Add skip-roles to conditionally skip workflows based on repository permissions by Copilot · Pull Request #15988 · github/gh-aw

Copilot · 2026-02-15T21:15:25Z

Implementation Plan for skip-roles Feature

This feature adds on.skip-roles: [...] to skip workflows for specified roles (e.g., admin, maintainer).

Original prompt

This section details on the original issue you should resolve

<issue_title>skip-roles</issue_title>
<issue_description>Add a front matter options on.skip-roles: [...] that allows to skip a workflow for particular roles. For example, in AI moderation scenario, certain check do not need to be applied to team members, only external users need to have it checked.
on:
  skip-roles: [admin, maintainer, write]
The check should be done in pre-activation and cleanly cancel activation. </issue_description>

Comments on the Issue (you are @copilot in this section)
@pelikhan /cloclo @pelikhan /cloclo @pelikhan /cloclo

Fixes skip-roles #15962

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

pelikhan

@copilot add skip roles to ai moderator: admin, maintainer, write, triage

- Add skip-roles: [admin, maintainer, write, triage] to ai-moderator.md - Remove custom check_external_user job (replaced by skip-roles) - Fix buildPreActivationAndActivationJobs to trigger on skip-roles and rate-limit - Update logging to include hasSkipRoles and hasRateLimit flags Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-02-15T21:49:41Z

@copilot add skip roles to ai moderator: admin, maintainer, write, triage

Added skip-roles: [admin, maintainer, write, triage] to ai-moderator.md and removed the custom check_external_user job. The workflow now uses the native skip-roles feature in pre-activation. (9a17b71)

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

https://api.github.com/user
- Triggering command: /usr/bin/gh gh api user --jq .login (http block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

pelikhan · 2026-02-15T21:59:21Z

@copilot merge main and recompile

…dd-skip-roles-option

Copilot · 2026-02-15T22:05:37Z

@copilot merge main and recompile

Merged main branch and recompiled all 154 workflows successfully. The merge commit (c822101) includes upstream changes to unlock job handling and other improvements. All skip-roles tests pass.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

https://api.github.com/graphql
- Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw (http block)
https://api.github.com/repos/actions/ai-inference/git/ref/tags/v2
- Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v2 --jq .object.sha (http block)
https://api.github.com/repos/actions/checkout/git/ref/tags/11bd71901bbe5b1630ceea73d27597364c9af683
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/11bd71901bbe5b1630ceea73d27597364c9af683 --jq .object.sha (http block)
https://api.github.com/repos/actions/checkout/git/ref/tags/v6
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha (http block)
https://api.github.com/repos/actions/download-artifact/git/ref/tags/v6
- Triggering command: /usr/bin/gh gh api /repos/actions/download-artifact/git/ref/tags/v6 --jq .object.sha (http block)
https://api.github.com/repos/actions/github-script/git/ref/tags/v7
- Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v7 --jq .object.sha (http block)
https://api.github.com/repos/actions/setup-go/git/ref/tags/4dc6199c7b1a012772edbd06daecab0f50c9053c
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/4dc6199c7b1a012772edbd06daecab0f50c9053c --jq .object.sha (http block)
https://api.github.com/repos/actions/setup-go/git/ref/tags/v5
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v5 --jq .object.sha (http block)
https://api.github.com/repos/actions/setup-go/git/ref/tags/v6
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v6 --jq .object.sha (http block)
https://api.github.com/repos/actions/setup-node/git/ref/tags/v6
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v6 --jq .object.sha (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v6 --jq .object.sha " -o gh-aw ./cmd/gh-aw (http block)
https://api.github.com/repos/actions/upload-artifact/git/ref/tags/v6
- Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v6 --jq .object.sha (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v6 --jq .object.sha logs/user.env (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v6 --jq .object.sha " -o gh-aw ./cmd/gh-aw (http block)
https://api.github.com/repos/anchore/sbom-action/git/ref/tags/v0
- Triggering command: /usr/bin/gh gh api /repos/anchore/sbom-action/git/ref/tags/v0 --jq .object.sha (http block)
https://api.github.com/repos/docker/build-push-action/git/ref/tags/v6
- Triggering command: /usr/bin/gh gh api /repos/docker/build-push-action/git/ref/tags/v6 --jq .object.sha (http block)
https://api.github.com/repos/docker/login-action/git/ref/tags/v3
- Triggering command: /usr/bin/gh gh api /repos/docker/login-action/git/ref/tags/v3 --jq .object.sha (http block)
https://api.github.com/repos/docker/metadata-action/git/ref/tags/v5
- Triggering command: /usr/bin/gh gh api /repos/docker/metadata-action/git/ref/tags/v5 --jq .object.sha (http block)
https://api.github.com/repos/docker/setup-buildx-action/git/ref/tags/v3
- Triggering command: /usr/bin/gh gh api /repos/docker/setup-buildx-action/git/ref/tags/v3 --jq .object.sha (http block)
https://api.github.com/repos/github/gh-aw/git/ref/tags/c4e091835c7a94dc7d3acb8ed3ae145afb4995f3
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/c4e091835c7a94dc7d3acb8ed3ae145afb4995f3 --jq .object.sha (http block)
https://api.github.com/repos/githubnext/agentics/git/ref/tags/-
- Triggering command: /usr/bin/gh gh api /repos/githubnext/agentics/git/ref/tags/- --jq .object.sha (http block)
https://api.github.com/user
- Triggering command: /usr/bin/gh gh api user --jq .login (http block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

pelikhan · 2026-02-15T22:17:06Z

@copilot lint go

Copilot

Pull request overview

This PR adds a skip-roles feature that allows workflows to conditionally skip execution based on repository permissions. The primary use case is AI moderation workflows that should only run for external contributors, not team members with elevated permissions.

Changes:

Added skip-roles configuration in the on: section (schema, extraction, YAML processing)
Implemented pre-activation check via check_skip_roles.cjs that queries GitHub API for user permissions
Updated pre-activation trigger logic to create pre_activation job when skip-roles or rate-limit are configured, even if roles: all is set
Applied the feature to AI moderator workflow, removing 87 lines of custom permission checking code

Reviewed changes

Copilot reviewed 14 out of 14 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
`pkg/parser/schemas/main_workflow_schema.json`	Added schema definition for skip-roles field supporting string or array format
`pkg/constants/constants.go`	Added CheckSkipRolesStepID and SkipRolesOkOutput constants
`pkg/workflow/compiler_types.go`	Added SkipRoles field to WorkflowData struct
`pkg/workflow/role_checks.go`	Added extractSkipRoles() and extractStringSliceField() helper functions
`pkg/workflow/compiler_orchestrator_workflow.go`	Integrated skip-roles extraction into workflow compilation
`pkg/workflow/compiler_jobs.go`	Updated pre-activation trigger condition to include hasSkipRoles and hasRateLimit flags
`pkg/workflow/compiler_activation_jobs.go`	Added skip-roles check step generation and condition to pre-activation job
`pkg/workflow/frontmatter_extraction_yaml.go`	Added YAML commenting logic for skip-roles field
`pkg/workflow/skip_roles_test.go`	Comprehensive tests for skip-roles feature including edge cases
`actions/setup/js/check_skip_roles.cjs`	JavaScript implementation using shared permission checking utility
`actions/setup/js/check_skip_roles.test.cjs`	Comprehensive unit tests for the JavaScript implementation
`.github/workflows/ai-moderator.md`	Applied skip-roles to AI moderator, replacing custom permission check
`.github/workflows/ai-moderator.lock.yml`	Compiled workflow with skip-roles pre-activation check
`.github/workflows/bot-detection.lock.yml`	Recompiled workflow with mention normalization (`@pelikhan` → `pelikhan`)

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

actions/setup/js/check_skip_roles.test.cjs

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-02-15T22:23:26Z

@copilot lint go

Go code linted successfully. Formatted compiler_unlock_job.go to remove trailing whitespace. All linter validations passed. (d96179a)

Initial plan

74399e7

Copilot AI assigned Copilot and pelikhan Feb 15, 2026

Copilot started work on behalf of pelikhan February 15, 2026 21:15 View session

Copilot AI and others added 4 commits February 15, 2026 21:20

Initial planning for skip-roles feature

296446f

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Add skip-roles feature implementation

80bdabe

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Fix skip-roles array commenting in YAML frontmatter

93143cf

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Remove example workflow files

14b9d59

Copilot AI changed the title ~~[WIP] Add front matter option to skip roles in workflow~~ Add skip-roles to conditionally skip workflows based on repository permissions Feb 15, 2026

Copilot AI requested a review from pelikhan February 15, 2026 21:34

Copilot finished work on behalf of pelikhan February 15, 2026 21:34

pelikhan reviewed Feb 15, 2026

View reviewed changes

Copilot started work on behalf of pelikhan February 15, 2026 21:43 View session

Copilot AI requested a review from pelikhan February 15, 2026 21:51

Copilot finished work on behalf of pelikhan February 15, 2026 21:51

Copilot started work on behalf of pelikhan February 15, 2026 21:59 View session

Merge branch 'main' of https://github.com/github/gh-aw into copilot/a…

c822101

…dd-skip-roles-option

Copilot finished work on behalf of pelikhan February 15, 2026 22:06

pelikhan marked this pull request as ready for review February 15, 2026 22:12

Copilot AI review requested due to automatic review settings February 15, 2026 22:12

Copilot started reviewing on behalf of pelikhan February 15, 2026 22:13 View session

pelikhan approved these changes Feb 15, 2026

View reviewed changes

Copilot AI reviewed Feb 15, 2026

View reviewed changes

actions/setup/js/check_skip_roles.test.cjs Show resolved Hide resolved

Copilot started work on behalf of pelikhan February 15, 2026 22:17 View session

Format Go code - remove trailing whitespace in compiler_unlock_job.go

d96179a

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI requested a review from pelikhan February 15, 2026 22:24

Copilot finished work on behalf of pelikhan February 15, 2026 22:24

pelikhan merged commit c16fce0 into main Feb 15, 2026

pelikhan deleted the copilot/add-skip-roles-option branch February 15, 2026 22:25

github-actions bot mentioned this pull request Feb 16, 2026

[docs] Update documentation for logs command and skip-bots/skip-roles features #16014

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add skip-roles to conditionally skip workflows based on repository permissions#15988

Add skip-roles to conditionally skip workflows based on repository permissions#15988
pelikhan merged 8 commits intomainfrom
copilot/add-skip-roles-option

Copilot AI commented Feb 15, 2026 •

edited

Loading

Uh oh!

pelikhan left a comment

Uh oh!

Copilot AI commented Feb 15, 2026 •

edited

Loading

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

pelikhan commented Feb 15, 2026

Uh oh!

Copilot AI commented Feb 15, 2026 •

edited

Loading

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

pelikhan commented Feb 15, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI commented Feb 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

Copilot AI commented Feb 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Implementation Plan for skip-roles Feature

Comments on the Issue (you are @copilot in this section)

Uh oh!

pelikhan left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI commented Feb 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

pelikhan commented Feb 15, 2026

Uh oh!

Copilot AI commented Feb 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

pelikhan commented Feb 15, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Copilot AI commented Feb 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Copilot AI commented Feb 15, 2026 •

edited

Loading

Copilot AI commented Feb 15, 2026 •

edited

Loading

Copilot AI commented Feb 15, 2026 •

edited

Loading