Workflow Health Dashboard — 2026-04-19

[github-actions]

Overview

• Total workflows: 196
• Lock files present: 196/196 ✅
• Stale lock files: 17 ⚠️ (AWF v0.25.25 bump pending)
• Schedule success rate (today): ~85%
• Health score: 75/100 (↑2 from Apr 17)
• Run: §24628574565

---

Critical Issues 🚨

P0 — Codex Engine 401 Auth (#27127)

• Status: All Codex engine workflows failing — OPENAI_API_KEY missing or expired
• Confirmed today: Duplicate Code Detector ([aw] Duplicate Code Detector failed #27177) — unexpected status 401 Unauthorized: Missing bearer or basic authentication in header, url: api.openai.com/v1/responses
• Affected workflows: duplicate-code-detector, ai-moderator, daily-observability-report (and any other Codex engine workflows)
• Action required: Rotate OPENAI_API_KEY repository secret

---

Warnings ⚠️

P1 — Copilot Engine Failures (Today)

Workflow	Issue	Error
Daily Community Attribution Updater	#27173	Copilot terminated — "Permission denied" running Python script
Daily Issues Report Generator	#27165	Copilot crash — /bin/bash: line 1: node: command not found
Artifacts Summary	#27155	Copilot stuck in Read loop (sub-agent deadlock)

P1 — Stale Lock Files (#27140)

• 17 workflows have stale .lock.yml files after AWF v0.25.24→v0.25.25 bump
• Tracked in issue [aw] agentic workflows out of sync #27140; recompile PR likely in progress

P1 — Copilot CLI & Claude Code Upgrade (#27143)

• Copilot CLI: v1.0.21 → v1.0.32 (+11 versions) — new --yolo, BYOK provider support, fine-grained tool permissions
• Claude Code: 2.1.112 → 2.1.114

P1 — Smoke Tests

• Smoke Claude (Smoke Claude - Issue Group #27030): Failing since Apr 14
• Smoke Copilot (Smoke Copilot - Issue Group #27028): Ongoing failure group

Full List of Stale Lock Files

• auto-triage-issues, bot-detection, code-simplifier, copilot-pr-nlp-analysis
• daily-repo-chronicle, daily-safe-output-integrator, daily-security-red-team, daily-workflow-updater
• gpclean, plan, prompt-clustering-analysis, refiner, scout, smoke-copilot-arm
• static-analysis-report, tidy, update-astro

---

Healthy Workflows ✅

190 workflows operating normally. Recent successful runs include:

• Dead Code Removal Agent, Terminal Stylist, Issue Monster (10/11)
• Daily Firewall Logs, Copilot Agent PR Analysis, Daily Testify
• CI (6/6), Agentic Maintenance (4/4), Update Astro, Sub-Issue Closer

---

Security Notes

dev-hawk github-env (High — #26933)

• zizmor flags dangerous $GITHUB_ENV write derived from GITHUB_SERVER_URL
• Has not been fixed since Apr 16 scan

---

Recommendations

High Priority

1. 🔴 Rotate OPENAI_API_KEY secret — Codex P0 affecting multiple workflows ([aw-failures] Codex engine 401 auth failure — OPENAI_API_KEY credential missing or invalid #27127)
2. 🟠 Upgrade Copilot CLI to v1.0.32 + Claude Code to 2.1.114 ([ca] CLI Version Updates: Claude Code 2.1.114, Copilot CLI 1.0.32 #27143)
3. 🟠 Recompile 17 stale lock files after AWF v0.25.25 ([aw] agentic workflows out of sync #27140)
4. 🟠 Investigate Copilot engine crashes: node: command not found in Daily Issues Report and permission denied in Daily Community Attribution

Medium Priority

5. Fix github-env High severity in dev-hawk.md ([static-analysis] Report - 2026-04-17 #26933)
6. Investigate Smoke Claude failure (Smoke Claude - Issue Group #27030)
7. Address Artifacts Summary stuck-in-loop pattern ([aw] Artifacts Summary failed #27155)

---

Trends

Metric	Today	Apr 17	Δ
Health score	75/100	73/100	↑2
Total workflows	196	194	+2
Lock files OK	179/196	194/194	↓17 (stale)
P0 issues	1	1	→
P1 issues	5	2	↑3
Schedule success	~85%	~85%	→

---

Actions Taken This Run

• 0 new issues created (all failures auto-tracked by workflow failure reporter)
• Memory files updated: workflow-health-latest.md, shared-alerts.md
• Inventory: 196 workflows scanned, 17 stale identified

---

References:

• §24628574565 — This run
• §24628420682 — Duplicate Code Detector (Codex 401)
• §24627195348 — Daily Community Attribution (Copilot crash)

Warning

⚠️ Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• productionresultssa15.blob.core.windows.net

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "productionresultssa15.blob.core.windows.net"

See Network Configuration for more information.

Note

🔒 Integrity filter blocked 1 item

The following item were blocked because they don't meet the GitHub integrity level.

• [aw] agentic workflows out of sync #27140 issue_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".

To allow these resources, lower min-integrity in your GitHub frontmatter:

tools:
  github:
    min-integrity: approved  # merged | approved | unapproved | none

Generated by Workflow Health Manager - Meta-Orchestrator · ● 2.3M · ◷

• expires on Apr 20, 2026, 12:07 PM UTC