eslint-plugin-primer-react 9.2.0-rc.a61b1e1 → 9.2.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (7) hide show
  1. package/.gitattributes +1 -0
  2. package/.github/aw/actions-lock.json +14 -0
  3. package/.github/workflows/agentics-maintenance.yml +633 -0
  4. package/.github/workflows/issue-triage.lock.yml +1759 -0
  5. package/.github/workflows/issue-triage.md +69 -0
  6. package/.prettierignore +4 -0
  7. package/package.json +1 -1
package/.github/workflows/issue-triage.lock.yml ADDED
@@ -0,0 +1,1759 @@
1
+ # gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"aa7ed08f2b119a2921bc9f034f4de92e27daeb5738cb9edc86106e85fd5a589e","body_hash":"c5c89d60d066952752d9d6222fb60e1ca20932dba10dfd2b7cf91b2a7f6b581d","compiler_version":"v0.83.1","strict":true,"agent_id":"copilot","engine_versions":{"copilot":"1.0.73"}}
2
+ # gh-aw-manifest: {"version":1,"secrets":["COPILOT_GITHUB_TOKEN","GH_AW_AGENT_TOKEN","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/cache/restore","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/cache/save","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/checkout","sha":"9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0","version":"v7.0.0"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"820762786026740c76f36085b0efc47a31fe5020","version":"v7.0.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"},{"repo":"github/gh-aw-actions/setup","sha":"8bdba8075360648fe6802302a5b4e016361dc6ac","version":"v0.83.1"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.27.38","digest":"sha256:cb928eb62d9139a013c2d278dab19af232d35a2d83dca71a3d98eb431f786243","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.27.38@sha256:cb928eb62d9139a013c2d278dab19af232d35a2d83dca71a3d98eb431f786243"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.38","digest":"sha256:cd6145620d96acee46e1ede25180a13aa36002467e663db0caa453a8bc8eb60c","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.38@sha256:cd6145620d96acee46e1ede25180a13aa36002467e663db0caa453a8bc8eb60c"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.27.38","digest":"sha256:6c19094d95aad5f9f128ad5e583f0f2b894b158aa66c3b86dd9bcc90970a2917","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.27.38@sha256:6c19094d95aad5f9f128ad5e583f0f2b894b158aa66c3b86dd9bcc90970a2917"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.4.3","digest":"sha256:3c744710ea275cd5ee65db92a1099e0d980754bd9fafda9ce67704c67004dc83","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.4.3@sha256:3c744710ea275cd5ee65db92a1099e0d980754bd9fafda9ce67704c67004dc83"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b","pinned_image":"ghcr.io/github/gh-aw-node@sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b"},{"image":"ghcr.io/github/github-mcp-server:v1.6.0","digest":"sha256:2b0c48b070f61e9d3969269ead600f62d00fb237b60ac849ef3d166ee7de9ad3","pinned_image":"ghcr.io/github/github-mcp-server:v1.6.0@sha256:2b0c48b070f61e9d3969269ead600f62d00fb237b60ac849ef3d166ee7de9ad3"}]}
3
+ # This file was automatically generated by gh-aw (v0.83.1). DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md
4
+ #
5
+ # ___ _ _
6
+ # / _ \ | | (_)
7
+ # | |_| | __ _ ___ _ __ | |_ _ ___
8
+ # | _ |/ _` |/ _ \ '_ \| __| |/ __|
9
+ # | | | | (_| | __/ | | | |_| | (__
10
+ # \_| |_/\__, |\___|_| |_|\__|_|\___|
11
+ # __/ |
12
+ # _ _ |___/
13
+ # | | | | / _| |
14
+ # | | | | ___ _ __ _ __| |_| | _____ ____
15
+ # | |/\| |/ _ \ '__| |/ /| _| |/ _ \ \ /\ / / ___|
16
+ # \ /\ / (_) | | | | ( | | | | (_) \ V V /\__ \
17
+ # \/ \/ \___/|_| |_|\_\|_| |_|\___/ \_/\_/ |___/
18
+ #
19
+ #
20
+ # To update this file, edit the corresponding .md file and run:
21
+ # gh aw compile
22
+ # Not all edits will cause changes to this file.
23
+ #
24
+ # For more information: https://github.github.com/gh-aw/introduction/overview/
25
+ #
26
+ # Triage assistant for new and reopened issues in eslint-plugin-primer-react.
27
+ # Reads the issue and its comments to classify the issue type when unset, apply
28
+ # relevant existing labels, flag likely duplicates, ask for missing information
29
+ # only when needed, and — when an issue is well-scoped and actionable — suggest
30
+ # assigning it to Copilot. Stays low-noise and never closes issues.
31
+ #
32
+ # Secrets used:
33
+ # - COPILOT_GITHUB_TOKEN
34
+ # - GH_AW_AGENT_TOKEN
35
+ # - GH_AW_GITHUB_MCP_SERVER_TOKEN
36
+ # - GH_AW_GITHUB_TOKEN
37
+ # - GITHUB_TOKEN
38
+ #
39
+ # Custom actions used:
40
+ # - actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
41
+ # - actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
42
+ # - actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
43
+ # - actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
44
+ # - actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
45
+ # - actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 (source v9)
46
+ # - actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
47
+ # - actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
48
+ # - github/gh-aw-actions/setup@8bdba8075360648fe6802302a5b4e016361dc6ac # v0.83.1
49
+ #
50
+ # Container images used:
51
+ # - ghcr.io/github/gh-aw-firewall/agent:0.27.38@sha256:cb928eb62d9139a013c2d278dab19af232d35a2d83dca71a3d98eb431f786243
52
+ # - ghcr.io/github/gh-aw-firewall/api-proxy:0.27.38@sha256:cd6145620d96acee46e1ede25180a13aa36002467e663db0caa453a8bc8eb60c
53
+ # - ghcr.io/github/gh-aw-firewall/squid:0.27.38@sha256:6c19094d95aad5f9f128ad5e583f0f2b894b158aa66c3b86dd9bcc90970a2917
54
+ # - ghcr.io/github/gh-aw-mcpg:v0.4.3@sha256:3c744710ea275cd5ee65db92a1099e0d980754bd9fafda9ce67704c67004dc83
55
+ # - ghcr.io/github/gh-aw-node@sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b
56
+ # - ghcr.io/github/github-mcp-server:v1.6.0@sha256:2b0c48b070f61e9d3969269ead600f62d00fb237b60ac849ef3d166ee7de9ad3
57
+
58
+ name: "Issue triage"
59
+ on:
60
+ issues:
61
+ types:
62
+ - opened
63
+ - reopened
64
+
65
+ permissions: {}
66
+
67
+ concurrency:
68
+ group: "gh-aw-${{ github.workflow }}-${{ github.event.issue.number || github.run_id }}"
69
+
70
+ run-name: "Issue triage"
71
+
72
+ jobs:
73
+ activation:
74
+ needs: pre_activation
75
+ if: needs.pre_activation.outputs.activated == 'true'
76
+ runs-on: ubuntu-slim
77
+ permissions:
78
+ actions: read
79
+ contents: read
80
+ issues: write
81
+ env:
82
+ GH_AW_MAX_DAILY_AI_CREDITS: ${{ vars.GH_AW_DEFAULT_MAX_DAILY_AI_CREDITS || '5000' }}
83
+ GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }}
84
+ outputs:
85
+ body: ${{ steps.sanitized.outputs.body }}
86
+ comment_id: ""
87
+ comment_repo: ""
88
+ daily_ai_credits_exceeded: ${{ steps.daily-effective-workflow-guardrail.outputs.daily_ai_credits_exceeded == 'true' }}
89
+ daily_ai_credits_threshold: ${{ steps.daily-effective-workflow-guardrail.outputs.daily_ai_credits_threshold || '' }}
90
+ daily_ai_credits_total_effective_tokens: ${{ steps.daily-effective-workflow-guardrail.outputs.daily_ai_credits_total_effective_tokens || '' }}
91
+ engine_id: ${{ steps.generate_aw_info.outputs.engine_id }}
92
+ lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }}
93
+ model: ${{ steps.generate_aw_info.outputs.model }}
94
+ oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }}
95
+ secret_verification_result: ${{ steps.validate-secret.outputs.verification_result }}
96
+ setup-parent-span-id: ${{ steps.setup.outputs.parent-span-id || steps.setup.outputs.span-id }}
97
+ setup-span-id: ${{ steps.setup.outputs.span-id }}
98
+ setup-trace-id: ${{ steps.setup.outputs.trace-id }}
99
+ stale_lock_file_failed: ${{ steps.check-lock-file.outputs.stale_lock_file_failed == 'true' }}
100
+ text: ${{ steps.sanitized.outputs.text }}
101
+ title: ${{ steps.sanitized.outputs.title }}
102
+ steps:
103
+ - name: Setup Scripts
104
+ id: setup
105
+ uses: github/gh-aw-actions/setup@8bdba8075360648fe6802302a5b4e016361dc6ac # v0.83.1
106
+ with:
107
+ destination: ${{ runner.temp }}/gh-aw/actions
108
+ job-name: ${{ github.job }}
109
+ trace-id: ${{ needs.pre_activation.outputs.setup-trace-id }}
110
+ parent-span-id: ${{ needs.pre_activation.outputs.setup-parent-span-id || needs.pre_activation.outputs.setup-span-id }}
111
+ safe-output-artifact-client: ${{ env.GH_AW_MAX_DAILY_AI_CREDITS != '' }}
112
+ env:
113
+ GH_AW_SETUP_WORKFLOW_NAME: "Issue triage"
114
+ GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/issue-triage.lock.yml@${{ github.ref }}
115
+ GH_AW_INFO_VERSION: "1.0.73"
116
+ GH_AW_INFO_AWF_VERSION: "v0.27.38"
117
+ GH_AW_INFO_ENGINE_ID: "copilot"
118
+ - name: Generate agentic run info
119
+ id: generate_aw_info
120
+ env:
121
+ GH_AW_INFO_ENGINE_ID: "copilot"
122
+ GH_AW_INFO_ENGINE_NAME: "GitHub Copilot CLI"
123
+ GH_AW_INFO_MODEL: ${{ vars.GH_AW_MODEL_AGENT_COPILOT || vars.GH_AW_DEFAULT_MODEL_COPILOT || 'claude-sonnet-4.6' }}
124
+ GH_AW_INFO_VERSION: "1.0.73"
125
+ GH_AW_INFO_AGENT_VERSION: "1.0.73"
126
+ GH_AW_INFO_CLI_VERSION: "v0.83.1"
127
+ GH_AW_INFO_WORKFLOW_NAME: "Issue triage"
128
+ GH_AW_INFO_EXPERIMENTAL: "false"
129
+ GH_AW_INFO_SUPPORTS_TOOLS_ALLOWLIST: "true"
130
+ GH_AW_INFO_STAGED: "false"
131
+ GH_AW_INFO_ALLOWED_DOMAINS: '["defaults"]'
132
+ GH_AW_INFO_FIREWALL_ENABLED: "true"
133
+ GH_AW_INFO_AWF_VERSION: "v0.27.38"
134
+ GH_AW_INFO_AWMG_VERSION: ""
135
+ GH_AW_INFO_FIREWALL_TYPE: "squid"
136
+ GH_AW_COMPILED_STRICT: "true"
137
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
138
+ with:
139
+ script: |
140
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
141
+ setupGlobals(core, github, context, exec, io, getOctokit);
142
+ const { main } = require('${{ runner.temp }}/gh-aw/actions/generate_aw_info.cjs');
143
+ await main(core, context);
144
+ - name: Restore daily AIC usage cache
145
+ id: restore-daily-aic-cache
146
+ if: ${{ env.GH_AW_MAX_DAILY_AI_CREDITS != '' }}
147
+ continue-on-error: true
148
+ uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
149
+ with:
150
+ key: agentic-workflow-usage-issuetriage-${{ github.run_id }}
151
+ restore-keys: agentic-workflow-usage-issuetriage-
152
+ path: /tmp/gh-aw/agentic-workflow-usage-cache.jsonl
153
+ - name: Restore daily AIC usage cache (artifact fallback)
154
+ id: restore-daily-aic-cache-fallback
155
+ if: ${{ env.GH_AW_MAX_DAILY_AI_CREDITS != '' }}
156
+ continue-on-error: true
157
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
158
+ env:
159
+ GH_AW_RESTORE_DAILY_AIC_CACHE_HIT: ${{ steps.restore-daily-aic-cache.outputs.cache-hit }}
160
+ GH_AW_RESTORE_DAILY_AIC_CACHE_MATCHED_KEY: ${{ steps.restore-daily-aic-cache.outputs.cache-matched-key }}
161
+ with:
162
+ github-token: ${{ secrets.GITHUB_TOKEN }}
163
+ script: |
164
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
165
+ setupGlobals(core, github, context, exec, io, getOctokit);
166
+ const { main } = require('${{ runner.temp }}/gh-aw/actions/restore_aic_usage_cache_fallback.cjs');
167
+ await main();
168
+ - name: Check daily workflow token guardrail
169
+ id: daily-effective-workflow-guardrail
170
+ if: ${{ env.GH_AW_MAX_DAILY_AI_CREDITS != '' }}
171
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
172
+ env:
173
+ GH_AW_WORKFLOW_NAME: "Issue triage"
174
+ GH_AW_WORKFLOW_ID: "issue-triage"
175
+ GH_AW_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
176
+ GH_AW_WORKFLOW_DISPATCH_AW_CONTEXT: ${{ github.event.inputs.aw_context || '' }}
177
+ GH_AW_HAS_SLASH_COMMAND: "false"
178
+ GH_AW_HAS_LABEL_COMMAND: "false"
179
+ GH_AW_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
180
+ GH_AW_MAX_DAILY_AI_CREDITS: ${{ vars.GH_AW_DEFAULT_MAX_DAILY_AI_CREDITS || '5000' }}
181
+ with:
182
+ github-token: ${{ secrets.GITHUB_TOKEN }}
183
+ script: |
184
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
185
+ setupGlobals(core, github, context, exec, io, getOctokit);
186
+ const { main } = require('${{ runner.temp }}/gh-aw/actions/check_daily_aic_workflow_guardrail.cjs');
187
+ await main();
188
+ - name: Add eyes reaction for immediate feedback
189
+ id: react
190
+ if: github.event_name == 'issues' || github.event_name == 'issue_comment' || github.event_name == 'pull_request_review_comment' || github.event_name == 'discussion' || github.event_name == 'discussion_comment' || github.event_name == 'pull_request' && github.event.pull_request.head.repo.id == github.repository_id
191
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
192
+ env:
193
+ GH_AW_REACTION: "eyes"
194
+ with:
195
+ github-token: ${{ secrets.GITHUB_TOKEN }}
196
+ script: |
197
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
198
+ setupGlobals(core, github, context, exec, io, getOctokit);
199
+ const { main } = require('${{ runner.temp }}/gh-aw/actions/add_reaction.cjs');
200
+ await main();
201
+ - name: Validate COPILOT_GITHUB_TOKEN secret
202
+ id: validate-secret
203
+ run: bash "${RUNNER_TEMP}/gh-aw/actions/validate_multi_secret.sh" COPILOT_GITHUB_TOKEN 'GitHub Copilot CLI' https://github.github.com/gh-aw/reference/engines/#github-copilot-default
204
+ env:
205
+ COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
206
+ - name: Check for OAuth tokens
207
+ id: check-oauth-tokens
208
+ run: bash "${RUNNER_TEMP}/gh-aw/actions/check_oauth_tokens.sh"
209
+ env:
210
+ COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
211
+ GH_AW_GITHUB_TOKEN: ${{ secrets.GH_AW_GITHUB_TOKEN }}
212
+ GH_AW_GITHUB_MCP_SERVER_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN }}
213
+ - name: Checkout .github and .agents folders
214
+ uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
215
+ with:
216
+ persist-credentials: false
217
+ sparse-checkout: |
218
+ .github
219
+ .agents
220
+ .antigravity
221
+ .claude
222
+ .codex
223
+ .gemini
224
+ .opencode
225
+ .pi
226
+ sparse-checkout-cone-mode: true
227
+ fetch-depth: 1
228
+ - name: Save agent config folders for base branch restoration
229
+ env:
230
+ GH_AW_AGENT_FOLDERS: ".agents .antigravity .claude .codex .gemini .github .opencode .pi"
231
+ GH_AW_AGENT_FILES: "AGENTS.md ANTIGRAVITY.md CLAUDE.md GEMINI.md PI.md opencode.jsonc"
232
+ # poutine:ignore untrusted_checkout_exec
233
+ run: bash "${RUNNER_TEMP}/gh-aw/actions/save_base_github_folders.sh"
234
+ - name: Check workflow lock file
235
+ id: check-lock-file
236
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
237
+ env:
238
+ GH_AW_WORKFLOW_FILE: "issue-triage.lock.yml"
239
+ GH_AW_CONTEXT_WORKFLOW_REF: "${{ github.workflow_ref }}"
240
+ with:
241
+ script: |
242
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
243
+ setupGlobals(core, github, context, exec, io, getOctokit);
244
+ const { main } = require('${{ runner.temp }}/gh-aw/actions/check_workflow_timestamp_api.cjs');
245
+ await main();
246
+ - name: Check compile-agentic version
247
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
248
+ env:
249
+ GH_AW_COMPILED_VERSION: "v0.83.1"
250
+ with:
251
+ script: |
252
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
253
+ setupGlobals(core, github, context, exec, io, getOctokit);
254
+ const { main } = require('${{ runner.temp }}/gh-aw/actions/check_version_updates.cjs');
255
+ await main();
256
+ - name: Compute current body text
257
+ id: sanitized
258
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
259
+ env:
260
+ GH_AW_ALLOWED_DOMAINS: "api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,github.com,host.docker.internal,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,ppa.launchpad.net,raw.githubusercontent.com,registry.npmjs.org,s.symcb.com,s.symcd.com,security.ubuntu.com,telemetry.enterprise.githubcopilot.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com,www.googleapis.com"
261
+ with:
262
+ script: |
263
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
264
+ setupGlobals(core, github, context, exec, io, getOctokit);
265
+ const { main } = require('${{ runner.temp }}/gh-aw/actions/compute_text.cjs');
266
+ await main();
267
+ - name: Log runtime features
268
+ if: ${{ contains(toJSON(vars), '"GH_AW_RUNTIME_FEATURES":') }}
269
+ run: bash "${RUNNER_TEMP}/gh-aw/actions/log_runtime_features_summary.sh"
270
+ - name: Create prompt with built-in context
271
+ env:
272
+ GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
273
+ GH_AW_SAFE_OUTPUTS: ${{ runner.temp }}/gh-aw/safeoutputs/outputs.jsonl
274
+ GH_AW_EXPR_1A3A194A: ${{ github.event.discussion.number || (fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_type == 'discussion' && fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_number) }}
275
+ GH_AW_EXPR_463A214A: ${{ github.event.pull_request.number || (fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_type == 'pull_request' && fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_number) }}
276
+ GH_AW_EXPR_802A9F6A: ${{ github.event.issue.number || (fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_type == 'issue' && fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_number) }}
277
+ GH_AW_EXPR_FF1D34CE: ${{ github.event.comment.id || fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').comment_id }}
278
+ GH_AW_GITHUB_ACTOR: ${{ github.actor }}
279
+ GH_AW_GITHUB_EVENT_ISSUE_NUMBER: ${{ github.event.issue.number }}
280
+ GH_AW_GITHUB_REPOSITORY: ${{ github.repository }}
281
+ GH_AW_GITHUB_RUN_ID: ${{ github.run_id }}
282
+ GH_AW_GITHUB_WORKSPACE: ${{ github.workspace }}
283
+ # poutine:ignore untrusted_checkout_exec
284
+ run: |
285
+ bash "${RUNNER_TEMP}/gh-aw/actions/create_prompt_first.sh"
286
+ {
287
+ cat << 'GH_AW_PROMPT_7faf8e16b9e4d7e9_EOF'
288
+ <system>
289
+ GH_AW_PROMPT_7faf8e16b9e4d7e9_EOF
290
+ cat "${RUNNER_TEMP}/gh-aw/prompts/xpia.md"
291
+ cat "${RUNNER_TEMP}/gh-aw/prompts/temp_folder_prompt.md"
292
+ cat "${RUNNER_TEMP}/gh-aw/prompts/markdown.md"
293
+ cat "${RUNNER_TEMP}/gh-aw/prompts/safe_outputs_prompt.md"
294
+ cat << 'GH_AW_PROMPT_7faf8e16b9e4d7e9_EOF'
295
+ <safe-output-tools>
296
+ Tools: add_comment, add_labels(max:3), assign_to_agent, set_issue_type, missing_tool, missing_data, noop
297
+ </safe-output-tools>
298
+ GH_AW_PROMPT_7faf8e16b9e4d7e9_EOF
299
+ cat "${RUNNER_TEMP}/gh-aw/prompts/mcp_cli_tools_prompt.md"
300
+ cat << 'GH_AW_PROMPT_7faf8e16b9e4d7e9_EOF'
301
+ <github-context>
302
+ The following GitHub context information is available for this workflow:
303
+ {{#if github.actor}}
304
+ - **actor**: __GH_AW_GITHUB_ACTOR__
305
+ {{/if}}
306
+ {{#if github.repository}}
307
+ - **repository**: __GH_AW_GITHUB_REPOSITORY__
308
+ {{/if}}
309
+ {{#if github.workspace}}
310
+ - **workspace**: __GH_AW_GITHUB_WORKSPACE__
311
+ {{/if}}
312
+ {{#if github.event.issue.number || (github.aw.context.item_type == 'issue' && github.aw.context.item_number)}}
313
+ - **issue-number**: #__GH_AW_EXPR_802A9F6A__
314
+ {{/if}}
315
+ {{#if github.event.discussion.number || (github.aw.context.item_type == 'discussion' && github.aw.context.item_number)}}
316
+ - **discussion-number**: #__GH_AW_EXPR_1A3A194A__
317
+ {{/if}}
318
+ {{#if github.event.pull_request.number || (github.aw.context.item_type == 'pull_request' && github.aw.context.item_number)}}
319
+ - **pull-request-number**: #__GH_AW_EXPR_463A214A__
320
+ {{/if}}
321
+ {{#if github.event.comment.id || github.aw.context.comment_id}}
322
+ - **comment-id**: __GH_AW_EXPR_FF1D34CE__
323
+ {{/if}}
324
+ {{#if github.run_id}}
325
+ - **workflow-run-id**: __GH_AW_GITHUB_RUN_ID__
326
+ {{/if}}
327
+ </github-context>
328
+
329
+ GH_AW_PROMPT_7faf8e16b9e4d7e9_EOF
330
+ cat "${RUNNER_TEMP}/gh-aw/prompts/github_mcp_tools_with_safeoutputs_prompt.md"
331
+ cat << 'GH_AW_PROMPT_7faf8e16b9e4d7e9_EOF'
332
+ </system>
333
+ {{#runtime-import .github/workflows/issue-triage.md}}
334
+ GH_AW_PROMPT_7faf8e16b9e4d7e9_EOF
335
+ } > "$GH_AW_PROMPT"
336
+ - name: Interpolate variables and render templates
337
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
338
+ env:
339
+ GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
340
+ GH_AW_ENGINE_ID: "copilot"
341
+ GH_AW_GITHUB_EVENT_ISSUE_NUMBER: ${{ github.event.issue.number }}
342
+ with:
343
+ script: |
344
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
345
+ setupGlobals(core, github, context, exec, io, getOctokit);
346
+ const { main } = require('${{ runner.temp }}/gh-aw/actions/interpolate_prompt.cjs');
347
+ await main();
348
+ - name: Substitute placeholders
349
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
350
+ env:
351
+ GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
352
+ GH_AW_EXPR_1A3A194A: ${{ github.event.discussion.number || (fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_type == 'discussion' && fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_number) }}
353
+ GH_AW_EXPR_463A214A: ${{ github.event.pull_request.number || (fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_type == 'pull_request' && fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_number) }}
354
+ GH_AW_EXPR_802A9F6A: ${{ github.event.issue.number || (fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_type == 'issue' && fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_number) }}
355
+ GH_AW_EXPR_FF1D34CE: ${{ github.event.comment.id || fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').comment_id }}
356
+ GH_AW_GITHUB_ACTOR: ${{ github.actor }}
357
+ GH_AW_GITHUB_EVENT_ISSUE_NUMBER: ${{ github.event.issue.number }}
358
+ GH_AW_GITHUB_REPOSITORY: ${{ github.repository }}
359
+ GH_AW_GITHUB_RUN_ID: ${{ github.run_id }}
360
+ GH_AW_GITHUB_WORKSPACE: ${{ github.workspace }}
361
+ GH_AW_MCP_CLI_SERVERS_LIST: "- `github` — run `github --help` to see available tools\n- `safeoutputs` — run `safeoutputs --help` to see available tools"
362
+ GH_AW_NEEDS_PRE_ACTIVATION_OUTPUTS_ACTIVATED: ${{ needs.pre_activation.outputs.activated }}
363
+ with:
364
+ script: |
365
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
366
+ setupGlobals(core, github, context, exec, io, getOctokit);
367
+
368
+ const substitutePlaceholders = require('${{ runner.temp }}/gh-aw/actions/substitute_placeholders.cjs');
369
+
370
+ // Call the substitution function
371
+ return await substitutePlaceholders({
372
+ file: process.env.GH_AW_PROMPT,
373
+ substitutions: {
374
+ GH_AW_EXPR_1A3A194A: process.env.GH_AW_EXPR_1A3A194A,
375
+ GH_AW_EXPR_463A214A: process.env.GH_AW_EXPR_463A214A,
376
+ GH_AW_EXPR_802A9F6A: process.env.GH_AW_EXPR_802A9F6A,
377
+ GH_AW_EXPR_FF1D34CE: process.env.GH_AW_EXPR_FF1D34CE,
378
+ GH_AW_GITHUB_ACTOR: process.env.GH_AW_GITHUB_ACTOR,
379
+ GH_AW_GITHUB_EVENT_ISSUE_NUMBER: process.env.GH_AW_GITHUB_EVENT_ISSUE_NUMBER,
380
+ GH_AW_GITHUB_REPOSITORY: process.env.GH_AW_GITHUB_REPOSITORY,
381
+ GH_AW_GITHUB_RUN_ID: process.env.GH_AW_GITHUB_RUN_ID,
382
+ GH_AW_GITHUB_WORKSPACE: process.env.GH_AW_GITHUB_WORKSPACE,
383
+ GH_AW_MCP_CLI_SERVERS_LIST: process.env.GH_AW_MCP_CLI_SERVERS_LIST,
384
+ GH_AW_NEEDS_PRE_ACTIVATION_OUTPUTS_ACTIVATED: process.env.GH_AW_NEEDS_PRE_ACTIVATION_OUTPUTS_ACTIVATED
385
+ }
386
+ });
387
+ - name: Validate prompt placeholders
388
+ env:
389
+ GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
390
+ # poutine:ignore untrusted_checkout_exec
391
+ run: bash "${RUNNER_TEMP}/gh-aw/actions/validate_prompt_placeholders.sh"
392
+ - name: Print prompt
393
+ env:
394
+ GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
395
+ # poutine:ignore untrusted_checkout_exec
396
+ run: bash "${RUNNER_TEMP}/gh-aw/actions/print_prompt_summary.sh"
397
+ - name: Upload activation artifact
398
+ if: success()
399
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
400
+ with:
401
+ name: activation
402
+ include-hidden-files: true
403
+ path: |
404
+ /tmp/gh-aw/aw_info.json
405
+ /tmp/gh-aw/models.json
406
+ /tmp/gh-aw/aw-prompts/prompt.txt
407
+ /tmp/gh-aw/aw-prompts/prompt-template.txt
408
+ /tmp/gh-aw/aw-prompts/prompt-import-tree.json
409
+ /tmp/gh-aw/github_rate_limits.jsonl
410
+ /tmp/gh-aw/base
411
+ /tmp/gh-aw/.github/agents
412
+ /tmp/gh-aw/.github/skills
413
+ if-no-files-found: ignore
414
+ retention-days: 1
415
+
416
+ agent:
417
+ needs: activation
418
+ if: needs.activation.outputs.daily_ai_credits_exceeded != 'true'
419
+ runs-on: ubuntu-latest
420
+ permissions: read-all
421
+ env:
422
+ DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
423
+ GH_AW_ASSETS_ALLOWED_EXTS: ""
424
+ GH_AW_ASSETS_BRANCH: ""
425
+ GH_AW_ASSETS_MAX_SIZE_KB: 0
426
+ GH_AW_MCP_LOG_DIR: /tmp/gh-aw/mcp-logs/safeoutputs
427
+ GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }}
428
+ GH_AW_WORKFLOW_ID_SANITIZED: issuetriage
429
+ outputs:
430
+ agentic_engine_timeout: ${{ steps.detect-agent-errors.outputs.agentic_engine_timeout || 'false' }}
431
+ ai_credits_rate_limit_error: ${{ steps.parse-mcp-gateway.outputs.ai_credits_rate_limit_error || 'false' }}
432
+ aic: ${{ steps.parse-mcp-gateway.outputs.aic }}
433
+ ambient_context: ${{ steps.parse-mcp-gateway.outputs.ambient_context }}
434
+ checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
435
+ effective_tokens: ${{ steps.parse-mcp-gateway.outputs.effective_tokens }}
436
+ has_patch: ${{ steps.collect_output.outputs.has_patch }}
437
+ http_400_response_error: ${{ steps.detect-agent-errors.outputs.http_400_response_error || 'false' }}
438
+ inference_access_error: ${{ steps.detect-agent-errors.outputs.inference_access_error || 'false' }}
439
+ invocation_cap_exceeded: ${{ steps.detect-agent-errors.outputs.invocation_cap_exceeded || 'false' }}
440
+ mcp_policy_error: ${{ steps.detect-agent-errors.outputs.mcp_policy_error || 'false' }}
441
+ model: ${{ needs.activation.outputs.model }}
442
+ model_not_supported_error: ${{ steps.detect-agent-errors.outputs.model_not_supported_error || 'false' }}
443
+ output: ${{ steps.collect_output.outputs.output }}
444
+ output_types: ${{ steps.collect_output.outputs.output_types }}
445
+ setup-parent-span-id: ${{ steps.setup.outputs.parent-span-id || steps.setup.outputs.span-id }}
446
+ setup-span-id: ${{ steps.setup.outputs.span-id }}
447
+ setup-trace-id: ${{ steps.setup.outputs.trace-id }}
448
+ unknown_model_ai_credits: ${{ steps.parse-mcp-gateway.outputs.unknown_model_ai_credits || 'false' }}
449
+ steps:
450
+ - name: Setup Scripts
451
+ id: setup
452
+ uses: github/gh-aw-actions/setup@8bdba8075360648fe6802302a5b4e016361dc6ac # v0.83.1
453
+ with:
454
+ destination: ${{ runner.temp }}/gh-aw/actions
455
+ job-name: ${{ github.job }}
456
+ trace-id: ${{ needs.activation.outputs.setup-trace-id }}
457
+ parent-span-id: ${{ needs.activation.outputs.setup-parent-span-id || needs.activation.outputs.setup-span-id }}
458
+ env:
459
+ GH_AW_SETUP_WORKFLOW_NAME: "Issue triage"
460
+ GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/issue-triage.lock.yml@${{ github.ref }}
461
+ GH_AW_INFO_VERSION: "1.0.73"
462
+ GH_AW_INFO_AWF_VERSION: "v0.27.38"
463
+ GH_AW_INFO_ENGINE_ID: "copilot"
464
+ - name: Set runtime paths
465
+ id: set-runtime-paths
466
+ run: |
467
+ {
468
+ echo "GH_AW_SAFE_OUTPUTS=${RUNNER_TEMP}/gh-aw/safeoutputs/outputs.jsonl"
469
+ echo "GH_AW_SAFE_OUTPUTS_CONFIG_PATH=${RUNNER_TEMP}/gh-aw/safeoutputs/config.json"
470
+ echo "GH_AW_SAFE_OUTPUTS_TOOLS_PATH=${RUNNER_TEMP}/gh-aw/safeoutputs/tools.json"
471
+ } >> "$GITHUB_OUTPUT"
472
+ - name: Checkout repository
473
+ uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
474
+ with:
475
+ persist-credentials: false
476
+ - name: Create gh-aw temp directory
477
+ run: bash "${RUNNER_TEMP}/gh-aw/actions/create_gh_aw_tmp_dir.sh"
478
+ - name: Configure gh CLI for GitHub Enterprise
479
+ run: bash "${RUNNER_TEMP}/gh-aw/actions/configure_gh_for_ghe.sh"
480
+ env:
481
+ GH_TOKEN: ${{ github.token }}
482
+ - name: Download activation artifact
483
+ uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
484
+ with:
485
+ name: activation
486
+ path: /tmp/gh-aw
487
+ - name: Configure Git credentials
488
+ env:
489
+ GITHUB_REPOSITORY: ${{ github.repository }}
490
+ GITHUB_SERVER_URL: ${{ github.server_url }}
491
+ GITHUB_TOKEN: ${{ github.token }}
492
+ run: bash "${RUNNER_TEMP}/gh-aw/actions/configure_git_credentials.sh"
493
+ - name: Checkout PR branch
494
+ id: checkout-pr
495
+ if: |
496
+ github.event.pull_request || github.event.issue.pull_request || github.event_name == 'workflow_dispatch' && fromJSON(github.event.inputs.aw_context || '{}').item_type == 'pull_request'
497
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
498
+ env:
499
+ GH_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
500
+ with:
501
+ github-token: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
502
+ script: |
503
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
504
+ setupGlobals(core, github, context, exec, io, getOctokit);
505
+ const { main } = require('${{ runner.temp }}/gh-aw/actions/checkout_pr_branch.cjs');
506
+ await main();
507
+ - name: Install GitHub Copilot CLI
508
+ run: bash "${RUNNER_TEMP}/gh-aw/actions/install_copilot_cli.sh" 1.0.73
509
+ env:
510
+ GH_HOST: github.com
511
+ - name: Install AWF binary
512
+ run: bash "${RUNNER_TEMP}/gh-aw/actions/install_awf_binary.sh" v0.27.38 --rootless
513
+ - name: Determine automatic lockdown mode for GitHub MCP Server
514
+ id: determine-automatic-lockdown
515
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 (source v9)
516
+ env:
517
+ GH_AW_GITHUB_TOKEN: ${{ secrets.GH_AW_GITHUB_TOKEN }}
518
+ GH_AW_GITHUB_MCP_SERVER_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN }}
519
+ GH_AW_GITHUB_MIN_INTEGRITY: 'none'
520
+ with:
521
+ script: |
522
+ const determineAutomaticLockdown = require('${{ runner.temp }}/gh-aw/actions/determine_automatic_lockdown.cjs');
523
+ await determineAutomaticLockdown(github, context, core);
524
+ - name: Parse integrity filter lists
525
+ id: parse-guard-vars
526
+ env:
527
+ GH_AW_BLOCKED_USERS_VAR: ${{ vars.GH_AW_GITHUB_BLOCKED_USERS || '' }}
528
+ GH_AW_TRUSTED_USERS_VAR: ${{ vars.GH_AW_GITHUB_TRUSTED_USERS || '' }}
529
+ GH_AW_APPROVAL_LABELS_VAR: ${{ vars.GH_AW_GITHUB_APPROVAL_LABELS || '' }}
530
+ run: bash "${RUNNER_TEMP}/gh-aw/actions/parse_guard_list.sh"
531
+ - name: Restore agent config folders from base branch
532
+ if: steps.checkout-pr.outcome == 'success'
533
+ env:
534
+ GH_AW_AGENT_FOLDERS: ".agents .antigravity .claude .codex .gemini .github .opencode .pi"
535
+ GH_AW_AGENT_FILES: "AGENTS.md ANTIGRAVITY.md CLAUDE.md GEMINI.md PI.md opencode.jsonc"
536
+ run: bash "${RUNNER_TEMP}/gh-aw/actions/restore_base_github_folders.sh"
537
+ - name: Restore inline sub-agents from activation artifact
538
+ env:
539
+ GH_AW_SUB_AGENT_DIR: ".github/agents"
540
+ GH_AW_SUB_AGENT_EXT: ".agent.md"
541
+ run: bash "${RUNNER_TEMP}/gh-aw/actions/restore_inline_sub_agents.sh"
542
+ - name: Restore inline skills from activation artifact
543
+ env:
544
+ GH_AW_SKILL_DIR: ".github/skills"
545
+ run: bash "${RUNNER_TEMP}/gh-aw/actions/restore_inline_skills.sh"
546
+ - name: Download container images
547
+ run: bash "${RUNNER_TEMP}/gh-aw/actions/download_docker_images.sh" ghcr.io/github/gh-aw-firewall/agent:0.27.38@sha256:cb928eb62d9139a013c2d278dab19af232d35a2d83dca71a3d98eb431f786243 ghcr.io/github/gh-aw-firewall/api-proxy:0.27.38@sha256:cd6145620d96acee46e1ede25180a13aa36002467e663db0caa453a8bc8eb60c ghcr.io/github/gh-aw-firewall/squid:0.27.38@sha256:6c19094d95aad5f9f128ad5e583f0f2b894b158aa66c3b86dd9bcc90970a2917 ghcr.io/github/gh-aw-mcpg:v0.4.3@sha256:3c744710ea275cd5ee65db92a1099e0d980754bd9fafda9ce67704c67004dc83 ghcr.io/github/gh-aw-node@sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b ghcr.io/github/github-mcp-server:v1.6.0@sha256:2b0c48b070f61e9d3969269ead600f62d00fb237b60ac849ef3d166ee7de9ad3
548
+ - name: Generate Safe Outputs Config
549
+ run: |
550
+ mkdir -p "${RUNNER_TEMP}/gh-aw/safeoutputs"
551
+ mkdir -p /tmp/gh-aw/safeoutputs
552
+ mkdir -p /tmp/gh-aw/mcp-logs/safeoutputs
553
+ cat > "${RUNNER_TEMP}/gh-aw/safeoutputs/config.json" << 'GH_AW_SAFE_OUTPUTS_CONFIG_689a0d538867fc81_EOF'
554
+ {"add_comment":{"max":1},"add_labels":{"issue_intent":true,"max":3,"target":"triggering"},"assign_to_agent":{"allowed":["copilot"],"issue_intent":true,"max":1,"name":"copilot","target":"triggering"},"create_report_incomplete_issue":{},"missing_data":{},"missing_tool":{},"noop":{"max":1,"report-as-issue":"true"},"report_incomplete":{},"set_issue_type":{"issue_intent":true,"max":1,"target":"triggering"}}
555
+ GH_AW_SAFE_OUTPUTS_CONFIG_689a0d538867fc81_EOF
556
+ - name: Generate Safe Outputs Tools
557
+ env:
558
+ GH_AW_TOOLS_META_JSON: |
559
+ {
560
+ "description_suffixes": {
561
+ "add_comment": " CONSTRAINTS: Maximum 1 comment(s) can be added. Supports reply_to_id for discussion threading.",
562
+ "add_labels": " CONSTRAINTS: Maximum 3 label(s) can be added. Target: triggering.",
563
+ "assign_to_agent": " CONSTRAINTS: Maximum 1 issue(s) can be assigned to agent."
564
+ },
565
+ "repo_params": {},
566
+ "dynamic_tools": [],
567
+ "required_field_additions": {
568
+ "assign_to_agent": [
569
+ "rationale",
570
+ "confidence"
571
+ ],
572
+ "set_issue_type": [
573
+ "rationale",
574
+ "confidence"
575
+ ]
576
+ }
577
+ }
578
+ GH_AW_VALIDATION_JSON: |
579
+ {
580
+ "add_comment": {
581
+ "defaultMax": 1,
582
+ "fields": {
583
+ "body": {
584
+ "required": true,
585
+ "type": "string",
586
+ "sanitize": true,
587
+ "maxLength": 65000
588
+ },
589
+ "item_number": {
590
+ "issueOrPRNumber": true
591
+ },
592
+ "reply_to_id": {
593
+ "type": "string",
594
+ "maxLength": 256
595
+ },
596
+ "repo": {
597
+ "type": "string",
598
+ "maxLength": 256
599
+ }
600
+ }
601
+ },
602
+ "add_labels": {
603
+ "defaultMax": 5,
604
+ "fields": {
605
+ "item_number": {
606
+ "issueNumberOrTemporaryId": true
607
+ },
608
+ "labels": {
609
+ "required": true,
610
+ "type": "array"
611
+ },
612
+ "repo": {
613
+ "type": "string",
614
+ "maxLength": 256
615
+ }
616
+ }
617
+ },
618
+ "assign_to_agent": {
619
+ "defaultMax": 1,
620
+ "fields": {
621
+ "agent": {
622
+ "type": "string",
623
+ "sanitize": true,
624
+ "maxLength": 128
625
+ },
626
+ "confidence": {
627
+ "type": "string",
628
+ "enum": [
629
+ "LOW",
630
+ "MEDIUM",
631
+ "HIGH"
632
+ ],
633
+ "x-strip-on-error": true
634
+ },
635
+ "issue_number": {
636
+ "issueNumberOrTemporaryId": true
637
+ },
638
+ "pull_number": {
639
+ "optionalPositiveInteger": true
640
+ },
641
+ "pull_request_repo": {
642
+ "type": "string",
643
+ "maxLength": 256
644
+ },
645
+ "rationale": {
646
+ "type": "string",
647
+ "sanitize": true,
648
+ "maxLength": 280,
649
+ "x-strip-on-error": true
650
+ },
651
+ "repo": {
652
+ "type": "string",
653
+ "maxLength": 256
654
+ },
655
+ "suggest": {
656
+ "type": "boolean"
657
+ }
658
+ },
659
+ "customValidation": "requiresOneOf:issue_number,pull_number"
660
+ },
661
+ "missing_data": {
662
+ "defaultMax": 20,
663
+ "fields": {
664
+ "alternatives": {
665
+ "type": "string",
666
+ "sanitize": true,
667
+ "maxLength": 256
668
+ },
669
+ "context": {
670
+ "type": "string",
671
+ "sanitize": true,
672
+ "maxLength": 256
673
+ },
674
+ "data_type": {
675
+ "type": "string",
676
+ "sanitize": true,
677
+ "maxLength": 128
678
+ },
679
+ "reason": {
680
+ "type": "string",
681
+ "sanitize": true,
682
+ "maxLength": 256
683
+ }
684
+ }
685
+ },
686
+ "missing_tool": {
687
+ "defaultMax": 20,
688
+ "fields": {
689
+ "alternatives": {
690
+ "type": "string",
691
+ "sanitize": true,
692
+ "maxLength": 512
693
+ },
694
+ "reason": {
695
+ "required": true,
696
+ "type": "string",
697
+ "sanitize": true,
698
+ "maxLength": 256
699
+ },
700
+ "tool": {
701
+ "type": "string",
702
+ "sanitize": true,
703
+ "maxLength": 128
704
+ }
705
+ }
706
+ },
707
+ "noop": {
708
+ "defaultMax": 1,
709
+ "fields": {
710
+ "message": {
711
+ "required": true,
712
+ "type": "string",
713
+ "sanitize": true,
714
+ "maxLength": 65000
715
+ }
716
+ }
717
+ },
718
+ "report_incomplete": {
719
+ "defaultMax": 5,
720
+ "fields": {
721
+ "details": {
722
+ "type": "string",
723
+ "sanitize": true,
724
+ "maxLength": 65000
725
+ },
726
+ "reason": {
727
+ "required": true,
728
+ "type": "string",
729
+ "sanitize": true,
730
+ "maxLength": 1024
731
+ }
732
+ }
733
+ },
734
+ "set_issue_type": {
735
+ "defaultMax": 5,
736
+ "fields": {
737
+ "confidence": {
738
+ "type": "string",
739
+ "enum": [
740
+ "LOW",
741
+ "MEDIUM",
742
+ "HIGH"
743
+ ],
744
+ "x-strip-on-error": true
745
+ },
746
+ "issue_number": {
747
+ "issueOrPRNumber": true
748
+ },
749
+ "issue_type": {
750
+ "required": true,
751
+ "type": "string",
752
+ "sanitize": true,
753
+ "maxLength": 128
754
+ },
755
+ "rationale": {
756
+ "type": "string",
757
+ "sanitize": true,
758
+ "maxLength": 280,
759
+ "x-strip-on-error": true
760
+ },
761
+ "repo": {
762
+ "type": "string",
763
+ "maxLength": 256
764
+ },
765
+ "suggest": {
766
+ "type": "boolean"
767
+ }
768
+ }
769
+ }
770
+ }
771
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
772
+ with:
773
+ script: |
774
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
775
+ setupGlobals(core, github, context, exec, io, getOctokit);
776
+ const { main } = require('${{ runner.temp }}/gh-aw/actions/generate_safe_outputs_tools.cjs');
777
+ await main();
778
+ - name: Start MCP Gateway
779
+ id: start-mcp-gateway
780
+ env:
781
+ GH_AW_POLICY_ALLOW_CREATE_PULL_REQUEST: ${{ vars.GH_AW_POLICY_ALLOW_CREATE_PULL_REQUEST || 'true' }}
782
+ GH_AW_SAFE_OUTPUTS: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS }}
783
+ GH_AW_SAFE_OUTPUTS_CONFIG_PATH: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS_CONFIG_PATH }}
784
+ GH_AW_SAFE_OUTPUTS_TOOLS_PATH: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS_TOOLS_PATH }}
785
+ GITHUB_MCP_SERVER_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
786
+ GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
787
+ run: |
788
+ set -eo pipefail
789
+ mkdir -p "${RUNNER_TEMP}/gh-aw/mcp-config"
790
+
791
+ # Export gateway environment variables for MCP config and gateway script
792
+ export MCP_GATEWAY_PORT="8080"
793
+ export MCP_GATEWAY_DOMAIN="awmg-mcpg"
794
+ export MCP_GATEWAY_HOST_DOMAIN="localhost"
795
+ MCP_GATEWAY_API_KEY=$(openssl rand -base64 45 | tr -d '/+=')
796
+ echo "::add-mask::${MCP_GATEWAY_API_KEY}"
797
+ export MCP_GATEWAY_API_KEY
798
+ export MCP_GATEWAY_PAYLOAD_DIR="/tmp/gh-aw/mcp-payloads"
799
+ mkdir -p "${MCP_GATEWAY_PAYLOAD_DIR}"
800
+ export MCP_GATEWAY_PAYLOAD_SIZE_THRESHOLD="524288"
801
+ export DEBUG="*"
802
+
803
+ export GH_AW_ENGINE="copilot"
804
+ MCP_GATEWAY_UID=$(id -u 2>/dev/null || echo '0')
805
+ MCP_GATEWAY_GID=$(id -g 2>/dev/null || echo '0')
806
+ source "${RUNNER_TEMP}/gh-aw/actions/resolve_docker_socket_gid.sh"
807
+ export MCP_GATEWAY_DOCKER_COMMAND='docker run -i --rm --network bridge -p 127.0.0.1:'"${MCP_GATEWAY_PORT}"':'"${MCP_GATEWAY_PORT}"' --name awmg-mcpg --add-host host.docker.internal:host-gateway --user '"${MCP_GATEWAY_UID}"':'"${MCP_GATEWAY_GID}"' --group-add '"${DOCKER_SOCK_GID}"' -v '"${DOCKER_SOCK_PATH}"':/var/run/docker.sock -e MCP_GATEWAY_PORT -e MCP_GATEWAY_DOMAIN -e MCP_GATEWAY_API_KEY -e MCP_GATEWAY_PAYLOAD_DIR -e MCP_GATEWAY_PAYLOAD_SIZE_THRESHOLD -e DOCKER_HOST=unix:///var/run/docker.sock -e DEBUG -e MCP_GATEWAY_LOG_DIR -e GH_AW_MCP_LOG_DIR -e GH_AW_SAFE_OUTPUTS -e GH_AW_SAFE_OUTPUTS_CONFIG_PATH -e GH_AW_SAFE_OUTPUTS_TOOLS_PATH -e GH_AW_POLICY_ALLOW_CREATE_PULL_REQUEST -e GH_AW_ASSETS_BRANCH -e GH_AW_ASSETS_MAX_SIZE_KB -e GH_AW_ASSETS_ALLOWED_EXTS -e DEFAULT_BRANCH -e GITHUB_MCP_SERVER_TOKEN -e GITHUB_MCP_GUARD_MIN_INTEGRITY -e GITHUB_MCP_GUARD_REPOS -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e GITHUB_SHA -e GITHUB_WORKSPACE -e GITHUB_TOKEN -e GITHUB_RUN_ID -e GITHUB_RUN_NUMBER -e GITHUB_RUN_ATTEMPT -e GITHUB_JOB -e GITHUB_ACTION -e GITHUB_EVENT_NAME -e GITHUB_EVENT_PATH -e GITHUB_ACTOR -e GITHUB_ACTOR_ID -e GITHUB_TRIGGERING_ACTOR -e GITHUB_WORKFLOW -e GITHUB_WORKFLOW_REF -e GITHUB_WORKFLOW_SHA -e GITHUB_REF -e GITHUB_REF_NAME -e GITHUB_REF_TYPE -e GITHUB_HEAD_REF -e GITHUB_BASE_REF -e RUNNER_TEMP -v /tmp/gh-aw/mcp-payloads:/tmp/gh-aw/mcp-payloads:rw -v /opt:/opt:ro -v /tmp:/tmp:rw -v '"${GITHUB_WORKSPACE}"':'"${GITHUB_WORKSPACE}"':rw -v '"${RUNNER_TEMP}"'/gh-aw/safeoutputs:'"${RUNNER_TEMP}"'/gh-aw/safeoutputs:rw ghcr.io/github/gh-aw-mcpg:v0.4.3'
808
+
809
+ mkdir -p "$HOME/.copilot"
810
+ GH_AW_NODE=$(which node 2>/dev/null || command -v node 2>/dev/null || echo node)
811
+ cat << GH_AW_MCP_CONFIG_cbd7e454efa3ed0c_EOF | "$GH_AW_NODE" "${RUNNER_TEMP}/gh-aw/actions/start_mcp_gateway.cjs"
812
+ {
813
+ "mcpServers": {
814
+ "github": {
815
+ "type": "stdio",
816
+ "container": "ghcr.io/github/github-mcp-server:v1.6.0",
817
+ "env": {
818
+ "GITHUB_FEATURES": "fields_param",
819
+ "GITHUB_HOST": "${GITHUB_SERVER_URL}",
820
+ "GITHUB_PERSONAL_ACCESS_TOKEN": "${GITHUB_MCP_SERVER_TOKEN}",
821
+ "GITHUB_READ_ONLY": "1",
822
+ "GITHUB_TOOLSETS": "issues,labels"
823
+ },
824
+ "guard-policies": {
825
+ "allow-only": {
826
+ "approval-labels": ${{ steps.parse-guard-vars.outputs.approval_labels }},
827
+ "blocked-users": ${{ steps.parse-guard-vars.outputs.blocked_users }},
828
+ "min-integrity": "none",
829
+ "repos": "all",
830
+ "trusted-users": ${{ steps.parse-guard-vars.outputs.trusted_users }}
831
+ }
832
+ }
833
+ },
834
+ "safeoutputs": {
835
+ "type": "stdio",
836
+ "container": "ghcr.io/github/gh-aw-node",
837
+ "mounts": ["\${GITHUB_WORKSPACE}:\${GITHUB_WORKSPACE}:rw", "${RUNNER_TEMP}/gh-aw/safeoutputs:${RUNNER_TEMP}/gh-aw/safeoutputs:rw", "/tmp/gh-aw:/tmp/gh-aw:rw"],
838
+ "args": ["-w", "\${GITHUB_WORKSPACE}"],
839
+ "entrypoint": "sh",
840
+ "entrypointArgs": ["-c", "sh ${RUNNER_TEMP}/gh-aw/safeoutputs/start_safe_outputs_mcp.sh"],
841
+ "env": {
842
+ "DEBUG": "*",
843
+ "DEFAULT_BRANCH": "\${DEFAULT_BRANCH}",
844
+ "GH_AW_ASSETS_ALLOWED_EXTS": "\${GH_AW_ASSETS_ALLOWED_EXTS}",
845
+ "GH_AW_ASSETS_BRANCH": "\${GH_AW_ASSETS_BRANCH}",
846
+ "GH_AW_ASSETS_MAX_SIZE_KB": "\${GH_AW_ASSETS_MAX_SIZE_KB}",
847
+ "GH_AW_MCP_LOG_DIR": "\${GH_AW_MCP_LOG_DIR}",
848
+ "GH_AW_SAFE_OUTPUTS": "\${GH_AW_SAFE_OUTPUTS}",
849
+ "GH_AW_SAFE_OUTPUTS_CONFIG_PATH": "\${GH_AW_SAFE_OUTPUTS_CONFIG_PATH}",
850
+ "GH_AW_SAFE_OUTPUTS_TOOLS_PATH": "\${GH_AW_SAFE_OUTPUTS_TOOLS_PATH}",
851
+ "GH_AW_POLICY_ALLOW_CREATE_PULL_REQUEST": "\${GH_AW_POLICY_ALLOW_CREATE_PULL_REQUEST}",
852
+ "GITHUB_REPOSITORY": "\${GITHUB_REPOSITORY}",
853
+ "GITHUB_SHA": "\${GITHUB_SHA}",
854
+ "GITHUB_TOKEN": "\${GITHUB_TOKEN}",
855
+ "GITHUB_WORKSPACE": "\${GITHUB_WORKSPACE}",
856
+ "RUNNER_TEMP": "\${RUNNER_TEMP}"
857
+ },
858
+ "guard-policies": {
859
+ "write-sink": {
860
+ "accept": [
861
+ "*"
862
+ ],
863
+ "sink-visibility": ${{ toJSON(steps.determine-automatic-lockdown.outputs.visibility) }}
864
+ }
865
+ }
866
+ }
867
+ },
868
+ "gateway": {
869
+ "port": $MCP_GATEWAY_PORT,
870
+ "domain": "${MCP_GATEWAY_DOMAIN}",
871
+ "apiKey": "${MCP_GATEWAY_API_KEY}",
872
+ "payloadDir": "${MCP_GATEWAY_PAYLOAD_DIR}",
873
+ "startupTimeout": 120
874
+ }
875
+ }
876
+ GH_AW_MCP_CONFIG_cbd7e454efa3ed0c_EOF
877
+ - name: Mount MCP servers as CLIs
878
+ id: mount-mcp-clis
879
+ continue-on-error: true
880
+ env:
881
+ MCP_GATEWAY_API_KEY: ${{ steps.start-mcp-gateway.outputs.gateway-api-key }}
882
+ MCP_GATEWAY_DOMAIN: ${{ steps.start-mcp-gateway.outputs.gateway-domain }}
883
+ MCP_GATEWAY_PORT: ${{ steps.start-mcp-gateway.outputs.gateway-port }}
884
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
885
+ with:
886
+ script: |
887
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
888
+ setupGlobals(core, github, context, exec, io);
889
+ const { main } = require('${{ runner.temp }}/gh-aw/actions/mount_mcp_as_cli.cjs');
890
+ await main();
891
+ - name: Clean credentials
892
+ continue-on-error: true
893
+ run: bash "${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh"
894
+ - name: Audit pre-agent workspace
895
+ id: pre_agent_audit
896
+ continue-on-error: true
897
+ run: bash "${RUNNER_TEMP}/gh-aw/actions/audit_pre_agent_workspace.sh"
898
+ - name: Execute GitHub Copilot CLI
899
+ id: agentic_execution
900
+ # Copilot CLI tool arguments (sorted):
901
+ timeout-minutes: 15
902
+ run: |
903
+ set -o pipefail
904
+ printf '%s' "$(date +%s%3N)" > /tmp/gh-aw/agent_cli_start_ms.txt
905
+ trap 'gh_aw_exit_code=$?; mkdir -p /tmp/gh-aw >/dev/null 2>&1 || true; printf "%s" "$gh_aw_exit_code" > /tmp/gh-aw/agent_execution_exit_code.txt || true; rm -f "$HOME/.copilot/settings.json"' EXIT
906
+ mkdir -p "$HOME/.copilot"
907
+ printf '%s' '{"builtInAgents":{"rubberDuck":false}}' > "$HOME/.copilot/settings.json"
908
+ export XDG_CONFIG_HOME="$HOME"
909
+ export GH_AW_MCP_CONFIG="$HOME/.copilot/mcp-config.json"
910
+ touch /tmp/gh-aw/agent-step-summary.md
911
+ GH_AW_NODE_BIN=$(command -v node 2>/dev/null || true)
912
+ export GH_AW_NODE_BIN
913
+ export COPILOT_API_KEY="$COPILOT_DUMMY_BYOK"
914
+ (umask 177 && touch /tmp/gh-aw/agent-stdio.log)
915
+ GH_AW_MAX_AI_CREDITS="${GH_AW_MAX_AI_CREDITS:-1000}"
916
+ printf '%s\n' "{\"\$schema\":\"https://github.com/github/gh-aw-firewall/releases/download/v0.27.38/awf-config.schema.json\",\"network\":{\"allowDomains\":[\"api.business.githubcopilot.com\",\"api.enterprise.githubcopilot.com\",\"api.github.com\",\"api.githubcopilot.com\",\"api.individual.githubcopilot.com\",\"api.snapcraft.io\",\"archive.ubuntu.com\",\"azure.archive.ubuntu.com\",\"crl.geotrust.com\",\"crl.globalsign.com\",\"crl.identrust.com\",\"crl.sectigo.com\",\"crl.thawte.com\",\"crl.usertrust.com\",\"crl.verisign.com\",\"crl3.digicert.com\",\"crl4.digicert.com\",\"crls.ssl.com\",\"github.com\",\"host.docker.internal\",\"json-schema.org\",\"json.schemastore.org\",\"keyserver.ubuntu.com\",\"ocsp.digicert.com\",\"ocsp.geotrust.com\",\"ocsp.globalsign.com\",\"ocsp.identrust.com\",\"ocsp.sectigo.com\",\"ocsp.ssl.com\",\"ocsp.thawte.com\",\"ocsp.usertrust.com\",\"ocsp.verisign.com\",\"packagecloud.io\",\"packages.cloud.google.com\",\"packages.microsoft.com\",\"ppa.launchpad.net\",\"raw.githubusercontent.com\",\"registry.npmjs.org\",\"s.symcb.com\",\"s.symcd.com\",\"security.ubuntu.com\",\"telemetry.enterprise.githubcopilot.com\",\"ts-crl.ws.symantec.com\",\"ts-ocsp.ws.symantec.com\",\"www.googleapis.com\"],\"isolation\":true,\"topologyAttach\":[\"awmg-mcpg\"]},\"apiProxy\":{\"enabled\":true,\"enableTokenSteering\":true,\"maxRuns\":500,\"maxAiCredits\":${GH_AW_MAX_AI_CREDITS},\"maxCacheMisses\":5,\"models\":{\"agent\":[\"sonnet-6x\",\"gpt-5.4\",\"gpt-5.3\",\"gemini-pro\",\"any\"],\"antigravity\":[\"copilot/antigravity*\",\"google/antigravity*\",\"gemini/antigravity*\"],\"any\":[\"copilot/*\",\"anthropic/*\",\"openai/*\",\"google/*\",\"gemini/*\"],\"claude\":[\"agent\"],\"codex\":[\"agent\"],\"coding\":[\"copilot/gpt-5*codex*\",\"openai/gpt-5*codex*\",\"gpt-5-codex\",\"kimi\"],\"computer-use\":[\"copilot/*computer-use*\",\"google/*computer-use*\",\"gemini/*computer-use*\",\"openai/*computer-use*\"],\"copilot\":[\"agent\"],\"deep-research\":[\"copilot/deep-research*\",\"copilot/o3-deep-research*\",\"copilot/o4-mini-deep-research*\",\"google/deep-research*\",\"gemini/deep-research*\",\"openai/o3-deep-research*\",\"openai/o4-mini-deep-research*\"],\"fable\":[\"copilot/*fable*\",\"anthropic/*fable*\"],\"gemini\":[\"agent\"],\"gemini-3-flash\":[\"copilot/gemini-3*flash*\",\"google/gemini-3*flash*\",\"gemini/gemini-3*flash*\"],\"gemini-3-pro\":[\"copilot/gemini-3*pro*\",\"google/gemini-3*pro*\",\"google/nano-banana*\",\"gemini/gemini-3*pro*\"],\"gemini-3.1-flash\":[\"copilot/gemini-3.1*flash*\",\"google/gemini-3.1*flash*\",\"gemini/gemini-3.1*flash*\"],\"gemini-3.1-pro\":[\"copilot/gemini-3.1*pro*\",\"google/gemini-3.1*pro*\",\"gemini/gemini-3.1*pro*\"],\"gemini-3.5-flash\":[\"copilot/gemini-3.5*flash*\",\"google/gemini-3.5*flash*\",\"gemini/gemini-3.5*flash*\"],\"gemini-flash\":[\"copilot/gemini-*flash*\",\"google/gemini-*flash*\",\"gemini/gemini-*flash*\"],\"gemini-flash-lite\":[\"copilot/gemini-*flash*lite*\",\"google/gemini-*flash*lite*\",\"gemini/gemini-*flash*lite*\"],\"gemini-omni\":[\"copilot/gemini-omni*\",\"google/gemini-omni*\",\"gemini/gemini-omni*\"],\"gemini-pro\":[\"copilot/gemini-*pro*\",\"google/gemini-*pro*\",\"gemini/gemini-*pro*\"],\"gemma\":[\"copilot/gemma*\",\"google/gemma*\",\"gemini/gemma*\"],\"gpt-5\":[\"copilot/gpt-5*\",\"openai/gpt-5*\"],\"gpt-5-codex\":[\"copilot/gpt-5*codex*\",\"openai/gpt-5*codex*\"],\"gpt-5-mini\":[\"copilot/gpt-5*mini*\",\"openai/gpt-5*mini*\"],\"gpt-5-nano\":[\"copilot/gpt-5*nano*\",\"openai/gpt-5*nano*\"],\"gpt-5-pro\":[\"copilot/gpt-5*pro*\",\"openai/gpt-5*pro*\"],\"gpt-5.1\":[\"copilot/gpt-5.1*\",\"openai/gpt-5.1*\"],\"gpt-5.2\":[\"copilot/gpt-5.2*\",\"openai/gpt-5.2*\"],\"gpt-5.3\":[\"copilot/gpt-5.3*\",\"openai/gpt-5.3*\"],\"gpt-5.4\":[\"copilot/gpt-5.4*\",\"openai/gpt-5.4*\"],\"gpt-5.5\":[\"copilot/gpt-5.5*\",\"openai/gpt-5.5*\"],\"gpt-5.6\":[\"copilot/gpt-5.6*\",\"openai/gpt-5.6*\"],\"haiku\":[\"copilot/*haiku*\",\"anthropic/*haiku*\"],\"image-generation\":[\"copilot/gpt-image*\",\"openai/gpt-image*\",\"openai/chatgpt-image*\",\"copilot/gemini-*image*\",\"google/gemini-*image*\",\"gemini/gemini-*image*\",\"google/imagen*\"],\"kimi\":[\"copilot/kimi*\",\"openai/kimi*\"],\"kiwi\":[\"copilot/kiwi*\",\"openai/kiwi*\"],\"large\":[\"fable\",\"sonnet\",\"gpt-5-pro\",\"gpt-5\",\"gemini-pro\"],\"lyria\":[\"google/lyria*\",\"gemini/lyria*\",\"copilot/lyria*\"],\"mai-code\":[\"copilot/MAI-Code*\",\"copilot/mai-code*\",\"openai/MAI-Code*\"],\"mai-code-1-flash-picker\":[\"copilot/MAI-Code-1-Flash-picker*\",\"copilot/mai-code-1-flash-picker*\",\"openai/MAI-Code-1-Flash-picker*\"],\"mini\":[\"haiku\",\"gpt-5-mini\",\"gpt-5-nano\",\"gemini-flash-lite\"],\"nano-banana\":[\"copilot/nano-banana*\",\"google/nano-banana*\",\"gemini/nano-banana*\"],\"opus\":[\"copilot/*opus*\",\"anthropic/*opus*\"],\"opusplan\":[\"opus?effort=high\"],\"raptor-mini\":[\"copilot/raptor*\",\"openai/raptor*\"],\"reasoning\":[\"copilot/o1*\",\"copilot/o3*\",\"copilot/o4*\",\"openai/o1*\",\"openai/o3*\",\"openai/o4*\"],\"robotics\":[\"copilot/*robotics*\",\"google/*robotics*\",\"gemini/*robotics*\"],\"small\":[\"mini\"],\"small-agent\":[\"haiku\",\"gpt-5-mini\",\"gemini-flash\"],\"sonnet\":[\"copilot/*sonnet*\",\"anthropic/*sonnet*\"],\"sonnet-6x\":[\"copilot/*sonnet-4.5*\",\"copilot/*sonnet-4.6*\",\"copilot/*sonnet-5*\",\"copilot/*sonnet-4-5-*\",\"anthropic/*sonnet-4-5-*\",\"copilot/*sonnet-4-6*\",\"anthropic/*sonnet-4-6*\",\"anthropic/*sonnet-5*\"],\"summarization\":[\"haiku\",\"gpt-5-mini\",\"gemini-flash-lite\",\"mini\"],\"veo\":[\"google/veo*\",\"gemini/veo*\"],\"vision\":[\"copilot/gemini-*image*\",\"google/gemini-*image*\",\"gemini/gemini-*image*\",\"copilot/gemini-*flash*\",\"google/gemini-*flash*\",\"gemini/gemini-*flash*\"]}},\"container\":{\"imageTag\":\"0.27.38,squid=sha256:6c19094d95aad5f9f128ad5e583f0f2b894b158aa66c3b86dd9bcc90970a2917,agent=sha256:cb928eb62d9139a013c2d278dab19af232d35a2d83dca71a3d98eb431f786243,api-proxy=sha256:cd6145620d96acee46e1ede25180a13aa36002467e663db0caa453a8bc8eb60c,cli-proxy=sha256:c30c5319da37505d42f95cb3faa2cfa55e794ccb5cc805dbd9201410d1ac2a3e\"},\"logging\":{\"proxyLogsDir\":\"/tmp/gh-aw/sandbox/firewall/logs\",\"auditDir\":\"/tmp/gh-aw/sandbox/firewall/audit\"}}" > "${RUNNER_TEMP}/gh-aw/awf-config.json"
917
+ cp "${RUNNER_TEMP}/gh-aw/awf-config.json" /tmp/gh-aw/awf-config.json
918
+ export GH_AW_MODELS_JSON_PATH="/tmp/gh-aw/models.json"
919
+ GH_AW_DOCKER_HOST=""
920
+ if [[ "${DOCKER_HOST:-}" =~ ^tcp:// ]]; then
921
+ GH_AW_DOCKER_HOST="${DOCKER_HOST}"
922
+ fi
923
+ if [[ "${DOCKER_HOST:-}" =~ ^tcp:// ]]; then
924
+ GH_AW_CHROOT_BINARIES_SOURCE_PATH="${RUNNER_TEMP}/gh-aw" GH_AW_CHROOT_IDENTITY_HOME="${RUNNER_TEMP}/gh-aw/home" node "${RUNNER_TEMP}/gh-aw/actions/patch_awf_chroot_config.cjs"
925
+ fi
926
+ GH_AW_TOOL_CACHE_MOUNT=""
927
+ GH_AW_TOOL_CACHE="${RUNNER_TOOL_CACHE:?RUNNER_TOOL_CACHE must be set}"
928
+ if [ -d "$GH_AW_TOOL_CACHE" ]; then
929
+ if [[ "$GH_AW_TOOL_CACHE" != /opt/* ]]; then
930
+ GH_AW_TOOL_CACHE_MOUNT="$GH_AW_TOOL_CACHE:$GH_AW_TOOL_CACHE:ro"
931
+ fi
932
+ fi
933
+ # shellcheck disable=SC1003,SC2016,SC2086
934
+ awf --config "${RUNNER_TEMP}/gh-aw/awf-config.json" --container-workdir "${GITHUB_WORKSPACE}" --mount "${RUNNER_TEMP}/gh-aw:${RUNNER_TEMP}/gh-aw:ro" --mount "${RUNNER_TEMP}/gh-aw:/host${RUNNER_TEMP}/gh-aw:ro" ${GH_AW_TOOL_CACHE_MOUNT:+--mount "$GH_AW_TOOL_CACHE_MOUNT"} ${GH_AW_DOCKER_HOST:+--docker-host "$GH_AW_DOCKER_HOST"} --env-all --exclude-env COPILOT_GITHUB_TOKEN --exclude-env GITHUB_MCP_SERVER_TOKEN --exclude-env MCP_GATEWAY_API_KEY --log-level info --skip-pull \
935
+ -- /bin/bash -c 'set +o histexpand; export PATH="${RUNNER_TEMP}/gh-aw/mcp-cli/bin:$PATH" && : "${RUNNER_TOOL_CACHE:?RUNNER_TOOL_CACHE must be set}"; GH_AW_TOOL_CACHE="$RUNNER_TOOL_CACHE"; export PATH="$(find "$GH_AW_TOOL_CACHE" -maxdepth 5 -type d -name bin 2>/dev/null | tr '\''\n'\'' '\'':'\'')$PATH"; [ -n "$GOROOT" ] && export PATH="$GOROOT/bin:$PATH" || true; [ -n "$ERLANG_HOME" ] && export PATH="$ERLANG_HOME/bin:$PATH" || true && GH_AW_NODE_EXEC="${GH_AW_NODE_BIN:-}"; if [ -z "$GH_AW_NODE_EXEC" ] || [ ! -x "$GH_AW_NODE_EXEC" ]; then GH_AW_NODE_EXEC="$(command -v node 2>/dev/null || true)"; fi; if [ -z "$GH_AW_NODE_EXEC" ]; then echo "node runtime missing on this runner — check runtimes.node in workflow YAML" >&2; exit 127; fi; GH_AW_NPM_GLOBAL_ROOT="$(npm root -g 2>/dev/null || true)"; if [ -n "$GH_AW_NPM_GLOBAL_ROOT" ]; then export NODE_PATH="${GH_AW_NPM_GLOBAL_ROOT}${NODE_PATH:+:${NODE_PATH}}"; fi; "$GH_AW_NODE_EXEC" ${RUNNER_TEMP}/gh-aw/actions/copilot_harness.cjs /usr/local/bin/copilot --add-dir /tmp/gh-aw/ --log-level all --log-dir /tmp/gh-aw/sandbox/agent/logs/ --disable-builtin-mcps --no-ask-user --allow-all-tools --allow-all-paths --add-dir "${GITHUB_WORKSPACE}" --prompt-file /tmp/gh-aw/aw-prompts/prompt.txt' 2>&1 | tee -a /tmp/gh-aw/agent-stdio.log
936
+ env:
937
+ AWF_REFLECT_ENABLED: 1
938
+ COPILOT_AGENT_RUNNER_TYPE: STANDALONE
939
+ COPILOT_DUMMY_BYOK: dummy-byok-key-for-offline-mode
940
+ COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
941
+ COPILOT_MODEL: ${{ vars.GH_AW_MODEL_AGENT_COPILOT || vars.GH_AW_DEFAULT_MODEL_COPILOT || 'claude-sonnet-4.6' }}
942
+ GH_AW_LLM_PROVIDER: github
943
+ GH_AW_MAX_AI_CREDITS: ${{ vars.GH_AW_DEFAULT_MAX_AI_CREDITS || '1000' }}
944
+ GH_AW_MAX_TURNS: ${{ vars.GH_AW_DEFAULT_MAX_TURNS || '' }}
945
+ GH_AW_PHASE: agent
946
+ GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
947
+ GH_AW_SAFE_OUTPUTS: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS }}
948
+ GH_AW_TIMEOUT_MINUTES: 15
949
+ GH_AW_VERSION: v0.83.1
950
+ GITHUB_API_URL: ${{ github.api_url }}
951
+ GITHUB_AW: true
952
+ GITHUB_COPILOT_INTEGRATION_ID: agentic-workflows
953
+ GITHUB_HEAD_REF: ${{ github.head_ref }}
954
+ GITHUB_MCP_SERVER_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
955
+ GITHUB_REF_NAME: ${{ github.ref_name }}
956
+ GITHUB_SERVER_URL: ${{ github.server_url }}
957
+ GITHUB_STEP_SUMMARY: /tmp/gh-aw/agent-step-summary.md
958
+ GITHUB_WORKSPACE: ${{ github.workspace }}
959
+ GIT_AUTHOR_EMAIL: github-actions[bot]@users.noreply.github.com
960
+ GIT_AUTHOR_NAME: github-actions[bot]
961
+ GIT_COMMITTER_EMAIL: github-actions[bot]@users.noreply.github.com
962
+ GIT_COMMITTER_NAME: github-actions[bot]
963
+ RUNNER_TEMP: ${{ runner.temp }}
964
+ TRACEPARENT: ${{ env.GITHUB_AW_OTEL_TRACE_ID != '' && env.GITHUB_AW_OTEL_PARENT_SPAN_ID != '' && format('00-{0}-{1}-01', env.GITHUB_AW_OTEL_TRACE_ID, env.GITHUB_AW_OTEL_PARENT_SPAN_ID) || '' }}
965
+ - name: Detect agent errors
966
+ if: always()
967
+ id: detect-agent-errors
968
+ continue-on-error: true
969
+ run: node "${RUNNER_TEMP}/gh-aw/actions/detect_agent_errors.cjs"
970
+ - name: Configure Git credentials
971
+ env:
972
+ GITHUB_REPOSITORY: ${{ github.repository }}
973
+ GITHUB_SERVER_URL: ${{ github.server_url }}
974
+ GITHUB_TOKEN: ${{ github.token }}
975
+ run: bash "${RUNNER_TEMP}/gh-aw/actions/configure_git_credentials.sh"
976
+ - name: Copy Copilot session state files to logs
977
+ if: always()
978
+ continue-on-error: true
979
+ run: bash "${RUNNER_TEMP}/gh-aw/actions/copy_copilot_session_state.sh"
980
+ - name: Stop MCP Gateway
981
+ if: always()
982
+ continue-on-error: true
983
+ env:
984
+ MCP_GATEWAY_PORT: ${{ steps.start-mcp-gateway.outputs.gateway-port }}
985
+ MCP_GATEWAY_API_KEY: ${{ steps.start-mcp-gateway.outputs.gateway-api-key }}
986
+ GATEWAY_PID: ${{ steps.start-mcp-gateway.outputs.gateway-pid }}
987
+ run: |
988
+ bash "${RUNNER_TEMP}/gh-aw/actions/stop_mcp_gateway.sh" "$GATEWAY_PID"
989
+ - name: Redact secrets in logs
990
+ if: always()
991
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
992
+ with:
993
+ script: |
994
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
995
+ setupGlobals(core, github, context, exec, io, getOctokit);
996
+ const { main } = require('${{ runner.temp }}/gh-aw/actions/redact_secrets.cjs');
997
+ await main();
998
+ env:
999
+ GH_AW_SECRET_NAMES: 'COPILOT_GITHUB_TOKEN,GH_AW_GITHUB_MCP_SERVER_TOKEN,GH_AW_GITHUB_TOKEN,GITHUB_TOKEN'
1000
+ SECRET_COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
1001
+ SECRET_GH_AW_GITHUB_MCP_SERVER_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN }}
1002
+ SECRET_GH_AW_GITHUB_TOKEN: ${{ secrets.GH_AW_GITHUB_TOKEN }}
1003
+ SECRET_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
1004
+ - name: Append agent step summary
1005
+ if: always()
1006
+ run: bash "${RUNNER_TEMP}/gh-aw/actions/append_agent_step_summary.sh"
1007
+ - name: Copy Safe Outputs
1008
+ if: always()
1009
+ env:
1010
+ GH_AW_SAFE_OUTPUTS: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS }}
1011
+ run: |
1012
+ mkdir -p /tmp/gh-aw
1013
+ cp "$GH_AW_SAFE_OUTPUTS" /tmp/gh-aw/safeoutputs.jsonl 2>/dev/null || true
1014
+ - name: Ingest agent output
1015
+ id: collect_output
1016
+ if: always()
1017
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
1018
+ env:
1019
+ GH_AW_SAFE_OUTPUTS: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS }}
1020
+ GH_AW_ALLOWED_DOMAINS: "api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,github.com,host.docker.internal,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,ppa.launchpad.net,raw.githubusercontent.com,registry.npmjs.org,s.symcb.com,s.symcd.com,security.ubuntu.com,telemetry.enterprise.githubcopilot.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com,www.googleapis.com"
1021
+ GITHUB_SERVER_URL: ${{ github.server_url }}
1022
+ GITHUB_API_URL: ${{ github.api_url }}
1023
+ with:
1024
+ script: |
1025
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
1026
+ setupGlobals(core, github, context, exec, io, getOctokit);
1027
+ const { main } = require('${{ runner.temp }}/gh-aw/actions/collect_ndjson_output.cjs');
1028
+ await main();
1029
+ - name: Parse agent logs for step summary
1030
+ if: always()
1031
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
1032
+ env:
1033
+ GH_AW_AGENT_OUTPUT: /tmp/gh-aw/sandbox/agent/logs/
1034
+ GH_AW_SAFE_OUTPUTS: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS }}
1035
+ with:
1036
+ script: |
1037
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
1038
+ setupGlobals(core, github, context, exec, io, getOctokit);
1039
+ const { main } = require('${{ runner.temp }}/gh-aw/actions/parse_copilot_log.cjs');
1040
+ await main();
1041
+ - name: Parse MCP Gateway logs for step summary
1042
+ if: always()
1043
+ id: parse-mcp-gateway
1044
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
1045
+ with:
1046
+ script: |
1047
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
1048
+ setupGlobals(core, github, context, exec, io, getOctokit);
1049
+ const { main } = require('${{ runner.temp }}/gh-aw/actions/parse_mcp_gateway_log.cjs');
1050
+ await main();
1051
+ - name: Print firewall logs
1052
+ if: always()
1053
+ continue-on-error: true
1054
+ env:
1055
+ AWF_LOGS_DIR: /tmp/gh-aw/sandbox/firewall/logs
1056
+ run: bash "${RUNNER_TEMP}/gh-aw/actions/print_firewall_logs.sh" --rootless
1057
+ - name: Parse token usage for step summary
1058
+ if: always()
1059
+ continue-on-error: true
1060
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
1061
+ with:
1062
+ script: |
1063
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
1064
+ setupGlobals(core, github, context, exec, io, getOctokit);
1065
+ const { main } = require('${{ runner.temp }}/gh-aw/actions/parse_token_usage.cjs');
1066
+ await main();
1067
+ - name: Print AWF reflect summary
1068
+ if: always()
1069
+ continue-on-error: true
1070
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
1071
+ with:
1072
+ script: |
1073
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
1074
+ setupGlobals(core, github, context, exec, io, getOctokit);
1075
+ const { main } = require('${{ runner.temp }}/gh-aw/actions/awf_reflect_summary.cjs');
1076
+ await main();
1077
+ - name: Write agent output placeholder if missing
1078
+ if: always()
1079
+ run: |
1080
+ if [ ! -f /tmp/gh-aw/agent_output.json ]; then
1081
+ echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
1082
+ fi
1083
+ - name: Upload agent artifacts
1084
+ if: always()
1085
+ continue-on-error: true
1086
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
1087
+ with:
1088
+ name: agent
1089
+ path: |
1090
+ /tmp/gh-aw/aw-prompts/prompt.txt
1091
+ /tmp/gh-aw/sandbox/agent/logs/
1092
+ /tmp/gh-aw/redacted-urls.log
1093
+ /tmp/gh-aw/mcp-logs/
1094
+ /tmp/gh-aw/proxy-logs/
1095
+ !/tmp/gh-aw/proxy-logs/proxy-tls/
1096
+ /tmp/gh-aw/agent_usage.json
1097
+ /tmp/gh-aw/agent-stdio.log
1098
+ /tmp/gh-aw/pre-agent-audit.txt
1099
+ /tmp/gh-aw/agent/
1100
+ /tmp/gh-aw/github_rate_limits.jsonl
1101
+ /tmp/gh-aw/safeoutputs.jsonl
1102
+ /tmp/gh-aw/agent_output.json
1103
+ /tmp/gh-aw/aw-*.patch
1104
+ /tmp/gh-aw/aw-*.bundle
1105
+ /tmp/gh-aw/awf-config.json
1106
+ /tmp/gh-aw/sandbox/firewall/logs/
1107
+ /tmp/gh-aw/sandbox/firewall/audit/
1108
+ /tmp/gh-aw/sandbox/firewall/awf-reflect.json
1109
+ if-no-files-found: ignore
1110
+
1111
+ conclusion:
1112
+ needs:
1113
+ - activation
1114
+ - agent
1115
+ - detection
1116
+ - safe_outputs
1117
+ if: >
1118
+ always() && (needs.agent.result != 'skipped' || needs.activation.outputs.lockdown_check_failed == 'true' ||
1119
+ needs.activation.outputs.oauth_token_check_failed == 'true' || needs.activation.outputs.stale_lock_file_failed == 'true' ||
1120
+ needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
1121
+ runs-on: ubuntu-slim
1122
+ permissions:
1123
+ contents: read
1124
+ issues: write
1125
+ pull-requests: write
1126
+ concurrency:
1127
+ group: "gh-aw-conclusion-issue-triage"
1128
+ cancel-in-progress: false
1129
+ queue: max
1130
+ env:
1131
+ GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }}
1132
+ outputs:
1133
+ incomplete_count: ${{ steps.report_incomplete.outputs.incomplete_count }}
1134
+ noop_message: ${{ steps.noop.outputs.noop_message }}
1135
+ tools_reported: ${{ steps.missing_tool.outputs.tools_reported }}
1136
+ total_count: ${{ steps.missing_tool.outputs.total_count }}
1137
+ steps:
1138
+ - name: Setup Scripts
1139
+ id: setup
1140
+ uses: github/gh-aw-actions/setup@8bdba8075360648fe6802302a5b4e016361dc6ac # v0.83.1
1141
+ with:
1142
+ destination: ${{ runner.temp }}/gh-aw/actions
1143
+ job-name: ${{ github.job }}
1144
+ trace-id: ${{ needs.activation.outputs.setup-trace-id }}
1145
+ parent-span-id: ${{ needs.activation.outputs.setup-parent-span-id || needs.activation.outputs.setup-span-id }}
1146
+ env:
1147
+ GH_AW_SETUP_WORKFLOW_NAME: "Issue triage"
1148
+ GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/issue-triage.lock.yml@${{ github.ref }}
1149
+ GH_AW_INFO_VERSION: "1.0.73"
1150
+ GH_AW_INFO_AWF_VERSION: "v0.27.38"
1151
+ GH_AW_INFO_ENGINE_ID: "copilot"
1152
+ - name: Download agent output artifact
1153
+ id: download-agent-output
1154
+ continue-on-error: true
1155
+ uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
1156
+ with:
1157
+ name: agent
1158
+ path: /tmp/gh-aw/
1159
+ - name: Setup agent output environment variable
1160
+ id: setup-agent-output-env
1161
+ if: steps.download-agent-output.outcome == 'success'
1162
+ run: |
1163
+ mkdir -p /tmp/gh-aw/
1164
+ find "/tmp/gh-aw/" -type f -print
1165
+ echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT"
1166
+ - name: Download safe outputs items manifest
1167
+ id: download-safe-outputs-manifest
1168
+ if: always()
1169
+ continue-on-error: true
1170
+ uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
1171
+ with:
1172
+ name: safe-outputs-items
1173
+ path: /tmp/gh-aw/
1174
+ - name: Collect usage artifact files
1175
+ if: always()
1176
+ continue-on-error: true
1177
+ run: |
1178
+ mkdir -p /tmp/gh-aw/usage/agent /tmp/gh-aw/usage/detection
1179
+ echo "Usage artifact source file status:"
1180
+ for file in /tmp/gh-aw/aw_info.json /tmp/gh-aw/aw-info.jsonl /tmp/gh-aw/agent_usage.json /tmp/gh-aw/agent_usage.jsonl /tmp/gh-aw/detection_usage.jsonl /tmp/gh-aw/evals/evals.jsonl /tmp/gh-aw/github_rate_limits.jsonl /tmp/gh-aw/sandbox/firewall-audit-logs/api-proxy-logs/token-usage.jsonl /tmp/gh-aw/sandbox/firewall/logs/api-proxy-logs/token-usage.jsonl /tmp/gh-aw/sandbox/firewall/audit/api-proxy-logs/token-usage.jsonl /tmp/gh-aw/threat-detection/sandbox/firewall-audit-logs/api-proxy-logs/token-usage.jsonl /tmp/gh-aw/threat-detection/sandbox/firewall/logs/api-proxy-logs/token-usage.jsonl /tmp/gh-aw/threat-detection/sandbox/firewall/audit/api-proxy-logs/token-usage.jsonl; do
1181
+ [ -f "$file" ] && echo "FOUND: $file" || echo "MISSING: $file"
1182
+ done
1183
+ [ -f /tmp/gh-aw/aw_info.json ] && cp /tmp/gh-aw/aw_info.json /tmp/gh-aw/usage/aw_info.json || true
1184
+ [ -f /tmp/gh-aw/aw-info.jsonl ] && cp /tmp/gh-aw/aw-info.jsonl /tmp/gh-aw/usage/aw-info.jsonl || true
1185
+ [ -f /tmp/gh-aw/agent_usage.json ] && cp /tmp/gh-aw/agent_usage.json /tmp/gh-aw/usage/agent_usage.json || true
1186
+ [ -f /tmp/gh-aw/agent_usage.jsonl ] && cp /tmp/gh-aw/agent_usage.jsonl /tmp/gh-aw/usage/agent_usage.jsonl || true
1187
+ [ -f /tmp/gh-aw/detection_usage.jsonl ] && cp /tmp/gh-aw/detection_usage.jsonl /tmp/gh-aw/usage/detection_usage.jsonl || true
1188
+ [ -f /tmp/gh-aw/evals/evals.jsonl ] && cp /tmp/gh-aw/evals/evals.jsonl /tmp/gh-aw/usage/evals.jsonl || true
1189
+ [ -f /tmp/gh-aw/github_rate_limits.jsonl ] && cp /tmp/gh-aw/github_rate_limits.jsonl /tmp/gh-aw/usage/github_rate_limits.jsonl || true
1190
+ [ -s /tmp/gh-aw/sandbox/firewall-audit-logs/api-proxy-logs/token-usage.jsonl ] && cp /tmp/gh-aw/sandbox/firewall-audit-logs/api-proxy-logs/token-usage.jsonl /tmp/gh-aw/usage/agent/token_usage.jsonl || true
1191
+ [ -s /tmp/gh-aw/sandbox/firewall/audit/api-proxy-logs/token-usage.jsonl ] && cp /tmp/gh-aw/sandbox/firewall/audit/api-proxy-logs/token-usage.jsonl /tmp/gh-aw/usage/agent/token_usage.jsonl || true
1192
+ [ -s /tmp/gh-aw/sandbox/firewall/logs/api-proxy-logs/token-usage.jsonl ] && cp /tmp/gh-aw/sandbox/firewall/logs/api-proxy-logs/token-usage.jsonl /tmp/gh-aw/usage/agent/token_usage.jsonl || true
1193
+ [ -s /tmp/gh-aw/threat-detection/sandbox/firewall-audit-logs/api-proxy-logs/token-usage.jsonl ] && cp /tmp/gh-aw/threat-detection/sandbox/firewall-audit-logs/api-proxy-logs/token-usage.jsonl /tmp/gh-aw/usage/detection/token_usage.jsonl || true
1194
+ [ -s /tmp/gh-aw/threat-detection/sandbox/firewall/audit/api-proxy-logs/token-usage.jsonl ] && cp /tmp/gh-aw/threat-detection/sandbox/firewall/audit/api-proxy-logs/token-usage.jsonl /tmp/gh-aw/usage/detection/token_usage.jsonl || true
1195
+ [ -s /tmp/gh-aw/threat-detection/sandbox/firewall/logs/api-proxy-logs/token-usage.jsonl ] && cp /tmp/gh-aw/threat-detection/sandbox/firewall/logs/api-proxy-logs/token-usage.jsonl /tmp/gh-aw/usage/detection/token_usage.jsonl || true
1196
+ [ -f /tmp/gh-aw/usage/agent/token_usage.jsonl ] || : > /tmp/gh-aw/usage/agent/token_usage.jsonl
1197
+ [ -f /tmp/gh-aw/usage/detection/token_usage.jsonl ] || : > /tmp/gh-aw/usage/detection/token_usage.jsonl
1198
+ mkdir -p /tmp/gh-aw/usage/activity
1199
+ node "${RUNNER_TEMP}/gh-aw/actions/generate_usage_activity_summary.cjs"
1200
+ find /tmp/gh-aw/usage -type f -print | sort
1201
+ - name: Upload usage artifact
1202
+ if: always()
1203
+ continue-on-error: true
1204
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
1205
+ with:
1206
+ name: usage
1207
+ path: |
1208
+ /tmp/gh-aw/usage/aw_info.json
1209
+ /tmp/gh-aw/usage/aw-info.jsonl
1210
+ /tmp/gh-aw/usage/agent_usage.json
1211
+ /tmp/gh-aw/usage/agent_usage.jsonl
1212
+ /tmp/gh-aw/usage/detection_usage.jsonl
1213
+ /tmp/gh-aw/usage/evals.jsonl
1214
+ /tmp/gh-aw/usage/github_rate_limits.jsonl
1215
+ /tmp/gh-aw/usage/agent/token_usage.jsonl
1216
+ /tmp/gh-aw/usage/detection/token_usage.jsonl
1217
+ /tmp/gh-aw/usage/activity/summary.json
1218
+ if-no-files-found: ignore
1219
+ - name: Restore daily AIC usage cache
1220
+ id: restore-daily-aic-cache-conclusion
1221
+ if: always()
1222
+ continue-on-error: true
1223
+ uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
1224
+ with:
1225
+ key: agentic-workflow-usage-issuetriage-${{ github.run_id }}
1226
+ restore-keys: agentic-workflow-usage-issuetriage-
1227
+ path: /tmp/gh-aw/agentic-workflow-usage-cache.jsonl
1228
+ - name: Write daily AIC usage cache entry
1229
+ id: write-daily-aic-cache
1230
+ if: always()
1231
+ continue-on-error: true
1232
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
1233
+ with:
1234
+ github-token: ${{ github.token }}
1235
+ script: |
1236
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
1237
+ setupGlobals(core, github, context);
1238
+ const { main } = require('${{ runner.temp }}/gh-aw/actions/write_daily_aic_usage_cache.cjs');
1239
+ await main();
1240
+ - name: Save daily AIC usage cache
1241
+ id: save-daily-aic-cache
1242
+ if: always()
1243
+ continue-on-error: true
1244
+ uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
1245
+ with:
1246
+ key: agentic-workflow-usage-issuetriage-${{ github.run_id }}
1247
+ path: /tmp/gh-aw/agentic-workflow-usage-cache.jsonl
1248
+ - name: Upload daily AIC usage cache artifact
1249
+ id: upload-daily-aic-cache
1250
+ if: always()
1251
+ continue-on-error: true
1252
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
1253
+ with:
1254
+ name: aic-usage-cache
1255
+ path: /tmp/gh-aw/agentic-workflow-usage-cache.jsonl
1256
+ if-no-files-found: ignore
1257
+ retention-days: 7
1258
+ - name: Process no-op messages
1259
+ id: noop
1260
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
1261
+ env:
1262
+ GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }}
1263
+ GH_AW_NOOP_MAX: "1"
1264
+ GH_AW_WORKFLOW_NAME: "Issue triage"
1265
+ GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/${{ github.repository }}/blob/${{ github.ref_name }}/.github/workflows/issue-triage.md"
1266
+ GH_AW_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
1267
+ GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }}
1268
+ GH_AW_NOOP_REPORT_AS_ISSUE: "true"
1269
+ GH_AW_AIC: ${{ needs.agent.outputs.aic }}
1270
+ GH_AW_THREAT_DETECTION_AIC: ${{ needs.detection.outputs.aic }}
1271
+ GH_AW_AMBIENT_CONTEXT: ${{ needs.agent.outputs.ambient_context }}
1272
+ GH_AW_WORKFLOW_ID: "issue-triage"
1273
+ with:
1274
+ github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
1275
+ script: |
1276
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
1277
+ setupGlobals(core, github, context, exec, io, getOctokit);
1278
+ const { main } = require('${{ runner.temp }}/gh-aw/actions/handle_noop_message.cjs');
1279
+ await main();
1280
+ - name: Log detection run
1281
+ id: detection_runs
1282
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
1283
+ env:
1284
+ GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }}
1285
+ GH_AW_WORKFLOW_NAME: "Issue triage"
1286
+ GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/${{ github.repository }}/blob/${{ github.ref_name }}/.github/workflows/issue-triage.md"
1287
+ GH_AW_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
1288
+ GH_AW_DETECTION_CONCLUSION: ${{ needs.detection.outputs.detection_conclusion }}
1289
+ GH_AW_DETECTION_REASON: ${{ needs.detection.outputs.detection_reason }}
1290
+ with:
1291
+ github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
1292
+ script: |
1293
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
1294
+ setupGlobals(core, github, context, exec, io, getOctokit);
1295
+ const { main } = require('${{ runner.temp }}/gh-aw/actions/handle_detection_runs.cjs');
1296
+ await main();
1297
+ - name: Record missing tool
1298
+ id: missing_tool
1299
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
1300
+ env:
1301
+ GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }}
1302
+ GH_AW_MISSING_TOOL_CREATE_ISSUE: "true"
1303
+ GH_AW_WORKFLOW_NAME: "Issue triage"
1304
+ GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/${{ github.repository }}/blob/${{ github.ref_name }}/.github/workflows/issue-triage.md"
1305
+ with:
1306
+ github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
1307
+ script: |
1308
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
1309
+ setupGlobals(core, github, context, exec, io, getOctokit);
1310
+ const { main } = require('${{ runner.temp }}/gh-aw/actions/missing_tool.cjs');
1311
+ await main();
1312
+ - name: Record incomplete
1313
+ id: report_incomplete
1314
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
1315
+ env:
1316
+ GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }}
1317
+ GH_AW_REPORT_INCOMPLETE_CREATE_ISSUE: "true"
1318
+ GH_AW_WORKFLOW_NAME: "Issue triage"
1319
+ GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/${{ github.repository }}/blob/${{ github.ref_name }}/.github/workflows/issue-triage.md"
1320
+ with:
1321
+ github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
1322
+ script: |
1323
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
1324
+ setupGlobals(core, github, context, exec, io, getOctokit);
1325
+ const { main } = require('${{ runner.temp }}/gh-aw/actions/report_incomplete_handler.cjs');
1326
+ await main();
1327
+ - name: Handle agent failure
1328
+ id: handle_agent_failure
1329
+ if: always()
1330
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
1331
+ env:
1332
+ GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }}
1333
+ GH_AW_WORKFLOW_NAME: "Issue triage"
1334
+ GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/${{ github.repository }}/blob/${{ github.ref_name }}/.github/workflows/issue-triage.md"
1335
+ GH_AW_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
1336
+ GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }}
1337
+ GH_AW_WORKFLOW_ID: "issue-triage"
1338
+ GH_AW_ACTION_FAILURE_ISSUE_EXPIRES_HOURS: "168"
1339
+ GH_AW_ENGINE_ID: "copilot"
1340
+ GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
1341
+ GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
1342
+ GH_AW_EFFECTIVE_TOKENS: ${{ needs.agent.outputs.effective_tokens || '' }}
1343
+ GH_AW_AI_CREDITS_RATE_LIMIT_ERROR: ${{ needs.agent.outputs.ai_credits_rate_limit_error || 'false' }}
1344
+ GH_AW_UNKNOWN_MODEL_AI_CREDITS: ${{ needs.agent.outputs.unknown_model_ai_credits || 'false' }}
1345
+ GH_AW_AIC: ${{ needs.agent.outputs.aic }}
1346
+ GH_AW_THREAT_DETECTION_AIC: ${{ needs.detection.outputs.aic }}
1347
+ GH_AW_MAX_AI_CREDITS: ${{ vars.GH_AW_DEFAULT_MAX_AI_CREDITS || '1000' }}
1348
+ GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
1349
+ GH_AW_MCP_POLICY_ERROR: ${{ needs.agent.outputs.mcp_policy_error }}
1350
+ GH_AW_AGENTIC_ENGINE_TIMEOUT: ${{ needs.agent.outputs.agentic_engine_timeout }}
1351
+ GH_AW_MODEL_NOT_SUPPORTED_ERROR: ${{ needs.agent.outputs.model_not_supported_error }}
1352
+ GH_AW_HTTP_400_RESPONSE_ERROR: ${{ needs.agent.outputs.http_400_response_error }}
1353
+ GH_AW_ENGINE_API_HOSTS: "api.enterprise.githubcopilot.com,api.githubcopilot.com,api.business.githubcopilot.com,api.individual.githubcopilot.com"
1354
+ GH_AW_ASSIGNMENT_ERRORS: ${{ needs.safe_outputs.outputs.assign_to_agent_assignment_errors }}
1355
+ GH_AW_ASSIGNMENT_ERROR_COUNT: ${{ needs.safe_outputs.outputs.assign_to_agent_assignment_error_count }}
1356
+ GH_AW_LOCKDOWN_CHECK_FAILED: ${{ needs.activation.outputs.lockdown_check_failed }}
1357
+ GH_AW_OAUTH_TOKEN_CHECK_FAILED: ${{ needs.activation.outputs.oauth_token_check_failed }}
1358
+ GH_AW_STALE_LOCK_FILE_FAILED: ${{ needs.activation.outputs.stale_lock_file_failed }}
1359
+ GH_AW_DAILY_AI_CREDITS_EXCEEDED: ${{ needs.activation.outputs.daily_ai_credits_exceeded }}
1360
+ GH_AW_DAILY_AI_CREDITS_TOTAL_EFFECTIVE_TOKENS: ${{ needs.activation.outputs.daily_ai_credits_total_effective_tokens }}
1361
+ GH_AW_DAILY_AI_CREDITS_THRESHOLD: ${{ needs.activation.outputs.daily_ai_credits_threshold }}
1362
+ GH_AW_GROUP_REPORTS: "false"
1363
+ GH_AW_FAILURE_REPORT_AS_ISSUE: "true"
1364
+ GH_AW_MISSING_TOOL_REPORT_AS_FAILURE: "true"
1365
+ GH_AW_MISSING_DATA_REPORT_AS_FAILURE: "true"
1366
+ GH_AW_TIMEOUT_MINUTES: "15"
1367
+ with:
1368
+ github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
1369
+ script: |
1370
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
1371
+ setupGlobals(core, github, context, exec, io, getOctokit);
1372
+ const { main } = require('${{ runner.temp }}/gh-aw/actions/handle_agent_failure.cjs');
1373
+ await main();
1374
+
1375
+ detection:
1376
+ needs:
1377
+ - activation
1378
+ - agent
1379
+ if: always() && needs.agent.result != 'skipped'
1380
+ runs-on: ubuntu-latest
1381
+ permissions:
1382
+ contents: read
1383
+ env:
1384
+ GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }}
1385
+ outputs:
1386
+ aic: ${{ steps.parse_detection_token_usage.outputs.aic }}
1387
+ detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
1388
+ detection_reason: ${{ steps.detection_conclusion.outputs.reason }}
1389
+ detection_success: ${{ steps.detection_conclusion.outputs.success }}
1390
+ steps:
1391
+ - name: Setup Scripts
1392
+ id: setup
1393
+ uses: github/gh-aw-actions/setup@8bdba8075360648fe6802302a5b4e016361dc6ac # v0.83.1
1394
+ with:
1395
+ destination: ${{ runner.temp }}/gh-aw/actions
1396
+ job-name: ${{ github.job }}
1397
+ trace-id: ${{ needs.activation.outputs.setup-trace-id }}
1398
+ parent-span-id: ${{ needs.activation.outputs.setup-parent-span-id || needs.activation.outputs.setup-span-id }}
1399
+ env:
1400
+ GH_AW_SETUP_WORKFLOW_NAME: "Issue triage"
1401
+ GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/issue-triage.lock.yml@${{ github.ref }}
1402
+ GH_AW_INFO_VERSION: "1.0.73"
1403
+ GH_AW_INFO_AWF_VERSION: "v0.27.38"
1404
+ GH_AW_INFO_ENGINE_ID: "copilot"
1405
+ - name: Download agent output artifact
1406
+ id: download-agent-output
1407
+ continue-on-error: true
1408
+ uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
1409
+ with:
1410
+ name: agent
1411
+ path: /tmp/gh-aw/
1412
+ - name: Setup agent output environment variable
1413
+ id: setup-agent-output-env
1414
+ if: steps.download-agent-output.outcome == 'success'
1415
+ run: |
1416
+ mkdir -p /tmp/gh-aw/
1417
+ find "/tmp/gh-aw/" -type f -print
1418
+ echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT"
1419
+ - name: Checkout repository for patch context
1420
+ if: needs.agent.outputs.has_patch == 'true'
1421
+ uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
1422
+ with:
1423
+ persist-credentials: false
1424
+ # --- Threat Detection ---
1425
+ - name: Clean stale firewall files from agent artifact
1426
+ run: |
1427
+ rm -rf /tmp/gh-aw/sandbox/firewall/logs
1428
+ rm -rf /tmp/gh-aw/sandbox/firewall/audit
1429
+ - name: Download container images
1430
+ run: bash "${RUNNER_TEMP}/gh-aw/actions/download_docker_images.sh" ghcr.io/github/gh-aw-firewall/agent:0.27.38@sha256:cb928eb62d9139a013c2d278dab19af232d35a2d83dca71a3d98eb431f786243 ghcr.io/github/gh-aw-firewall/api-proxy:0.27.38@sha256:cd6145620d96acee46e1ede25180a13aa36002467e663db0caa453a8bc8eb60c ghcr.io/github/gh-aw-firewall/squid:0.27.38@sha256:6c19094d95aad5f9f128ad5e583f0f2b894b158aa66c3b86dd9bcc90970a2917
1431
+ - name: Check if detection needed
1432
+ id: detection_guard
1433
+ if: always()
1434
+ env:
1435
+ OUTPUT_TYPES: ${{ needs.agent.outputs.output_types }}
1436
+ HAS_PATCH: ${{ needs.agent.outputs.has_patch }}
1437
+ run: |
1438
+ if [[ -n "$OUTPUT_TYPES" || "$HAS_PATCH" == "true" ]]; then
1439
+ echo "run_detection=true" >> "$GITHUB_OUTPUT"
1440
+ echo "Detection will run: output_types=$OUTPUT_TYPES, has_patch=$HAS_PATCH"
1441
+ else
1442
+ echo "run_detection=false" >> "$GITHUB_OUTPUT"
1443
+ echo "Detection skipped: no agent outputs or patches to analyze"
1444
+ fi
1445
+ - name: Clear MCP Config for detection
1446
+ if: always() && steps.detection_guard.outputs.run_detection == 'true'
1447
+ run: |
1448
+ rm -f "${RUNNER_TEMP}/gh-aw/mcp-config/mcp-servers.json"
1449
+ rm -f "$HOME/.copilot/mcp-config.json"
1450
+ rm -f "$GITHUB_WORKSPACE/.gemini/settings.json"
1451
+ - name: Prepare threat detection files
1452
+ if: always() && steps.detection_guard.outputs.run_detection == 'true'
1453
+ run: |
1454
+ mkdir -p /tmp/gh-aw/threat-detection/aw-prompts
1455
+ rm -f /tmp/gh-aw/agent_usage.json
1456
+ cp /tmp/gh-aw/aw-prompts/prompt.txt /tmp/gh-aw/threat-detection/aw-prompts/prompt.txt 2>/dev/null || true
1457
+ if [ ! -s /tmp/gh-aw/threat-detection/aw-prompts/prompt.txt ]; then
1458
+ echo "::warning::ERR_VALIDATION: Missing or empty detection context prompt at /tmp/gh-aw/threat-detection/aw-prompts/prompt.txt. Ensure the agent artifact includes /tmp/gh-aw/aw-prompts/prompt.txt. Detection will continue with fallback workflow context."
1459
+ fi
1460
+ cp /tmp/gh-aw/agent_output.json /tmp/gh-aw/threat-detection/agent_output.json 2>/dev/null || true
1461
+ for f in /tmp/gh-aw/aw-*.patch; do
1462
+ [ -f "$f" ] && cp "$f" /tmp/gh-aw/threat-detection/ 2>/dev/null || true
1463
+ done
1464
+ for f in /tmp/gh-aw/aw-*.bundle; do
1465
+ [ -f "$f" ] && cp "$f" /tmp/gh-aw/threat-detection/ 2>/dev/null || true
1466
+ done
1467
+ echo "Prepared threat detection files:"
1468
+ ls -la /tmp/gh-aw/threat-detection/ 2>/dev/null || true
1469
+ - name: Setup threat detection
1470
+ if: always() && steps.detection_guard.outputs.run_detection == 'true'
1471
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
1472
+ env:
1473
+ WORKFLOW_NAME: "Issue triage"
1474
+ WORKFLOW_DESCRIPTION: "Triage assistant for new and reopened issues in eslint-plugin-primer-react.\nReads the issue and its comments to classify the issue type when unset, apply\nrelevant existing labels, flag likely duplicates, ask for missing information\nonly when needed, and — when an issue is well-scoped and actionable — suggest\nassigning it to Copilot. Stays low-noise and never closes issues."
1475
+ HAS_PATCH: ${{ needs.agent.outputs.has_patch }}
1476
+ with:
1477
+ script: |
1478
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
1479
+ setupGlobals(core, github, context, exec, io, getOctokit);
1480
+ const { main } = require('${{ runner.temp }}/gh-aw/actions/setup_threat_detection.cjs');
1481
+ await main();
1482
+ - name: Ensure threat-detection directory and log
1483
+ if: always() && steps.detection_guard.outputs.run_detection == 'true'
1484
+ run: |
1485
+ mkdir -p /tmp/gh-aw/threat-detection
1486
+ touch /tmp/gh-aw/threat-detection/detection.log
1487
+ - name: Setup Node.js
1488
+ uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
1489
+ with:
1490
+ node-version: '24'
1491
+ package-manager-cache: false
1492
+ - name: Install GitHub Copilot CLI
1493
+ run: bash "${RUNNER_TEMP}/gh-aw/actions/install_copilot_cli.sh" 1.0.73
1494
+ env:
1495
+ GH_HOST: github.com
1496
+ - name: Install AWF binary
1497
+ run: bash "${RUNNER_TEMP}/gh-aw/actions/install_awf_binary.sh" v0.27.38
1498
+ - name: Execute GitHub Copilot CLI
1499
+ if: always() && steps.detection_guard.outputs.run_detection == 'true'
1500
+ continue-on-error: true
1501
+ id: detection_agentic_execution
1502
+ # Copilot CLI tool arguments (sorted):
1503
+ timeout-minutes: 20
1504
+ run: |
1505
+ set -o pipefail
1506
+ printf '%s' "$(date +%s%3N)" > /tmp/gh-aw/agent_cli_start_ms.txt
1507
+ trap 'gh_aw_exit_code=$?; mkdir -p /tmp/gh-aw >/dev/null 2>&1 || true; printf "%s" "$gh_aw_exit_code" > /tmp/gh-aw/agent_execution_exit_code.txt || true; rm -f "$HOME/.copilot/settings.json"' EXIT
1508
+ mkdir -p "$HOME/.copilot"
1509
+ printf '%s' '{"builtInAgents":{"rubberDuck":false}}' > "$HOME/.copilot/settings.json"
1510
+ export XDG_CONFIG_HOME="$HOME"
1511
+ touch /tmp/gh-aw/agent-step-summary.md
1512
+ GH_AW_NODE_BIN=$(command -v node 2>/dev/null || true)
1513
+ export GH_AW_NODE_BIN
1514
+ export COPILOT_API_KEY="$COPILOT_DUMMY_BYOK"
1515
+ (umask 177 && touch /tmp/gh-aw/threat-detection/detection.log)
1516
+ GH_AW_MAX_AI_CREDITS="${GH_AW_MAX_AI_CREDITS:-400}"
1517
+ printf '%s\n' "{\"\$schema\":\"https://github.com/github/gh-aw-firewall/releases/download/v0.27.38/awf-config.schema.json\",\"network\":{\"allowDomains\":[\"api.business.githubcopilot.com\",\"api.enterprise.githubcopilot.com\",\"api.github.com\",\"api.githubcopilot.com\",\"api.individual.githubcopilot.com\",\"github.com\",\"host.docker.internal\",\"registry.npmjs.org\",\"telemetry.enterprise.githubcopilot.com\"]},\"apiProxy\":{\"enabled\":true,\"enableTokenSteering\":true,\"maxRuns\":500,\"maxAiCredits\":${GH_AW_MAX_AI_CREDITS},\"maxCacheMisses\":5,\"models\":{\"agent\":[\"sonnet-6x\",\"gpt-5.4\",\"gpt-5.3\",\"gemini-pro\",\"any\"],\"antigravity\":[\"copilot/antigravity*\",\"google/antigravity*\",\"gemini/antigravity*\"],\"any\":[\"copilot/*\",\"anthropic/*\",\"openai/*\",\"google/*\",\"gemini/*\"],\"claude\":[\"agent\"],\"codex\":[\"agent\"],\"coding\":[\"copilot/gpt-5*codex*\",\"openai/gpt-5*codex*\",\"gpt-5-codex\",\"kimi\"],\"computer-use\":[\"copilot/*computer-use*\",\"google/*computer-use*\",\"gemini/*computer-use*\",\"openai/*computer-use*\"],\"copilot\":[\"agent\"],\"deep-research\":[\"copilot/deep-research*\",\"copilot/o3-deep-research*\",\"copilot/o4-mini-deep-research*\",\"google/deep-research*\",\"gemini/deep-research*\",\"openai/o3-deep-research*\",\"openai/o4-mini-deep-research*\"],\"fable\":[\"copilot/*fable*\",\"anthropic/*fable*\"],\"gemini\":[\"agent\"],\"gemini-3-flash\":[\"copilot/gemini-3*flash*\",\"google/gemini-3*flash*\",\"gemini/gemini-3*flash*\"],\"gemini-3-pro\":[\"copilot/gemini-3*pro*\",\"google/gemini-3*pro*\",\"google/nano-banana*\",\"gemini/gemini-3*pro*\"],\"gemini-3.1-flash\":[\"copilot/gemini-3.1*flash*\",\"google/gemini-3.1*flash*\",\"gemini/gemini-3.1*flash*\"],\"gemini-3.1-pro\":[\"copilot/gemini-3.1*pro*\",\"google/gemini-3.1*pro*\",\"gemini/gemini-3.1*pro*\"],\"gemini-3.5-flash\":[\"copilot/gemini-3.5*flash*\",\"google/gemini-3.5*flash*\",\"gemini/gemini-3.5*flash*\"],\"gemini-flash\":[\"copilot/gemini-*flash*\",\"google/gemini-*flash*\",\"gemini/gemini-*flash*\"],\"gemini-flash-lite\":[\"copilot/gemini-*flash*lite*\",\"google/gemini-*flash*lite*\",\"gemini/gemini-*flash*lite*\"],\"gemini-omni\":[\"copilot/gemini-omni*\",\"google/gemini-omni*\",\"gemini/gemini-omni*\"],\"gemini-pro\":[\"copilot/gemini-*pro*\",\"google/gemini-*pro*\",\"gemini/gemini-*pro*\"],\"gemma\":[\"copilot/gemma*\",\"google/gemma*\",\"gemini/gemma*\"],\"gpt-5\":[\"copilot/gpt-5*\",\"openai/gpt-5*\"],\"gpt-5-codex\":[\"copilot/gpt-5*codex*\",\"openai/gpt-5*codex*\"],\"gpt-5-mini\":[\"copilot/gpt-5*mini*\",\"openai/gpt-5*mini*\"],\"gpt-5-nano\":[\"copilot/gpt-5*nano*\",\"openai/gpt-5*nano*\"],\"gpt-5-pro\":[\"copilot/gpt-5*pro*\",\"openai/gpt-5*pro*\"],\"gpt-5.1\":[\"copilot/gpt-5.1*\",\"openai/gpt-5.1*\"],\"gpt-5.2\":[\"copilot/gpt-5.2*\",\"openai/gpt-5.2*\"],\"gpt-5.3\":[\"copilot/gpt-5.3*\",\"openai/gpt-5.3*\"],\"gpt-5.4\":[\"copilot/gpt-5.4*\",\"openai/gpt-5.4*\"],\"gpt-5.5\":[\"copilot/gpt-5.5*\",\"openai/gpt-5.5*\"],\"gpt-5.6\":[\"copilot/gpt-5.6*\",\"openai/gpt-5.6*\"],\"haiku\":[\"copilot/*haiku*\",\"anthropic/*haiku*\"],\"image-generation\":[\"copilot/gpt-image*\",\"openai/gpt-image*\",\"openai/chatgpt-image*\",\"copilot/gemini-*image*\",\"google/gemini-*image*\",\"gemini/gemini-*image*\",\"google/imagen*\"],\"kimi\":[\"copilot/kimi*\",\"openai/kimi*\"],\"kiwi\":[\"copilot/kiwi*\",\"openai/kiwi*\"],\"large\":[\"fable\",\"sonnet\",\"gpt-5-pro\",\"gpt-5\",\"gemini-pro\"],\"lyria\":[\"google/lyria*\",\"gemini/lyria*\",\"copilot/lyria*\"],\"mai-code\":[\"copilot/MAI-Code*\",\"copilot/mai-code*\",\"openai/MAI-Code*\"],\"mai-code-1-flash-picker\":[\"copilot/MAI-Code-1-Flash-picker*\",\"copilot/mai-code-1-flash-picker*\",\"openai/MAI-Code-1-Flash-picker*\"],\"mini\":[\"haiku\",\"gpt-5-mini\",\"gpt-5-nano\",\"gemini-flash-lite\"],\"nano-banana\":[\"copilot/nano-banana*\",\"google/nano-banana*\",\"gemini/nano-banana*\"],\"opus\":[\"copilot/*opus*\",\"anthropic/*opus*\"],\"opusplan\":[\"opus?effort=high\"],\"raptor-mini\":[\"copilot/raptor*\",\"openai/raptor*\"],\"reasoning\":[\"copilot/o1*\",\"copilot/o3*\",\"copilot/o4*\",\"openai/o1*\",\"openai/o3*\",\"openai/o4*\"],\"robotics\":[\"copilot/*robotics*\",\"google/*robotics*\",\"gemini/*robotics*\"],\"small\":[\"mini\"],\"small-agent\":[\"haiku\",\"gpt-5-mini\",\"gemini-flash\"],\"sonnet\":[\"copilot/*sonnet*\",\"anthropic/*sonnet*\"],\"sonnet-6x\":[\"copilot/*sonnet-4.5*\",\"copilot/*sonnet-4.6*\",\"copilot/*sonnet-5*\",\"copilot/*sonnet-4-5-*\",\"anthropic/*sonnet-4-5-*\",\"copilot/*sonnet-4-6*\",\"anthropic/*sonnet-4-6*\",\"anthropic/*sonnet-5*\"],\"summarization\":[\"haiku\",\"gpt-5-mini\",\"gemini-flash-lite\",\"mini\"],\"veo\":[\"google/veo*\",\"gemini/veo*\"],\"vision\":[\"copilot/gemini-*image*\",\"google/gemini-*image*\",\"gemini/gemini-*image*\",\"copilot/gemini-*flash*\",\"google/gemini-*flash*\",\"gemini/gemini-*flash*\"]}},\"container\":{\"imageTag\":\"0.27.38,squid=sha256:6c19094d95aad5f9f128ad5e583f0f2b894b158aa66c3b86dd9bcc90970a2917,agent=sha256:cb928eb62d9139a013c2d278dab19af232d35a2d83dca71a3d98eb431f786243,api-proxy=sha256:cd6145620d96acee46e1ede25180a13aa36002467e663db0caa453a8bc8eb60c,cli-proxy=sha256:c30c5319da37505d42f95cb3faa2cfa55e794ccb5cc805dbd9201410d1ac2a3e\"},\"logging\":{\"proxyLogsDir\":\"/tmp/gh-aw/sandbox/firewall/logs\",\"auditDir\":\"/tmp/gh-aw/sandbox/firewall/audit\"}}" > "${RUNNER_TEMP}/gh-aw/awf-config.json"
1518
+ cp "${RUNNER_TEMP}/gh-aw/awf-config.json" /tmp/gh-aw/awf-config.json
1519
+ export GH_AW_MODELS_JSON_PATH="/tmp/gh-aw/models.json"
1520
+ GH_AW_DOCKER_HOST=""
1521
+ if [[ "${DOCKER_HOST:-}" =~ ^tcp:// ]]; then
1522
+ GH_AW_DOCKER_HOST="${DOCKER_HOST}"
1523
+ fi
1524
+ if [[ "${DOCKER_HOST:-}" =~ ^tcp:// ]]; then
1525
+ _GH_AW_CHROOT_JSON=$(jq -c --arg src "${RUNNER_TEMP}/gh-aw" --arg user "$(id -un)" --argjson uid "$(id -u)" --argjson gid "$(id -g)" --arg home "${RUNNER_TEMP}/gh-aw/home" '.chroot={"binariesSourcePath":$src,"identity":{"user":$user,"uid":$uid,"gid":$gid,"home":$home}}' "${RUNNER_TEMP}/gh-aw/awf-config.json") || { echo "chroot config patch failed" >&2; exit 1; }
1526
+ printf '%s\n' "$_GH_AW_CHROOT_JSON" > "${RUNNER_TEMP}/gh-aw/awf-config.json"
1527
+ printf '%s\n' "$_GH_AW_CHROOT_JSON" > "${RUNNER_TEMP}/gh-aw/awf-config.json"
1528
+ fi
1529
+ GH_AW_TOOL_CACHE_MOUNT=""
1530
+ GH_AW_TOOL_CACHE="${RUNNER_TOOL_CACHE:?RUNNER_TOOL_CACHE must be set}"
1531
+ if [ -d "$GH_AW_TOOL_CACHE" ]; then
1532
+ if [[ "$GH_AW_TOOL_CACHE" != /opt/* ]]; then
1533
+ GH_AW_TOOL_CACHE_MOUNT="$GH_AW_TOOL_CACHE:$GH_AW_TOOL_CACHE:ro"
1534
+ fi
1535
+ fi
1536
+ # shellcheck disable=SC1003,SC2016,SC2086
1537
+ awf --config "${RUNNER_TEMP}/gh-aw/awf-config.json" --container-workdir "${GITHUB_WORKSPACE}" --mount "${RUNNER_TEMP}/gh-aw:${RUNNER_TEMP}/gh-aw:ro" --mount "${RUNNER_TEMP}/gh-aw:/host${RUNNER_TEMP}/gh-aw:ro" ${GH_AW_TOOL_CACHE_MOUNT:+--mount "$GH_AW_TOOL_CACHE_MOUNT"} ${GH_AW_DOCKER_HOST:+--docker-host "$GH_AW_DOCKER_HOST"} --env-all --exclude-env COPILOT_GITHUB_TOKEN --log-level info --skip-pull \
1538
+ -- /bin/bash -c 'set +o histexpand; : "${RUNNER_TOOL_CACHE:?RUNNER_TOOL_CACHE must be set}"; GH_AW_TOOL_CACHE="$RUNNER_TOOL_CACHE"; export PATH="$(find "$GH_AW_TOOL_CACHE" -maxdepth 5 -type d -name bin 2>/dev/null | tr '\''\n'\'' '\'':'\'')$PATH"; [ -n "$GOROOT" ] && export PATH="$GOROOT/bin:$PATH" || true; [ -n "$ERLANG_HOME" ] && export PATH="$ERLANG_HOME/bin:$PATH" || true && GH_AW_NODE_EXEC="${GH_AW_NODE_BIN:-}"; if [ -z "$GH_AW_NODE_EXEC" ] || [ ! -x "$GH_AW_NODE_EXEC" ]; then GH_AW_NODE_EXEC="$(command -v node 2>/dev/null || true)"; fi; if [ -z "$GH_AW_NODE_EXEC" ]; then echo "node runtime missing on this runner — check runtimes.node in workflow YAML" >&2; exit 127; fi; GH_AW_NPM_GLOBAL_ROOT="$(npm root -g 2>/dev/null || true)"; if [ -n "$GH_AW_NPM_GLOBAL_ROOT" ]; then export NODE_PATH="${GH_AW_NPM_GLOBAL_ROOT}${NODE_PATH:+:${NODE_PATH}}"; fi; "$GH_AW_NODE_EXEC" ${RUNNER_TEMP}/gh-aw/actions/copilot_harness.cjs /usr/local/bin/copilot --add-dir /tmp/gh-aw/ --log-level all --log-dir /tmp/gh-aw/sandbox/agent/logs/ --disable-builtin-mcps --no-ask-user --allow-all-tools --add-dir "${GITHUB_WORKSPACE}" --prompt-file /tmp/gh-aw/aw-prompts/prompt.txt' 2>&1 | tee -a /tmp/gh-aw/threat-detection/detection.log
1539
+ env:
1540
+ AWF_REFLECT_ENABLED: 1
1541
+ COPILOT_AGENT_RUNNER_TYPE: STANDALONE
1542
+ COPILOT_DUMMY_BYOK: dummy-byok-key-for-offline-mode
1543
+ COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
1544
+ COPILOT_MODEL: ${{ vars.GH_AW_MODEL_DETECTION_COPILOT || vars.GH_AW_DEFAULT_MODEL_COPILOT || 'claude-sonnet-4.6' }}
1545
+ GH_AW_LLM_PROVIDER: github
1546
+ GH_AW_MAX_AI_CREDITS: ${{ vars.GH_AW_DEFAULT_DETECTION_MAX_AI_CREDITS || '400' }}
1547
+ GH_AW_MAX_TURNS: ${{ vars.GH_AW_DEFAULT_MAX_TURNS || '' }}
1548
+ GH_AW_PHASE: detection
1549
+ GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
1550
+ GH_AW_TIMEOUT_MINUTES: 20
1551
+ GH_AW_VERSION: v0.83.1
1552
+ GITHUB_API_URL: ${{ github.api_url }}
1553
+ GITHUB_AW: true
1554
+ GITHUB_COPILOT_INTEGRATION_ID: agentic-workflows
1555
+ GITHUB_HEAD_REF: ${{ github.head_ref }}
1556
+ GITHUB_REF_NAME: ${{ github.ref_name }}
1557
+ GITHUB_SERVER_URL: ${{ github.server_url }}
1558
+ GITHUB_STEP_SUMMARY: /tmp/gh-aw/agent-step-summary.md
1559
+ GITHUB_WORKSPACE: ${{ github.workspace }}
1560
+ GIT_AUTHOR_EMAIL: github-actions[bot]@users.noreply.github.com
1561
+ GIT_AUTHOR_NAME: github-actions[bot]
1562
+ GIT_COMMITTER_EMAIL: github-actions[bot]@users.noreply.github.com
1563
+ GIT_COMMITTER_NAME: github-actions[bot]
1564
+ RUNNER_TEMP: ${{ runner.temp }}
1565
+ TRACEPARENT: ${{ env.GITHUB_AW_OTEL_TRACE_ID != '' && env.GITHUB_AW_OTEL_PARENT_SPAN_ID != '' && format('00-{0}-{1}-01', env.GITHUB_AW_OTEL_TRACE_ID, env.GITHUB_AW_OTEL_PARENT_SPAN_ID) || '' }}
1566
+ - name: Parse threat detection token usage for step summary
1567
+ id: parse_detection_token_usage
1568
+ if: always()
1569
+ continue-on-error: true
1570
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
1571
+ env:
1572
+ GH_AW_TOKEN_USAGE_SUMMARY_TITLE: Threat Detection Token Usage
1573
+ with:
1574
+ script: |
1575
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
1576
+ setupGlobals(core, github, context, exec, io, getOctokit);
1577
+ const { main } = require('${{ runner.temp }}/gh-aw/actions/parse_token_usage.cjs');
1578
+ await main();
1579
+ - name: Upload threat detection log
1580
+ if: always() && steps.detection_guard.outputs.run_detection == 'true'
1581
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
1582
+ with:
1583
+ name: detection
1584
+ path: /tmp/gh-aw/threat-detection/detection.log
1585
+ if-no-files-found: ignore
1586
+ - name: Parse and conclude threat detection
1587
+ id: detection_conclusion
1588
+ if: always()
1589
+ continue-on-error: true
1590
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
1591
+ env:
1592
+ RUN_DETECTION: ${{ steps.detection_guard.outputs.run_detection }}
1593
+ DETECTION_AGENTIC_EXECUTION_OUTCOME: ${{ steps.detection_agentic_execution.outcome }}
1594
+ GH_AW_DETECTION_CONTINUE_ON_ERROR: "true"
1595
+ with:
1596
+ script: |
1597
+ try {
1598
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
1599
+ setupGlobals(core, github, context, exec, io, getOctokit);
1600
+ const { main } = require('${{ runner.temp }}/gh-aw/actions/parse_threat_detection_results.cjs');
1601
+ await main();
1602
+ } catch (loadErr) {
1603
+ const continueOnError = process.env.GH_AW_DETECTION_CONTINUE_ON_ERROR !== 'false';
1604
+ const detectionExecutionFailed = process.env.DETECTION_AGENTIC_EXECUTION_OUTCOME === 'failure';
1605
+ const msg = 'ERR_SYSTEM: \u274C Unexpected error loading threat detection module: ' + (loadErr && loadErr.message ? loadErr.message : String(loadErr));
1606
+ core.error(msg);
1607
+ core.setOutput('reason', 'parse_error');
1608
+ if (continueOnError && !detectionExecutionFailed) {
1609
+ core.warning('\u26A0\uFE0F ' + msg);
1610
+ core.setOutput('conclusion', 'warning');
1611
+ core.setOutput('success', 'false');
1612
+ } else {
1613
+ core.setOutput('conclusion', 'failure');
1614
+ core.setOutput('success', 'false');
1615
+ core.setFailed(msg);
1616
+ }
1617
+ }
1618
+
1619
+ pre_activation:
1620
+ runs-on: ubuntu-slim
1621
+ env:
1622
+ GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }}
1623
+ outputs:
1624
+ activated: ${{ steps.check_membership.outputs.is_team_member == 'true' }}
1625
+ matched_command: ''
1626
+ setup-parent-span-id: ${{ steps.setup.outputs.parent-span-id || steps.setup.outputs.span-id }}
1627
+ setup-span-id: ${{ steps.setup.outputs.span-id }}
1628
+ setup-trace-id: ${{ steps.setup.outputs.trace-id }}
1629
+ steps:
1630
+ - name: Setup Scripts
1631
+ id: setup
1632
+ uses: github/gh-aw-actions/setup@8bdba8075360648fe6802302a5b4e016361dc6ac # v0.83.1
1633
+ with:
1634
+ destination: ${{ runner.temp }}/gh-aw/actions
1635
+ job-name: ${{ github.job }}
1636
+ env:
1637
+ GH_AW_SETUP_WORKFLOW_NAME: "Issue triage"
1638
+ GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/issue-triage.lock.yml@${{ github.ref }}
1639
+ GH_AW_INFO_VERSION: "1.0.73"
1640
+ GH_AW_INFO_AWF_VERSION: "v0.27.38"
1641
+ GH_AW_INFO_ENGINE_ID: "copilot"
1642
+ - name: Check team membership for workflow
1643
+ id: check_membership
1644
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
1645
+ env:
1646
+ GH_AW_REQUIRED_ROLES: "admin,maintainer,write"
1647
+ with:
1648
+ github-token: ${{ secrets.GITHUB_TOKEN }}
1649
+ script: |
1650
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
1651
+ setupGlobals(core, github, context, exec, io, getOctokit);
1652
+ const { main } = require('${{ runner.temp }}/gh-aw/actions/check_membership.cjs');
1653
+ await main();
1654
+
1655
+ safe_outputs:
1656
+ needs:
1657
+ - activation
1658
+ - agent
1659
+ - detection
1660
+ if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
1661
+ runs-on: ubuntu-slim
1662
+ permissions:
1663
+ contents: read
1664
+ issues: write
1665
+ pull-requests: write
1666
+ timeout-minutes: 45
1667
+ env:
1668
+ GH_AW_AGENT_AIC: ${{ needs.agent.outputs.aic }}
1669
+ GH_AW_AIC: ${{ needs.agent.outputs.aic }}
1670
+ GH_AW_AMBIENT_CONTEXT: ${{ needs.agent.outputs.ambient_context }}
1671
+ GH_AW_CALLER_WORKFLOW_ID: "${{ github.repository }}/issue-triage"
1672
+ GH_AW_DETECTION_CONCLUSION: ${{ needs.detection.outputs.detection_conclusion }}
1673
+ GH_AW_DETECTION_REASON: ${{ needs.detection.outputs.detection_reason }}
1674
+ GH_AW_EFFECTIVE_TOKENS: ${{ needs.agent.outputs.effective_tokens }}
1675
+ GH_AW_ENGINE_ID: "copilot"
1676
+ GH_AW_ENGINE_MODEL: ${{ needs.agent.outputs.model }}
1677
+ GH_AW_ENGINE_VERSION: "1.0.73"
1678
+ GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }}
1679
+ GH_AW_THREAT_DETECTION_AIC: ${{ needs.detection.outputs.aic }}
1680
+ GH_AW_WORKFLOW_ID: "issue-triage"
1681
+ GH_AW_WORKFLOW_NAME: "Issue triage"
1682
+ GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/${{ github.repository }}/blob/${{ github.ref_name }}/.github/workflows/issue-triage.md"
1683
+ outputs:
1684
+ assign_to_agent_assigned: ${{ steps.process_safe_outputs.outputs.assign_to_agent_assigned }}
1685
+ assign_to_agent_assignment_error_count: ${{ steps.process_safe_outputs.outputs.assign_to_agent_assignment_error_count }}
1686
+ assign_to_agent_assignment_errors: ${{ steps.process_safe_outputs.outputs.assign_to_agent_assignment_errors }}
1687
+ code_push_failure_count: ${{ steps.process_safe_outputs.outputs.code_push_failure_count }}
1688
+ code_push_failure_errors: ${{ steps.process_safe_outputs.outputs.code_push_failure_errors }}
1689
+ comment_id: ${{ steps.process_safe_outputs.outputs.comment_id }}
1690
+ comment_url: ${{ steps.process_safe_outputs.outputs.comment_url }}
1691
+ create_discussion_error_count: ${{ steps.process_safe_outputs.outputs.create_discussion_error_count }}
1692
+ create_discussion_errors: ${{ steps.process_safe_outputs.outputs.create_discussion_errors }}
1693
+ process_safe_outputs_processed_count: ${{ steps.process_safe_outputs.outputs.processed_count }}
1694
+ process_safe_outputs_temporary_id_map: ${{ steps.process_safe_outputs.outputs.temporary_id_map }}
1695
+ steps:
1696
+ - name: Setup Scripts
1697
+ id: setup
1698
+ uses: github/gh-aw-actions/setup@8bdba8075360648fe6802302a5b4e016361dc6ac # v0.83.1
1699
+ with:
1700
+ destination: ${{ runner.temp }}/gh-aw/actions
1701
+ job-name: ${{ github.job }}
1702
+ trace-id: ${{ needs.activation.outputs.setup-trace-id }}
1703
+ parent-span-id: ${{ needs.activation.outputs.setup-parent-span-id || needs.activation.outputs.setup-span-id }}
1704
+ env:
1705
+ GH_AW_SETUP_WORKFLOW_NAME: "Issue triage"
1706
+ GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/issue-triage.lock.yml@${{ github.ref }}
1707
+ GH_AW_INFO_VERSION: "1.0.73"
1708
+ GH_AW_INFO_AWF_VERSION: "v0.27.38"
1709
+ GH_AW_INFO_ENGINE_ID: "copilot"
1710
+ - name: Download agent output artifact
1711
+ id: download-agent-output
1712
+ continue-on-error: true
1713
+ uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
1714
+ with:
1715
+ name: agent
1716
+ path: /tmp/gh-aw/
1717
+ - name: Setup agent output environment variable
1718
+ id: setup-agent-output-env
1719
+ if: steps.download-agent-output.outcome == 'success'
1720
+ run: |
1721
+ mkdir -p /tmp/gh-aw/
1722
+ find "/tmp/gh-aw/" -type f -print
1723
+ echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT"
1724
+ - name: Configure GH_HOST for enterprise compatibility
1725
+ id: ghes-host-config
1726
+ shell: bash
1727
+ run: | # zizmor: ignore[github-env] - GITHUB_SERVER_URL is set by GitHub Actions, not user input.
1728
+ # Derive GH_HOST from GITHUB_SERVER_URL so the gh CLI targets the correct
1729
+ # GitHub instance (GHES/GHEC). On github.com this is a harmless no-op.
1730
+ GH_HOST="${GITHUB_SERVER_URL#https://}"
1731
+ GH_HOST="${GH_HOST#http://}"
1732
+ echo "GH_HOST=${GH_HOST}" >> "$GITHUB_ENV"
1733
+ - name: Process Safe Outputs
1734
+ id: process_safe_outputs
1735
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
1736
+ env:
1737
+ GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }}
1738
+ GH_AW_COMMENT_ID: ${{ needs.activation.outputs.comment_id }}
1739
+ GH_AW_ALLOWED_DOMAINS: "api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,github.com,host.docker.internal,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,ppa.launchpad.net,raw.githubusercontent.com,registry.npmjs.org,s.symcb.com,s.symcd.com,security.ubuntu.com,telemetry.enterprise.githubcopilot.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com,www.googleapis.com"
1740
+ GITHUB_SERVER_URL: ${{ github.server_url }}
1741
+ GITHUB_API_URL: ${{ github.api_url }}
1742
+ GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"add_comment\":{\"max\":1},\"add_labels\":{\"issue_intent\":true,\"max\":3,\"target\":\"triggering\"},\"assign_to_agent\":{\"allowed\":[\"copilot\"],\"issue_intent\":true,\"max\":1,\"name\":\"copilot\",\"target\":\"triggering\"},\"create_report_incomplete_issue\":{},\"missing_data\":{},\"missing_tool\":{},\"noop\":{\"max\":1,\"report-as-issue\":\"true\"},\"report_incomplete\":{},\"set_issue_type\":{\"issue_intent\":true,\"max\":1,\"target\":\"triggering\"}}"
1743
+ GH_AW_ASSIGN_TO_AGENT_TOKEN: ${{ secrets.GH_AW_AGENT_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
1744
+ with:
1745
+ github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
1746
+ script: |
1747
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
1748
+ setupGlobals(core, github, context, exec, io, getOctokit);
1749
+ const { main } = require('${{ runner.temp }}/gh-aw/actions/safe_output_handler_manager.cjs');
1750
+ await main();
1751
+ - name: Upload Safe Outputs Items
1752
+ if: always()
1753
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
1754
+ with:
1755
+ name: safe-outputs-items
1756
+ path: |
1757
+ /tmp/gh-aw/safe-output-items.jsonl
1758
+ /tmp/gh-aw/temporary-id-map.json
1759
+ if-no-files-found: ignore