mirrors/z3
3
0
Fork 0
mirror of https://github.com/Z3Prover/z3 synced 2026-06-02 15:17:54 +00:00
Code Activity

Recompile agentic workflows to gh-aw v0.37.19 (#8323)

Browse source 
* Initial plan

* Initial plan: Recompile agentic workflows to latest gh-aw version

Co-authored-by: NikolajBjorner <3085284+NikolajBjorner@users.noreply.github.com>

* Update gh-aw instruction files with latest features

Co-authored-by: NikolajBjorner <3085284+NikolajBjorner@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: NikolajBjorner <3085284+NikolajBjorner@users.noreply.github.com>
This commit is contained in:
Copilot 2026-01-24 12:08:16 -08:00 • committed by GitHub
parent c88c781f3b
commit d87aa87ae4
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
11 changed files with 168 additions and 431 deletions
Download patch file Download diff file Expand all files Collapse all files

285
.github/agents/upgrade-agentic-workflows.md vendored
View file

@ -1,285 +0,0 @@
---
description: Upgrade agentic workflows to the latest version of gh-aw with automated compilation and error fixing
infer: false
---
You are specialized in **upgrading GitHub Agentic Workflows (gh-aw)** to the latest version.
Your job is to upgrade workflows in a repository to work with the latest gh-aw version, handling breaking changes and compilation errors.
Read the ENTIRE content of this file carefully before proceeding. Follow the instructions precisely.
## Capabilities & Responsibilities
**Prerequisites**
- The `gh aw` CLI may be available in this environment.
- Always consult the **instructions file** for schema and features:
- Local copy: @.github/aw/github-agentic-workflows.md
- Canonical upstream: https://raw.githubusercontent.com/githubnext/gh-aw/main/.github/aw/github-agentic-workflows.md
**Key Commands Available**
- `fix` → apply automatic codemods to fix deprecated fields
- `compile` → compile all workflows
- `compile <workflow-name>` → compile a specific workflow
:::note[Command Execution]
When running in GitHub Copilot Cloud, you don't have direct access to `gh aw` CLI commands. Instead, use the **agentic-workflows** MCP tool:
- `fix` tool → apply automatic codemods to fix deprecated fields
- `compile` tool → compile workflows
When running in other environments with `gh aw` CLI access, prefix commands with `gh aw` (e.g., `gh aw compile`).
These tools provide the same functionality through the MCP server without requiring GitHub CLI authentication.
:::
## Instructions
### 1. Fetch Latest gh-aw Changes
Before upgrading, always review what's new:
1. **Fetch Latest Release Information**
- Use GitHub tools to fetch the CHANGELOG.md from the `githubnext/gh-aw` repository
- Review and understand:
- Breaking changes
- New features
- Deprecations
- Migration guides or upgrade instructions
- Summarize key changes with clear indicators:
- 🚨 Breaking changes (requires action)
- ✨ New features (optional enhancements)
- ⚠️ Deprecations (plan to update)
- 📖 Migration guides (follow instructions)
### 2. Apply Automatic Fixes with Codemods
Before attempting to compile, apply automatic codemods:
1. **Run Automatic Fixes**
Use the `fix` tool with the `--write` flag to apply automatic fixes.
This will automatically update workflow files with changes like:
- Replacing 'timeout_minutes' with 'timeout-minutes'
- Replacing 'network.firewall' with 'sandbox.agent: false'
- Removing deprecated 'safe-inputs.mode' field
2. **Review the Changes**
- Note which workflows were updated by the codemods
- These automatic fixes handle common deprecations
### 3. Attempt Recompilation
Try to compile all workflows:
1. **Run Compilation**
Use the `compile` tool to compile all workflows.
2. **Analyze Results**
- Note any compilation errors or warnings
- Group errors by type (schema validation, breaking changes, missing features)
- Identify patterns in the errors
### 4. Fix Compilation Errors
If compilation fails, work through errors systematically:
1. **Analyze Each Error**
- Read the error message carefully
- Reference the changelog for breaking changes
- Check the gh-aw instructions for correct syntax
2. **Common Error Patterns**
**Schema Changes:**
- Old field names that have been renamed
- New required fields
- Changed field types or formats
**Breaking Changes:**
- Deprecated features that have been removed
- Changed default behaviors
- Updated tool configurations
**Example Fixes:**
```yaml
# Old format (deprecated)
mcp-servers:
github:
mode: remote
# New format
tools:
github:
mode: remote
toolsets: [default]
```
3. **Apply Fixes Incrementally**
- Fix one workflow or one error type at a time
- After each fix, use the `compile` tool with `<workflow-name>` to verify
- Verify the fix works before moving to the next error
4. **Document Changes**
- Keep track of all changes made
- Note which breaking changes affected which workflows
- Document any manual migration steps taken
### 5. Verify All Workflows
After fixing all errors:
1. **Final Compilation Check**
Use the `compile` tool to ensure all workflows compile successfully.
2. **Review Generated Lock Files**
- Ensure all workflows have corresponding `.lock.yml` files
- Check that lock files are valid GitHub Actions YAML
3. **Refresh Agent and Instruction Files**
After successfully upgrading workflows, refresh the agent files and instructions to ensure you have the latest versions:
- Run `gh aw init` to update all agent files (`.github/agents/*.md`) and instruction files (`.github/aw/github-agentic-workflows.md`)
- This ensures that agents and instructions are aligned with the new gh-aw version
- The command will preserve your existing configuration while updating to the latest templates
## Creating Outputs
After completing the upgrade:
### If All Workflows Compile Successfully
Create a **pull request** with:
**Title:** `Upgrade workflows to latest gh-aw version`
**Description:**
```markdown
## Summary
Upgraded all agentic workflows to gh-aw version [VERSION].
## Changes
### gh-aw Version Update
- Previous version: [OLD_VERSION]
- New version: [NEW_VERSION]
### Key Changes from Changelog
- [List relevant changes from the changelog]
- [Highlight any breaking changes that affected this repository]
### Workflows Updated
- [List all workflow files that were modified]
### Automatic Fixes Applied (via codemods)
- [List changes made by the `fix` tool with `--write` flag]
- [Reference which deprecated fields were updated]
### Manual Fixes Applied
- [Describe any manual changes made to fix compilation errors]
- [Reference specific breaking changes that required fixes]
### Testing
- ✅ All workflows compile successfully
- ✅ All `.lock.yml` files generated
- ✅ No compilation errors or warnings
### Post-Upgrade Steps
- ✅ Refreshed agent files and instructions with `gh aw init`
## Files Changed
- Updated `.md` workflow files: [LIST]
- Generated `.lock.yml` files: [LIST]
- Updated agent files: [LIST] (if `gh aw init` was run)
```
### If Compilation Errors Cannot Be Fixed
Create an **issue** with:
**Title:** `Failed to upgrade workflows to latest gh-aw version`
**Description:**
```markdown
## Summary
Attempted to upgrade workflows to gh-aw version [VERSION] but encountered compilation errors that could not be automatically resolved.
## Version Information
- Current gh-aw version: [VERSION]
- Target version: [NEW_VERSION]
## Compilation Errors
### Error 1: [Error Type]
```
[Full error message]
```
**Affected Workflows:**
- [List workflows with this error]
**Attempted Fixes:**
- [Describe what was tried]
- [Explain why it didn't work]
**Relevant Changelog Reference:**
- [Link to changelog section]
- [Excerpt of relevant documentation]
### Error 2: [Error Type]
[Repeat for each distinct error]
## Investigation Steps Taken
1. [Step 1]
2. [Step 2]
3. [Step 3]
## Recommendations
- [Suggest next steps]
- [Identify if this is a bug in gh-aw or requires repository changes]
- [Link to relevant documentation or issues]
## Additional Context
- Changelog review: [Link to CHANGELOG.md]
- Migration guide: [Link if available]
```
## Best Practices
1. **Always Review Changelog First**
- Understanding breaking changes upfront saves time
- Look for migration guides or specific upgrade instructions
- Pay attention to deprecation warnings
2. **Fix Errors Incrementally**
- Don't try to fix everything at once
- Validate each fix before moving to the next
- Group similar errors and fix them together
3. **Test Thoroughly**
- Compile workflows to verify fixes
- Check that all lock files are generated
- Review the generated YAML for correctness
4. **Document Everything**
- Keep track of all changes made
- Explain why changes were necessary
- Reference specific changelog entries
5. **Clear Communication**
- Use emojis to make output engaging
- Summarize complex changes clearly
- Provide actionable next steps
## Important Notes
- When running in GitHub Copilot Cloud, use the **agentic-workflows** MCP tool for all commands
- When running in environments with `gh aw` CLI access, prefix commands with `gh aw`
- Breaking changes are inevitable - expect to make manual fixes
- If stuck, create an issue with detailed information for the maintainers

2
.github/aw/create-agentic-workflow.md vendored
View file

@ -181,7 +181,7 @@ DO NOT ask all these questions at once; instead, engage in a back-and-forth conv
- 📋 **DO NOT include other fields with good defaults** - Let the compiler use sensible defaults unless customization is needed. - 📋 **DO NOT include other fields with good defaults** - Let the compiler use sensible defaults unless customization is needed.
- Apply security best practices: - Apply security best practices:
- Default to `permissions: read-all` and expand only if necessary. - Default to `permissions: read-all` and expand only if necessary.
- Prefer `safe-outputs` (`create-issue`, `add-comment`, `create-pull-request`, `create-pull-request-review-comment`, `update-issue`) over granting write perms. - Prefer `safe-outputs` (`create-issue`, `add-comment`, `create-pull-request`, `create-pull-request-review-comment`, `update-issue`, `dispatch-workflow`) over granting write perms.
- For custom write operations to external services (email, Slack, webhooks), use `safe-outputs.jobs:` to create custom safe output jobs. - For custom write operations to external services (email, Slack, webhooks), use `safe-outputs.jobs:` to create custom safe output jobs.
- Constrain `network:` to the minimum required ecosystems/domains. - Constrain `network:` to the minimum required ecosystems/domains.
- Use sanitized expressions (`${{ needs.activation.outputs.text }}`) instead of raw event text. - Use sanitized expressions (`${{ needs.activation.outputs.text }}`) instead of raw event text.

2
.github/aw/create-shared-agentic-workflow.md vendored
View file

@ -34,7 +34,7 @@ You are a conversational chat agent that interacts with the user to design secur
**Move Write Operations to Safe Outputs** **Move Write Operations to Safe Outputs**
- Never grant direct write permissions in shared components - Never grant direct write permissions in shared components
- Use `safe-outputs:` configuration for all write operations - Use `safe-outputs:` configuration for all write operations
- Common safe outputs: `create-issue`, `add-comment`, `create-pull-request`, `update-issue` - Common safe outputs: `create-issue`, `add-comment`, `create-pull-request`, `update-issue`, `dispatch-workflow`
- Let consuming workflows decide which safe outputs to enable - Let consuming workflows decide which safe outputs to enable
**Process Agent Output in Safe Jobs** **Process Agent Output in Safe Jobs**

18
.github/aw/github-agentic-workflows.md vendored
View file

@ -465,6 +465,16 @@ The YAML frontmatter supports these fields:
target-repo: "owner/repo" # Optional: cross-repository target-repo: "owner/repo" # Optional: cross-repository
``` ```
When using `safe-outputs.add-labels`, the main job does **not** need `issues: write` or `pull-requests: write` permission since label addition is handled by a separate job with appropriate permissions. When using `safe-outputs.add-labels`, the main job does **not** need `issues: write` or `pull-requests: write` permission since label addition is handled by a separate job with appropriate permissions.
- `remove-labels:` - Safe label removal from issues or PRs
```yaml
safe-outputs:
remove-labels:
allowed: [automated, stale] # Optional: restrict to specific labels
max: 3 # Optional: maximum number of operations (default: 3)
target: "*" # Optional: "triggering" (default), "*" (any issue/PR), or number
target-repo: "owner/repo" # Optional: cross-repository
```
When `allowed` is omitted, any labels can be removed. Use `allowed` to restrict removal to specific labels. When using `safe-outputs.remove-labels`, the main job does **not** need `issues: write` or `pull-requests: write` permission since label removal is handled by a separate job with appropriate permissions.
- `add-reviewer:` - Add reviewers to pull requests - `add-reviewer:` - Add reviewers to pull requests
```yaml ```yaml
safe-outputs: safe-outputs:
@ -558,6 +568,14 @@ The YAML frontmatter supports these fields:
target-repo: "owner/repo" # Optional: cross-repository target-repo: "owner/repo" # Optional: cross-repository
``` ```
Publishes workflow artifacts to an orphaned git branch for persistent storage. Default allowed extensions include common non-executable types. Maximum file size is 50MB (51200 KB). Publishes workflow artifacts to an orphaned git branch for persistent storage. Default allowed extensions include common non-executable types. Maximum file size is 50MB (51200 KB).
- `dispatch-workflow:` - Trigger other workflows with inputs
```yaml
safe-outputs:
dispatch-workflow:
workflows: [workflow-name] # Required: list of workflow names to allow
max: 3 # Optional: max dispatches (default: 1, max: 3)
```
Triggers other agentic workflows in the same repository using workflow_dispatch. Agent output includes `workflow_name` (without .md extension) and optional `inputs` (key-value pairs). Not supported for cross-repository operations.
- `create-code-scanning-alert:` - Generate SARIF security advisories - `create-code-scanning-alert:` - Generate SARIF security advisories
```yaml ```yaml
safe-outputs: safe-outputs:

4
.github/workflows/agentics-maintenance.yml vendored
View file

@ -13,7 +13,7 @@
# \ /\ / (_) | | | | ( | | | | (_) \ V V /\__ \ # \ /\ / (_) | | | | ( | | | | (_) \ V V /\__ \
# \/ \/ \___/|_| |_|\_\|_| |_|\___/ \_/\_/ |___/ # \/ \/ \___/|_| |_|\_\|_| |_|\___/ \_/\_/ |___/
# #
# This file was automatically generated by pkg/workflow/maintenance_workflow.go (v0.37.15). DO NOT EDIT. # This file was automatically generated by pkg/workflow/maintenance_workflow.go (v0.37.19). DO NOT EDIT.
# #
# To regenerate this workflow, run: # To regenerate this workflow, run:
# gh aw compile # gh aw compile
@ -46,7 +46,7 @@ jobs:
issues: write issues: write
steps: steps:
- name: Setup Scripts - name: Setup Scripts
uses: githubnext/gh-aw/actions/setup@v0.37.15 uses: githubnext/gh-aw/actions/setup@v0.37.19
with: with:
destination: /opt/gh-aw/actions destination: /opt/gh-aw/actions

39
.github/workflows/api-coherence-checker.lock.yml generated vendored
View file

@ -13,7 +13,7 @@
# \ /\ / (_) | | | | ( | | | | (_) \ V V /\__ \ # \ /\ / (_) | | | | ( | | | | (_) \ V V /\__ \
# \/ \/ \___/|_| |_|\_\|_| |_|\___/ \_/\_/ |___/ # \/ \/ \___/|_| |_|\_\|_| |_|\___/ \_/\_/ |___/
# #
# This file was automatically generated by gh-aw (v0.37.15). DO NOT EDIT. # This file was automatically generated by gh-aw (v0.37.19). DO NOT EDIT.
# #
# To update this file, edit the corresponding .md file and run: # To update this file, edit the corresponding .md file and run:
# gh aw compile # gh aw compile
@ -45,7 +45,7 @@ jobs:
comment_repo: "" comment_repo: ""
steps: steps:
- name: Setup Scripts - name: Setup Scripts
uses: githubnext/gh-aw/actions/setup@v0.37.15 uses: githubnext/gh-aw/actions/setup@v0.37.19
with: with:
destination: /opt/gh-aw/actions destination: /opt/gh-aw/actions
- name: Check workflow file timestamps - name: Check workflow file timestamps
@ -82,7 +82,7 @@ jobs:
secret_verification_result: ${{ steps.validate-secret.outputs.verification_result }} secret_verification_result: ${{ steps.validate-secret.outputs.verification_result }}
steps: steps:
- name: Setup Scripts - name: Setup Scripts
uses: githubnext/gh-aw/actions/setup@v0.37.15 uses: githubnext/gh-aw/actions/setup@v0.37.19
with: with:
destination: /opt/gh-aw/actions destination: /opt/gh-aw/actions
- name: Create gh-aw temp directory - name: Create gh-aw temp directory
@ -145,7 +145,7 @@ jobs:
const determineAutomaticLockdown = require('/opt/gh-aw/actions/determine_automatic_lockdown.cjs'); const determineAutomaticLockdown = require('/opt/gh-aw/actions/determine_automatic_lockdown.cjs');
await determineAutomaticLockdown(github, context, core); await determineAutomaticLockdown(github, context, core);
- name: Download container images - name: Download container images
run: bash /opt/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.29.0 ghcr.io/githubnext/gh-aw-mcpg:v0.0.76 node:lts-alpine run: bash /opt/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.29.0 ghcr.io/githubnext/gh-aw-mcpg:v0.0.78 node:lts-alpine
- name: Write Safe Outputs Config - name: Write Safe Outputs Config
run: | run: |
mkdir -p /opt/gh-aw/safeoutputs mkdir -p /opt/gh-aw/safeoutputs
@ -375,7 +375,7 @@ jobs:
# Register API key as secret to mask it from logs # Register API key as secret to mask it from logs
echo "::add-mask::${MCP_GATEWAY_API_KEY}" echo "::add-mask::${MCP_GATEWAY_API_KEY}"
export GH_AW_ENGINE="copilot" export GH_AW_ENGINE="copilot"
export MCP_GATEWAY_DOCKER_COMMAND='docker run -i --rm --network host -v /var/run/docker.sock:/var/run/docker.sock -e MCP_GATEWAY_PORT -e MCP_GATEWAY_DOMAIN -e MCP_GATEWAY_API_KEY -e DEBUG="*" -e MCP_GATEWAY_LOG_DIR -e GH_AW_MCP_LOG_DIR -e GH_AW_SAFE_OUTPUTS -e GH_AW_SAFE_OUTPUTS_CONFIG_PATH -e GH_AW_SAFE_OUTPUTS_TOOLS_PATH -e GH_AW_ASSETS_BRANCH -e GH_AW_ASSETS_MAX_SIZE_KB -e GH_AW_ASSETS_ALLOWED_EXTS -e DEFAULT_BRANCH -e GITHUB_MCP_SERVER_TOKEN -e GITHUB_MCP_LOCKDOWN -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e GITHUB_SHA -e GITHUB_WORKSPACE -e GITHUB_TOKEN -e GITHUB_RUN_ID -e GITHUB_RUN_NUMBER -e GITHUB_RUN_ATTEMPT -e GITHUB_JOB -e GITHUB_ACTION -e GITHUB_EVENT_NAME -e GITHUB_EVENT_PATH -e GITHUB_ACTOR -e GITHUB_ACTOR_ID -e GITHUB_TRIGGERING_ACTOR -e GITHUB_WORKFLOW -e GITHUB_WORKFLOW_REF -e GITHUB_WORKFLOW_SHA -e GITHUB_REF -e GITHUB_REF_NAME -e GITHUB_REF_TYPE -e GITHUB_HEAD_REF -e GITHUB_BASE_REF -e GH_AW_SAFE_OUTPUTS_PORT -e GH_AW_SAFE_OUTPUTS_API_KEY -v /opt:/opt:ro -v /tmp:/tmp:rw -v '"${GITHUB_WORKSPACE}"':'"${GITHUB_WORKSPACE}"':rw ghcr.io/githubnext/gh-aw-mcpg:v0.0.76' export MCP_GATEWAY_DOCKER_COMMAND='docker run -i --rm --network host -v /var/run/docker.sock:/var/run/docker.sock -e MCP_GATEWAY_PORT -e MCP_GATEWAY_DOMAIN -e MCP_GATEWAY_API_KEY -e DEBUG="*" -e MCP_GATEWAY_LOG_DIR -e GH_AW_MCP_LOG_DIR -e GH_AW_SAFE_OUTPUTS -e GH_AW_SAFE_OUTPUTS_CONFIG_PATH -e GH_AW_SAFE_OUTPUTS_TOOLS_PATH -e GH_AW_ASSETS_BRANCH -e GH_AW_ASSETS_MAX_SIZE_KB -e GH_AW_ASSETS_ALLOWED_EXTS -e DEFAULT_BRANCH -e GITHUB_MCP_SERVER_TOKEN -e GITHUB_MCP_LOCKDOWN -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e GITHUB_SHA -e GITHUB_WORKSPACE -e GITHUB_TOKEN -e GITHUB_RUN_ID -e GITHUB_RUN_NUMBER -e GITHUB_RUN_ATTEMPT -e GITHUB_JOB -e GITHUB_ACTION -e GITHUB_EVENT_NAME -e GITHUB_EVENT_PATH -e GITHUB_ACTOR -e GITHUB_ACTOR_ID -e GITHUB_TRIGGERING_ACTOR -e GITHUB_WORKFLOW -e GITHUB_WORKFLOW_REF -e GITHUB_WORKFLOW_SHA -e GITHUB_REF -e GITHUB_REF_NAME -e GITHUB_REF_TYPE -e GITHUB_HEAD_REF -e GITHUB_BASE_REF -e GH_AW_SAFE_OUTPUTS_PORT -e GH_AW_SAFE_OUTPUTS_API_KEY -v /opt:/opt:ro -v /tmp:/tmp:rw -v '"${GITHUB_WORKSPACE}"':'"${GITHUB_WORKSPACE}"':rw ghcr.io/githubnext/gh-aw-mcpg:v0.0.78'
mkdir -p /home/runner/.copilot mkdir -p /home/runner/.copilot
cat << MCPCONFIG_EOF | bash /opt/gh-aw/actions/start_mcp_gateway.sh cat << MCPCONFIG_EOF | bash /opt/gh-aw/actions/start_mcp_gateway.sh
@ -427,7 +427,7 @@ jobs:
model: process.env.GH_AW_MODEL_AGENT_COPILOT || "", model: process.env.GH_AW_MODEL_AGENT_COPILOT || "",
version: "", version: "",
agent_version: "0.0.389", agent_version: "0.0.389",
cli_version: "v0.37.15", cli_version: "v0.37.19",
workflow_name: "API Coherence Checker", workflow_name: "API Coherence Checker",
experimental: false, experimental: false,
supports_tools_allowlist: true, supports_tools_allowlist: true,
@ -441,11 +441,10 @@ jobs:
actor: context.actor, actor: context.actor,
event_name: context.eventName, event_name: context.eventName,
staged: false, staged: false,
network_mode: "defaults", allowed_domains: ["defaults"],
allowed_domains: [],
firewall_enabled: true, firewall_enabled: true,
awf_version: "v0.10.0", awf_version: "v0.10.0",
awmg_version: "v0.0.76", awmg_version: "v0.0.78",
steps: { steps: {
firewall: "squid" firewall: "squid"
}, },
@ -788,7 +787,7 @@ jobs:
timeout-minutes: 30 timeout-minutes: 30
run: | run: |
set -o pipefail set -o pipefail
sudo -E awf --env-all --container-workdir "${GITHUB_WORKSPACE}" --mount /tmp:/tmp:rw --mount "${GITHUB_WORKSPACE}:${GITHUB_WORKSPACE}:rw" --mount /usr/bin/date:/usr/bin/date:ro --mount /usr/bin/gh:/usr/bin/gh:ro --mount /usr/bin/yq:/usr/bin/yq:ro --mount /usr/local/bin/copilot:/usr/local/bin/copilot:ro --mount /home/runner/.copilot:/home/runner/.copilot:rw --mount /opt/gh-aw:/opt/gh-aw:ro --allow-domains api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,github.com,host.docker.internal,raw.githubusercontent.com,registry.npmjs.org --log-level info --proxy-logs-dir /tmp/gh-aw/sandbox/firewall/logs --enable-host-access --image-tag 0.10.0 \ sudo -E awf --env-all --container-workdir "${GITHUB_WORKSPACE}" --mount /tmp:/tmp:rw --mount "${GITHUB_WORKSPACE}:${GITHUB_WORKSPACE}:rw" --mount /usr/bin/date:/usr/bin/date:ro --mount /usr/bin/gh:/usr/bin/gh:ro --mount /usr/bin/yq:/usr/bin/yq:ro --mount /usr/local/bin/copilot:/usr/local/bin/copilot:ro --mount /home/runner/.copilot:/home/runner/.copilot:rw --mount /opt/gh-aw:/opt/gh-aw:ro --allow-domains api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,github.com,host.docker.internal,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,ppa.launchpad.net,raw.githubusercontent.com,registry.npmjs.org,s.symcb.com,s.symcd.com,security.ubuntu.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com --log-level info --proxy-logs-dir /tmp/gh-aw/sandbox/firewall/logs --enable-host-access --image-tag 0.10.0 \
-- /usr/local/bin/copilot --add-dir /tmp/gh-aw/ --log-level all --log-dir /tmp/gh-aw/sandbox/agent/logs/ --add-dir "${GITHUB_WORKSPACE}" --disable-builtin-mcps --allow-all-tools --add-dir /tmp/gh-aw/cache-memory/ --allow-all-paths --share /tmp/gh-aw/sandbox/agent/logs/conversation.md --prompt "$(cat /tmp/gh-aw/aw-prompts/prompt.txt)"${GH_AW_MODEL_AGENT_COPILOT:+ --model "$GH_AW_MODEL_AGENT_COPILOT"} \ -- /usr/local/bin/copilot --add-dir /tmp/gh-aw/ --log-level all --log-dir /tmp/gh-aw/sandbox/agent/logs/ --add-dir "${GITHUB_WORKSPACE}" --disable-builtin-mcps --allow-all-tools --add-dir /tmp/gh-aw/cache-memory/ --allow-all-paths --share /tmp/gh-aw/sandbox/agent/logs/conversation.md --prompt "$(cat /tmp/gh-aw/aw-prompts/prompt.txt)"${GH_AW_MODEL_AGENT_COPILOT:+ --model "$GH_AW_MODEL_AGENT_COPILOT"} \
2>&1 | tee /tmp/gh-aw/agent-stdio.log 2>&1 | tee /tmp/gh-aw/agent-stdio.log
env: env:
@ -856,7 +855,7 @@ jobs:
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
env: env:
GH_AW_SAFE_OUTPUTS: ${{ env.GH_AW_SAFE_OUTPUTS }} GH_AW_SAFE_OUTPUTS: ${{ env.GH_AW_SAFE_OUTPUTS }}
GH_AW_ALLOWED_DOMAINS: "api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,github.com,host.docker.internal,raw.githubusercontent.com,registry.npmjs.org" GH_AW_ALLOWED_DOMAINS: "api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,github.com,host.docker.internal,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,ppa.launchpad.net,raw.githubusercontent.com,registry.npmjs.org,s.symcb.com,s.symcd.com,security.ubuntu.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com"
GITHUB_SERVER_URL: ${{ github.server_url }} GITHUB_SERVER_URL: ${{ github.server_url }}
GITHUB_API_URL: ${{ github.api_url }} GITHUB_API_URL: ${{ github.api_url }}
with: with:
@ -950,7 +949,7 @@ jobs:
total_count: ${{ steps.missing_tool.outputs.total_count }} total_count: ${{ steps.missing_tool.outputs.total_count }}
steps: steps:
- name: Setup Scripts - name: Setup Scripts
uses: githubnext/gh-aw/actions/setup@v0.37.15 uses: githubnext/gh-aw/actions/setup@v0.37.19
with: with:
destination: /opt/gh-aw/actions destination: /opt/gh-aw/actions
- name: Debug job inputs - name: Debug job inputs
@ -966,7 +965,7 @@ jobs:
echo "Agent Conclusion: $AGENT_CONCLUSION" echo "Agent Conclusion: $AGENT_CONCLUSION"
- name: Download agent output artifact - name: Download agent output artifact
continue-on-error: true continue-on-error: true
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0 uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
with: with:
name: agent-output name: agent-output
path: /tmp/gh-aw/safeoutputs/ path: /tmp/gh-aw/safeoutputs/
@ -1049,18 +1048,18 @@ jobs:
success: ${{ steps.parse_results.outputs.success }} success: ${{ steps.parse_results.outputs.success }}
steps: steps:
- name: Setup Scripts - name: Setup Scripts
uses: githubnext/gh-aw/actions/setup@v0.37.15 uses: githubnext/gh-aw/actions/setup@v0.37.19
with: with:
destination: /opt/gh-aw/actions destination: /opt/gh-aw/actions
- name: Download agent artifacts - name: Download agent artifacts
continue-on-error: true continue-on-error: true
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0 uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
with: with:
name: agent-artifacts name: agent-artifacts
path: /tmp/gh-aw/threat-detection/ path: /tmp/gh-aw/threat-detection/
- name: Download agent output artifact - name: Download agent output artifact
continue-on-error: true continue-on-error: true
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0 uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
with: with:
name: agent-output name: agent-output
path: /tmp/gh-aw/threat-detection/ path: /tmp/gh-aw/threat-detection/
@ -1199,12 +1198,12 @@ jobs:
process_safe_outputs_temporary_id_map: ${{ steps.process_safe_outputs.outputs.temporary_id_map }} process_safe_outputs_temporary_id_map: ${{ steps.process_safe_outputs.outputs.temporary_id_map }}
steps: steps:
- name: Setup Scripts - name: Setup Scripts
uses: githubnext/gh-aw/actions/setup@v0.37.15 uses: githubnext/gh-aw/actions/setup@v0.37.19
with: with:
destination: /opt/gh-aw/actions destination: /opt/gh-aw/actions
- name: Download agent output artifact - name: Download agent output artifact
continue-on-error: true continue-on-error: true
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0 uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
with: with:
name: agent-output name: agent-output
path: /tmp/gh-aw/safeoutputs/ path: /tmp/gh-aw/safeoutputs/
@ -1236,11 +1235,11 @@ jobs:
permissions: {} permissions: {}
steps: steps:
- name: Setup Scripts - name: Setup Scripts
uses: githubnext/gh-aw/actions/setup@v0.37.15 uses: githubnext/gh-aw/actions/setup@v0.37.19
with: with:
destination: /opt/gh-aw/actions destination: /opt/gh-aw/actions
- name: Download cache-memory artifact (default) - name: Download cache-memory artifact (default)
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0 uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
continue-on-error: true continue-on-error: true
with: with:
name: cache-memory name: cache-memory

41
.github/workflows/build-warning-fixer.lock.yml generated vendored
View file

@ -13,7 +13,7 @@
# \ /\ / (_) | | | | ( | | | | (_) \ V V /\__ \ # \ /\ / (_) | | | | ( | | | | (_) \ V V /\__ \
# \/ \/ \___/|_| |_|\_\|_| |_|\___/ \_/\_/ |___/ # \/ \/ \___/|_| |_|\_\|_| |_|\___/ \_/\_/ |___/
# #
# This file was automatically generated by gh-aw (v0.37.15). DO NOT EDIT. # This file was automatically generated by gh-aw (v0.37.19). DO NOT EDIT.
# #
# To update this file, edit the corresponding .md file and run: # To update this file, edit the corresponding .md file and run:
# gh aw compile # gh aw compile
@ -45,7 +45,7 @@ jobs:
comment_repo: "" comment_repo: ""
steps: steps:
- name: Setup Scripts - name: Setup Scripts
uses: githubnext/gh-aw/actions/setup@v0.37.15 uses: githubnext/gh-aw/actions/setup@v0.37.19
with: with:
destination: /opt/gh-aw/actions destination: /opt/gh-aw/actions
- name: Check workflow file timestamps - name: Check workflow file timestamps
@ -82,11 +82,11 @@ jobs:
secret_verification_result: ${{ steps.validate-secret.outputs.verification_result }} secret_verification_result: ${{ steps.validate-secret.outputs.verification_result }}
steps: steps:
- name: Setup Scripts - name: Setup Scripts
uses: githubnext/gh-aw/actions/setup@v0.37.15 uses: githubnext/gh-aw/actions/setup@v0.37.19
with: with:
destination: /opt/gh-aw/actions destination: /opt/gh-aw/actions
- name: Checkout repository - name: Checkout repository
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with: with:
persist-credentials: false persist-credentials: false
- name: Create gh-aw temp directory - name: Create gh-aw temp directory
@ -135,7 +135,7 @@ jobs:
const determineAutomaticLockdown = require('/opt/gh-aw/actions/determine_automatic_lockdown.cjs'); const determineAutomaticLockdown = require('/opt/gh-aw/actions/determine_automatic_lockdown.cjs');
await determineAutomaticLockdown(github, context, core); await determineAutomaticLockdown(github, context, core);
- name: Download container images - name: Download container images
run: bash /opt/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.29.0 ghcr.io/githubnext/gh-aw-mcpg:v0.0.76 node:lts-alpine run: bash /opt/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.29.0 ghcr.io/githubnext/gh-aw-mcpg:v0.0.78 node:lts-alpine
- name: Write Safe Outputs Config - name: Write Safe Outputs Config
run: | run: |
mkdir -p /opt/gh-aw/safeoutputs mkdir -p /opt/gh-aw/safeoutputs
@ -375,7 +375,7 @@ jobs:
# Register API key as secret to mask it from logs # Register API key as secret to mask it from logs
echo "::add-mask::${MCP_GATEWAY_API_KEY}" echo "::add-mask::${MCP_GATEWAY_API_KEY}"
export GH_AW_ENGINE="copilot" export GH_AW_ENGINE="copilot"
export MCP_GATEWAY_DOCKER_COMMAND='docker run -i --rm --network host -v /var/run/docker.sock:/var/run/docker.sock -e MCP_GATEWAY_PORT -e MCP_GATEWAY_DOMAIN -e MCP_GATEWAY_API_KEY -e DEBUG="*" -e MCP_GATEWAY_LOG_DIR -e GH_AW_MCP_LOG_DIR -e GH_AW_SAFE_OUTPUTS -e GH_AW_SAFE_OUTPUTS_CONFIG_PATH -e GH_AW_SAFE_OUTPUTS_TOOLS_PATH -e GH_AW_ASSETS_BRANCH -e GH_AW_ASSETS_MAX_SIZE_KB -e GH_AW_ASSETS_ALLOWED_EXTS -e DEFAULT_BRANCH -e GITHUB_MCP_SERVER_TOKEN -e GITHUB_MCP_LOCKDOWN -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e GITHUB_SHA -e GITHUB_WORKSPACE -e GITHUB_TOKEN -e GITHUB_RUN_ID -e GITHUB_RUN_NUMBER -e GITHUB_RUN_ATTEMPT -e GITHUB_JOB -e GITHUB_ACTION -e GITHUB_EVENT_NAME -e GITHUB_EVENT_PATH -e GITHUB_ACTOR -e GITHUB_ACTOR_ID -e GITHUB_TRIGGERING_ACTOR -e GITHUB_WORKFLOW -e GITHUB_WORKFLOW_REF -e GITHUB_WORKFLOW_SHA -e GITHUB_REF -e GITHUB_REF_NAME -e GITHUB_REF_TYPE -e GITHUB_HEAD_REF -e GITHUB_BASE_REF -e GH_AW_SAFE_OUTPUTS_PORT -e GH_AW_SAFE_OUTPUTS_API_KEY -v /opt:/opt:ro -v /tmp:/tmp:rw -v '"${GITHUB_WORKSPACE}"':'"${GITHUB_WORKSPACE}"':rw ghcr.io/githubnext/gh-aw-mcpg:v0.0.76' export MCP_GATEWAY_DOCKER_COMMAND='docker run -i --rm --network host -v /var/run/docker.sock:/var/run/docker.sock -e MCP_GATEWAY_PORT -e MCP_GATEWAY_DOMAIN -e MCP_GATEWAY_API_KEY -e DEBUG="*" -e MCP_GATEWAY_LOG_DIR -e GH_AW_MCP_LOG_DIR -e GH_AW_SAFE_OUTPUTS -e GH_AW_SAFE_OUTPUTS_CONFIG_PATH -e GH_AW_SAFE_OUTPUTS_TOOLS_PATH -e GH_AW_ASSETS_BRANCH -e GH_AW_ASSETS_MAX_SIZE_KB -e GH_AW_ASSETS_ALLOWED_EXTS -e DEFAULT_BRANCH -e GITHUB_MCP_SERVER_TOKEN -e GITHUB_MCP_LOCKDOWN -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e GITHUB_SHA -e GITHUB_WORKSPACE -e GITHUB_TOKEN -e GITHUB_RUN_ID -e GITHUB_RUN_NUMBER -e GITHUB_RUN_ATTEMPT -e GITHUB_JOB -e GITHUB_ACTION -e GITHUB_EVENT_NAME -e GITHUB_EVENT_PATH -e GITHUB_ACTOR -e GITHUB_ACTOR_ID -e GITHUB_TRIGGERING_ACTOR -e GITHUB_WORKFLOW -e GITHUB_WORKFLOW_REF -e GITHUB_WORKFLOW_SHA -e GITHUB_REF -e GITHUB_REF_NAME -e GITHUB_REF_TYPE -e GITHUB_HEAD_REF -e GITHUB_BASE_REF -e GH_AW_SAFE_OUTPUTS_PORT -e GH_AW_SAFE_OUTPUTS_API_KEY -v /opt:/opt:ro -v /tmp:/tmp:rw -v '"${GITHUB_WORKSPACE}"':'"${GITHUB_WORKSPACE}"':rw ghcr.io/githubnext/gh-aw-mcpg:v0.0.78'
mkdir -p /home/runner/.copilot mkdir -p /home/runner/.copilot
cat << MCPCONFIG_EOF | bash /opt/gh-aw/actions/start_mcp_gateway.sh cat << MCPCONFIG_EOF | bash /opt/gh-aw/actions/start_mcp_gateway.sh
@ -419,7 +419,7 @@ jobs:
model: process.env.GH_AW_MODEL_AGENT_COPILOT || "", model: process.env.GH_AW_MODEL_AGENT_COPILOT || "",
version: "", version: "",
agent_version: "0.0.389", agent_version: "0.0.389",
cli_version: "v0.37.15", cli_version: "v0.37.19",
workflow_name: "Build Warning Fixer", workflow_name: "Build Warning Fixer",
experimental: false, experimental: false,
supports_tools_allowlist: true, supports_tools_allowlist: true,
@ -433,11 +433,10 @@ jobs:
actor: context.actor, actor: context.actor,
event_name: context.eventName, event_name: context.eventName,
staged: false, staged: false,
network_mode: "defaults", allowed_domains: ["defaults"],
allowed_domains: [],
firewall_enabled: true, firewall_enabled: true,
awf_version: "v0.10.0", awf_version: "v0.10.0",
awmg_version: "v0.0.76", awmg_version: "v0.0.78",
steps: { steps: {
firewall: "squid" firewall: "squid"
}, },
@ -710,7 +709,7 @@ jobs:
timeout-minutes: 60 timeout-minutes: 60
run: | run: |
set -o pipefail set -o pipefail
sudo -E awf --env-all --container-workdir "${GITHUB_WORKSPACE}" --mount /tmp:/tmp:rw --mount "${GITHUB_WORKSPACE}:${GITHUB_WORKSPACE}:rw" --mount /usr/bin/date:/usr/bin/date:ro --mount /usr/bin/gh:/usr/bin/gh:ro --mount /usr/bin/yq:/usr/bin/yq:ro --mount /usr/local/bin/copilot:/usr/local/bin/copilot:ro --mount /home/runner/.copilot:/home/runner/.copilot:rw --mount /opt/gh-aw:/opt/gh-aw:ro --allow-domains api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,github.com,host.docker.internal,raw.githubusercontent.com,registry.npmjs.org --log-level info --proxy-logs-dir /tmp/gh-aw/sandbox/firewall/logs --enable-host-access --image-tag 0.10.0 \ sudo -E awf --env-all --container-workdir "${GITHUB_WORKSPACE}" --mount /tmp:/tmp:rw --mount "${GITHUB_WORKSPACE}:${GITHUB_WORKSPACE}:rw" --mount /usr/bin/date:/usr/bin/date:ro --mount /usr/bin/gh:/usr/bin/gh:ro --mount /usr/bin/yq:/usr/bin/yq:ro --mount /usr/local/bin/copilot:/usr/local/bin/copilot:ro --mount /home/runner/.copilot:/home/runner/.copilot:rw --mount /opt/gh-aw:/opt/gh-aw:ro --allow-domains api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,github.com,host.docker.internal,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,ppa.launchpad.net,raw.githubusercontent.com,registry.npmjs.org,s.symcb.com,s.symcd.com,security.ubuntu.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com --log-level info --proxy-logs-dir /tmp/gh-aw/sandbox/firewall/logs --enable-host-access --image-tag 0.10.0 \
-- /usr/local/bin/copilot --add-dir /tmp/gh-aw/ --log-level all --log-dir /tmp/gh-aw/sandbox/agent/logs/ --add-dir "${GITHUB_WORKSPACE}" --disable-builtin-mcps --allow-tool github --allow-tool safeoutputs --allow-tool shell --allow-tool write --allow-all-paths --share /tmp/gh-aw/sandbox/agent/logs/conversation.md --prompt "$(cat /tmp/gh-aw/aw-prompts/prompt.txt)"${GH_AW_MODEL_AGENT_COPILOT:+ --model "$GH_AW_MODEL_AGENT_COPILOT"} \ -- /usr/local/bin/copilot --add-dir /tmp/gh-aw/ --log-level all --log-dir /tmp/gh-aw/sandbox/agent/logs/ --add-dir "${GITHUB_WORKSPACE}" --disable-builtin-mcps --allow-tool github --allow-tool safeoutputs --allow-tool shell --allow-tool write --allow-all-paths --share /tmp/gh-aw/sandbox/agent/logs/conversation.md --prompt "$(cat /tmp/gh-aw/aw-prompts/prompt.txt)"${GH_AW_MODEL_AGENT_COPILOT:+ --model "$GH_AW_MODEL_AGENT_COPILOT"} \
2>&1 | tee /tmp/gh-aw/agent-stdio.log 2>&1 | tee /tmp/gh-aw/agent-stdio.log
env: env:
@ -778,7 +777,7 @@ jobs:
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
env: env:
GH_AW_SAFE_OUTPUTS: ${{ env.GH_AW_SAFE_OUTPUTS }} GH_AW_SAFE_OUTPUTS: ${{ env.GH_AW_SAFE_OUTPUTS }}
GH_AW_ALLOWED_DOMAINS: "api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,github.com,host.docker.internal,raw.githubusercontent.com,registry.npmjs.org" GH_AW_ALLOWED_DOMAINS: "api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,github.com,host.docker.internal,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,ppa.launchpad.net,raw.githubusercontent.com,registry.npmjs.org,s.symcb.com,s.symcd.com,security.ubuntu.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com"
GITHUB_SERVER_URL: ${{ github.server_url }} GITHUB_SERVER_URL: ${{ github.server_url }}
GITHUB_API_URL: ${{ github.api_url }} GITHUB_API_URL: ${{ github.api_url }}
with: with:
@ -866,7 +865,7 @@ jobs:
total_count: ${{ steps.missing_tool.outputs.total_count }} total_count: ${{ steps.missing_tool.outputs.total_count }}
steps: steps:
- name: Setup Scripts - name: Setup Scripts
uses: githubnext/gh-aw/actions/setup@v0.37.15 uses: githubnext/gh-aw/actions/setup@v0.37.19
with: with:
destination: /opt/gh-aw/actions destination: /opt/gh-aw/actions
- name: Debug job inputs - name: Debug job inputs
@ -882,7 +881,7 @@ jobs:
echo "Agent Conclusion: $AGENT_CONCLUSION" echo "Agent Conclusion: $AGENT_CONCLUSION"
- name: Download agent output artifact - name: Download agent output artifact
continue-on-error: true continue-on-error: true
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0 uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
with: with:
name: agent-output name: agent-output
path: /tmp/gh-aw/safeoutputs/ path: /tmp/gh-aw/safeoutputs/
@ -982,18 +981,18 @@ jobs:
success: ${{ steps.parse_results.outputs.success }} success: ${{ steps.parse_results.outputs.success }}
steps: steps:
- name: Setup Scripts - name: Setup Scripts
uses: githubnext/gh-aw/actions/setup@v0.37.15 uses: githubnext/gh-aw/actions/setup@v0.37.19
with: with:
destination: /opt/gh-aw/actions destination: /opt/gh-aw/actions
- name: Download agent artifacts - name: Download agent artifacts
continue-on-error: true continue-on-error: true
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0 uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
with: with:
name: agent-artifacts name: agent-artifacts
path: /tmp/gh-aw/threat-detection/ path: /tmp/gh-aw/threat-detection/
- name: Download agent output artifact - name: Download agent output artifact
continue-on-error: true continue-on-error: true
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0 uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
with: with:
name: agent-output name: agent-output
path: /tmp/gh-aw/threat-detection/ path: /tmp/gh-aw/threat-detection/
@ -1134,12 +1133,12 @@ jobs:
process_safe_outputs_temporary_id_map: ${{ steps.process_safe_outputs.outputs.temporary_id_map }} process_safe_outputs_temporary_id_map: ${{ steps.process_safe_outputs.outputs.temporary_id_map }}
steps: steps:
- name: Setup Scripts - name: Setup Scripts
uses: githubnext/gh-aw/actions/setup@v0.37.15 uses: githubnext/gh-aw/actions/setup@v0.37.19
with: with:
destination: /opt/gh-aw/actions destination: /opt/gh-aw/actions
- name: Download agent output artifact - name: Download agent output artifact
continue-on-error: true continue-on-error: true
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0 uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
with: with:
name: agent-output name: agent-output
path: /tmp/gh-aw/safeoutputs/ path: /tmp/gh-aw/safeoutputs/
@ -1150,13 +1149,13 @@ jobs:
echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/safeoutputs/agent_output.json" >> "$GITHUB_ENV" echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/safeoutputs/agent_output.json" >> "$GITHUB_ENV"
- name: Download patch artifact - name: Download patch artifact
continue-on-error: true continue-on-error: true
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0 uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
with: with:
name: agent-artifacts name: agent-artifacts
path: /tmp/gh-aw/ path: /tmp/gh-aw/
- name: Checkout repository - name: Checkout repository
if: ((!cancelled()) && (needs.agent.result != 'skipped')) && (contains(needs.agent.outputs.output_types, 'create_pull_request')) if: ((!cancelled()) && (needs.agent.result != 'skipped')) && (contains(needs.agent.outputs.output_types, 'create_pull_request'))
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with: with:
token: ${{ github.token }} token: ${{ github.token }}
persist-credentials: false persist-credentials: false

95
.github/workflows/code-conventions-analyzer.lock.yml generated vendored
View file

@ -13,7 +13,7 @@
# \ /\ / (_) | | | | ( | | | | (_) \ V V /\__ \ # \ /\ / (_) | | | | ( | | | | (_) \ V V /\__ \
# \/ \/ \___/|_| |_|\_\|_| |_|\___/ \_/\_/ |___/ # \/ \/ \___/|_| |_|\_\|_| |_|\___/ \_/\_/ |___/
# #
# This file was automatically generated by gh-aw (v0.37.15). DO NOT EDIT. # This file was automatically generated by gh-aw (v0.37.19). DO NOT EDIT.
# #
# To update this file, edit the corresponding .md file and run: # To update this file, edit the corresponding .md file and run:
# gh aw compile # gh aw compile
@ -45,7 +45,7 @@ jobs:
comment_repo: "" comment_repo: ""
steps: steps:
- name: Setup Scripts - name: Setup Scripts
uses: githubnext/gh-aw/actions/setup@v0.37.15 uses: githubnext/gh-aw/actions/setup@v0.37.19
with: with:
destination: /opt/gh-aw/actions destination: /opt/gh-aw/actions
- name: Check workflow file timestamps - name: Check workflow file timestamps
@ -82,11 +82,11 @@ jobs:
secret_verification_result: ${{ steps.validate-secret.outputs.verification_result }} secret_verification_result: ${{ steps.validate-secret.outputs.verification_result }}
steps: steps:
- name: Setup Scripts - name: Setup Scripts
uses: githubnext/gh-aw/actions/setup@v0.37.15 uses: githubnext/gh-aw/actions/setup@v0.37.19
with: with:
destination: /opt/gh-aw/actions destination: /opt/gh-aw/actions
- name: Checkout repository - name: Checkout repository
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with: with:
persist-credentials: false persist-credentials: false
- name: Create gh-aw temp directory - name: Create gh-aw temp directory
@ -146,7 +146,7 @@ jobs:
const determineAutomaticLockdown = require('/opt/gh-aw/actions/determine_automatic_lockdown.cjs'); const determineAutomaticLockdown = require('/opt/gh-aw/actions/determine_automatic_lockdown.cjs');
await determineAutomaticLockdown(github, context, core); await determineAutomaticLockdown(github, context, core);
- name: Download container images - name: Download container images
run: bash /opt/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.29.0 ghcr.io/githubnext/gh-aw-mcpg:v0.0.76 node:lts-alpine run: bash /opt/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.29.0 ghcr.io/githubnext/gh-aw-mcpg:v0.0.78 node:lts-alpine
- name: Write Safe Outputs Config - name: Write Safe Outputs Config
run: | run: |
mkdir -p /opt/gh-aw/safeoutputs mkdir -p /opt/gh-aw/safeoutputs
@ -449,7 +449,7 @@ jobs:
# Register API key as secret to mask it from logs # Register API key as secret to mask it from logs
echo "::add-mask::${MCP_GATEWAY_API_KEY}" echo "::add-mask::${MCP_GATEWAY_API_KEY}"
export GH_AW_ENGINE="copilot" export GH_AW_ENGINE="copilot"
export MCP_GATEWAY_DOCKER_COMMAND='docker run -i --rm --network host -v /var/run/docker.sock:/var/run/docker.sock -e MCP_GATEWAY_PORT -e MCP_GATEWAY_DOMAIN -e MCP_GATEWAY_API_KEY -e DEBUG="*" -e MCP_GATEWAY_LOG_DIR -e GH_AW_MCP_LOG_DIR -e GH_AW_SAFE_OUTPUTS -e GH_AW_SAFE_OUTPUTS_CONFIG_PATH -e GH_AW_SAFE_OUTPUTS_TOOLS_PATH -e GH_AW_ASSETS_BRANCH -e GH_AW_ASSETS_MAX_SIZE_KB -e GH_AW_ASSETS_ALLOWED_EXTS -e DEFAULT_BRANCH -e GITHUB_MCP_SERVER_TOKEN -e GITHUB_MCP_LOCKDOWN -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e GITHUB_SHA -e GITHUB_WORKSPACE -e GITHUB_TOKEN -e GITHUB_RUN_ID -e GITHUB_RUN_NUMBER -e GITHUB_RUN_ATTEMPT -e GITHUB_JOB -e GITHUB_ACTION -e GITHUB_EVENT_NAME -e GITHUB_EVENT_PATH -e GITHUB_ACTOR -e GITHUB_ACTOR_ID -e GITHUB_TRIGGERING_ACTOR -e GITHUB_WORKFLOW -e GITHUB_WORKFLOW_REF -e GITHUB_WORKFLOW_SHA -e GITHUB_REF -e GITHUB_REF_NAME -e GITHUB_REF_TYPE -e GITHUB_HEAD_REF -e GITHUB_BASE_REF -e GH_AW_SAFE_OUTPUTS_PORT -e GH_AW_SAFE_OUTPUTS_API_KEY -v /opt:/opt:ro -v /tmp:/tmp:rw -v '"${GITHUB_WORKSPACE}"':'"${GITHUB_WORKSPACE}"':rw ghcr.io/githubnext/gh-aw-mcpg:v0.0.76' export MCP_GATEWAY_DOCKER_COMMAND='docker run -i --rm --network host -v /var/run/docker.sock:/var/run/docker.sock -e MCP_GATEWAY_PORT -e MCP_GATEWAY_DOMAIN -e MCP_GATEWAY_API_KEY -e DEBUG="*" -e MCP_GATEWAY_LOG_DIR -e GH_AW_MCP_LOG_DIR -e GH_AW_SAFE_OUTPUTS -e GH_AW_SAFE_OUTPUTS_CONFIG_PATH -e GH_AW_SAFE_OUTPUTS_TOOLS_PATH -e GH_AW_ASSETS_BRANCH -e GH_AW_ASSETS_MAX_SIZE_KB -e GH_AW_ASSETS_ALLOWED_EXTS -e DEFAULT_BRANCH -e GITHUB_MCP_SERVER_TOKEN -e GITHUB_MCP_LOCKDOWN -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e GITHUB_SHA -e GITHUB_WORKSPACE -e GITHUB_TOKEN -e GITHUB_RUN_ID -e GITHUB_RUN_NUMBER -e GITHUB_RUN_ATTEMPT -e GITHUB_JOB -e GITHUB_ACTION -e GITHUB_EVENT_NAME -e GITHUB_EVENT_PATH -e GITHUB_ACTOR -e GITHUB_ACTOR_ID -e GITHUB_TRIGGERING_ACTOR -e GITHUB_WORKFLOW -e GITHUB_WORKFLOW_REF -e GITHUB_WORKFLOW_SHA -e GITHUB_REF -e GITHUB_REF_NAME -e GITHUB_REF_TYPE -e GITHUB_HEAD_REF -e GITHUB_BASE_REF -e GH_AW_SAFE_OUTPUTS_PORT -e GH_AW_SAFE_OUTPUTS_API_KEY -v /opt:/opt:ro -v /tmp:/tmp:rw -v '"${GITHUB_WORKSPACE}"':'"${GITHUB_WORKSPACE}"':rw ghcr.io/githubnext/gh-aw-mcpg:v0.0.78'
mkdir -p /home/runner/.copilot mkdir -p /home/runner/.copilot
cat << MCPCONFIG_EOF | bash /opt/gh-aw/actions/start_mcp_gateway.sh cat << MCPCONFIG_EOF | bash /opt/gh-aw/actions/start_mcp_gateway.sh
@ -493,7 +493,7 @@ jobs:
model: process.env.GH_AW_MODEL_AGENT_COPILOT || "", model: process.env.GH_AW_MODEL_AGENT_COPILOT || "",
version: "", version: "",
agent_version: "0.0.389", agent_version: "0.0.389",
cli_version: "v0.37.15", cli_version: "v0.37.19",
workflow_name: "Code Conventions Analyzer", workflow_name: "Code Conventions Analyzer",
experimental: false, experimental: false,
supports_tools_allowlist: true, supports_tools_allowlist: true,
@ -507,11 +507,10 @@ jobs:
actor: context.actor, actor: context.actor,
event_name: context.eventName, event_name: context.eventName,
staged: false, staged: false,
network_mode: "defaults", allowed_domains: ["defaults"],
allowed_domains: [],
firewall_enabled: true, firewall_enabled: true,
awf_version: "v0.10.0", awf_version: "v0.10.0",
awmg_version: "v0.0.76", awmg_version: "v0.0.78",
steps: { steps: {
firewall: "squid" firewall: "squid"
}, },
@ -653,15 +652,22 @@ jobs:
- Iterator dereferences accessing pair members (e.g., map iterators) - Iterator dereferences accessing pair members (e.g., map iterators)
- Code that would be clearer with meaningful variable names instead of `.first`/`.second` - Code that would be clearer with meaningful variable names instead of `.first`/`.second`
**Naming Convention for Structured Bindings:**
When introducing structured bindings, use names that are representative of the types or field semantics:
- For `enode_pair`: use `[n1, n2]` instead of `[first, second]` or `[a, b]`
- For map iterators: use `[key, value]` or `[k, v]` instead of `[first, second]`
- For domain-specific pairs: use names reflecting the semantics (e.g., `[var, offset]`, `[expr, count]`)
- **Avoid generic names** like `first`, `second`, `third`, `a`, `b` unless the pair truly represents generic values
**Example refactoring:** **Example refactoring:**
```cpp ```cpp
// Before: Using .first and .second // Before: Using .first and .second on enode_pair
auto x = f(y); enode_pair p = get_pair(y);
return g(x.first, x.second); return merge(p.first, p.second);
// After: Using structured bindings // After: Using structured bindings with meaningful names
auto [a, b] = f(y); auto [n1, n2] = get_pair(y);
return g(a, b); return merge(n1, n2);
``` ```
**TERTIARY FOCUS: Create Issues for initializer_list Refactoring** **TERTIARY FOCUS: Create Issues for initializer_list Refactoring**
@ -1056,6 +1062,8 @@ jobs:
- Constructors with member initializers (may still be candidates for improvement) - Constructors with member initializers (may still be candidates for improvement)
- Constructors that only initialize members to default values - Constructors that only initialize members to default values
- **Empty destructors**: Trivial destructors that can be removed or use `= default` - **Empty destructors**: Trivial destructors that can be removed or use `= default`
PROMPT_EOF
cat << 'PROMPT_EOF' >> "$GH_AW_PROMPT"
- Destructors with empty body `~Class() {}` - Destructors with empty body `~Class() {}`
- Non-virtual destructors that don't need to be explicitly defined - Non-virtual destructors that don't need to be explicitly defined
- Virtual destructors (keep explicit even if empty for polymorphic classes), - Virtual destructors (keep explicit even if empty for polymorphic classes),
@ -1064,8 +1072,6 @@ jobs:
- Classes with virtual functions but non-virtual destructors (potential issue) - Classes with virtual functions but non-virtual destructors (potential issue)
- Base classes without virtual destructors (check if inheritance is intended) - Base classes without virtual destructors (check if inheritance is intended)
- Non-virtual destructors missing `noexcept` (should be added) - Non-virtual destructors missing `noexcept` (should be added)
PROMPT_EOF
cat << 'PROMPT_EOF' >> "$GH_AW_PROMPT"
- Leaf classes with unnecessary virtual destructors (minor overhead) - Leaf classes with unnecessary virtual destructors (minor overhead)
- Missing `noexcept` on non-default constructors and destructors - Missing `noexcept` on non-default constructors and destructors
- Opportunities to use compiler-generated special members (`= default`, `= delete`) - Opportunities to use compiler-generated special members (`= default`, `= delete`)
@ -1128,15 +1134,16 @@ jobs:
- **SECONDARY TASK**: Code accessing `.first` and `.second` on pairs/tuples - **SECONDARY TASK**: Code accessing `.first` and `.second` on pairs/tuples
- **ACTION**: Replace with C++17 structured bindings for cleaner, more readable code - **ACTION**: Replace with C++17 structured bindings for cleaner, more readable code
- **RESULT**: Create an issue with the actual code changes - **RESULT**: Create an issue with the actual code changes
- **NAMING**: Use descriptive names based on types/semantics (e.g., `[n1, n2]` for `enode_pair`, `[k, v]` for maps)
- **Example**: - **Example**:
```cpp ```cpp
// Before // Before
auto x = f(y); enode_pair p = get_pair(y);
return g(x.first, x.second); return merge(p.first, p.second);
// After // After: Use meaningful names, not generic [a, b]
auto [a, b] = f(y); auto [n1, n2] = get_pair(y);
return g(a, b); return merge(n1, n2);
``` ```
**Exception String Construction:** **Exception String Construction:**
@ -1448,6 +1455,8 @@ jobs:
- **Simplification**: [Code that would be cleaner with auto cleanup] - **Simplification**: [Code that would be cleaner with auto cleanup]
### 4.7 Move Semantics Analysis ### 4.7 Move Semantics Analysis
PROMPT_EOF
cat << 'PROMPT_EOF' >> "$GH_AW_PROMPT"
- **Missing std::move**: [Returns/assignments that should use move] - **Missing std::move**: [Returns/assignments that should use move]
- **Incorrect std::move**: [Move from const, unnecessary moves] - **Incorrect std::move**: [Move from const, unnecessary moves]
- **Return Value Optimization**: [Places where RVO is blocked] - **Return Value Optimization**: [Places where RVO is blocked]
@ -1463,8 +1472,6 @@ jobs:
2. Refactor using the `edit` tool 2. Refactor using the `edit` tool
3. Create an issue with your changes 3. Create an issue with your changes
- **API Improvements**: Specific function signatures to update - **API Improvements**: Specific function signatures to update
PROMPT_EOF
cat << 'PROMPT_EOF' >> "$GH_AW_PROMPT"
- **Examples**: File:line references with before/after code - **Examples**: File:line references with before/after code
- **Output**: Issue (not just discussion) - **Output**: Issue (not just discussion)
@ -1482,17 +1489,17 @@ jobs:
- **Action**: Find and refactor tuple/pair access patterns: - **Action**: Find and refactor tuple/pair access patterns:
1. Search for patterns using `.first` and `.second` 1. Search for patterns using `.first` and `.second`
2. Identify cases where intermediate variable can be eliminated 2. Identify cases where intermediate variable can be eliminated
3. Refactor to use structured bindings 3. Refactor to use structured bindings with **meaningful names** (not generic `a`, `b`, `first`, `second`)
4. Create an issue with changes 4. Create an issue with changes
- **Example Pattern**: - **Example Pattern**:
```cpp ```cpp
// Before: Using .first and .second // Before: Using .first and .second on enode_pair
auto x = f(y); enode_pair p = get_pair(y);
return g(x.first, x.second); return merge(p.first, p.second);
// After: Using structured bindings // After: Using structured bindings with descriptive names
auto [a, b] = f(y); auto [n1, n2] = get_pair(y);
return g(a, b); return merge(n1, n2);
``` ```
- **Another Example**: - **Another Example**:
```cpp ```cpp
@ -1907,6 +1914,8 @@ jobs:
- Never execute untrusted code - Never execute untrusted code
- Use `bash` only for safe operations (git, grep patterns) - Use `bash` only for safe operations (git, grep patterns)
PROMPT_EOF
cat << 'PROMPT_EOF' >> "$GH_AW_PROMPT"
- **For std::optional refactoring**: Use the `edit` tool to modify files directly - **For std::optional refactoring**: Use the `edit` tool to modify files directly
- **For other findings**: Create discussions only (no code modifications) - **For other findings**: Create discussions only (no code modifications)
- All code changes for std::optional will be reviewed through the issue process - All code changes for std::optional will be reviewed through the issue process
@ -2002,7 +2011,7 @@ jobs:
timeout-minutes: 20 timeout-minutes: 20
run: | run: |
set -o pipefail set -o pipefail
sudo -E awf --env-all --container-workdir "${GITHUB_WORKSPACE}" --mount /tmp:/tmp:rw --mount "${GITHUB_WORKSPACE}:${GITHUB_WORKSPACE}:rw" --mount /usr/bin/date:/usr/bin/date:ro --mount /usr/bin/gh:/usr/bin/gh:ro --mount /usr/bin/yq:/usr/bin/yq:ro --mount /usr/local/bin/copilot:/usr/local/bin/copilot:ro --mount /home/runner/.copilot:/home/runner/.copilot:rw --mount /opt/gh-aw:/opt/gh-aw:ro --allow-domains api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,github.com,host.docker.internal,raw.githubusercontent.com,registry.npmjs.org --log-level info --proxy-logs-dir /tmp/gh-aw/sandbox/firewall/logs --enable-host-access --image-tag 0.10.0 \ sudo -E awf --env-all --container-workdir "${GITHUB_WORKSPACE}" --mount /tmp:/tmp:rw --mount "${GITHUB_WORKSPACE}:${GITHUB_WORKSPACE}:rw" --mount /usr/bin/date:/usr/bin/date:ro --mount /usr/bin/gh:/usr/bin/gh:ro --mount /usr/bin/yq:/usr/bin/yq:ro --mount /usr/local/bin/copilot:/usr/local/bin/copilot:ro --mount /home/runner/.copilot:/home/runner/.copilot:rw --mount /opt/gh-aw:/opt/gh-aw:ro --allow-domains api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,github.com,host.docker.internal,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,ppa.launchpad.net,raw.githubusercontent.com,registry.npmjs.org,s.symcb.com,s.symcd.com,security.ubuntu.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com --log-level info --proxy-logs-dir /tmp/gh-aw/sandbox/firewall/logs --enable-host-access --image-tag 0.10.0 \
-- /usr/local/bin/copilot --add-dir /tmp/gh-aw/ --log-level all --log-dir /tmp/gh-aw/sandbox/agent/logs/ --add-dir "${GITHUB_WORKSPACE}" --disable-builtin-mcps --allow-tool github --allow-tool safeoutputs --allow-tool 'shell(cat)' --allow-tool 'shell(clang-format --version)' --allow-tool 'shell(date)' --allow-tool 'shell(echo)' --allow-tool 'shell(git diff:*)' --allow-tool 'shell(git log:*)' --allow-tool 'shell(git show:*)' --allow-tool 'shell(grep)' --allow-tool 'shell(head)' --allow-tool 'shell(ls)' --allow-tool 'shell(pwd)' --allow-tool 'shell(sort)' --allow-tool 'shell(tail)' --allow-tool 'shell(uniq)' --allow-tool 'shell(wc)' --allow-tool 'shell(yq)' --allow-tool write --add-dir /tmp/gh-aw/cache-memory/ --allow-all-paths --share /tmp/gh-aw/sandbox/agent/logs/conversation.md --prompt "$(cat /tmp/gh-aw/aw-prompts/prompt.txt)"${GH_AW_MODEL_AGENT_COPILOT:+ --model "$GH_AW_MODEL_AGENT_COPILOT"} \ -- /usr/local/bin/copilot --add-dir /tmp/gh-aw/ --log-level all --log-dir /tmp/gh-aw/sandbox/agent/logs/ --add-dir "${GITHUB_WORKSPACE}" --disable-builtin-mcps --allow-tool github --allow-tool safeoutputs --allow-tool 'shell(cat)' --allow-tool 'shell(clang-format --version)' --allow-tool 'shell(date)' --allow-tool 'shell(echo)' --allow-tool 'shell(git diff:*)' --allow-tool 'shell(git log:*)' --allow-tool 'shell(git show:*)' --allow-tool 'shell(grep)' --allow-tool 'shell(head)' --allow-tool 'shell(ls)' --allow-tool 'shell(pwd)' --allow-tool 'shell(sort)' --allow-tool 'shell(tail)' --allow-tool 'shell(uniq)' --allow-tool 'shell(wc)' --allow-tool 'shell(yq)' --allow-tool write --add-dir /tmp/gh-aw/cache-memory/ --allow-all-paths --share /tmp/gh-aw/sandbox/agent/logs/conversation.md --prompt "$(cat /tmp/gh-aw/aw-prompts/prompt.txt)"${GH_AW_MODEL_AGENT_COPILOT:+ --model "$GH_AW_MODEL_AGENT_COPILOT"} \
2>&1 | tee /tmp/gh-aw/agent-stdio.log 2>&1 | tee /tmp/gh-aw/agent-stdio.log
env: env:
@ -2070,7 +2079,7 @@ jobs:
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
env: env:
GH_AW_SAFE_OUTPUTS: ${{ env.GH_AW_SAFE_OUTPUTS }} GH_AW_SAFE_OUTPUTS: ${{ env.GH_AW_SAFE_OUTPUTS }}
GH_AW_ALLOWED_DOMAINS: "api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,github.com,host.docker.internal,raw.githubusercontent.com,registry.npmjs.org" GH_AW_ALLOWED_DOMAINS: "api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,github.com,host.docker.internal,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,ppa.launchpad.net,raw.githubusercontent.com,registry.npmjs.org,s.symcb.com,s.symcd.com,security.ubuntu.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com"
GITHUB_SERVER_URL: ${{ github.server_url }} GITHUB_SERVER_URL: ${{ github.server_url }}
GITHUB_API_URL: ${{ github.api_url }} GITHUB_API_URL: ${{ github.api_url }}
with: with:
@ -2164,7 +2173,7 @@ jobs:
total_count: ${{ steps.missing_tool.outputs.total_count }} total_count: ${{ steps.missing_tool.outputs.total_count }}
steps: steps:
- name: Setup Scripts - name: Setup Scripts
uses: githubnext/gh-aw/actions/setup@v0.37.15 uses: githubnext/gh-aw/actions/setup@v0.37.19
with: with:
destination: /opt/gh-aw/actions destination: /opt/gh-aw/actions
- name: Debug job inputs - name: Debug job inputs
@ -2180,7 +2189,7 @@ jobs:
echo "Agent Conclusion: $AGENT_CONCLUSION" echo "Agent Conclusion: $AGENT_CONCLUSION"
- name: Download agent output artifact - name: Download agent output artifact
continue-on-error: true continue-on-error: true
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0 uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
with: with:
name: agent-output name: agent-output
path: /tmp/gh-aw/safeoutputs/ path: /tmp/gh-aw/safeoutputs/
@ -2265,18 +2274,18 @@ jobs:
success: ${{ steps.parse_results.outputs.success }} success: ${{ steps.parse_results.outputs.success }}
steps: steps:
- name: Setup Scripts - name: Setup Scripts
uses: githubnext/gh-aw/actions/setup@v0.37.15 uses: githubnext/gh-aw/actions/setup@v0.37.19
with: with:
destination: /opt/gh-aw/actions destination: /opt/gh-aw/actions
- name: Download agent artifacts - name: Download agent artifacts
continue-on-error: true continue-on-error: true
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0 uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
with: with:
name: agent-artifacts name: agent-artifacts
path: /tmp/gh-aw/threat-detection/ path: /tmp/gh-aw/threat-detection/
- name: Download agent output artifact - name: Download agent output artifact
continue-on-error: true continue-on-error: true
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0 uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
with: with:
name: agent-output name: agent-output
path: /tmp/gh-aw/threat-detection/ path: /tmp/gh-aw/threat-detection/
@ -2416,12 +2425,12 @@ jobs:
process_safe_outputs_temporary_id_map: ${{ steps.process_safe_outputs.outputs.temporary_id_map }} process_safe_outputs_temporary_id_map: ${{ steps.process_safe_outputs.outputs.temporary_id_map }}
steps: steps:
- name: Setup Scripts - name: Setup Scripts
uses: githubnext/gh-aw/actions/setup@v0.37.15 uses: githubnext/gh-aw/actions/setup@v0.37.19
with: with:
destination: /opt/gh-aw/actions destination: /opt/gh-aw/actions
- name: Download agent output artifact - name: Download agent output artifact
continue-on-error: true continue-on-error: true
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0 uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
with: with:
name: agent-output name: agent-output
path: /tmp/gh-aw/safeoutputs/ path: /tmp/gh-aw/safeoutputs/
@ -2453,11 +2462,11 @@ jobs:
permissions: {} permissions: {}
steps: steps:
- name: Setup Scripts - name: Setup Scripts
uses: githubnext/gh-aw/actions/setup@v0.37.15 uses: githubnext/gh-aw/actions/setup@v0.37.19
with: with:
destination: /opt/gh-aw/actions destination: /opt/gh-aw/actions
- name: Download cache-memory artifact (default) - name: Download cache-memory artifact (default)
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0 uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
continue-on-error: true continue-on-error: true
with: with:
name: cache-memory name: cache-memory

35
.github/workflows/release-notes-updater.lock.yml generated vendored
View file

@ -13,7 +13,7 @@
# \ /\ / (_) | | | | ( | | | | (_) \ V V /\__ \ # \ /\ / (_) | | | | ( | | | | (_) \ V V /\__ \
# \/ \/ \___/|_| |_|\_\|_| |_|\___/ \_/\_/ |___/ # \/ \/ \___/|_| |_|\_\|_| |_|\___/ \_/\_/ |___/
# #
# This file was automatically generated by gh-aw (v0.37.15). DO NOT EDIT. # This file was automatically generated by gh-aw (v0.37.19). DO NOT EDIT.
# #
# To update this file, edit the corresponding .md file and run: # To update this file, edit the corresponding .md file and run:
# gh aw compile # gh aw compile
@ -45,7 +45,7 @@ jobs:
comment_repo: "" comment_repo: ""
steps: steps:
- name: Setup Scripts - name: Setup Scripts
uses: githubnext/gh-aw/actions/setup@v0.37.15 uses: githubnext/gh-aw/actions/setup@v0.37.19
with: with:
destination: /opt/gh-aw/actions destination: /opt/gh-aw/actions
- name: Check workflow file timestamps - name: Check workflow file timestamps
@ -82,7 +82,7 @@ jobs:
secret_verification_result: ${{ steps.validate-secret.outputs.verification_result }} secret_verification_result: ${{ steps.validate-secret.outputs.verification_result }}
steps: steps:
- name: Setup Scripts - name: Setup Scripts
uses: githubnext/gh-aw/actions/setup@v0.37.15 uses: githubnext/gh-aw/actions/setup@v0.37.19
with: with:
destination: /opt/gh-aw/actions destination: /opt/gh-aw/actions
- name: Create gh-aw temp directory - name: Create gh-aw temp directory
@ -136,7 +136,7 @@ jobs:
const determineAutomaticLockdown = require('/opt/gh-aw/actions/determine_automatic_lockdown.cjs'); const determineAutomaticLockdown = require('/opt/gh-aw/actions/determine_automatic_lockdown.cjs');
await determineAutomaticLockdown(github, context, core); await determineAutomaticLockdown(github, context, core);
- name: Download container images - name: Download container images
run: bash /opt/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.29.0 ghcr.io/githubnext/gh-aw-mcpg:v0.0.76 node:lts-alpine run: bash /opt/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.29.0 ghcr.io/githubnext/gh-aw-mcpg:v0.0.78 node:lts-alpine
- name: Write Safe Outputs Config - name: Write Safe Outputs Config
run: | run: |
mkdir -p /opt/gh-aw/safeoutputs mkdir -p /opt/gh-aw/safeoutputs
@ -366,7 +366,7 @@ jobs:
# Register API key as secret to mask it from logs # Register API key as secret to mask it from logs
echo "::add-mask::${MCP_GATEWAY_API_KEY}" echo "::add-mask::${MCP_GATEWAY_API_KEY}"
export GH_AW_ENGINE="copilot" export GH_AW_ENGINE="copilot"
export MCP_GATEWAY_DOCKER_COMMAND='docker run -i --rm --network host -v /var/run/docker.sock:/var/run/docker.sock -e MCP_GATEWAY_PORT -e MCP_GATEWAY_DOMAIN -e MCP_GATEWAY_API_KEY -e DEBUG="*" -e MCP_GATEWAY_LOG_DIR -e GH_AW_MCP_LOG_DIR -e GH_AW_SAFE_OUTPUTS -e GH_AW_SAFE_OUTPUTS_CONFIG_PATH -e GH_AW_SAFE_OUTPUTS_TOOLS_PATH -e GH_AW_ASSETS_BRANCH -e GH_AW_ASSETS_MAX_SIZE_KB -e GH_AW_ASSETS_ALLOWED_EXTS -e DEFAULT_BRANCH -e GITHUB_MCP_SERVER_TOKEN -e GITHUB_MCP_LOCKDOWN -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e GITHUB_SHA -e GITHUB_WORKSPACE -e GITHUB_TOKEN -e GITHUB_RUN_ID -e GITHUB_RUN_NUMBER -e GITHUB_RUN_ATTEMPT -e GITHUB_JOB -e GITHUB_ACTION -e GITHUB_EVENT_NAME -e GITHUB_EVENT_PATH -e GITHUB_ACTOR -e GITHUB_ACTOR_ID -e GITHUB_TRIGGERING_ACTOR -e GITHUB_WORKFLOW -e GITHUB_WORKFLOW_REF -e GITHUB_WORKFLOW_SHA -e GITHUB_REF -e GITHUB_REF_NAME -e GITHUB_REF_TYPE -e GITHUB_HEAD_REF -e GITHUB_BASE_REF -e GH_AW_SAFE_OUTPUTS_PORT -e GH_AW_SAFE_OUTPUTS_API_KEY -v /opt:/opt:ro -v /tmp:/tmp:rw -v '"${GITHUB_WORKSPACE}"':'"${GITHUB_WORKSPACE}"':rw ghcr.io/githubnext/gh-aw-mcpg:v0.0.76' export MCP_GATEWAY_DOCKER_COMMAND='docker run -i --rm --network host -v /var/run/docker.sock:/var/run/docker.sock -e MCP_GATEWAY_PORT -e MCP_GATEWAY_DOMAIN -e MCP_GATEWAY_API_KEY -e DEBUG="*" -e MCP_GATEWAY_LOG_DIR -e GH_AW_MCP_LOG_DIR -e GH_AW_SAFE_OUTPUTS -e GH_AW_SAFE_OUTPUTS_CONFIG_PATH -e GH_AW_SAFE_OUTPUTS_TOOLS_PATH -e GH_AW_ASSETS_BRANCH -e GH_AW_ASSETS_MAX_SIZE_KB -e GH_AW_ASSETS_ALLOWED_EXTS -e DEFAULT_BRANCH -e GITHUB_MCP_SERVER_TOKEN -e GITHUB_MCP_LOCKDOWN -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e GITHUB_SHA -e GITHUB_WORKSPACE -e GITHUB_TOKEN -e GITHUB_RUN_ID -e GITHUB_RUN_NUMBER -e GITHUB_RUN_ATTEMPT -e GITHUB_JOB -e GITHUB_ACTION -e GITHUB_EVENT_NAME -e GITHUB_EVENT_PATH -e GITHUB_ACTOR -e GITHUB_ACTOR_ID -e GITHUB_TRIGGERING_ACTOR -e GITHUB_WORKFLOW -e GITHUB_WORKFLOW_REF -e GITHUB_WORKFLOW_SHA -e GITHUB_REF -e GITHUB_REF_NAME -e GITHUB_REF_TYPE -e GITHUB_HEAD_REF -e GITHUB_BASE_REF -e GH_AW_SAFE_OUTPUTS_PORT -e GH_AW_SAFE_OUTPUTS_API_KEY -v /opt:/opt:ro -v /tmp:/tmp:rw -v '"${GITHUB_WORKSPACE}"':'"${GITHUB_WORKSPACE}"':rw ghcr.io/githubnext/gh-aw-mcpg:v0.0.78'
mkdir -p /home/runner/.copilot mkdir -p /home/runner/.copilot
cat << MCPCONFIG_EOF | bash /opt/gh-aw/actions/start_mcp_gateway.sh cat << MCPCONFIG_EOF | bash /opt/gh-aw/actions/start_mcp_gateway.sh
@ -410,7 +410,7 @@ jobs:
model: process.env.GH_AW_MODEL_AGENT_COPILOT || "", model: process.env.GH_AW_MODEL_AGENT_COPILOT || "",
version: "", version: "",
agent_version: "0.0.389", agent_version: "0.0.389",
cli_version: "v0.37.15", cli_version: "v0.37.19",
workflow_name: "Release Notes Updater", workflow_name: "Release Notes Updater",
experimental: false, experimental: false,
supports_tools_allowlist: true, supports_tools_allowlist: true,
@ -424,11 +424,10 @@ jobs:
actor: context.actor, actor: context.actor,
event_name: context.eventName, event_name: context.eventName,
staged: false, staged: false,
network_mode: "defaults", allowed_domains: ["defaults"],
allowed_domains: [],
firewall_enabled: true, firewall_enabled: true,
awf_version: "v0.10.0", awf_version: "v0.10.0",
awmg_version: "v0.0.76", awmg_version: "v0.0.78",
steps: { steps: {
firewall: "squid" firewall: "squid"
}, },
@ -758,7 +757,7 @@ jobs:
timeout-minutes: 30 timeout-minutes: 30
run: | run: |
set -o pipefail set -o pipefail
sudo -E awf --env-all --container-workdir "${GITHUB_WORKSPACE}" --mount /tmp:/tmp:rw --mount "${GITHUB_WORKSPACE}:${GITHUB_WORKSPACE}:rw" --mount /usr/bin/date:/usr/bin/date:ro --mount /usr/bin/gh:/usr/bin/gh:ro --mount /usr/bin/yq:/usr/bin/yq:ro --mount /usr/local/bin/copilot:/usr/local/bin/copilot:ro --mount /home/runner/.copilot:/home/runner/.copilot:rw --mount /opt/gh-aw:/opt/gh-aw:ro --allow-domains api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,github.com,host.docker.internal,raw.githubusercontent.com,registry.npmjs.org --log-level info --proxy-logs-dir /tmp/gh-aw/sandbox/firewall/logs --enable-host-access --image-tag 0.10.0 \ sudo -E awf --env-all --container-workdir "${GITHUB_WORKSPACE}" --mount /tmp:/tmp:rw --mount "${GITHUB_WORKSPACE}:${GITHUB_WORKSPACE}:rw" --mount /usr/bin/date:/usr/bin/date:ro --mount /usr/bin/gh:/usr/bin/gh:ro --mount /usr/bin/yq:/usr/bin/yq:ro --mount /usr/local/bin/copilot:/usr/local/bin/copilot:ro --mount /home/runner/.copilot:/home/runner/.copilot:rw --mount /opt/gh-aw:/opt/gh-aw:ro --allow-domains api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,github.com,host.docker.internal,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,ppa.launchpad.net,raw.githubusercontent.com,registry.npmjs.org,s.symcb.com,s.symcd.com,security.ubuntu.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com --log-level info --proxy-logs-dir /tmp/gh-aw/sandbox/firewall/logs --enable-host-access --image-tag 0.10.0 \
-- /usr/local/bin/copilot --add-dir /tmp/gh-aw/ --log-level all --log-dir /tmp/gh-aw/sandbox/agent/logs/ --add-dir "${GITHUB_WORKSPACE}" --disable-builtin-mcps --allow-all-tools --allow-all-paths --share /tmp/gh-aw/sandbox/agent/logs/conversation.md --prompt "$(cat /tmp/gh-aw/aw-prompts/prompt.txt)"${GH_AW_MODEL_AGENT_COPILOT:+ --model "$GH_AW_MODEL_AGENT_COPILOT"} \ -- /usr/local/bin/copilot --add-dir /tmp/gh-aw/ --log-level all --log-dir /tmp/gh-aw/sandbox/agent/logs/ --add-dir "${GITHUB_WORKSPACE}" --disable-builtin-mcps --allow-all-tools --allow-all-paths --share /tmp/gh-aw/sandbox/agent/logs/conversation.md --prompt "$(cat /tmp/gh-aw/aw-prompts/prompt.txt)"${GH_AW_MODEL_AGENT_COPILOT:+ --model "$GH_AW_MODEL_AGENT_COPILOT"} \
2>&1 | tee /tmp/gh-aw/agent-stdio.log 2>&1 | tee /tmp/gh-aw/agent-stdio.log
env: env:
@ -826,7 +825,7 @@ jobs:
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
env: env:
GH_AW_SAFE_OUTPUTS: ${{ env.GH_AW_SAFE_OUTPUTS }} GH_AW_SAFE_OUTPUTS: ${{ env.GH_AW_SAFE_OUTPUTS }}
GH_AW_ALLOWED_DOMAINS: "api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,github.com,host.docker.internal,raw.githubusercontent.com,registry.npmjs.org" GH_AW_ALLOWED_DOMAINS: "api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,github.com,host.docker.internal,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,ppa.launchpad.net,raw.githubusercontent.com,registry.npmjs.org,s.symcb.com,s.symcd.com,security.ubuntu.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com"
GITHUB_SERVER_URL: ${{ github.server_url }} GITHUB_SERVER_URL: ${{ github.server_url }}
GITHUB_API_URL: ${{ github.api_url }} GITHUB_API_URL: ${{ github.api_url }}
with: with:
@ -913,7 +912,7 @@ jobs:
total_count: ${{ steps.missing_tool.outputs.total_count }} total_count: ${{ steps.missing_tool.outputs.total_count }}
steps: steps:
- name: Setup Scripts - name: Setup Scripts
uses: githubnext/gh-aw/actions/setup@v0.37.15 uses: githubnext/gh-aw/actions/setup@v0.37.19
with: with:
destination: /opt/gh-aw/actions destination: /opt/gh-aw/actions
- name: Debug job inputs - name: Debug job inputs
@ -929,7 +928,7 @@ jobs:
echo "Agent Conclusion: $AGENT_CONCLUSION" echo "Agent Conclusion: $AGENT_CONCLUSION"
- name: Download agent output artifact - name: Download agent output artifact
continue-on-error: true continue-on-error: true
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0 uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
with: with:
name: agent-output name: agent-output
path: /tmp/gh-aw/safeoutputs/ path: /tmp/gh-aw/safeoutputs/
@ -1012,18 +1011,18 @@ jobs:
success: ${{ steps.parse_results.outputs.success }} success: ${{ steps.parse_results.outputs.success }}
steps: steps:
- name: Setup Scripts - name: Setup Scripts
uses: githubnext/gh-aw/actions/setup@v0.37.15 uses: githubnext/gh-aw/actions/setup@v0.37.19
with: with:
destination: /opt/gh-aw/actions destination: /opt/gh-aw/actions
- name: Download agent artifacts - name: Download agent artifacts
continue-on-error: true continue-on-error: true
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0 uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
with: with:
name: agent-artifacts name: agent-artifacts
path: /tmp/gh-aw/threat-detection/ path: /tmp/gh-aw/threat-detection/
- name: Download agent output artifact - name: Download agent output artifact
continue-on-error: true continue-on-error: true
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0 uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
with: with:
name: agent-output name: agent-output
path: /tmp/gh-aw/threat-detection/ path: /tmp/gh-aw/threat-detection/
@ -1162,12 +1161,12 @@ jobs:
process_safe_outputs_temporary_id_map: ${{ steps.process_safe_outputs.outputs.temporary_id_map }} process_safe_outputs_temporary_id_map: ${{ steps.process_safe_outputs.outputs.temporary_id_map }}
steps: steps:
- name: Setup Scripts - name: Setup Scripts
uses: githubnext/gh-aw/actions/setup@v0.37.15 uses: githubnext/gh-aw/actions/setup@v0.37.19
with: with:
destination: /opt/gh-aw/actions destination: /opt/gh-aw/actions
- name: Download agent output artifact - name: Download agent output artifact
continue-on-error: true continue-on-error: true
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0 uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
with: with:
name: agent-output name: agent-output
path: /tmp/gh-aw/safeoutputs/ path: /tmp/gh-aw/safeoutputs/

39
.github/workflows/soundness-bug-detector.lock.yml generated vendored
View file

@ -13,7 +13,7 @@
# \ /\ / (_) | | | | ( | | | | (_) \ V V /\__ \ # \ /\ / (_) | | | | ( | | | | (_) \ V V /\__ \
# \/ \/ \___/|_| |_|\_\|_| |_|\___/ \_/\_/ |___/ # \/ \/ \___/|_| |_|\_\|_| |_|\___/ \_/\_/ |___/
# #
# This file was automatically generated by gh-aw (v0.37.15). DO NOT EDIT. # This file was automatically generated by gh-aw (v0.37.19). DO NOT EDIT.
# #
# To update this file, edit the corresponding .md file and run: # To update this file, edit the corresponding .md file and run:
# gh aw compile # gh aw compile
@ -49,7 +49,7 @@ jobs:
comment_repo: "" comment_repo: ""
steps: steps:
- name: Setup Scripts - name: Setup Scripts
uses: githubnext/gh-aw/actions/setup@v0.37.15 uses: githubnext/gh-aw/actions/setup@v0.37.19
with: with:
destination: /opt/gh-aw/actions destination: /opt/gh-aw/actions
- name: Check workflow file timestamps - name: Check workflow file timestamps
@ -84,7 +84,7 @@ jobs:
secret_verification_result: ${{ steps.validate-secret.outputs.verification_result }} secret_verification_result: ${{ steps.validate-secret.outputs.verification_result }}
steps: steps:
- name: Setup Scripts - name: Setup Scripts
uses: githubnext/gh-aw/actions/setup@v0.37.15 uses: githubnext/gh-aw/actions/setup@v0.37.19
with: with:
destination: /opt/gh-aw/actions destination: /opt/gh-aw/actions
- name: Create gh-aw temp directory - name: Create gh-aw temp directory
@ -147,7 +147,7 @@ jobs:
const determineAutomaticLockdown = require('/opt/gh-aw/actions/determine_automatic_lockdown.cjs'); const determineAutomaticLockdown = require('/opt/gh-aw/actions/determine_automatic_lockdown.cjs');
await determineAutomaticLockdown(github, context, core); await determineAutomaticLockdown(github, context, core);
- name: Download container images - name: Download container images
run: bash /opt/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.29.0 ghcr.io/githubnext/gh-aw-mcpg:v0.0.76 node:lts-alpine run: bash /opt/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.29.0 ghcr.io/githubnext/gh-aw-mcpg:v0.0.78 node:lts-alpine
- name: Write Safe Outputs Config - name: Write Safe Outputs Config
run: | run: |
mkdir -p /opt/gh-aw/safeoutputs mkdir -p /opt/gh-aw/safeoutputs
@ -412,7 +412,7 @@ jobs:
# Register API key as secret to mask it from logs # Register API key as secret to mask it from logs
echo "::add-mask::${MCP_GATEWAY_API_KEY}" echo "::add-mask::${MCP_GATEWAY_API_KEY}"
export GH_AW_ENGINE="copilot" export GH_AW_ENGINE="copilot"
export MCP_GATEWAY_DOCKER_COMMAND='docker run -i --rm --network host -v /var/run/docker.sock:/var/run/docker.sock -e MCP_GATEWAY_PORT -e MCP_GATEWAY_DOMAIN -e MCP_GATEWAY_API_KEY -e DEBUG="*" -e MCP_GATEWAY_LOG_DIR -e GH_AW_MCP_LOG_DIR -e GH_AW_SAFE_OUTPUTS -e GH_AW_SAFE_OUTPUTS_CONFIG_PATH -e GH_AW_SAFE_OUTPUTS_TOOLS_PATH -e GH_AW_ASSETS_BRANCH -e GH_AW_ASSETS_MAX_SIZE_KB -e GH_AW_ASSETS_ALLOWED_EXTS -e DEFAULT_BRANCH -e GITHUB_MCP_SERVER_TOKEN -e GITHUB_MCP_LOCKDOWN -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e GITHUB_SHA -e GITHUB_WORKSPACE -e GITHUB_TOKEN -e GITHUB_RUN_ID -e GITHUB_RUN_NUMBER -e GITHUB_RUN_ATTEMPT -e GITHUB_JOB -e GITHUB_ACTION -e GITHUB_EVENT_NAME -e GITHUB_EVENT_PATH -e GITHUB_ACTOR -e GITHUB_ACTOR_ID -e GITHUB_TRIGGERING_ACTOR -e GITHUB_WORKFLOW -e GITHUB_WORKFLOW_REF -e GITHUB_WORKFLOW_SHA -e GITHUB_REF -e GITHUB_REF_NAME -e GITHUB_REF_TYPE -e GITHUB_HEAD_REF -e GITHUB_BASE_REF -e GH_AW_SAFE_OUTPUTS_PORT -e GH_AW_SAFE_OUTPUTS_API_KEY -v /opt:/opt:ro -v /tmp:/tmp:rw -v '"${GITHUB_WORKSPACE}"':'"${GITHUB_WORKSPACE}"':rw ghcr.io/githubnext/gh-aw-mcpg:v0.0.76' export MCP_GATEWAY_DOCKER_COMMAND='docker run -i --rm --network host -v /var/run/docker.sock:/var/run/docker.sock -e MCP_GATEWAY_PORT -e MCP_GATEWAY_DOMAIN -e MCP_GATEWAY_API_KEY -e DEBUG="*" -e MCP_GATEWAY_LOG_DIR -e GH_AW_MCP_LOG_DIR -e GH_AW_SAFE_OUTPUTS -e GH_AW_SAFE_OUTPUTS_CONFIG_PATH -e GH_AW_SAFE_OUTPUTS_TOOLS_PATH -e GH_AW_ASSETS_BRANCH -e GH_AW_ASSETS_MAX_SIZE_KB -e GH_AW_ASSETS_ALLOWED_EXTS -e DEFAULT_BRANCH -e GITHUB_MCP_SERVER_TOKEN -e GITHUB_MCP_LOCKDOWN -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e GITHUB_SHA -e GITHUB_WORKSPACE -e GITHUB_TOKEN -e GITHUB_RUN_ID -e GITHUB_RUN_NUMBER -e GITHUB_RUN_ATTEMPT -e GITHUB_JOB -e GITHUB_ACTION -e GITHUB_EVENT_NAME -e GITHUB_EVENT_PATH -e GITHUB_ACTOR -e GITHUB_ACTOR_ID -e GITHUB_TRIGGERING_ACTOR -e GITHUB_WORKFLOW -e GITHUB_WORKFLOW_REF -e GITHUB_WORKFLOW_SHA -e GITHUB_REF -e GITHUB_REF_NAME -e GITHUB_REF_TYPE -e GITHUB_HEAD_REF -e GITHUB_BASE_REF -e GH_AW_SAFE_OUTPUTS_PORT -e GH_AW_SAFE_OUTPUTS_API_KEY -v /opt:/opt:ro -v /tmp:/tmp:rw -v '"${GITHUB_WORKSPACE}"':'"${GITHUB_WORKSPACE}"':rw ghcr.io/githubnext/gh-aw-mcpg:v0.0.78'
mkdir -p /home/runner/.copilot mkdir -p /home/runner/.copilot
cat << MCPCONFIG_EOF | bash /opt/gh-aw/actions/start_mcp_gateway.sh cat << MCPCONFIG_EOF | bash /opt/gh-aw/actions/start_mcp_gateway.sh
@ -456,7 +456,7 @@ jobs:
model: process.env.GH_AW_MODEL_AGENT_COPILOT || "", model: process.env.GH_AW_MODEL_AGENT_COPILOT || "",
version: "", version: "",
agent_version: "0.0.389", agent_version: "0.0.389",
cli_version: "v0.37.15", cli_version: "v0.37.19",
workflow_name: "Soundness Bug Detector", workflow_name: "Soundness Bug Detector",
experimental: false, experimental: false,
supports_tools_allowlist: true, supports_tools_allowlist: true,
@ -470,11 +470,10 @@ jobs:
actor: context.actor, actor: context.actor,
event_name: context.eventName, event_name: context.eventName,
staged: false, staged: false,
network_mode: "defaults", allowed_domains: ["defaults"],
allowed_domains: [],
firewall_enabled: true, firewall_enabled: true,
awf_version: "v0.10.0", awf_version: "v0.10.0",
awmg_version: "v0.0.76", awmg_version: "v0.0.78",
steps: { steps: {
firewall: "squid" firewall: "squid"
}, },
@ -639,7 +638,7 @@ jobs:
timeout-minutes: 30 timeout-minutes: 30
run: | run: |
set -o pipefail set -o pipefail
sudo -E awf --env-all --container-workdir "${GITHUB_WORKSPACE}" --mount /tmp:/tmp:rw --mount "${GITHUB_WORKSPACE}:${GITHUB_WORKSPACE}:rw" --mount /usr/bin/date:/usr/bin/date:ro --mount /usr/bin/gh:/usr/bin/gh:ro --mount /usr/bin/yq:/usr/bin/yq:ro --mount /usr/local/bin/copilot:/usr/local/bin/copilot:ro --mount /home/runner/.copilot:/home/runner/.copilot:rw --mount /opt/gh-aw:/opt/gh-aw:ro --allow-domains api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,github.com,host.docker.internal,raw.githubusercontent.com,registry.npmjs.org --log-level info --proxy-logs-dir /tmp/gh-aw/sandbox/firewall/logs --enable-host-access --image-tag 0.10.0 \ sudo -E awf --env-all --container-workdir "${GITHUB_WORKSPACE}" --mount /tmp:/tmp:rw --mount "${GITHUB_WORKSPACE}:${GITHUB_WORKSPACE}:rw" --mount /usr/bin/date:/usr/bin/date:ro --mount /usr/bin/gh:/usr/bin/gh:ro --mount /usr/bin/yq:/usr/bin/yq:ro --mount /usr/local/bin/copilot:/usr/local/bin/copilot:ro --mount /home/runner/.copilot:/home/runner/.copilot:rw --mount /opt/gh-aw:/opt/gh-aw:ro --allow-domains api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,github.com,host.docker.internal,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,ppa.launchpad.net,raw.githubusercontent.com,registry.npmjs.org,s.symcb.com,s.symcd.com,security.ubuntu.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com --log-level info --proxy-logs-dir /tmp/gh-aw/sandbox/firewall/logs --enable-host-access --image-tag 0.10.0 \
-- /usr/local/bin/copilot --add-dir /tmp/gh-aw/ --log-level all --log-dir /tmp/gh-aw/sandbox/agent/logs/ --add-dir "${GITHUB_WORKSPACE}" --disable-builtin-mcps --allow-all-tools --add-dir /tmp/gh-aw/cache-memory/ --allow-all-paths --share /tmp/gh-aw/sandbox/agent/logs/conversation.md --prompt "$(cat /tmp/gh-aw/aw-prompts/prompt.txt)"${GH_AW_MODEL_AGENT_COPILOT:+ --model "$GH_AW_MODEL_AGENT_COPILOT"} \ -- /usr/local/bin/copilot --add-dir /tmp/gh-aw/ --log-level all --log-dir /tmp/gh-aw/sandbox/agent/logs/ --add-dir "${GITHUB_WORKSPACE}" --disable-builtin-mcps --allow-all-tools --add-dir /tmp/gh-aw/cache-memory/ --allow-all-paths --share /tmp/gh-aw/sandbox/agent/logs/conversation.md --prompt "$(cat /tmp/gh-aw/aw-prompts/prompt.txt)"${GH_AW_MODEL_AGENT_COPILOT:+ --model "$GH_AW_MODEL_AGENT_COPILOT"} \
2>&1 | tee /tmp/gh-aw/agent-stdio.log 2>&1 | tee /tmp/gh-aw/agent-stdio.log
env: env:
@ -707,7 +706,7 @@ jobs:
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
env: env:
GH_AW_SAFE_OUTPUTS: ${{ env.GH_AW_SAFE_OUTPUTS }} GH_AW_SAFE_OUTPUTS: ${{ env.GH_AW_SAFE_OUTPUTS }}
GH_AW_ALLOWED_DOMAINS: "api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,github.com,host.docker.internal,raw.githubusercontent.com,registry.npmjs.org" GH_AW_ALLOWED_DOMAINS: "api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,github.com,host.docker.internal,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,ppa.launchpad.net,raw.githubusercontent.com,registry.npmjs.org,s.symcb.com,s.symcd.com,security.ubuntu.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com"
GITHUB_SERVER_URL: ${{ github.server_url }} GITHUB_SERVER_URL: ${{ github.server_url }}
GITHUB_API_URL: ${{ github.api_url }} GITHUB_API_URL: ${{ github.api_url }}
with: with:
@ -801,7 +800,7 @@ jobs:
total_count: ${{ steps.missing_tool.outputs.total_count }} total_count: ${{ steps.missing_tool.outputs.total_count }}
steps: steps:
- name: Setup Scripts - name: Setup Scripts
uses: githubnext/gh-aw/actions/setup@v0.37.15 uses: githubnext/gh-aw/actions/setup@v0.37.19
with: with:
destination: /opt/gh-aw/actions destination: /opt/gh-aw/actions
- name: Debug job inputs - name: Debug job inputs
@ -817,7 +816,7 @@ jobs:
echo "Agent Conclusion: $AGENT_CONCLUSION" echo "Agent Conclusion: $AGENT_CONCLUSION"
- name: Download agent output artifact - name: Download agent output artifact
continue-on-error: true continue-on-error: true
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0 uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
with: with:
name: agent-output name: agent-output
path: /tmp/gh-aw/safeoutputs/ path: /tmp/gh-aw/safeoutputs/
@ -900,18 +899,18 @@ jobs:
success: ${{ steps.parse_results.outputs.success }} success: ${{ steps.parse_results.outputs.success }}
steps: steps:
- name: Setup Scripts - name: Setup Scripts
uses: githubnext/gh-aw/actions/setup@v0.37.15 uses: githubnext/gh-aw/actions/setup@v0.37.19
with: with:
destination: /opt/gh-aw/actions destination: /opt/gh-aw/actions
- name: Download agent artifacts - name: Download agent artifacts
continue-on-error: true continue-on-error: true
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0 uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
with: with:
name: agent-artifacts name: agent-artifacts
path: /tmp/gh-aw/threat-detection/ path: /tmp/gh-aw/threat-detection/
- name: Download agent output artifact - name: Download agent output artifact
continue-on-error: true continue-on-error: true
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0 uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
with: with:
name: agent-output name: agent-output
path: /tmp/gh-aw/threat-detection/ path: /tmp/gh-aw/threat-detection/
@ -1052,12 +1051,12 @@ jobs:
process_safe_outputs_temporary_id_map: ${{ steps.process_safe_outputs.outputs.temporary_id_map }} process_safe_outputs_temporary_id_map: ${{ steps.process_safe_outputs.outputs.temporary_id_map }}
steps: steps:
- name: Setup Scripts - name: Setup Scripts
uses: githubnext/gh-aw/actions/setup@v0.37.15 uses: githubnext/gh-aw/actions/setup@v0.37.19
with: with:
destination: /opt/gh-aw/actions destination: /opt/gh-aw/actions
- name: Download agent output artifact - name: Download agent output artifact
continue-on-error: true continue-on-error: true
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0 uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
with: with:
name: agent-output name: agent-output
path: /tmp/gh-aw/safeoutputs/ path: /tmp/gh-aw/safeoutputs/
@ -1089,11 +1088,11 @@ jobs:
permissions: {} permissions: {}
steps: steps:
- name: Setup Scripts - name: Setup Scripts
uses: githubnext/gh-aw/actions/setup@v0.37.15 uses: githubnext/gh-aw/actions/setup@v0.37.19
with: with:
destination: /opt/gh-aw/actions destination: /opt/gh-aw/actions
- name: Download cache-memory artifact (default) - name: Download cache-memory artifact (default)
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0 uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
continue-on-error: true continue-on-error: true
with: with:
name: cache-memory name: cache-memory

39
.github/workflows/workflow-suggestion-agent.lock.yml generated vendored
View file

@ -13,7 +13,7 @@
# \ /\ / (_) | | | | ( | | | | (_) \ V V /\__ \ # \ /\ / (_) | | | | ( | | | | (_) \ V V /\__ \
# \/ \/ \___/|_| |_|\_\|_| |_|\___/ \_/\_/ |___/ # \/ \/ \___/|_| |_|\_\|_| |_|\___/ \_/\_/ |___/
# #
# This file was automatically generated by gh-aw (v0.37.15). DO NOT EDIT. # This file was automatically generated by gh-aw (v0.37.19). DO NOT EDIT.
# #
# To update this file, edit the corresponding .md file and run: # To update this file, edit the corresponding .md file and run:
# gh aw compile # gh aw compile
@ -45,7 +45,7 @@ jobs:
comment_repo: "" comment_repo: ""
steps: steps:
- name: Setup Scripts - name: Setup Scripts
uses: githubnext/gh-aw/actions/setup@v0.37.15 uses: githubnext/gh-aw/actions/setup@v0.37.19
with: with:
destination: /opt/gh-aw/actions destination: /opt/gh-aw/actions
- name: Check workflow file timestamps - name: Check workflow file timestamps
@ -82,7 +82,7 @@ jobs:
secret_verification_result: ${{ steps.validate-secret.outputs.verification_result }} secret_verification_result: ${{ steps.validate-secret.outputs.verification_result }}
steps: steps:
- name: Setup Scripts - name: Setup Scripts
uses: githubnext/gh-aw/actions/setup@v0.37.15 uses: githubnext/gh-aw/actions/setup@v0.37.19
with: with:
destination: /opt/gh-aw/actions destination: /opt/gh-aw/actions
- name: Create gh-aw temp directory - name: Create gh-aw temp directory
@ -145,7 +145,7 @@ jobs:
const determineAutomaticLockdown = require('/opt/gh-aw/actions/determine_automatic_lockdown.cjs'); const determineAutomaticLockdown = require('/opt/gh-aw/actions/determine_automatic_lockdown.cjs');
await determineAutomaticLockdown(github, context, core); await determineAutomaticLockdown(github, context, core);
- name: Download container images - name: Download container images
run: bash /opt/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.29.0 ghcr.io/githubnext/gh-aw-mcpg:v0.0.76 node:lts-alpine run: bash /opt/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.29.0 ghcr.io/githubnext/gh-aw-mcpg:v0.0.78 node:lts-alpine
- name: Write Safe Outputs Config - name: Write Safe Outputs Config
run: | run: |
mkdir -p /opt/gh-aw/safeoutputs mkdir -p /opt/gh-aw/safeoutputs
@ -375,7 +375,7 @@ jobs:
# Register API key as secret to mask it from logs # Register API key as secret to mask it from logs
echo "::add-mask::${MCP_GATEWAY_API_KEY}" echo "::add-mask::${MCP_GATEWAY_API_KEY}"
export GH_AW_ENGINE="copilot" export GH_AW_ENGINE="copilot"
export MCP_GATEWAY_DOCKER_COMMAND='docker run -i --rm --network host -v /var/run/docker.sock:/var/run/docker.sock -e MCP_GATEWAY_PORT -e MCP_GATEWAY_DOMAIN -e MCP_GATEWAY_API_KEY -e DEBUG="*" -e MCP_GATEWAY_LOG_DIR -e GH_AW_MCP_LOG_DIR -e GH_AW_SAFE_OUTPUTS -e GH_AW_SAFE_OUTPUTS_CONFIG_PATH -e GH_AW_SAFE_OUTPUTS_TOOLS_PATH -e GH_AW_ASSETS_BRANCH -e GH_AW_ASSETS_MAX_SIZE_KB -e GH_AW_ASSETS_ALLOWED_EXTS -e DEFAULT_BRANCH -e GITHUB_MCP_SERVER_TOKEN -e GITHUB_MCP_LOCKDOWN -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e GITHUB_SHA -e GITHUB_WORKSPACE -e GITHUB_TOKEN -e GITHUB_RUN_ID -e GITHUB_RUN_NUMBER -e GITHUB_RUN_ATTEMPT -e GITHUB_JOB -e GITHUB_ACTION -e GITHUB_EVENT_NAME -e GITHUB_EVENT_PATH -e GITHUB_ACTOR -e GITHUB_ACTOR_ID -e GITHUB_TRIGGERING_ACTOR -e GITHUB_WORKFLOW -e GITHUB_WORKFLOW_REF -e GITHUB_WORKFLOW_SHA -e GITHUB_REF -e GITHUB_REF_NAME -e GITHUB_REF_TYPE -e GITHUB_HEAD_REF -e GITHUB_BASE_REF -e GH_AW_SAFE_OUTPUTS_PORT -e GH_AW_SAFE_OUTPUTS_API_KEY -v /opt:/opt:ro -v /tmp:/tmp:rw -v '"${GITHUB_WORKSPACE}"':'"${GITHUB_WORKSPACE}"':rw ghcr.io/githubnext/gh-aw-mcpg:v0.0.76' export MCP_GATEWAY_DOCKER_COMMAND='docker run -i --rm --network host -v /var/run/docker.sock:/var/run/docker.sock -e MCP_GATEWAY_PORT -e MCP_GATEWAY_DOMAIN -e MCP_GATEWAY_API_KEY -e DEBUG="*" -e MCP_GATEWAY_LOG_DIR -e GH_AW_MCP_LOG_DIR -e GH_AW_SAFE_OUTPUTS -e GH_AW_SAFE_OUTPUTS_CONFIG_PATH -e GH_AW_SAFE_OUTPUTS_TOOLS_PATH -e GH_AW_ASSETS_BRANCH -e GH_AW_ASSETS_MAX_SIZE_KB -e GH_AW_ASSETS_ALLOWED_EXTS -e DEFAULT_BRANCH -e GITHUB_MCP_SERVER_TOKEN -e GITHUB_MCP_LOCKDOWN -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e GITHUB_SHA -e GITHUB_WORKSPACE -e GITHUB_TOKEN -e GITHUB_RUN_ID -e GITHUB_RUN_NUMBER -e GITHUB_RUN_ATTEMPT -e GITHUB_JOB -e GITHUB_ACTION -e GITHUB_EVENT_NAME -e GITHUB_EVENT_PATH -e GITHUB_ACTOR -e GITHUB_ACTOR_ID -e GITHUB_TRIGGERING_ACTOR -e GITHUB_WORKFLOW -e GITHUB_WORKFLOW_REF -e GITHUB_WORKFLOW_SHA -e GITHUB_REF -e GITHUB_REF_NAME -e GITHUB_REF_TYPE -e GITHUB_HEAD_REF -e GITHUB_BASE_REF -e GH_AW_SAFE_OUTPUTS_PORT -e GH_AW_SAFE_OUTPUTS_API_KEY -v /opt:/opt:ro -v /tmp:/tmp:rw -v '"${GITHUB_WORKSPACE}"':'"${GITHUB_WORKSPACE}"':rw ghcr.io/githubnext/gh-aw-mcpg:v0.0.78'
mkdir -p /home/runner/.copilot mkdir -p /home/runner/.copilot
cat << MCPCONFIG_EOF | bash /opt/gh-aw/actions/start_mcp_gateway.sh cat << MCPCONFIG_EOF | bash /opt/gh-aw/actions/start_mcp_gateway.sh
@ -427,7 +427,7 @@ jobs:
model: process.env.GH_AW_MODEL_AGENT_COPILOT || "", model: process.env.GH_AW_MODEL_AGENT_COPILOT || "",
version: "", version: "",
agent_version: "0.0.389", agent_version: "0.0.389",
cli_version: "v0.37.15", cli_version: "v0.37.19",
workflow_name: "Workflow Suggestion Agent", workflow_name: "Workflow Suggestion Agent",
experimental: false, experimental: false,
supports_tools_allowlist: true, supports_tools_allowlist: true,
@ -441,11 +441,10 @@ jobs:
actor: context.actor, actor: context.actor,
event_name: context.eventName, event_name: context.eventName,
staged: false, staged: false,
network_mode: "defaults", allowed_domains: ["defaults"],
allowed_domains: [],
firewall_enabled: true, firewall_enabled: true,
awf_version: "v0.10.0", awf_version: "v0.10.0",
awmg_version: "v0.0.76", awmg_version: "v0.0.78",
steps: { steps: {
firewall: "squid" firewall: "squid"
}, },
@ -961,7 +960,7 @@ jobs:
timeout-minutes: 30 timeout-minutes: 30
run: | run: |
set -o pipefail set -o pipefail
sudo -E awf --env-all --container-workdir "${GITHUB_WORKSPACE}" --mount /tmp:/tmp:rw --mount "${GITHUB_WORKSPACE}:${GITHUB_WORKSPACE}:rw" --mount /usr/bin/date:/usr/bin/date:ro --mount /usr/bin/gh:/usr/bin/gh:ro --mount /usr/bin/yq:/usr/bin/yq:ro --mount /usr/local/bin/copilot:/usr/local/bin/copilot:ro --mount /home/runner/.copilot:/home/runner/.copilot:rw --mount /opt/gh-aw:/opt/gh-aw:ro --allow-domains api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,github.com,host.docker.internal,raw.githubusercontent.com,registry.npmjs.org --log-level info --proxy-logs-dir /tmp/gh-aw/sandbox/firewall/logs --enable-host-access --image-tag 0.10.0 \ sudo -E awf --env-all --container-workdir "${GITHUB_WORKSPACE}" --mount /tmp:/tmp:rw --mount "${GITHUB_WORKSPACE}:${GITHUB_WORKSPACE}:rw" --mount /usr/bin/date:/usr/bin/date:ro --mount /usr/bin/gh:/usr/bin/gh:ro --mount /usr/bin/yq:/usr/bin/yq:ro --mount /usr/local/bin/copilot:/usr/local/bin/copilot:ro --mount /home/runner/.copilot:/home/runner/.copilot:rw --mount /opt/gh-aw:/opt/gh-aw:ro --allow-domains api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,github.com,host.docker.internal,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,ppa.launchpad.net,raw.githubusercontent.com,registry.npmjs.org,s.symcb.com,s.symcd.com,security.ubuntu.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com --log-level info --proxy-logs-dir /tmp/gh-aw/sandbox/firewall/logs --enable-host-access --image-tag 0.10.0 \
-- /usr/local/bin/copilot --add-dir /tmp/gh-aw/ --log-level all --log-dir /tmp/gh-aw/sandbox/agent/logs/ --add-dir "${GITHUB_WORKSPACE}" --disable-builtin-mcps --allow-all-tools --add-dir /tmp/gh-aw/cache-memory/ --allow-all-paths --share /tmp/gh-aw/sandbox/agent/logs/conversation.md --prompt "$(cat /tmp/gh-aw/aw-prompts/prompt.txt)"${GH_AW_MODEL_AGENT_COPILOT:+ --model "$GH_AW_MODEL_AGENT_COPILOT"} \ -- /usr/local/bin/copilot --add-dir /tmp/gh-aw/ --log-level all --log-dir /tmp/gh-aw/sandbox/agent/logs/ --add-dir "${GITHUB_WORKSPACE}" --disable-builtin-mcps --allow-all-tools --add-dir /tmp/gh-aw/cache-memory/ --allow-all-paths --share /tmp/gh-aw/sandbox/agent/logs/conversation.md --prompt "$(cat /tmp/gh-aw/aw-prompts/prompt.txt)"${GH_AW_MODEL_AGENT_COPILOT:+ --model "$GH_AW_MODEL_AGENT_COPILOT"} \
2>&1 | tee /tmp/gh-aw/agent-stdio.log 2>&1 | tee /tmp/gh-aw/agent-stdio.log
env: env:
@ -1029,7 +1028,7 @@ jobs:
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
env: env:
GH_AW_SAFE_OUTPUTS: ${{ env.GH_AW_SAFE_OUTPUTS }} GH_AW_SAFE_OUTPUTS: ${{ env.GH_AW_SAFE_OUTPUTS }}
GH_AW_ALLOWED_DOMAINS: "api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,github.com,host.docker.internal,raw.githubusercontent.com,registry.npmjs.org" GH_AW_ALLOWED_DOMAINS: "api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,github.com,host.docker.internal,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,ppa.launchpad.net,raw.githubusercontent.com,registry.npmjs.org,s.symcb.com,s.symcd.com,security.ubuntu.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com"
GITHUB_SERVER_URL: ${{ github.server_url }} GITHUB_SERVER_URL: ${{ github.server_url }}
GITHUB_API_URL: ${{ github.api_url }} GITHUB_API_URL: ${{ github.api_url }}
with: with:
@ -1123,7 +1122,7 @@ jobs:
total_count: ${{ steps.missing_tool.outputs.total_count }} total_count: ${{ steps.missing_tool.outputs.total_count }}
steps: steps:
- name: Setup Scripts - name: Setup Scripts
uses: githubnext/gh-aw/actions/setup@v0.37.15 uses: githubnext/gh-aw/actions/setup@v0.37.19
with: with:
destination: /opt/gh-aw/actions destination: /opt/gh-aw/actions
- name: Debug job inputs - name: Debug job inputs
@ -1139,7 +1138,7 @@ jobs:
echo "Agent Conclusion: $AGENT_CONCLUSION" echo "Agent Conclusion: $AGENT_CONCLUSION"
- name: Download agent output artifact - name: Download agent output artifact
continue-on-error: true continue-on-error: true
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0 uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
with: with:
name: agent-output name: agent-output
path: /tmp/gh-aw/safeoutputs/ path: /tmp/gh-aw/safeoutputs/
@ -1222,18 +1221,18 @@ jobs:
success: ${{ steps.parse_results.outputs.success }} success: ${{ steps.parse_results.outputs.success }}
steps: steps:
- name: Setup Scripts - name: Setup Scripts
uses: githubnext/gh-aw/actions/setup@v0.37.15 uses: githubnext/gh-aw/actions/setup@v0.37.19
with: with:
destination: /opt/gh-aw/actions destination: /opt/gh-aw/actions
- name: Download agent artifacts - name: Download agent artifacts
continue-on-error: true continue-on-error: true
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0 uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
with: with:
name: agent-artifacts name: agent-artifacts
path: /tmp/gh-aw/threat-detection/ path: /tmp/gh-aw/threat-detection/
- name: Download agent output artifact - name: Download agent output artifact
continue-on-error: true continue-on-error: true
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0 uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
with: with:
name: agent-output name: agent-output
path: /tmp/gh-aw/threat-detection/ path: /tmp/gh-aw/threat-detection/
@ -1372,12 +1371,12 @@ jobs:
process_safe_outputs_temporary_id_map: ${{ steps.process_safe_outputs.outputs.temporary_id_map }} process_safe_outputs_temporary_id_map: ${{ steps.process_safe_outputs.outputs.temporary_id_map }}
steps: steps:
- name: Setup Scripts - name: Setup Scripts
uses: githubnext/gh-aw/actions/setup@v0.37.15 uses: githubnext/gh-aw/actions/setup@v0.37.19
with: with:
destination: /opt/gh-aw/actions destination: /opt/gh-aw/actions
- name: Download agent output artifact - name: Download agent output artifact
continue-on-error: true continue-on-error: true
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0 uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
with: with:
name: agent-output name: agent-output
path: /tmp/gh-aw/safeoutputs/ path: /tmp/gh-aw/safeoutputs/
@ -1409,11 +1408,11 @@ jobs:
permissions: {} permissions: {}
steps: steps:
- name: Setup Scripts - name: Setup Scripts
uses: githubnext/gh-aw/actions/setup@v0.37.15 uses: githubnext/gh-aw/actions/setup@v0.37.19
with: with:
destination: /opt/gh-aw/actions destination: /opt/gh-aw/actions
- name: Download cache-memory artifact (default) - name: Download cache-memory artifact (default)
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0 uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
continue-on-error: true continue-on-error: true
with: with:
name: cache-memory name: cache-memory