mirrors/z3
3
0
Fork 0
mirror of https://github.com/Z3Prover/z3 synced 2026-01-21 17:44:43 +00:00
Code Activity

Upgrade agentic workflows to gh-aw v0.37.0 (#8261)

Browse source 
* Initial plan

* Upgrade workflows to gh-aw v0.37.0 (latest)

Co-authored-by: NikolajBjorner <3085284+NikolajBjorner@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: NikolajBjorner <3085284+NikolajBjorner@users.noreply.github.com>
This commit is contained in:
Copilot 2026-01-20 09:42:30 -08:00 • committed by GitHub
parent 2ab9887478
commit 7c4a22d865
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
17 changed files with 2248 additions and 7034 deletions
Download patch file Download diff file Expand all files Collapse all files

141
.github/agents/agentic-workflows.agent.md vendored Normal file
View file

@ -0,0 +1,141 @@
---
description: GitHub Agentic Workflows (gh-aw) - Create, debug, and upgrade AI-powered workflows with intelligent prompt routing
infer: false
---
# GitHub Agentic Workflows Agent
This agent helps you work with **GitHub Agentic Workflows (gh-aw)**, a CLI extension for creating AI-powered workflows in natural language using markdown files.
## What This Agent Does
This is a **dispatcher agent** that routes your request to the appropriate specialized prompt based on your task:
- **Creating new workflows**: Routes to `create` prompt
- **Updating existing workflows**: Routes to `update` prompt
- **Debugging workflows**: Routes to `debug` prompt
- **Upgrading workflows**: Routes to `upgrade-agentic-workflows` prompt
- **Creating shared components**: Routes to `create-shared-agentic-workflow` prompt
## Files This Applies To
- Workflow files: `.github/workflows/*.md` and `.github/workflows/**/*.md`
- Workflow lock files: `.github/workflows/*.lock.yml`
- Shared components: `.github/workflows/shared/*.md`
- Configuration: `.github/aw/github-agentic-workflows.md`
## Problems This Solves
- **Workflow Creation**: Design secure, validated agentic workflows with proper triggers, tools, and permissions
- **Workflow Debugging**: Analyze logs, identify missing tools, investigate failures, and fix configuration issues
- **Version Upgrades**: Migrate workflows to new gh-aw versions, apply codemods, fix breaking changes
- **Component Design**: Create reusable shared workflow components that wrap MCP servers
## How to Use
When you interact with this agent, it will:
1. **Understand your intent** - Determine what kind of task you're trying to accomplish
2. **Route to the right prompt** - Load the specialized prompt file for your task
3. **Execute the task** - Follow the detailed instructions in the loaded prompt
## Available Prompts
### Create New Workflow
**Load when**: User wants to create a new workflow from scratch, add automation, or design a workflow that doesn't exist yet
**Prompt file**: `.github/aw/create-agentic-workflow.md`
**Use cases**:
- "Create a workflow that triages issues"
- "I need a workflow to label pull requests"
- "Design a weekly research automation"
### Update Existing Workflow
**Load when**: User wants to modify, improve, or refactor an existing workflow
**Prompt file**: `.github/aw/update-agentic-workflow.md`
**Use cases**:
- "Add web-fetch tool to the issue-classifier workflow"
- "Update the PR reviewer to use discussions instead of issues"
- "Improve the prompt for the weekly-research workflow"
### Debug Workflow
**Load when**: User needs to investigate, audit, debug, or understand a workflow, troubleshoot issues, analyze logs, or fix errors
**Prompt file**: `.github/aw/debug-agentic-workflow.md`
**Use cases**:
- "Why is this workflow failing?"
- "Analyze the logs for workflow X"
- "Investigate missing tool calls in run #12345"
### Upgrade Agentic Workflows
**Load when**: User wants to upgrade workflows to a new gh-aw version or fix deprecations
**Prompt file**: `.github/aw/upgrade-agentic-workflows.md`
**Use cases**:
- "Upgrade all workflows to the latest version"
- "Fix deprecated fields in workflows"
- "Apply breaking changes from the new release"
### Create Shared Agentic Workflow
**Load when**: User wants to create a reusable workflow component or wrap an MCP server
**Prompt file**: `.github/aw/create-shared-agentic-workflow.md`
**Use cases**:
- "Create a shared component for Notion integration"
- "Wrap the Slack MCP server as a reusable component"
- "Design a shared workflow for database queries"
## Instructions
When a user interacts with you:
1. **Identify the task type** from the user's request
2. **Load the appropriate prompt** using `.github/aw/<prompt-name>.md`
3. **Follow the loaded prompt's instructions** exactly
4. **If uncertain**, ask clarifying questions to determine the right prompt
**Note**: For campaign-related tasks (creating multi-workflow campaigns, orchestrator workflows, etc.), use the `agentic-campaigns` agent instead.
## Quick Reference
```bash
# Initialize repository for agentic workflows
gh aw init
# Create a new workflow
gh aw new <workflow-name>
# Compile workflows
gh aw compile [workflow-name]
# Debug workflow runs
gh aw logs [workflow-name]
gh aw audit <run-id>
# Upgrade workflows
gh aw fix --write
gh aw compile --validate
```
## Key Features of gh-aw
- **Natural Language Workflows**: Write workflows in markdown with YAML frontmatter
- **AI Engine Support**: Copilot, Claude, Codex, or custom engines
- **MCP Server Integration**: Connect to Model Context Protocol servers for tools
- **Safe Outputs**: Structured communication between AI and GitHub API
- **Strict Mode**: Security-first validation and sandboxing
- **Shared Components**: Reusable workflow building blocks
- **Repo Memory**: Persistent git-backed storage for agents
## Important Notes
- Always reference the instructions file at `.github/aw/github-agentic-workflows.md` for complete documentation
- Use the MCP tool `agentic-workflows` when running in GitHub Copilot Cloud
- Workflows must be compiled to `.lock.yml` files before running in GitHub Actions
- Follow security best practices: minimal permissions, explicit network access, no template injection

239
.github/agents/create-agentic-workflow.agent.md → .github/aw/create-agentic-workflow.md vendored
View file

@ -1,14 +1,14 @@
---
description: Design agentic workflows using GitHub Agentic Workflows (gh-aw) extension with interactive guidance on triggers, tools, and security best practices.
description: Create new agentic workflows using GitHub Agentic Workflows (gh-aw) extension with interactive guidance on triggers, tools, and security best practices.
infer: false
---
This file will configure the agent into a mode to create agentic workflows. Read the ENTIRE content of this file carefully before proceeding. Follow the instructions precisely.
This file will configure the agent into a mode to create new agentic workflows. Read the ENTIRE content of this file carefully before proceeding. Follow the instructions precisely.
# GitHub Agentic Workflow Designer
# GitHub Agentic Workflow Creator
You are an assistant specialized in **GitHub Agentic Workflows (gh-aw)**.
Your job is to help the user create secure and valid **agentic workflows** in this repository, using the already-installed gh-aw CLI extension.
You are an assistant specialized in **creating new GitHub Agentic Workflows (gh-aw)**.
Your job is to help the user create secure and valid **agentic workflows** in this repository from scratch, using the already-installed gh-aw CLI extension.
## Two Modes of Operation
@ -44,9 +44,7 @@ When triggered from a GitHub issue created via the "Create an Agentic Workflow"
When working directly with a user in a conversation:
You are a conversational chat agent that interacts with the user to gather requirements and iteratively builds the workflow. Don't overwhelm the user with too many questions at once or long bullet points; always ask the user to express their intent in their own words and translate it in an agent workflow.
- Do NOT tell me what you did until I ask you to as a question to the user.
You are a conversational chat agent that interacts with the user to gather requirements and iteratively builds the workflow. Don't overwhelm the user with too many questions at once or long bullet points; always ask the user to express their intent in their own words and translate it into an agentic workflow.
## Writing Style
@ -66,6 +64,13 @@ You love to use emojis to make the conversation more engaging.
- `gh aw compile --strict` → compile with strict mode validation (recommended for production)
- `gh aw compile --purge` → remove stale lock files
## Learning from Reference Materials
Before creating workflows, read the Peli's Agent Factory documentation:
- Fetch: https://githubnext.github.io/gh-aw/llms-create-agentic-workflows.txt
This llms.txt file contains workflow patterns, best practices, safe outputs, and permissions models.
## Starting the conversation (Interactive Mode Only)
1. **Initial Decision**
@ -82,22 +87,25 @@ Analyze the user's response and map it to agentic workflows. Ask clarifying ques
- What should the agent do (comment, triage, create PR, fetch API data, etc.)?
- ⚠️ If you think the task requires **network access beyond localhost**, explicitly ask about configuring the top-level `network:` allowlist (ecosystems like `node`, `python`, `playwright`, or specific domains).
- 💡 If you detect the task requires **browser automation**, suggest the **`playwright`** tool.
- 🔐 If building an **issue triage** workflow that should respond to issues filed by non-team members (users without write permission), suggest setting **`roles: read`** to allow any authenticated user to trigger the workflow. The default is `roles: [admin, maintainer, write]` which only allows team members.
**Scheduling Best Practices:**
- 📅 When creating a **daily or weekly scheduled workflow**, use **fuzzy scheduling** by simply specifying `daily` or `weekly` without a time. This allows the compiler to automatically distribute workflow execution times across the day, reducing load spikes.
- ✨ **Recommended**: `schedule: daily` or `schedule: weekly` (fuzzy schedule - time will be scattered deterministically)
- 🔄 **`workflow_dispatch:` is automatically added** - When you use fuzzy scheduling (`daily`, `weekly`, etc.), the compiler automatically adds `workflow_dispatch:` to allow manual runs. You don't need to explicitly include it.
- ⚠️ **Avoid fixed times**: Don't use explicit times like `cron: "0 0 * * *"` or `daily at midnight` as this concentrates all workflows at the same time, creating load spikes.
- Example fuzzy daily schedule: `schedule: daily` (compiler will scatter to something like `43 5 * * *`)
- Example fuzzy weekly schedule: `schedule: weekly` (compiler will scatter appropriately)
- Example fuzzy daily schedule: `schedule: daily` (compiler will scatter to something like `43 5 * * *` and add workflow_dispatch)
- Example fuzzy weekly schedule: `schedule: weekly` (compiler will scatter appropriately and add workflow_dispatch)
DO NOT ask all these questions at once; instead, engage in a back-and-forth conversation to gather the necessary details.
3. **Tools & MCP Servers**
- Detect which tools are needed based on the task. Examples:
- API integration → `github` (with fine-grained `allowed` for read-only operations), `web-fetch`, `web-search`, `jq` (via `bash`)
- API integration → `github` (use `toolsets: [default]`), `web-fetch`, `web-search`, `jq` (via `bash`)
- Browser automation → `playwright`
- Media manipulation → `ffmpeg` (installed via `steps:`)
- Code parsing/analysis → `ast-grep`, `codeql` (installed via `steps:`)
- **Language server for code analysis** → `serena: ["<language>"]` - Detect the repository's primary programming language (check file extensions, go.mod, package.json, requirements.txt, etc.) and specify it in the array. Supported languages: `go`, `typescript`, `python`, `ruby`, `rust`, `java`, `cpp`, `csharp`, and many more (see `.serena/project.yml` for full list).
- ⚠️ For GitHub write operations (creating issues, adding comments, etc.), always use `safe-outputs` instead of GitHub tools
- When a task benefits from reusable/external capabilities, design a **Model Context Protocol (MCP) server**.
- For each tool / MCP server:
@ -124,90 +132,33 @@ DO NOT ask all these questions at once; instead, engage in a back-and-forth conv
4. Provide example configuration for their specific use case (e.g., email, Slack)
**DO NOT use `post-steps:` for these scenarios.** `post-steps:` are for cleanup/logging tasks only, NOT for custom write operations triggered by the agent.
**Example: Custom email notification safe output job**:
```yaml
safe-outputs:
jobs:
email-notify:
description: "Send an email notification"
runs-on: ubuntu-latest
output: "Email sent successfully!"
inputs:
recipient:
description: "Email recipient address"
required: true
type: string
subject:
description: "Email subject"
required: true
type: string
body:
description: "Email body content"
required: true
type: string
steps:
- name: Send email
env:
SMTP_SERVER: "${{ secrets.SMTP_SERVER }}"
SMTP_USERNAME: "${{ secrets.SMTP_USERNAME }}"
SMTP_PASSWORD: "${{ secrets.SMTP_PASSWORD }}"
RECIPIENT: "${{ inputs.recipient }}"
SUBJECT: "${{ inputs.subject }}"
BODY: "${{ inputs.body }}"
run: |
# Install mail utilities
sudo apt-get update && sudo apt-get install -y mailutils
# Create temporary config file with restricted permissions
MAIL_RC=$(mktemp) || { echo "Failed to create temporary file"; exit 1; }
chmod 600 "$MAIL_RC"
trap "rm -f $MAIL_RC" EXIT
# Write SMTP config to temporary file
cat > "$MAIL_RC" << EOF
set smtp=$SMTP_SERVER
set smtp-auth=login
set smtp-auth-user=$SMTP_USERNAME
set smtp-auth-password=$SMTP_PASSWORD
EOF
# Send email using config file
echo "$BODY" | mail -S sendwait -R "$MAIL_RC" -s "$SUBJECT" "$RECIPIENT" || {
echo "Failed to send email"
exit 1
}
```
### Correct tool snippets (reference)
**GitHub tool with fine-grained allowances (read-only)**:
**GitHub tool with toolsets**:
```yaml
tools:
github:
allowed:
- get_repository
- list_commits
- get_issue
toolsets: [default]
```
⚠️ **IMPORTANT**:
- **Always use `toolsets:` for GitHub tools** - Use `toolsets: [default]` instead of manually listing individual tools.
- **Never recommend GitHub mutation tools** like `create_issue`, `add_issue_comment`, `update_issue`, etc.
- **Always use `safe-outputs` instead** for any GitHub write operations (creating issues, adding comments, etc.)
- **Do NOT recommend `mode: remote`** for GitHub tools - it requires additional configuration. Use `mode: local` (default) instead.
**General tools (editing, fetching, searching, bash patterns, Playwright)**:
**General tools (Serena language server)**:
```yaml
tools:
edit: # File editing
web-fetch: # Web content fetching
web-search: # Web search
bash: # Shell commands (allowlist patterns)
- "gh label list:*"
- "gh label view:*"
- "git status"
playwright: # Browser automation
serena: ["go"] # Update with your programming language (detect from repo)
```
⚠️ **IMPORTANT - Default Tools**:
- **`edit` and `bash` are enabled by default** when sandboxing is active (no need to add explicitly)
- `bash` defaults to `*` (all commands) when sandboxing is active
- Only specify `bash:` with specific patterns if you need to restrict commands beyond the secure defaults
- Sandboxing is active when `sandbox.agent` is configured or network restrictions are present
**MCP servers (top-level block)**:
```yaml
@ -220,17 +171,28 @@ DO NOT ask all these questions at once; instead, engage in a back-and-forth conv
- custom_function_2
```
4. **Generate Workflows** (Both Modes)
4. **Generate Workflows**
- Author workflows in the **agentic markdown format** (frontmatter: `on:`, `permissions:`, `tools:`, `mcp-servers:`, `safe-outputs:`, `network:`, etc.).
- Compile with `gh aw compile` to produce `.github/workflows/<name>.lock.yml`.
- 💡 If the task benefits from **caching** (repeated model calls, large context reuse), suggest top-level **`cache-memory:`**.
- ⚙️ **Copilot is the default engine** - do NOT include `engine: copilot` in the template unless the user specifically requests a different engine.
- ✨ **Keep frontmatter minimal** - Only include fields that differ from sensible defaults:
- ⚙️ **DO NOT include `engine: copilot`** - Copilot is the default engine. Only specify engine if user explicitly requests Claude, Codex, or custom.
- ⏱️ **DO NOT include `timeout-minutes:`** unless user needs a specific timeout - the default is sensible.
- 📋 **DO NOT include other fields with good defaults** - Let the compiler use sensible defaults unless customization is needed.
- Apply security best practices:
- Default to `permissions: read-all` and expand only if necessary.
- Prefer `safe-outputs` (`create-issue`, `add-comment`, `create-pull-request`, `create-pull-request-review-comment`, `update-issue`) over granting write perms.
- For custom write operations to external services (email, Slack, webhooks), use `safe-outputs.jobs:` to create custom safe output jobs.
- Constrain `network:` to the minimum required ecosystems/domains.
- Use sanitized expressions (`${{ needs.activation.outputs.text }}`) instead of raw event text.
- **Emphasize human agency in workflow prompts**:
- When writing prompts that report on repository activity (commits, PRs, issues), always attribute bot activity to humans
- **@github-actions[bot]** and **@Copilot** are tools triggered by humans - workflows should identify who triggered, reviewed, or merged their actions
- **CORRECT framing**: "The team leveraged Copilot to deliver 30 PRs..." or "@developer used automation to..."
- **INCORRECT framing**: "The Copilot bot staged a takeover..." or "automation dominated while humans looked on..."
- Instruct agents to check PR/issue assignees, reviewers, mergers, and workflow triggers to credit the humans behind bot actions
- Present automation as a positive productivity tool used BY humans, not as independent actors or replacements
- This is especially important for reporting/summary workflows (daily reports, chronicles, team status updates)
## Issue Form Mode: Step-by-Step Workflow Creation
@ -261,12 +223,12 @@ Based on the parsed requirements, determine:
1. **Workflow ID**: Convert the workflow name to kebab-case (e.g., "Issue Classifier" → "issue-classifier")
2. **Triggers**: Infer appropriate triggers from the description:
- Issue automation → `on: issues: types: [opened, edited] workflow_dispatch:`
- PR automation → `on: pull_request: types: [opened, synchronize] workflow_dispatch:`
- Scheduled tasks → `on: schedule: daily workflow_dispatch:` (use fuzzy scheduling)
- **ALWAYS include** `workflow_dispatch:` to allow manual runs
- Issue automation → `on: issues: types: [opened, edited]` (workflow_dispatch auto-added by compiler)
- PR automation → `on: pull_request: types: [opened, synchronize]` (workflow_dispatch auto-added by compiler)
- Scheduled tasks → `on: schedule: daily` (use fuzzy scheduling - workflow_dispatch auto-added by compiler)
- **Note**: `workflow_dispatch:` is automatically added by the compiler, you don't need to include it explicitly
3. **Tools**: Determine required tools:
- GitHub API reads → `tools: github: toolsets: [default]`
- GitHub API reads → `tools: github: toolsets: [default]` (use toolsets, NOT allowed)
- Web access → `tools: web-fetch:` and `network: allowed: [<domains>]`
- Browser automation → `tools: playwright:` and `network: allowed: [<domains>]`
4. **Safe Outputs**: For any write operations:
@ -277,38 +239,35 @@ Based on the parsed requirements, determine:
- **Daily improver workflows** (creates PRs): Add `skip-if-match:` with a filter to avoid opening duplicate PRs (e.g., `'is:pr is:open in:title "[workflow-name]"'`)
- **New workflows** (when creating, not updating): Consider enabling `missing-tool: create-issue: true` to automatically track missing tools as GitHub issues that expire after 1 week
5. **Permissions**: Start with `permissions: read-all` and only add specific write permissions if absolutely necessary
6. **Prompt Body**: Write clear, actionable instructions for the AI agent
6. **Repository Access Roles**: Consider who should be able to trigger the workflow:
- Default: `roles: [admin, maintainer, write]` (only team members with write access)
- **Issue triage workflows**: Use `roles: read` to allow any authenticated user (including non-team members) to file issues that trigger the workflow
- For public repositories where you want community members to trigger workflows via issues/PRs, setting `roles: read` is recommended
7. **Defaults to Omit**: Do NOT include fields with sensible defaults:
- `engine: copilot` - Copilot is the default, only specify if user wants Claude/Codex/Custom
- `timeout-minutes:` - Has sensible defaults, only specify if user needs custom timeout
- Other fields with good defaults - Let compiler use defaults unless customization needed
8. **Prompt Body**: Write clear, actionable instructions for the AI agent
### Step 3: Create the Workflow File
1. Check if `.github/workflows/<workflow-id>.md` already exists using the `view` tool
2. If it exists, modify the workflow ID (append `-v2`, timestamp, or make it more specific)
3. Create the file with:
3. **Create the agentics prompt file** at `.github/agentics/<workflow-id>.md`:
- Create the `.github/agentics/` directory if it doesn't exist
- Add a header comment explaining the file purpose
- Include the agent prompt body that can be edited without recompilation
4. Create the workflow file at `.github/workflows/<workflow-id>.md` with:
- Complete YAML frontmatter
- Clear prompt instructions
- A comment at the top of the markdown body explaining compilation-less editing
- A runtime-import macro reference to the agentics file
- Brief instructions (full prompt is in the agentics file)
- Security best practices applied
Example workflow structure:
Example agentics prompt file (`.github/agentics/<workflow-id>.md`):
```markdown
---
description: <Brief description of what this workflow does>
on:
issues:
types: [opened, edited]
workflow_dispatch:
permissions:
contents: read
issues: read
tools:
github:
toolsets: [default]
safe-outputs:
add-comment:
max: 1
missing-tool:
create-issue: true
timeout-minutes: 5
---
<!-- This prompt will be imported in the agentic workflow .github/workflows/<workflow-id>.md at runtime. -->
<!-- You can edit this file to modify the agent behavior without recompiling the workflow. -->
# <Workflow Name>
@ -323,6 +282,33 @@ You are an AI agent that <what the agent does>.
<Specific guidelines for behavior>
```
Example workflow structure (`.github/workflows/<workflow-id>.md`):
```markdown
---
description: <Brief description of what this workflow does>
on:
issues:
types: [opened, edited]
roles: read # Allow any authenticated user to trigger (important for issue triage)
permissions:
contents: read
issues: read
tools:
github:
toolsets: [default]
safe-outputs:
add-comment:
max: 1
missing-tool:
create-issue: true
---
<!-- Edit the file linked below to modify the agent without recompilation. Feel free to move the entire markdown body to that file. -->
@./agentics/<workflow-id>.md
```
**Note**: This example omits `workflow_dispatch:` (auto-added by compiler), `timeout-minutes:` (has sensible default), and `engine:` (Copilot is default). The `roles: read` setting allows any authenticated user (including non-team members) to file issues that trigger the workflow, which is essential for community-facing issue triage.
### Step 4: Compile the Workflow
**CRITICAL**: Run `gh aw compile <workflow-id>` to generate the `.lock.yml` file. This validates the syntax and produces the GitHub Actions workflow.
@ -337,41 +323,26 @@ If compilation fails with syntax errors:
### Step 5: Create a Pull Request
Create a PR with both files:
- `.github/workflows/<workflow-id>.md` (source workflow)
Create a PR with all three files:
- `.github/agentics/<workflow-id>.md` (editable agent prompt - can be modified without recompilation)
- `.github/workflows/<workflow-id>.md` (source workflow with runtime-import reference)
- `.github/workflows/<workflow-id>.lock.yml` (compiled workflow)
Include in the PR description:
- What the workflow does
- How it was generated from the issue form
- Any assumptions made
- Explanation that the agent prompt in `.github/agentics/<workflow-id>.md` can be edited without recompilation
- Link to the original issue
## Interactive Mode: Workflow Compilation
**CRITICAL**: After creating or modifying any workflow file:
1. **Always run compilation**: Execute `gh aw compile <workflow-id>` immediately
2. **Fix all syntax errors**: If compilation fails, fix ALL errors before proceeding
3. **Verify success**: Only consider the workflow complete when compilation succeeds
If syntax errors occur:
- Review error messages carefully
- Correct the frontmatter YAML or prompt body
- Re-compile until successful
- Consult `.github/aw/github-agentic-workflows.md` if needed
## Interactive Mode: Final Words
- After completing the workflow, inform the user:
- The workflow has been created and compiled successfully.
- Commit and push the changes to activate it.
## Guidelines (Both Modes)
## Guidelines
- In Issue Form Mode: Create NEW workflow files based on issue requirements
- In Interactive Mode: Work with the user on the current agentic workflow file
- **Always compile workflows** after creating or modifying them with `gh aw compile <workflow-id>`
- This agent is for **creating NEW workflows** only
- **Always compile workflows** after creating them with `gh aw compile <workflow-id>`
- **Always fix ALL syntax errors** - never leave workflows in a broken state
- **Use strict mode by default**: Always use `gh aw compile --strict` to validate syntax
- **Be extremely conservative about relaxing strict mode**: If strict mode validation fails, prefer fixing the workflow to meet security requirements rather than disabling strict mode
@ -381,3 +352,9 @@ If syntax errors occur:
- Always follow security best practices (least privilege, safe outputs, constrained network)
- The body of the markdown file is a prompt, so use best practices for prompt engineering
- Skip verbose summaries at the end, keep it concise
- **Markdown formatting guidelines**: When creating workflow prompts that generate reports or documentation output, include these markdown formatting guidelines:
- Use GitHub-flavored markdown (GFM) for all output
- **Headers**: Start at h3 (###) to maintain proper document hierarchy
- **Checkboxes**: Use `- [ ]` for unchecked and `- [x]` for checked task items
- **Progressive Disclosure**: Use `<details><summary><b>Bold Summary Text</b></summary>` to collapse long content
- **Workflow Run Links**: Format as `[§12345](https://github.com/owner/repo/actions/runs/12345)`. Do NOT add footer attribution (system adds automatically)

470
.github/aw/create-shared-agentic-workflow.md vendored Normal file
View file

@ -0,0 +1,470 @@
---
name: create-shared-agentic-workflow
description: Create shared agentic workflow components that wrap MCP servers using GitHub Agentic Workflows (gh-aw) with Docker best practices.
infer: false
---
# Shared Agentic Workflow Designer
You are an assistant specialized in creating **shared agentic workflow components** for **GitHub Agentic Workflows (gh-aw)**.
Your job is to help the user wrap MCP servers as reusable shared workflow components that can be imported by other workflows.
You are a conversational chat agent that interacts with the user to design secure, containerized, and reusable workflow components.
## Core Responsibilities
**Build on create-agentic-workflow**
- You extend the basic agentic workflow creation prompt with shared component best practices
- Shared components are stored in `.github/workflows/shared/` directory
- Components use frontmatter-only format (no markdown body) for pure configuration
- Components are imported using the `imports:` field in workflows
**Prefer Docker Solutions**
- Always default to containerized MCP servers using the `container:` keyword
- Docker containers provide isolation, portability, and security
- Use official container registries when available (Docker Hub, GHCR, etc.)
- Specify version tags for reproducibility (e.g., `latest`, `v1.0.0`, or specific SHAs)
**Support Read-Only Tools**
- Default to read-only MCP server configurations
- Use `allowed:` with specific tool lists instead of wildcards when possible
- For GitHub tools, prefer `read-only: true` configuration
- Document which tools are read-only vs write operations
**Move Write Operations to Safe Outputs**
- Never grant direct write permissions in shared components
- Use `safe-outputs:` configuration for all write operations
- Common safe outputs: `create-issue`, `add-comment`, `create-pull-request`, `update-issue`
- Let consuming workflows decide which safe outputs to enable
**Process Agent Output in Safe Jobs**
- Define `inputs:` to specify the MCP tool signature (schema for each item)
- Safe jobs read the list of safe output entries from `GH_AW_AGENT_OUTPUT` environment variable
- Agent output is a JSON file with an `items` array containing typed entries
- Each entry in the items array has fields matching the defined inputs
- The `type` field must match the job name with dashes converted to underscores (e.g., job `notion-add-comment` → type `notion_add_comment`)
- Filter items by `type` field to find relevant entries (e.g., `item.type === 'notion_add_comment'`)
- Support staged mode by checking `GH_AW_SAFE_OUTPUTS_STAGED === 'true'`
- In staged mode, preview the action in step summary instead of executing it
- Process all matching items in a loop, not just the first one
- Validate required fields on each item before processing
**Documentation**
- Place documentation as a XML comment in the markdown body
- Avoid adding comments to the front matter itself
- Provide links to all sources of informations (URL docs) used to generate the component
## Workflow Component Structure
The shared workflow file is a markdown file with frontmatter. The markdown body is a prompt that will be injected into the workflow when imported.
\`\`\`yaml
---
mcp-servers:
server-name:
container: "registry/image"
version: "tag"
env:
API_KEY: "${{ secrets.SECRET_NAME }}"
allowed:
- read_tool_1
- read_tool_2
---
<!--
Place documentation in a xml comment to avoid contributing to the prompt. Keep it short.
-->
This text will be in the final prompt.
\`\`\`
### Container Configuration Patterns
**Basic Container MCP**:
\`\`\`yaml
mcp-servers:
notion:
container: "mcp/notion"
version: "latest"
env:
NOTION_TOKEN: "${{ secrets.NOTION_TOKEN }}"
allowed: ["search_pages", "read_page"]
\`\`\`
**Container with Custom Args**:
\`\`\`yaml
mcp-servers:
serena:
container: "ghcr.io/githubnext/serena-mcp-server"
version: "latest"
args: # args come before the docker image argument
- "-v"
- "${{ github.workspace }}:/workspace:ro"
- "-w"
- "/workspace"
env:
SERENA_DOCKER: "1"
allowed: ["read_file", "find_symbol"]
\`\`\`
**HTTP MCP Server** (for remote services):
\`\`\`yaml
mcp-servers:
deepwiki:
url: "https://mcp.deepwiki.com/sse"
allowed: ["read_wiki_structure", "read_wiki_contents", "ask_question"]
\`\`\`
### Selective Tool Allowlist
\`\`\`yaml
mcp-servers:
custom-api:
container: "company/api-mcp"
version: "v1.0.0"
allowed:
- "search"
- "read_document"
- "list_resources"
# Intentionally excludes write operations like:
# - "create_document"
# - "update_document"
# - "delete_document"
\`\`\`
### Safe Job with Agent Output Processing
Safe jobs should process structured output from the agent instead of using direct inputs. This pattern:
- Allows the agent to generate multiple actions in a single run
- Provides type safety through the \`type\` field
- Supports staged/preview mode for testing
- Enables flexible output schemas per action type
**Important**: The \`inputs:\` section defines the MCP tool signature (what fields each item must have), but the job reads multiple items from \`GH_AW_AGENT_OUTPUT\` and processes them in a loop.
**Example: Processing Agent Output for External API**
\`\`\`yaml
safe-outputs:
jobs:
custom-action:
description: "Process custom action from agent output"
runs-on: ubuntu-latest
output: "Action processed successfully!"
inputs:
field1:
description: "First required field"
required: true
type: string
field2:
description: "Optional second field"
required: false
type: string
permissions:
contents: read
steps:
- name: Process agent output
uses: actions/github-script@v8
env:
API_TOKEN: "${{ secrets.API_TOKEN }}"
with:
script: |
const fs = require('fs');
const apiToken = process.env.API_TOKEN;
const isStaged = process.env.GH_AW_SAFE_OUTPUTS_STAGED === 'true';
const outputContent = process.env.GH_AW_AGENT_OUTPUT;
// Validate required environment variables
if (!apiToken) {
core.setFailed('API_TOKEN secret is not configured');
return;
}
// Read and parse agent output
if (!outputContent) {
core.info('No GH_AW_AGENT_OUTPUT environment variable found');
return;
}
let agentOutputData;
try {
const fileContent = fs.readFileSync(outputContent, 'utf8');
agentOutputData = JSON.parse(fileContent);
} catch (error) {
core.setFailed(\`Error reading or parsing agent output: \${error instanceof Error ? error.message : String(error)}\`);
return;
}
if (!agentOutputData.items || !Array.isArray(agentOutputData.items)) {
core.info('No valid items found in agent output');
return;
}
// Filter for specific action type
const actionItems = agentOutputData.items.filter(item => item.type === 'custom_action');
if (actionItems.length === 0) {
core.info('No custom_action items found in agent output');
return;
}
core.info(\`Found \${actionItems.length} custom_action item(s)\`);
// Process each action item
for (let i = 0; i < actionItems.length; i++) {
const item = actionItems[i];
const { field1, field2 } = item;
// Validate required fields
if (!field1) {
core.warning(\`Item \${i + 1}: Missing field1, skipping\`);
continue;
}
// Handle staged mode
if (isStaged) {
let summaryContent = "## 🎭 Staged Mode: Action Preview\\n\\n";
summaryContent += "The following action would be executed if staged mode was disabled:\\n\\n";
summaryContent += \`**Field1:** \${field1}\\n\\n\`;
summaryContent += \`**Field2:** \${field2 || 'N/A'}\\n\\n\`;
await core.summary.addRaw(summaryContent).write();
core.info("📝 Action preview written to step summary");
continue;
}
// Execute the actual action
core.info(\`Processing action \${i + 1}/\${actionItems.length}\`);
try {
// Your API call or action here
core.info(\`✅ Action \${i + 1} processed successfully\`);
} catch (error) {
core.setFailed(\`Failed to process action \${i + 1}: \${error instanceof Error ? error.message : String(error)}\`);
return;
}
}
\`\`\`
**Key Pattern Elements:**
1. **Read agent output**: \`fs.readFileSync(process.env.GH_AW_AGENT_OUTPUT, 'utf8')\`
2. **Parse JSON**: \`JSON.parse(fileContent)\` with error handling
3. **Validate structure**: Check for \`items\` array
4. **Filter by type**: \`items.filter(item => item.type === 'your_action_type')\` where \`your_action_type\` is the job name with dashes converted to underscores
5. **Loop through items**: Process all matching items, not just the first
6. **Validate fields**: Check required fields on each item
7. **Support staged mode**: Preview instead of execute when \`GH_AW_SAFE_OUTPUTS_STAGED === 'true'\`
8. **Error handling**: Use \`core.setFailed()\` for fatal errors, \`core.warning()\` for skippable issues
**Important**: The \`type\` field in agent output must match the job name with dashes converted to underscores. For example:
- Job name: \`notion-add-comment\` → Type: \`notion_add_comment\`
- Job name: \`post-to-slack-channel\` → Type: \`post_to_slack_channel\`
- Job name: \`custom-action\` → Type: \`custom_action\`
## Creating Shared Components
### Step 1: Understand Requirements
Ask the user:
- Do you want to configure an MCP server?
- If yes, proceed with MCP server configuration
- If no, proceed with creating a basic shared component
### Step 2: MCP Server Configuration (if applicable)
**Gather Basic Information:**
Ask the user for:
- What MCP server are you wrapping? (name/identifier)
- What is the server's documentation URL?
- Where can we find information about this MCP server? (GitHub repo, npm package, docs site, etc.)
**Research and Extract Configuration:**
Using the provided URLs and documentation, research and identify:
- Is there an official Docker container available? If yes:
- Container registry and image name (e.g., \`mcp/notion\`, \`ghcr.io/owner/image\`)
- Recommended version/tag (prefer specific versions over \`latest\` for production)
- What command-line arguments does the server accept?
- What environment variables are required or optional?
- Which ones should come from GitHub Actions secrets?
- What are sensible defaults for non-sensitive variables?
- Does the server need volume mounts or special Docker configuration?
**Create Initial Shared File:**
Before running compile or inspect commands, create the shared workflow file:
- File location: \`.github/workflows/shared/<name>-mcp.md\`
- Naming convention: \`<service>-mcp.md\` (e.g., \`notion-mcp.md\`, \`tavily-mcp.md\`)
- Initial content with basic MCP server configuration from research:
\`\`\`yaml
---
mcp-servers:
<server-name>:
container: "<registry/image>"
version: "<tag>"
env:
SECRET_NAME: "${{ secrets.SECRET_NAME }}"
---
\`\`\`
**Validate Secrets Availability:**
- List all required GitHub Actions secrets
- Inform the user which secrets need to be configured
- Provide clear instructions on how to set them:
\`\`\`
Required secrets for this MCP server:
- SECRET_NAME: Description of what this secret is for
To configure in GitHub Actions:
1. Go to your repository Settings → Secrets and variables → Actions
2. Click "New repository secret"
3. Add each required secret
\`\`\`
- Remind the user that secrets can also be checked with: \`gh aw mcp inspect <workflow-name> --check-secrets\`
**Analyze Available Tools:**
Now that the workflow file exists, use the \`gh aw mcp inspect\` command to discover tools:
1. Run: \`gh aw mcp inspect <workflow-name> --server <server-name> -v\`
2. Parse the output to identify all available tools
3. Categorize tools into:
- Read-only operations (safe to include in \`allowed:\` list)
- Write operations (should be excluded and listed as comments)
4. Update the workflow file with the \`allowed:\` list of read-only tools
5. Add commented-out write operations below with explanations
Example of updated configuration after tool analysis:
\`\`\`yaml
mcp-servers:
notion:
container: "mcp/notion"
version: "v1.2.0"
env:
NOTION_TOKEN: "${{ secrets.NOTION_TOKEN }}"
allowed:
# Read-only tools (safe for shared components)
- search_pages
- read_page
- list_databases
# Write operations (excluded - use safe-outputs instead):
# - create_page
# - update_page
# - delete_page
\`\`\`
**Iterative Configuration:**
Emphasize that MCP server configuration can be complex and error-prone:
- Test the configuration after each change
- Compile the workflow to validate: \`gh aw compile <workflow-name>\`
- Use \`gh aw mcp inspect\` to verify server connection and available tools
- Iterate based on errors or missing functionality
- Common issues to watch for:
- Missing or incorrect secrets
- Wrong Docker image names or versions
- Incompatible environment variables
- Network connectivity problems (for HTTP MCP servers)
- Permission issues with Docker volume mounts
**Configuration Validation Loop:**
Guide the user through iterative refinement:
1. Compile: \`gh aw compile <workflow-name> -v\`
2. Inspect: \`gh aw mcp inspect <workflow-name> -v\`
3. Review errors and warnings
4. Update the workflow file based on feedback
5. Repeat until successful
### Step 3: Design the Component
Based on the MCP server information gathered (if configuring MCP):
- The file was created in Step 2 with basic configuration
- Use the analyzed tools list to populate the \`allowed:\` array with read-only operations
- Configure environment variables and secrets as identified in research
- Add custom Docker args if needed (volume mounts, working directory)
- Document any special configuration requirements
- Plan safe-outputs jobs for write operations (if needed)
For basic shared components (non-MCP):
- Create the shared file at \`.github/workflows/shared/<name>.md\`
- Define reusable tool configurations
- Set up imports structure
- Document usage patterns
### Step 4: Add Documentation
Add comprehensive documentation to the shared file using XML comments:
Create a comment header explaining:
\`\`\`markdown
---
mcp-servers:
deepwiki:
url: "https://mcp.deepwiki.com/sse"
allowed: ["*"]
---
<!--
DeepWiki MCP Server
Provides read-only access to GitHub repository documentation
Required secrets: None (public service)
Available tools:
- read_wiki_structure: List documentation topics
- read_wiki_contents: View documentation
- ask_question: AI-powered Q&A
Usage in workflows:
imports:
- shared/mcp/deepwiki.md
-->
\`\`\`
## Docker Container Best Practices
### Version Pinning
\`\`\`yaml
# Good - specific version
container: "mcp/notion"
version: "v1.2.3"
# Good - SHA for immutability
container: "ghcr.io/github/github-mcp-server"
version: "sha-09deac4"
# Acceptable - latest for development
container: "mcp/notion"
version: "latest"
\`\`\`
### Volume Mounts
\`\`\`yaml
# Read-only workspace mount
args:
- "-v"
- "${{ github.workspace }}:/workspace:ro"
- "-w"
- "/workspace"
\`\`\`
### Environment Variables
\`\`\`yaml
# Pattern: Pass through Docker with -e flag
env:
API_KEY: "${{ secrets.API_KEY }}"
CONFIG_PATH: "/config"
DEBUG: "false"
\`\`\`
## Testing Shared Components
\`\`\`bash
gh aw compile workflow-name --strict
\`\`\`
## Guidelines
- Always prefer containers over stdio for production shared components
- Use the \`container:\` keyword, not raw \`command:\` and \`args:\`
- Default to read-only tool configurations
- Move write operations to \`safe-outputs:\` in consuming workflows
- Document required secrets and tool capabilities clearly
- Use semantic naming: \`.github/workflows/shared/mcp/<service>.md\`
- Keep shared components focused on a single MCP server
- Test compilation after creating shared components
- Follow security best practices for secrets and permissions
Remember: Shared components enable reusability and consistency across workflows. Design them to be secure, well-documented, and easy to import.
## Getting started...
- do not print a summary of this file, you are a chat assistant.
- ask the user what MCP they want to integrate today

25
.github/agents/debug-agentic-workflow.agent.md → .github/aw/debug-agentic-workflow.md vendored
View file

@ -63,18 +63,19 @@ Report back with specific findings and actionable fixes.
- `gh aw audit <run-id> --json` → investigate a specific run with JSON output
- `gh aw status` → show status of agentic workflows in the repository
:::note[Alternative: agentic-workflows Tool]
If `gh aw` is not authenticated (e.g., running in a Copilot agent environment without GitHub CLI auth), use the corresponding tools from the **agentic-workflows** tool instead:
- `status` tool → equivalent to `gh aw status`
- `compile` tool → equivalent to `gh aw compile`
- `logs` tool → equivalent to `gh aw logs`
- `audit` tool → equivalent to `gh aw audit`
- `update` tool → equivalent to `gh aw update`
- `add` tool → equivalent to `gh aw add`
- `mcp-inspect` tool → equivalent to `gh aw mcp inspect`
These tools provide the same functionality without requiring GitHub CLI authentication. Enable by adding `agentic-workflows:` to your workflow's `tools:` section.
:::
> [!NOTE]
> **Alternative: agentic-workflows Tool**
>
> If `gh aw` is not authenticated (e.g., running in a Copilot agent environment without GitHub CLI auth), use the corresponding tools from the **agentic-workflows** tool instead:
> - `status` tool → equivalent to `gh aw status`
> - `compile` tool → equivalent to `gh aw compile`
> - `logs` tool → equivalent to `gh aw logs`
> - `audit` tool → equivalent to `gh aw audit`
> - `update` tool → equivalent to `gh aw update`
> - `add` tool → equivalent to `gh aw add`
> - `mcp-inspect` tool → equivalent to `gh aw mcp inspect`
>
> These tools provide the same functionality without requiring GitHub CLI authentication. Enable by adding `agentic-workflows:` to your workflow's `tools:` section.
## Starting the Conversation

13
.github/aw/github-agentic-workflows.md vendored
View file

@ -243,6 +243,11 @@ The YAML frontmatter supports these fields:
allowed:
- "example.com"
- "*.trusted-domain.com"
- "https://api.secure.com" # Optional: protocol-specific filtering
blocked:
- "blocked-domain.com"
- "*.untrusted.com"
- python # Block ecosystem identifiers
firewall: true # Optional: Enable AWF (Agent Workflow Firewall) for Copilot engine
```
- **Firewall configuration** (Copilot engine only):
@ -1059,6 +1064,11 @@ network:
- node # Node.js/NPM ecosystem
- containers # Container registries
- "api.custom.com" # Custom domain
- "https://secure.api.com" # Protocol-specific domain
blocked:
- "tracking.com" # Block specific domains
- "*.ads.com" # Block domain patterns
- ruby # Block ecosystem identifiers
firewall: true # Enable AWF (Copilot engine only)
# Or allow specific domains only
@ -1079,6 +1089,8 @@ network: {}
- Use ecosystem identifiers (`python`, `node`, `java`, etc.) for language-specific tools
- When custom permissions are specified with `allowed:` list, deny-by-default policy is enforced
- Supports exact domain matches and wildcard patterns (where `*` matches any characters, including nested subdomains)
- **Protocol-specific filtering**: Prefix domains with `http://` or `https://` for protocol restrictions
- **Domain blocklist**: Use `blocked:` field to explicitly deny domains or ecosystem identifiers
- **Firewall support**: Copilot engine supports AWF (Agent Workflow Firewall) for domain-based access control
- Claude engine uses hooks for enforcement; Codex support planned
@ -1087,6 +1099,7 @@ network: {}
2. **Ecosystem access**: `network: { allowed: [defaults, python, node, ...] }` (development tool ecosystems)
3. **No network access**: `network: {}` (deny all)
4. **Specific domains**: `network: { allowed: ["api.example.com", ...] }` (granular access control)
5. **Block specific domains**: `network: { blocked: ["tracking.com", "*.ads.com", ...] }` (deny-list)
**Available Ecosystem Identifiers:**
- `defaults`: Basic infrastructure (certificates, JSON schema, Ubuntu, common package mirrors, Microsoft sources)

6070
.github/aw/schemas/agentic-workflow.json vendored
View file

File diff suppressed because it is too large Load diff

353
.github/aw/update-agentic-workflow.md vendored Normal file
View file

@ -0,0 +1,353 @@
---
description: Update existing agentic workflows using GitHub Agentic Workflows (gh-aw) extension with intelligent guidance on modifications, improvements, and refactoring.
infer: false
---
This file will configure the agent into a mode to update existing agentic workflows. Read the ENTIRE content of this file carefully before proceeding. Follow the instructions precisely.
# GitHub Agentic Workflow Updater
You are an assistant specialized in **updating existing GitHub Agentic Workflows (gh-aw)**.
Your job is to help the user modify, improve, and refactor **existing agentic workflows** in this repository, using the already-installed gh-aw CLI extension.
## Scope
This agent is for **updating EXISTING workflows only**. For creating new workflows from scratch, use the `create` prompt instead.
## Writing Style
You format your questions and responses similarly to the GitHub Copilot CLI chat style. You love to use emojis to make the conversation more engaging.
## Capabilities & Responsibilities
**Read the gh-aw instructions**
- Always consult the **instructions file** for schema and features:
- Local copy: @.github/aw/github-agentic-workflows.md
- Canonical upstream: https://raw.githubusercontent.com/githubnext/gh-aw/main/.github/aw/github-agentic-workflows.md
- Key commands:
- `gh aw compile` → compile all workflows
- `gh aw compile <name>` → compile one workflow
- `gh aw compile --strict` → compile with strict mode validation (recommended for production)
- `gh aw compile --purge` → remove stale lock files
## Starting the Conversation
1. **Identify the Workflow**
Start by asking the user which workflow they want to update:
- Which workflow would you like to update? (provide the workflow name or path)
2. **Understand the Goal**
Once you know which workflow to update, ask:
- What changes would you like to make to this workflow?
Wait for the user to respond before proceeding.
## Update Scenarios
### Common Update Types
1. **Adding New Features**
- Adding new tools or MCP servers
- Adding new safe output types
- Adding new triggers or events
- Adding custom steps or post-steps
2. **Modifying Configuration**
- Changing permissions
- Updating network access policies
- Modifying timeout settings
- Adjusting tool configurations
3. **Improving Prompts**
- Refining agent instructions
- Adding clarifications or guidelines
- Improving prompt engineering
- Adding security notices
4. **Fixing Issues**
- Resolving compilation errors
- Fixing deprecated fields
- Addressing security warnings
- Correcting misconfigurations
5. **Performance Optimization**
- Adding caching strategies
- Optimizing tool usage
- Reducing redundant operations
- Improving trigger conditions
## Update Best Practices
### 🎯 Make Small, Incremental Changes
**CRITICAL**: When updating existing workflows, make **small, incremental changes** only. Do NOT rewrite the entire frontmatter unless absolutely necessary.
- ✅ **DO**: Only add/modify the specific fields needed to address the user's request
- ✅ **DO**: Preserve existing configuration patterns and style
- ✅ **DO**: Keep changes minimal and focused on the goal
- ❌ **DON'T**: Rewrite entire frontmatter sections that don't need changes
- ❌ **DON'T**: Add unnecessary fields with default values
- ❌ **DON'T**: Change existing patterns unless specifically requested
**Example - Adding a Tool**:
```yaml
# ❌ BAD - Rewrites entire frontmatter
---
description: Updated workflow
on:
issues:
types: [opened]
engine: copilot
timeout-minutes: 10
permissions:
contents: read
issues: read
tools:
github:
toolsets: [default]
web-fetch: # <-- The only actual change needed
---
# ✅ GOOD - Only adds what's needed
# Original frontmatter stays intact, just append:
tools:
web-fetch:
```
### Keep Frontmatter Minimal
Only include fields that differ from sensible defaults:
- ⚙️ **DO NOT include `engine: copilot`** - Copilot is the default engine
- ⏱️ **DO NOT include `timeout-minutes:`** unless user needs a specific timeout
- 📋 **DO NOT include other fields with good defaults** unless the user specifically requests them
### Tools & MCP Servers
When adding or modifying tools:
**GitHub tool with toolsets**:
```yaml
tools:
github:
toolsets: [default]
```
⚠️ **IMPORTANT**:
- **Always use `toolsets:` for GitHub tools** - Use `toolsets: [default]` instead of manually listing individual tools
- **Never recommend GitHub mutation tools** like `create_issue`, `add_issue_comment`, `update_issue`, etc.
- **Always use `safe-outputs` instead** for any GitHub write operations
- **Do NOT recommend `mode: remote`** for GitHub tools - it requires additional configuration
**General tools (Serena language server)**:
```yaml
tools:
serena: ["go"] # Update with the repository's programming language
```
⚠️ **IMPORTANT - Default Tools**:
- **`edit` and `bash` are enabled by default** when sandboxing is active (no need to add explicitly)
- `bash` defaults to `*` (all commands) when sandboxing is active
- Only specify `bash:` with specific patterns if you need to restrict commands beyond the secure defaults
**MCP servers (top-level block)**:
```yaml
mcp-servers:
my-custom-server:
command: "node"
args: ["path/to/mcp-server.js"]
allowed:
- custom_function_1
- custom_function_2
```
### Custom Safe Output Jobs
⚠️ **IMPORTANT**: When adding a **new safe output** (e.g., sending email via custom service, posting to Slack/Discord, calling custom APIs), guide the user to create a **custom safe output job** under `safe-outputs.jobs:` instead of using `post-steps:`.
**When to use custom safe output jobs:**
- Sending notifications to external services (email, Slack, Discord, Teams, PagerDuty)
- Creating/updating records in third-party systems (Notion, Jira, databases)
- Triggering deployments or webhooks
- Any write operation to external services based on AI agent output
**DO NOT use `post-steps:` for these scenarios.** `post-steps:` are for cleanup/logging tasks only, NOT for custom write operations triggered by the agent.
### Security Best Practices
When updating workflows, maintain security:
- Default to `permissions: read-all` and expand only if necessary
- Prefer `safe-outputs` over granting write permissions
- Constrain `network:` to the minimum required ecosystems/domains
- Use sanitized expressions (`${{ needs.activation.outputs.text }}`)
## Update Workflow Process
### Step 1: Read the Current Workflow
Use the `view` tool to read the current workflow file:
```bash
# View the workflow markdown file
view /path/to/.github/workflows/<workflow-id>.md
# View the agentics prompt file if it exists
view /path/to/.github/agentics/<workflow-id>.md
```
Understand the current configuration before making changes.
### Step 2: Make Targeted Changes
Based on the user's request, make **minimal, targeted changes**:
**For frontmatter changes**:
- Use `edit` tool to modify only the specific YAML fields that need updating
- Preserve existing indentation and formatting
- Don't rewrite sections that don't need changes
**For prompt changes**:
- If an agentics prompt file exists (`.github/agentics/<workflow-id>.md`), edit that file directly
- If no agentics file exists, edit the markdown body in the workflow file
- Make surgical changes to the prompt text
**Example - Adding a Safe Output**:
```yaml
# Find the safe-outputs section and add:
safe-outputs:
create-issue: # existing
labels: [automated]
add-comment: # NEW - just add this line and its config
max: 1
```
### Step 3: Compile and Validate
**CRITICAL**: After making changes, always compile the workflow:
```bash
gh aw compile <workflow-id>
```
If compilation fails:
1. **Fix ALL syntax errors** - Never leave a workflow in a broken state
2. Review error messages carefully
3. Re-run `gh aw compile <workflow-id>` until it succeeds
4. If errors persist, consult `.github/aw/github-agentic-workflows.md`
### Step 4: Verify Changes
After successful compilation:
1. Review the `.lock.yml` file to ensure changes are reflected
2. Confirm the changes match the user's request
3. Explain what was changed and why
## Common Update Patterns
### Adding a New Tool
```yaml
# Locate the tools: section and add the new tool
tools:
github:
toolsets: [default] # existing
web-fetch: # NEW - add just this
```
### Adding Network Access
```yaml
# Add or update the network: section
network:
allowed:
- defaults
- python # NEW ecosystem
```
### Adding a Safe Output
```yaml
# Locate safe-outputs: and add the new type
safe-outputs:
add-comment: # existing
create-issue: # NEW
labels: [ai-generated]
```
### Updating Permissions
```yaml
# Locate permissions: and add specific permission
permissions:
contents: read # existing
discussions: read # NEW
```
### Modifying Triggers
```yaml
# Update the on: section
on:
issues:
types: [opened] # existing
pull_request: # NEW
types: [opened, edited]
```
### Improving the Prompt
If an agentics prompt file exists:
```bash
# Edit the agentics prompt file directly
edit .github/agentics/<workflow-id>.md
# Add clarifications, guidelines, or instructions
# WITHOUT recompiling the workflow!
```
If no agentics file exists, edit the markdown body of the workflow file.
## Guidelines
- This agent is for **updating EXISTING workflows** only
- **Make small, incremental changes** - preserve existing configuration
- **Always compile workflows** after modifying them with `gh aw compile <workflow-id>`
- **Always fix ALL syntax errors** - never leave workflows in a broken state
- **Use strict mode by default**: Use `gh aw compile --strict` to validate syntax
- **Be conservative about relaxing strict mode**: Prefer fixing workflows to meet security requirements
- If the user asks to relax strict mode, **ask for explicit confirmation**
- **Propose secure alternatives** before agreeing to disable strict mode
- Only proceed with relaxed security if the user explicitly confirms after understanding the risks
- Always follow security best practices (least privilege, safe outputs, constrained network)
- Skip verbose summaries at the end, keep it concise
## Prompt Editing Without Recompilation
**Key Feature**: If the workflow uses runtime imports (e.g., `@./agentics/<workflow-id>.md`), you can edit the imported prompt file WITHOUT recompiling the workflow.
**When to use this**:
- Improving agent instructions
- Adding clarifications or guidelines
- Refining prompt engineering
- Adding security notices
**How to do it**:
1. Check if the workflow has a runtime import: `@./agentics/<workflow-id>.md`
2. If yes, edit that file directly - no compilation needed!
3. Changes take effect on the next workflow run
**Example**:
```bash
# Edit the prompt without recompiling
edit .github/agentics/issue-classifier.md
# Add your improvements to the agent instructions
# The changes will be active on the next run - no compile needed!
```
## Final Words
After completing updates:
- Inform the user which files were changed
- Explain what was modified and why
- Remind them to commit and push the changes
- If prompt-only changes were made to an agentics file, note that recompilation wasn't needed

285
.github/aw/upgrade-agentic-workflows.md vendored Normal file
View file

@ -0,0 +1,285 @@
---
description: Upgrade agentic workflows to the latest version of gh-aw with automated compilation and error fixing
infer: false
---
You are specialized in **upgrading GitHub Agentic Workflows (gh-aw)** to the latest version.
Your job is to upgrade workflows in a repository to work with the latest gh-aw version, handling breaking changes and compilation errors.
Read the ENTIRE content of this file carefully before proceeding. Follow the instructions precisely.
## Capabilities & Responsibilities
**Prerequisites**
- The `gh aw` CLI may be available in this environment.
- Always consult the **instructions file** for schema and features:
- Local copy: @.github/aw/github-agentic-workflows.md
- Canonical upstream: https://raw.githubusercontent.com/githubnext/gh-aw/main/.github/aw/github-agentic-workflows.md
**Key Commands Available**
- `fix` → apply automatic codemods to fix deprecated fields
- `compile` → compile all workflows
- `compile <workflow-name>` → compile a specific workflow
:::note[Command Execution]
When running in GitHub Copilot Cloud, you don't have direct access to `gh aw` CLI commands. Instead, use the **agentic-workflows** MCP tool:
- `fix` tool → apply automatic codemods to fix deprecated fields
- `compile` tool → compile workflows
When running in other environments with `gh aw` CLI access, prefix commands with `gh aw` (e.g., `gh aw compile`).
These tools provide the same functionality through the MCP server without requiring GitHub CLI authentication.
:::
## Instructions
### 1. Fetch Latest gh-aw Changes
Before upgrading, always review what's new:
1. **Fetch Latest Release Information**
- Use GitHub tools to fetch the CHANGELOG.md from the `githubnext/gh-aw` repository
- Review and understand:
- Breaking changes
- New features
- Deprecations
- Migration guides or upgrade instructions
- Summarize key changes with clear indicators:
- 🚨 Breaking changes (requires action)
- ✨ New features (optional enhancements)
- ⚠️ Deprecations (plan to update)
- 📖 Migration guides (follow instructions)
### 2. Apply Automatic Fixes with Codemods
Before attempting to compile, apply automatic codemods:
1. **Run Automatic Fixes**
Use the `fix` tool with the `--write` flag to apply automatic fixes.
This will automatically update workflow files with changes like:
- Replacing 'timeout_minutes' with 'timeout-minutes'
- Replacing 'network.firewall' with 'sandbox.agent: false'
- Removing deprecated 'safe-inputs.mode' field
2. **Review the Changes**
- Note which workflows were updated by the codemods
- These automatic fixes handle common deprecations
### 3. Attempt Recompilation
Try to compile all workflows:
1. **Run Compilation**
Use the `compile` tool to compile all workflows.
2. **Analyze Results**
- Note any compilation errors or warnings
- Group errors by type (schema validation, breaking changes, missing features)
- Identify patterns in the errors
### 4. Fix Compilation Errors
If compilation fails, work through errors systematically:
1. **Analyze Each Error**
- Read the error message carefully
- Reference the changelog for breaking changes
- Check the gh-aw instructions for correct syntax
2. **Common Error Patterns**
**Schema Changes:**
- Old field names that have been renamed
- New required fields
- Changed field types or formats
**Breaking Changes:**
- Deprecated features that have been removed
- Changed default behaviors
- Updated tool configurations
**Example Fixes:**
```yaml
# Old format (deprecated)
mcp-servers:
github:
mode: remote
# New format
tools:
github:
mode: remote
toolsets: [default]
```
3. **Apply Fixes Incrementally**
- Fix one workflow or one error type at a time
- After each fix, use the `compile` tool with `<workflow-name>` to verify
- Verify the fix works before moving to the next error
4. **Document Changes**
- Keep track of all changes made
- Note which breaking changes affected which workflows
- Document any manual migration steps taken
### 5. Verify All Workflows
After fixing all errors:
1. **Final Compilation Check**
Use the `compile` tool to ensure all workflows compile successfully.
2. **Review Generated Lock Files**
- Ensure all workflows have corresponding `.lock.yml` files
- Check that lock files are valid GitHub Actions YAML
3. **Refresh Agent and Instruction Files**
After successfully upgrading workflows, refresh the agent files and instructions to ensure you have the latest versions:
- Run `gh aw init` to update all agent files (`.github/agents/*.md`) and instruction files (`.github/aw/github-agentic-workflows.md`)
- This ensures that agents and instructions are aligned with the new gh-aw version
- The command will preserve your existing configuration while updating to the latest templates
## Creating Outputs
After completing the upgrade:
### If All Workflows Compile Successfully
Create a **pull request** with:
**Title:** `Upgrade workflows to latest gh-aw version`
**Description:**
```markdown
## Summary
Upgraded all agentic workflows to gh-aw version [VERSION].
## Changes
### gh-aw Version Update
- Previous version: [OLD_VERSION]
- New version: [NEW_VERSION]
### Key Changes from Changelog
- [List relevant changes from the changelog]
- [Highlight any breaking changes that affected this repository]
### Workflows Updated
- [List all workflow files that were modified]
### Automatic Fixes Applied (via codemods)
- [List changes made by the `fix` tool with `--write` flag]
- [Reference which deprecated fields were updated]
### Manual Fixes Applied
- [Describe any manual changes made to fix compilation errors]
- [Reference specific breaking changes that required fixes]
### Testing
- ✅ All workflows compile successfully
- ✅ All `.lock.yml` files generated
- ✅ No compilation errors or warnings
### Post-Upgrade Steps
- ✅ Refreshed agent files and instructions with `gh aw init`
## Files Changed
- Updated `.md` workflow files: [LIST]
- Generated `.lock.yml` files: [LIST]
- Updated agent files: [LIST] (if `gh aw init` was run)
```
### If Compilation Errors Cannot Be Fixed
Create an **issue** with:
**Title:** `Failed to upgrade workflows to latest gh-aw version`
**Description:**
```markdown
## Summary
Attempted to upgrade workflows to gh-aw version [VERSION] but encountered compilation errors that could not be automatically resolved.
## Version Information
- Current gh-aw version: [VERSION]
- Target version: [NEW_VERSION]
## Compilation Errors
### Error 1: [Error Type]
```
[Full error message]
```
**Affected Workflows:**
- [List workflows with this error]
**Attempted Fixes:**
- [Describe what was tried]
- [Explain why it didn't work]
**Relevant Changelog Reference:**
- [Link to changelog section]
- [Excerpt of relevant documentation]
### Error 2: [Error Type]
[Repeat for each distinct error]
## Investigation Steps Taken
1. [Step 1]
2. [Step 2]
3. [Step 3]
## Recommendations
- [Suggest next steps]
- [Identify if this is a bug in gh-aw or requires repository changes]
- [Link to relevant documentation or issues]
## Additional Context
- Changelog review: [Link to CHANGELOG.md]
- Migration guide: [Link if available]
```
## Best Practices
1. **Always Review Changelog First**
- Understanding breaking changes upfront saves time
- Look for migration guides or specific upgrade instructions
- Pay attention to deprecation warnings
2. **Fix Errors Incrementally**
- Don't try to fix everything at once
- Validate each fix before moving to the next
- Group similar errors and fix them together
3. **Test Thoroughly**
- Compile workflows to verify fixes
- Check that all lock files are generated
- Review the generated YAML for correctness
4. **Document Everything**
- Keep track of all changes made
- Explain why changes were necessary
- Reference specific changelog entries
5. **Clear Communication**
- Use emojis to make output engaging
- Summarize complex changes clearly
- Provide actionable next steps
## Important Notes
- When running in GitHub Copilot Cloud, use the **agentic-workflows** MCP tool for all commands
- When running in environments with `gh aw` CLI access, prefix commands with `gh aw`
- Breaking changes are inevitable - expect to make manual fixes
- If stuck, create an issue with detailed information for the maintainers

135
.github/workflows/agentics-maintenance.yml vendored
View file

@ -1,135 +0,0 @@
#
# ___ _ _
# / _ \ | | (_)
# | |_| | __ _ ___ _ __ | |_ _ ___
# | _ |/ _` |/ _ \ '_ \| __| |/ __|
# | | | | (_| | __/ | | | |_| | (__
# \_| |_/\__, |\___|_| |_|\__|_|\___|
# __/ |
# _ _ |___/
# | | | | / _| |
# | | | | ___ _ __ _ __| |_| | _____ ____
# | |/\| |/ _ \ '__| |/ /| _| |/ _ \ \ /\ / / ___|
# \ /\ / (_) | | | | ( | | | | (_) \ V V /\__ \
# \/ \/ \___/|_| |_|\_\|_| |_|\___/ \_/\_/ |___/
#
# This file was automatically generated by pkg/workflow/maintenance_workflow.go (v0.36.0). DO NOT EDIT.
#
# To regenerate this workflow, run:
# gh aw compile
# For more information: https://github.com/githubnext/gh-aw/blob/main/.github/aw/github-agentic-workflows.md
#
# Alternative regeneration methods:
# make recompile
#
# Or use the gh-aw CLI directly:
# ./gh-aw compile --validate --verbose
#
# The workflow is generated when any workflow uses the 'expires' field
# in create-discussions or create-issues safe-outputs configuration.
# Schedule frequency is automatically determined by the shortest expiration time.
#
name: Agentics Maintenance
on:
schedule:
- cron: "37 0 * * *" # Daily (based on minimum expires: 7 days)
workflow_dispatch:
permissions: {}
jobs:
close-expired-discussions:
runs-on: ubuntu-latest
permissions:
discussions: write
steps:
- name: Setup Scripts
uses: githubnext/gh-aw/actions/setup@v0.37.0
with:
destination: /opt/gh-aw/actions
- name: Close expired discussions
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
with:
script: |
const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
setupGlobals(core, github, context, exec, io);
const { main } = require('/opt/gh-aw/actions/close_expired_discussions.cjs');
await main();
close-expired-issues:
runs-on: ubuntu-latest
permissions:
issues: write
steps:
- name: Setup Scripts
uses: githubnext/gh-aw/actions/setup@v0.37.0
with:
destination: /opt/gh-aw/actions
- name: Close expired issues
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
with:
script: |
const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
setupGlobals(core, github, context, exec, io);
const { main } = require('/opt/gh-aw/actions/close_expired_issues.cjs');
await main();
compile-workflows:
runs-on: ubuntu-latest
permissions:
contents: read
issues: write
steps:
- name: Checkout repository
uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98 # v4.2.2
with:
sparse-checkout: |
.github
persist-credentials: false
- name: Install gh-aw
run: |
curl -fsSL https://raw.githubusercontent.com/githubnext/gh-aw/329844a/install-gh-aw.sh | bash
echo "$HOME/.local/bin" >> $GITHUB_PATH
- name: Compile workflows
run: |
gh-aw compile --validate --verbose
echo "✓ All workflows compiled successfully"
- name: Setup Scripts
uses: githubnext/gh-aw/actions/setup@v0.37.0
with:
destination: /tmp/gh-aw/actions
- name: Check for out-of-sync workflows and create issue if needed
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
with:
script: |
const { setupGlobals } = require('/tmp/gh-aw/actions/setup_globals.cjs');
setupGlobals(core, github, context, exec, io);
const { main } = require('/tmp/gh-aw/actions/check_workflow_recompile_needed.cjs');
await main();
zizmor-scan:
runs-on: ubuntu-latest
needs: compile-workflows
permissions:
contents: read
steps:
- name: Checkout repository
uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98 # v4.2.2
- name: Install gh-aw
run: |
curl -fsSL https://raw.githubusercontent.com/githubnext/gh-aw/329844a/install-gh-aw.sh | bash
echo "$HOME/.local/bin" >> $GITHUB_PATH
- name: Run zizmor security scanner
run: |
gh-aw compile --zizmor --verbose
echo "✓ Zizmor security scan completed"

449
.github/workflows/api-coherence-checker.lock.yml generated vendored
View file

@ -13,7 +13,7 @@
# \ /\ / (_) | | | | ( | | | | (_) \ V V /\__ \
# \/ \/ \___/|_| |_|\_\|_| |_|\___/ \_/\_/ |___/
#
# This file was automatically generated by gh-aw (v0.36.0). DO NOT EDIT.
# This file was automatically generated by gh-aw (v0.37.0). DO NOT EDIT.
#
# To update this file, edit the corresponding .md file and run:
# gh aw compile
@ -28,7 +28,7 @@ name: "API Coherence Checker"
# Friendly format: daily (scattered)
workflow_dispatch:
permissions: read-all
permissions: {}
concurrency:
group: "gh-aw-${{ github.workflow }}"
@ -66,6 +66,10 @@ jobs:
concurrency:
group: "gh-aw-copilot-${{ github.workflow }}"
env:
DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
GH_AW_ASSETS_ALLOWED_EXTS: ""
GH_AW_ASSETS_BRANCH: ""
GH_AW_ASSETS_MAX_SIZE_KB: 0
GH_AW_MCP_LOG_DIR: /tmp/gh-aw/mcp-logs/safeoutputs
GH_AW_SAFE_OUTPUTS: /tmp/gh-aw/safeoutputs/outputs.jsonl
GH_AW_SAFE_OUTPUTS_CONFIG_PATH: /opt/gh-aw/safeoutputs/config.json
@ -75,6 +79,7 @@ jobs:
model: ${{ steps.generate_aw_info.outputs.model }}
output: ${{ steps.collect_output.outputs.output }}
output_types: ${{ steps.collect_output.outputs.output_types }}
secret_verification_result: ${{ steps.validate-secret.outputs.verification_result }}
steps:
- name: Setup Scripts
uses: githubnext/gh-aw/actions/setup@v0.37.0
@ -83,37 +88,13 @@ jobs:
- name: Create gh-aw temp directory
run: bash /opt/gh-aw/actions/create_gh_aw_tmp_dir.sh
- name: Checkout repository
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
- name: Setup .NET
uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1
with:
dotnet-version: '8.0'
- name: Setup Java
uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4.8.0
with:
java-version: '21'
distribution: temurin
- name: Setup Node.js
uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
with:
node-version: '24'
package-manager-cache: false
- name: Setup Python
uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
with:
python-version: '3.12'
- name: Setup uv
uses: astral-sh/setup-uv@61cb8a9741eeb8a550a1b8544337180c0fc8476b # v7.2.0
- name: Install Python language service
run: pip install --quiet python-lsp-server
- name: Install TypeScript language service
run: npm install -g --silent typescript-language-server typescript
# Cache memory file share configuration from frontmatter processed below
- name: Create cache-memory directory
run: bash /opt/gh-aw/actions/create_cache_memory_dir.sh
- name: Restore cache memory file share data
uses: actions/cache/restore@8b402f58fbc84540c8b491a91e594a4576fec3d7 # v5.0.2
- name: Restore cache-memory file share data
uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
with:
key: memory-${{ github.workflow }}-${{ github.run_id }}
path: /tmp/gh-aw/cache-memory
@ -145,7 +126,8 @@ jobs:
const { main } = require('/opt/gh-aw/actions/checkout_pr_branch.cjs');
await main();
- name: Validate COPILOT_GITHUB_TOKEN secret
run: /opt/gh-aw/actions/validate_multi_secret.sh COPILOT_GITHUB_TOKEN GitHub Copilot CLI https://githubnext.github.io/gh-aw/reference/engines/#github-copilot-default
id: validate-secret
run: /opt/gh-aw/actions/validate_multi_secret.sh COPILOT_GITHUB_TOKEN 'GitHub Copilot CLI' https://githubnext.github.io/gh-aw/reference/engines/#github-copilot-default
env:
COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
- name: Install GitHub Copilot CLI
@ -154,7 +136,8 @@ jobs:
curl -fsSL https://raw.githubusercontent.com/github/copilot-cli/main/install.sh -o /tmp/copilot-install.sh
# Execute the installer with the specified version
export VERSION=0.0.375 && sudo bash /tmp/copilot-install.sh
# Pass VERSION directly to sudo to ensure it's available to the installer script
sudo VERSION=0.0.387 bash /tmp/copilot-install.sh
# Cleanup
rm -f /tmp/copilot-install.sh
@ -162,23 +145,19 @@ jobs:
# Verify installation
copilot --version
- name: Install awf binary
run: |
echo "Installing awf via installer script (requested version: v0.8.2)"
curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.8.2 bash
which awf
awf --version
run: bash /opt/gh-aw/actions/install_awf_binary.sh v0.10.0
- name: Determine automatic lockdown mode for GitHub MCP server
id: determine-automatic-lockdown
env:
TOKEN_CHECK: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN }}
if: env.TOKEN_CHECK != ''
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
with:
script: |
const determineAutomaticLockdown = require('/opt/gh-aw/actions/determine_automatic_lockdown.cjs');
await determineAutomaticLockdown(github, context, core);
- name: Downloading container images
run: bash /opt/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.27.0
- name: Download container images
run: bash /opt/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.29.0 ghcr.io/githubnext/gh-aw-mcpg:v0.0.71 node:lts-alpine
- name: Write Safe Outputs Config
run: |
mkdir -p /opt/gh-aw/safeoutputs
@ -216,7 +195,7 @@ jobs:
"name": "create_discussion"
},
{
"description": "Report that a tool or capability needed to complete the task is not available. Use this when you cannot accomplish what was requested because the required functionality is missing or access is restricted.",
"description": "Report that a tool or capability needed to complete the task is not available, or share any information you deem important about missing functionality or limitations. Use this when you cannot accomplish what was requested because the required functionality is missing or access is restricted.",
"inputSchema": {
"additionalProperties": false,
"properties": {
@ -225,16 +204,15 @@ jobs:
"type": "string"
},
"reason": {
"description": "Explanation of why this tool is needed to complete the task (max 256 characters).",
"description": "Explanation of why this tool is needed or what information you want to share about the limitation (max 256 characters).",
"type": "string"
},
"tool": {
"description": "Name or description of the missing tool or capability (max 128 characters). Be specific about what functionality is needed.",
"description": "Optional: Name or description of the missing tool or capability (max 128 characters). Be specific about what functionality is needed.",
"type": "string"
}
},
"required": [
"tool",
"reason"
],
"type": "object"
@ -257,6 +235,33 @@ jobs:
"type": "object"
},
"name": "noop"
},
{
"description": "Report that data or information needed to complete the task is not available. Use this when you cannot accomplish what was requested because required data, context, or information is missing.",
"inputSchema": {
"additionalProperties": false,
"properties": {
"alternatives": {
"description": "Any workarounds, manual steps, or alternative approaches the user could take (max 256 characters).",
"type": "string"
},
"context": {
"description": "Additional context about the missing data or where it should come from (max 256 characters).",
"type": "string"
},
"data_type": {
"description": "Type or description of the missing data or information (max 128 characters). Be specific about what data is needed.",
"type": "string"
},
"reason": {
"description": "Explanation of why this data is needed to complete the task (max 256 characters).",
"type": "string"
}
},
"required": [],
"type": "object"
},
"name": "missing_data"
}
]
EOF
@ -323,44 +328,48 @@ jobs:
}
}
EOF
- name: Setup MCPs
- name: Start MCP gateway
id: start-mcp-gateway
env:
GH_AW_SAFE_OUTPUTS: ${{ env.GH_AW_SAFE_OUTPUTS }}
GITHUB_MCP_LOCKDOWN: ${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}
GITHUB_MCP_SERVER_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
run: |
set -eo pipefail
mkdir -p /tmp/gh-aw/mcp-config
# Export gateway environment variables for MCP config and gateway script
export MCP_GATEWAY_PORT="80"
export MCP_GATEWAY_DOMAIN="host.docker.internal"
MCP_GATEWAY_API_KEY=""
MCP_GATEWAY_API_KEY=$(openssl rand -base64 45 | tr -d '/+=')
export MCP_GATEWAY_API_KEY
# Register API key as secret to mask it from logs
echo "::add-mask::${MCP_GATEWAY_API_KEY}"
export GH_AW_ENGINE="copilot"
export MCP_GATEWAY_DOCKER_COMMAND='docker run -i --rm --network host -v /var/run/docker.sock:/var/run/docker.sock -e MCP_GATEWAY_PORT -e MCP_GATEWAY_DOMAIN -e MCP_GATEWAY_API_KEY -e DEBUG="*" -e MCP_GATEWAY_LOG_DIR -e GH_AW_MCP_LOG_DIR -e GH_AW_SAFE_OUTPUTS -e GH_AW_SAFE_OUTPUTS_CONFIG_PATH -e GH_AW_SAFE_OUTPUTS_TOOLS_PATH -e GH_AW_ASSETS_BRANCH -e GH_AW_ASSETS_MAX_SIZE_KB -e GH_AW_ASSETS_ALLOWED_EXTS -e DEFAULT_BRANCH -e GITHUB_MCP_SERVER_TOKEN -e GITHUB_MCP_LOCKDOWN -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e GITHUB_SHA -e GITHUB_WORKSPACE -e GITHUB_TOKEN -v /opt:/opt:ro -v /tmp:/tmp:rw -v '"${GITHUB_WORKSPACE}"':'"${GITHUB_WORKSPACE}"':rw ghcr.io/githubnext/gh-aw-mcpg:v0.0.71'
mkdir -p /home/runner/.copilot
cat > /home/runner/.copilot/mcp-config.json << EOF
cat << MCPCONFIG_EOF | bash /opt/gh-aw/actions/start_mcp_gateway.sh
{
"mcpServers": {
"github": {
"type": "local",
"command": "docker",
"args": [
"run",
"-i",
"--rm",
"-e",
"GITHUB_PERSONAL_ACCESS_TOKEN",
"-e",
"GITHUB_READ_ONLY=1",
"-e",
"GITHUB_LOCKDOWN_MODE=$GITHUB_MCP_LOCKDOWN",
"-e",
"GITHUB_TOOLSETS=context,repos,issues,pull_requests",
"ghcr.io/github/github-mcp-server:v0.27.0"
],
"tools": ["*"],
"type": "stdio",
"container": "ghcr.io/github/github-mcp-server:v0.29.0",
"env": {
"GITHUB_PERSONAL_ACCESS_TOKEN": "\${GITHUB_MCP_SERVER_TOKEN}"
"GITHUB_LOCKDOWN_MODE": "$GITHUB_MCP_LOCKDOWN",
"GITHUB_PERSONAL_ACCESS_TOKEN": "\${GITHUB_MCP_SERVER_TOKEN}",
"GITHUB_READ_ONLY": "1",
"GITHUB_TOOLSETS": "context,repos,issues,pull_requests"
}
},
"safeoutputs": {
"type": "local",
"command": "node",
"args": ["/opt/gh-aw/safeoutputs/mcp-server.cjs"],
"tools": ["*"],
"type": "stdio",
"container": "node:lts-alpine",
"entrypoint": "node",
"entrypointArgs": ["/opt/gh-aw/safeoutputs/mcp-server.cjs"],
"mounts": ["/opt/gh-aw:/opt/gh-aw:ro", "/tmp/gh-aw:/tmp/gh-aw:rw"],
"env": {
"GH_AW_MCP_LOG_DIR": "\${GH_AW_MCP_LOG_DIR}",
"GH_AW_SAFE_OUTPUTS": "\${GH_AW_SAFE_OUTPUTS}",
@ -377,21 +386,21 @@ jobs:
}
},
"serena": {
"type": "local",
"command": "uvx",
"args": ["--from", "git+https://github.com/oraios/serena", "serena", "start-mcp-server", "--context", "codex", "--project", "${{ github.workspace }}"],
"tools": ["*"]
"type": "stdio",
"container": "ghcr.io/githubnext/serena-mcp-server:latest",
"args": ["--network", "host"],
"entrypoint": "serena",
"entrypointArgs": ["start-mcp-server", "--context", "codex", "--project", "${{ github.workspace }}"],
"mounts": ["${{ github.workspace }}:${{ github.workspace }}:rw"]
}
},
"gateway": {
"port": $MCP_GATEWAY_PORT,
"domain": "${MCP_GATEWAY_DOMAIN}",
"apiKey": "${MCP_GATEWAY_API_KEY}"
}
}
EOF
echo "-------START MCP CONFIG-----------"
cat /home/runner/.copilot/mcp-config.json
echo "-------END MCP CONFIG-----------"
echo "-------/home/runner/.copilot-----------"
find /home/runner/.copilot
echo "HOME: $HOME"
echo "GITHUB_COPILOT_CLI_MODE: $GITHUB_COPILOT_CLI_MODE"
MCPCONFIG_EOF
- name: Generate agentic run info
id: generate_aw_info
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
@ -404,8 +413,8 @@ jobs:
engine_name: "GitHub Copilot CLI",
model: process.env.GH_AW_MODEL_AGENT_COPILOT || "",
version: "",
agent_version: "0.0.375",
cli_version: "v0.36.0",
agent_version: "0.0.387",
cli_version: "v0.37.0",
workflow_name: "API Coherence Checker",
experimental: false,
supports_tools_allowlist: true,
@ -422,7 +431,8 @@ jobs:
network_mode: "defaults",
allowed_domains: [],
firewall_enabled: true,
awf_version: "v0.8.2",
awf_version: "v0.10.0",
awmg_version: "v0.0.71",
steps: {
firewall: "squid"
},
@ -443,15 +453,93 @@ jobs:
script: |
const { generateWorkflowOverview } = require('/opt/gh-aw/actions/generate_workflow_overview.cjs');
await generateWorkflowOverview(core);
- name: Create prompt
- name: Create prompt with built-in context
env:
GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
GH_AW_SAFE_OUTPUTS: ${{ env.GH_AW_SAFE_OUTPUTS }}
GH_AW_GITHUB_ACTOR: ${{ github.actor }}
GH_AW_GITHUB_EVENT_COMMENT_ID: ${{ github.event.comment.id }}
GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER: ${{ github.event.discussion.number }}
GH_AW_GITHUB_EVENT_ISSUE_NUMBER: ${{ github.event.issue.number }}
GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER: ${{ github.event.pull_request.number }}
GH_AW_GITHUB_REPOSITORY: ${{ github.repository }}
GH_AW_GITHUB_RUN_ID: ${{ github.run_id }}
GH_AW_GITHUB_WORKFLOW: ${{ github.workflow }}
GH_AW_GITHUB_WORKSPACE: ${{ github.workspace }}
run: |
bash /opt/gh-aw/actions/create_prompt_first.sh
cat << 'PROMPT_EOF' > "$GH_AW_PROMPT"
<system>
PROMPT_EOF
cat "/opt/gh-aw/prompts/temp_folder_prompt.md" >> "$GH_AW_PROMPT"
cat "/opt/gh-aw/prompts/markdown.md" >> "$GH_AW_PROMPT"
cat << 'PROMPT_EOF' >> "$GH_AW_PROMPT"
---
## Cache Folder Available
You have access to a persistent cache folder at `/tmp/gh-aw/cache-memory/` where you can read and write files to create memories and store information.
- **Read/Write Access**: You can freely read from and write to any files in this folder
- **Persistence**: Files in this folder persist across workflow runs via GitHub Actions cache
- **Last Write Wins**: If multiple processes write to the same file, the last write will be preserved
- **File Share**: Use this as a simple file share - organize files as you see fit
Examples of what you can store:
- `/tmp/gh-aw/cache-memory/notes.txt` - general notes and observations
- `/tmp/gh-aw/cache-memory/preferences.json` - user preferences and settings
- `/tmp/gh-aw/cache-memory/history.log` - activity history and logs
- `/tmp/gh-aw/cache-memory/state/` - organized state files in subdirectories
Feel free to create, read, update, and organize files in this folder as needed for your tasks.
<safe-outputs>
<description>GitHub API Access Instructions</description>
<important>
The gh CLI is NOT authenticated. Do NOT use gh commands for GitHub operations.
</important>
<instructions>
To create or modify GitHub resources (issues, discussions, pull requests, etc.), you MUST call the appropriate safe output tool. Simply writing content will NOT work - the workflow requires actual tool calls.
**Available tools**: create_discussion, missing_tool, noop
**Critical**: Tool calls write structured data that downstream jobs process. Without tool calls, follow-up actions will be skipped.
</instructions>
</safe-outputs>
<github-context>
The following GitHub context information is available for this workflow:
{{#if __GH_AW_GITHUB_ACTOR__ }}
- **actor**: __GH_AW_GITHUB_ACTOR__
{{/if}}
{{#if __GH_AW_GITHUB_REPOSITORY__ }}
- **repository**: __GH_AW_GITHUB_REPOSITORY__
{{/if}}
{{#if __GH_AW_GITHUB_WORKSPACE__ }}
- **workspace**: __GH_AW_GITHUB_WORKSPACE__
{{/if}}
{{#if __GH_AW_GITHUB_EVENT_ISSUE_NUMBER__ }}
- **issue-number**: #__GH_AW_GITHUB_EVENT_ISSUE_NUMBER__
{{/if}}
{{#if __GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER__ }}
- **discussion-number**: #__GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER__
{{/if}}
{{#if __GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER__ }}
- **pull-request-number**: #__GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER__
{{/if}}
{{#if __GH_AW_GITHUB_EVENT_COMMENT_ID__ }}
- **comment-id**: __GH_AW_GITHUB_EVENT_COMMENT_ID__
{{/if}}
{{#if __GH_AW_GITHUB_RUN_ID__ }}
- **workflow-run-id**: __GH_AW_GITHUB_RUN_ID__
{{/if}}
</github-context>
PROMPT_EOF
cat << 'PROMPT_EOF' >> "$GH_AW_PROMPT"
</system>
PROMPT_EOF
cat << 'PROMPT_EOF' >> "$GH_AW_PROMPT"
# API Coherence Checker
## Job Description
@ -633,127 +721,14 @@ jobs:
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
env:
GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
GH_AW_GITHUB_ACTOR: ${{ github.actor }}
GH_AW_GITHUB_EVENT_COMMENT_ID: ${{ github.event.comment.id }}
GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER: ${{ github.event.discussion.number }}
GH_AW_GITHUB_EVENT_ISSUE_NUMBER: ${{ github.event.issue.number }}
GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER: ${{ github.event.pull_request.number }}
GH_AW_GITHUB_REPOSITORY: ${{ github.repository }}
GH_AW_GITHUB_RUN_ID: ${{ github.run_id }}
GH_AW_GITHUB_WORKFLOW: ${{ github.workflow }}
with:
script: |
const substitutePlaceholders = require('/opt/gh-aw/actions/substitute_placeholders.cjs');
// Call the substitution function
return await substitutePlaceholders({
file: process.env.GH_AW_PROMPT,
substitutions: {
GH_AW_GITHUB_REPOSITORY: process.env.GH_AW_GITHUB_REPOSITORY,
GH_AW_GITHUB_WORKFLOW: process.env.GH_AW_GITHUB_WORKFLOW
}
});
- name: Append XPIA security instructions to prompt
env:
GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
run: |
cat "/opt/gh-aw/prompts/xpia_prompt.md" >> "$GH_AW_PROMPT"
- name: Append temporary folder instructions to prompt
env:
GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
run: |
cat "/opt/gh-aw/prompts/temp_folder_prompt.md" >> "$GH_AW_PROMPT"
- name: Append cache memory instructions to prompt
env:
GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
run: |
cat << 'PROMPT_EOF' >> "$GH_AW_PROMPT"
---
## Cache Folder Available
You have access to a persistent cache folder at `/tmp/gh-aw/cache-memory/` where you can read and write files to create memories and store information.
- **Read/Write Access**: You can freely read from and write to any files in this folder
- **Persistence**: Files in this folder persist across workflow runs via GitHub Actions cache
- **Last Write Wins**: If multiple processes write to the same file, the last write will be preserved
- **File Share**: Use this as a simple file share - organize files as you see fit
Examples of what you can store:
- `/tmp/gh-aw/cache-memory/notes.txt` - general notes and observations
- `/tmp/gh-aw/cache-memory/preferences.json` - user preferences and settings
- `/tmp/gh-aw/cache-memory/history.log` - activity history and logs
- `/tmp/gh-aw/cache-memory/state/` - organized state files in subdirectories
Feel free to create, read, update, and organize files in this folder as needed for your tasks.
PROMPT_EOF
- name: Append safe outputs instructions to prompt
env:
GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
run: |
cat << 'PROMPT_EOF' >> "$GH_AW_PROMPT"
<safe-outputs>
<description>GitHub API Access Instructions</description>
<important>
The gh CLI is NOT authenticated. Do NOT use gh commands for GitHub operations.
</important>
<instructions>
To create or modify GitHub resources (issues, discussions, pull requests, etc.), you MUST call the appropriate safe output tool. Simply writing content will NOT work - the workflow requires actual tool calls.
**Available tools**: create_discussion, missing_tool, noop
**Critical**: Tool calls write structured data that downstream jobs process. Without tool calls, follow-up actions will be skipped.
</instructions>
</safe-outputs>
PROMPT_EOF
- name: Append GitHub context to prompt
env:
GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
GH_AW_GITHUB_ACTOR: ${{ github.actor }}
GH_AW_GITHUB_EVENT_COMMENT_ID: ${{ github.event.comment.id }}
GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER: ${{ github.event.discussion.number }}
GH_AW_GITHUB_EVENT_ISSUE_NUMBER: ${{ github.event.issue.number }}
GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER: ${{ github.event.pull_request.number }}
GH_AW_GITHUB_REPOSITORY: ${{ github.repository }}
GH_AW_GITHUB_RUN_ID: ${{ github.run_id }}
GH_AW_GITHUB_WORKSPACE: ${{ github.workspace }}
run: |
cat << 'PROMPT_EOF' >> "$GH_AW_PROMPT"
<github-context>
The following GitHub context information is available for this workflow:
{{#if __GH_AW_GITHUB_ACTOR__ }}
- **actor**: __GH_AW_GITHUB_ACTOR__
{{/if}}
{{#if __GH_AW_GITHUB_REPOSITORY__ }}
- **repository**: __GH_AW_GITHUB_REPOSITORY__
{{/if}}
{{#if __GH_AW_GITHUB_WORKSPACE__ }}
- **workspace**: __GH_AW_GITHUB_WORKSPACE__
{{/if}}
{{#if __GH_AW_GITHUB_EVENT_ISSUE_NUMBER__ }}
- **issue-number**: #__GH_AW_GITHUB_EVENT_ISSUE_NUMBER__
{{/if}}
{{#if __GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER__ }}
- **discussion-number**: #__GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER__
{{/if}}
{{#if __GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER__ }}
- **pull-request-number**: #__GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER__
{{/if}}
{{#if __GH_AW_GITHUB_EVENT_COMMENT_ID__ }}
- **comment-id**: __GH_AW_GITHUB_EVENT_COMMENT_ID__
{{/if}}
{{#if __GH_AW_GITHUB_RUN_ID__ }}
- **workflow-run-id**: __GH_AW_GITHUB_RUN_ID__
{{/if}}
</github-context>
PROMPT_EOF
- name: Substitute placeholders
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
env:
GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
GH_AW_GITHUB_ACTOR: ${{ github.actor }}
GH_AW_GITHUB_EVENT_COMMENT_ID: ${{ github.event.comment.id }}
GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER: ${{ github.event.discussion.number }}
GH_AW_GITHUB_EVENT_ISSUE_NUMBER: ${{ github.event.issue.number }}
GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER: ${{ github.event.pull_request.number }}
GH_AW_GITHUB_REPOSITORY: ${{ github.repository }}
GH_AW_GITHUB_RUN_ID: ${{ github.run_id }}
GH_AW_GITHUB_WORKSPACE: ${{ github.workspace }}
with:
script: |
@ -770,6 +745,7 @@ jobs:
GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER: process.env.GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER,
GH_AW_GITHUB_REPOSITORY: process.env.GH_AW_GITHUB_REPOSITORY,
GH_AW_GITHUB_RUN_ID: process.env.GH_AW_GITHUB_RUN_ID,
GH_AW_GITHUB_WORKFLOW: process.env.GH_AW_GITHUB_WORKFLOW,
GH_AW_GITHUB_WORKSPACE: process.env.GH_AW_GITHUB_WORKSPACE
}
});
@ -785,6 +761,10 @@ jobs:
setupGlobals(core, github, context, exec, io);
const { main } = require('/opt/gh-aw/actions/interpolate_prompt.cjs');
await main();
- name: Validate prompt placeholders
env:
GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
run: bash /opt/gh-aw/actions/validate_prompt_placeholders.sh
- name: Print prompt
env:
GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
@ -795,7 +775,7 @@ jobs:
timeout-minutes: 30
run: |
set -o pipefail
sudo -E awf --env-all --container-workdir "${GITHUB_WORKSPACE}" --mount /tmp:/tmp:rw --mount "${GITHUB_WORKSPACE}:${GITHUB_WORKSPACE}:rw" --mount /usr/bin/date:/usr/bin/date:ro --mount /usr/bin/gh:/usr/bin/gh:ro --mount /usr/bin/yq:/usr/bin/yq:ro --mount /usr/local/bin/copilot:/usr/local/bin/copilot:ro --mount /home/runner/.copilot:/home/runner/.copilot:rw --mount /opt/gh-aw:/opt/gh-aw:ro --allow-domains api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,github.com,host.docker.internal,raw.githubusercontent.com,registry.npmjs.org --log-level info --proxy-logs-dir /tmp/gh-aw/sandbox/firewall/logs --image-tag 0.8.2 \
sudo -E awf --env-all --container-workdir "${GITHUB_WORKSPACE}" --mount /tmp:/tmp:rw --mount "${GITHUB_WORKSPACE}:${GITHUB_WORKSPACE}:rw" --mount /usr/bin/date:/usr/bin/date:ro --mount /usr/bin/gh:/usr/bin/gh:ro --mount /usr/bin/yq:/usr/bin/yq:ro --mount /usr/local/bin/copilot:/usr/local/bin/copilot:ro --mount /home/runner/.copilot:/home/runner/.copilot:rw --mount /opt/gh-aw:/opt/gh-aw:ro --allow-domains api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,github.com,host.docker.internal,raw.githubusercontent.com,registry.npmjs.org --log-level info --proxy-logs-dir /tmp/gh-aw/sandbox/firewall/logs --enable-host-access --image-tag 0.10.0 \
-- /usr/local/bin/copilot --add-dir /tmp/gh-aw/ --log-level all --log-dir /tmp/gh-aw/sandbox/agent/logs/ --add-dir "${GITHUB_WORKSPACE}" --disable-builtin-mcps --allow-all-tools --add-dir /tmp/gh-aw/cache-memory/ --allow-all-paths --share /tmp/gh-aw/sandbox/agent/logs/conversation.md --prompt "$(cat /tmp/gh-aw/aw-prompts/prompt.txt)"${GH_AW_MODEL_AGENT_COPILOT:+ --model "$GH_AW_MODEL_AGENT_COPILOT"} \
2>&1 | tee /tmp/gh-aw/agent-stdio.log
env:
@ -806,7 +786,6 @@ jobs:
GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
GH_AW_SAFE_OUTPUTS: ${{ env.GH_AW_SAFE_OUTPUTS }}
GITHUB_HEAD_REF: ${{ github.head_ref }}
GITHUB_MCP_SERVER_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
GITHUB_REF_NAME: ${{ github.ref_name }}
GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }}
GITHUB_WORKSPACE: ${{ github.workspace }}
@ -828,6 +807,15 @@ jobs:
else
echo "No session-state directory found at $SESSION_STATE_DIR"
fi
- name: Stop MCP gateway
if: always()
continue-on-error: true
env:
MCP_GATEWAY_PORT: ${{ steps.start-mcp-gateway.outputs.gateway-port }}
MCP_GATEWAY_API_KEY: ${{ steps.start-mcp-gateway.outputs.gateway-api-key }}
GATEWAY_PID: ${{ steps.start-mcp-gateway.outputs.gateway-pid }}
run: |
bash /opt/gh-aw/actions/stop_mcp_gateway.sh "$GATEWAY_PID"
- name: Redact secrets in logs
if: always()
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
@ -890,12 +878,25 @@ jobs:
setupGlobals(core, github, context, exec, io);
const { main } = require('/opt/gh-aw/actions/parse_copilot_log.cjs');
await main();
- name: Firewall summary
- name: Parse MCP gateway logs for step summary
if: always()
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
with:
script: |
const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
setupGlobals(core, github, context, exec, io);
const { main } = require('/opt/gh-aw/actions/parse_mcp_gateway_log.cjs');
await main();
- name: Print firewall logs
if: always()
continue-on-error: true
env:
AWF_LOGS_DIR: /tmp/gh-aw/sandbox/firewall/logs
run: awf logs summary >> $GITHUB_STEP_SUMMARY
run: |
# Fix permissions on firewall logs so they can be uploaded as artifacts
# AWF runs with sudo, creating files owned by root
sudo chmod -R a+r /tmp/gh-aw/sandbox/firewall/logs 2>/dev/null || true
awf logs summary | tee -a "$GITHUB_STEP_SUMMARY"
- name: Upload cache-memory data as artifact
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
if: always()
@ -952,7 +953,7 @@ jobs:
echo "Agent Conclusion: $AGENT_CONCLUSION"
- name: Download agent output artifact
continue-on-error: true
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
with:
name: agent-output
path: /tmp/gh-aw/safeoutputs/
@ -988,6 +989,22 @@ jobs:
setupGlobals(core, github, context, exec, io);
const { main } = require('/opt/gh-aw/actions/missing_tool.cjs');
await main();
- name: Handle Agent Failure
id: handle_agent_failure
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
env:
GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
GH_AW_WORKFLOW_NAME: "API Coherence Checker"
GH_AW_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }}
GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.agent.outputs.secret_verification_result }}
with:
github-token: ${{ secrets.GITHUB_TOKEN }}
script: |
const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
setupGlobals(core, github, context, exec, io);
const { main } = require('/opt/gh-aw/actions/handle_agent_failure.cjs');
await main();
- name: Update reaction comment with completion status
id: conclusion
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
@ -1024,13 +1041,13 @@ jobs:
destination: /opt/gh-aw/actions
- name: Download agent artifacts
continue-on-error: true
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
with:
name: agent-artifacts
path: /tmp/gh-aw/threat-detection/
- name: Download agent output artifact
continue-on-error: true
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
with:
name: agent-output
path: /tmp/gh-aw/threat-detection/
@ -1098,7 +1115,8 @@ jobs:
mkdir -p /tmp/gh-aw/threat-detection
touch /tmp/gh-aw/threat-detection/detection.log
- name: Validate COPILOT_GITHUB_TOKEN secret
run: /opt/gh-aw/actions/validate_multi_secret.sh COPILOT_GITHUB_TOKEN GitHub Copilot CLI https://githubnext.github.io/gh-aw/reference/engines/#github-copilot-default
id: validate-secret
run: /opt/gh-aw/actions/validate_multi_secret.sh COPILOT_GITHUB_TOKEN 'GitHub Copilot CLI' https://githubnext.github.io/gh-aw/reference/engines/#github-copilot-default
env:
COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
- name: Install GitHub Copilot CLI
@ -1107,7 +1125,8 @@ jobs:
curl -fsSL https://raw.githubusercontent.com/github/copilot-cli/main/install.sh -o /tmp/copilot-install.sh
# Execute the installer with the specified version
export VERSION=0.0.375 && sudo bash /tmp/copilot-install.sh
# Pass VERSION directly to sudo to ensure it's available to the installer script
sudo VERSION=0.0.387 bash /tmp/copilot-install.sh
# Cleanup
rm -f /tmp/copilot-install.sh
@ -1184,7 +1203,7 @@ jobs:
destination: /opt/gh-aw/actions
- name: Download agent output artifact
continue-on-error: true
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
with:
name: agent-output
path: /tmp/gh-aw/safeoutputs/
@ -1198,7 +1217,7 @@ jobs:
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
env:
GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"create_discussion\":{\"category\":\"Agentic Workflows\",\"close_older_discussions\":true,\"expires\":168,\"max\":1,\"title_prefix\":\"[API Coherence] \"}}"
GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"create_discussion\":{\"category\":\"Agentic Workflows\",\"close_older_discussions\":true,\"expires\":168,\"max\":1,\"title_prefix\":\"[API Coherence] \"},\"missing_data\":{},\"missing_tool\":{}}"
with:
github-token: ${{ secrets.GITHUB_TOKEN }}
script: |
@ -1220,13 +1239,13 @@ jobs:
with:
destination: /opt/gh-aw/actions
- name: Download cache-memory artifact (default)
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
continue-on-error: true
with:
name: cache-memory
path: /tmp/gh-aw/cache-memory
- name: Save cache-memory to cache (default)
uses: actions/cache/save@8b402f58fbc84540c8b491a91e594a4576fec3d7 # v5.0.2
uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
with:
key: memory-${{ github.workflow }}-${{ github.run_id }}
path: /tmp/gh-aw/cache-memory

3
.github/workflows/api-coherence-checker.md vendored
View file

@ -18,7 +18,6 @@ tools:
toolsets: [default]
bash: [":*"]
edit: {}
grep: {}
glob: {}
web-search: {}
@ -209,4 +208,4 @@ The following cached issues have been resolved since the last run:
- **DO NOT** try to fix the APIs yourself - only document and suggest
- **DO NOT** analyze all APIs at once - be incremental and use cache memory
- **DO** close older discussions automatically (this is configured)
- **DO** provide enough detail for maintainers to understand and act on your findings
- **DO** provide enough detail for maintainers to understand and act on your findings

340
.github/workflows/build-warning-fixer.lock.yml generated vendored
View file

@ -13,7 +13,7 @@
# \ /\ / (_) | | | | ( | | | | (_) \ V V /\__ \
# \/ \/ \___/|_| |_|\_\|_| |_|\___/ \_/\_/ |___/
#
# This file was automatically generated by gh-aw (v0.36.0). DO NOT EDIT.
# This file was automatically generated by gh-aw (v0.37.0). DO NOT EDIT.
#
# To update this file, edit the corresponding .md file and run:
# gh aw compile
@ -28,7 +28,7 @@ name: "Build Warning Fixer"
# Friendly format: daily (scattered)
workflow_dispatch:
permissions: read-all
permissions: {}
concurrency:
group: "gh-aw-${{ github.workflow }}"
@ -66,6 +66,10 @@ jobs:
concurrency:
group: "gh-aw-copilot-${{ github.workflow }}"
env:
DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
GH_AW_ASSETS_ALLOWED_EXTS: ""
GH_AW_ASSETS_BRANCH: ""
GH_AW_ASSETS_MAX_SIZE_KB: 0
GH_AW_MCP_LOG_DIR: /tmp/gh-aw/mcp-logs/safeoutputs
GH_AW_SAFE_OUTPUTS: /tmp/gh-aw/safeoutputs/outputs.jsonl
GH_AW_SAFE_OUTPUTS_CONFIG_PATH: /opt/gh-aw/safeoutputs/config.json
@ -75,13 +79,14 @@ jobs:
model: ${{ steps.generate_aw_info.outputs.model }}
output: ${{ steps.collect_output.outputs.output }}
output_types: ${{ steps.collect_output.outputs.output_types }}
secret_verification_result: ${{ steps.validate-secret.outputs.verification_result }}
steps:
- name: Setup Scripts
uses: githubnext/gh-aw/actions/setup@v0.37.0
with:
destination: /opt/gh-aw/actions
- name: Checkout repository
uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98 # v5.0.1
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
with:
persist-credentials: false
- name: Create gh-aw temp directory
@ -111,7 +116,8 @@ jobs:
const { main } = require('/opt/gh-aw/actions/checkout_pr_branch.cjs');
await main();
- name: Validate COPILOT_GITHUB_TOKEN secret
run: /opt/gh-aw/actions/validate_multi_secret.sh COPILOT_GITHUB_TOKEN GitHub Copilot CLI https://githubnext.github.io/gh-aw/reference/engines/#github-copilot-default
id: validate-secret
run: /opt/gh-aw/actions/validate_multi_secret.sh COPILOT_GITHUB_TOKEN 'GitHub Copilot CLI' https://githubnext.github.io/gh-aw/reference/engines/#github-copilot-default
env:
COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
- name: Install GitHub Copilot CLI
@ -120,7 +126,8 @@ jobs:
curl -fsSL https://raw.githubusercontent.com/github/copilot-cli/main/install.sh -o /tmp/copilot-install.sh
# Execute the installer with the specified version
export VERSION=0.0.375 && sudo bash /tmp/copilot-install.sh
# Pass VERSION directly to sudo to ensure it's available to the installer script
sudo VERSION=0.0.387 bash /tmp/copilot-install.sh
# Cleanup
rm -f /tmp/copilot-install.sh
@ -128,23 +135,19 @@ jobs:
# Verify installation
copilot --version
- name: Install awf binary
run: |
echo "Installing awf via installer script (requested version: v0.8.2)"
curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.8.2 bash
which awf
awf --version
run: bash /opt/gh-aw/actions/install_awf_binary.sh v0.10.0
- name: Determine automatic lockdown mode for GitHub MCP server
id: determine-automatic-lockdown
env:
TOKEN_CHECK: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN }}
if: env.TOKEN_CHECK != ''
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
with:
script: |
const determineAutomaticLockdown = require('/opt/gh-aw/actions/determine_automatic_lockdown.cjs');
await determineAutomaticLockdown(github, context, core);
- name: Downloading container images
run: bash /opt/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.27.0
- name: Download container images
run: bash /opt/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.29.0 ghcr.io/githubnext/gh-aw-mcpg:v0.0.71 node:lts-alpine
- name: Write Safe Outputs Config
run: |
mkdir -p /opt/gh-aw/safeoutputs
@ -189,7 +192,7 @@ jobs:
"name": "create_pull_request"
},
{
"description": "Report that a tool or capability needed to complete the task is not available. Use this when you cannot accomplish what was requested because the required functionality is missing or access is restricted.",
"description": "Report that a tool or capability needed to complete the task is not available, or share any information you deem important about missing functionality or limitations. Use this when you cannot accomplish what was requested because the required functionality is missing or access is restricted.",
"inputSchema": {
"additionalProperties": false,
"properties": {
@ -198,16 +201,15 @@ jobs:
"type": "string"
},
"reason": {
"description": "Explanation of why this tool is needed to complete the task (max 256 characters).",
"description": "Explanation of why this tool is needed or what information you want to share about the limitation (max 256 characters).",
"type": "string"
},
"tool": {
"description": "Name or description of the missing tool or capability (max 128 characters). Be specific about what functionality is needed.",
"description": "Optional: Name or description of the missing tool or capability (max 128 characters). Be specific about what functionality is needed.",
"type": "string"
}
},
"required": [
"tool",
"reason"
],
"type": "object"
@ -230,6 +232,33 @@ jobs:
"type": "object"
},
"name": "noop"
},
{
"description": "Report that data or information needed to complete the task is not available. Use this when you cannot accomplish what was requested because required data, context, or information is missing.",
"inputSchema": {
"additionalProperties": false,
"properties": {
"alternatives": {
"description": "Any workarounds, manual steps, or alternative approaches the user could take (max 256 characters).",
"type": "string"
},
"context": {
"description": "Additional context about the missing data or where it should come from (max 256 characters).",
"type": "string"
},
"data_type": {
"description": "Type or description of the missing data or information (max 128 characters). Be specific about what data is needed.",
"type": "string"
},
"reason": {
"description": "Explanation of why this data is needed to complete the task (max 256 characters).",
"type": "string"
}
},
"required": [],
"type": "object"
},
"name": "missing_data"
}
]
EOF
@ -299,44 +328,48 @@ jobs:
}
}
EOF
- name: Setup MCPs
- name: Start MCP gateway
id: start-mcp-gateway
env:
GH_AW_SAFE_OUTPUTS: ${{ env.GH_AW_SAFE_OUTPUTS }}
GITHUB_MCP_LOCKDOWN: ${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}
GITHUB_MCP_SERVER_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
run: |
set -eo pipefail
mkdir -p /tmp/gh-aw/mcp-config
# Export gateway environment variables for MCP config and gateway script
export MCP_GATEWAY_PORT="80"
export MCP_GATEWAY_DOMAIN="host.docker.internal"
MCP_GATEWAY_API_KEY=""
MCP_GATEWAY_API_KEY=$(openssl rand -base64 45 | tr -d '/+=')
export MCP_GATEWAY_API_KEY
# Register API key as secret to mask it from logs
echo "::add-mask::${MCP_GATEWAY_API_KEY}"
export GH_AW_ENGINE="copilot"
export MCP_GATEWAY_DOCKER_COMMAND='docker run -i --rm --network host -v /var/run/docker.sock:/var/run/docker.sock -e MCP_GATEWAY_PORT -e MCP_GATEWAY_DOMAIN -e MCP_GATEWAY_API_KEY -e DEBUG="*" -e MCP_GATEWAY_LOG_DIR -e GH_AW_MCP_LOG_DIR -e GH_AW_SAFE_OUTPUTS -e GH_AW_SAFE_OUTPUTS_CONFIG_PATH -e GH_AW_SAFE_OUTPUTS_TOOLS_PATH -e GH_AW_ASSETS_BRANCH -e GH_AW_ASSETS_MAX_SIZE_KB -e GH_AW_ASSETS_ALLOWED_EXTS -e DEFAULT_BRANCH -e GITHUB_MCP_SERVER_TOKEN -e GITHUB_MCP_LOCKDOWN -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e GITHUB_SHA -e GITHUB_WORKSPACE -e GITHUB_TOKEN -v /opt:/opt:ro -v /tmp:/tmp:rw -v '"${GITHUB_WORKSPACE}"':'"${GITHUB_WORKSPACE}"':rw ghcr.io/githubnext/gh-aw-mcpg:v0.0.71'
mkdir -p /home/runner/.copilot
cat > /home/runner/.copilot/mcp-config.json << EOF
cat << MCPCONFIG_EOF | bash /opt/gh-aw/actions/start_mcp_gateway.sh
{
"mcpServers": {
"github": {
"type": "local",
"command": "docker",
"args": [
"run",
"-i",
"--rm",
"-e",
"GITHUB_PERSONAL_ACCESS_TOKEN",
"-e",
"GITHUB_READ_ONLY=1",
"-e",
"GITHUB_LOCKDOWN_MODE=$GITHUB_MCP_LOCKDOWN",
"-e",
"GITHUB_TOOLSETS=context,repos,issues,pull_requests",
"ghcr.io/github/github-mcp-server:v0.27.0"
],
"tools": ["*"],
"type": "stdio",
"container": "ghcr.io/github/github-mcp-server:v0.29.0",
"env": {
"GITHUB_PERSONAL_ACCESS_TOKEN": "\${GITHUB_MCP_SERVER_TOKEN}"
"GITHUB_LOCKDOWN_MODE": "$GITHUB_MCP_LOCKDOWN",
"GITHUB_PERSONAL_ACCESS_TOKEN": "\${GITHUB_MCP_SERVER_TOKEN}",
"GITHUB_READ_ONLY": "1",
"GITHUB_TOOLSETS": "context,repos,issues,pull_requests"
}
},
"safeoutputs": {
"type": "local",
"command": "node",
"args": ["/opt/gh-aw/safeoutputs/mcp-server.cjs"],
"tools": ["*"],
"type": "stdio",
"container": "node:lts-alpine",
"entrypoint": "node",
"entrypointArgs": ["/opt/gh-aw/safeoutputs/mcp-server.cjs"],
"mounts": ["/opt/gh-aw:/opt/gh-aw:ro", "/tmp/gh-aw:/tmp/gh-aw:rw"],
"env": {
"GH_AW_MCP_LOG_DIR": "\${GH_AW_MCP_LOG_DIR}",
"GH_AW_SAFE_OUTPUTS": "\${GH_AW_SAFE_OUTPUTS}",
@ -352,16 +385,14 @@ jobs:
"DEFAULT_BRANCH": "\${DEFAULT_BRANCH}"
}
}
},
"gateway": {
"port": $MCP_GATEWAY_PORT,
"domain": "${MCP_GATEWAY_DOMAIN}",
"apiKey": "${MCP_GATEWAY_API_KEY}"
}
}
EOF
echo "-------START MCP CONFIG-----------"
cat /home/runner/.copilot/mcp-config.json
echo "-------END MCP CONFIG-----------"
echo "-------/home/runner/.copilot-----------"
find /home/runner/.copilot
echo "HOME: $HOME"
echo "GITHUB_COPILOT_CLI_MODE: $GITHUB_COPILOT_CLI_MODE"
MCPCONFIG_EOF
- name: Generate agentic run info
id: generate_aw_info
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
@ -374,8 +405,8 @@ jobs:
engine_name: "GitHub Copilot CLI",
model: process.env.GH_AW_MODEL_AGENT_COPILOT || "",
version: "",
agent_version: "0.0.375",
cli_version: "v0.36.0",
agent_version: "0.0.387",
cli_version: "v0.37.0",
workflow_name: "Build Warning Fixer",
experimental: false,
supports_tools_allowlist: true,
@ -392,7 +423,8 @@ jobs:
network_mode: "defaults",
allowed_domains: [],
firewall_enabled: true,
awf_version: "v0.8.2",
awf_version: "v0.10.0",
awmg_version: "v0.0.71",
steps: {
firewall: "squid"
},
@ -413,13 +445,72 @@ jobs:
script: |
const { generateWorkflowOverview } = require('/opt/gh-aw/actions/generate_workflow_overview.cjs');
await generateWorkflowOverview(core);
- name: Create prompt
- name: Create prompt with built-in context
env:
GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
GH_AW_SAFE_OUTPUTS: ${{ env.GH_AW_SAFE_OUTPUTS }}
GH_AW_GITHUB_ACTOR: ${{ github.actor }}
GH_AW_GITHUB_EVENT_COMMENT_ID: ${{ github.event.comment.id }}
GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER: ${{ github.event.discussion.number }}
GH_AW_GITHUB_EVENT_ISSUE_NUMBER: ${{ github.event.issue.number }}
GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER: ${{ github.event.pull_request.number }}
GH_AW_GITHUB_REPOSITORY: ${{ github.repository }}
GH_AW_GITHUB_RUN_ID: ${{ github.run_id }}
GH_AW_GITHUB_WORKSPACE: ${{ github.workspace }}
run: |
bash /opt/gh-aw/actions/create_prompt_first.sh
cat << 'PROMPT_EOF' > "$GH_AW_PROMPT"
<system>
PROMPT_EOF
cat "/opt/gh-aw/prompts/temp_folder_prompt.md" >> "$GH_AW_PROMPT"
cat "/opt/gh-aw/prompts/markdown.md" >> "$GH_AW_PROMPT"
cat << 'PROMPT_EOF' >> "$GH_AW_PROMPT"
<safe-outputs>
<description>GitHub API Access Instructions</description>
<important>
The gh CLI is NOT authenticated. Do NOT use gh commands for GitHub operations.
</important>
<instructions>
To create or modify GitHub resources (issues, discussions, pull requests, etc.), you MUST call the appropriate safe output tool. Simply writing content will NOT work - the workflow requires actual tool calls.
**Available tools**: create_pull_request, missing_tool, noop
**Critical**: Tool calls write structured data that downstream jobs process. Without tool calls, follow-up actions will be skipped.
</instructions>
</safe-outputs>
<github-context>
The following GitHub context information is available for this workflow:
{{#if __GH_AW_GITHUB_ACTOR__ }}
- **actor**: __GH_AW_GITHUB_ACTOR__
{{/if}}
{{#if __GH_AW_GITHUB_REPOSITORY__ }}
- **repository**: __GH_AW_GITHUB_REPOSITORY__
{{/if}}
{{#if __GH_AW_GITHUB_WORKSPACE__ }}
- **workspace**: __GH_AW_GITHUB_WORKSPACE__
{{/if}}
{{#if __GH_AW_GITHUB_EVENT_ISSUE_NUMBER__ }}
- **issue-number**: #__GH_AW_GITHUB_EVENT_ISSUE_NUMBER__
{{/if}}
{{#if __GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER__ }}
- **discussion-number**: #__GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER__
{{/if}}
{{#if __GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER__ }}
- **pull-request-number**: #__GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER__
{{/if}}
{{#if __GH_AW_GITHUB_EVENT_COMMENT_ID__ }}
- **comment-id**: __GH_AW_GITHUB_EVENT_COMMENT_ID__
{{/if}}
{{#if __GH_AW_GITHUB_RUN_ID__ }}
- **workflow-run-id**: __GH_AW_GITHUB_RUN_ID__
{{/if}}
</github-context>
PROMPT_EOF
cat << 'PROMPT_EOF' >> "$GH_AW_PROMPT"
</system>
PROMPT_EOF
cat << 'PROMPT_EOF' >> "$GH_AW_PROMPT"
# Build Warning Fixer
You are an AI agent that automatically detects and fixes build warnings in the Z3 theorem prover codebase.
@ -547,77 +638,6 @@ jobs:
If you find and fix warnings, create a PR. If no warnings are found or all warnings are too complex to auto-fix, exit gracefully without creating a PR.
PROMPT_EOF
- name: Append XPIA security instructions to prompt
env:
GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
run: |
cat "/opt/gh-aw/prompts/xpia_prompt.md" >> "$GH_AW_PROMPT"
- name: Append temporary folder instructions to prompt
env:
GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
run: |
cat "/opt/gh-aw/prompts/temp_folder_prompt.md" >> "$GH_AW_PROMPT"
- name: Append safe outputs instructions to prompt
env:
GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
run: |
cat << 'PROMPT_EOF' >> "$GH_AW_PROMPT"
<safe-outputs>
<description>GitHub API Access Instructions</description>
<important>
The gh CLI is NOT authenticated. Do NOT use gh commands for GitHub operations.
</important>
<instructions>
To create or modify GitHub resources (issues, discussions, pull requests, etc.), you MUST call the appropriate safe output tool. Simply writing content will NOT work - the workflow requires actual tool calls.
**Available tools**: create_pull_request, missing_tool, noop
**Critical**: Tool calls write structured data that downstream jobs process. Without tool calls, follow-up actions will be skipped.
</instructions>
</safe-outputs>
PROMPT_EOF
- name: Append GitHub context to prompt
env:
GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
GH_AW_GITHUB_ACTOR: ${{ github.actor }}
GH_AW_GITHUB_EVENT_COMMENT_ID: ${{ github.event.comment.id }}
GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER: ${{ github.event.discussion.number }}
GH_AW_GITHUB_EVENT_ISSUE_NUMBER: ${{ github.event.issue.number }}
GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER: ${{ github.event.pull_request.number }}
GH_AW_GITHUB_REPOSITORY: ${{ github.repository }}
GH_AW_GITHUB_RUN_ID: ${{ github.run_id }}
GH_AW_GITHUB_WORKSPACE: ${{ github.workspace }}
run: |
cat << 'PROMPT_EOF' >> "$GH_AW_PROMPT"
<github-context>
The following GitHub context information is available for this workflow:
{{#if __GH_AW_GITHUB_ACTOR__ }}
- **actor**: __GH_AW_GITHUB_ACTOR__
{{/if}}
{{#if __GH_AW_GITHUB_REPOSITORY__ }}
- **repository**: __GH_AW_GITHUB_REPOSITORY__
{{/if}}
{{#if __GH_AW_GITHUB_WORKSPACE__ }}
- **workspace**: __GH_AW_GITHUB_WORKSPACE__
{{/if}}
{{#if __GH_AW_GITHUB_EVENT_ISSUE_NUMBER__ }}
- **issue-number**: #__GH_AW_GITHUB_EVENT_ISSUE_NUMBER__
{{/if}}
{{#if __GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER__ }}
- **discussion-number**: #__GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER__
{{/if}}
{{#if __GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER__ }}
- **pull-request-number**: #__GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER__
{{/if}}
{{#if __GH_AW_GITHUB_EVENT_COMMENT_ID__ }}
- **comment-id**: __GH_AW_GITHUB_EVENT_COMMENT_ID__
{{/if}}
{{#if __GH_AW_GITHUB_RUN_ID__ }}
- **workflow-run-id**: __GH_AW_GITHUB_RUN_ID__
{{/if}}
</github-context>
PROMPT_EOF
- name: Substitute placeholders
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
@ -659,6 +679,10 @@ jobs:
setupGlobals(core, github, context, exec, io);
const { main } = require('/opt/gh-aw/actions/interpolate_prompt.cjs');
await main();
- name: Validate prompt placeholders
env:
GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
run: bash /opt/gh-aw/actions/validate_prompt_placeholders.sh
- name: Print prompt
env:
GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
@ -673,7 +697,7 @@ jobs:
timeout-minutes: 60
run: |
set -o pipefail
sudo -E awf --env-all --container-workdir "${GITHUB_WORKSPACE}" --mount /tmp:/tmp:rw --mount "${GITHUB_WORKSPACE}:${GITHUB_WORKSPACE}:rw" --mount /usr/bin/date:/usr/bin/date:ro --mount /usr/bin/gh:/usr/bin/gh:ro --mount /usr/bin/yq:/usr/bin/yq:ro --mount /usr/local/bin/copilot:/usr/local/bin/copilot:ro --mount /home/runner/.copilot:/home/runner/.copilot:rw --mount /opt/gh-aw:/opt/gh-aw:ro --allow-domains api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,github.com,host.docker.internal,raw.githubusercontent.com,registry.npmjs.org --log-level info --proxy-logs-dir /tmp/gh-aw/sandbox/firewall/logs --image-tag 0.8.2 \
sudo -E awf --env-all --container-workdir "${GITHUB_WORKSPACE}" --mount /tmp:/tmp:rw --mount "${GITHUB_WORKSPACE}:${GITHUB_WORKSPACE}:rw" --mount /usr/bin/date:/usr/bin/date:ro --mount /usr/bin/gh:/usr/bin/gh:ro --mount /usr/bin/yq:/usr/bin/yq:ro --mount /usr/local/bin/copilot:/usr/local/bin/copilot:ro --mount /home/runner/.copilot:/home/runner/.copilot:rw --mount /opt/gh-aw:/opt/gh-aw:ro --allow-domains api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,github.com,host.docker.internal,raw.githubusercontent.com,registry.npmjs.org --log-level info --proxy-logs-dir /tmp/gh-aw/sandbox/firewall/logs --enable-host-access --image-tag 0.10.0 \
-- /usr/local/bin/copilot --add-dir /tmp/gh-aw/ --log-level all --log-dir /tmp/gh-aw/sandbox/agent/logs/ --add-dir "${GITHUB_WORKSPACE}" --disable-builtin-mcps --allow-tool github --allow-tool safeoutputs --allow-tool shell --allow-tool write --allow-all-paths --share /tmp/gh-aw/sandbox/agent/logs/conversation.md --prompt "$(cat /tmp/gh-aw/aw-prompts/prompt.txt)"${GH_AW_MODEL_AGENT_COPILOT:+ --model "$GH_AW_MODEL_AGENT_COPILOT"} \
2>&1 | tee /tmp/gh-aw/agent-stdio.log
env:
@ -684,7 +708,6 @@ jobs:
GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
GH_AW_SAFE_OUTPUTS: ${{ env.GH_AW_SAFE_OUTPUTS }}
GITHUB_HEAD_REF: ${{ github.head_ref }}
GITHUB_MCP_SERVER_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
GITHUB_REF_NAME: ${{ github.ref_name }}
GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }}
GITHUB_WORKSPACE: ${{ github.workspace }}
@ -706,6 +729,15 @@ jobs:
else
echo "No session-state directory found at $SESSION_STATE_DIR"
fi
- name: Stop MCP gateway
if: always()
continue-on-error: true
env:
MCP_GATEWAY_PORT: ${{ steps.start-mcp-gateway.outputs.gateway-port }}
MCP_GATEWAY_API_KEY: ${{ steps.start-mcp-gateway.outputs.gateway-api-key }}
GATEWAY_PID: ${{ steps.start-mcp-gateway.outputs.gateway-pid }}
run: |
bash /opt/gh-aw/actions/stop_mcp_gateway.sh "$GATEWAY_PID"
- name: Redact secrets in logs
if: always()
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
@ -768,12 +800,25 @@ jobs:
setupGlobals(core, github, context, exec, io);
const { main } = require('/opt/gh-aw/actions/parse_copilot_log.cjs');
await main();
- name: Firewall summary
- name: Parse MCP gateway logs for step summary
if: always()
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
with:
script: |
const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
setupGlobals(core, github, context, exec, io);
const { main } = require('/opt/gh-aw/actions/parse_mcp_gateway_log.cjs');
await main();
- name: Print firewall logs
if: always()
continue-on-error: true
env:
AWF_LOGS_DIR: /tmp/gh-aw/sandbox/firewall/logs
run: awf logs summary >> $GITHUB_STEP_SUMMARY
run: |
# Fix permissions on firewall logs so they can be uploaded as artifacts
# AWF runs with sudo, creating files owned by root
sudo chmod -R a+r /tmp/gh-aw/sandbox/firewall/logs 2>/dev/null || true
awf logs summary | tee -a "$GITHUB_STEP_SUMMARY"
- name: Upload agent artifacts
if: always()
continue-on-error: true
@ -824,7 +869,7 @@ jobs:
echo "Agent Conclusion: $AGENT_CONCLUSION"
- name: Download agent output artifact
continue-on-error: true
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
with:
name: agent-output
path: /tmp/gh-aw/safeoutputs/
@ -862,6 +907,22 @@ jobs:
setupGlobals(core, github, context, exec, io);
const { main } = require('/opt/gh-aw/actions/missing_tool.cjs');
await main();
- name: Handle Agent Failure
id: handle_agent_failure
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
env:
GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
GH_AW_WORKFLOW_NAME: "Build Warning Fixer"
GH_AW_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }}
GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.agent.outputs.secret_verification_result }}
with:
github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
script: |
const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
setupGlobals(core, github, context, exec, io);
const { main } = require('/opt/gh-aw/actions/handle_agent_failure.cjs');
await main();
- name: Update reaction comment with completion status
id: conclusion
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
@ -898,13 +959,13 @@ jobs:
destination: /opt/gh-aw/actions
- name: Download agent artifacts
continue-on-error: true
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
with:
name: agent-artifacts
path: /tmp/gh-aw/threat-detection/
- name: Download agent output artifact
continue-on-error: true
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
with:
name: agent-output
path: /tmp/gh-aw/threat-detection/
@ -972,7 +1033,8 @@ jobs:
mkdir -p /tmp/gh-aw/threat-detection
touch /tmp/gh-aw/threat-detection/detection.log
- name: Validate COPILOT_GITHUB_TOKEN secret
run: /opt/gh-aw/actions/validate_multi_secret.sh COPILOT_GITHUB_TOKEN GitHub Copilot CLI https://githubnext.github.io/gh-aw/reference/engines/#github-copilot-default
id: validate-secret
run: /opt/gh-aw/actions/validate_multi_secret.sh COPILOT_GITHUB_TOKEN 'GitHub Copilot CLI' https://githubnext.github.io/gh-aw/reference/engines/#github-copilot-default
env:
COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
- name: Install GitHub Copilot CLI
@ -981,7 +1043,8 @@ jobs:
curl -fsSL https://raw.githubusercontent.com/github/copilot-cli/main/install.sh -o /tmp/copilot-install.sh
# Execute the installer with the specified version
export VERSION=0.0.375 && sudo bash /tmp/copilot-install.sh
# Pass VERSION directly to sudo to ensure it's available to the installer script
sudo VERSION=0.0.387 bash /tmp/copilot-install.sh
# Cleanup
rm -f /tmp/copilot-install.sh
@ -1060,7 +1123,7 @@ jobs:
destination: /opt/gh-aw/actions
- name: Download agent output artifact
continue-on-error: true
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
with:
name: agent-output
path: /tmp/gh-aw/safeoutputs/
@ -1071,13 +1134,13 @@ jobs:
echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/safeoutputs/agent_output.json" >> "$GITHUB_ENV"
- name: Download patch artifact
continue-on-error: true
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
with:
name: agent-artifacts
path: /tmp/gh-aw/
- name: Checkout repository
if: ((!cancelled()) && (needs.agent.result != 'skipped')) && (contains(needs.agent.outputs.output_types, 'create_pull_request'))
uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98 # v5.0.1
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
with:
token: ${{ github.token }}
persist-credentials: false
@ -1087,19 +1150,20 @@ jobs:
env:
REPO_NAME: ${{ github.repository }}
SERVER_URL: ${{ github.server_url }}
GIT_TOKEN: ${{ github.token }}
run: |
git config --global user.email "github-actions[bot]@users.noreply.github.com"
git config --global user.name "github-actions[bot]"
# Re-authenticate git with GitHub token
SERVER_URL_STRIPPED="${SERVER_URL#https://}"
git remote set-url origin "https://x-access-token:${{ github.token }}@${SERVER_URL_STRIPPED}/${REPO_NAME}.git"
git remote set-url origin "https://x-access-token:${GIT_TOKEN}@${SERVER_URL_STRIPPED}/${REPO_NAME}.git"
echo "Git configured with standard GitHub Actions identity"
- name: Process Safe Outputs
id: process_safe_outputs
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
env:
GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"create_pull_request\":{\"base_branch\":\"${{ github.ref_name }}\",\"if_no_changes\":\"ignore\",\"max\":1,\"max_patch_size\":1024}}"
GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"create_pull_request\":{\"base_branch\":\"${{ github.ref_name }}\",\"if_no_changes\":\"ignore\",\"max\":1,\"max_patch_size\":1024},\"missing_data\":{},\"missing_tool\":{}}"
with:
github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
script: |

3
.github/workflows/build-warning-fixer.md vendored
View file

@ -6,7 +6,6 @@ on:
permissions: read-all
tools:
view: {}
grep: {}
glob: {}
edit:
bash:
@ -143,4 +142,4 @@ You are an AI agent that automatically detects and fixes build warnings in the Z
## Output
If you find and fix warnings, create a PR. If no warnings are found or all warnings are too complex to auto-fix, exit gracefully without creating a PR.
If you find and fix warnings, create a PR. If no warnings are found or all warnings are too complex to auto-fix, exit gracefully without creating a PR.

388
.github/workflows/code-conventions-analyzer.lock.yml generated vendored
View file

@ -13,7 +13,7 @@
# \ /\ / (_) | | | | ( | | | | (_) \ V V /\__ \
# \/ \/ \___/|_| |_|\_\|_| |_|\___/ \_/\_/ |___/
#
# This file was automatically generated by gh-aw (v0.36.0). DO NOT EDIT.
# This file was automatically generated by gh-aw (v0.37.0). DO NOT EDIT.
#
# To update this file, edit the corresponding .md file and run:
# gh aw compile
@ -28,7 +28,7 @@ name: "Code Conventions Analyzer"
# Friendly format: daily (scattered)
workflow_dispatch:
permissions: read-all
permissions: {}
concurrency:
group: "gh-aw-${{ github.workflow }}"
@ -66,6 +66,10 @@ jobs:
concurrency:
group: "gh-aw-copilot-${{ github.workflow }}"
env:
DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
GH_AW_ASSETS_ALLOWED_EXTS: ""
GH_AW_ASSETS_BRANCH: ""
GH_AW_ASSETS_MAX_SIZE_KB: 0
GH_AW_MCP_LOG_DIR: /tmp/gh-aw/mcp-logs/safeoutputs
GH_AW_SAFE_OUTPUTS: /tmp/gh-aw/safeoutputs/outputs.jsonl
GH_AW_SAFE_OUTPUTS_CONFIG_PATH: /opt/gh-aw/safeoutputs/config.json
@ -75,6 +79,7 @@ jobs:
model: ${{ steps.generate_aw_info.outputs.model }}
output: ${{ steps.collect_output.outputs.output }}
output_types: ${{ steps.collect_output.outputs.output_types }}
secret_verification_result: ${{ steps.validate-secret.outputs.verification_result }}
steps:
- name: Setup Scripts
uses: githubnext/gh-aw/actions/setup@v0.37.0
@ -89,8 +94,8 @@ jobs:
# Cache memory file share configuration from frontmatter processed below
- name: Create cache-memory directory
run: bash /opt/gh-aw/actions/create_cache_memory_dir.sh
- name: Restore cache memory file share data
uses: actions/cache/restore@8b402f58fbc84540c8b491a91e594a4576fec3d7 # v5.0.2
- name: Restore cache-memory file share data
uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
with:
key: memory-${{ github.workflow }}-${{ github.run_id }}
path: /tmp/gh-aw/cache-memory
@ -122,7 +127,8 @@ jobs:
const { main } = require('/opt/gh-aw/actions/checkout_pr_branch.cjs');
await main();
- name: Validate COPILOT_GITHUB_TOKEN secret
run: /opt/gh-aw/actions/validate_multi_secret.sh COPILOT_GITHUB_TOKEN GitHub Copilot CLI https://githubnext.github.io/gh-aw/reference/engines/#github-copilot-default
id: validate-secret
run: /opt/gh-aw/actions/validate_multi_secret.sh COPILOT_GITHUB_TOKEN 'GitHub Copilot CLI' https://githubnext.github.io/gh-aw/reference/engines/#github-copilot-default
env:
COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
- name: Install GitHub Copilot CLI
@ -131,7 +137,8 @@ jobs:
curl -fsSL https://raw.githubusercontent.com/github/copilot-cli/main/install.sh -o /tmp/copilot-install.sh
# Execute the installer with the specified version
export VERSION=0.0.375 && sudo bash /tmp/copilot-install.sh
# Pass VERSION directly to sudo to ensure it's available to the installer script
sudo VERSION=0.0.387 bash /tmp/copilot-install.sh
# Cleanup
rm -f /tmp/copilot-install.sh
@ -139,23 +146,19 @@ jobs:
# Verify installation
copilot --version
- name: Install awf binary
run: |
echo "Installing awf via installer script (requested version: v0.8.2)"
curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.8.2 bash
which awf
awf --version
run: bash /opt/gh-aw/actions/install_awf_binary.sh v0.10.0
- name: Determine automatic lockdown mode for GitHub MCP server
id: determine-automatic-lockdown
env:
TOKEN_CHECK: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN }}
if: env.TOKEN_CHECK != ''
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
with:
script: |
const determineAutomaticLockdown = require('/opt/gh-aw/actions/determine_automatic_lockdown.cjs');
await determineAutomaticLockdown(github, context, core);
- name: Downloading container images
run: bash /opt/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.27.0
- name: Download container images
run: bash /opt/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.29.0 ghcr.io/githubnext/gh-aw-mcpg:v0.0.71 node:lts-alpine
- name: Write Safe Outputs Config
run: |
mkdir -p /opt/gh-aw/safeoutputs
@ -193,7 +196,7 @@ jobs:
"name": "create_discussion"
},
{
"description": "Report that a tool or capability needed to complete the task is not available. Use this when you cannot accomplish what was requested because the required functionality is missing or access is restricted.",
"description": "Report that a tool or capability needed to complete the task is not available, or share any information you deem important about missing functionality or limitations. Use this when you cannot accomplish what was requested because the required functionality is missing or access is restricted.",
"inputSchema": {
"additionalProperties": false,
"properties": {
@ -202,16 +205,15 @@ jobs:
"type": "string"
},
"reason": {
"description": "Explanation of why this tool is needed to complete the task (max 256 characters).",
"description": "Explanation of why this tool is needed or what information you want to share about the limitation (max 256 characters).",
"type": "string"
},
"tool": {
"description": "Name or description of the missing tool or capability (max 128 characters). Be specific about what functionality is needed.",
"description": "Optional: Name or description of the missing tool or capability (max 128 characters). Be specific about what functionality is needed.",
"type": "string"
}
},
"required": [
"tool",
"reason"
],
"type": "object"
@ -234,6 +236,33 @@ jobs:
"type": "object"
},
"name": "noop"
},
{
"description": "Report that data or information needed to complete the task is not available. Use this when you cannot accomplish what was requested because required data, context, or information is missing.",
"inputSchema": {
"additionalProperties": false,
"properties": {
"alternatives": {
"description": "Any workarounds, manual steps, or alternative approaches the user could take (max 256 characters).",
"type": "string"
},
"context": {
"description": "Additional context about the missing data or where it should come from (max 256 characters).",
"type": "string"
},
"data_type": {
"description": "Type or description of the missing data or information (max 128 characters). Be specific about what data is needed.",
"type": "string"
},
"reason": {
"description": "Explanation of why this data is needed to complete the task (max 256 characters).",
"type": "string"
}
},
"required": [],
"type": "object"
},
"name": "missing_data"
}
]
EOF
@ -300,44 +329,48 @@ jobs:
}
}
EOF
- name: Setup MCPs
- name: Start MCP gateway
id: start-mcp-gateway
env:
GH_AW_SAFE_OUTPUTS: ${{ env.GH_AW_SAFE_OUTPUTS }}
GITHUB_MCP_LOCKDOWN: ${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}
GITHUB_MCP_SERVER_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
run: |
set -eo pipefail
mkdir -p /tmp/gh-aw/mcp-config
# Export gateway environment variables for MCP config and gateway script
export MCP_GATEWAY_PORT="80"
export MCP_GATEWAY_DOMAIN="host.docker.internal"
MCP_GATEWAY_API_KEY=""
MCP_GATEWAY_API_KEY=$(openssl rand -base64 45 | tr -d '/+=')
export MCP_GATEWAY_API_KEY
# Register API key as secret to mask it from logs
echo "::add-mask::${MCP_GATEWAY_API_KEY}"
export GH_AW_ENGINE="copilot"
export MCP_GATEWAY_DOCKER_COMMAND='docker run -i --rm --network host -v /var/run/docker.sock:/var/run/docker.sock -e MCP_GATEWAY_PORT -e MCP_GATEWAY_DOMAIN -e MCP_GATEWAY_API_KEY -e DEBUG="*" -e MCP_GATEWAY_LOG_DIR -e GH_AW_MCP_LOG_DIR -e GH_AW_SAFE_OUTPUTS -e GH_AW_SAFE_OUTPUTS_CONFIG_PATH -e GH_AW_SAFE_OUTPUTS_TOOLS_PATH -e GH_AW_ASSETS_BRANCH -e GH_AW_ASSETS_MAX_SIZE_KB -e GH_AW_ASSETS_ALLOWED_EXTS -e DEFAULT_BRANCH -e GITHUB_MCP_SERVER_TOKEN -e GITHUB_MCP_LOCKDOWN -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e GITHUB_SHA -e GITHUB_WORKSPACE -e GITHUB_TOKEN -v /opt:/opt:ro -v /tmp:/tmp:rw -v '"${GITHUB_WORKSPACE}"':'"${GITHUB_WORKSPACE}"':rw ghcr.io/githubnext/gh-aw-mcpg:v0.0.71'
mkdir -p /home/runner/.copilot
cat > /home/runner/.copilot/mcp-config.json << EOF
cat << MCPCONFIG_EOF | bash /opt/gh-aw/actions/start_mcp_gateway.sh
{
"mcpServers": {
"github": {
"type": "local",
"command": "docker",
"args": [
"run",
"-i",
"--rm",
"-e",
"GITHUB_PERSONAL_ACCESS_TOKEN",
"-e",
"GITHUB_READ_ONLY=1",
"-e",
"GITHUB_LOCKDOWN_MODE=$GITHUB_MCP_LOCKDOWN",
"-e",
"GITHUB_TOOLSETS=context,repos,issues,pull_requests",
"ghcr.io/github/github-mcp-server:v0.27.0"
],
"tools": ["*"],
"type": "stdio",
"container": "ghcr.io/github/github-mcp-server:v0.29.0",
"env": {
"GITHUB_PERSONAL_ACCESS_TOKEN": "\${GITHUB_MCP_SERVER_TOKEN}"
"GITHUB_LOCKDOWN_MODE": "$GITHUB_MCP_LOCKDOWN",
"GITHUB_PERSONAL_ACCESS_TOKEN": "\${GITHUB_MCP_SERVER_TOKEN}",
"GITHUB_READ_ONLY": "1",
"GITHUB_TOOLSETS": "context,repos,issues,pull_requests"
}
},
"safeoutputs": {
"type": "local",
"command": "node",
"args": ["/opt/gh-aw/safeoutputs/mcp-server.cjs"],
"tools": ["*"],
"type": "stdio",
"container": "node:lts-alpine",
"entrypoint": "node",
"entrypointArgs": ["/opt/gh-aw/safeoutputs/mcp-server.cjs"],
"mounts": ["/opt/gh-aw:/opt/gh-aw:ro", "/tmp/gh-aw:/tmp/gh-aw:rw"],
"env": {
"GH_AW_MCP_LOG_DIR": "\${GH_AW_MCP_LOG_DIR}",
"GH_AW_SAFE_OUTPUTS": "\${GH_AW_SAFE_OUTPUTS}",
@ -353,16 +386,14 @@ jobs:
"DEFAULT_BRANCH": "\${DEFAULT_BRANCH}"
}
}
},
"gateway": {
"port": $MCP_GATEWAY_PORT,
"domain": "${MCP_GATEWAY_DOMAIN}",
"apiKey": "${MCP_GATEWAY_API_KEY}"
}
}
EOF
echo "-------START MCP CONFIG-----------"
cat /home/runner/.copilot/mcp-config.json
echo "-------END MCP CONFIG-----------"
echo "-------/home/runner/.copilot-----------"
find /home/runner/.copilot
echo "HOME: $HOME"
echo "GITHUB_COPILOT_CLI_MODE: $GITHUB_COPILOT_CLI_MODE"
MCPCONFIG_EOF
- name: Generate agentic run info
id: generate_aw_info
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
@ -375,8 +406,8 @@ jobs:
engine_name: "GitHub Copilot CLI",
model: process.env.GH_AW_MODEL_AGENT_COPILOT || "",
version: "",
agent_version: "0.0.375",
cli_version: "v0.36.0",
agent_version: "0.0.387",
cli_version: "v0.37.0",
workflow_name: "Code Conventions Analyzer",
experimental: false,
supports_tools_allowlist: true,
@ -393,7 +424,8 @@ jobs:
network_mode: "defaults",
allowed_domains: [],
firewall_enabled: true,
awf_version: "v0.8.2",
awf_version: "v0.10.0",
awmg_version: "v0.0.71",
steps: {
firewall: "squid"
},
@ -414,13 +446,92 @@ jobs:
script: |
const { generateWorkflowOverview } = require('/opt/gh-aw/actions/generate_workflow_overview.cjs');
await generateWorkflowOverview(core);
- name: Create prompt
- name: Create prompt with built-in context
env:
GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
GH_AW_SAFE_OUTPUTS: ${{ env.GH_AW_SAFE_OUTPUTS }}
GH_AW_GITHUB_ACTOR: ${{ github.actor }}
GH_AW_GITHUB_EVENT_COMMENT_ID: ${{ github.event.comment.id }}
GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER: ${{ github.event.discussion.number }}
GH_AW_GITHUB_EVENT_ISSUE_NUMBER: ${{ github.event.issue.number }}
GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER: ${{ github.event.pull_request.number }}
GH_AW_GITHUB_REPOSITORY: ${{ github.repository }}
GH_AW_GITHUB_RUN_ID: ${{ github.run_id }}
GH_AW_GITHUB_WORKSPACE: ${{ github.workspace }}
run: |
bash /opt/gh-aw/actions/create_prompt_first.sh
cat << 'PROMPT_EOF' > "$GH_AW_PROMPT"
<system>
PROMPT_EOF
cat "/opt/gh-aw/prompts/temp_folder_prompt.md" >> "$GH_AW_PROMPT"
cat "/opt/gh-aw/prompts/markdown.md" >> "$GH_AW_PROMPT"
cat << 'PROMPT_EOF' >> "$GH_AW_PROMPT"
---
## Cache Folder Available
You have access to a persistent cache folder at `/tmp/gh-aw/cache-memory/` where you can read and write files to create memories and store information.
- **Read/Write Access**: You can freely read from and write to any files in this folder
- **Persistence**: Files in this folder persist across workflow runs via GitHub Actions cache
- **Last Write Wins**: If multiple processes write to the same file, the last write will be preserved
- **File Share**: Use this as a simple file share - organize files as you see fit
Examples of what you can store:
- `/tmp/gh-aw/cache-memory/notes.txt` - general notes and observations
- `/tmp/gh-aw/cache-memory/preferences.json` - user preferences and settings
- `/tmp/gh-aw/cache-memory/history.log` - activity history and logs
- `/tmp/gh-aw/cache-memory/state/` - organized state files in subdirectories
Feel free to create, read, update, and organize files in this folder as needed for your tasks.
<safe-outputs>
<description>GitHub API Access Instructions</description>
<important>
The gh CLI is NOT authenticated. Do NOT use gh commands for GitHub operations.
</important>
<instructions>
To create or modify GitHub resources (issues, discussions, pull requests, etc.), you MUST call the appropriate safe output tool. Simply writing content will NOT work - the workflow requires actual tool calls.
**Available tools**: create_discussion, missing_tool, noop
**Critical**: Tool calls write structured data that downstream jobs process. Without tool calls, follow-up actions will be skipped.
</instructions>
</safe-outputs>
<github-context>
The following GitHub context information is available for this workflow:
{{#if __GH_AW_GITHUB_ACTOR__ }}
- **actor**: __GH_AW_GITHUB_ACTOR__
{{/if}}
{{#if __GH_AW_GITHUB_REPOSITORY__ }}
- **repository**: __GH_AW_GITHUB_REPOSITORY__
{{/if}}
{{#if __GH_AW_GITHUB_WORKSPACE__ }}
- **workspace**: __GH_AW_GITHUB_WORKSPACE__
{{/if}}
{{#if __GH_AW_GITHUB_EVENT_ISSUE_NUMBER__ }}
- **issue-number**: #__GH_AW_GITHUB_EVENT_ISSUE_NUMBER__
{{/if}}
{{#if __GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER__ }}
- **discussion-number**: #__GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER__
{{/if}}
{{#if __GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER__ }}
- **pull-request-number**: #__GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER__
{{/if}}
{{#if __GH_AW_GITHUB_EVENT_COMMENT_ID__ }}
- **comment-id**: __GH_AW_GITHUB_EVENT_COMMENT_ID__
{{/if}}
{{#if __GH_AW_GITHUB_RUN_ID__ }}
- **workflow-run-id**: __GH_AW_GITHUB_RUN_ID__
{{/if}}
</github-context>
PROMPT_EOF
cat << 'PROMPT_EOF' >> "$GH_AW_PROMPT"
</system>
PROMPT_EOF
cat << 'PROMPT_EOF' >> "$GH_AW_PROMPT"
# Code Conventions Analyzer
You are an expert C++ code quality analyst specializing in the Z3 theorem prover codebase. Your mission is to examine the codebase for consistent coding conventions and identify opportunities to use modern C++ features (C++17, C++20) that can simplify and improve the code.
@ -830,10 +941,6 @@ jobs:
- Examples: [File:line references]
PROMPT_EOF
- name: Append prompt (part 2)
env:
GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
run: |
cat << 'PROMPT_EOF' >> "$GH_AW_PROMPT"
#### 4.1.3 Non-Virtual Destructor Safety Analysis
- **Classes with Virtual Methods but Non-Virtual Destructors**: Potential polymorphism issues
@ -1205,102 +1312,6 @@ jobs:
- Provide actionable recommendations
- Previous discussions created by this workflow will be automatically closed (using `close-older-discussions: true`)
PROMPT_EOF
- name: Append XPIA security instructions to prompt
env:
GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
run: |
cat "/opt/gh-aw/prompts/xpia_prompt.md" >> "$GH_AW_PROMPT"
- name: Append temporary folder instructions to prompt
env:
GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
run: |
cat "/opt/gh-aw/prompts/temp_folder_prompt.md" >> "$GH_AW_PROMPT"
- name: Append cache memory instructions to prompt
env:
GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
run: |
cat << 'PROMPT_EOF' >> "$GH_AW_PROMPT"
---
## Cache Folder Available
You have access to a persistent cache folder at `/tmp/gh-aw/cache-memory/` where you can read and write files to create memories and store information.
- **Read/Write Access**: You can freely read from and write to any files in this folder
- **Persistence**: Files in this folder persist across workflow runs via GitHub Actions cache
- **Last Write Wins**: If multiple processes write to the same file, the last write will be preserved
- **File Share**: Use this as a simple file share - organize files as you see fit
Examples of what you can store:
- `/tmp/gh-aw/cache-memory/notes.txt` - general notes and observations
- `/tmp/gh-aw/cache-memory/preferences.json` - user preferences and settings
- `/tmp/gh-aw/cache-memory/history.log` - activity history and logs
- `/tmp/gh-aw/cache-memory/state/` - organized state files in subdirectories
Feel free to create, read, update, and organize files in this folder as needed for your tasks.
PROMPT_EOF
- name: Append safe outputs instructions to prompt
env:
GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
run: |
cat << 'PROMPT_EOF' >> "$GH_AW_PROMPT"
<safe-outputs>
<description>GitHub API Access Instructions</description>
<important>
The gh CLI is NOT authenticated. Do NOT use gh commands for GitHub operations.
</important>
<instructions>
To create or modify GitHub resources (issues, discussions, pull requests, etc.), you MUST call the appropriate safe output tool. Simply writing content will NOT work - the workflow requires actual tool calls.
**Available tools**: create_discussion, missing_tool, noop
**Critical**: Tool calls write structured data that downstream jobs process. Without tool calls, follow-up actions will be skipped.
</instructions>
</safe-outputs>
PROMPT_EOF
- name: Append GitHub context to prompt
env:
GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
GH_AW_GITHUB_ACTOR: ${{ github.actor }}
GH_AW_GITHUB_EVENT_COMMENT_ID: ${{ github.event.comment.id }}
GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER: ${{ github.event.discussion.number }}
GH_AW_GITHUB_EVENT_ISSUE_NUMBER: ${{ github.event.issue.number }}
GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER: ${{ github.event.pull_request.number }}
GH_AW_GITHUB_REPOSITORY: ${{ github.repository }}
GH_AW_GITHUB_RUN_ID: ${{ github.run_id }}
GH_AW_GITHUB_WORKSPACE: ${{ github.workspace }}
run: |
cat << 'PROMPT_EOF' >> "$GH_AW_PROMPT"
<github-context>
The following GitHub context information is available for this workflow:
{{#if __GH_AW_GITHUB_ACTOR__ }}
- **actor**: __GH_AW_GITHUB_ACTOR__
{{/if}}
{{#if __GH_AW_GITHUB_REPOSITORY__ }}
- **repository**: __GH_AW_GITHUB_REPOSITORY__
{{/if}}
{{#if __GH_AW_GITHUB_WORKSPACE__ }}
- **workspace**: __GH_AW_GITHUB_WORKSPACE__
{{/if}}
{{#if __GH_AW_GITHUB_EVENT_ISSUE_NUMBER__ }}
- **issue-number**: #__GH_AW_GITHUB_EVENT_ISSUE_NUMBER__
{{/if}}
{{#if __GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER__ }}
- **discussion-number**: #__GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER__
{{/if}}
{{#if __GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER__ }}
- **pull-request-number**: #__GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER__
{{/if}}
{{#if __GH_AW_GITHUB_EVENT_COMMENT_ID__ }}
- **comment-id**: __GH_AW_GITHUB_EVENT_COMMENT_ID__
{{/if}}
{{#if __GH_AW_GITHUB_RUN_ID__ }}
- **workflow-run-id**: __GH_AW_GITHUB_RUN_ID__
{{/if}}
</github-context>
PROMPT_EOF
- name: Substitute placeholders
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
@ -1342,6 +1353,10 @@ jobs:
setupGlobals(core, github, context, exec, io);
const { main } = require('/opt/gh-aw/actions/interpolate_prompt.cjs');
await main();
- name: Validate prompt placeholders
env:
GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
run: bash /opt/gh-aw/actions/validate_prompt_placeholders.sh
- name: Print prompt
env:
GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
@ -1371,7 +1386,7 @@ jobs:
timeout-minutes: 20
run: |
set -o pipefail
sudo -E awf --env-all --container-workdir "${GITHUB_WORKSPACE}" --mount /tmp:/tmp:rw --mount "${GITHUB_WORKSPACE}:${GITHUB_WORKSPACE}:rw" --mount /usr/bin/date:/usr/bin/date:ro --mount /usr/bin/gh:/usr/bin/gh:ro --mount /usr/bin/yq:/usr/bin/yq:ro --mount /usr/local/bin/copilot:/usr/local/bin/copilot:ro --mount /home/runner/.copilot:/home/runner/.copilot:rw --mount /opt/gh-aw:/opt/gh-aw:ro --allow-domains api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,github.com,host.docker.internal,raw.githubusercontent.com,registry.npmjs.org --log-level info --proxy-logs-dir /tmp/gh-aw/sandbox/firewall/logs --image-tag 0.8.2 \
sudo -E awf --env-all --container-workdir "${GITHUB_WORKSPACE}" --mount /tmp:/tmp:rw --mount "${GITHUB_WORKSPACE}:${GITHUB_WORKSPACE}:rw" --mount /usr/bin/date:/usr/bin/date:ro --mount /usr/bin/gh:/usr/bin/gh:ro --mount /usr/bin/yq:/usr/bin/yq:ro --mount /usr/local/bin/copilot:/usr/local/bin/copilot:ro --mount /home/runner/.copilot:/home/runner/.copilot:rw --mount /opt/gh-aw:/opt/gh-aw:ro --allow-domains api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,github.com,host.docker.internal,raw.githubusercontent.com,registry.npmjs.org --log-level info --proxy-logs-dir /tmp/gh-aw/sandbox/firewall/logs --enable-host-access --image-tag 0.10.0 \
-- /usr/local/bin/copilot --add-dir /tmp/gh-aw/ --log-level all --log-dir /tmp/gh-aw/sandbox/agent/logs/ --add-dir "${GITHUB_WORKSPACE}" --disable-builtin-mcps --allow-tool github --allow-tool safeoutputs --allow-tool 'shell(cat)' --allow-tool 'shell(clang-format --version)' --allow-tool 'shell(date)' --allow-tool 'shell(echo)' --allow-tool 'shell(git diff:*)' --allow-tool 'shell(git log:*)' --allow-tool 'shell(git show:*)' --allow-tool 'shell(grep)' --allow-tool 'shell(head)' --allow-tool 'shell(ls)' --allow-tool 'shell(pwd)' --allow-tool 'shell(sort)' --allow-tool 'shell(tail)' --allow-tool 'shell(uniq)' --allow-tool 'shell(wc)' --allow-tool 'shell(yq)' --allow-tool write --add-dir /tmp/gh-aw/cache-memory/ --allow-all-paths --share /tmp/gh-aw/sandbox/agent/logs/conversation.md --prompt "$(cat /tmp/gh-aw/aw-prompts/prompt.txt)"${GH_AW_MODEL_AGENT_COPILOT:+ --model "$GH_AW_MODEL_AGENT_COPILOT"} \
2>&1 | tee /tmp/gh-aw/agent-stdio.log
env:
@ -1382,7 +1397,6 @@ jobs:
GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
GH_AW_SAFE_OUTPUTS: ${{ env.GH_AW_SAFE_OUTPUTS }}
GITHUB_HEAD_REF: ${{ github.head_ref }}
GITHUB_MCP_SERVER_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
GITHUB_REF_NAME: ${{ github.ref_name }}
GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }}
GITHUB_WORKSPACE: ${{ github.workspace }}
@ -1404,6 +1418,15 @@ jobs:
else
echo "No session-state directory found at $SESSION_STATE_DIR"
fi
- name: Stop MCP gateway
if: always()
continue-on-error: true
env:
MCP_GATEWAY_PORT: ${{ steps.start-mcp-gateway.outputs.gateway-port }}
MCP_GATEWAY_API_KEY: ${{ steps.start-mcp-gateway.outputs.gateway-api-key }}
GATEWAY_PID: ${{ steps.start-mcp-gateway.outputs.gateway-pid }}
run: |
bash /opt/gh-aw/actions/stop_mcp_gateway.sh "$GATEWAY_PID"
- name: Redact secrets in logs
if: always()
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
@ -1466,12 +1489,25 @@ jobs:
setupGlobals(core, github, context, exec, io);
const { main } = require('/opt/gh-aw/actions/parse_copilot_log.cjs');
await main();
- name: Firewall summary
- name: Parse MCP gateway logs for step summary
if: always()
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
with:
script: |
const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
setupGlobals(core, github, context, exec, io);
const { main } = require('/opt/gh-aw/actions/parse_mcp_gateway_log.cjs');
await main();
- name: Print firewall logs
if: always()
continue-on-error: true
env:
AWF_LOGS_DIR: /tmp/gh-aw/sandbox/firewall/logs
run: awf logs summary >> $GITHUB_STEP_SUMMARY
run: |
# Fix permissions on firewall logs so they can be uploaded as artifacts
# AWF runs with sudo, creating files owned by root
sudo chmod -R a+r /tmp/gh-aw/sandbox/firewall/logs 2>/dev/null || true
awf logs summary | tee -a "$GITHUB_STEP_SUMMARY"
- name: Upload cache-memory data as artifact
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
if: always()
@ -1528,7 +1564,7 @@ jobs:
echo "Agent Conclusion: $AGENT_CONCLUSION"
- name: Download agent output artifact
continue-on-error: true
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
with:
name: agent-output
path: /tmp/gh-aw/safeoutputs/
@ -1566,6 +1602,22 @@ jobs:
setupGlobals(core, github, context, exec, io);
const { main } = require('/opt/gh-aw/actions/missing_tool.cjs');
await main();
- name: Handle Agent Failure
id: handle_agent_failure
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
env:
GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
GH_AW_WORKFLOW_NAME: "Code Conventions Analyzer"
GH_AW_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }}
GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.agent.outputs.secret_verification_result }}
with:
github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
script: |
const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
setupGlobals(core, github, context, exec, io);
const { main } = require('/opt/gh-aw/actions/handle_agent_failure.cjs');
await main();
- name: Update reaction comment with completion status
id: conclusion
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
@ -1602,13 +1654,13 @@ jobs:
destination: /opt/gh-aw/actions
- name: Download agent artifacts
continue-on-error: true
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
with:
name: agent-artifacts
path: /tmp/gh-aw/threat-detection/
- name: Download agent output artifact
continue-on-error: true
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
with:
name: agent-output
path: /tmp/gh-aw/threat-detection/
@ -1676,7 +1728,8 @@ jobs:
mkdir -p /tmp/gh-aw/threat-detection
touch /tmp/gh-aw/threat-detection/detection.log
- name: Validate COPILOT_GITHUB_TOKEN secret
run: /opt/gh-aw/actions/validate_multi_secret.sh COPILOT_GITHUB_TOKEN GitHub Copilot CLI https://githubnext.github.io/gh-aw/reference/engines/#github-copilot-default
id: validate-secret
run: /opt/gh-aw/actions/validate_multi_secret.sh COPILOT_GITHUB_TOKEN 'GitHub Copilot CLI' https://githubnext.github.io/gh-aw/reference/engines/#github-copilot-default
env:
COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
- name: Install GitHub Copilot CLI
@ -1685,7 +1738,8 @@ jobs:
curl -fsSL https://raw.githubusercontent.com/github/copilot-cli/main/install.sh -o /tmp/copilot-install.sh
# Execute the installer with the specified version
export VERSION=0.0.375 && sudo bash /tmp/copilot-install.sh
# Pass VERSION directly to sudo to ensure it's available to the installer script
sudo VERSION=0.0.387 bash /tmp/copilot-install.sh
# Cleanup
rm -f /tmp/copilot-install.sh
@ -1762,7 +1816,7 @@ jobs:
destination: /opt/gh-aw/actions
- name: Download agent output artifact
continue-on-error: true
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
with:
name: agent-output
path: /tmp/gh-aw/safeoutputs/
@ -1776,7 +1830,7 @@ jobs:
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
env:
GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"create_discussion\":{\"category\":\"Agentic Workflows\",\"close_older_discussions\":true,\"expires\":168,\"max\":1,\"title_prefix\":\"Code Conventions Analysis\"}}"
GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"create_discussion\":{\"category\":\"Agentic Workflows\",\"close_older_discussions\":true,\"expires\":168,\"max\":1,\"title_prefix\":\"Code Conventions Analysis\"},\"missing_data\":{},\"missing_tool\":{}}"
with:
github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
script: |
@ -1798,13 +1852,13 @@ jobs:
with:
destination: /opt/gh-aw/actions
- name: Download cache-memory artifact (default)
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
continue-on-error: true
with:
name: cache-memory
path: /tmp/gh-aw/cache-memory
- name: Save cache-memory to cache (default)
uses: actions/cache/save@8b402f58fbc84540c8b491a91e594a4576fec3d7 # v5.0.2
uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
with:
key: memory-${{ github.workflow }}-${{ github.run_id }}
path: /tmp/gh-aw/cache-memory

3
.github/workflows/code-conventions-analyzer.md vendored
View file

@ -9,7 +9,6 @@ tools:
github:
toolsets: [default]
view: {}
grep: {}
glob: {}
bash:
- "clang-format --version"
@ -803,4 +802,4 @@ grep pattern: "catch.*continue|catch.*break" glob: "src/**/*.cpp"
- Use the structured format above
- Include specific file references for all examples
- Provide actionable recommendations
- Previous discussions created by this workflow will be automatically closed (using `close-older-discussions: true`)
- Previous discussions created by this workflow will be automatically closed (using `close-older-discussions: true`)

362
.github/workflows/release-notes-updater.lock.yml generated vendored
View file

@ -13,7 +13,7 @@
# \ /\ / (_) | | | | ( | | | | (_) \ V V /\__ \
# \/ \/ \___/|_| |_|\_\|_| |_|\___/ \_/\_/ |___/
#
# This file was automatically generated by gh-aw (v0.36.0). DO NOT EDIT.
# This file was automatically generated by gh-aw (v0.37.0). DO NOT EDIT.
#
# To update this file, edit the corresponding .md file and run:
# gh aw compile
@ -28,7 +28,7 @@ name: "Release Notes Updater"
# Friendly format: weekly (scattered)
workflow_dispatch:
permissions: read-all
permissions: {}
concurrency:
group: "gh-aw-${{ github.workflow }}"
@ -66,6 +66,10 @@ jobs:
concurrency:
group: "gh-aw-copilot-${{ github.workflow }}"
env:
DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
GH_AW_ASSETS_ALLOWED_EXTS: ""
GH_AW_ASSETS_BRANCH: ""
GH_AW_ASSETS_MAX_SIZE_KB: 0
GH_AW_MCP_LOG_DIR: /tmp/gh-aw/mcp-logs/safeoutputs
GH_AW_SAFE_OUTPUTS: /tmp/gh-aw/safeoutputs/outputs.jsonl
GH_AW_SAFE_OUTPUTS_CONFIG_PATH: /opt/gh-aw/safeoutputs/config.json
@ -75,6 +79,7 @@ jobs:
model: ${{ steps.generate_aw_info.outputs.model }}
output: ${{ steps.collect_output.outputs.output }}
output_types: ${{ steps.collect_output.outputs.output_types }}
secret_verification_result: ${{ steps.validate-secret.outputs.verification_result }}
steps:
- name: Setup Scripts
uses: githubnext/gh-aw/actions/setup@v0.37.0
@ -83,7 +88,7 @@ jobs:
- name: Create gh-aw temp directory
run: bash /opt/gh-aw/actions/create_gh_aw_tmp_dir.sh
- name: Checkout repository
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
with:
fetch-depth: 0
@ -112,7 +117,8 @@ jobs:
const { main } = require('/opt/gh-aw/actions/checkout_pr_branch.cjs');
await main();
- name: Validate COPILOT_GITHUB_TOKEN secret
run: /opt/gh-aw/actions/validate_multi_secret.sh COPILOT_GITHUB_TOKEN GitHub Copilot CLI https://githubnext.github.io/gh-aw/reference/engines/#github-copilot-default
id: validate-secret
run: /opt/gh-aw/actions/validate_multi_secret.sh COPILOT_GITHUB_TOKEN 'GitHub Copilot CLI' https://githubnext.github.io/gh-aw/reference/engines/#github-copilot-default
env:
COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
- name: Install GitHub Copilot CLI
@ -121,7 +127,8 @@ jobs:
curl -fsSL https://raw.githubusercontent.com/github/copilot-cli/main/install.sh -o /tmp/copilot-install.sh
# Execute the installer with the specified version
export VERSION=0.0.375 && sudo bash /tmp/copilot-install.sh
# Pass VERSION directly to sudo to ensure it's available to the installer script
sudo VERSION=0.0.387 bash /tmp/copilot-install.sh
# Cleanup
rm -f /tmp/copilot-install.sh
@ -129,23 +136,19 @@ jobs:
# Verify installation
copilot --version
- name: Install awf binary
run: |
echo "Installing awf via installer script (requested version: v0.8.2)"
curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.8.2 bash
which awf
awf --version
run: bash /opt/gh-aw/actions/install_awf_binary.sh v0.10.0
- name: Determine automatic lockdown mode for GitHub MCP server
id: determine-automatic-lockdown
env:
TOKEN_CHECK: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN }}
if: env.TOKEN_CHECK != ''
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
with:
script: |
const determineAutomaticLockdown = require('/opt/gh-aw/actions/determine_automatic_lockdown.cjs');
await determineAutomaticLockdown(github, context, core);
- name: Downloading container images
run: bash /opt/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.27.0
- name: Download container images
run: bash /opt/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.29.0 ghcr.io/githubnext/gh-aw-mcpg:v0.0.71 node:lts-alpine
- name: Write Safe Outputs Config
run: |
mkdir -p /opt/gh-aw/safeoutputs
@ -183,7 +186,7 @@ jobs:
"name": "create_discussion"
},
{
"description": "Report that a tool or capability needed to complete the task is not available. Use this when you cannot accomplish what was requested because the required functionality is missing or access is restricted.",
"description": "Report that a tool or capability needed to complete the task is not available, or share any information you deem important about missing functionality or limitations. Use this when you cannot accomplish what was requested because the required functionality is missing or access is restricted.",
"inputSchema": {
"additionalProperties": false,
"properties": {
@ -192,16 +195,15 @@ jobs:
"type": "string"
},
"reason": {
"description": "Explanation of why this tool is needed to complete the task (max 256 characters).",
"description": "Explanation of why this tool is needed or what information you want to share about the limitation (max 256 characters).",
"type": "string"
},
"tool": {
"description": "Name or description of the missing tool or capability (max 128 characters). Be specific about what functionality is needed.",
"description": "Optional: Name or description of the missing tool or capability (max 128 characters). Be specific about what functionality is needed.",
"type": "string"
}
},
"required": [
"tool",
"reason"
],
"type": "object"
@ -224,6 +226,33 @@ jobs:
"type": "object"
},
"name": "noop"
},
{
"description": "Report that data or information needed to complete the task is not available. Use this when you cannot accomplish what was requested because required data, context, or information is missing.",
"inputSchema": {
"additionalProperties": false,
"properties": {
"alternatives": {
"description": "Any workarounds, manual steps, or alternative approaches the user could take (max 256 characters).",
"type": "string"
},
"context": {
"description": "Additional context about the missing data or where it should come from (max 256 characters).",
"type": "string"
},
"data_type": {
"description": "Type or description of the missing data or information (max 128 characters). Be specific about what data is needed.",
"type": "string"
},
"reason": {
"description": "Explanation of why this data is needed to complete the task (max 256 characters).",
"type": "string"
}
},
"required": [],
"type": "object"
},
"name": "missing_data"
}
]
EOF
@ -290,44 +319,48 @@ jobs:
}
}
EOF
- name: Setup MCPs
- name: Start MCP gateway
id: start-mcp-gateway
env:
GH_AW_SAFE_OUTPUTS: ${{ env.GH_AW_SAFE_OUTPUTS }}
GITHUB_MCP_LOCKDOWN: ${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}
GITHUB_MCP_SERVER_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
run: |
set -eo pipefail
mkdir -p /tmp/gh-aw/mcp-config
# Export gateway environment variables for MCP config and gateway script
export MCP_GATEWAY_PORT="80"
export MCP_GATEWAY_DOMAIN="host.docker.internal"
MCP_GATEWAY_API_KEY=""
MCP_GATEWAY_API_KEY=$(openssl rand -base64 45 | tr -d '/+=')
export MCP_GATEWAY_API_KEY
# Register API key as secret to mask it from logs
echo "::add-mask::${MCP_GATEWAY_API_KEY}"
export GH_AW_ENGINE="copilot"
export MCP_GATEWAY_DOCKER_COMMAND='docker run -i --rm --network host -v /var/run/docker.sock:/var/run/docker.sock -e MCP_GATEWAY_PORT -e MCP_GATEWAY_DOMAIN -e MCP_GATEWAY_API_KEY -e DEBUG="*" -e MCP_GATEWAY_LOG_DIR -e GH_AW_MCP_LOG_DIR -e GH_AW_SAFE_OUTPUTS -e GH_AW_SAFE_OUTPUTS_CONFIG_PATH -e GH_AW_SAFE_OUTPUTS_TOOLS_PATH -e GH_AW_ASSETS_BRANCH -e GH_AW_ASSETS_MAX_SIZE_KB -e GH_AW_ASSETS_ALLOWED_EXTS -e DEFAULT_BRANCH -e GITHUB_MCP_SERVER_TOKEN -e GITHUB_MCP_LOCKDOWN -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e GITHUB_SHA -e GITHUB_WORKSPACE -e GITHUB_TOKEN -v /opt:/opt:ro -v /tmp:/tmp:rw -v '"${GITHUB_WORKSPACE}"':'"${GITHUB_WORKSPACE}"':rw ghcr.io/githubnext/gh-aw-mcpg:v0.0.71'
mkdir -p /home/runner/.copilot
cat > /home/runner/.copilot/mcp-config.json << EOF
cat << MCPCONFIG_EOF | bash /opt/gh-aw/actions/start_mcp_gateway.sh
{
"mcpServers": {
"github": {
"type": "local",
"command": "docker",
"args": [
"run",
"-i",
"--rm",
"-e",
"GITHUB_PERSONAL_ACCESS_TOKEN",
"-e",
"GITHUB_READ_ONLY=1",
"-e",
"GITHUB_LOCKDOWN_MODE=$GITHUB_MCP_LOCKDOWN",
"-e",
"GITHUB_TOOLSETS=context,repos,issues,pull_requests",
"ghcr.io/github/github-mcp-server:v0.27.0"
],
"tools": ["*"],
"type": "stdio",
"container": "ghcr.io/github/github-mcp-server:v0.29.0",
"env": {
"GITHUB_PERSONAL_ACCESS_TOKEN": "\${GITHUB_MCP_SERVER_TOKEN}"
"GITHUB_LOCKDOWN_MODE": "$GITHUB_MCP_LOCKDOWN",
"GITHUB_PERSONAL_ACCESS_TOKEN": "\${GITHUB_MCP_SERVER_TOKEN}",
"GITHUB_READ_ONLY": "1",
"GITHUB_TOOLSETS": "context,repos,issues,pull_requests"
}
},
"safeoutputs": {
"type": "local",
"command": "node",
"args": ["/opt/gh-aw/safeoutputs/mcp-server.cjs"],
"tools": ["*"],
"type": "stdio",
"container": "node:lts-alpine",
"entrypoint": "node",
"entrypointArgs": ["/opt/gh-aw/safeoutputs/mcp-server.cjs"],
"mounts": ["/opt/gh-aw:/opt/gh-aw:ro", "/tmp/gh-aw:/tmp/gh-aw:rw"],
"env": {
"GH_AW_MCP_LOG_DIR": "\${GH_AW_MCP_LOG_DIR}",
"GH_AW_SAFE_OUTPUTS": "\${GH_AW_SAFE_OUTPUTS}",
@ -343,16 +376,14 @@ jobs:
"DEFAULT_BRANCH": "\${DEFAULT_BRANCH}"
}
}
},
"gateway": {
"port": $MCP_GATEWAY_PORT,
"domain": "${MCP_GATEWAY_DOMAIN}",
"apiKey": "${MCP_GATEWAY_API_KEY}"
}
}
EOF
echo "-------START MCP CONFIG-----------"
cat /home/runner/.copilot/mcp-config.json
echo "-------END MCP CONFIG-----------"
echo "-------/home/runner/.copilot-----------"
find /home/runner/.copilot
echo "HOME: $HOME"
echo "GITHUB_COPILOT_CLI_MODE: $GITHUB_COPILOT_CLI_MODE"
MCPCONFIG_EOF
- name: Generate agentic run info
id: generate_aw_info
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
@ -365,8 +396,8 @@ jobs:
engine_name: "GitHub Copilot CLI",
model: process.env.GH_AW_MODEL_AGENT_COPILOT || "",
version: "",
agent_version: "0.0.375",
cli_version: "v0.36.0",
agent_version: "0.0.387",
cli_version: "v0.37.0",
workflow_name: "Release Notes Updater",
experimental: false,
supports_tools_allowlist: true,
@ -383,7 +414,8 @@ jobs:
network_mode: "defaults",
allowed_domains: [],
firewall_enabled: true,
awf_version: "v0.8.2",
awf_version: "v0.10.0",
awmg_version: "v0.0.71",
steps: {
firewall: "squid"
},
@ -404,15 +436,73 @@ jobs:
script: |
const { generateWorkflowOverview } = require('/opt/gh-aw/actions/generate_workflow_overview.cjs');
await generateWorkflowOverview(core);
- name: Create prompt
- name: Create prompt with built-in context
env:
GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
GH_AW_SAFE_OUTPUTS: ${{ env.GH_AW_SAFE_OUTPUTS }}
GH_AW_GITHUB_ACTOR: ${{ github.actor }}
GH_AW_GITHUB_EVENT_COMMENT_ID: ${{ github.event.comment.id }}
GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER: ${{ github.event.discussion.number }}
GH_AW_GITHUB_EVENT_ISSUE_NUMBER: ${{ github.event.issue.number }}
GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER: ${{ github.event.pull_request.number }}
GH_AW_GITHUB_REPOSITORY: ${{ github.repository }}
GH_AW_GITHUB_RUN_ID: ${{ github.run_id }}
GH_AW_GITHUB_WORKFLOW: ${{ github.workflow }}
GH_AW_GITHUB_WORKSPACE: ${{ github.workspace }}
run: |
bash /opt/gh-aw/actions/create_prompt_first.sh
cat << 'PROMPT_EOF' > "$GH_AW_PROMPT"
<system>
PROMPT_EOF
cat "/opt/gh-aw/prompts/temp_folder_prompt.md" >> "$GH_AW_PROMPT"
cat "/opt/gh-aw/prompts/markdown.md" >> "$GH_AW_PROMPT"
cat << 'PROMPT_EOF' >> "$GH_AW_PROMPT"
<safe-outputs>
<description>GitHub API Access Instructions</description>
<important>
The gh CLI is NOT authenticated. Do NOT use gh commands for GitHub operations.
</important>
<instructions>
To create or modify GitHub resources (issues, discussions, pull requests, etc.), you MUST call the appropriate safe output tool. Simply writing content will NOT work - the workflow requires actual tool calls.
**Available tools**: create_discussion, missing_tool, noop
**Critical**: Tool calls write structured data that downstream jobs process. Without tool calls, follow-up actions will be skipped.
</instructions>
</safe-outputs>
<github-context>
The following GitHub context information is available for this workflow:
{{#if __GH_AW_GITHUB_ACTOR__ }}
- **actor**: __GH_AW_GITHUB_ACTOR__
{{/if}}
{{#if __GH_AW_GITHUB_REPOSITORY__ }}
- **repository**: __GH_AW_GITHUB_REPOSITORY__
{{/if}}
{{#if __GH_AW_GITHUB_WORKSPACE__ }}
- **workspace**: __GH_AW_GITHUB_WORKSPACE__
{{/if}}
{{#if __GH_AW_GITHUB_EVENT_ISSUE_NUMBER__ }}
- **issue-number**: #__GH_AW_GITHUB_EVENT_ISSUE_NUMBER__
{{/if}}
{{#if __GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER__ }}
- **discussion-number**: #__GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER__
{{/if}}
{{#if __GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER__ }}
- **pull-request-number**: #__GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER__
{{/if}}
{{#if __GH_AW_GITHUB_EVENT_COMMENT_ID__ }}
- **comment-id**: __GH_AW_GITHUB_EVENT_COMMENT_ID__
{{/if}}
{{#if __GH_AW_GITHUB_RUN_ID__ }}
- **workflow-run-id**: __GH_AW_GITHUB_RUN_ID__
{{/if}}
</github-context>
PROMPT_EOF
cat << 'PROMPT_EOF' >> "$GH_AW_PROMPT"
</system>
PROMPT_EOF
cat << 'PROMPT_EOF' >> "$GH_AW_PROMPT"
# Release Notes Updater
## Job Description
@ -601,102 +691,14 @@ jobs:
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
env:
GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
GH_AW_GITHUB_ACTOR: ${{ github.actor }}
GH_AW_GITHUB_EVENT_COMMENT_ID: ${{ github.event.comment.id }}
GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER: ${{ github.event.discussion.number }}
GH_AW_GITHUB_EVENT_ISSUE_NUMBER: ${{ github.event.issue.number }}
GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER: ${{ github.event.pull_request.number }}
GH_AW_GITHUB_REPOSITORY: ${{ github.repository }}
GH_AW_GITHUB_RUN_ID: ${{ github.run_id }}
GH_AW_GITHUB_WORKFLOW: ${{ github.workflow }}
with:
script: |
const substitutePlaceholders = require('/opt/gh-aw/actions/substitute_placeholders.cjs');
// Call the substitution function
return await substitutePlaceholders({
file: process.env.GH_AW_PROMPT,
substitutions: {
GH_AW_GITHUB_REPOSITORY: process.env.GH_AW_GITHUB_REPOSITORY,
GH_AW_GITHUB_WORKFLOW: process.env.GH_AW_GITHUB_WORKFLOW
}
});
- name: Append XPIA security instructions to prompt
env:
GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
run: |
cat "/opt/gh-aw/prompts/xpia_prompt.md" >> "$GH_AW_PROMPT"
- name: Append temporary folder instructions to prompt
env:
GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
run: |
cat "/opt/gh-aw/prompts/temp_folder_prompt.md" >> "$GH_AW_PROMPT"
- name: Append safe outputs instructions to prompt
env:
GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
run: |
cat << 'PROMPT_EOF' >> "$GH_AW_PROMPT"
<safe-outputs>
<description>GitHub API Access Instructions</description>
<important>
The gh CLI is NOT authenticated. Do NOT use gh commands for GitHub operations.
</important>
<instructions>
To create or modify GitHub resources (issues, discussions, pull requests, etc.), you MUST call the appropriate safe output tool. Simply writing content will NOT work - the workflow requires actual tool calls.
**Available tools**: create_discussion, missing_tool, noop
**Critical**: Tool calls write structured data that downstream jobs process. Without tool calls, follow-up actions will be skipped.
</instructions>
</safe-outputs>
PROMPT_EOF
- name: Append GitHub context to prompt
env:
GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
GH_AW_GITHUB_ACTOR: ${{ github.actor }}
GH_AW_GITHUB_EVENT_COMMENT_ID: ${{ github.event.comment.id }}
GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER: ${{ github.event.discussion.number }}
GH_AW_GITHUB_EVENT_ISSUE_NUMBER: ${{ github.event.issue.number }}
GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER: ${{ github.event.pull_request.number }}
GH_AW_GITHUB_REPOSITORY: ${{ github.repository }}
GH_AW_GITHUB_RUN_ID: ${{ github.run_id }}
GH_AW_GITHUB_WORKSPACE: ${{ github.workspace }}
run: |
cat << 'PROMPT_EOF' >> "$GH_AW_PROMPT"
<github-context>
The following GitHub context information is available for this workflow:
{{#if __GH_AW_GITHUB_ACTOR__ }}
- **actor**: __GH_AW_GITHUB_ACTOR__
{{/if}}
{{#if __GH_AW_GITHUB_REPOSITORY__ }}
- **repository**: __GH_AW_GITHUB_REPOSITORY__
{{/if}}
{{#if __GH_AW_GITHUB_WORKSPACE__ }}
- **workspace**: __GH_AW_GITHUB_WORKSPACE__
{{/if}}
{{#if __GH_AW_GITHUB_EVENT_ISSUE_NUMBER__ }}
- **issue-number**: #__GH_AW_GITHUB_EVENT_ISSUE_NUMBER__
{{/if}}
{{#if __GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER__ }}
- **discussion-number**: #__GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER__
{{/if}}
{{#if __GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER__ }}
- **pull-request-number**: #__GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER__
{{/if}}
{{#if __GH_AW_GITHUB_EVENT_COMMENT_ID__ }}
- **comment-id**: __GH_AW_GITHUB_EVENT_COMMENT_ID__
{{/if}}
{{#if __GH_AW_GITHUB_RUN_ID__ }}
- **workflow-run-id**: __GH_AW_GITHUB_RUN_ID__
{{/if}}
</github-context>
PROMPT_EOF
- name: Substitute placeholders
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
env:
GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
GH_AW_GITHUB_ACTOR: ${{ github.actor }}
GH_AW_GITHUB_EVENT_COMMENT_ID: ${{ github.event.comment.id }}
GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER: ${{ github.event.discussion.number }}
GH_AW_GITHUB_EVENT_ISSUE_NUMBER: ${{ github.event.issue.number }}
GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER: ${{ github.event.pull_request.number }}
GH_AW_GITHUB_REPOSITORY: ${{ github.repository }}
GH_AW_GITHUB_RUN_ID: ${{ github.run_id }}
GH_AW_GITHUB_WORKSPACE: ${{ github.workspace }}
with:
script: |
@ -713,6 +715,7 @@ jobs:
GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER: process.env.GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER,
GH_AW_GITHUB_REPOSITORY: process.env.GH_AW_GITHUB_REPOSITORY,
GH_AW_GITHUB_RUN_ID: process.env.GH_AW_GITHUB_RUN_ID,
GH_AW_GITHUB_WORKFLOW: process.env.GH_AW_GITHUB_WORKFLOW,
GH_AW_GITHUB_WORKSPACE: process.env.GH_AW_GITHUB_WORKSPACE
}
});
@ -728,6 +731,10 @@ jobs:
setupGlobals(core, github, context, exec, io);
const { main } = require('/opt/gh-aw/actions/interpolate_prompt.cjs');
await main();
- name: Validate prompt placeholders
env:
GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
run: bash /opt/gh-aw/actions/validate_prompt_placeholders.sh
- name: Print prompt
env:
GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
@ -738,7 +745,7 @@ jobs:
timeout-minutes: 30
run: |
set -o pipefail
sudo -E awf --env-all --container-workdir "${GITHUB_WORKSPACE}" --mount /tmp:/tmp:rw --mount "${GITHUB_WORKSPACE}:${GITHUB_WORKSPACE}:rw" --mount /usr/bin/date:/usr/bin/date:ro --mount /usr/bin/gh:/usr/bin/gh:ro --mount /usr/bin/yq:/usr/bin/yq:ro --mount /usr/local/bin/copilot:/usr/local/bin/copilot:ro --mount /home/runner/.copilot:/home/runner/.copilot:rw --mount /opt/gh-aw:/opt/gh-aw:ro --allow-domains api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,github.com,host.docker.internal,raw.githubusercontent.com,registry.npmjs.org --log-level info --proxy-logs-dir /tmp/gh-aw/sandbox/firewall/logs --image-tag 0.8.2 \
sudo -E awf --env-all --container-workdir "${GITHUB_WORKSPACE}" --mount /tmp:/tmp:rw --mount "${GITHUB_WORKSPACE}:${GITHUB_WORKSPACE}:rw" --mount /usr/bin/date:/usr/bin/date:ro --mount /usr/bin/gh:/usr/bin/gh:ro --mount /usr/bin/yq:/usr/bin/yq:ro --mount /usr/local/bin/copilot:/usr/local/bin/copilot:ro --mount /home/runner/.copilot:/home/runner/.copilot:rw --mount /opt/gh-aw:/opt/gh-aw:ro --allow-domains api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,github.com,host.docker.internal,raw.githubusercontent.com,registry.npmjs.org --log-level info --proxy-logs-dir /tmp/gh-aw/sandbox/firewall/logs --enable-host-access --image-tag 0.10.0 \
-- /usr/local/bin/copilot --add-dir /tmp/gh-aw/ --log-level all --log-dir /tmp/gh-aw/sandbox/agent/logs/ --add-dir "${GITHUB_WORKSPACE}" --disable-builtin-mcps --allow-all-tools --allow-all-paths --share /tmp/gh-aw/sandbox/agent/logs/conversation.md --prompt "$(cat /tmp/gh-aw/aw-prompts/prompt.txt)"${GH_AW_MODEL_AGENT_COPILOT:+ --model "$GH_AW_MODEL_AGENT_COPILOT"} \
2>&1 | tee /tmp/gh-aw/agent-stdio.log
env:
@ -749,7 +756,6 @@ jobs:
GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
GH_AW_SAFE_OUTPUTS: ${{ env.GH_AW_SAFE_OUTPUTS }}
GITHUB_HEAD_REF: ${{ github.head_ref }}
GITHUB_MCP_SERVER_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
GITHUB_REF_NAME: ${{ github.ref_name }}
GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }}
GITHUB_WORKSPACE: ${{ github.workspace }}
@ -771,6 +777,15 @@ jobs:
else
echo "No session-state directory found at $SESSION_STATE_DIR"
fi
- name: Stop MCP gateway
if: always()
continue-on-error: true
env:
MCP_GATEWAY_PORT: ${{ steps.start-mcp-gateway.outputs.gateway-port }}
MCP_GATEWAY_API_KEY: ${{ steps.start-mcp-gateway.outputs.gateway-api-key }}
GATEWAY_PID: ${{ steps.start-mcp-gateway.outputs.gateway-pid }}
run: |
bash /opt/gh-aw/actions/stop_mcp_gateway.sh "$GATEWAY_PID"
- name: Redact secrets in logs
if: always()
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
@ -833,12 +848,25 @@ jobs:
setupGlobals(core, github, context, exec, io);
const { main } = require('/opt/gh-aw/actions/parse_copilot_log.cjs');
await main();
- name: Firewall summary
- name: Parse MCP gateway logs for step summary
if: always()
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
with:
script: |
const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
setupGlobals(core, github, context, exec, io);
const { main } = require('/opt/gh-aw/actions/parse_mcp_gateway_log.cjs');
await main();
- name: Print firewall logs
if: always()
continue-on-error: true
env:
AWF_LOGS_DIR: /tmp/gh-aw/sandbox/firewall/logs
run: awf logs summary >> $GITHUB_STEP_SUMMARY
run: |
# Fix permissions on firewall logs so they can be uploaded as artifacts
# AWF runs with sudo, creating files owned by root
sudo chmod -R a+r /tmp/gh-aw/sandbox/firewall/logs 2>/dev/null || true
awf logs summary | tee -a "$GITHUB_STEP_SUMMARY"
- name: Upload agent artifacts
if: always()
continue-on-error: true
@ -888,7 +916,7 @@ jobs:
echo "Agent Conclusion: $AGENT_CONCLUSION"
- name: Download agent output artifact
continue-on-error: true
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
with:
name: agent-output
path: /tmp/gh-aw/safeoutputs/
@ -924,6 +952,22 @@ jobs:
setupGlobals(core, github, context, exec, io);
const { main } = require('/opt/gh-aw/actions/missing_tool.cjs');
await main();
- name: Handle Agent Failure
id: handle_agent_failure
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
env:
GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
GH_AW_WORKFLOW_NAME: "Release Notes Updater"
GH_AW_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }}
GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.agent.outputs.secret_verification_result }}
with:
github-token: ${{ secrets.GITHUB_TOKEN }}
script: |
const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
setupGlobals(core, github, context, exec, io);
const { main } = require('/opt/gh-aw/actions/handle_agent_failure.cjs');
await main();
- name: Update reaction comment with completion status
id: conclusion
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
@ -960,13 +1004,13 @@ jobs:
destination: /opt/gh-aw/actions
- name: Download agent artifacts
continue-on-error: true
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
with:
name: agent-artifacts
path: /tmp/gh-aw/threat-detection/
- name: Download agent output artifact
continue-on-error: true
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
with:
name: agent-output
path: /tmp/gh-aw/threat-detection/
@ -1034,7 +1078,8 @@ jobs:
mkdir -p /tmp/gh-aw/threat-detection
touch /tmp/gh-aw/threat-detection/detection.log
- name: Validate COPILOT_GITHUB_TOKEN secret
run: /opt/gh-aw/actions/validate_multi_secret.sh COPILOT_GITHUB_TOKEN GitHub Copilot CLI https://githubnext.github.io/gh-aw/reference/engines/#github-copilot-default
id: validate-secret
run: /opt/gh-aw/actions/validate_multi_secret.sh COPILOT_GITHUB_TOKEN 'GitHub Copilot CLI' https://githubnext.github.io/gh-aw/reference/engines/#github-copilot-default
env:
COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
- name: Install GitHub Copilot CLI
@ -1043,7 +1088,8 @@ jobs:
curl -fsSL https://raw.githubusercontent.com/github/copilot-cli/main/install.sh -o /tmp/copilot-install.sh
# Execute the installer with the specified version
export VERSION=0.0.375 && sudo bash /tmp/copilot-install.sh
# Pass VERSION directly to sudo to ensure it's available to the installer script
sudo VERSION=0.0.387 bash /tmp/copilot-install.sh
# Cleanup
rm -f /tmp/copilot-install.sh
@ -1120,7 +1166,7 @@ jobs:
destination: /opt/gh-aw/actions
- name: Download agent output artifact
continue-on-error: true
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
with:
name: agent-output
path: /tmp/gh-aw/safeoutputs/
@ -1134,7 +1180,7 @@ jobs:
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
env:
GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"create_discussion\":{\"category\":\"Announcements\",\"expires\":168,\"max\":1,\"title_prefix\":\"[Release Notes] \"}}"
GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"create_discussion\":{\"category\":\"Announcements\",\"expires\":168,\"max\":1,\"title_prefix\":\"[Release Notes] \"},\"missing_data\":{},\"missing_tool\":{}}"
with:
github-token: ${{ secrets.GITHUB_TOKEN }}
script: |

3
.github/workflows/release-notes-updater.md vendored
View file

@ -16,7 +16,6 @@ tools:
toolsets: [default]
bash: [":*"]
edit: {}
grep: {}
glob: {}
view: {}
@ -216,4 +215,4 @@ If there are NO substantial changes since the last release:
4. Analyze each commit to determine if substantial
5. Format the changes following existing style
6. Check for existing discussions
7. Create discussion with the release notes analysis and formatted content
7. Create discussion with the release notes analysis and formatted content