Fix Ollama CPU warm-up and isolate hosted threat detection by pelikhan · Pull Request #71244 · github/gh-aw

pelikhan · 2026-10-22T23:34:51Z

Summary

Fixes the Daily BYOK Ollama Test failure observed in https://github.com/github/gh-aw/actions/runs/39864818048.

Set LLAMA_ARG_REPACK=0 on the Ollama server so its llama.cpp child uses standard CPU buffers instead of the AMX extra-weight-buffer path. The observed v0.31.1 runner repeatedly segfaulted during model warm-up immediately after selecting AMX buffers on the hosted Xeon CPU; more retries cannot fix that native crash. The pinned Ollama version, verified installer, model, and BYOK endpoint remain unchanged. Ollama v0.31.1 embeds llama.cpp b9840, whose supported LLAMA_ARG_REPACK option disables extra model buffer types; Ollama inherits this environment into llama-server.
Independently fix the detector's provider failure: detection runs on a separate runner but inherited the agent's local Ollama URL, ephemeral key expression, and qwen model. Its logged provider-authentication HTTP 403 is a separately coupled configuration failure, not evidence that the warm-up crash caused its missing result file. Use an explicit Claude detector with GitHub-hosted Haiku and Actions-token inference, preserving enabled detection and AWF protections.
Add regressions covering startup configuration and both inline/external detector rendering, including no local endpoint/key/model inheritance and no Anthropic-secret dependency. Regenerate the production lock.

Validation

go test ./pkg/workflow -run '^TestDailyBYOKOllama' -count=1 passes; both regressions fail against the original workflow source in an isolated snapshot.
make fmt passes.
Current compiler compile daily-byok-ollama-test --validate --shellcheck --no-check-update passes; model-inventory validation passes with the existing experimental-feature notice.
make recompile succeeds for all 346 workflows in a disposable snapshot.
PATH=/opt/homebrew/bin:$PATH make agent-report-progress passes Go/custom lint, schema freshness, impacted unit tests, and repository-wide workflow drift checks.
Read-only security review of exact source/lock/test hashes: PASS, all ten controls satisfied. Newly reachable pinned Claude install provenance and lifecycle source verified separately; no confirmed vulnerabilities.

Dry-run compilation intentionally rejects this workflow's authored host setup/post steps, so no diagnostic lock was emitted. No workflow was dispatched or rerun. Actual inference on an AMX-capable hosted runner remains unverified; the local coverage establishes the configuration and generated routing, not live native inference.

Markdown security overview

Source	Change	Security impact
permissions, lines 8–11	Enable `copilot-requests: write`.	Authorizes hosted detector inference using `github.token`, without adding repository write permissions.
startup, lines 40–46	Disable CPU weight repacking.	Fixed supported process setting; installer provenance, endpoint, and sandbox remain unchanged.
detection, lines 180–186	Use a distinct explicit GitHub-hosted detector.	Prevents agent-local provider/key inheritance while keeping threat detection and credential exclusions enabled.

Disable llama.cpp weight repacking to avoid the hosted Xeon AMX warm-up crash. Run detection with an explicit GitHub-hosted provider instead of inheriting the agent runner's local Ollama endpoint. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

github-actions · 2026-10-22T23:37:37Z

🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer

github-actions · 2026-10-22T23:37:40Z

✅ PR Code Quality Reviewer completed the code quality review.

🔎 Code quality review by PR Code Quality Reviewer

github-actions · 2026-10-22T23:37:52Z

✅ Ponytail Reviewer completed successfully!

Ponytail Reviewer

Outcome: reported_no_action

The agent completed and reported no action. A no-op output alone does not verify that all required work was completed or that publication was possible.

Agent messages are omitted from this comment. The category uses structured run status, not interpretation of agent prose.

Generated from Ponytail Reviewer · gpt56 · ~7 AIC · ⌖ ~6 AIC · ⊞ 14.8K · ◷

Generated by Ponytail Reviewer for #71244

github-actions · 2026-10-22T23:38:00Z

✅ Design Decision Gate 🏗️ completed the design decision gate check. See the comment below for the result and any generated ADR draft.

Design Decision Gate 🏗️

Outcome: reported_no_action

The agent completed and reported no action. A no-op output alone does not verify that all required work was completed or that publication was possible.

Agent messages are omitted from this comment. The category uses structured run status, not interpretation of agent prose.

Generated from Design Decision Gate 🏗️ · opus55 · ~12 AIC · ⌖ ~32 AIC · ◇ ~15 AIC · ⊞ 1.9K · ◷

🏗️ ADR gate enforced by Design Decision Gate 🏗️

github-actions · 2026-10-22T23:38:27Z

✅ Test Quality Sentinel completed test quality analysis.

Test Quality Sentinel

Outcome: reported_no_action

The agent completed and reported no action. A no-op output alone does not verify that all required work was completed or that publication was possible.

Agent messages are omitted from this comment. The category uses structured run status, not interpretation of agent prose.

Generated from Test Quality Sentinel · haiku45 · ~6 AIC · ⌖ ~8 AIC · ◇ ~3 AIC · ⊞ 9.2K · ◷

🧪 Test quality analysis by Test Quality Sentinel

Copilot

🔵 Needs a closer look

The hardware-specific workaround and hosted detector authentication remain unverified end to end on the target runner.

1 open issue

Check rendered ANTHROPIC_MODEL instead of modelOverrides · New

What changed in this PR

This PR updates gh-aw’s daily Ollama BYOK workflow to address the reported CPU warm-up crash and separate hosted threat detection from the local Ollama configuration.

Changes:

Disable CPU weight repacking while preserving the pinned Ollama version and model.
Configure GitHub-hosted Claude Haiku detection with Actions-token authentication.
Add startup and detector-routing regressions and regenerate the compiled workflow.

File	Description
`pkg/workflow/daily_byok_ollama_test.go`	Adds startup configuration and detector-isolation regression checks.
`.github/workflows/daily-byok-ollama-test.md`	Sets the CPU workaround and explicit hosted detector configuration.
`.github/workflows/daily-byok-ollama-test.lock.yml`	Regenerates executable jobs with the new startup, permissions, and detector settings.

_{Review effort: Max}

+			assert.NotContains(t, steps, "env.OLLAMA_API_KEY")
+			assert.NotContains(t, steps, "qwen2.5:0.5b")
+			assert.Contains(t, steps, "COPILOT_GITHUB_TOKEN: ${{ github.token }}")
+			assert.Contains(t, steps, "claude-haiku-4.5")


github-actions · 2026-10-23T00:10:09Z

🎉 This pull request is included in a new release.

Release: v0.93.1

Copilot AI max review requested due to automatic review settings October 22, 2026 23:34

Copilot started reviewing on behalf of pelikhan October 22, 2026 23:35

View session

pelikhan marked this pull request as draft October 22, 2026 23:36

pelikhan marked this pull request as ready for review October 22, 2026 23:36

pelikhan merged commit 3103173 into main Oct 22, 2026
36 of 41 checks passed

pelikhan deleted the pelikhan-scaling-lamp branch October 22, 2026 23:36

Copilot AI reviewed Oct 22, 2026

View reviewed changes

Comment thread pkg/workflow/daily_byok_ollama_test.go

assert.NotContains(t, steps, "env.OLLAMA_API_KEY")

assert.NotContains(t, steps, "qwen2.5:0.5b")

assert.Contains(t, steps, "COPILOT_GITHUB_TOKEN: ${{ github.token }}")

assert.Contains(t, steps, "claude-haiku-4.5")

This was referenced Oct 23, 2026

Smoke Test: MAI-Code-1.1-Flash - 39875720065 #71253

Closed

Smoke Test: Kiro - 39875673875 #71256

Closed

This was referenced Oct 23, 2026

Smoke Test: Codex - 39876758550 #71264

Closed

Smoke Test: Claude - 39877179050 #71274

Closed

Smoke Test: Goose - 39878754039 #71283

Closed

[gh-aw-parity] gh-aw threat-detection changes to review - 2026-10-23 github/gh-aw-threat-detection#1330

Closed

Navigation Menu

Repository navigation

Fix Ollama CPU warm-up and isolate hosted threat detection - #71244

Fix Ollama CPU warm-up and isolate hosted threat detection#71244
pelikhan merged 1 commit into
mainfrom
pelikhan-scaling-lamp

pelikhan commented Oct 22, 2026

Uh oh!

Uh oh!

github-actions Bot commented Oct 22, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 22, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 22, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 22, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 22, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

github-actions Bot commented Oct 23, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

pelikhan commented Oct 22, 2026

Summary

Validation

Markdown security overview

Uh oh!

Uh oh!

github-actions Bot commented Oct 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Ponytail Reviewer

Uh oh!

github-actions Bot commented Oct 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Design Decision Gate 🏗️

Uh oh!

github-actions Bot commented Oct 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Test Quality Sentinel

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

github-actions Bot commented Oct 23, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

github-actions Bot commented Oct 22, 2026 •

edited

Loading

github-actions Bot commented Oct 22, 2026 •

edited

Loading

github-actions Bot commented Oct 22, 2026 •

edited

Loading

github-actions Bot commented Oct 22, 2026 •

edited

Loading

github-actions Bot commented Oct 22, 2026 •

edited

Loading