Fix agentic workflow incident handling

[Amaury Levé (Evangelink)]

Summary

• Route ResourceLock automation branches through nohwnd-bot/testfx with the existing machine-user credential, allowing draft PR creation when the repository blocks the run-scoped GITHUB_TOKEN.
• Prevent literal - pull request bodies by requiring the complete Markdown body in the safe-output request.
• Pin Test Improver threat detection to gpt-5-mini and require one complete, unformatted THREAT_DETECTION_RESULT line.
• Update the agentic-workflow authentication documentation and regenerate both lockfiles.

Fixes #10715.

Addresses the threat-detection parse_error recorded in #10711. This is intentionally non-closing because #10711 is the automatically managed detection ledger.

The output blocked by #10715 was recovered separately as draft PR #10718.

Security review

gh aw reports one new restricted-secret reference: BACKPORT_MACHINE_USER_PAT.

• This is an existing repository secret already used by deterministic automation; no new credential was created.
• The generated safe-output configuration uses it to push the head branch to nohwnd-bot/testfx and open the PR against microsoft/testfx.
• The agent sandbox does not receive the credential. The generated workflow includes it in secret redaction and the gh-aw manifest.
• Existing controls remain enforced: threat detection, draft PRs, one PR per run, resource-lock/* branches, explicit allowed/excluded files, protected-file blocking, and patch file/size limits.
• No actions were added or removed, no action pins or container digests changed, and no network redirects changed.
• The credential's exact scopes and expiry are managed outside this repository and could not be independently verified; maintainers should confirm they remain limited to the automation fork and upstream PR creation.

Validation

• gh aw compile resource-lock-refactoring test-improver --strict --approve --validate --no-emit
• python .github/scripts/check_action_pins.py
• Four review passes, including expert, adversarial, release-readiness, and post-fix reviews

[Copilot]

Pull request overview

Fixes agentic workflow incident handling for ResourceLock PR creation and Test Improver threat detection.

Changes:

• Routes ResourceLock PR branches through the automation fork using the machine-user credential.
• Prevents literal - PR bodies and constrains threat-detection output.
• Updates authentication documentation and regenerated workflows.

Show a summary per file

File	Description
.github/workflows/test-improver.md	Pins and constrains threat detection.
.github/workflows/test-improver.lock.yml	Regenerates the Test Improver workflow.
.github/workflows/resource-lock-refactoring.md	Configures fork-based PR creation and complete bodies.
.github/workflows/resource-lock-refactoring.lock.yml	Regenerates ResourceLock automation with PAT handling.
.github/workflows/README.md	Documents the authentication exception.

Review details

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 5/5 changed files
• Comments generated: 0
• Review effort level: Balanced

[github-actions]

Note

🤖 Automated review by GitHub Copilot. Generated by the Expert Code Review workflow. To request a follow-up action, reply by tagging @copilot directly.

✅ 22/22 dimensions clean — no findings.

This PR touches only agentic workflow sources (.md), their compiled lockfiles (.lock.yml), and the workflows README. No C# production code, tests, analyzers, MSBuild files, or PowerShell scripts are changed, so dimensions 1–14, 18–19, and 22 are N/A.

Applicable dimensions reviewed:

• Documentation Accuracy (17) — README updates accurately describe the new BACKPORT_MACHINE_USER_PAT secret, its purpose, and the explicit-exception carve-out for resource-lock-refactoring. The new agent instruction ("Never pass --body -") is clear and addresses a concrete incident.
• Build Infrastructure & Dependencies (20) — Both lockfiles were regenerated with --strict (metadata confirms "strict":true). No action pins or container digests changed. The BACKPORT_MACHINE_USER_PAT secret is added to the manifest, redaction list, and safe-outputs config consistently. The compiler_version remains v0.86.2 across both lockfiles.
• Scope & PR Discipline (21) — The PR addresses two related incidents (#10715 and #10711) and cross-references the recovered output (#10718). Changes are cohesive: one workflow gets cross-fork PR creation, the other gets a threat-detection pin. Both share the same root cause domain (agentic workflow incident handling).
• Security (9) — The PAT is an existing credential; the agent sandbox does not receive it. It flows only through GitHub Actions secret interpolation (${{ secrets.BACKPORT_MACHINE_USER_PAT }}), standard secret redaction, and the safe-outputs handler config. The PR description's security review section is thorough and appropriately scoped.