Repository navigation
chore: sync actions from [email protected] - #264
Merged
Merged
Conversation
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Credential exposure, unsafe fallback behavior, validation regressions, and incorrect retry/cache handling must be addressed.
11 open findings
What changed in this PR
Syncs setup actions to [email protected], including sandbox installation support and broad runtime/safe-output compatibility changes.
Changes:
- Adds docker-sbx and gVisor setup scripts.
- Revises safe-output, logging, AIC, prompt, and credential behavior.
- Removes newer work-queue, session-parser, ledger, and supporting components.
| File | Description |
|---|---|
setup/sh/verify_git_credentials.sh |
Removes credential verification. |
setup/sh/sudo_gvisor_install.sh |
Adds gVisor installation. |
setup/sh/sudo_docker_sbx_install.sh |
Adds docker-sbx installation. |
setup/sh/run_awf_with_startup_retries.sh |
Changes retry classification. |
setup/sh/mask_otlp_headers.sh |
Inlines minimum mask length. |
setup/sh/mask_otlp_common.sh |
Removes shared mask constant. |
setup/sh/mask_otlp_attributes.sh |
Masks short attribute values. |
setup/sh/download_docker_images.sh |
Removes local-only pull policy. |
setup/sh/docker_sbx_secrets_check.sh |
Adds secret preflight checks. |
setup/sh/docker_sbx_preflight.sh |
Adds sandbox smoke test. |
setup/sh/docker_sbx_kvm_check.sh |
Adds KVM checks. |
setup/sh/docker_sbx_daemon.sh |
Adds daemon setup and login. |
setup/sh/docker_sbx_credential_refresh.sh |
Adds credential refresh. |
setup/sh/create_gh_aw_tmp_dir.sh |
Removes memory-validation setup. |
setup/sh/cloud_hypervisor_setup_enclave_artifacts.sh |
Removes enclave setup. |
setup/sh/clone_repo_memory_branch.sh |
Simplifies branch cloning. |
setup/sh/clean_git_credentials.sh |
Removes include credential cleanup. |
setup/sh/append_agent_step_summary.sh |
Uses fixed summary path. |
setup/setup.sh |
Reduces safe-output runtime bundle. |
setup/session_parsers.go |
Removes embedded parsers. |
setup/session_parsers_test.go |
Removes embedding test. |
setup/md/safe_outputs_prompt.md |
Consolidates transport guidance. |
setup/md/safe_outputs_mcp_transport_prompt.md |
Removes MCP-specific prompt. |
setup/md/safe_outputs_cli_only_transport_prompt.md |
Removes CLI-only prompt. |
setup/md/model_not_supported_error.md |
Simplifies model guidance. |
setup/md/mcp_cli_tools_with_safeoutputs_prompt.md |
Revises safe-output transport text. |
setup/md/docker_sbx_secrets_missing.md |
Adds missing-secret report. |
setup/md/daily_workflow_aic_exceeded.md |
Simplifies AIC report. |
setup/md/copilot_agent_not_found.md |
Removes agent-not-found report. |
setup/md/comment_memory_disclosure_note.md |
Revises disclosure text. |
setup/md/agent_failure_issue.md |
Updates failure contexts. |
setup/md/agent_failure_comment.md |
Updates failure contexts. |
setup/js/write_work_queue_snapshot.cjs |
Removes queue snapshots. |
setup/js/work_queue_script_preparation_checks.cjs |
Removes preparation checks. |
setup/js/work_queue_prepare_claim_script.cjs |
Removes claim preparation. |
setup/js/work_queue_effect_test_helpers.cjs |
Removes queue test helper. |
setup/js/work_queue_declared_verification.cjs |
Removes effect verification. |
setup/js/work_queue_control_delivery.cjs |
Removes control delivery. |
setup/js/validate_memory_step.cjs |
Narrows core typing. |
setup/js/upload_assets.cjs |
Revises asset summaries. |
setup/js/types/work-queue-native-client.d.ts |
Removes queue client types. |
setup/js/types/safe-outputs-config.d.ts |
Removes assignment label filter. |
setup/js/types/handler-factory.d.ts |
Removes protected-path exclusion. |
setup/js/types/github-script.type-test.ts |
Removes global type tests. |
setup/js/types/github-script.d.ts |
Loosens global types. |
setup/js/tsconfig.json |
Narrows typecheck inputs. |
setup/js/tool_timeouts.cjs |
Removes timeout propagation. |
setup/js/testdata/copilot_sdk_web_fetch_contract.json |
Revises SDK contract fixture. |
setup/js/test-live-github-api.cjs |
Removes reader mode. |
setup/js/test_data/pydantic_ai_smoke_stdout.log |
Removes smoke fixture. |
setup/js/test_data/deepseek_headless_stdout.log |
Removes DeepSeek fixture. |
setup/js/test_data/codex_ci_smoke.jsonl |
Removes Codex fixture. |
setup/js/test_data/codex_ci_no_tools.jsonl |
Removes no-tools fixture. |
setup/js/test_data/codex_ci_mcp.jsonl |
Removes MCP fixture. |
setup/js/substitute_placeholders.cjs |
Removes split-prompt handling. |
setup/js/submit_pr_review.cjs |
Changes target failure handling. |
setup/js/steering_helpers.cjs |
Simplifies steering counts. |
setup/js/start_mcp_gateway.cjs |
Removes timeout and Pi adapter support. |
setup/js/set_issue_type.cjs |
Changes target failure handling. |
setup/js/session_artifact.cjs |
Removes session artifacts. |
setup/js/scripts/work_queue_yaml/package.json |
Removes queue YAML build package. |
setup/js/scripts/work_queue_yaml/entry.mjs |
Removes YAML entry point. |
setup/js/scripts/work_queue_yaml/build.mjs |
Removes YAML bundler. |
setup/js/sanitize_content.cjs |
Removes deferred mentions. |
setup/js/sanitize_content_core.cjs |
Adds lint suppressions. |
setup/js/safe_outputs_tools_loader.cjs |
Removes ledger tools. |
setup/js/safe_outputs_mcp_arguments.cjs |
Removes blank-field normalization. |
setup/js/safe_outputs_append.cjs |
Removes claim normalization. |
setup/js/safe_output_processor.cjs |
Removes claim authorization. |
setup/js/safe_output_action_handler.cjs |
Removes claim scoping. |
setup/js/runtime_import.cjs |
Warns for missing optional imports. |
setup/js/reply_to_pr_review_comment.cjs |
Simplifies mention resolution. |
setup/js/replace_label.cjs |
Simplifies triggering targets. |
setup/js/remove_labels.cjs |
Simplifies triggering targets. |
setup/js/rate_limit_helpers.cjs |
Assumes primary rate quota. |
setup/js/push_to_pull_request_branch.cjs |
Revises errors and authorization. |
setup/js/pi_steering_extension.cjs |
Uses Pi steering API. |
setup/js/pi_session_redaction.cjs |
Removes Pi HTML redaction. |
setup/js/pi_session_export.cjs |
Removes Pi export. |
setup/js/pi_provider_error.cjs |
Removes provider sanitization. |
setup/js/parse_mcp_gateway_log.cjs |
Adds unified timeline summary. |
setup/js/parse_json_prefix.cjs |
Removes prefix parser. |
setup/js/parse_claude_log.cjs |
Reworks Claude parsing. |
setup/js/package.json |
Downgrades and removes dependencies. |
setup/js/optional_field_normalizer.cjs |
Removes optional-field normalization. |
setup/js/model_attribution.cjs |
Removes model validation. |
setup/js/model_aliases.cjs |
Revises regex construction. |
setup/js/messages_footer.cjs |
Removes fallback model attribution. |
setup/js/memory_file_eligibility.cjs |
Changes filtering logs. |
setup/js/mcp_scripts_validation.cjs |
Changes schema semantics. |
setup/js/ledger_append.cjs |
Removes ledger append handling. |
setup/js/issue_body.cjs |
Removes issue-body formatter. |
setup/js/interpolate_prompt.cjs |
Removes split-prompt processing. |
setup/js/intent_probe.cjs |
Removes noop probe detection. |
setup/js/install_frontmatter_skills.cjs |
Adds summary heading. |
setup/js/inline_artifact_target.cjs |
Removes target overrides. |
setup/js/index.cjs |
Removes module exports. |
setup/js/harness_retry_runner.cjs |
Simplifies retry cancellation. |
setup/js/handler_auth.cjs |
Removes credential-source metadata. |
setup/js/handle_noop_message.cjs |
Removes fallback model attribution. |
setup/js/github_rate_limit_logger.cjs |
Removes credential-source logging. |
setup/js/git_patch_utils.cjs |
Removes queue-scoped paths. |
setup/js/generate_usage_artifacts.cjs |
Removes artifact generator. |
setup/js/generate_git_bundle.cjs |
Removes queue-scoped paths. |
setup/js/generate_footer.cjs |
Removes model validation and review markers. |
setup/js/fuzz_template_branch_harness.cjs |
Simplifies core shim. |
setup/js/fixtures/provider_refusals.cjs |
Removes refusal fixtures. |
setup/js/fixtures/gemini_ci_sessions.cjs |
Removes Gemini fixtures. |
setup/js/fixtures/gemini_ci_lifecycle.cjs |
Removes lifecycle fixture. |
setup/js/fixtures/claude_ci_normalization.cjs |
Removes Claude fixture. |
setup/js/firewall_blocked_domains.cjs |
Reorders blocked decisions. |
setup/js/extract_inline_sub_agents.cjs |
Removes Pi and target overrides. |
setup/js/extract_inline_skills.cjs |
Changes skill destinations. |
setup/js/extra_empty_commit.cjs |
Removes queue push authorization. |
setup/js/dynamic_workflow_session.cjs |
Removes workflow events. |
setup/js/diagnostic_sanitization.cjs |
Removes diagnostic redaction. |
setup/js/daily_aic_workflow_helpers.cjs |
Removes usage-file classifier. |
setup/js/daily_aic_scan.cjs |
Changes fallback caching. |
setup/js/daily_aic_component_coverage.cjs |
Simplifies job matching. |
setup/js/daily_aic_cache_helpers.cjs |
Reverts cache coverage schema. |
setup/js/create_pr_review_comment.cjs |
Simplifies mention resolution. |
setup/js/create_discussion.cjs |
Simplifies mention resolution. |
setup/js/copilot_workflow_events.cjs |
Removes workflow event definitions. |
setup/js/copilot_sdk_tool_budget.cjs |
Removes SDK tool budget. |
setup/js/copilot_sdk_permissions.cjs |
Changes workflow permissions. |
setup/js/copilot_sdk_driver.cjs |
Removes routing effort. |
setup/js/copilot_routing_effort.cjs |
Removes routing helper. |
setup/js/convert_gateway_config_shared.cjs |
Removes CLI-server preservation. |
setup/js/convert_gateway_config_pi.cjs |
Removes Pi conversion. |
setup/js/constants.cjs |
Removes newer constants. |
setup/js/comment_memory.cjs |
Makes memory block visible. |
setup/js/collect_work_queue_intents.cjs |
Removes intent collection. |
setup/js/codex_log_framing.cjs |
Removes Codex framing. |
setup/js/close_issue.cjs |
Broadens legacy fallback. |
setup/js/close_discussion.cjs |
Simplifies mention resolution. |
setup/js/check_membership.cjs |
Tightens bot authorization. |
setup/js/capture_work_queue_intent_origin.cjs |
Removes origin capture. |
setup/js/azure_devops_work_items.cjs |
Simplifies validation errors. |
setup/js/awf_reflect_summary.cjs |
Reverts reflect path. |
setup/js/awf_reflect_paths.cjs |
Removes path abstraction. |
setup/js/assign_to_agent.cjs |
Removes required-label filtering. |
setup/js/add_workflow_run_comment.cjs |
Removes type annotation. |
setup/js/add_comment.cjs |
Revises targeting and mentions. |
setup/js/actions_secret_masking.cjs |
Simplifies availability check. |
setup-cli/action.yml |
Requires an explicit version. |
.github/aw/compat.json |
Lowers maximum compatible agent. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| const engineId = process.env.GH_AW_ENGINE_ID || ""; | ||
| const engineVersion = process.env.GH_AW_ENGINE_VERSION || ""; | ||
| const engineModel = getFallbackModel() || validateModelIdentifier(process.env.GH_AW_ENGINE_MODEL); | ||
| const engineModel = process.env.GH_AW_ENGINE_MODEL || ""; |
| @@ -614,7 +613,7 @@ function generateXMLMarker(workflowName, runUrl) { | |||
| // Read engine metadata from environment variables | |||
| const engineId = process.env.GH_AW_ENGINE_ID || ""; | |||
| const engineVersion = process.env.GH_AW_ENGINE_VERSION || ""; | |||
| const engineModel = getFallbackModel() || validateModelIdentifier(process.env.GH_AW_ENGINE_MODEL); | |||
| const engineModel = process.env.GH_AW_ENGINE_MODEL || ""; | |||
| echo "Removed checkout credential include from git config" | ||
| fi | ||
| done < <(git config --file "${GIT_CONFIG_PATH}" --null --get-regexp '^includeif\..*\.path$' 2>/dev/null) | ||
|
|
||
| # Remove any credentials from remote URLs (https://username:[email protected] format) |
Comment on lines
+131
to
133
| if [ $CLONE_EXIT_CODE -ne 0 ]; then | ||
| # Clone failed - branch doesn't exist | ||
| if [ "$CREATE_ORPHAN" = "true" ]; then |
|
|
||
| echo "::group::Install docker-sbx" | ||
| # Add Docker apt repo without installing Docker Engine (already present). | ||
| curl -fsSL https://get.docker.com | sudo REPO_ONLY=1 sh |
| @@ -165,7 +165,7 @@ function validateSchemaNode(value, schema, path, options = {}) { | |||
| /** @type {Array<{path: string, message: string, expected?: string, received?: string}>} */ | |||
| const errors = []; | |||
| for (const subSchema of schema.oneOf) { | |||
| const error = validateSchemaNode(value, subSchema, path, { ...options, skipRequiredAtRoot: false }); | |||
| const error = validateSchemaNode(value, subSchema, path, options); | |||
|
|
||
| // Check if max-turns limit was hit | ||
| let maxTurnsHit = canonicalLogEntries.some(entry => entry.type === "session.result" && !sessionContext(entry).parentToolUseId && entry.data.subtype === "error_max_turns"); | ||
| let maxTurnsHit = false; |
| } | ||
| return { success: false, error: targetResult.error }; | ||
| } | ||
| if (!targetResult.success) return { success: false, error: targetResult.error }; |
| [ -z "$_val" ] && continue | ||
| [ "${#_val}" -lt "$MIN_MASK_LENGTH" ] && continue | ||
| echo '::add-mask::'"$_val" | ||
| [ -n "$_val" ] && echo '::add-mask::'"$_val" |
Comment on lines
+101
to
103
| if ! grep -Fq "$GH_AW_AWF_HARNESS_MARKER" "$gh_aw_awf_attempt_log" && | ||
| grep -Eqi '(Fatal error:|Process exiting with code:|Refusing to use symlink as bind mountpoint|mcp gateway[^[:cntrl:]]{0,80}(startup failed|failed to start|startup error))' "$gh_aw_awf_attempt_log" && | ||
| [ "$gh_aw_awf_attempt" -lt "$gh_aw_awf_startup_retries" ]; then |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Automated sync of actions from gh-aw at
v0.89.21.