mirror of
https://github.com/Z3Prover/z3
synced 2026-02-17 14:21:45 +00:00
Merge pull request #8667 from Z3Prover/copilot/fix-a3-python-workflow-error
Fix shell substitution breaking agentic workflow template interpolation
This commit is contained in:
Nikolaj Bjorner
GitHub
commit
6884ffdd07
4 changed files with 356 additions and 314 deletions
334
.github/workflows/a3-python-v2.lock.yml
generated
vendored
334
.github/workflows/a3-python-v2.lock.yml
generated
vendored
|
|
@ -13,7 +13,7 @@
|
||||||
# \ /\ / (_) | | | | ( | | | | (_) \ V V /\__ \
|
# \ /\ / (_) | | | | ( | | | | (_) \ V V /\__ \
|
||||||
# \/ \/ \___/|_| |_|\_\|_| |_|\___/ \_/\_/ |___/
|
# \/ \/ \___/|_| |_|\_\|_| |_|\___/ \_/\_/ |___/
|
||||||
#
|
#
|
||||||
# This file was automatically generated by gh-aw (v0.45.0). DO NOT EDIT.
|
# This file was automatically generated by gh-aw (v0.45.3). DO NOT EDIT.
|
||||||
#
|
#
|
||||||
# To update this file, edit z3prover/z3/a3/a3-python-v2.md@a91c5c58bd975f336bf5b744885ffd4b36b2d2ec and run:
|
# To update this file, edit z3prover/z3/a3/a3-python-v2.md@a91c5c58bd975f336bf5b744885ffd4b36b2d2ec and run:
|
||||||
# gh aw compile
|
# gh aw compile
|
||||||
|
|
@ -50,9 +50,17 @@ jobs:
|
||||||
comment_repo: ""
|
comment_repo: ""
|
||||||
steps:
|
steps:
|
||||||
- name: Setup Scripts
|
- name: Setup Scripts
|
||||||
uses: github/gh-aw/actions/setup@v0.45.1
|
uses: github/gh-aw/actions/setup@v0.45.3
|
||||||
with:
|
with:
|
||||||
destination: /opt/gh-aw/actions
|
destination: /opt/gh-aw/actions
|
||||||
|
- name: Checkout .github and .agents folders
|
||||||
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
||||||
|
with:
|
||||||
|
sparse-checkout: |
|
||||||
|
.github
|
||||||
|
.agents
|
||||||
|
fetch-depth: 1
|
||||||
|
persist-credentials: false
|
||||||
- name: Check workflow file timestamps
|
- name: Check workflow file timestamps
|
||||||
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
|
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
|
||||||
env:
|
env:
|
||||||
|
|
@ -63,6 +71,150 @@ jobs:
|
||||||
setupGlobals(core, github, context, exec, io);
|
setupGlobals(core, github, context, exec, io);
|
||||||
const { main } = require('/opt/gh-aw/actions/check_workflow_timestamp_api.cjs');
|
const { main } = require('/opt/gh-aw/actions/check_workflow_timestamp_api.cjs');
|
||||||
await main();
|
await main();
|
||||||
|
- name: Create prompt with built-in context
|
||||||
|
env:
|
||||||
|
GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
|
||||||
|
GH_AW_SAFE_OUTPUTS: ${{ env.GH_AW_SAFE_OUTPUTS }}
|
||||||
|
GH_AW_GITHUB_ACTOR: ${{ github.actor }}
|
||||||
|
GH_AW_GITHUB_EVENT_COMMENT_ID: ${{ github.event.comment.id }}
|
||||||
|
GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER: ${{ github.event.discussion.number }}
|
||||||
|
GH_AW_GITHUB_EVENT_ISSUE_NUMBER: ${{ github.event.issue.number }}
|
||||||
|
GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER: ${{ github.event.pull_request.number }}
|
||||||
|
GH_AW_GITHUB_REPOSITORY: ${{ github.repository }}
|
||||||
|
GH_AW_GITHUB_RUN_ID: ${{ github.run_id }}
|
||||||
|
GH_AW_GITHUB_WORKSPACE: ${{ github.workspace }}
|
||||||
|
run: |
|
||||||
|
bash /opt/gh-aw/actions/create_prompt_first.sh
|
||||||
|
cat << 'GH_AW_PROMPT_EOF' > "$GH_AW_PROMPT"
|
||||||
|
<system>
|
||||||
|
GH_AW_PROMPT_EOF
|
||||||
|
cat "/opt/gh-aw/prompts/xpia.md" >> "$GH_AW_PROMPT"
|
||||||
|
cat "/opt/gh-aw/prompts/temp_folder_prompt.md" >> "$GH_AW_PROMPT"
|
||||||
|
cat "/opt/gh-aw/prompts/markdown.md" >> "$GH_AW_PROMPT"
|
||||||
|
cat << 'GH_AW_PROMPT_EOF' >> "$GH_AW_PROMPT"
|
||||||
|
<safe-outputs>
|
||||||
|
<description>GitHub API Access Instructions</description>
|
||||||
|
<important>
|
||||||
|
The gh CLI is NOT authenticated. Do NOT use gh commands for GitHub operations.
|
||||||
|
</important>
|
||||||
|
<instructions>
|
||||||
|
To create or modify GitHub resources (issues, discussions, pull requests, etc.), you MUST call the appropriate safe output tool. Simply writing content will NOT work - the workflow requires actual tool calls.
|
||||||
|
|
||||||
|
Temporary IDs: Some safe output tools support a temporary ID field (usually named temporary_id) so you can reference newly-created items elsewhere in the SAME agent output (for example, using #aw_abc1 in a later body).
|
||||||
|
|
||||||
|
**IMPORTANT - temporary_id format rules:**
|
||||||
|
- If you DON'T need to reference the item later, OMIT the temporary_id field entirely (it will be auto-generated if needed)
|
||||||
|
- If you DO need cross-references/chaining, you MUST match this EXACT validation regex: /^aw_[A-Za-z0-9]{3,8}$/i
|
||||||
|
- Format: aw_ prefix followed by 3 to 8 alphanumeric characters (A-Z, a-z, 0-9, case-insensitive)
|
||||||
|
- Valid alphanumeric characters: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789
|
||||||
|
- INVALID examples: aw_ab (too short), aw_123456789 (too long), aw_test-id (contains hyphen), aw_id_123 (contains underscore)
|
||||||
|
- VALID examples: aw_abc, aw_abc1, aw_Test123, aw_A1B2C3D4, aw_12345678
|
||||||
|
- To generate valid IDs: use 3-8 random alphanumeric characters or omit the field to let the system auto-generate
|
||||||
|
|
||||||
|
Do NOT invent other aw_* formats — downstream steps will reject them with validation errors matching against /^aw_[A-Za-z0-9]{3,8}$/i.
|
||||||
|
|
||||||
|
Discover available tools from the safeoutputs MCP server.
|
||||||
|
|
||||||
|
**Critical**: Tool calls write structured data that downstream jobs process. Without tool calls, follow-up actions will be skipped.
|
||||||
|
|
||||||
|
**Note**: If you made no other safe output tool calls during this workflow execution, call the "noop" tool to provide a status message indicating completion or that no actions were needed.
|
||||||
|
</instructions>
|
||||||
|
</safe-outputs>
|
||||||
|
<github-context>
|
||||||
|
The following GitHub context information is available for this workflow:
|
||||||
|
{{#if __GH_AW_GITHUB_ACTOR__ }}
|
||||||
|
- **actor**: __GH_AW_GITHUB_ACTOR__
|
||||||
|
{{/if}}
|
||||||
|
{{#if __GH_AW_GITHUB_REPOSITORY__ }}
|
||||||
|
- **repository**: __GH_AW_GITHUB_REPOSITORY__
|
||||||
|
{{/if}}
|
||||||
|
{{#if __GH_AW_GITHUB_WORKSPACE__ }}
|
||||||
|
- **workspace**: __GH_AW_GITHUB_WORKSPACE__
|
||||||
|
{{/if}}
|
||||||
|
{{#if __GH_AW_GITHUB_EVENT_ISSUE_NUMBER__ }}
|
||||||
|
- **issue-number**: #__GH_AW_GITHUB_EVENT_ISSUE_NUMBER__
|
||||||
|
{{/if}}
|
||||||
|
{{#if __GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER__ }}
|
||||||
|
- **discussion-number**: #__GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER__
|
||||||
|
{{/if}}
|
||||||
|
{{#if __GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER__ }}
|
||||||
|
- **pull-request-number**: #__GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER__
|
||||||
|
{{/if}}
|
||||||
|
{{#if __GH_AW_GITHUB_EVENT_COMMENT_ID__ }}
|
||||||
|
- **comment-id**: __GH_AW_GITHUB_EVENT_COMMENT_ID__
|
||||||
|
{{/if}}
|
||||||
|
{{#if __GH_AW_GITHUB_RUN_ID__ }}
|
||||||
|
- **workflow-run-id**: __GH_AW_GITHUB_RUN_ID__
|
||||||
|
{{/if}}
|
||||||
|
</github-context>
|
||||||
|
|
||||||
|
GH_AW_PROMPT_EOF
|
||||||
|
cat << 'GH_AW_PROMPT_EOF' >> "$GH_AW_PROMPT"
|
||||||
|
</system>
|
||||||
|
GH_AW_PROMPT_EOF
|
||||||
|
cat << 'GH_AW_PROMPT_EOF' >> "$GH_AW_PROMPT"
|
||||||
|
{{#runtime-import .github/workflows/a3-python-v2.md}}
|
||||||
|
GH_AW_PROMPT_EOF
|
||||||
|
- name: Interpolate variables and render templates
|
||||||
|
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
|
||||||
|
env:
|
||||||
|
GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
|
||||||
|
GH_AW_GITHUB_REPOSITORY: ${{ github.repository }}
|
||||||
|
GH_AW_GITHUB_WORKSPACE: ${{ github.workspace }}
|
||||||
|
with:
|
||||||
|
script: |
|
||||||
|
const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
|
||||||
|
setupGlobals(core, github, context, exec, io);
|
||||||
|
const { main } = require('/opt/gh-aw/actions/interpolate_prompt.cjs');
|
||||||
|
await main();
|
||||||
|
- name: Substitute placeholders
|
||||||
|
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
|
||||||
|
env:
|
||||||
|
GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
|
||||||
|
GH_AW_GITHUB_ACTOR: ${{ github.actor }}
|
||||||
|
GH_AW_GITHUB_EVENT_COMMENT_ID: ${{ github.event.comment.id }}
|
||||||
|
GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER: ${{ github.event.discussion.number }}
|
||||||
|
GH_AW_GITHUB_EVENT_ISSUE_NUMBER: ${{ github.event.issue.number }}
|
||||||
|
GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER: ${{ github.event.pull_request.number }}
|
||||||
|
GH_AW_GITHUB_REPOSITORY: ${{ github.repository }}
|
||||||
|
GH_AW_GITHUB_RUN_ID: ${{ github.run_id }}
|
||||||
|
GH_AW_GITHUB_WORKSPACE: ${{ github.workspace }}
|
||||||
|
with:
|
||||||
|
script: |
|
||||||
|
const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
|
||||||
|
setupGlobals(core, github, context, exec, io);
|
||||||
|
|
||||||
|
const substitutePlaceholders = require('/opt/gh-aw/actions/substitute_placeholders.cjs');
|
||||||
|
|
||||||
|
// Call the substitution function
|
||||||
|
return await substitutePlaceholders({
|
||||||
|
file: process.env.GH_AW_PROMPT,
|
||||||
|
substitutions: {
|
||||||
|
GH_AW_GITHUB_ACTOR: process.env.GH_AW_GITHUB_ACTOR,
|
||||||
|
GH_AW_GITHUB_EVENT_COMMENT_ID: process.env.GH_AW_GITHUB_EVENT_COMMENT_ID,
|
||||||
|
GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER: process.env.GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER,
|
||||||
|
GH_AW_GITHUB_EVENT_ISSUE_NUMBER: process.env.GH_AW_GITHUB_EVENT_ISSUE_NUMBER,
|
||||||
|
GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER: process.env.GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER,
|
||||||
|
GH_AW_GITHUB_REPOSITORY: process.env.GH_AW_GITHUB_REPOSITORY,
|
||||||
|
GH_AW_GITHUB_RUN_ID: process.env.GH_AW_GITHUB_RUN_ID,
|
||||||
|
GH_AW_GITHUB_WORKSPACE: process.env.GH_AW_GITHUB_WORKSPACE
|
||||||
|
}
|
||||||
|
});
|
||||||
|
- name: Validate prompt placeholders
|
||||||
|
env:
|
||||||
|
GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
|
||||||
|
run: bash /opt/gh-aw/actions/validate_prompt_placeholders.sh
|
||||||
|
- name: Print prompt
|
||||||
|
env:
|
||||||
|
GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
|
||||||
|
run: bash /opt/gh-aw/actions/print_prompt_summary.sh
|
||||||
|
- name: Upload prompt artifact
|
||||||
|
if: success()
|
||||||
|
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
|
||||||
|
with:
|
||||||
|
name: prompt
|
||||||
|
path: /tmp/gh-aw/aw-prompts/prompt.txt
|
||||||
|
retention-days: 1
|
||||||
|
|
||||||
agent:
|
agent:
|
||||||
needs: activation
|
needs: activation
|
||||||
|
|
@ -92,11 +244,11 @@ jobs:
|
||||||
secret_verification_result: ${{ steps.validate-secret.outputs.verification_result }}
|
secret_verification_result: ${{ steps.validate-secret.outputs.verification_result }}
|
||||||
steps:
|
steps:
|
||||||
- name: Setup Scripts
|
- name: Setup Scripts
|
||||||
uses: github/gh-aw/actions/setup@v0.45.1
|
uses: github/gh-aw/actions/setup@v0.45.3
|
||||||
with:
|
with:
|
||||||
destination: /opt/gh-aw/actions
|
destination: /opt/gh-aw/actions
|
||||||
- name: Checkout repository
|
- name: Checkout repository
|
||||||
uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98 # v6.0.2
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
||||||
with:
|
with:
|
||||||
persist-credentials: false
|
persist-credentials: false
|
||||||
- name: Create gh-aw temp directory
|
- name: Create gh-aw temp directory
|
||||||
|
|
@ -145,11 +297,10 @@ jobs:
|
||||||
model: process.env.GH_AW_MODEL_AGENT_COPILOT || "",
|
model: process.env.GH_AW_MODEL_AGENT_COPILOT || "",
|
||||||
version: "",
|
version: "",
|
||||||
agent_version: "0.0.410",
|
agent_version: "0.0.410",
|
||||||
cli_version: "v0.45.0",
|
cli_version: "v0.45.3",
|
||||||
workflow_name: "A3 Python Code Analysis",
|
workflow_name: "A3 Python Code Analysis",
|
||||||
experimental: false,
|
experimental: false,
|
||||||
supports_tools_allowlist: true,
|
supports_tools_allowlist: true,
|
||||||
supports_http_transport: true,
|
|
||||||
run_id: context.runId,
|
run_id: context.runId,
|
||||||
run_number: context.runNumber,
|
run_number: context.runNumber,
|
||||||
run_attempt: process.env.GITHUB_RUN_ATTEMPT,
|
run_attempt: process.env.GITHUB_RUN_ATTEMPT,
|
||||||
|
|
@ -161,7 +312,7 @@ jobs:
|
||||||
staged: false,
|
staged: false,
|
||||||
allowed_domains: ["defaults","python"],
|
allowed_domains: ["defaults","python"],
|
||||||
firewall_enabled: true,
|
firewall_enabled: true,
|
||||||
awf_version: "v0.18.0",
|
awf_version: "v0.19.1",
|
||||||
awmg_version: "v0.1.4",
|
awmg_version: "v0.1.4",
|
||||||
steps: {
|
steps: {
|
||||||
firewall: "squid"
|
firewall: "squid"
|
||||||
|
|
@ -185,7 +336,7 @@ jobs:
|
||||||
- name: Install GitHub Copilot CLI
|
- name: Install GitHub Copilot CLI
|
||||||
run: /opt/gh-aw/actions/install_copilot_cli.sh 0.0.410
|
run: /opt/gh-aw/actions/install_copilot_cli.sh 0.0.410
|
||||||
- name: Install awf binary
|
- name: Install awf binary
|
||||||
run: bash /opt/gh-aw/actions/install_awf_binary.sh v0.18.0
|
run: bash /opt/gh-aw/actions/install_awf_binary.sh v0.19.1
|
||||||
- name: Determine automatic lockdown mode for GitHub MCP Server
|
- name: Determine automatic lockdown mode for GitHub MCP Server
|
||||||
id: determine-automatic-lockdown
|
id: determine-automatic-lockdown
|
||||||
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
|
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
|
||||||
|
|
@ -197,7 +348,7 @@ jobs:
|
||||||
const determineAutomaticLockdown = require('/opt/gh-aw/actions/determine_automatic_lockdown.cjs');
|
const determineAutomaticLockdown = require('/opt/gh-aw/actions/determine_automatic_lockdown.cjs');
|
||||||
await determineAutomaticLockdown(github, context, core);
|
await determineAutomaticLockdown(github, context, core);
|
||||||
- name: Download container images
|
- name: Download container images
|
||||||
run: bash /opt/gh-aw/actions/download_docker_images.sh ghcr.io/github/gh-aw-firewall/agent:0.18.0 ghcr.io/github/gh-aw-firewall/squid:0.18.0 ghcr.io/github/gh-aw-mcpg:v0.1.4 ghcr.io/github/github-mcp-server:v0.30.3 node:lts-alpine
|
run: bash /opt/gh-aw/actions/download_docker_images.sh ghcr.io/github/gh-aw-firewall/agent:0.19.1 ghcr.io/github/gh-aw-firewall/squid:0.19.1 ghcr.io/github/gh-aw-mcpg:v0.1.4 ghcr.io/github/github-mcp-server:v0.30.3 node:lts-alpine
|
||||||
- name: Write Safe Outputs Config
|
- name: Write Safe Outputs Config
|
||||||
run: |
|
run: |
|
||||||
mkdir -p /opt/gh-aw/safeoutputs
|
mkdir -p /opt/gh-aw/safeoutputs
|
||||||
|
|
@ -233,7 +384,7 @@ jobs:
|
||||||
},
|
},
|
||||||
"temporary_id": {
|
"temporary_id": {
|
||||||
"description": "Unique temporary identifier for referencing this issue before it's created. Format: 'aw_' followed by 3 to 8 alphanumeric characters (e.g., 'aw_abc1', 'aw_Test123'). Use '#aw_ID' in body text to reference other issues by their temporary_id; these are replaced with actual issue numbers after creation.",
|
"description": "Unique temporary identifier for referencing this issue before it's created. Format: 'aw_' followed by 3 to 8 alphanumeric characters (e.g., 'aw_abc1', 'aw_Test123'). Use '#aw_ID' in body text to reference other issues by their temporary_id; these are replaced with actual issue numbers after creation.",
|
||||||
"pattern": "^aw_[A-Za-z0-9]{4,8}$",
|
"pattern": "^aw_[A-Za-z0-9]{3,8}$",
|
||||||
"type": "string"
|
"type": "string"
|
||||||
},
|
},
|
||||||
"title": {
|
"title": {
|
||||||
|
|
@ -488,140 +639,11 @@ jobs:
|
||||||
script: |
|
script: |
|
||||||
const { generateWorkflowOverview } = require('/opt/gh-aw/actions/generate_workflow_overview.cjs');
|
const { generateWorkflowOverview } = require('/opt/gh-aw/actions/generate_workflow_overview.cjs');
|
||||||
await generateWorkflowOverview(core);
|
await generateWorkflowOverview(core);
|
||||||
- name: Create prompt with built-in context
|
- name: Download prompt artifact
|
||||||
env:
|
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
|
||||||
GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
|
|
||||||
GH_AW_SAFE_OUTPUTS: ${{ env.GH_AW_SAFE_OUTPUTS }}
|
|
||||||
GH_AW_GITHUB_ACTOR: ${{ github.actor }}
|
|
||||||
GH_AW_GITHUB_EVENT_COMMENT_ID: ${{ github.event.comment.id }}
|
|
||||||
GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER: ${{ github.event.discussion.number }}
|
|
||||||
GH_AW_GITHUB_EVENT_ISSUE_NUMBER: ${{ github.event.issue.number }}
|
|
||||||
GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER: ${{ github.event.pull_request.number }}
|
|
||||||
GH_AW_GITHUB_REPOSITORY: ${{ github.repository }}
|
|
||||||
GH_AW_GITHUB_RUN_ID: ${{ github.run_id }}
|
|
||||||
GH_AW_GITHUB_WORKSPACE: ${{ github.workspace }}
|
|
||||||
run: |
|
|
||||||
bash /opt/gh-aw/actions/create_prompt_first.sh
|
|
||||||
cat << 'GH_AW_PROMPT_EOF' > "$GH_AW_PROMPT"
|
|
||||||
<system>
|
|
||||||
GH_AW_PROMPT_EOF
|
|
||||||
cat "/opt/gh-aw/prompts/xpia.md" >> "$GH_AW_PROMPT"
|
|
||||||
cat "/opt/gh-aw/prompts/temp_folder_prompt.md" >> "$GH_AW_PROMPT"
|
|
||||||
cat "/opt/gh-aw/prompts/markdown.md" >> "$GH_AW_PROMPT"
|
|
||||||
cat << 'GH_AW_PROMPT_EOF' >> "$GH_AW_PROMPT"
|
|
||||||
<safe-outputs>
|
|
||||||
<description>GitHub API Access Instructions</description>
|
|
||||||
<important>
|
|
||||||
The gh CLI is NOT authenticated. Do NOT use gh commands for GitHub operations.
|
|
||||||
</important>
|
|
||||||
<instructions>
|
|
||||||
To create or modify GitHub resources (issues, discussions, pull requests, etc.), you MUST call the appropriate safe output tool. Simply writing content will NOT work - the workflow requires actual tool calls.
|
|
||||||
|
|
||||||
Temporary IDs: Some safe output tools support a temporary ID field (usually named temporary_id) so you can reference newly-created items elsewhere in the SAME agent output (for example, using #aw_abc1 in a later body).
|
|
||||||
|
|
||||||
**IMPORTANT - temporary_id format rules:**
|
|
||||||
- If you DON'T need to reference the item later, OMIT the temporary_id field entirely (it will be auto-generated if needed)
|
|
||||||
- If you DO need cross-references/chaining, you MUST match this EXACT validation regex: /^aw_[A-Za-z0-9]{3,8}$/i
|
|
||||||
- Format: aw_ prefix followed by 3 to 8 alphanumeric characters (A-Z, a-z, 0-9, case-insensitive)
|
|
||||||
- Valid alphanumeric characters: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789
|
|
||||||
- INVALID examples: aw_ab (too short), aw_123456789 (too long), aw_test-id (contains hyphen), aw_id_123 (contains underscore)
|
|
||||||
- VALID examples: aw_abc, aw_abc1, aw_Test123, aw_A1B2C3D4, aw_12345678
|
|
||||||
- To generate valid IDs: use 3-8 random alphanumeric characters or omit the field to let the system auto-generate
|
|
||||||
|
|
||||||
Do NOT invent other aw_* formats — downstream steps will reject them with validation errors matching against /^aw_[A-Za-z0-9]{3,8}$/i.
|
|
||||||
|
|
||||||
Discover available tools from the safeoutputs MCP server.
|
|
||||||
|
|
||||||
**Critical**: Tool calls write structured data that downstream jobs process. Without tool calls, follow-up actions will be skipped.
|
|
||||||
|
|
||||||
**Note**: If you made no other safe output tool calls during this workflow execution, call the "noop" tool to provide a status message indicating completion or that no actions were needed.
|
|
||||||
</instructions>
|
|
||||||
</safe-outputs>
|
|
||||||
<github-context>
|
|
||||||
The following GitHub context information is available for this workflow:
|
|
||||||
{{#if __GH_AW_GITHUB_ACTOR__ }}
|
|
||||||
- **actor**: __GH_AW_GITHUB_ACTOR__
|
|
||||||
{{/if}}
|
|
||||||
{{#if __GH_AW_GITHUB_REPOSITORY__ }}
|
|
||||||
- **repository**: __GH_AW_GITHUB_REPOSITORY__
|
|
||||||
{{/if}}
|
|
||||||
{{#if __GH_AW_GITHUB_WORKSPACE__ }}
|
|
||||||
- **workspace**: __GH_AW_GITHUB_WORKSPACE__
|
|
||||||
{{/if}}
|
|
||||||
{{#if __GH_AW_GITHUB_EVENT_ISSUE_NUMBER__ }}
|
|
||||||
- **issue-number**: #__GH_AW_GITHUB_EVENT_ISSUE_NUMBER__
|
|
||||||
{{/if}}
|
|
||||||
{{#if __GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER__ }}
|
|
||||||
- **discussion-number**: #__GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER__
|
|
||||||
{{/if}}
|
|
||||||
{{#if __GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER__ }}
|
|
||||||
- **pull-request-number**: #__GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER__
|
|
||||||
{{/if}}
|
|
||||||
{{#if __GH_AW_GITHUB_EVENT_COMMENT_ID__ }}
|
|
||||||
- **comment-id**: __GH_AW_GITHUB_EVENT_COMMENT_ID__
|
|
||||||
{{/if}}
|
|
||||||
{{#if __GH_AW_GITHUB_RUN_ID__ }}
|
|
||||||
- **workflow-run-id**: __GH_AW_GITHUB_RUN_ID__
|
|
||||||
{{/if}}
|
|
||||||
</github-context>
|
|
||||||
|
|
||||||
GH_AW_PROMPT_EOF
|
|
||||||
cat << 'GH_AW_PROMPT_EOF' >> "$GH_AW_PROMPT"
|
|
||||||
</system>
|
|
||||||
GH_AW_PROMPT_EOF
|
|
||||||
cat << 'GH_AW_PROMPT_EOF' >> "$GH_AW_PROMPT"
|
|
||||||
{{#runtime-import .github/workflows/a3-python-v2.md}}
|
|
||||||
GH_AW_PROMPT_EOF
|
|
||||||
- name: Substitute placeholders
|
|
||||||
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
|
|
||||||
env:
|
|
||||||
GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
|
|
||||||
GH_AW_GITHUB_ACTOR: ${{ github.actor }}
|
|
||||||
GH_AW_GITHUB_EVENT_COMMENT_ID: ${{ github.event.comment.id }}
|
|
||||||
GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER: ${{ github.event.discussion.number }}
|
|
||||||
GH_AW_GITHUB_EVENT_ISSUE_NUMBER: ${{ github.event.issue.number }}
|
|
||||||
GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER: ${{ github.event.pull_request.number }}
|
|
||||||
GH_AW_GITHUB_REPOSITORY: ${{ github.repository }}
|
|
||||||
GH_AW_GITHUB_RUN_ID: ${{ github.run_id }}
|
|
||||||
GH_AW_GITHUB_WORKSPACE: ${{ github.workspace }}
|
|
||||||
with:
|
with:
|
||||||
script: |
|
name: prompt
|
||||||
const substitutePlaceholders = require('/opt/gh-aw/actions/substitute_placeholders.cjs');
|
path: /tmp/gh-aw/aw-prompts
|
||||||
|
|
||||||
// Call the substitution function
|
|
||||||
return await substitutePlaceholders({
|
|
||||||
file: process.env.GH_AW_PROMPT,
|
|
||||||
substitutions: {
|
|
||||||
GH_AW_GITHUB_ACTOR: process.env.GH_AW_GITHUB_ACTOR,
|
|
||||||
GH_AW_GITHUB_EVENT_COMMENT_ID: process.env.GH_AW_GITHUB_EVENT_COMMENT_ID,
|
|
||||||
GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER: process.env.GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER,
|
|
||||||
GH_AW_GITHUB_EVENT_ISSUE_NUMBER: process.env.GH_AW_GITHUB_EVENT_ISSUE_NUMBER,
|
|
||||||
GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER: process.env.GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER,
|
|
||||||
GH_AW_GITHUB_REPOSITORY: process.env.GH_AW_GITHUB_REPOSITORY,
|
|
||||||
GH_AW_GITHUB_RUN_ID: process.env.GH_AW_GITHUB_RUN_ID,
|
|
||||||
GH_AW_GITHUB_WORKSPACE: process.env.GH_AW_GITHUB_WORKSPACE
|
|
||||||
}
|
|
||||||
});
|
|
||||||
- name: Interpolate variables and render templates
|
|
||||||
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
|
|
||||||
env:
|
|
||||||
GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
|
|
||||||
GH_AW_GITHUB_REPOSITORY: ${{ github.repository }}
|
|
||||||
GH_AW_GITHUB_WORKSPACE: ${{ github.workspace }}
|
|
||||||
with:
|
|
||||||
script: |
|
|
||||||
const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
|
|
||||||
setupGlobals(core, github, context, exec, io);
|
|
||||||
const { main } = require('/opt/gh-aw/actions/interpolate_prompt.cjs');
|
|
||||||
await main();
|
|
||||||
- name: Validate prompt placeholders
|
|
||||||
env:
|
|
||||||
GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
|
|
||||||
run: bash /opt/gh-aw/actions/validate_prompt_placeholders.sh
|
|
||||||
- name: Print prompt
|
|
||||||
env:
|
|
||||||
GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
|
|
||||||
run: bash /opt/gh-aw/actions/print_prompt_summary.sh
|
|
||||||
- name: Clean git credentials
|
- name: Clean git credentials
|
||||||
run: bash /opt/gh-aw/actions/clean_git_credentials.sh
|
run: bash /opt/gh-aw/actions/clean_git_credentials.sh
|
||||||
- name: Execute GitHub Copilot CLI
|
- name: Execute GitHub Copilot CLI
|
||||||
|
|
@ -630,7 +652,7 @@ jobs:
|
||||||
timeout-minutes: 45
|
timeout-minutes: 45
|
||||||
run: |
|
run: |
|
||||||
set -o pipefail
|
set -o pipefail
|
||||||
sudo -E awf --env-all --container-workdir "${GITHUB_WORKSPACE}" --allow-domains '*.pythonhosted.org,anaconda.org,api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,binstar.org,bootstrap.pypa.io,conda.anaconda.org,conda.binstar.org,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,files.pythonhosted.org,github.com,host.docker.internal,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,pip.pypa.io,ppa.launchpad.net,pypi.org,pypi.python.org,raw.githubusercontent.com,registry.npmjs.org,repo.anaconda.com,repo.continuum.io,s.symcb.com,s.symcd.com,security.ubuntu.com,telemetry.enterprise.githubcopilot.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com' --log-level info --proxy-logs-dir /tmp/gh-aw/sandbox/firewall/logs --enable-host-access --image-tag 0.18.0 --skip-pull \
|
sudo -E awf --env-all --container-workdir "${GITHUB_WORKSPACE}" --allow-domains '*.pythonhosted.org,anaconda.org,api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,binstar.org,bootstrap.pypa.io,conda.anaconda.org,conda.binstar.org,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,files.pythonhosted.org,github.com,host.docker.internal,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,pip.pypa.io,ppa.launchpad.net,pypi.org,pypi.python.org,raw.githubusercontent.com,registry.npmjs.org,repo.anaconda.com,repo.continuum.io,s.symcb.com,s.symcd.com,security.ubuntu.com,telemetry.enterprise.githubcopilot.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com' --log-level info --proxy-logs-dir /tmp/gh-aw/sandbox/firewall/logs --enable-host-access --image-tag 0.19.1 --skip-pull \
|
||||||
-- /bin/bash -c '/usr/local/bin/copilot --add-dir /tmp/gh-aw/ --log-level all --log-dir /tmp/gh-aw/sandbox/agent/logs/ --add-dir "${GITHUB_WORKSPACE}" --disable-builtin-mcps --allow-all-tools --allow-all-paths --share /tmp/gh-aw/sandbox/agent/logs/conversation.md --prompt "$(cat /tmp/gh-aw/aw-prompts/prompt.txt)"${GH_AW_MODEL_AGENT_COPILOT:+ --model "$GH_AW_MODEL_AGENT_COPILOT"}' 2>&1 | tee -a /tmp/gh-aw/agent-stdio.log
|
-- /bin/bash -c '/usr/local/bin/copilot --add-dir /tmp/gh-aw/ --log-level all --log-dir /tmp/gh-aw/sandbox/agent/logs/ --add-dir "${GITHUB_WORKSPACE}" --disable-builtin-mcps --allow-all-tools --allow-all-paths --share /tmp/gh-aw/sandbox/agent/logs/conversation.md --prompt "$(cat /tmp/gh-aw/aw-prompts/prompt.txt)"${GH_AW_MODEL_AGENT_COPILOT:+ --model "$GH_AW_MODEL_AGENT_COPILOT"}' 2>&1 | tee -a /tmp/gh-aw/agent-stdio.log
|
||||||
env:
|
env:
|
||||||
COPILOT_AGENT_RUNNER_TYPE: STANDALONE
|
COPILOT_AGENT_RUNNER_TYPE: STANDALONE
|
||||||
|
|
@ -698,7 +720,7 @@ jobs:
|
||||||
SECRET_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
SECRET_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||||
- name: Upload Safe Outputs
|
- name: Upload Safe Outputs
|
||||||
if: always()
|
if: always()
|
||||||
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
|
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
|
||||||
with:
|
with:
|
||||||
name: safe-output
|
name: safe-output
|
||||||
path: ${{ env.GH_AW_SAFE_OUTPUTS }}
|
path: ${{ env.GH_AW_SAFE_OUTPUTS }}
|
||||||
|
|
@ -720,13 +742,13 @@ jobs:
|
||||||
await main();
|
await main();
|
||||||
- name: Upload sanitized agent output
|
- name: Upload sanitized agent output
|
||||||
if: always() && env.GH_AW_AGENT_OUTPUT
|
if: always() && env.GH_AW_AGENT_OUTPUT
|
||||||
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
|
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
|
||||||
with:
|
with:
|
||||||
name: agent-output
|
name: agent-output
|
||||||
path: ${{ env.GH_AW_AGENT_OUTPUT }}
|
path: ${{ env.GH_AW_AGENT_OUTPUT }}
|
||||||
if-no-files-found: warn
|
if-no-files-found: warn
|
||||||
- name: Upload engine output files
|
- name: Upload engine output files
|
||||||
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
|
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
|
||||||
with:
|
with:
|
||||||
name: agent_outputs
|
name: agent_outputs
|
||||||
path: |
|
path: |
|
||||||
|
|
@ -771,7 +793,7 @@ jobs:
|
||||||
- name: Upload agent artifacts
|
- name: Upload agent artifacts
|
||||||
if: always()
|
if: always()
|
||||||
continue-on-error: true
|
continue-on-error: true
|
||||||
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
|
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
|
||||||
with:
|
with:
|
||||||
name: agent-artifacts
|
name: agent-artifacts
|
||||||
path: |
|
path: |
|
||||||
|
|
@ -800,12 +822,12 @@ jobs:
|
||||||
total_count: ${{ steps.missing_tool.outputs.total_count }}
|
total_count: ${{ steps.missing_tool.outputs.total_count }}
|
||||||
steps:
|
steps:
|
||||||
- name: Setup Scripts
|
- name: Setup Scripts
|
||||||
uses: github/gh-aw/actions/setup@v0.45.1
|
uses: github/gh-aw/actions/setup@v0.45.3
|
||||||
with:
|
with:
|
||||||
destination: /opt/gh-aw/actions
|
destination: /opt/gh-aw/actions
|
||||||
- name: Download agent output artifact
|
- name: Download agent output artifact
|
||||||
continue-on-error: true
|
continue-on-error: true
|
||||||
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
|
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
|
||||||
with:
|
with:
|
||||||
name: agent-output
|
name: agent-output
|
||||||
path: /tmp/gh-aw/safeoutputs/
|
path: /tmp/gh-aw/safeoutputs/
|
||||||
|
|
@ -901,18 +923,18 @@ jobs:
|
||||||
success: ${{ steps.parse_results.outputs.success }}
|
success: ${{ steps.parse_results.outputs.success }}
|
||||||
steps:
|
steps:
|
||||||
- name: Setup Scripts
|
- name: Setup Scripts
|
||||||
uses: github/gh-aw/actions/setup@v0.45.1
|
uses: github/gh-aw/actions/setup@v0.45.3
|
||||||
with:
|
with:
|
||||||
destination: /opt/gh-aw/actions
|
destination: /opt/gh-aw/actions
|
||||||
- name: Download agent artifacts
|
- name: Download agent artifacts
|
||||||
continue-on-error: true
|
continue-on-error: true
|
||||||
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
|
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
|
||||||
with:
|
with:
|
||||||
name: agent-artifacts
|
name: agent-artifacts
|
||||||
path: /tmp/gh-aw/threat-detection/
|
path: /tmp/gh-aw/threat-detection/
|
||||||
- name: Download agent output artifact
|
- name: Download agent output artifact
|
||||||
continue-on-error: true
|
continue-on-error: true
|
||||||
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
|
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
|
||||||
with:
|
with:
|
||||||
name: agent-output
|
name: agent-output
|
||||||
path: /tmp/gh-aw/threat-detection/
|
path: /tmp/gh-aw/threat-detection/
|
||||||
|
|
@ -984,7 +1006,7 @@ jobs:
|
||||||
await main();
|
await main();
|
||||||
- name: Upload threat detection log
|
- name: Upload threat detection log
|
||||||
if: always()
|
if: always()
|
||||||
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
|
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
|
||||||
with:
|
with:
|
||||||
name: threat-detection.log
|
name: threat-detection.log
|
||||||
path: /tmp/gh-aw/threat-detection/detection.log
|
path: /tmp/gh-aw/threat-detection/detection.log
|
||||||
|
|
@ -1014,12 +1036,12 @@ jobs:
|
||||||
process_safe_outputs_temporary_id_map: ${{ steps.process_safe_outputs.outputs.temporary_id_map }}
|
process_safe_outputs_temporary_id_map: ${{ steps.process_safe_outputs.outputs.temporary_id_map }}
|
||||||
steps:
|
steps:
|
||||||
- name: Setup Scripts
|
- name: Setup Scripts
|
||||||
uses: github/gh-aw/actions/setup@v0.45.1
|
uses: github/gh-aw/actions/setup@v0.45.3
|
||||||
with:
|
with:
|
||||||
destination: /opt/gh-aw/actions
|
destination: /opt/gh-aw/actions
|
||||||
- name: Download agent output artifact
|
- name: Download agent output artifact
|
||||||
continue-on-error: true
|
continue-on-error: true
|
||||||
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
|
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
|
||||||
with:
|
with:
|
||||||
name: agent-output
|
name: agent-output
|
||||||
path: /tmp/gh-aw/safeoutputs/
|
path: /tmp/gh-aw/safeoutputs/
|
||||||
|
|
|
||||||
1
.github/workflows/a3-python-v2.md
vendored
1
.github/workflows/a3-python-v2.md
vendored
|
|
@ -37,7 +37,6 @@ You are an expert Python code analyst using the a3-python tool to identify bugs
|
||||||
## Current Context
|
## Current Context
|
||||||
|
|
||||||
- **Repository**: ${{ github.repository }}
|
- **Repository**: ${{ github.repository }}
|
||||||
- **Analysis Date**: $(date +%Y-%m-%d)
|
|
||||||
- **Workspace**: ${{ github.workspace }}
|
- **Workspace**: ${{ github.workspace }}
|
||||||
|
|
||||||
## Phase 1: Install and Setup a3-python
|
## Phase 1: Install and Setup a3-python
|
||||||
|
|
|
||||||
334
.github/workflows/a3-python.lock.yml
generated
vendored
334
.github/workflows/a3-python.lock.yml
generated
vendored
|
|
@ -13,7 +13,7 @@
|
||||||
# \ /\ / (_) | | | | ( | | | | (_) \ V V /\__ \
|
# \ /\ / (_) | | | | ( | | | | (_) \ V V /\__ \
|
||||||
# \/ \/ \___/|_| |_|\_\|_| |_|\___/ \_/\_/ |___/
|
# \/ \/ \___/|_| |_|\_\|_| |_|\___/ \_/\_/ |___/
|
||||||
#
|
#
|
||||||
# This file was automatically generated by gh-aw (v0.45.0). DO NOT EDIT.
|
# This file was automatically generated by gh-aw (v0.45.3). DO NOT EDIT.
|
||||||
#
|
#
|
||||||
# To update this file, edit the corresponding .md file and run:
|
# To update this file, edit the corresponding .md file and run:
|
||||||
# gh aw compile
|
# gh aw compile
|
||||||
|
|
@ -48,9 +48,17 @@ jobs:
|
||||||
comment_repo: ""
|
comment_repo: ""
|
||||||
steps:
|
steps:
|
||||||
- name: Setup Scripts
|
- name: Setup Scripts
|
||||||
uses: github/gh-aw/actions/setup@v0.45.1
|
uses: github/gh-aw/actions/setup@v0.45.3
|
||||||
with:
|
with:
|
||||||
destination: /opt/gh-aw/actions
|
destination: /opt/gh-aw/actions
|
||||||
|
- name: Checkout .github and .agents folders
|
||||||
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
||||||
|
with:
|
||||||
|
sparse-checkout: |
|
||||||
|
.github
|
||||||
|
.agents
|
||||||
|
fetch-depth: 1
|
||||||
|
persist-credentials: false
|
||||||
- name: Check workflow file timestamps
|
- name: Check workflow file timestamps
|
||||||
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
|
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
|
||||||
env:
|
env:
|
||||||
|
|
@ -61,6 +69,150 @@ jobs:
|
||||||
setupGlobals(core, github, context, exec, io);
|
setupGlobals(core, github, context, exec, io);
|
||||||
const { main } = require('/opt/gh-aw/actions/check_workflow_timestamp_api.cjs');
|
const { main } = require('/opt/gh-aw/actions/check_workflow_timestamp_api.cjs');
|
||||||
await main();
|
await main();
|
||||||
|
- name: Create prompt with built-in context
|
||||||
|
env:
|
||||||
|
GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
|
||||||
|
GH_AW_SAFE_OUTPUTS: ${{ env.GH_AW_SAFE_OUTPUTS }}
|
||||||
|
GH_AW_GITHUB_ACTOR: ${{ github.actor }}
|
||||||
|
GH_AW_GITHUB_EVENT_COMMENT_ID: ${{ github.event.comment.id }}
|
||||||
|
GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER: ${{ github.event.discussion.number }}
|
||||||
|
GH_AW_GITHUB_EVENT_ISSUE_NUMBER: ${{ github.event.issue.number }}
|
||||||
|
GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER: ${{ github.event.pull_request.number }}
|
||||||
|
GH_AW_GITHUB_REPOSITORY: ${{ github.repository }}
|
||||||
|
GH_AW_GITHUB_RUN_ID: ${{ github.run_id }}
|
||||||
|
GH_AW_GITHUB_WORKSPACE: ${{ github.workspace }}
|
||||||
|
run: |
|
||||||
|
bash /opt/gh-aw/actions/create_prompt_first.sh
|
||||||
|
cat << 'GH_AW_PROMPT_EOF' > "$GH_AW_PROMPT"
|
||||||
|
<system>
|
||||||
|
GH_AW_PROMPT_EOF
|
||||||
|
cat "/opt/gh-aw/prompts/xpia.md" >> "$GH_AW_PROMPT"
|
||||||
|
cat "/opt/gh-aw/prompts/temp_folder_prompt.md" >> "$GH_AW_PROMPT"
|
||||||
|
cat "/opt/gh-aw/prompts/markdown.md" >> "$GH_AW_PROMPT"
|
||||||
|
cat << 'GH_AW_PROMPT_EOF' >> "$GH_AW_PROMPT"
|
||||||
|
<safe-outputs>
|
||||||
|
<description>GitHub API Access Instructions</description>
|
||||||
|
<important>
|
||||||
|
The gh CLI is NOT authenticated. Do NOT use gh commands for GitHub operations.
|
||||||
|
</important>
|
||||||
|
<instructions>
|
||||||
|
To create or modify GitHub resources (issues, discussions, pull requests, etc.), you MUST call the appropriate safe output tool. Simply writing content will NOT work - the workflow requires actual tool calls.
|
||||||
|
|
||||||
|
Temporary IDs: Some safe output tools support a temporary ID field (usually named temporary_id) so you can reference newly-created items elsewhere in the SAME agent output (for example, using #aw_abc1 in a later body).
|
||||||
|
|
||||||
|
**IMPORTANT - temporary_id format rules:**
|
||||||
|
- If you DON'T need to reference the item later, OMIT the temporary_id field entirely (it will be auto-generated if needed)
|
||||||
|
- If you DO need cross-references/chaining, you MUST match this EXACT validation regex: /^aw_[A-Za-z0-9]{3,8}$/i
|
||||||
|
- Format: aw_ prefix followed by 3 to 8 alphanumeric characters (A-Z, a-z, 0-9, case-insensitive)
|
||||||
|
- Valid alphanumeric characters: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789
|
||||||
|
- INVALID examples: aw_ab (too short), aw_123456789 (too long), aw_test-id (contains hyphen), aw_id_123 (contains underscore)
|
||||||
|
- VALID examples: aw_abc, aw_abc1, aw_Test123, aw_A1B2C3D4, aw_12345678
|
||||||
|
- To generate valid IDs: use 3-8 random alphanumeric characters or omit the field to let the system auto-generate
|
||||||
|
|
||||||
|
Do NOT invent other aw_* formats — downstream steps will reject them with validation errors matching against /^aw_[A-Za-z0-9]{3,8}$/i.
|
||||||
|
|
||||||
|
Discover available tools from the safeoutputs MCP server.
|
||||||
|
|
||||||
|
**Critical**: Tool calls write structured data that downstream jobs process. Without tool calls, follow-up actions will be skipped.
|
||||||
|
|
||||||
|
**Note**: If you made no other safe output tool calls during this workflow execution, call the "noop" tool to provide a status message indicating completion or that no actions were needed.
|
||||||
|
</instructions>
|
||||||
|
</safe-outputs>
|
||||||
|
<github-context>
|
||||||
|
The following GitHub context information is available for this workflow:
|
||||||
|
{{#if __GH_AW_GITHUB_ACTOR__ }}
|
||||||
|
- **actor**: __GH_AW_GITHUB_ACTOR__
|
||||||
|
{{/if}}
|
||||||
|
{{#if __GH_AW_GITHUB_REPOSITORY__ }}
|
||||||
|
- **repository**: __GH_AW_GITHUB_REPOSITORY__
|
||||||
|
{{/if}}
|
||||||
|
{{#if __GH_AW_GITHUB_WORKSPACE__ }}
|
||||||
|
- **workspace**: __GH_AW_GITHUB_WORKSPACE__
|
||||||
|
{{/if}}
|
||||||
|
{{#if __GH_AW_GITHUB_EVENT_ISSUE_NUMBER__ }}
|
||||||
|
- **issue-number**: #__GH_AW_GITHUB_EVENT_ISSUE_NUMBER__
|
||||||
|
{{/if}}
|
||||||
|
{{#if __GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER__ }}
|
||||||
|
- **discussion-number**: #__GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER__
|
||||||
|
{{/if}}
|
||||||
|
{{#if __GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER__ }}
|
||||||
|
- **pull-request-number**: #__GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER__
|
||||||
|
{{/if}}
|
||||||
|
{{#if __GH_AW_GITHUB_EVENT_COMMENT_ID__ }}
|
||||||
|
- **comment-id**: __GH_AW_GITHUB_EVENT_COMMENT_ID__
|
||||||
|
{{/if}}
|
||||||
|
{{#if __GH_AW_GITHUB_RUN_ID__ }}
|
||||||
|
- **workflow-run-id**: __GH_AW_GITHUB_RUN_ID__
|
||||||
|
{{/if}}
|
||||||
|
</github-context>
|
||||||
|
|
||||||
|
GH_AW_PROMPT_EOF
|
||||||
|
cat << 'GH_AW_PROMPT_EOF' >> "$GH_AW_PROMPT"
|
||||||
|
</system>
|
||||||
|
GH_AW_PROMPT_EOF
|
||||||
|
cat << 'GH_AW_PROMPT_EOF' >> "$GH_AW_PROMPT"
|
||||||
|
{{#runtime-import .github/workflows/a3-python.md}}
|
||||||
|
GH_AW_PROMPT_EOF
|
||||||
|
- name: Interpolate variables and render templates
|
||||||
|
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
|
||||||
|
env:
|
||||||
|
GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
|
||||||
|
GH_AW_GITHUB_REPOSITORY: ${{ github.repository }}
|
||||||
|
GH_AW_GITHUB_WORKSPACE: ${{ github.workspace }}
|
||||||
|
with:
|
||||||
|
script: |
|
||||||
|
const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
|
||||||
|
setupGlobals(core, github, context, exec, io);
|
||||||
|
const { main } = require('/opt/gh-aw/actions/interpolate_prompt.cjs');
|
||||||
|
await main();
|
||||||
|
- name: Substitute placeholders
|
||||||
|
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
|
||||||
|
env:
|
||||||
|
GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
|
||||||
|
GH_AW_GITHUB_ACTOR: ${{ github.actor }}
|
||||||
|
GH_AW_GITHUB_EVENT_COMMENT_ID: ${{ github.event.comment.id }}
|
||||||
|
GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER: ${{ github.event.discussion.number }}
|
||||||
|
GH_AW_GITHUB_EVENT_ISSUE_NUMBER: ${{ github.event.issue.number }}
|
||||||
|
GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER: ${{ github.event.pull_request.number }}
|
||||||
|
GH_AW_GITHUB_REPOSITORY: ${{ github.repository }}
|
||||||
|
GH_AW_GITHUB_RUN_ID: ${{ github.run_id }}
|
||||||
|
GH_AW_GITHUB_WORKSPACE: ${{ github.workspace }}
|
||||||
|
with:
|
||||||
|
script: |
|
||||||
|
const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
|
||||||
|
setupGlobals(core, github, context, exec, io);
|
||||||
|
|
||||||
|
const substitutePlaceholders = require('/opt/gh-aw/actions/substitute_placeholders.cjs');
|
||||||
|
|
||||||
|
// Call the substitution function
|
||||||
|
return await substitutePlaceholders({
|
||||||
|
file: process.env.GH_AW_PROMPT,
|
||||||
|
substitutions: {
|
||||||
|
GH_AW_GITHUB_ACTOR: process.env.GH_AW_GITHUB_ACTOR,
|
||||||
|
GH_AW_GITHUB_EVENT_COMMENT_ID: process.env.GH_AW_GITHUB_EVENT_COMMENT_ID,
|
||||||
|
GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER: process.env.GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER,
|
||||||
|
GH_AW_GITHUB_EVENT_ISSUE_NUMBER: process.env.GH_AW_GITHUB_EVENT_ISSUE_NUMBER,
|
||||||
|
GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER: process.env.GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER,
|
||||||
|
GH_AW_GITHUB_REPOSITORY: process.env.GH_AW_GITHUB_REPOSITORY,
|
||||||
|
GH_AW_GITHUB_RUN_ID: process.env.GH_AW_GITHUB_RUN_ID,
|
||||||
|
GH_AW_GITHUB_WORKSPACE: process.env.GH_AW_GITHUB_WORKSPACE
|
||||||
|
}
|
||||||
|
});
|
||||||
|
- name: Validate prompt placeholders
|
||||||
|
env:
|
||||||
|
GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
|
||||||
|
run: bash /opt/gh-aw/actions/validate_prompt_placeholders.sh
|
||||||
|
- name: Print prompt
|
||||||
|
env:
|
||||||
|
GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
|
||||||
|
run: bash /opt/gh-aw/actions/print_prompt_summary.sh
|
||||||
|
- name: Upload prompt artifact
|
||||||
|
if: success()
|
||||||
|
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
|
||||||
|
with:
|
||||||
|
name: prompt
|
||||||
|
path: /tmp/gh-aw/aw-prompts/prompt.txt
|
||||||
|
retention-days: 1
|
||||||
|
|
||||||
agent:
|
agent:
|
||||||
needs: activation
|
needs: activation
|
||||||
|
|
@ -90,11 +242,11 @@ jobs:
|
||||||
secret_verification_result: ${{ steps.validate-secret.outputs.verification_result }}
|
secret_verification_result: ${{ steps.validate-secret.outputs.verification_result }}
|
||||||
steps:
|
steps:
|
||||||
- name: Setup Scripts
|
- name: Setup Scripts
|
||||||
uses: github/gh-aw/actions/setup@v0.45.1
|
uses: github/gh-aw/actions/setup@v0.45.3
|
||||||
with:
|
with:
|
||||||
destination: /opt/gh-aw/actions
|
destination: /opt/gh-aw/actions
|
||||||
- name: Checkout repository
|
- name: Checkout repository
|
||||||
uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98 # v6.0.2
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
||||||
with:
|
with:
|
||||||
persist-credentials: false
|
persist-credentials: false
|
||||||
- name: Create gh-aw temp directory
|
- name: Create gh-aw temp directory
|
||||||
|
|
@ -143,11 +295,10 @@ jobs:
|
||||||
model: process.env.GH_AW_MODEL_AGENT_COPILOT || "",
|
model: process.env.GH_AW_MODEL_AGENT_COPILOT || "",
|
||||||
version: "",
|
version: "",
|
||||||
agent_version: "0.0.410",
|
agent_version: "0.0.410",
|
||||||
cli_version: "v0.45.0",
|
cli_version: "v0.45.3",
|
||||||
workflow_name: "A3 Python Code Analysis",
|
workflow_name: "A3 Python Code Analysis",
|
||||||
experimental: false,
|
experimental: false,
|
||||||
supports_tools_allowlist: true,
|
supports_tools_allowlist: true,
|
||||||
supports_http_transport: true,
|
|
||||||
run_id: context.runId,
|
run_id: context.runId,
|
||||||
run_number: context.runNumber,
|
run_number: context.runNumber,
|
||||||
run_attempt: process.env.GITHUB_RUN_ATTEMPT,
|
run_attempt: process.env.GITHUB_RUN_ATTEMPT,
|
||||||
|
|
@ -159,7 +310,7 @@ jobs:
|
||||||
staged: false,
|
staged: false,
|
||||||
allowed_domains: ["defaults","python"],
|
allowed_domains: ["defaults","python"],
|
||||||
firewall_enabled: true,
|
firewall_enabled: true,
|
||||||
awf_version: "v0.18.0",
|
awf_version: "v0.19.1",
|
||||||
awmg_version: "v0.1.4",
|
awmg_version: "v0.1.4",
|
||||||
steps: {
|
steps: {
|
||||||
firewall: "squid"
|
firewall: "squid"
|
||||||
|
|
@ -183,7 +334,7 @@ jobs:
|
||||||
- name: Install GitHub Copilot CLI
|
- name: Install GitHub Copilot CLI
|
||||||
run: /opt/gh-aw/actions/install_copilot_cli.sh 0.0.410
|
run: /opt/gh-aw/actions/install_copilot_cli.sh 0.0.410
|
||||||
- name: Install awf binary
|
- name: Install awf binary
|
||||||
run: bash /opt/gh-aw/actions/install_awf_binary.sh v0.18.0
|
run: bash /opt/gh-aw/actions/install_awf_binary.sh v0.19.1
|
||||||
- name: Determine automatic lockdown mode for GitHub MCP Server
|
- name: Determine automatic lockdown mode for GitHub MCP Server
|
||||||
id: determine-automatic-lockdown
|
id: determine-automatic-lockdown
|
||||||
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
|
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
|
||||||
|
|
@ -195,7 +346,7 @@ jobs:
|
||||||
const determineAutomaticLockdown = require('/opt/gh-aw/actions/determine_automatic_lockdown.cjs');
|
const determineAutomaticLockdown = require('/opt/gh-aw/actions/determine_automatic_lockdown.cjs');
|
||||||
await determineAutomaticLockdown(github, context, core);
|
await determineAutomaticLockdown(github, context, core);
|
||||||
- name: Download container images
|
- name: Download container images
|
||||||
run: bash /opt/gh-aw/actions/download_docker_images.sh ghcr.io/github/gh-aw-firewall/agent:0.18.0 ghcr.io/github/gh-aw-firewall/squid:0.18.0 ghcr.io/github/gh-aw-mcpg:v0.1.4 ghcr.io/github/github-mcp-server:v0.30.3 node:lts-alpine
|
run: bash /opt/gh-aw/actions/download_docker_images.sh ghcr.io/github/gh-aw-firewall/agent:0.19.1 ghcr.io/github/gh-aw-firewall/squid:0.19.1 ghcr.io/github/gh-aw-mcpg:v0.1.4 ghcr.io/github/github-mcp-server:v0.30.3 node:lts-alpine
|
||||||
- name: Write Safe Outputs Config
|
- name: Write Safe Outputs Config
|
||||||
run: |
|
run: |
|
||||||
mkdir -p /opt/gh-aw/safeoutputs
|
mkdir -p /opt/gh-aw/safeoutputs
|
||||||
|
|
@ -231,7 +382,7 @@ jobs:
|
||||||
},
|
},
|
||||||
"temporary_id": {
|
"temporary_id": {
|
||||||
"description": "Unique temporary identifier for referencing this issue before it's created. Format: 'aw_' followed by 3 to 8 alphanumeric characters (e.g., 'aw_abc1', 'aw_Test123'). Use '#aw_ID' in body text to reference other issues by their temporary_id; these are replaced with actual issue numbers after creation.",
|
"description": "Unique temporary identifier for referencing this issue before it's created. Format: 'aw_' followed by 3 to 8 alphanumeric characters (e.g., 'aw_abc1', 'aw_Test123'). Use '#aw_ID' in body text to reference other issues by their temporary_id; these are replaced with actual issue numbers after creation.",
|
||||||
"pattern": "^aw_[A-Za-z0-9]{4,8}$",
|
"pattern": "^aw_[A-Za-z0-9]{3,8}$",
|
||||||
"type": "string"
|
"type": "string"
|
||||||
},
|
},
|
||||||
"title": {
|
"title": {
|
||||||
|
|
@ -486,140 +637,11 @@ jobs:
|
||||||
script: |
|
script: |
|
||||||
const { generateWorkflowOverview } = require('/opt/gh-aw/actions/generate_workflow_overview.cjs');
|
const { generateWorkflowOverview } = require('/opt/gh-aw/actions/generate_workflow_overview.cjs');
|
||||||
await generateWorkflowOverview(core);
|
await generateWorkflowOverview(core);
|
||||||
- name: Create prompt with built-in context
|
- name: Download prompt artifact
|
||||||
env:
|
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
|
||||||
GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
|
|
||||||
GH_AW_SAFE_OUTPUTS: ${{ env.GH_AW_SAFE_OUTPUTS }}
|
|
||||||
GH_AW_GITHUB_ACTOR: ${{ github.actor }}
|
|
||||||
GH_AW_GITHUB_EVENT_COMMENT_ID: ${{ github.event.comment.id }}
|
|
||||||
GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER: ${{ github.event.discussion.number }}
|
|
||||||
GH_AW_GITHUB_EVENT_ISSUE_NUMBER: ${{ github.event.issue.number }}
|
|
||||||
GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER: ${{ github.event.pull_request.number }}
|
|
||||||
GH_AW_GITHUB_REPOSITORY: ${{ github.repository }}
|
|
||||||
GH_AW_GITHUB_RUN_ID: ${{ github.run_id }}
|
|
||||||
GH_AW_GITHUB_WORKSPACE: ${{ github.workspace }}
|
|
||||||
run: |
|
|
||||||
bash /opt/gh-aw/actions/create_prompt_first.sh
|
|
||||||
cat << 'GH_AW_PROMPT_EOF' > "$GH_AW_PROMPT"
|
|
||||||
<system>
|
|
||||||
GH_AW_PROMPT_EOF
|
|
||||||
cat "/opt/gh-aw/prompts/xpia.md" >> "$GH_AW_PROMPT"
|
|
||||||
cat "/opt/gh-aw/prompts/temp_folder_prompt.md" >> "$GH_AW_PROMPT"
|
|
||||||
cat "/opt/gh-aw/prompts/markdown.md" >> "$GH_AW_PROMPT"
|
|
||||||
cat << 'GH_AW_PROMPT_EOF' >> "$GH_AW_PROMPT"
|
|
||||||
<safe-outputs>
|
|
||||||
<description>GitHub API Access Instructions</description>
|
|
||||||
<important>
|
|
||||||
The gh CLI is NOT authenticated. Do NOT use gh commands for GitHub operations.
|
|
||||||
</important>
|
|
||||||
<instructions>
|
|
||||||
To create or modify GitHub resources (issues, discussions, pull requests, etc.), you MUST call the appropriate safe output tool. Simply writing content will NOT work - the workflow requires actual tool calls.
|
|
||||||
|
|
||||||
Temporary IDs: Some safe output tools support a temporary ID field (usually named temporary_id) so you can reference newly-created items elsewhere in the SAME agent output (for example, using #aw_abc1 in a later body).
|
|
||||||
|
|
||||||
**IMPORTANT - temporary_id format rules:**
|
|
||||||
- If you DON'T need to reference the item later, OMIT the temporary_id field entirely (it will be auto-generated if needed)
|
|
||||||
- If you DO need cross-references/chaining, you MUST match this EXACT validation regex: /^aw_[A-Za-z0-9]{3,8}$/i
|
|
||||||
- Format: aw_ prefix followed by 3 to 8 alphanumeric characters (A-Z, a-z, 0-9, case-insensitive)
|
|
||||||
- Valid alphanumeric characters: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789
|
|
||||||
- INVALID examples: aw_ab (too short), aw_123456789 (too long), aw_test-id (contains hyphen), aw_id_123 (contains underscore)
|
|
||||||
- VALID examples: aw_abc, aw_abc1, aw_Test123, aw_A1B2C3D4, aw_12345678
|
|
||||||
- To generate valid IDs: use 3-8 random alphanumeric characters or omit the field to let the system auto-generate
|
|
||||||
|
|
||||||
Do NOT invent other aw_* formats — downstream steps will reject them with validation errors matching against /^aw_[A-Za-z0-9]{3,8}$/i.
|
|
||||||
|
|
||||||
Discover available tools from the safeoutputs MCP server.
|
|
||||||
|
|
||||||
**Critical**: Tool calls write structured data that downstream jobs process. Without tool calls, follow-up actions will be skipped.
|
|
||||||
|
|
||||||
**Note**: If you made no other safe output tool calls during this workflow execution, call the "noop" tool to provide a status message indicating completion or that no actions were needed.
|
|
||||||
</instructions>
|
|
||||||
</safe-outputs>
|
|
||||||
<github-context>
|
|
||||||
The following GitHub context information is available for this workflow:
|
|
||||||
{{#if __GH_AW_GITHUB_ACTOR__ }}
|
|
||||||
- **actor**: __GH_AW_GITHUB_ACTOR__
|
|
||||||
{{/if}}
|
|
||||||
{{#if __GH_AW_GITHUB_REPOSITORY__ }}
|
|
||||||
- **repository**: __GH_AW_GITHUB_REPOSITORY__
|
|
||||||
{{/if}}
|
|
||||||
{{#if __GH_AW_GITHUB_WORKSPACE__ }}
|
|
||||||
- **workspace**: __GH_AW_GITHUB_WORKSPACE__
|
|
||||||
{{/if}}
|
|
||||||
{{#if __GH_AW_GITHUB_EVENT_ISSUE_NUMBER__ }}
|
|
||||||
- **issue-number**: #__GH_AW_GITHUB_EVENT_ISSUE_NUMBER__
|
|
||||||
{{/if}}
|
|
||||||
{{#if __GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER__ }}
|
|
||||||
- **discussion-number**: #__GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER__
|
|
||||||
{{/if}}
|
|
||||||
{{#if __GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER__ }}
|
|
||||||
- **pull-request-number**: #__GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER__
|
|
||||||
{{/if}}
|
|
||||||
{{#if __GH_AW_GITHUB_EVENT_COMMENT_ID__ }}
|
|
||||||
- **comment-id**: __GH_AW_GITHUB_EVENT_COMMENT_ID__
|
|
||||||
{{/if}}
|
|
||||||
{{#if __GH_AW_GITHUB_RUN_ID__ }}
|
|
||||||
- **workflow-run-id**: __GH_AW_GITHUB_RUN_ID__
|
|
||||||
{{/if}}
|
|
||||||
</github-context>
|
|
||||||
|
|
||||||
GH_AW_PROMPT_EOF
|
|
||||||
cat << 'GH_AW_PROMPT_EOF' >> "$GH_AW_PROMPT"
|
|
||||||
</system>
|
|
||||||
GH_AW_PROMPT_EOF
|
|
||||||
cat << 'GH_AW_PROMPT_EOF' >> "$GH_AW_PROMPT"
|
|
||||||
{{#runtime-import .github/workflows/a3-python.md}}
|
|
||||||
GH_AW_PROMPT_EOF
|
|
||||||
- name: Substitute placeholders
|
|
||||||
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
|
|
||||||
env:
|
|
||||||
GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
|
|
||||||
GH_AW_GITHUB_ACTOR: ${{ github.actor }}
|
|
||||||
GH_AW_GITHUB_EVENT_COMMENT_ID: ${{ github.event.comment.id }}
|
|
||||||
GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER: ${{ github.event.discussion.number }}
|
|
||||||
GH_AW_GITHUB_EVENT_ISSUE_NUMBER: ${{ github.event.issue.number }}
|
|
||||||
GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER: ${{ github.event.pull_request.number }}
|
|
||||||
GH_AW_GITHUB_REPOSITORY: ${{ github.repository }}
|
|
||||||
GH_AW_GITHUB_RUN_ID: ${{ github.run_id }}
|
|
||||||
GH_AW_GITHUB_WORKSPACE: ${{ github.workspace }}
|
|
||||||
with:
|
with:
|
||||||
script: |
|
name: prompt
|
||||||
const substitutePlaceholders = require('/opt/gh-aw/actions/substitute_placeholders.cjs');
|
path: /tmp/gh-aw/aw-prompts
|
||||||
|
|
||||||
// Call the substitution function
|
|
||||||
return await substitutePlaceholders({
|
|
||||||
file: process.env.GH_AW_PROMPT,
|
|
||||||
substitutions: {
|
|
||||||
GH_AW_GITHUB_ACTOR: process.env.GH_AW_GITHUB_ACTOR,
|
|
||||||
GH_AW_GITHUB_EVENT_COMMENT_ID: process.env.GH_AW_GITHUB_EVENT_COMMENT_ID,
|
|
||||||
GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER: process.env.GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER,
|
|
||||||
GH_AW_GITHUB_EVENT_ISSUE_NUMBER: process.env.GH_AW_GITHUB_EVENT_ISSUE_NUMBER,
|
|
||||||
GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER: process.env.GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER,
|
|
||||||
GH_AW_GITHUB_REPOSITORY: process.env.GH_AW_GITHUB_REPOSITORY,
|
|
||||||
GH_AW_GITHUB_RUN_ID: process.env.GH_AW_GITHUB_RUN_ID,
|
|
||||||
GH_AW_GITHUB_WORKSPACE: process.env.GH_AW_GITHUB_WORKSPACE
|
|
||||||
}
|
|
||||||
});
|
|
||||||
- name: Interpolate variables and render templates
|
|
||||||
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
|
|
||||||
env:
|
|
||||||
GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
|
|
||||||
GH_AW_GITHUB_REPOSITORY: ${{ github.repository }}
|
|
||||||
GH_AW_GITHUB_WORKSPACE: ${{ github.workspace }}
|
|
||||||
with:
|
|
||||||
script: |
|
|
||||||
const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
|
|
||||||
setupGlobals(core, github, context, exec, io);
|
|
||||||
const { main } = require('/opt/gh-aw/actions/interpolate_prompt.cjs');
|
|
||||||
await main();
|
|
||||||
- name: Validate prompt placeholders
|
|
||||||
env:
|
|
||||||
GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
|
|
||||||
run: bash /opt/gh-aw/actions/validate_prompt_placeholders.sh
|
|
||||||
- name: Print prompt
|
|
||||||
env:
|
|
||||||
GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
|
|
||||||
run: bash /opt/gh-aw/actions/print_prompt_summary.sh
|
|
||||||
- name: Clean git credentials
|
- name: Clean git credentials
|
||||||
run: bash /opt/gh-aw/actions/clean_git_credentials.sh
|
run: bash /opt/gh-aw/actions/clean_git_credentials.sh
|
||||||
- name: Execute GitHub Copilot CLI
|
- name: Execute GitHub Copilot CLI
|
||||||
|
|
@ -628,7 +650,7 @@ jobs:
|
||||||
timeout-minutes: 45
|
timeout-minutes: 45
|
||||||
run: |
|
run: |
|
||||||
set -o pipefail
|
set -o pipefail
|
||||||
sudo -E awf --env-all --container-workdir "${GITHUB_WORKSPACE}" --allow-domains '*.pythonhosted.org,anaconda.org,api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,binstar.org,bootstrap.pypa.io,conda.anaconda.org,conda.binstar.org,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,files.pythonhosted.org,github.com,host.docker.internal,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,pip.pypa.io,ppa.launchpad.net,pypi.org,pypi.python.org,raw.githubusercontent.com,registry.npmjs.org,repo.anaconda.com,repo.continuum.io,s.symcb.com,s.symcd.com,security.ubuntu.com,telemetry.enterprise.githubcopilot.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com' --log-level info --proxy-logs-dir /tmp/gh-aw/sandbox/firewall/logs --enable-host-access --image-tag 0.18.0 --skip-pull \
|
sudo -E awf --env-all --container-workdir "${GITHUB_WORKSPACE}" --allow-domains '*.pythonhosted.org,anaconda.org,api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,binstar.org,bootstrap.pypa.io,conda.anaconda.org,conda.binstar.org,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,files.pythonhosted.org,github.com,host.docker.internal,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,pip.pypa.io,ppa.launchpad.net,pypi.org,pypi.python.org,raw.githubusercontent.com,registry.npmjs.org,repo.anaconda.com,repo.continuum.io,s.symcb.com,s.symcd.com,security.ubuntu.com,telemetry.enterprise.githubcopilot.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com' --log-level info --proxy-logs-dir /tmp/gh-aw/sandbox/firewall/logs --enable-host-access --image-tag 0.19.1 --skip-pull \
|
||||||
-- /bin/bash -c '/usr/local/bin/copilot --add-dir /tmp/gh-aw/ --log-level all --log-dir /tmp/gh-aw/sandbox/agent/logs/ --add-dir "${GITHUB_WORKSPACE}" --disable-builtin-mcps --allow-all-tools --allow-all-paths --share /tmp/gh-aw/sandbox/agent/logs/conversation.md --prompt "$(cat /tmp/gh-aw/aw-prompts/prompt.txt)"${GH_AW_MODEL_AGENT_COPILOT:+ --model "$GH_AW_MODEL_AGENT_COPILOT"}' 2>&1 | tee -a /tmp/gh-aw/agent-stdio.log
|
-- /bin/bash -c '/usr/local/bin/copilot --add-dir /tmp/gh-aw/ --log-level all --log-dir /tmp/gh-aw/sandbox/agent/logs/ --add-dir "${GITHUB_WORKSPACE}" --disable-builtin-mcps --allow-all-tools --allow-all-paths --share /tmp/gh-aw/sandbox/agent/logs/conversation.md --prompt "$(cat /tmp/gh-aw/aw-prompts/prompt.txt)"${GH_AW_MODEL_AGENT_COPILOT:+ --model "$GH_AW_MODEL_AGENT_COPILOT"}' 2>&1 | tee -a /tmp/gh-aw/agent-stdio.log
|
||||||
env:
|
env:
|
||||||
COPILOT_AGENT_RUNNER_TYPE: STANDALONE
|
COPILOT_AGENT_RUNNER_TYPE: STANDALONE
|
||||||
|
|
@ -696,7 +718,7 @@ jobs:
|
||||||
SECRET_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
SECRET_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||||
- name: Upload Safe Outputs
|
- name: Upload Safe Outputs
|
||||||
if: always()
|
if: always()
|
||||||
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
|
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
|
||||||
with:
|
with:
|
||||||
name: safe-output
|
name: safe-output
|
||||||
path: ${{ env.GH_AW_SAFE_OUTPUTS }}
|
path: ${{ env.GH_AW_SAFE_OUTPUTS }}
|
||||||
|
|
@ -718,13 +740,13 @@ jobs:
|
||||||
await main();
|
await main();
|
||||||
- name: Upload sanitized agent output
|
- name: Upload sanitized agent output
|
||||||
if: always() && env.GH_AW_AGENT_OUTPUT
|
if: always() && env.GH_AW_AGENT_OUTPUT
|
||||||
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
|
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
|
||||||
with:
|
with:
|
||||||
name: agent-output
|
name: agent-output
|
||||||
path: ${{ env.GH_AW_AGENT_OUTPUT }}
|
path: ${{ env.GH_AW_AGENT_OUTPUT }}
|
||||||
if-no-files-found: warn
|
if-no-files-found: warn
|
||||||
- name: Upload engine output files
|
- name: Upload engine output files
|
||||||
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
|
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
|
||||||
with:
|
with:
|
||||||
name: agent_outputs
|
name: agent_outputs
|
||||||
path: |
|
path: |
|
||||||
|
|
@ -769,7 +791,7 @@ jobs:
|
||||||
- name: Upload agent artifacts
|
- name: Upload agent artifacts
|
||||||
if: always()
|
if: always()
|
||||||
continue-on-error: true
|
continue-on-error: true
|
||||||
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
|
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
|
||||||
with:
|
with:
|
||||||
name: agent-artifacts
|
name: agent-artifacts
|
||||||
path: |
|
path: |
|
||||||
|
|
@ -798,12 +820,12 @@ jobs:
|
||||||
total_count: ${{ steps.missing_tool.outputs.total_count }}
|
total_count: ${{ steps.missing_tool.outputs.total_count }}
|
||||||
steps:
|
steps:
|
||||||
- name: Setup Scripts
|
- name: Setup Scripts
|
||||||
uses: github/gh-aw/actions/setup@v0.45.1
|
uses: github/gh-aw/actions/setup@v0.45.3
|
||||||
with:
|
with:
|
||||||
destination: /opt/gh-aw/actions
|
destination: /opt/gh-aw/actions
|
||||||
- name: Download agent output artifact
|
- name: Download agent output artifact
|
||||||
continue-on-error: true
|
continue-on-error: true
|
||||||
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
|
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
|
||||||
with:
|
with:
|
||||||
name: agent-output
|
name: agent-output
|
||||||
path: /tmp/gh-aw/safeoutputs/
|
path: /tmp/gh-aw/safeoutputs/
|
||||||
|
|
@ -891,18 +913,18 @@ jobs:
|
||||||
success: ${{ steps.parse_results.outputs.success }}
|
success: ${{ steps.parse_results.outputs.success }}
|
||||||
steps:
|
steps:
|
||||||
- name: Setup Scripts
|
- name: Setup Scripts
|
||||||
uses: github/gh-aw/actions/setup@v0.45.1
|
uses: github/gh-aw/actions/setup@v0.45.3
|
||||||
with:
|
with:
|
||||||
destination: /opt/gh-aw/actions
|
destination: /opt/gh-aw/actions
|
||||||
- name: Download agent artifacts
|
- name: Download agent artifacts
|
||||||
continue-on-error: true
|
continue-on-error: true
|
||||||
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
|
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
|
||||||
with:
|
with:
|
||||||
name: agent-artifacts
|
name: agent-artifacts
|
||||||
path: /tmp/gh-aw/threat-detection/
|
path: /tmp/gh-aw/threat-detection/
|
||||||
- name: Download agent output artifact
|
- name: Download agent output artifact
|
||||||
continue-on-error: true
|
continue-on-error: true
|
||||||
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
|
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
|
||||||
with:
|
with:
|
||||||
name: agent-output
|
name: agent-output
|
||||||
path: /tmp/gh-aw/threat-detection/
|
path: /tmp/gh-aw/threat-detection/
|
||||||
|
|
@ -974,7 +996,7 @@ jobs:
|
||||||
await main();
|
await main();
|
||||||
- name: Upload threat detection log
|
- name: Upload threat detection log
|
||||||
if: always()
|
if: always()
|
||||||
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
|
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
|
||||||
with:
|
with:
|
||||||
name: threat-detection.log
|
name: threat-detection.log
|
||||||
path: /tmp/gh-aw/threat-detection/detection.log
|
path: /tmp/gh-aw/threat-detection/detection.log
|
||||||
|
|
@ -1002,12 +1024,12 @@ jobs:
|
||||||
process_safe_outputs_temporary_id_map: ${{ steps.process_safe_outputs.outputs.temporary_id_map }}
|
process_safe_outputs_temporary_id_map: ${{ steps.process_safe_outputs.outputs.temporary_id_map }}
|
||||||
steps:
|
steps:
|
||||||
- name: Setup Scripts
|
- name: Setup Scripts
|
||||||
uses: github/gh-aw/actions/setup@v0.45.1
|
uses: github/gh-aw/actions/setup@v0.45.3
|
||||||
with:
|
with:
|
||||||
destination: /opt/gh-aw/actions
|
destination: /opt/gh-aw/actions
|
||||||
- name: Download agent output artifact
|
- name: Download agent output artifact
|
||||||
continue-on-error: true
|
continue-on-error: true
|
||||||
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
|
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
|
||||||
with:
|
with:
|
||||||
name: agent-output
|
name: agent-output
|
||||||
path: /tmp/gh-aw/safeoutputs/
|
path: /tmp/gh-aw/safeoutputs/
|
||||||
|
|
|
||||||
1
.github/workflows/a3-python.md
vendored
1
.github/workflows/a3-python.md
vendored
|
|
@ -36,7 +36,6 @@ You are an expert Python code analyst using the a3-python tool to identify bugs
|
||||||
## Current Context
|
## Current Context
|
||||||
|
|
||||||
- **Repository**: ${{ github.repository }}
|
- **Repository**: ${{ github.repository }}
|
||||||
- **Analysis Date**: $(date +%Y-%m-%d)
|
|
||||||
- **Workspace**: ${{ github.workspace }}
|
- **Workspace**: ${{ github.workspace }}
|
||||||
|
|
||||||
## Phase 1: Install and Setup a3-python
|
## Phase 1: Install and Setup a3-python
|
||||||
|
|
|
||||||
Loading…
Add table
Add a link
Reference in a new issue