Report skipped threat detection when the detector was not installed

[Copilot]

When an agent produced no safe outputs or patches, the detection guard skipped the detector install, but the conclusion step still failed in strict mode because threat-detect was absent.

• Conclusion: If detection was not needed and the binary is absent, report conclusion=skipped, success=true, and an empty reason. A missing binary remains an error when detection was required.
• Regression coverage: Cover skipped detection in strict and warn modes, including an empty guard output.

• Fixes Threat detection fails the run when it was skipped and continue-on-error: false #66872

[Copilot]

Updated in 2ed6253: a missing detector is now a successful skip only when RUN_DETECTION=false and the install outcome is skipped. Unset, empty, unexpected, or mismatched states report detector unavailable; regression coverage verifies strict and warn behavior.

[Copilot]

🟢 Approval recommended

The focused fallback matches the existing conclusion contract and has comprehensive regression coverage.

0 open findings

What changed in this PR

Fixes #66872 by treating an unavailable detector as skipped when detection was unnecessary.

Changes:

• Emits successful skipped outputs when RUN_DETECTION is not true.
• Adds regression coverage for strict, warning, and empty guard-output cases.

File	Description
actions/​setup/​sh/​conclude_threat_detection.sh	Handles skipped detection without requiring the detector binary.
pkg/​workflow/​threat_detection_conclude_script_test.go	Covers missing-binary behavior and preserves required failure cases.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[gh-aw-bot]

@copilot address the following outstanding work in one pass:

1. Update this branch with the latest main using make merge-main, resolving any conflicts and preserving the intended changes.
2. Review (actions/setup/sh/conclude_threat_detection.sh:52): This branch fails open on any RUN_DETECTION value other than the literal true, including empty/unset. If the detection_guard step errors out or its output is not propagated (e.g. the env expression resolves to an empty string) while the agent did produce safe outputs or a patch, the install step is skipped and this code now reports conclusion=skipped / success=true, so safe outputs are published without ever being scanned — previously this case was reported as an error. Make the skip explicit by only treating RUN_DETECTION = "false" (ideally combined with THREAT_DETECT_INSTALL_OUTCOME = "skipped") as a legitimate skip and keep report_detector_unavailable for any other/unknown value. - Report skipped threat detection when the detector was not installed #67810 (comment)

Push the necessary fixes, reply to each listed review thread and resolve it when addressed. Ignore feedback already answered or resolved. Use the pr-finisher skill and stop when only human review or CI remains; do not trigger CI.

Sous-chef head: c7026f6
Sous-chef work: 8320df7cc6f7619c39066ddd7185ce8e1457f0319f428bc98c34b0da304559fd
Sous-chef state: 989520b758faedf548a6858c880edc02e14f24637c561dc33ac6fa717b72ba99

Generated by 👨‍🍳 PR Sous Chef · pi · haiku45 · 5.51 AIC · ⌖ 8.49 AIC · ⊞ 1.1K · ◷
_{Comment /souschef to run again}

[gh-aw-bot]

@copilot address the following outstanding work in one pass:

1. Update this branch with the latest main using make merge-main, resolving any conflicts and preserving the intended changes.
2. Fix failing check impacted-go-tests (FAILURE): https://github.com/github/gh-aw/actions/runs/38204004527/job/114676488381.

Push the necessary fixes, reply to each listed review thread and resolve it when addressed. Ignore feedback already answered or resolved. Use the pr-finisher skill and stop when only human review or CI remains; do not trigger CI.

Sous-chef head: 2ed6253
Sous-chef work: 42e5d572d9d75b7168fe7d0aeda0717cc07e65ed240f6d299e6fec661214f1ac
Sous-chef state: 2649bd79ba7b9dc0715fa033a6fbd108e110218163683be4a3fbb95112d64983

Generated by 👨‍🍳 PR Sous Chef · pi · haiku45 · 3.63 AIC · ⌖ 6.98 AIC · ⊞ 1.1K · ◷
_{Comment /souschef to run again}

[Copilot]

@copilot address the following outstanding work in one pass:

1. Update this branch with the latest main using make merge-main, resolving any conflicts and preserving the intended changes....

The fail-closed guard and its regression coverage remain in place (2ed6253). I merged the latest main in ff9eed8, preserving that fix.

@copilot address the following outstanding work in one pass:

1. Update this branch with the latest main using make merge-main, resolving any conflicts and preserving the intended changes....

Merged the latest main in ff9eed8. The updated implementation resolves the stale work-queue test expectation; the targeted test and final impacted Go test gate pass. I did not trigger CI.

[github-actions]

🎉 This pull request is included in a new release.

Release: v0.91.9