fix: provision Spec Kit CLI + assess extension in feature-assess host setup steps - #4195
Merged
mnriem merged 1 commit intoAug 18, 2026
Merged
Conversation
…st setup steps The prior fix (github#4193) added setup-uv/setup-python actions but the CLI was still installed by the agent at runtime, which fails: inside the gh-aw firewall container `uv` is not on PATH, bare `python3` resolves to PyPy, and the Copilot permission gate blocks ad-hoc interpreter/installer fallbacks. As a result `specify` never installed and the assess skills only "worked" by the agent reading raw command files. Move provisioning into host setup steps that run before the agent starts (full network, working PATH): - Install the CLI with `uv pip install --system` so the `specify` entry point lands in the tool-cache Python bin the agent container adds to PATH. - Run `specify init --here --integration copilot` and `specify extension add assess` on the host so the five `speckit.assess.*` skills exist when the agent runs. Rewrite intro + Step 1 so the agent confirms (not installs) the preinstalled environment, and renumber the pipeline steps accordingly. Mark the setup steps `continue-on-error` so a provisioning failure still lets the agent start and post the operational-failure comment instead of hard-failing the job. Recompile feature-assess.lock.yml. Assisted-by: GitHub Copilot (model: Claude Opus 4.8, autonomous) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: ed10e45c-6fce-48c8-815f-cf905a4e553f
Contributor
There was a problem hiding this comment.
Pull request overview
Moves Spec Kit and assess extension provisioning into pre-agent host steps.
Changes:
- Installs and initializes Spec Kit before Copilot starts.
- Updates agent instructions and failure handling.
- Regenerates the compiled workflow.
Show a summary per file
| File | Description |
|---|---|
.github/workflows/feature-assess.md |
Adds provisioning steps and revises agent guidance. |
.github/workflows/feature-assess.lock.yml |
Updates generated workflow setup and metadata. |
Review details
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
- Files reviewed: 2/2 changed files
- Comments generated: 2
- Review effort level: Balanced
Comment on lines
+135
to
+147
| For each pipeline stage below, "run the `<stage>` assess command" means: locate | ||
| that installed command's definition (search under the Copilot command/skill | ||
| files created by the setup steps — e.g. `.github/`-scoped skill files — and under | ||
| `.specify/` and `extensions/assess/`) and **follow its instructions faithfully** | ||
| against the idea, honouring its non-interactive branch. Stay inside each stage's | ||
| lane — earlier stages capture and gather; they do not decide. | ||
|
|
||
| If the environment is missing (no `specify` on `PATH`, or the `assess` command | ||
| definitions cannot be found), **stop**: post one comment explaining the | ||
| **operational/environment failure** and stop **without applying any verdict | ||
| label**. An install or environment failure is an operational problem with the | ||
| runner, not a judgment about the request — do **not** apply `feature-invalid` | ||
| (that label is reserved for unassessable request content, per Step 5). |
Comment on lines
+47
to
+49
| - name: Install Spec Kit CLI | ||
| continue-on-error: true | ||
| run: uv pip install --system "${{ github.workspace }}" |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The
feature-assessworkflow could not actually run Spec Kit. The prior fix (#4193) addedsetup-uv/setup-pythonactions, but the CLI was still installed by the agent at runtime, which cannot work inside the gh-aw firewall container:uvis not on the containerPATH(setup-uv doesn't place its binary under a tool-cachebindir the container rebuildsPATHfrom).python3resolves to PyPy 3.9, not the CPython 3.14 thatactions/setup-pythoninstalled.--no-ask-user) blocks ad-hoc interpreter/installer fallbacks (uv tool install,curl … | sh, versionedpython3.12, full-path pythons).Net effect:
specifynever installed, and the run only "succeeded" because the agent fell back to readingextensions/assess/commands/*.mddirectly — thespeckit.assess.*skills were never provisioned.Fix
Move all provisioning into host setup steps that run before the agent starts (full network, working host
PATH):Install Spec Kit CLI—uv pip install --system "${{ github.workspace }}", so thespecifyentry point lands in the tool-cache Pythonbinthe agent container adds toPATH.Initialize Spec Kit and install the assess extension—specify init --here --integration copilot --script sh --forcethenspecify extension add assess, so the fivespeckit.assess.*skills exist when the agent runs.Supporting changes:
continue-on-errorso a provisioning failure still lets the agent start and post the operational-failure comment instead of hard-failing the job. (The compiler hoists the recognizedSetup uvaction and strips the flag from it; the failure-prone custom steps keep it.)feature-assess.lock.yml. Diff vs the current lock is minimal: metadata hash + the new setup steps.Notes
bug-testworkflow'suv pip install --systemsetup pattern..gitattributesor.github/aw/actions-lock.json.This PR was authored autonomously by GitHub Copilot (model: Claude Opus 4.8) on behalf of @mnriem. Commits carry
Assisted-by:trailers per the repository's agent-disclosure policy.