Derive Copilot SDK session timeout from agent step timeout (minus 30s)

[Copilot]

The Daily Security Observability workflow was failing in the copilot engine after the SDK driver hit its 10-minute session.idle wait limit, causing runs to terminate before completion. This update generalizes the fix so SDK timeout is derived automatically from the configured agent step timeout, instead of relying on a workflow-specific hardcoded value.

• Problem scope

  • copilot-sdk runs can outlast the SDK default send/wait timeout.
  • The prior fix only set an override in a single workflow.

• Change

  • Updated shared SDK env construction in actions/setup/js/process_runner.cjs so, in SDK mode:
    • If COPILOT_SDK_SEND_TIMEOUT_MS is explicitly set, it is respected.
    • Otherwise, timeout is derived from GH_AW_TIMEOUT_MINUTES as agent timeout minus 30 seconds.
  • Added focused unit coverage in actions/setup/js/process_runner.test.cjs for:
    • derivation from GH_AW_TIMEOUT_MINUTES
    • explicit override precedence
    • invalid timeout input handling
  • Existing Daily Security Observability workflow override remains valid and aligned with this rule.

• Why this is bounded

  • The derived timeout is intentionally set below the step timeout to preserve headroom before job timeout.

---

Branch update requested by pr-sous-chef for run https://github.com/github/gh-aw/actions/runs/26843942909

Generated by 👨‍🍳 PR Sous Chef · gpt54mini 3.6M · ◷

[pelikhan]

@copilot set the copilot sdk timeout to the agent time - 30 seconds.

[Copilot]

@copilot set the copilot sdk timeout to the agent time - 30 seconds.

Updated in a03e913. The workflow now sets COPILOT_SDK_SEND_TIMEOUT_MS to 3570000 (60m agent timeout minus 30s), and the lock file was recompiled accordingly.

[pelikhan]

@copilot copilot_harness.cjs must set the timeout on the fly based on the timeout configured for the agent step - not just hardcoded in a single agentic workflow.

[Copilot]

Pull request overview

Increases the Copilot SDK send/wait timeout for the Daily Security Observability agentic workflow so long-running (7-day) analyses don’t terminate early due to the SDK’s idle/wait limit, while staying within the GitHub Actions job timeout budget.

Changes:

• Adds a workflow-level env override in daily-security-observability.md to set COPILOT_SDK_SEND_TIMEOUT_MS to 59m30s.
• Regenerates the compiled workflow lock file so the same env override is applied at runtime.

Show a summary per file

File	Description
.github/workflows/daily-security-observability.md	Adds workflow-level env override for Copilot SDK send timeout to match the 60-minute job timeout budget.
.github/workflows/daily-security-observability.lock.yml	Carries the env override into the compiled workflow so it takes effect in GitHub Actions runtime.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 2/2 changed files
• Comments generated: 0

[Copilot]

@copilot copilot_harness.cjs must set the timeout on the fly based on the timeout configured for the agent step - not just hardcoded in a single agentic workflow.

Implemented in 2f89666. copilot_harness now gets COPILOT_SDK_SEND_TIMEOUT_MS dynamically via shared buildCopilotSDKEnv(), derived from GH_AW_TIMEOUT_MINUTES as (timeout-minutes * 60s - 30s) for SDK runs, with explicit COPILOT_SDK_SEND_TIMEOUT_MS still taking precedence. Added unit coverage in process_runner.test.cjs.

[github-actions]

@copilot please make the timeout dynamic in copilot_harness.cjs and rerun checks.

Generated by 👨‍🍳 PR Sous Chef · gpt54mini 3.6M · ◷