mirror of
https://github.com/Z3Prover/z3
synced 2026-01-27 12:28:43 +00:00
Recompile agentic workflows to gh-aw v0.37.19 (#8323)
* Initial plan * Initial plan: Recompile agentic workflows to latest gh-aw version Co-authored-by: NikolajBjorner <3085284+NikolajBjorner@users.noreply.github.com> * Update gh-aw instruction files with latest features Co-authored-by: NikolajBjorner <3085284+NikolajBjorner@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: NikolajBjorner <3085284+NikolajBjorner@users.noreply.github.com>
This commit is contained in:
Copilot
GitHub
parent
c88c781f3b
commit
d87aa87ae4
11 changed files with 168 additions and 431 deletions
285
.github/agents/upgrade-agentic-workflows.md
vendored
285
.github/agents/upgrade-agentic-workflows.md
vendored
|
|
@ -1,285 +0,0 @@
|
|||
---
|
||||
description: Upgrade agentic workflows to the latest version of gh-aw with automated compilation and error fixing
|
||||
infer: false
|
||||
---
|
||||
|
||||
You are specialized in **upgrading GitHub Agentic Workflows (gh-aw)** to the latest version.
|
||||
Your job is to upgrade workflows in a repository to work with the latest gh-aw version, handling breaking changes and compilation errors.
|
||||
|
||||
Read the ENTIRE content of this file carefully before proceeding. Follow the instructions precisely.
|
||||
|
||||
## Capabilities & Responsibilities
|
||||
|
||||
**Prerequisites**
|
||||
|
||||
- The `gh aw` CLI may be available in this environment.
|
||||
- Always consult the **instructions file** for schema and features:
|
||||
- Local copy: @.github/aw/github-agentic-workflows.md
|
||||
- Canonical upstream: https://raw.githubusercontent.com/githubnext/gh-aw/main/.github/aw/github-agentic-workflows.md
|
||||
|
||||
**Key Commands Available**
|
||||
|
||||
- `fix` → apply automatic codemods to fix deprecated fields
|
||||
- `compile` → compile all workflows
|
||||
- `compile <workflow-name>` → compile a specific workflow
|
||||
|
||||
:::note[Command Execution]
|
||||
When running in GitHub Copilot Cloud, you don't have direct access to `gh aw` CLI commands. Instead, use the **agentic-workflows** MCP tool:
|
||||
- `fix` tool → apply automatic codemods to fix deprecated fields
|
||||
- `compile` tool → compile workflows
|
||||
|
||||
When running in other environments with `gh aw` CLI access, prefix commands with `gh aw` (e.g., `gh aw compile`).
|
||||
|
||||
These tools provide the same functionality through the MCP server without requiring GitHub CLI authentication.
|
||||
:::
|
||||
|
||||
## Instructions
|
||||
|
||||
### 1. Fetch Latest gh-aw Changes
|
||||
|
||||
Before upgrading, always review what's new:
|
||||
|
||||
1. **Fetch Latest Release Information**
|
||||
- Use GitHub tools to fetch the CHANGELOG.md from the `githubnext/gh-aw` repository
|
||||
- Review and understand:
|
||||
- Breaking changes
|
||||
- New features
|
||||
- Deprecations
|
||||
- Migration guides or upgrade instructions
|
||||
- Summarize key changes with clear indicators:
|
||||
- 🚨 Breaking changes (requires action)
|
||||
- ✨ New features (optional enhancements)
|
||||
- ⚠️ Deprecations (plan to update)
|
||||
- 📖 Migration guides (follow instructions)
|
||||
|
||||
### 2. Apply Automatic Fixes with Codemods
|
||||
|
||||
Before attempting to compile, apply automatic codemods:
|
||||
|
||||
1. **Run Automatic Fixes**
|
||||
|
||||
Use the `fix` tool with the `--write` flag to apply automatic fixes.
|
||||
|
||||
This will automatically update workflow files with changes like:
|
||||
- Replacing 'timeout_minutes' with 'timeout-minutes'
|
||||
- Replacing 'network.firewall' with 'sandbox.agent: false'
|
||||
- Removing deprecated 'safe-inputs.mode' field
|
||||
|
||||
2. **Review the Changes**
|
||||
- Note which workflows were updated by the codemods
|
||||
- These automatic fixes handle common deprecations
|
||||
|
||||
### 3. Attempt Recompilation
|
||||
|
||||
Try to compile all workflows:
|
||||
|
||||
1. **Run Compilation**
|
||||
|
||||
Use the `compile` tool to compile all workflows.
|
||||
|
||||
2. **Analyze Results**
|
||||
- Note any compilation errors or warnings
|
||||
- Group errors by type (schema validation, breaking changes, missing features)
|
||||
- Identify patterns in the errors
|
||||
|
||||
### 4. Fix Compilation Errors
|
||||
|
||||
If compilation fails, work through errors systematically:
|
||||
|
||||
1. **Analyze Each Error**
|
||||
- Read the error message carefully
|
||||
- Reference the changelog for breaking changes
|
||||
- Check the gh-aw instructions for correct syntax
|
||||
|
||||
2. **Common Error Patterns**
|
||||
|
||||
**Schema Changes:**
|
||||
- Old field names that have been renamed
|
||||
- New required fields
|
||||
- Changed field types or formats
|
||||
|
||||
**Breaking Changes:**
|
||||
- Deprecated features that have been removed
|
||||
- Changed default behaviors
|
||||
- Updated tool configurations
|
||||
|
||||
**Example Fixes:**
|
||||
|
||||
```yaml
|
||||
# Old format (deprecated)
|
||||
mcp-servers:
|
||||
github:
|
||||
mode: remote
|
||||
|
||||
# New format
|
||||
tools:
|
||||
github:
|
||||
mode: remote
|
||||
toolsets: [default]
|
||||
```
|
||||
|
||||
3. **Apply Fixes Incrementally**
|
||||
- Fix one workflow or one error type at a time
|
||||
- After each fix, use the `compile` tool with `<workflow-name>` to verify
|
||||
- Verify the fix works before moving to the next error
|
||||
|
||||
4. **Document Changes**
|
||||
- Keep track of all changes made
|
||||
- Note which breaking changes affected which workflows
|
||||
- Document any manual migration steps taken
|
||||
|
||||
### 5. Verify All Workflows
|
||||
|
||||
After fixing all errors:
|
||||
|
||||
1. **Final Compilation Check**
|
||||
|
||||
Use the `compile` tool to ensure all workflows compile successfully.
|
||||
|
||||
2. **Review Generated Lock Files**
|
||||
- Ensure all workflows have corresponding `.lock.yml` files
|
||||
- Check that lock files are valid GitHub Actions YAML
|
||||
|
||||
3. **Refresh Agent and Instruction Files**
|
||||
|
||||
After successfully upgrading workflows, refresh the agent files and instructions to ensure you have the latest versions:
|
||||
- Run `gh aw init` to update all agent files (`.github/agents/*.md`) and instruction files (`.github/aw/github-agentic-workflows.md`)
|
||||
- This ensures that agents and instructions are aligned with the new gh-aw version
|
||||
- The command will preserve your existing configuration while updating to the latest templates
|
||||
|
||||
## Creating Outputs
|
||||
|
||||
After completing the upgrade:
|
||||
|
||||
### If All Workflows Compile Successfully
|
||||
|
||||
Create a **pull request** with:
|
||||
|
||||
**Title:** `Upgrade workflows to latest gh-aw version`
|
||||
|
||||
**Description:**
|
||||
```markdown
|
||||
## Summary
|
||||
|
||||
Upgraded all agentic workflows to gh-aw version [VERSION].
|
||||
|
||||
## Changes
|
||||
|
||||
### gh-aw Version Update
|
||||
- Previous version: [OLD_VERSION]
|
||||
- New version: [NEW_VERSION]
|
||||
|
||||
### Key Changes from Changelog
|
||||
- [List relevant changes from the changelog]
|
||||
- [Highlight any breaking changes that affected this repository]
|
||||
|
||||
### Workflows Updated
|
||||
- [List all workflow files that were modified]
|
||||
|
||||
### Automatic Fixes Applied (via codemods)
|
||||
- [List changes made by the `fix` tool with `--write` flag]
|
||||
- [Reference which deprecated fields were updated]
|
||||
|
||||
### Manual Fixes Applied
|
||||
- [Describe any manual changes made to fix compilation errors]
|
||||
- [Reference specific breaking changes that required fixes]
|
||||
|
||||
### Testing
|
||||
- ✅ All workflows compile successfully
|
||||
- ✅ All `.lock.yml` files generated
|
||||
- ✅ No compilation errors or warnings
|
||||
|
||||
### Post-Upgrade Steps
|
||||
- ✅ Refreshed agent files and instructions with `gh aw init`
|
||||
|
||||
## Files Changed
|
||||
- Updated `.md` workflow files: [LIST]
|
||||
- Generated `.lock.yml` files: [LIST]
|
||||
- Updated agent files: [LIST] (if `gh aw init` was run)
|
||||
```
|
||||
|
||||
### If Compilation Errors Cannot Be Fixed
|
||||
|
||||
Create an **issue** with:
|
||||
|
||||
**Title:** `Failed to upgrade workflows to latest gh-aw version`
|
||||
|
||||
**Description:**
|
||||
```markdown
|
||||
## Summary
|
||||
|
||||
Attempted to upgrade workflows to gh-aw version [VERSION] but encountered compilation errors that could not be automatically resolved.
|
||||
|
||||
## Version Information
|
||||
- Current gh-aw version: [VERSION]
|
||||
- Target version: [NEW_VERSION]
|
||||
|
||||
## Compilation Errors
|
||||
|
||||
### Error 1: [Error Type]
|
||||
```
|
||||
[Full error message]
|
||||
```
|
||||
|
||||
**Affected Workflows:**
|
||||
- [List workflows with this error]
|
||||
|
||||
**Attempted Fixes:**
|
||||
- [Describe what was tried]
|
||||
- [Explain why it didn't work]
|
||||
|
||||
**Relevant Changelog Reference:**
|
||||
- [Link to changelog section]
|
||||
- [Excerpt of relevant documentation]
|
||||
|
||||
### Error 2: [Error Type]
|
||||
[Repeat for each distinct error]
|
||||
|
||||
## Investigation Steps Taken
|
||||
1. [Step 1]
|
||||
2. [Step 2]
|
||||
3. [Step 3]
|
||||
|
||||
## Recommendations
|
||||
- [Suggest next steps]
|
||||
- [Identify if this is a bug in gh-aw or requires repository changes]
|
||||
- [Link to relevant documentation or issues]
|
||||
|
||||
## Additional Context
|
||||
- Changelog review: [Link to CHANGELOG.md]
|
||||
- Migration guide: [Link if available]
|
||||
```
|
||||
|
||||
## Best Practices
|
||||
|
||||
1. **Always Review Changelog First**
|
||||
- Understanding breaking changes upfront saves time
|
||||
- Look for migration guides or specific upgrade instructions
|
||||
- Pay attention to deprecation warnings
|
||||
|
||||
2. **Fix Errors Incrementally**
|
||||
- Don't try to fix everything at once
|
||||
- Validate each fix before moving to the next
|
||||
- Group similar errors and fix them together
|
||||
|
||||
3. **Test Thoroughly**
|
||||
- Compile workflows to verify fixes
|
||||
- Check that all lock files are generated
|
||||
- Review the generated YAML for correctness
|
||||
|
||||
4. **Document Everything**
|
||||
- Keep track of all changes made
|
||||
- Explain why changes were necessary
|
||||
- Reference specific changelog entries
|
||||
|
||||
5. **Clear Communication**
|
||||
- Use emojis to make output engaging
|
||||
- Summarize complex changes clearly
|
||||
- Provide actionable next steps
|
||||
|
||||
## Important Notes
|
||||
|
||||
- When running in GitHub Copilot Cloud, use the **agentic-workflows** MCP tool for all commands
|
||||
- When running in environments with `gh aw` CLI access, prefix commands with `gh aw`
|
||||
- Breaking changes are inevitable - expect to make manual fixes
|
||||
- If stuck, create an issue with detailed information for the maintainers
|
||||
2
.github/aw/create-agentic-workflow.md
vendored
2
.github/aw/create-agentic-workflow.md
vendored
|
|
@ -181,7 +181,7 @@ DO NOT ask all these questions at once; instead, engage in a back-and-forth conv
|
|||
- 📋 **DO NOT include other fields with good defaults** - Let the compiler use sensible defaults unless customization is needed.
|
||||
- Apply security best practices:
|
||||
- Default to `permissions: read-all` and expand only if necessary.
|
||||
- Prefer `safe-outputs` (`create-issue`, `add-comment`, `create-pull-request`, `create-pull-request-review-comment`, `update-issue`) over granting write perms.
|
||||
- Prefer `safe-outputs` (`create-issue`, `add-comment`, `create-pull-request`, `create-pull-request-review-comment`, `update-issue`, `dispatch-workflow`) over granting write perms.
|
||||
- For custom write operations to external services (email, Slack, webhooks), use `safe-outputs.jobs:` to create custom safe output jobs.
|
||||
- Constrain `network:` to the minimum required ecosystems/domains.
|
||||
- Use sanitized expressions (`${{ needs.activation.outputs.text }}`) instead of raw event text.
|
||||
|
|
|
|||
2
.github/aw/create-shared-agentic-workflow.md
vendored
2
.github/aw/create-shared-agentic-workflow.md
vendored
|
|
@ -34,7 +34,7 @@ You are a conversational chat agent that interacts with the user to design secur
|
|||
**Move Write Operations to Safe Outputs**
|
||||
- Never grant direct write permissions in shared components
|
||||
- Use `safe-outputs:` configuration for all write operations
|
||||
- Common safe outputs: `create-issue`, `add-comment`, `create-pull-request`, `update-issue`
|
||||
- Common safe outputs: `create-issue`, `add-comment`, `create-pull-request`, `update-issue`, `dispatch-workflow`
|
||||
- Let consuming workflows decide which safe outputs to enable
|
||||
|
||||
**Process Agent Output in Safe Jobs**
|
||||
|
|
|
|||
18
.github/aw/github-agentic-workflows.md
vendored
18
.github/aw/github-agentic-workflows.md
vendored
|
|
@ -465,6 +465,16 @@ The YAML frontmatter supports these fields:
|
|||
target-repo: "owner/repo" # Optional: cross-repository
|
||||
```
|
||||
When using `safe-outputs.add-labels`, the main job does **not** need `issues: write` or `pull-requests: write` permission since label addition is handled by a separate job with appropriate permissions.
|
||||
- `remove-labels:` - Safe label removal from issues or PRs
|
||||
```yaml
|
||||
safe-outputs:
|
||||
remove-labels:
|
||||
allowed: [automated, stale] # Optional: restrict to specific labels
|
||||
max: 3 # Optional: maximum number of operations (default: 3)
|
||||
target: "*" # Optional: "triggering" (default), "*" (any issue/PR), or number
|
||||
target-repo: "owner/repo" # Optional: cross-repository
|
||||
```
|
||||
When `allowed` is omitted, any labels can be removed. Use `allowed` to restrict removal to specific labels. When using `safe-outputs.remove-labels`, the main job does **not** need `issues: write` or `pull-requests: write` permission since label removal is handled by a separate job with appropriate permissions.
|
||||
- `add-reviewer:` - Add reviewers to pull requests
|
||||
```yaml
|
||||
safe-outputs:
|
||||
|
|
@ -558,6 +568,14 @@ The YAML frontmatter supports these fields:
|
|||
target-repo: "owner/repo" # Optional: cross-repository
|
||||
```
|
||||
Publishes workflow artifacts to an orphaned git branch for persistent storage. Default allowed extensions include common non-executable types. Maximum file size is 50MB (51200 KB).
|
||||
- `dispatch-workflow:` - Trigger other workflows with inputs
|
||||
```yaml
|
||||
safe-outputs:
|
||||
dispatch-workflow:
|
||||
workflows: [workflow-name] # Required: list of workflow names to allow
|
||||
max: 3 # Optional: max dispatches (default: 1, max: 3)
|
||||
```
|
||||
Triggers other agentic workflows in the same repository using workflow_dispatch. Agent output includes `workflow_name` (without .md extension) and optional `inputs` (key-value pairs). Not supported for cross-repository operations.
|
||||
- `create-code-scanning-alert:` - Generate SARIF security advisories
|
||||
```yaml
|
||||
safe-outputs:
|
||||
|
|
|
|||
4
.github/workflows/agentics-maintenance.yml
vendored
4
.github/workflows/agentics-maintenance.yml
vendored
|
|
@ -13,7 +13,7 @@
|
|||
# \ /\ / (_) | | | | ( | | | | (_) \ V V /\__ \
|
||||
# \/ \/ \___/|_| |_|\_\|_| |_|\___/ \_/\_/ |___/
|
||||
#
|
||||
# This file was automatically generated by pkg/workflow/maintenance_workflow.go (v0.37.15). DO NOT EDIT.
|
||||
# This file was automatically generated by pkg/workflow/maintenance_workflow.go (v0.37.19). DO NOT EDIT.
|
||||
#
|
||||
# To regenerate this workflow, run:
|
||||
# gh aw compile
|
||||
|
|
@ -46,7 +46,7 @@ jobs:
|
|||
issues: write
|
||||
steps:
|
||||
- name: Setup Scripts
|
||||
uses: githubnext/gh-aw/actions/setup@v0.37.15
|
||||
uses: githubnext/gh-aw/actions/setup@v0.37.19
|
||||
with:
|
||||
destination: /opt/gh-aw/actions
|
||||
|
||||
|
|
|
|||
39
.github/workflows/api-coherence-checker.lock.yml
generated
vendored
39
.github/workflows/api-coherence-checker.lock.yml
generated
vendored
|
|
@ -13,7 +13,7 @@
|
|||
# \ /\ / (_) | | | | ( | | | | (_) \ V V /\__ \
|
||||
# \/ \/ \___/|_| |_|\_\|_| |_|\___/ \_/\_/ |___/
|
||||
#
|
||||
# This file was automatically generated by gh-aw (v0.37.15). DO NOT EDIT.
|
||||
# This file was automatically generated by gh-aw (v0.37.19). DO NOT EDIT.
|
||||
#
|
||||
# To update this file, edit the corresponding .md file and run:
|
||||
# gh aw compile
|
||||
|
|
@ -45,7 +45,7 @@ jobs:
|
|||
comment_repo: ""
|
||||
steps:
|
||||
- name: Setup Scripts
|
||||
uses: githubnext/gh-aw/actions/setup@v0.37.15
|
||||
uses: githubnext/gh-aw/actions/setup@v0.37.19
|
||||
with:
|
||||
destination: /opt/gh-aw/actions
|
||||
- name: Check workflow file timestamps
|
||||
|
|
@ -82,7 +82,7 @@ jobs:
|
|||
secret_verification_result: ${{ steps.validate-secret.outputs.verification_result }}
|
||||
steps:
|
||||
- name: Setup Scripts
|
||||
uses: githubnext/gh-aw/actions/setup@v0.37.15
|
||||
uses: githubnext/gh-aw/actions/setup@v0.37.19
|
||||
with:
|
||||
destination: /opt/gh-aw/actions
|
||||
- name: Create gh-aw temp directory
|
||||
|
|
@ -145,7 +145,7 @@ jobs:
|
|||
const determineAutomaticLockdown = require('/opt/gh-aw/actions/determine_automatic_lockdown.cjs');
|
||||
await determineAutomaticLockdown(github, context, core);
|
||||
- name: Download container images
|
||||
run: bash /opt/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.29.0 ghcr.io/githubnext/gh-aw-mcpg:v0.0.76 node:lts-alpine
|
||||
run: bash /opt/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.29.0 ghcr.io/githubnext/gh-aw-mcpg:v0.0.78 node:lts-alpine
|
||||
- name: Write Safe Outputs Config
|
||||
run: |
|
||||
mkdir -p /opt/gh-aw/safeoutputs
|
||||
|
|
@ -375,7 +375,7 @@ jobs:
|
|||
# Register API key as secret to mask it from logs
|
||||
echo "::add-mask::${MCP_GATEWAY_API_KEY}"
|
||||
export GH_AW_ENGINE="copilot"
|
||||
export MCP_GATEWAY_DOCKER_COMMAND='docker run -i --rm --network host -v /var/run/docker.sock:/var/run/docker.sock -e MCP_GATEWAY_PORT -e MCP_GATEWAY_DOMAIN -e MCP_GATEWAY_API_KEY -e DEBUG="*" -e MCP_GATEWAY_LOG_DIR -e GH_AW_MCP_LOG_DIR -e GH_AW_SAFE_OUTPUTS -e GH_AW_SAFE_OUTPUTS_CONFIG_PATH -e GH_AW_SAFE_OUTPUTS_TOOLS_PATH -e GH_AW_ASSETS_BRANCH -e GH_AW_ASSETS_MAX_SIZE_KB -e GH_AW_ASSETS_ALLOWED_EXTS -e DEFAULT_BRANCH -e GITHUB_MCP_SERVER_TOKEN -e GITHUB_MCP_LOCKDOWN -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e GITHUB_SHA -e GITHUB_WORKSPACE -e GITHUB_TOKEN -e GITHUB_RUN_ID -e GITHUB_RUN_NUMBER -e GITHUB_RUN_ATTEMPT -e GITHUB_JOB -e GITHUB_ACTION -e GITHUB_EVENT_NAME -e GITHUB_EVENT_PATH -e GITHUB_ACTOR -e GITHUB_ACTOR_ID -e GITHUB_TRIGGERING_ACTOR -e GITHUB_WORKFLOW -e GITHUB_WORKFLOW_REF -e GITHUB_WORKFLOW_SHA -e GITHUB_REF -e GITHUB_REF_NAME -e GITHUB_REF_TYPE -e GITHUB_HEAD_REF -e GITHUB_BASE_REF -e GH_AW_SAFE_OUTPUTS_PORT -e GH_AW_SAFE_OUTPUTS_API_KEY -v /opt:/opt:ro -v /tmp:/tmp:rw -v '"${GITHUB_WORKSPACE}"':'"${GITHUB_WORKSPACE}"':rw ghcr.io/githubnext/gh-aw-mcpg:v0.0.76'
|
||||
export MCP_GATEWAY_DOCKER_COMMAND='docker run -i --rm --network host -v /var/run/docker.sock:/var/run/docker.sock -e MCP_GATEWAY_PORT -e MCP_GATEWAY_DOMAIN -e MCP_GATEWAY_API_KEY -e DEBUG="*" -e MCP_GATEWAY_LOG_DIR -e GH_AW_MCP_LOG_DIR -e GH_AW_SAFE_OUTPUTS -e GH_AW_SAFE_OUTPUTS_CONFIG_PATH -e GH_AW_SAFE_OUTPUTS_TOOLS_PATH -e GH_AW_ASSETS_BRANCH -e GH_AW_ASSETS_MAX_SIZE_KB -e GH_AW_ASSETS_ALLOWED_EXTS -e DEFAULT_BRANCH -e GITHUB_MCP_SERVER_TOKEN -e GITHUB_MCP_LOCKDOWN -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e GITHUB_SHA -e GITHUB_WORKSPACE -e GITHUB_TOKEN -e GITHUB_RUN_ID -e GITHUB_RUN_NUMBER -e GITHUB_RUN_ATTEMPT -e GITHUB_JOB -e GITHUB_ACTION -e GITHUB_EVENT_NAME -e GITHUB_EVENT_PATH -e GITHUB_ACTOR -e GITHUB_ACTOR_ID -e GITHUB_TRIGGERING_ACTOR -e GITHUB_WORKFLOW -e GITHUB_WORKFLOW_REF -e GITHUB_WORKFLOW_SHA -e GITHUB_REF -e GITHUB_REF_NAME -e GITHUB_REF_TYPE -e GITHUB_HEAD_REF -e GITHUB_BASE_REF -e GH_AW_SAFE_OUTPUTS_PORT -e GH_AW_SAFE_OUTPUTS_API_KEY -v /opt:/opt:ro -v /tmp:/tmp:rw -v '"${GITHUB_WORKSPACE}"':'"${GITHUB_WORKSPACE}"':rw ghcr.io/githubnext/gh-aw-mcpg:v0.0.78'
|
||||
|
||||
mkdir -p /home/runner/.copilot
|
||||
cat << MCPCONFIG_EOF | bash /opt/gh-aw/actions/start_mcp_gateway.sh
|
||||
|
|
@ -427,7 +427,7 @@ jobs:
|
|||
model: process.env.GH_AW_MODEL_AGENT_COPILOT || "",
|
||||
version: "",
|
||||
agent_version: "0.0.389",
|
||||
cli_version: "v0.37.15",
|
||||
cli_version: "v0.37.19",
|
||||
workflow_name: "API Coherence Checker",
|
||||
experimental: false,
|
||||
supports_tools_allowlist: true,
|
||||
|
|
@ -441,11 +441,10 @@ jobs:
|
|||
actor: context.actor,
|
||||
event_name: context.eventName,
|
||||
staged: false,
|
||||
network_mode: "defaults",
|
||||
allowed_domains: [],
|
||||
allowed_domains: ["defaults"],
|
||||
firewall_enabled: true,
|
||||
awf_version: "v0.10.0",
|
||||
awmg_version: "v0.0.76",
|
||||
awmg_version: "v0.0.78",
|
||||
steps: {
|
||||
firewall: "squid"
|
||||
},
|
||||
|
|
@ -788,7 +787,7 @@ jobs:
|
|||
timeout-minutes: 30
|
||||
run: |
|
||||
set -o pipefail
|
||||
sudo -E awf --env-all --container-workdir "${GITHUB_WORKSPACE}" --mount /tmp:/tmp:rw --mount "${GITHUB_WORKSPACE}:${GITHUB_WORKSPACE}:rw" --mount /usr/bin/date:/usr/bin/date:ro --mount /usr/bin/gh:/usr/bin/gh:ro --mount /usr/bin/yq:/usr/bin/yq:ro --mount /usr/local/bin/copilot:/usr/local/bin/copilot:ro --mount /home/runner/.copilot:/home/runner/.copilot:rw --mount /opt/gh-aw:/opt/gh-aw:ro --allow-domains api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,github.com,host.docker.internal,raw.githubusercontent.com,registry.npmjs.org --log-level info --proxy-logs-dir /tmp/gh-aw/sandbox/firewall/logs --enable-host-access --image-tag 0.10.0 \
|
||||
sudo -E awf --env-all --container-workdir "${GITHUB_WORKSPACE}" --mount /tmp:/tmp:rw --mount "${GITHUB_WORKSPACE}:${GITHUB_WORKSPACE}:rw" --mount /usr/bin/date:/usr/bin/date:ro --mount /usr/bin/gh:/usr/bin/gh:ro --mount /usr/bin/yq:/usr/bin/yq:ro --mount /usr/local/bin/copilot:/usr/local/bin/copilot:ro --mount /home/runner/.copilot:/home/runner/.copilot:rw --mount /opt/gh-aw:/opt/gh-aw:ro --allow-domains api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,github.com,host.docker.internal,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,ppa.launchpad.net,raw.githubusercontent.com,registry.npmjs.org,s.symcb.com,s.symcd.com,security.ubuntu.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com --log-level info --proxy-logs-dir /tmp/gh-aw/sandbox/firewall/logs --enable-host-access --image-tag 0.10.0 \
|
||||
-- /usr/local/bin/copilot --add-dir /tmp/gh-aw/ --log-level all --log-dir /tmp/gh-aw/sandbox/agent/logs/ --add-dir "${GITHUB_WORKSPACE}" --disable-builtin-mcps --allow-all-tools --add-dir /tmp/gh-aw/cache-memory/ --allow-all-paths --share /tmp/gh-aw/sandbox/agent/logs/conversation.md --prompt "$(cat /tmp/gh-aw/aw-prompts/prompt.txt)"${GH_AW_MODEL_AGENT_COPILOT:+ --model "$GH_AW_MODEL_AGENT_COPILOT"} \
|
||||
2>&1 | tee /tmp/gh-aw/agent-stdio.log
|
||||
env:
|
||||
|
|
@ -856,7 +855,7 @@ jobs:
|
|||
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
|
||||
env:
|
||||
GH_AW_SAFE_OUTPUTS: ${{ env.GH_AW_SAFE_OUTPUTS }}
|
||||
GH_AW_ALLOWED_DOMAINS: "api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,github.com,host.docker.internal,raw.githubusercontent.com,registry.npmjs.org"
|
||||
GH_AW_ALLOWED_DOMAINS: "api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,github.com,host.docker.internal,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,ppa.launchpad.net,raw.githubusercontent.com,registry.npmjs.org,s.symcb.com,s.symcd.com,security.ubuntu.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com"
|
||||
GITHUB_SERVER_URL: ${{ github.server_url }}
|
||||
GITHUB_API_URL: ${{ github.api_url }}
|
||||
with:
|
||||
|
|
@ -950,7 +949,7 @@ jobs:
|
|||
total_count: ${{ steps.missing_tool.outputs.total_count }}
|
||||
steps:
|
||||
- name: Setup Scripts
|
||||
uses: githubnext/gh-aw/actions/setup@v0.37.15
|
||||
uses: githubnext/gh-aw/actions/setup@v0.37.19
|
||||
with:
|
||||
destination: /opt/gh-aw/actions
|
||||
- name: Debug job inputs
|
||||
|
|
@ -966,7 +965,7 @@ jobs:
|
|||
echo "Agent Conclusion: $AGENT_CONCLUSION"
|
||||
- name: Download agent output artifact
|
||||
continue-on-error: true
|
||||
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
|
||||
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
|
||||
with:
|
||||
name: agent-output
|
||||
path: /tmp/gh-aw/safeoutputs/
|
||||
|
|
@ -1049,18 +1048,18 @@ jobs:
|
|||
success: ${{ steps.parse_results.outputs.success }}
|
||||
steps:
|
||||
- name: Setup Scripts
|
||||
uses: githubnext/gh-aw/actions/setup@v0.37.15
|
||||
uses: githubnext/gh-aw/actions/setup@v0.37.19
|
||||
with:
|
||||
destination: /opt/gh-aw/actions
|
||||
- name: Download agent artifacts
|
||||
continue-on-error: true
|
||||
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
|
||||
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
|
||||
with:
|
||||
name: agent-artifacts
|
||||
path: /tmp/gh-aw/threat-detection/
|
||||
- name: Download agent output artifact
|
||||
continue-on-error: true
|
||||
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
|
||||
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
|
||||
with:
|
||||
name: agent-output
|
||||
path: /tmp/gh-aw/threat-detection/
|
||||
|
|
@ -1199,12 +1198,12 @@ jobs:
|
|||
process_safe_outputs_temporary_id_map: ${{ steps.process_safe_outputs.outputs.temporary_id_map }}
|
||||
steps:
|
||||
- name: Setup Scripts
|
||||
uses: githubnext/gh-aw/actions/setup@v0.37.15
|
||||
uses: githubnext/gh-aw/actions/setup@v0.37.19
|
||||
with:
|
||||
destination: /opt/gh-aw/actions
|
||||
- name: Download agent output artifact
|
||||
continue-on-error: true
|
||||
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
|
||||
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
|
||||
with:
|
||||
name: agent-output
|
||||
path: /tmp/gh-aw/safeoutputs/
|
||||
|
|
@ -1236,11 +1235,11 @@ jobs:
|
|||
permissions: {}
|
||||
steps:
|
||||
- name: Setup Scripts
|
||||
uses: githubnext/gh-aw/actions/setup@v0.37.15
|
||||
uses: githubnext/gh-aw/actions/setup@v0.37.19
|
||||
with:
|
||||
destination: /opt/gh-aw/actions
|
||||
- name: Download cache-memory artifact (default)
|
||||
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
|
||||
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
|
||||
continue-on-error: true
|
||||
with:
|
||||
name: cache-memory
|
||||
|
|
|
|||
41
.github/workflows/build-warning-fixer.lock.yml
generated
vendored
41
.github/workflows/build-warning-fixer.lock.yml
generated
vendored
|
|
@ -13,7 +13,7 @@
|
|||
# \ /\ / (_) | | | | ( | | | | (_) \ V V /\__ \
|
||||
# \/ \/ \___/|_| |_|\_\|_| |_|\___/ \_/\_/ |___/
|
||||
#
|
||||
# This file was automatically generated by gh-aw (v0.37.15). DO NOT EDIT.
|
||||
# This file was automatically generated by gh-aw (v0.37.19). DO NOT EDIT.
|
||||
#
|
||||
# To update this file, edit the corresponding .md file and run:
|
||||
# gh aw compile
|
||||
|
|
@ -45,7 +45,7 @@ jobs:
|
|||
comment_repo: ""
|
||||
steps:
|
||||
- name: Setup Scripts
|
||||
uses: githubnext/gh-aw/actions/setup@v0.37.15
|
||||
uses: githubnext/gh-aw/actions/setup@v0.37.19
|
||||
with:
|
||||
destination: /opt/gh-aw/actions
|
||||
- name: Check workflow file timestamps
|
||||
|
|
@ -82,11 +82,11 @@ jobs:
|
|||
secret_verification_result: ${{ steps.validate-secret.outputs.verification_result }}
|
||||
steps:
|
||||
- name: Setup Scripts
|
||||
uses: githubnext/gh-aw/actions/setup@v0.37.15
|
||||
uses: githubnext/gh-aw/actions/setup@v0.37.19
|
||||
with:
|
||||
destination: /opt/gh-aw/actions
|
||||
- name: Checkout repository
|
||||
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
|
||||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
||||
with:
|
||||
persist-credentials: false
|
||||
- name: Create gh-aw temp directory
|
||||
|
|
@ -135,7 +135,7 @@ jobs:
|
|||
const determineAutomaticLockdown = require('/opt/gh-aw/actions/determine_automatic_lockdown.cjs');
|
||||
await determineAutomaticLockdown(github, context, core);
|
||||
- name: Download container images
|
||||
run: bash /opt/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.29.0 ghcr.io/githubnext/gh-aw-mcpg:v0.0.76 node:lts-alpine
|
||||
run: bash /opt/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.29.0 ghcr.io/githubnext/gh-aw-mcpg:v0.0.78 node:lts-alpine
|
||||
- name: Write Safe Outputs Config
|
||||
run: |
|
||||
mkdir -p /opt/gh-aw/safeoutputs
|
||||
|
|
@ -375,7 +375,7 @@ jobs:
|
|||
# Register API key as secret to mask it from logs
|
||||
echo "::add-mask::${MCP_GATEWAY_API_KEY}"
|
||||
export GH_AW_ENGINE="copilot"
|
||||
export MCP_GATEWAY_DOCKER_COMMAND='docker run -i --rm --network host -v /var/run/docker.sock:/var/run/docker.sock -e MCP_GATEWAY_PORT -e MCP_GATEWAY_DOMAIN -e MCP_GATEWAY_API_KEY -e DEBUG="*" -e MCP_GATEWAY_LOG_DIR -e GH_AW_MCP_LOG_DIR -e GH_AW_SAFE_OUTPUTS -e GH_AW_SAFE_OUTPUTS_CONFIG_PATH -e GH_AW_SAFE_OUTPUTS_TOOLS_PATH -e GH_AW_ASSETS_BRANCH -e GH_AW_ASSETS_MAX_SIZE_KB -e GH_AW_ASSETS_ALLOWED_EXTS -e DEFAULT_BRANCH -e GITHUB_MCP_SERVER_TOKEN -e GITHUB_MCP_LOCKDOWN -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e GITHUB_SHA -e GITHUB_WORKSPACE -e GITHUB_TOKEN -e GITHUB_RUN_ID -e GITHUB_RUN_NUMBER -e GITHUB_RUN_ATTEMPT -e GITHUB_JOB -e GITHUB_ACTION -e GITHUB_EVENT_NAME -e GITHUB_EVENT_PATH -e GITHUB_ACTOR -e GITHUB_ACTOR_ID -e GITHUB_TRIGGERING_ACTOR -e GITHUB_WORKFLOW -e GITHUB_WORKFLOW_REF -e GITHUB_WORKFLOW_SHA -e GITHUB_REF -e GITHUB_REF_NAME -e GITHUB_REF_TYPE -e GITHUB_HEAD_REF -e GITHUB_BASE_REF -e GH_AW_SAFE_OUTPUTS_PORT -e GH_AW_SAFE_OUTPUTS_API_KEY -v /opt:/opt:ro -v /tmp:/tmp:rw -v '"${GITHUB_WORKSPACE}"':'"${GITHUB_WORKSPACE}"':rw ghcr.io/githubnext/gh-aw-mcpg:v0.0.76'
|
||||
export MCP_GATEWAY_DOCKER_COMMAND='docker run -i --rm --network host -v /var/run/docker.sock:/var/run/docker.sock -e MCP_GATEWAY_PORT -e MCP_GATEWAY_DOMAIN -e MCP_GATEWAY_API_KEY -e DEBUG="*" -e MCP_GATEWAY_LOG_DIR -e GH_AW_MCP_LOG_DIR -e GH_AW_SAFE_OUTPUTS -e GH_AW_SAFE_OUTPUTS_CONFIG_PATH -e GH_AW_SAFE_OUTPUTS_TOOLS_PATH -e GH_AW_ASSETS_BRANCH -e GH_AW_ASSETS_MAX_SIZE_KB -e GH_AW_ASSETS_ALLOWED_EXTS -e DEFAULT_BRANCH -e GITHUB_MCP_SERVER_TOKEN -e GITHUB_MCP_LOCKDOWN -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e GITHUB_SHA -e GITHUB_WORKSPACE -e GITHUB_TOKEN -e GITHUB_RUN_ID -e GITHUB_RUN_NUMBER -e GITHUB_RUN_ATTEMPT -e GITHUB_JOB -e GITHUB_ACTION -e GITHUB_EVENT_NAME -e GITHUB_EVENT_PATH -e GITHUB_ACTOR -e GITHUB_ACTOR_ID -e GITHUB_TRIGGERING_ACTOR -e GITHUB_WORKFLOW -e GITHUB_WORKFLOW_REF -e GITHUB_WORKFLOW_SHA -e GITHUB_REF -e GITHUB_REF_NAME -e GITHUB_REF_TYPE -e GITHUB_HEAD_REF -e GITHUB_BASE_REF -e GH_AW_SAFE_OUTPUTS_PORT -e GH_AW_SAFE_OUTPUTS_API_KEY -v /opt:/opt:ro -v /tmp:/tmp:rw -v '"${GITHUB_WORKSPACE}"':'"${GITHUB_WORKSPACE}"':rw ghcr.io/githubnext/gh-aw-mcpg:v0.0.78'
|
||||
|
||||
mkdir -p /home/runner/.copilot
|
||||
cat << MCPCONFIG_EOF | bash /opt/gh-aw/actions/start_mcp_gateway.sh
|
||||
|
|
@ -419,7 +419,7 @@ jobs:
|
|||
model: process.env.GH_AW_MODEL_AGENT_COPILOT || "",
|
||||
version: "",
|
||||
agent_version: "0.0.389",
|
||||
cli_version: "v0.37.15",
|
||||
cli_version: "v0.37.19",
|
||||
workflow_name: "Build Warning Fixer",
|
||||
experimental: false,
|
||||
supports_tools_allowlist: true,
|
||||
|
|
@ -433,11 +433,10 @@ jobs:
|
|||
actor: context.actor,
|
||||
event_name: context.eventName,
|
||||
staged: false,
|
||||
network_mode: "defaults",
|
||||
allowed_domains: [],
|
||||
allowed_domains: ["defaults"],
|
||||
firewall_enabled: true,
|
||||
awf_version: "v0.10.0",
|
||||
awmg_version: "v0.0.76",
|
||||
awmg_version: "v0.0.78",
|
||||
steps: {
|
||||
firewall: "squid"
|
||||
},
|
||||
|
|
@ -710,7 +709,7 @@ jobs:
|
|||
timeout-minutes: 60
|
||||
run: |
|
||||
set -o pipefail
|
||||
sudo -E awf --env-all --container-workdir "${GITHUB_WORKSPACE}" --mount /tmp:/tmp:rw --mount "${GITHUB_WORKSPACE}:${GITHUB_WORKSPACE}:rw" --mount /usr/bin/date:/usr/bin/date:ro --mount /usr/bin/gh:/usr/bin/gh:ro --mount /usr/bin/yq:/usr/bin/yq:ro --mount /usr/local/bin/copilot:/usr/local/bin/copilot:ro --mount /home/runner/.copilot:/home/runner/.copilot:rw --mount /opt/gh-aw:/opt/gh-aw:ro --allow-domains api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,github.com,host.docker.internal,raw.githubusercontent.com,registry.npmjs.org --log-level info --proxy-logs-dir /tmp/gh-aw/sandbox/firewall/logs --enable-host-access --image-tag 0.10.0 \
|
||||
sudo -E awf --env-all --container-workdir "${GITHUB_WORKSPACE}" --mount /tmp:/tmp:rw --mount "${GITHUB_WORKSPACE}:${GITHUB_WORKSPACE}:rw" --mount /usr/bin/date:/usr/bin/date:ro --mount /usr/bin/gh:/usr/bin/gh:ro --mount /usr/bin/yq:/usr/bin/yq:ro --mount /usr/local/bin/copilot:/usr/local/bin/copilot:ro --mount /home/runner/.copilot:/home/runner/.copilot:rw --mount /opt/gh-aw:/opt/gh-aw:ro --allow-domains api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,github.com,host.docker.internal,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,ppa.launchpad.net,raw.githubusercontent.com,registry.npmjs.org,s.symcb.com,s.symcd.com,security.ubuntu.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com --log-level info --proxy-logs-dir /tmp/gh-aw/sandbox/firewall/logs --enable-host-access --image-tag 0.10.0 \
|
||||
-- /usr/local/bin/copilot --add-dir /tmp/gh-aw/ --log-level all --log-dir /tmp/gh-aw/sandbox/agent/logs/ --add-dir "${GITHUB_WORKSPACE}" --disable-builtin-mcps --allow-tool github --allow-tool safeoutputs --allow-tool shell --allow-tool write --allow-all-paths --share /tmp/gh-aw/sandbox/agent/logs/conversation.md --prompt "$(cat /tmp/gh-aw/aw-prompts/prompt.txt)"${GH_AW_MODEL_AGENT_COPILOT:+ --model "$GH_AW_MODEL_AGENT_COPILOT"} \
|
||||
2>&1 | tee /tmp/gh-aw/agent-stdio.log
|
||||
env:
|
||||
|
|
@ -778,7 +777,7 @@ jobs:
|
|||
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
|
||||
env:
|
||||
GH_AW_SAFE_OUTPUTS: ${{ env.GH_AW_SAFE_OUTPUTS }}
|
||||
GH_AW_ALLOWED_DOMAINS: "api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,github.com,host.docker.internal,raw.githubusercontent.com,registry.npmjs.org"
|
||||
GH_AW_ALLOWED_DOMAINS: "api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,github.com,host.docker.internal,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,ppa.launchpad.net,raw.githubusercontent.com,registry.npmjs.org,s.symcb.com,s.symcd.com,security.ubuntu.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com"
|
||||
GITHUB_SERVER_URL: ${{ github.server_url }}
|
||||
GITHUB_API_URL: ${{ github.api_url }}
|
||||
with:
|
||||
|
|
@ -866,7 +865,7 @@ jobs:
|
|||
total_count: ${{ steps.missing_tool.outputs.total_count }}
|
||||
steps:
|
||||
- name: Setup Scripts
|
||||
uses: githubnext/gh-aw/actions/setup@v0.37.15
|
||||
uses: githubnext/gh-aw/actions/setup@v0.37.19
|
||||
with:
|
||||
destination: /opt/gh-aw/actions
|
||||
- name: Debug job inputs
|
||||
|
|
@ -882,7 +881,7 @@ jobs:
|
|||
echo "Agent Conclusion: $AGENT_CONCLUSION"
|
||||
- name: Download agent output artifact
|
||||
continue-on-error: true
|
||||
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
|
||||
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
|
||||
with:
|
||||
name: agent-output
|
||||
path: /tmp/gh-aw/safeoutputs/
|
||||
|
|
@ -982,18 +981,18 @@ jobs:
|
|||
success: ${{ steps.parse_results.outputs.success }}
|
||||
steps:
|
||||
- name: Setup Scripts
|
||||
uses: githubnext/gh-aw/actions/setup@v0.37.15
|
||||
uses: githubnext/gh-aw/actions/setup@v0.37.19
|
||||
with:
|
||||
destination: /opt/gh-aw/actions
|
||||
- name: Download agent artifacts
|
||||
continue-on-error: true
|
||||
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
|
||||
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
|
||||
with:
|
||||
name: agent-artifacts
|
||||
path: /tmp/gh-aw/threat-detection/
|
||||
- name: Download agent output artifact
|
||||
continue-on-error: true
|
||||
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
|
||||
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
|
||||
with:
|
||||
name: agent-output
|
||||
path: /tmp/gh-aw/threat-detection/
|
||||
|
|
@ -1134,12 +1133,12 @@ jobs:
|
|||
process_safe_outputs_temporary_id_map: ${{ steps.process_safe_outputs.outputs.temporary_id_map }}
|
||||
steps:
|
||||
- name: Setup Scripts
|
||||
uses: githubnext/gh-aw/actions/setup@v0.37.15
|
||||
uses: githubnext/gh-aw/actions/setup@v0.37.19
|
||||
with:
|
||||
destination: /opt/gh-aw/actions
|
||||
- name: Download agent output artifact
|
||||
continue-on-error: true
|
||||
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
|
||||
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
|
||||
with:
|
||||
name: agent-output
|
||||
path: /tmp/gh-aw/safeoutputs/
|
||||
|
|
@ -1150,13 +1149,13 @@ jobs:
|
|||
echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/safeoutputs/agent_output.json" >> "$GITHUB_ENV"
|
||||
- name: Download patch artifact
|
||||
continue-on-error: true
|
||||
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
|
||||
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
|
||||
with:
|
||||
name: agent-artifacts
|
||||
path: /tmp/gh-aw/
|
||||
- name: Checkout repository
|
||||
if: ((!cancelled()) && (needs.agent.result != 'skipped')) && (contains(needs.agent.outputs.output_types, 'create_pull_request'))
|
||||
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
|
||||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
||||
with:
|
||||
token: ${{ github.token }}
|
||||
persist-credentials: false
|
||||
|
|
|
|||
95
.github/workflows/code-conventions-analyzer.lock.yml
generated
vendored
95
.github/workflows/code-conventions-analyzer.lock.yml
generated
vendored
|
|
@ -13,7 +13,7 @@
|
|||
# \ /\ / (_) | | | | ( | | | | (_) \ V V /\__ \
|
||||
# \/ \/ \___/|_| |_|\_\|_| |_|\___/ \_/\_/ |___/
|
||||
#
|
||||
# This file was automatically generated by gh-aw (v0.37.15). DO NOT EDIT.
|
||||
# This file was automatically generated by gh-aw (v0.37.19). DO NOT EDIT.
|
||||
#
|
||||
# To update this file, edit the corresponding .md file and run:
|
||||
# gh aw compile
|
||||
|
|
@ -45,7 +45,7 @@ jobs:
|
|||
comment_repo: ""
|
||||
steps:
|
||||
- name: Setup Scripts
|
||||
uses: githubnext/gh-aw/actions/setup@v0.37.15
|
||||
uses: githubnext/gh-aw/actions/setup@v0.37.19
|
||||
with:
|
||||
destination: /opt/gh-aw/actions
|
||||
- name: Check workflow file timestamps
|
||||
|
|
@ -82,11 +82,11 @@ jobs:
|
|||
secret_verification_result: ${{ steps.validate-secret.outputs.verification_result }}
|
||||
steps:
|
||||
- name: Setup Scripts
|
||||
uses: githubnext/gh-aw/actions/setup@v0.37.15
|
||||
uses: githubnext/gh-aw/actions/setup@v0.37.19
|
||||
with:
|
||||
destination: /opt/gh-aw/actions
|
||||
- name: Checkout repository
|
||||
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
|
||||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
||||
with:
|
||||
persist-credentials: false
|
||||
- name: Create gh-aw temp directory
|
||||
|
|
@ -146,7 +146,7 @@ jobs:
|
|||
const determineAutomaticLockdown = require('/opt/gh-aw/actions/determine_automatic_lockdown.cjs');
|
||||
await determineAutomaticLockdown(github, context, core);
|
||||
- name: Download container images
|
||||
run: bash /opt/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.29.0 ghcr.io/githubnext/gh-aw-mcpg:v0.0.76 node:lts-alpine
|
||||
run: bash /opt/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.29.0 ghcr.io/githubnext/gh-aw-mcpg:v0.0.78 node:lts-alpine
|
||||
- name: Write Safe Outputs Config
|
||||
run: |
|
||||
mkdir -p /opt/gh-aw/safeoutputs
|
||||
|
|
@ -449,7 +449,7 @@ jobs:
|
|||
# Register API key as secret to mask it from logs
|
||||
echo "::add-mask::${MCP_GATEWAY_API_KEY}"
|
||||
export GH_AW_ENGINE="copilot"
|
||||
export MCP_GATEWAY_DOCKER_COMMAND='docker run -i --rm --network host -v /var/run/docker.sock:/var/run/docker.sock -e MCP_GATEWAY_PORT -e MCP_GATEWAY_DOMAIN -e MCP_GATEWAY_API_KEY -e DEBUG="*" -e MCP_GATEWAY_LOG_DIR -e GH_AW_MCP_LOG_DIR -e GH_AW_SAFE_OUTPUTS -e GH_AW_SAFE_OUTPUTS_CONFIG_PATH -e GH_AW_SAFE_OUTPUTS_TOOLS_PATH -e GH_AW_ASSETS_BRANCH -e GH_AW_ASSETS_MAX_SIZE_KB -e GH_AW_ASSETS_ALLOWED_EXTS -e DEFAULT_BRANCH -e GITHUB_MCP_SERVER_TOKEN -e GITHUB_MCP_LOCKDOWN -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e GITHUB_SHA -e GITHUB_WORKSPACE -e GITHUB_TOKEN -e GITHUB_RUN_ID -e GITHUB_RUN_NUMBER -e GITHUB_RUN_ATTEMPT -e GITHUB_JOB -e GITHUB_ACTION -e GITHUB_EVENT_NAME -e GITHUB_EVENT_PATH -e GITHUB_ACTOR -e GITHUB_ACTOR_ID -e GITHUB_TRIGGERING_ACTOR -e GITHUB_WORKFLOW -e GITHUB_WORKFLOW_REF -e GITHUB_WORKFLOW_SHA -e GITHUB_REF -e GITHUB_REF_NAME -e GITHUB_REF_TYPE -e GITHUB_HEAD_REF -e GITHUB_BASE_REF -e GH_AW_SAFE_OUTPUTS_PORT -e GH_AW_SAFE_OUTPUTS_API_KEY -v /opt:/opt:ro -v /tmp:/tmp:rw -v '"${GITHUB_WORKSPACE}"':'"${GITHUB_WORKSPACE}"':rw ghcr.io/githubnext/gh-aw-mcpg:v0.0.76'
|
||||
export MCP_GATEWAY_DOCKER_COMMAND='docker run -i --rm --network host -v /var/run/docker.sock:/var/run/docker.sock -e MCP_GATEWAY_PORT -e MCP_GATEWAY_DOMAIN -e MCP_GATEWAY_API_KEY -e DEBUG="*" -e MCP_GATEWAY_LOG_DIR -e GH_AW_MCP_LOG_DIR -e GH_AW_SAFE_OUTPUTS -e GH_AW_SAFE_OUTPUTS_CONFIG_PATH -e GH_AW_SAFE_OUTPUTS_TOOLS_PATH -e GH_AW_ASSETS_BRANCH -e GH_AW_ASSETS_MAX_SIZE_KB -e GH_AW_ASSETS_ALLOWED_EXTS -e DEFAULT_BRANCH -e GITHUB_MCP_SERVER_TOKEN -e GITHUB_MCP_LOCKDOWN -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e GITHUB_SHA -e GITHUB_WORKSPACE -e GITHUB_TOKEN -e GITHUB_RUN_ID -e GITHUB_RUN_NUMBER -e GITHUB_RUN_ATTEMPT -e GITHUB_JOB -e GITHUB_ACTION -e GITHUB_EVENT_NAME -e GITHUB_EVENT_PATH -e GITHUB_ACTOR -e GITHUB_ACTOR_ID -e GITHUB_TRIGGERING_ACTOR -e GITHUB_WORKFLOW -e GITHUB_WORKFLOW_REF -e GITHUB_WORKFLOW_SHA -e GITHUB_REF -e GITHUB_REF_NAME -e GITHUB_REF_TYPE -e GITHUB_HEAD_REF -e GITHUB_BASE_REF -e GH_AW_SAFE_OUTPUTS_PORT -e GH_AW_SAFE_OUTPUTS_API_KEY -v /opt:/opt:ro -v /tmp:/tmp:rw -v '"${GITHUB_WORKSPACE}"':'"${GITHUB_WORKSPACE}"':rw ghcr.io/githubnext/gh-aw-mcpg:v0.0.78'
|
||||
|
||||
mkdir -p /home/runner/.copilot
|
||||
cat << MCPCONFIG_EOF | bash /opt/gh-aw/actions/start_mcp_gateway.sh
|
||||
|
|
@ -493,7 +493,7 @@ jobs:
|
|||
model: process.env.GH_AW_MODEL_AGENT_COPILOT || "",
|
||||
version: "",
|
||||
agent_version: "0.0.389",
|
||||
cli_version: "v0.37.15",
|
||||
cli_version: "v0.37.19",
|
||||
workflow_name: "Code Conventions Analyzer",
|
||||
experimental: false,
|
||||
supports_tools_allowlist: true,
|
||||
|
|
@ -507,11 +507,10 @@ jobs:
|
|||
actor: context.actor,
|
||||
event_name: context.eventName,
|
||||
staged: false,
|
||||
network_mode: "defaults",
|
||||
allowed_domains: [],
|
||||
allowed_domains: ["defaults"],
|
||||
firewall_enabled: true,
|
||||
awf_version: "v0.10.0",
|
||||
awmg_version: "v0.0.76",
|
||||
awmg_version: "v0.0.78",
|
||||
steps: {
|
||||
firewall: "squid"
|
||||
},
|
||||
|
|
@ -653,15 +652,22 @@ jobs:
|
|||
- Iterator dereferences accessing pair members (e.g., map iterators)
|
||||
- Code that would be clearer with meaningful variable names instead of `.first`/`.second`
|
||||
|
||||
**Naming Convention for Structured Bindings:**
|
||||
When introducing structured bindings, use names that are representative of the types or field semantics:
|
||||
- For `enode_pair`: use `[n1, n2]` instead of `[first, second]` or `[a, b]`
|
||||
- For map iterators: use `[key, value]` or `[k, v]` instead of `[first, second]`
|
||||
- For domain-specific pairs: use names reflecting the semantics (e.g., `[var, offset]`, `[expr, count]`)
|
||||
- **Avoid generic names** like `first`, `second`, `third`, `a`, `b` unless the pair truly represents generic values
|
||||
|
||||
**Example refactoring:**
|
||||
```cpp
|
||||
// Before: Using .first and .second
|
||||
auto x = f(y);
|
||||
return g(x.first, x.second);
|
||||
// Before: Using .first and .second on enode_pair
|
||||
enode_pair p = get_pair(y);
|
||||
return merge(p.first, p.second);
|
||||
|
||||
// After: Using structured bindings
|
||||
auto [a, b] = f(y);
|
||||
return g(a, b);
|
||||
// After: Using structured bindings with meaningful names
|
||||
auto [n1, n2] = get_pair(y);
|
||||
return merge(n1, n2);
|
||||
```
|
||||
|
||||
**TERTIARY FOCUS: Create Issues for initializer_list Refactoring**
|
||||
|
|
@ -1056,6 +1062,8 @@ jobs:
|
|||
- Constructors with member initializers (may still be candidates for improvement)
|
||||
- Constructors that only initialize members to default values
|
||||
- **Empty destructors**: Trivial destructors that can be removed or use `= default`
|
||||
PROMPT_EOF
|
||||
cat << 'PROMPT_EOF' >> "$GH_AW_PROMPT"
|
||||
- Destructors with empty body `~Class() {}`
|
||||
- Non-virtual destructors that don't need to be explicitly defined
|
||||
- Virtual destructors (keep explicit even if empty for polymorphic classes),
|
||||
|
|
@ -1064,8 +1072,6 @@ jobs:
|
|||
- Classes with virtual functions but non-virtual destructors (potential issue)
|
||||
- Base classes without virtual destructors (check if inheritance is intended)
|
||||
- Non-virtual destructors missing `noexcept` (should be added)
|
||||
PROMPT_EOF
|
||||
cat << 'PROMPT_EOF' >> "$GH_AW_PROMPT"
|
||||
- Leaf classes with unnecessary virtual destructors (minor overhead)
|
||||
- Missing `noexcept` on non-default constructors and destructors
|
||||
- Opportunities to use compiler-generated special members (`= default`, `= delete`)
|
||||
|
|
@ -1128,15 +1134,16 @@ jobs:
|
|||
- **SECONDARY TASK**: Code accessing `.first` and `.second` on pairs/tuples
|
||||
- **ACTION**: Replace with C++17 structured bindings for cleaner, more readable code
|
||||
- **RESULT**: Create an issue with the actual code changes
|
||||
- **NAMING**: Use descriptive names based on types/semantics (e.g., `[n1, n2]` for `enode_pair`, `[k, v]` for maps)
|
||||
- **Example**:
|
||||
```cpp
|
||||
// Before
|
||||
auto x = f(y);
|
||||
return g(x.first, x.second);
|
||||
enode_pair p = get_pair(y);
|
||||
return merge(p.first, p.second);
|
||||
|
||||
// After
|
||||
auto [a, b] = f(y);
|
||||
return g(a, b);
|
||||
// After: Use meaningful names, not generic [a, b]
|
||||
auto [n1, n2] = get_pair(y);
|
||||
return merge(n1, n2);
|
||||
```
|
||||
|
||||
**Exception String Construction:**
|
||||
|
|
@ -1448,6 +1455,8 @@ jobs:
|
|||
- **Simplification**: [Code that would be cleaner with auto cleanup]
|
||||
|
||||
### 4.7 Move Semantics Analysis
|
||||
PROMPT_EOF
|
||||
cat << 'PROMPT_EOF' >> "$GH_AW_PROMPT"
|
||||
- **Missing std::move**: [Returns/assignments that should use move]
|
||||
- **Incorrect std::move**: [Move from const, unnecessary moves]
|
||||
- **Return Value Optimization**: [Places where RVO is blocked]
|
||||
|
|
@ -1463,8 +1472,6 @@ jobs:
|
|||
2. Refactor using the `edit` tool
|
||||
3. Create an issue with your changes
|
||||
- **API Improvements**: Specific function signatures to update
|
||||
PROMPT_EOF
|
||||
cat << 'PROMPT_EOF' >> "$GH_AW_PROMPT"
|
||||
- **Examples**: File:line references with before/after code
|
||||
- **Output**: Issue (not just discussion)
|
||||
|
||||
|
|
@ -1482,17 +1489,17 @@ jobs:
|
|||
- **Action**: Find and refactor tuple/pair access patterns:
|
||||
1. Search for patterns using `.first` and `.second`
|
||||
2. Identify cases where intermediate variable can be eliminated
|
||||
3. Refactor to use structured bindings
|
||||
3. Refactor to use structured bindings with **meaningful names** (not generic `a`, `b`, `first`, `second`)
|
||||
4. Create an issue with changes
|
||||
- **Example Pattern**:
|
||||
```cpp
|
||||
// Before: Using .first and .second
|
||||
auto x = f(y);
|
||||
return g(x.first, x.second);
|
||||
// Before: Using .first and .second on enode_pair
|
||||
enode_pair p = get_pair(y);
|
||||
return merge(p.first, p.second);
|
||||
|
||||
// After: Using structured bindings
|
||||
auto [a, b] = f(y);
|
||||
return g(a, b);
|
||||
// After: Using structured bindings with descriptive names
|
||||
auto [n1, n2] = get_pair(y);
|
||||
return merge(n1, n2);
|
||||
```
|
||||
- **Another Example**:
|
||||
```cpp
|
||||
|
|
@ -1907,6 +1914,8 @@ jobs:
|
|||
|
||||
- Never execute untrusted code
|
||||
- Use `bash` only for safe operations (git, grep patterns)
|
||||
PROMPT_EOF
|
||||
cat << 'PROMPT_EOF' >> "$GH_AW_PROMPT"
|
||||
- **For std::optional refactoring**: Use the `edit` tool to modify files directly
|
||||
- **For other findings**: Create discussions only (no code modifications)
|
||||
- All code changes for std::optional will be reviewed through the issue process
|
||||
|
|
@ -2002,7 +2011,7 @@ jobs:
|
|||
timeout-minutes: 20
|
||||
run: |
|
||||
set -o pipefail
|
||||
sudo -E awf --env-all --container-workdir "${GITHUB_WORKSPACE}" --mount /tmp:/tmp:rw --mount "${GITHUB_WORKSPACE}:${GITHUB_WORKSPACE}:rw" --mount /usr/bin/date:/usr/bin/date:ro --mount /usr/bin/gh:/usr/bin/gh:ro --mount /usr/bin/yq:/usr/bin/yq:ro --mount /usr/local/bin/copilot:/usr/local/bin/copilot:ro --mount /home/runner/.copilot:/home/runner/.copilot:rw --mount /opt/gh-aw:/opt/gh-aw:ro --allow-domains api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,github.com,host.docker.internal,raw.githubusercontent.com,registry.npmjs.org --log-level info --proxy-logs-dir /tmp/gh-aw/sandbox/firewall/logs --enable-host-access --image-tag 0.10.0 \
|
||||
sudo -E awf --env-all --container-workdir "${GITHUB_WORKSPACE}" --mount /tmp:/tmp:rw --mount "${GITHUB_WORKSPACE}:${GITHUB_WORKSPACE}:rw" --mount /usr/bin/date:/usr/bin/date:ro --mount /usr/bin/gh:/usr/bin/gh:ro --mount /usr/bin/yq:/usr/bin/yq:ro --mount /usr/local/bin/copilot:/usr/local/bin/copilot:ro --mount /home/runner/.copilot:/home/runner/.copilot:rw --mount /opt/gh-aw:/opt/gh-aw:ro --allow-domains api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,github.com,host.docker.internal,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,ppa.launchpad.net,raw.githubusercontent.com,registry.npmjs.org,s.symcb.com,s.symcd.com,security.ubuntu.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com --log-level info --proxy-logs-dir /tmp/gh-aw/sandbox/firewall/logs --enable-host-access --image-tag 0.10.0 \
|
||||
-- /usr/local/bin/copilot --add-dir /tmp/gh-aw/ --log-level all --log-dir /tmp/gh-aw/sandbox/agent/logs/ --add-dir "${GITHUB_WORKSPACE}" --disable-builtin-mcps --allow-tool github --allow-tool safeoutputs --allow-tool 'shell(cat)' --allow-tool 'shell(clang-format --version)' --allow-tool 'shell(date)' --allow-tool 'shell(echo)' --allow-tool 'shell(git diff:*)' --allow-tool 'shell(git log:*)' --allow-tool 'shell(git show:*)' --allow-tool 'shell(grep)' --allow-tool 'shell(head)' --allow-tool 'shell(ls)' --allow-tool 'shell(pwd)' --allow-tool 'shell(sort)' --allow-tool 'shell(tail)' --allow-tool 'shell(uniq)' --allow-tool 'shell(wc)' --allow-tool 'shell(yq)' --allow-tool write --add-dir /tmp/gh-aw/cache-memory/ --allow-all-paths --share /tmp/gh-aw/sandbox/agent/logs/conversation.md --prompt "$(cat /tmp/gh-aw/aw-prompts/prompt.txt)"${GH_AW_MODEL_AGENT_COPILOT:+ --model "$GH_AW_MODEL_AGENT_COPILOT"} \
|
||||
2>&1 | tee /tmp/gh-aw/agent-stdio.log
|
||||
env:
|
||||
|
|
@ -2070,7 +2079,7 @@ jobs:
|
|||
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
|
||||
env:
|
||||
GH_AW_SAFE_OUTPUTS: ${{ env.GH_AW_SAFE_OUTPUTS }}
|
||||
GH_AW_ALLOWED_DOMAINS: "api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,github.com,host.docker.internal,raw.githubusercontent.com,registry.npmjs.org"
|
||||
GH_AW_ALLOWED_DOMAINS: "api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,github.com,host.docker.internal,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,ppa.launchpad.net,raw.githubusercontent.com,registry.npmjs.org,s.symcb.com,s.symcd.com,security.ubuntu.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com"
|
||||
GITHUB_SERVER_URL: ${{ github.server_url }}
|
||||
GITHUB_API_URL: ${{ github.api_url }}
|
||||
with:
|
||||
|
|
@ -2164,7 +2173,7 @@ jobs:
|
|||
total_count: ${{ steps.missing_tool.outputs.total_count }}
|
||||
steps:
|
||||
- name: Setup Scripts
|
||||
uses: githubnext/gh-aw/actions/setup@v0.37.15
|
||||
uses: githubnext/gh-aw/actions/setup@v0.37.19
|
||||
with:
|
||||
destination: /opt/gh-aw/actions
|
||||
- name: Debug job inputs
|
||||
|
|
@ -2180,7 +2189,7 @@ jobs:
|
|||
echo "Agent Conclusion: $AGENT_CONCLUSION"
|
||||
- name: Download agent output artifact
|
||||
continue-on-error: true
|
||||
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
|
||||
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
|
||||
with:
|
||||
name: agent-output
|
||||
path: /tmp/gh-aw/safeoutputs/
|
||||
|
|
@ -2265,18 +2274,18 @@ jobs:
|
|||
success: ${{ steps.parse_results.outputs.success }}
|
||||
steps:
|
||||
- name: Setup Scripts
|
||||
uses: githubnext/gh-aw/actions/setup@v0.37.15
|
||||
uses: githubnext/gh-aw/actions/setup@v0.37.19
|
||||
with:
|
||||
destination: /opt/gh-aw/actions
|
||||
- name: Download agent artifacts
|
||||
continue-on-error: true
|
||||
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
|
||||
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
|
||||
with:
|
||||
name: agent-artifacts
|
||||
path: /tmp/gh-aw/threat-detection/
|
||||
- name: Download agent output artifact
|
||||
continue-on-error: true
|
||||
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
|
||||
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
|
||||
with:
|
||||
name: agent-output
|
||||
path: /tmp/gh-aw/threat-detection/
|
||||
|
|
@ -2416,12 +2425,12 @@ jobs:
|
|||
process_safe_outputs_temporary_id_map: ${{ steps.process_safe_outputs.outputs.temporary_id_map }}
|
||||
steps:
|
||||
- name: Setup Scripts
|
||||
uses: githubnext/gh-aw/actions/setup@v0.37.15
|
||||
uses: githubnext/gh-aw/actions/setup@v0.37.19
|
||||
with:
|
||||
destination: /opt/gh-aw/actions
|
||||
- name: Download agent output artifact
|
||||
continue-on-error: true
|
||||
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
|
||||
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
|
||||
with:
|
||||
name: agent-output
|
||||
path: /tmp/gh-aw/safeoutputs/
|
||||
|
|
@ -2453,11 +2462,11 @@ jobs:
|
|||
permissions: {}
|
||||
steps:
|
||||
- name: Setup Scripts
|
||||
uses: githubnext/gh-aw/actions/setup@v0.37.15
|
||||
uses: githubnext/gh-aw/actions/setup@v0.37.19
|
||||
with:
|
||||
destination: /opt/gh-aw/actions
|
||||
- name: Download cache-memory artifact (default)
|
||||
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
|
||||
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
|
||||
continue-on-error: true
|
||||
with:
|
||||
name: cache-memory
|
||||
|
|
|
|||
35
.github/workflows/release-notes-updater.lock.yml
generated
vendored
35
.github/workflows/release-notes-updater.lock.yml
generated
vendored
|
|
@ -13,7 +13,7 @@
|
|||
# \ /\ / (_) | | | | ( | | | | (_) \ V V /\__ \
|
||||
# \/ \/ \___/|_| |_|\_\|_| |_|\___/ \_/\_/ |___/
|
||||
#
|
||||
# This file was automatically generated by gh-aw (v0.37.15). DO NOT EDIT.
|
||||
# This file was automatically generated by gh-aw (v0.37.19). DO NOT EDIT.
|
||||
#
|
||||
# To update this file, edit the corresponding .md file and run:
|
||||
# gh aw compile
|
||||
|
|
@ -45,7 +45,7 @@ jobs:
|
|||
comment_repo: ""
|
||||
steps:
|
||||
- name: Setup Scripts
|
||||
uses: githubnext/gh-aw/actions/setup@v0.37.15
|
||||
uses: githubnext/gh-aw/actions/setup@v0.37.19
|
||||
with:
|
||||
destination: /opt/gh-aw/actions
|
||||
- name: Check workflow file timestamps
|
||||
|
|
@ -82,7 +82,7 @@ jobs:
|
|||
secret_verification_result: ${{ steps.validate-secret.outputs.verification_result }}
|
||||
steps:
|
||||
- name: Setup Scripts
|
||||
uses: githubnext/gh-aw/actions/setup@v0.37.15
|
||||
uses: githubnext/gh-aw/actions/setup@v0.37.19
|
||||
with:
|
||||
destination: /opt/gh-aw/actions
|
||||
- name: Create gh-aw temp directory
|
||||
|
|
@ -136,7 +136,7 @@ jobs:
|
|||
const determineAutomaticLockdown = require('/opt/gh-aw/actions/determine_automatic_lockdown.cjs');
|
||||
await determineAutomaticLockdown(github, context, core);
|
||||
- name: Download container images
|
||||
run: bash /opt/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.29.0 ghcr.io/githubnext/gh-aw-mcpg:v0.0.76 node:lts-alpine
|
||||
run: bash /opt/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.29.0 ghcr.io/githubnext/gh-aw-mcpg:v0.0.78 node:lts-alpine
|
||||
- name: Write Safe Outputs Config
|
||||
run: |
|
||||
mkdir -p /opt/gh-aw/safeoutputs
|
||||
|
|
@ -366,7 +366,7 @@ jobs:
|
|||
# Register API key as secret to mask it from logs
|
||||
echo "::add-mask::${MCP_GATEWAY_API_KEY}"
|
||||
export GH_AW_ENGINE="copilot"
|
||||
export MCP_GATEWAY_DOCKER_COMMAND='docker run -i --rm --network host -v /var/run/docker.sock:/var/run/docker.sock -e MCP_GATEWAY_PORT -e MCP_GATEWAY_DOMAIN -e MCP_GATEWAY_API_KEY -e DEBUG="*" -e MCP_GATEWAY_LOG_DIR -e GH_AW_MCP_LOG_DIR -e GH_AW_SAFE_OUTPUTS -e GH_AW_SAFE_OUTPUTS_CONFIG_PATH -e GH_AW_SAFE_OUTPUTS_TOOLS_PATH -e GH_AW_ASSETS_BRANCH -e GH_AW_ASSETS_MAX_SIZE_KB -e GH_AW_ASSETS_ALLOWED_EXTS -e DEFAULT_BRANCH -e GITHUB_MCP_SERVER_TOKEN -e GITHUB_MCP_LOCKDOWN -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e GITHUB_SHA -e GITHUB_WORKSPACE -e GITHUB_TOKEN -e GITHUB_RUN_ID -e GITHUB_RUN_NUMBER -e GITHUB_RUN_ATTEMPT -e GITHUB_JOB -e GITHUB_ACTION -e GITHUB_EVENT_NAME -e GITHUB_EVENT_PATH -e GITHUB_ACTOR -e GITHUB_ACTOR_ID -e GITHUB_TRIGGERING_ACTOR -e GITHUB_WORKFLOW -e GITHUB_WORKFLOW_REF -e GITHUB_WORKFLOW_SHA -e GITHUB_REF -e GITHUB_REF_NAME -e GITHUB_REF_TYPE -e GITHUB_HEAD_REF -e GITHUB_BASE_REF -e GH_AW_SAFE_OUTPUTS_PORT -e GH_AW_SAFE_OUTPUTS_API_KEY -v /opt:/opt:ro -v /tmp:/tmp:rw -v '"${GITHUB_WORKSPACE}"':'"${GITHUB_WORKSPACE}"':rw ghcr.io/githubnext/gh-aw-mcpg:v0.0.76'
|
||||
export MCP_GATEWAY_DOCKER_COMMAND='docker run -i --rm --network host -v /var/run/docker.sock:/var/run/docker.sock -e MCP_GATEWAY_PORT -e MCP_GATEWAY_DOMAIN -e MCP_GATEWAY_API_KEY -e DEBUG="*" -e MCP_GATEWAY_LOG_DIR -e GH_AW_MCP_LOG_DIR -e GH_AW_SAFE_OUTPUTS -e GH_AW_SAFE_OUTPUTS_CONFIG_PATH -e GH_AW_SAFE_OUTPUTS_TOOLS_PATH -e GH_AW_ASSETS_BRANCH -e GH_AW_ASSETS_MAX_SIZE_KB -e GH_AW_ASSETS_ALLOWED_EXTS -e DEFAULT_BRANCH -e GITHUB_MCP_SERVER_TOKEN -e GITHUB_MCP_LOCKDOWN -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e GITHUB_SHA -e GITHUB_WORKSPACE -e GITHUB_TOKEN -e GITHUB_RUN_ID -e GITHUB_RUN_NUMBER -e GITHUB_RUN_ATTEMPT -e GITHUB_JOB -e GITHUB_ACTION -e GITHUB_EVENT_NAME -e GITHUB_EVENT_PATH -e GITHUB_ACTOR -e GITHUB_ACTOR_ID -e GITHUB_TRIGGERING_ACTOR -e GITHUB_WORKFLOW -e GITHUB_WORKFLOW_REF -e GITHUB_WORKFLOW_SHA -e GITHUB_REF -e GITHUB_REF_NAME -e GITHUB_REF_TYPE -e GITHUB_HEAD_REF -e GITHUB_BASE_REF -e GH_AW_SAFE_OUTPUTS_PORT -e GH_AW_SAFE_OUTPUTS_API_KEY -v /opt:/opt:ro -v /tmp:/tmp:rw -v '"${GITHUB_WORKSPACE}"':'"${GITHUB_WORKSPACE}"':rw ghcr.io/githubnext/gh-aw-mcpg:v0.0.78'
|
||||
|
||||
mkdir -p /home/runner/.copilot
|
||||
cat << MCPCONFIG_EOF | bash /opt/gh-aw/actions/start_mcp_gateway.sh
|
||||
|
|
@ -410,7 +410,7 @@ jobs:
|
|||
model: process.env.GH_AW_MODEL_AGENT_COPILOT || "",
|
||||
version: "",
|
||||
agent_version: "0.0.389",
|
||||
cli_version: "v0.37.15",
|
||||
cli_version: "v0.37.19",
|
||||
workflow_name: "Release Notes Updater",
|
||||
experimental: false,
|
||||
supports_tools_allowlist: true,
|
||||
|
|
@ -424,11 +424,10 @@ jobs:
|
|||
actor: context.actor,
|
||||
event_name: context.eventName,
|
||||
staged: false,
|
||||
network_mode: "defaults",
|
||||
allowed_domains: [],
|
||||
allowed_domains: ["defaults"],
|
||||
firewall_enabled: true,
|
||||
awf_version: "v0.10.0",
|
||||
awmg_version: "v0.0.76",
|
||||
awmg_version: "v0.0.78",
|
||||
steps: {
|
||||
firewall: "squid"
|
||||
},
|
||||
|
|
@ -758,7 +757,7 @@ jobs:
|
|||
timeout-minutes: 30
|
||||
run: |
|
||||
set -o pipefail
|
||||
sudo -E awf --env-all --container-workdir "${GITHUB_WORKSPACE}" --mount /tmp:/tmp:rw --mount "${GITHUB_WORKSPACE}:${GITHUB_WORKSPACE}:rw" --mount /usr/bin/date:/usr/bin/date:ro --mount /usr/bin/gh:/usr/bin/gh:ro --mount /usr/bin/yq:/usr/bin/yq:ro --mount /usr/local/bin/copilot:/usr/local/bin/copilot:ro --mount /home/runner/.copilot:/home/runner/.copilot:rw --mount /opt/gh-aw:/opt/gh-aw:ro --allow-domains api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,github.com,host.docker.internal,raw.githubusercontent.com,registry.npmjs.org --log-level info --proxy-logs-dir /tmp/gh-aw/sandbox/firewall/logs --enable-host-access --image-tag 0.10.0 \
|
||||
sudo -E awf --env-all --container-workdir "${GITHUB_WORKSPACE}" --mount /tmp:/tmp:rw --mount "${GITHUB_WORKSPACE}:${GITHUB_WORKSPACE}:rw" --mount /usr/bin/date:/usr/bin/date:ro --mount /usr/bin/gh:/usr/bin/gh:ro --mount /usr/bin/yq:/usr/bin/yq:ro --mount /usr/local/bin/copilot:/usr/local/bin/copilot:ro --mount /home/runner/.copilot:/home/runner/.copilot:rw --mount /opt/gh-aw:/opt/gh-aw:ro --allow-domains api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,github.com,host.docker.internal,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,ppa.launchpad.net,raw.githubusercontent.com,registry.npmjs.org,s.symcb.com,s.symcd.com,security.ubuntu.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com --log-level info --proxy-logs-dir /tmp/gh-aw/sandbox/firewall/logs --enable-host-access --image-tag 0.10.0 \
|
||||
-- /usr/local/bin/copilot --add-dir /tmp/gh-aw/ --log-level all --log-dir /tmp/gh-aw/sandbox/agent/logs/ --add-dir "${GITHUB_WORKSPACE}" --disable-builtin-mcps --allow-all-tools --allow-all-paths --share /tmp/gh-aw/sandbox/agent/logs/conversation.md --prompt "$(cat /tmp/gh-aw/aw-prompts/prompt.txt)"${GH_AW_MODEL_AGENT_COPILOT:+ --model "$GH_AW_MODEL_AGENT_COPILOT"} \
|
||||
2>&1 | tee /tmp/gh-aw/agent-stdio.log
|
||||
env:
|
||||
|
|
@ -826,7 +825,7 @@ jobs:
|
|||
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
|
||||
env:
|
||||
GH_AW_SAFE_OUTPUTS: ${{ env.GH_AW_SAFE_OUTPUTS }}
|
||||
GH_AW_ALLOWED_DOMAINS: "api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,github.com,host.docker.internal,raw.githubusercontent.com,registry.npmjs.org"
|
||||
GH_AW_ALLOWED_DOMAINS: "api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,github.com,host.docker.internal,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,ppa.launchpad.net,raw.githubusercontent.com,registry.npmjs.org,s.symcb.com,s.symcd.com,security.ubuntu.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com"
|
||||
GITHUB_SERVER_URL: ${{ github.server_url }}
|
||||
GITHUB_API_URL: ${{ github.api_url }}
|
||||
with:
|
||||
|
|
@ -913,7 +912,7 @@ jobs:
|
|||
total_count: ${{ steps.missing_tool.outputs.total_count }}
|
||||
steps:
|
||||
- name: Setup Scripts
|
||||
uses: githubnext/gh-aw/actions/setup@v0.37.15
|
||||
uses: githubnext/gh-aw/actions/setup@v0.37.19
|
||||
with:
|
||||
destination: /opt/gh-aw/actions
|
||||
- name: Debug job inputs
|
||||
|
|
@ -929,7 +928,7 @@ jobs:
|
|||
echo "Agent Conclusion: $AGENT_CONCLUSION"
|
||||
- name: Download agent output artifact
|
||||
continue-on-error: true
|
||||
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
|
||||
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
|
||||
with:
|
||||
name: agent-output
|
||||
path: /tmp/gh-aw/safeoutputs/
|
||||
|
|
@ -1012,18 +1011,18 @@ jobs:
|
|||
success: ${{ steps.parse_results.outputs.success }}
|
||||
steps:
|
||||
- name: Setup Scripts
|
||||
uses: githubnext/gh-aw/actions/setup@v0.37.15
|
||||
uses: githubnext/gh-aw/actions/setup@v0.37.19
|
||||
with:
|
||||
destination: /opt/gh-aw/actions
|
||||
- name: Download agent artifacts
|
||||
continue-on-error: true
|
||||
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
|
||||
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
|
||||
with:
|
||||
name: agent-artifacts
|
||||
path: /tmp/gh-aw/threat-detection/
|
||||
- name: Download agent output artifact
|
||||
continue-on-error: true
|
||||
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
|
||||
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
|
||||
with:
|
||||
name: agent-output
|
||||
path: /tmp/gh-aw/threat-detection/
|
||||
|
|
@ -1162,12 +1161,12 @@ jobs:
|
|||
process_safe_outputs_temporary_id_map: ${{ steps.process_safe_outputs.outputs.temporary_id_map }}
|
||||
steps:
|
||||
- name: Setup Scripts
|
||||
uses: githubnext/gh-aw/actions/setup@v0.37.15
|
||||
uses: githubnext/gh-aw/actions/setup@v0.37.19
|
||||
with:
|
||||
destination: /opt/gh-aw/actions
|
||||
- name: Download agent output artifact
|
||||
continue-on-error: true
|
||||
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
|
||||
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
|
||||
with:
|
||||
name: agent-output
|
||||
path: /tmp/gh-aw/safeoutputs/
|
||||
|
|
|
|||
39
.github/workflows/soundness-bug-detector.lock.yml
generated
vendored
39
.github/workflows/soundness-bug-detector.lock.yml
generated
vendored
|
|
@ -13,7 +13,7 @@
|
|||
# \ /\ / (_) | | | | ( | | | | (_) \ V V /\__ \
|
||||
# \/ \/ \___/|_| |_|\_\|_| |_|\___/ \_/\_/ |___/
|
||||
#
|
||||
# This file was automatically generated by gh-aw (v0.37.15). DO NOT EDIT.
|
||||
# This file was automatically generated by gh-aw (v0.37.19). DO NOT EDIT.
|
||||
#
|
||||
# To update this file, edit the corresponding .md file and run:
|
||||
# gh aw compile
|
||||
|
|
@ -49,7 +49,7 @@ jobs:
|
|||
comment_repo: ""
|
||||
steps:
|
||||
- name: Setup Scripts
|
||||
uses: githubnext/gh-aw/actions/setup@v0.37.15
|
||||
uses: githubnext/gh-aw/actions/setup@v0.37.19
|
||||
with:
|
||||
destination: /opt/gh-aw/actions
|
||||
- name: Check workflow file timestamps
|
||||
|
|
@ -84,7 +84,7 @@ jobs:
|
|||
secret_verification_result: ${{ steps.validate-secret.outputs.verification_result }}
|
||||
steps:
|
||||
- name: Setup Scripts
|
||||
uses: githubnext/gh-aw/actions/setup@v0.37.15
|
||||
uses: githubnext/gh-aw/actions/setup@v0.37.19
|
||||
with:
|
||||
destination: /opt/gh-aw/actions
|
||||
- name: Create gh-aw temp directory
|
||||
|
|
@ -147,7 +147,7 @@ jobs:
|
|||
const determineAutomaticLockdown = require('/opt/gh-aw/actions/determine_automatic_lockdown.cjs');
|
||||
await determineAutomaticLockdown(github, context, core);
|
||||
- name: Download container images
|
||||
run: bash /opt/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.29.0 ghcr.io/githubnext/gh-aw-mcpg:v0.0.76 node:lts-alpine
|
||||
run: bash /opt/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.29.0 ghcr.io/githubnext/gh-aw-mcpg:v0.0.78 node:lts-alpine
|
||||
- name: Write Safe Outputs Config
|
||||
run: |
|
||||
mkdir -p /opt/gh-aw/safeoutputs
|
||||
|
|
@ -412,7 +412,7 @@ jobs:
|
|||
# Register API key as secret to mask it from logs
|
||||
echo "::add-mask::${MCP_GATEWAY_API_KEY}"
|
||||
export GH_AW_ENGINE="copilot"
|
||||
export MCP_GATEWAY_DOCKER_COMMAND='docker run -i --rm --network host -v /var/run/docker.sock:/var/run/docker.sock -e MCP_GATEWAY_PORT -e MCP_GATEWAY_DOMAIN -e MCP_GATEWAY_API_KEY -e DEBUG="*" -e MCP_GATEWAY_LOG_DIR -e GH_AW_MCP_LOG_DIR -e GH_AW_SAFE_OUTPUTS -e GH_AW_SAFE_OUTPUTS_CONFIG_PATH -e GH_AW_SAFE_OUTPUTS_TOOLS_PATH -e GH_AW_ASSETS_BRANCH -e GH_AW_ASSETS_MAX_SIZE_KB -e GH_AW_ASSETS_ALLOWED_EXTS -e DEFAULT_BRANCH -e GITHUB_MCP_SERVER_TOKEN -e GITHUB_MCP_LOCKDOWN -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e GITHUB_SHA -e GITHUB_WORKSPACE -e GITHUB_TOKEN -e GITHUB_RUN_ID -e GITHUB_RUN_NUMBER -e GITHUB_RUN_ATTEMPT -e GITHUB_JOB -e GITHUB_ACTION -e GITHUB_EVENT_NAME -e GITHUB_EVENT_PATH -e GITHUB_ACTOR -e GITHUB_ACTOR_ID -e GITHUB_TRIGGERING_ACTOR -e GITHUB_WORKFLOW -e GITHUB_WORKFLOW_REF -e GITHUB_WORKFLOW_SHA -e GITHUB_REF -e GITHUB_REF_NAME -e GITHUB_REF_TYPE -e GITHUB_HEAD_REF -e GITHUB_BASE_REF -e GH_AW_SAFE_OUTPUTS_PORT -e GH_AW_SAFE_OUTPUTS_API_KEY -v /opt:/opt:ro -v /tmp:/tmp:rw -v '"${GITHUB_WORKSPACE}"':'"${GITHUB_WORKSPACE}"':rw ghcr.io/githubnext/gh-aw-mcpg:v0.0.76'
|
||||
export MCP_GATEWAY_DOCKER_COMMAND='docker run -i --rm --network host -v /var/run/docker.sock:/var/run/docker.sock -e MCP_GATEWAY_PORT -e MCP_GATEWAY_DOMAIN -e MCP_GATEWAY_API_KEY -e DEBUG="*" -e MCP_GATEWAY_LOG_DIR -e GH_AW_MCP_LOG_DIR -e GH_AW_SAFE_OUTPUTS -e GH_AW_SAFE_OUTPUTS_CONFIG_PATH -e GH_AW_SAFE_OUTPUTS_TOOLS_PATH -e GH_AW_ASSETS_BRANCH -e GH_AW_ASSETS_MAX_SIZE_KB -e GH_AW_ASSETS_ALLOWED_EXTS -e DEFAULT_BRANCH -e GITHUB_MCP_SERVER_TOKEN -e GITHUB_MCP_LOCKDOWN -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e GITHUB_SHA -e GITHUB_WORKSPACE -e GITHUB_TOKEN -e GITHUB_RUN_ID -e GITHUB_RUN_NUMBER -e GITHUB_RUN_ATTEMPT -e GITHUB_JOB -e GITHUB_ACTION -e GITHUB_EVENT_NAME -e GITHUB_EVENT_PATH -e GITHUB_ACTOR -e GITHUB_ACTOR_ID -e GITHUB_TRIGGERING_ACTOR -e GITHUB_WORKFLOW -e GITHUB_WORKFLOW_REF -e GITHUB_WORKFLOW_SHA -e GITHUB_REF -e GITHUB_REF_NAME -e GITHUB_REF_TYPE -e GITHUB_HEAD_REF -e GITHUB_BASE_REF -e GH_AW_SAFE_OUTPUTS_PORT -e GH_AW_SAFE_OUTPUTS_API_KEY -v /opt:/opt:ro -v /tmp:/tmp:rw -v '"${GITHUB_WORKSPACE}"':'"${GITHUB_WORKSPACE}"':rw ghcr.io/githubnext/gh-aw-mcpg:v0.0.78'
|
||||
|
||||
mkdir -p /home/runner/.copilot
|
||||
cat << MCPCONFIG_EOF | bash /opt/gh-aw/actions/start_mcp_gateway.sh
|
||||
|
|
@ -456,7 +456,7 @@ jobs:
|
|||
model: process.env.GH_AW_MODEL_AGENT_COPILOT || "",
|
||||
version: "",
|
||||
agent_version: "0.0.389",
|
||||
cli_version: "v0.37.15",
|
||||
cli_version: "v0.37.19",
|
||||
workflow_name: "Soundness Bug Detector",
|
||||
experimental: false,
|
||||
supports_tools_allowlist: true,
|
||||
|
|
@ -470,11 +470,10 @@ jobs:
|
|||
actor: context.actor,
|
||||
event_name: context.eventName,
|
||||
staged: false,
|
||||
network_mode: "defaults",
|
||||
allowed_domains: [],
|
||||
allowed_domains: ["defaults"],
|
||||
firewall_enabled: true,
|
||||
awf_version: "v0.10.0",
|
||||
awmg_version: "v0.0.76",
|
||||
awmg_version: "v0.0.78",
|
||||
steps: {
|
||||
firewall: "squid"
|
||||
},
|
||||
|
|
@ -639,7 +638,7 @@ jobs:
|
|||
timeout-minutes: 30
|
||||
run: |
|
||||
set -o pipefail
|
||||
sudo -E awf --env-all --container-workdir "${GITHUB_WORKSPACE}" --mount /tmp:/tmp:rw --mount "${GITHUB_WORKSPACE}:${GITHUB_WORKSPACE}:rw" --mount /usr/bin/date:/usr/bin/date:ro --mount /usr/bin/gh:/usr/bin/gh:ro --mount /usr/bin/yq:/usr/bin/yq:ro --mount /usr/local/bin/copilot:/usr/local/bin/copilot:ro --mount /home/runner/.copilot:/home/runner/.copilot:rw --mount /opt/gh-aw:/opt/gh-aw:ro --allow-domains api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,github.com,host.docker.internal,raw.githubusercontent.com,registry.npmjs.org --log-level info --proxy-logs-dir /tmp/gh-aw/sandbox/firewall/logs --enable-host-access --image-tag 0.10.0 \
|
||||
sudo -E awf --env-all --container-workdir "${GITHUB_WORKSPACE}" --mount /tmp:/tmp:rw --mount "${GITHUB_WORKSPACE}:${GITHUB_WORKSPACE}:rw" --mount /usr/bin/date:/usr/bin/date:ro --mount /usr/bin/gh:/usr/bin/gh:ro --mount /usr/bin/yq:/usr/bin/yq:ro --mount /usr/local/bin/copilot:/usr/local/bin/copilot:ro --mount /home/runner/.copilot:/home/runner/.copilot:rw --mount /opt/gh-aw:/opt/gh-aw:ro --allow-domains api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,github.com,host.docker.internal,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,ppa.launchpad.net,raw.githubusercontent.com,registry.npmjs.org,s.symcb.com,s.symcd.com,security.ubuntu.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com --log-level info --proxy-logs-dir /tmp/gh-aw/sandbox/firewall/logs --enable-host-access --image-tag 0.10.0 \
|
||||
-- /usr/local/bin/copilot --add-dir /tmp/gh-aw/ --log-level all --log-dir /tmp/gh-aw/sandbox/agent/logs/ --add-dir "${GITHUB_WORKSPACE}" --disable-builtin-mcps --allow-all-tools --add-dir /tmp/gh-aw/cache-memory/ --allow-all-paths --share /tmp/gh-aw/sandbox/agent/logs/conversation.md --prompt "$(cat /tmp/gh-aw/aw-prompts/prompt.txt)"${GH_AW_MODEL_AGENT_COPILOT:+ --model "$GH_AW_MODEL_AGENT_COPILOT"} \
|
||||
2>&1 | tee /tmp/gh-aw/agent-stdio.log
|
||||
env:
|
||||
|
|
@ -707,7 +706,7 @@ jobs:
|
|||
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
|
||||
env:
|
||||
GH_AW_SAFE_OUTPUTS: ${{ env.GH_AW_SAFE_OUTPUTS }}
|
||||
GH_AW_ALLOWED_DOMAINS: "api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,github.com,host.docker.internal,raw.githubusercontent.com,registry.npmjs.org"
|
||||
GH_AW_ALLOWED_DOMAINS: "api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,github.com,host.docker.internal,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,ppa.launchpad.net,raw.githubusercontent.com,registry.npmjs.org,s.symcb.com,s.symcd.com,security.ubuntu.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com"
|
||||
GITHUB_SERVER_URL: ${{ github.server_url }}
|
||||
GITHUB_API_URL: ${{ github.api_url }}
|
||||
with:
|
||||
|
|
@ -801,7 +800,7 @@ jobs:
|
|||
total_count: ${{ steps.missing_tool.outputs.total_count }}
|
||||
steps:
|
||||
- name: Setup Scripts
|
||||
uses: githubnext/gh-aw/actions/setup@v0.37.15
|
||||
uses: githubnext/gh-aw/actions/setup@v0.37.19
|
||||
with:
|
||||
destination: /opt/gh-aw/actions
|
||||
- name: Debug job inputs
|
||||
|
|
@ -817,7 +816,7 @@ jobs:
|
|||
echo "Agent Conclusion: $AGENT_CONCLUSION"
|
||||
- name: Download agent output artifact
|
||||
continue-on-error: true
|
||||
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
|
||||
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
|
||||
with:
|
||||
name: agent-output
|
||||
path: /tmp/gh-aw/safeoutputs/
|
||||
|
|
@ -900,18 +899,18 @@ jobs:
|
|||
success: ${{ steps.parse_results.outputs.success }}
|
||||
steps:
|
||||
- name: Setup Scripts
|
||||
uses: githubnext/gh-aw/actions/setup@v0.37.15
|
||||
uses: githubnext/gh-aw/actions/setup@v0.37.19
|
||||
with:
|
||||
destination: /opt/gh-aw/actions
|
||||
- name: Download agent artifacts
|
||||
continue-on-error: true
|
||||
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
|
||||
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
|
||||
with:
|
||||
name: agent-artifacts
|
||||
path: /tmp/gh-aw/threat-detection/
|
||||
- name: Download agent output artifact
|
||||
continue-on-error: true
|
||||
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
|
||||
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
|
||||
with:
|
||||
name: agent-output
|
||||
path: /tmp/gh-aw/threat-detection/
|
||||
|
|
@ -1052,12 +1051,12 @@ jobs:
|
|||
process_safe_outputs_temporary_id_map: ${{ steps.process_safe_outputs.outputs.temporary_id_map }}
|
||||
steps:
|
||||
- name: Setup Scripts
|
||||
uses: githubnext/gh-aw/actions/setup@v0.37.15
|
||||
uses: githubnext/gh-aw/actions/setup@v0.37.19
|
||||
with:
|
||||
destination: /opt/gh-aw/actions
|
||||
- name: Download agent output artifact
|
||||
continue-on-error: true
|
||||
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
|
||||
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
|
||||
with:
|
||||
name: agent-output
|
||||
path: /tmp/gh-aw/safeoutputs/
|
||||
|
|
@ -1089,11 +1088,11 @@ jobs:
|
|||
permissions: {}
|
||||
steps:
|
||||
- name: Setup Scripts
|
||||
uses: githubnext/gh-aw/actions/setup@v0.37.15
|
||||
uses: githubnext/gh-aw/actions/setup@v0.37.19
|
||||
with:
|
||||
destination: /opt/gh-aw/actions
|
||||
- name: Download cache-memory artifact (default)
|
||||
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
|
||||
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
|
||||
continue-on-error: true
|
||||
with:
|
||||
name: cache-memory
|
||||
|
|
|
|||
39
.github/workflows/workflow-suggestion-agent.lock.yml
generated
vendored
39
.github/workflows/workflow-suggestion-agent.lock.yml
generated
vendored
|
|
@ -13,7 +13,7 @@
|
|||
# \ /\ / (_) | | | | ( | | | | (_) \ V V /\__ \
|
||||
# \/ \/ \___/|_| |_|\_\|_| |_|\___/ \_/\_/ |___/
|
||||
#
|
||||
# This file was automatically generated by gh-aw (v0.37.15). DO NOT EDIT.
|
||||
# This file was automatically generated by gh-aw (v0.37.19). DO NOT EDIT.
|
||||
#
|
||||
# To update this file, edit the corresponding .md file and run:
|
||||
# gh aw compile
|
||||
|
|
@ -45,7 +45,7 @@ jobs:
|
|||
comment_repo: ""
|
||||
steps:
|
||||
- name: Setup Scripts
|
||||
uses: githubnext/gh-aw/actions/setup@v0.37.15
|
||||
uses: githubnext/gh-aw/actions/setup@v0.37.19
|
||||
with:
|
||||
destination: /opt/gh-aw/actions
|
||||
- name: Check workflow file timestamps
|
||||
|
|
@ -82,7 +82,7 @@ jobs:
|
|||
secret_verification_result: ${{ steps.validate-secret.outputs.verification_result }}
|
||||
steps:
|
||||
- name: Setup Scripts
|
||||
uses: githubnext/gh-aw/actions/setup@v0.37.15
|
||||
uses: githubnext/gh-aw/actions/setup@v0.37.19
|
||||
with:
|
||||
destination: /opt/gh-aw/actions
|
||||
- name: Create gh-aw temp directory
|
||||
|
|
@ -145,7 +145,7 @@ jobs:
|
|||
const determineAutomaticLockdown = require('/opt/gh-aw/actions/determine_automatic_lockdown.cjs');
|
||||
await determineAutomaticLockdown(github, context, core);
|
||||
- name: Download container images
|
||||
run: bash /opt/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.29.0 ghcr.io/githubnext/gh-aw-mcpg:v0.0.76 node:lts-alpine
|
||||
run: bash /opt/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.29.0 ghcr.io/githubnext/gh-aw-mcpg:v0.0.78 node:lts-alpine
|
||||
- name: Write Safe Outputs Config
|
||||
run: |
|
||||
mkdir -p /opt/gh-aw/safeoutputs
|
||||
|
|
@ -375,7 +375,7 @@ jobs:
|
|||
# Register API key as secret to mask it from logs
|
||||
echo "::add-mask::${MCP_GATEWAY_API_KEY}"
|
||||
export GH_AW_ENGINE="copilot"
|
||||
export MCP_GATEWAY_DOCKER_COMMAND='docker run -i --rm --network host -v /var/run/docker.sock:/var/run/docker.sock -e MCP_GATEWAY_PORT -e MCP_GATEWAY_DOMAIN -e MCP_GATEWAY_API_KEY -e DEBUG="*" -e MCP_GATEWAY_LOG_DIR -e GH_AW_MCP_LOG_DIR -e GH_AW_SAFE_OUTPUTS -e GH_AW_SAFE_OUTPUTS_CONFIG_PATH -e GH_AW_SAFE_OUTPUTS_TOOLS_PATH -e GH_AW_ASSETS_BRANCH -e GH_AW_ASSETS_MAX_SIZE_KB -e GH_AW_ASSETS_ALLOWED_EXTS -e DEFAULT_BRANCH -e GITHUB_MCP_SERVER_TOKEN -e GITHUB_MCP_LOCKDOWN -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e GITHUB_SHA -e GITHUB_WORKSPACE -e GITHUB_TOKEN -e GITHUB_RUN_ID -e GITHUB_RUN_NUMBER -e GITHUB_RUN_ATTEMPT -e GITHUB_JOB -e GITHUB_ACTION -e GITHUB_EVENT_NAME -e GITHUB_EVENT_PATH -e GITHUB_ACTOR -e GITHUB_ACTOR_ID -e GITHUB_TRIGGERING_ACTOR -e GITHUB_WORKFLOW -e GITHUB_WORKFLOW_REF -e GITHUB_WORKFLOW_SHA -e GITHUB_REF -e GITHUB_REF_NAME -e GITHUB_REF_TYPE -e GITHUB_HEAD_REF -e GITHUB_BASE_REF -e GH_AW_SAFE_OUTPUTS_PORT -e GH_AW_SAFE_OUTPUTS_API_KEY -v /opt:/opt:ro -v /tmp:/tmp:rw -v '"${GITHUB_WORKSPACE}"':'"${GITHUB_WORKSPACE}"':rw ghcr.io/githubnext/gh-aw-mcpg:v0.0.76'
|
||||
export MCP_GATEWAY_DOCKER_COMMAND='docker run -i --rm --network host -v /var/run/docker.sock:/var/run/docker.sock -e MCP_GATEWAY_PORT -e MCP_GATEWAY_DOMAIN -e MCP_GATEWAY_API_KEY -e DEBUG="*" -e MCP_GATEWAY_LOG_DIR -e GH_AW_MCP_LOG_DIR -e GH_AW_SAFE_OUTPUTS -e GH_AW_SAFE_OUTPUTS_CONFIG_PATH -e GH_AW_SAFE_OUTPUTS_TOOLS_PATH -e GH_AW_ASSETS_BRANCH -e GH_AW_ASSETS_MAX_SIZE_KB -e GH_AW_ASSETS_ALLOWED_EXTS -e DEFAULT_BRANCH -e GITHUB_MCP_SERVER_TOKEN -e GITHUB_MCP_LOCKDOWN -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e GITHUB_SHA -e GITHUB_WORKSPACE -e GITHUB_TOKEN -e GITHUB_RUN_ID -e GITHUB_RUN_NUMBER -e GITHUB_RUN_ATTEMPT -e GITHUB_JOB -e GITHUB_ACTION -e GITHUB_EVENT_NAME -e GITHUB_EVENT_PATH -e GITHUB_ACTOR -e GITHUB_ACTOR_ID -e GITHUB_TRIGGERING_ACTOR -e GITHUB_WORKFLOW -e GITHUB_WORKFLOW_REF -e GITHUB_WORKFLOW_SHA -e GITHUB_REF -e GITHUB_REF_NAME -e GITHUB_REF_TYPE -e GITHUB_HEAD_REF -e GITHUB_BASE_REF -e GH_AW_SAFE_OUTPUTS_PORT -e GH_AW_SAFE_OUTPUTS_API_KEY -v /opt:/opt:ro -v /tmp:/tmp:rw -v '"${GITHUB_WORKSPACE}"':'"${GITHUB_WORKSPACE}"':rw ghcr.io/githubnext/gh-aw-mcpg:v0.0.78'
|
||||
|
||||
mkdir -p /home/runner/.copilot
|
||||
cat << MCPCONFIG_EOF | bash /opt/gh-aw/actions/start_mcp_gateway.sh
|
||||
|
|
@ -427,7 +427,7 @@ jobs:
|
|||
model: process.env.GH_AW_MODEL_AGENT_COPILOT || "",
|
||||
version: "",
|
||||
agent_version: "0.0.389",
|
||||
cli_version: "v0.37.15",
|
||||
cli_version: "v0.37.19",
|
||||
workflow_name: "Workflow Suggestion Agent",
|
||||
experimental: false,
|
||||
supports_tools_allowlist: true,
|
||||
|
|
@ -441,11 +441,10 @@ jobs:
|
|||
actor: context.actor,
|
||||
event_name: context.eventName,
|
||||
staged: false,
|
||||
network_mode: "defaults",
|
||||
allowed_domains: [],
|
||||
allowed_domains: ["defaults"],
|
||||
firewall_enabled: true,
|
||||
awf_version: "v0.10.0",
|
||||
awmg_version: "v0.0.76",
|
||||
awmg_version: "v0.0.78",
|
||||
steps: {
|
||||
firewall: "squid"
|
||||
},
|
||||
|
|
@ -961,7 +960,7 @@ jobs:
|
|||
timeout-minutes: 30
|
||||
run: |
|
||||
set -o pipefail
|
||||
sudo -E awf --env-all --container-workdir "${GITHUB_WORKSPACE}" --mount /tmp:/tmp:rw --mount "${GITHUB_WORKSPACE}:${GITHUB_WORKSPACE}:rw" --mount /usr/bin/date:/usr/bin/date:ro --mount /usr/bin/gh:/usr/bin/gh:ro --mount /usr/bin/yq:/usr/bin/yq:ro --mount /usr/local/bin/copilot:/usr/local/bin/copilot:ro --mount /home/runner/.copilot:/home/runner/.copilot:rw --mount /opt/gh-aw:/opt/gh-aw:ro --allow-domains api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,github.com,host.docker.internal,raw.githubusercontent.com,registry.npmjs.org --log-level info --proxy-logs-dir /tmp/gh-aw/sandbox/firewall/logs --enable-host-access --image-tag 0.10.0 \
|
||||
sudo -E awf --env-all --container-workdir "${GITHUB_WORKSPACE}" --mount /tmp:/tmp:rw --mount "${GITHUB_WORKSPACE}:${GITHUB_WORKSPACE}:rw" --mount /usr/bin/date:/usr/bin/date:ro --mount /usr/bin/gh:/usr/bin/gh:ro --mount /usr/bin/yq:/usr/bin/yq:ro --mount /usr/local/bin/copilot:/usr/local/bin/copilot:ro --mount /home/runner/.copilot:/home/runner/.copilot:rw --mount /opt/gh-aw:/opt/gh-aw:ro --allow-domains api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,github.com,host.docker.internal,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,ppa.launchpad.net,raw.githubusercontent.com,registry.npmjs.org,s.symcb.com,s.symcd.com,security.ubuntu.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com --log-level info --proxy-logs-dir /tmp/gh-aw/sandbox/firewall/logs --enable-host-access --image-tag 0.10.0 \
|
||||
-- /usr/local/bin/copilot --add-dir /tmp/gh-aw/ --log-level all --log-dir /tmp/gh-aw/sandbox/agent/logs/ --add-dir "${GITHUB_WORKSPACE}" --disable-builtin-mcps --allow-all-tools --add-dir /tmp/gh-aw/cache-memory/ --allow-all-paths --share /tmp/gh-aw/sandbox/agent/logs/conversation.md --prompt "$(cat /tmp/gh-aw/aw-prompts/prompt.txt)"${GH_AW_MODEL_AGENT_COPILOT:+ --model "$GH_AW_MODEL_AGENT_COPILOT"} \
|
||||
2>&1 | tee /tmp/gh-aw/agent-stdio.log
|
||||
env:
|
||||
|
|
@ -1029,7 +1028,7 @@ jobs:
|
|||
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
|
||||
env:
|
||||
GH_AW_SAFE_OUTPUTS: ${{ env.GH_AW_SAFE_OUTPUTS }}
|
||||
GH_AW_ALLOWED_DOMAINS: "api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,github.com,host.docker.internal,raw.githubusercontent.com,registry.npmjs.org"
|
||||
GH_AW_ALLOWED_DOMAINS: "api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,github.com,host.docker.internal,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,ppa.launchpad.net,raw.githubusercontent.com,registry.npmjs.org,s.symcb.com,s.symcd.com,security.ubuntu.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com"
|
||||
GITHUB_SERVER_URL: ${{ github.server_url }}
|
||||
GITHUB_API_URL: ${{ github.api_url }}
|
||||
with:
|
||||
|
|
@ -1123,7 +1122,7 @@ jobs:
|
|||
total_count: ${{ steps.missing_tool.outputs.total_count }}
|
||||
steps:
|
||||
- name: Setup Scripts
|
||||
uses: githubnext/gh-aw/actions/setup@v0.37.15
|
||||
uses: githubnext/gh-aw/actions/setup@v0.37.19
|
||||
with:
|
||||
destination: /opt/gh-aw/actions
|
||||
- name: Debug job inputs
|
||||
|
|
@ -1139,7 +1138,7 @@ jobs:
|
|||
echo "Agent Conclusion: $AGENT_CONCLUSION"
|
||||
- name: Download agent output artifact
|
||||
continue-on-error: true
|
||||
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
|
||||
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
|
||||
with:
|
||||
name: agent-output
|
||||
path: /tmp/gh-aw/safeoutputs/
|
||||
|
|
@ -1222,18 +1221,18 @@ jobs:
|
|||
success: ${{ steps.parse_results.outputs.success }}
|
||||
steps:
|
||||
- name: Setup Scripts
|
||||
uses: githubnext/gh-aw/actions/setup@v0.37.15
|
||||
uses: githubnext/gh-aw/actions/setup@v0.37.19
|
||||
with:
|
||||
destination: /opt/gh-aw/actions
|
||||
- name: Download agent artifacts
|
||||
continue-on-error: true
|
||||
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
|
||||
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
|
||||
with:
|
||||
name: agent-artifacts
|
||||
path: /tmp/gh-aw/threat-detection/
|
||||
- name: Download agent output artifact
|
||||
continue-on-error: true
|
||||
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
|
||||
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
|
||||
with:
|
||||
name: agent-output
|
||||
path: /tmp/gh-aw/threat-detection/
|
||||
|
|
@ -1372,12 +1371,12 @@ jobs:
|
|||
process_safe_outputs_temporary_id_map: ${{ steps.process_safe_outputs.outputs.temporary_id_map }}
|
||||
steps:
|
||||
- name: Setup Scripts
|
||||
uses: githubnext/gh-aw/actions/setup@v0.37.15
|
||||
uses: githubnext/gh-aw/actions/setup@v0.37.19
|
||||
with:
|
||||
destination: /opt/gh-aw/actions
|
||||
- name: Download agent output artifact
|
||||
continue-on-error: true
|
||||
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
|
||||
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
|
||||
with:
|
||||
name: agent-output
|
||||
path: /tmp/gh-aw/safeoutputs/
|
||||
|
|
@ -1409,11 +1408,11 @@ jobs:
|
|||
permissions: {}
|
||||
steps:
|
||||
- name: Setup Scripts
|
||||
uses: githubnext/gh-aw/actions/setup@v0.37.15
|
||||
uses: githubnext/gh-aw/actions/setup@v0.37.19
|
||||
with:
|
||||
destination: /opt/gh-aw/actions
|
||||
- name: Download cache-memory artifact (default)
|
||||
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
|
||||
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
|
||||
continue-on-error: true
|
||||
with:
|
||||
name: cache-memory
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue