Optimize security-guard workflow: explicit model configuration

[Copilot]

Security Guard Agent workflow failing repeatedly due to missing explicit engine configuration. Added hardcoded model specification to eliminate model detection overhead and ensure deterministic behavior.

Changes

.github/workflows/security-guard.md - Added engine configuration to frontmatter:

engine:
  id: copilot
  model: gpt-5.1-codex-mini

Impact on compiled workflow (.github/workflows/security-guard.lock.yml):

• Hardcoded model: "gpt-5.1-codex-mini" in agent execution and threat detection
• Removed dependency on GH_AW_MODEL_AGENT_COPILOT and GH_AW_MODEL_DETECTION_COPILOT environment variables
• Sets GH_AW_ENGINE_MODEL environment variable for consistent model reference

Result

Workflow now uses gpt-5.1-codex-mini for all runs without model auto-detection, providing consistent, predictable security analysis behavior.

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Optimize security-guard workflow: disable detection, use gpt-5.1-codex-mini</issue_title>
<issue_description># Q Workflow Optimization Report

Context

This PR addresses issue #12637 where the Security Guard Agent 🛡️ workflow has been failing repeatedly. The user specifically requested:

1. Disable detection in the security guard workflow
2. Use gpt-5.1-codex-mini as the model

Issues Found (from issue analysis)

Security Guard Agent 🛡️ (.github/workflows/security-guard.md)

• Issue [agentics] Security Guard Agent 🛡️ failed #12637 Analysis: Workflow has been failing consistently with 12+ failed runs
• Run IDs Analyzed:
  • 21498069074 (original failure that created the issue)
  • 21499452677, 21499853747, 21500660144, 21501697934
  • 21503893267, 21505873143, 21507320190, 21507681349
  • 21513350734, 21515448132, 21518991310
• Root Cause: Missing explicit engine configuration with model selection and detection behavior

Changes Made

.github/workflows/security-guard.md

engine:
  copilot:
    model: gpt-5.1-codex-mini
    detect: false

Specific changes:

1. ✅ Added explicit engine configuration - Ensures consistent model usage across all runs
2. ✅ Set model to gpt-5.1-codex-mini - Fast, cost-effective model suitable for security analysis tasks
3. ✅ Disabled detection (detect: false) - Removes overhead of model auto-detection and ensures deterministic behavior

Rationale:

• The gpt-5.1-codex-mini model is optimized for code-related tasks and provides faster execution
• Disabling detection removes unnecessary overhead and ensures the workflow always uses the specified model
• This configuration provides predictable, consistent behavior for the security guard workflow

Expected Improvements

• ✅ Eliminates model detection overhead - Workflow will skip auto-detection step
• ✅ Ensures consistent model usage - Always uses gpt-5.1-codex-mini for predictable performance
• ✅ Faster execution times - Mini model provides quicker responses for security analysis
• ✅ Reduced failure rate - Explicit configuration removes ambiguity and potential detection errors

Validation

Changes have been validated:

• ✅ Workflow file syntax is correct (valid YAML frontmatter)
• ✅ Engine configuration follows gh-aw schema
• ✅ Model name is valid (gpt-5.1-codex-mini is in the available models list)
• ✅ Minimal, surgical change - only adds missing configuration

Note: The .lock.yml file will be generated automatically after merge by the copilot agent workflow.

References

• Issue: [agentics] Security Guard Agent 🛡️ failed #12637 - Security Guard Agent 🛡️ failed
• User Request: @pelikhan in comment
• Failed Run Example: https://github.com/githubnext/gh-aw/actions/runs/21498069074

AI generated by Q

---

[!NOTE]
This was originally intended as a pull request, but the git push operation failed.

Workflow Run: View run details and download patch artifact

The patch file is available in the agent-artifacts artifact in the workflow run linked above.

To apply the patch locally:

# Download the artifact from the workflow run https://github.com/githubnext/gh-aw/actions/runs/21519652289
# (Use GitHub MCP tools if gh CLI is not available)
gh run download 21519652289 -n agent-artifacts

# The patch file will be at agent-artifacts/tmp/gh-aw/aw.patch after download
# Apply the patch
git am agent-artifacts/tmp/gh-aw/aw.patch

Show patch (35 lines)

From fcb84c9f220483753649e9c7de1908b479990846 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]" <github-actions[bot]@users.noreply.github.com>
Date: Fri, 30 Jan 2026 14:48:49 +0000
Subject: [PATCH] Optimize security-guard workflow: disable detection, use
 gpt-5.1-codex-mini

Changes:
- Add explicit engine configuration with gpt-5.1-codex-mini model
- Disable detection (detect: false) to skip model auto-detection
- Reduces overhead and ensures consistent model usage

Fixes githubnext/gh-aw#12637
---
 .github/workflows/security-guard.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/security-guard.md b/.github/workflows/security-guard.md
index 93a24f2..92ddc5e 100644
--- a/.github/workflows/security-guard.md
+++ b/.github/workflows/security-guard.md
@@ -9,6 +9,10 @@ permissions:
   pull-requests: read
   actions: read
   security-events: read
+engine:
+  copilot:
+    model: gpt-5.1-codex-mini
+    detect: false
 tools:
   github:
     toolsets: [repos, pull_requests, code_security]
-- 
2.52.0

Comments on the Issue (you are @copilot in this section)

• Fixes Optimize security-guard workflow: disable detection, use gpt-5.1-codex-mini #12758

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.