From 74bfb0456f3891c300ab21e533c3f519955edea7 Mon Sep 17 00:00:00 2001 From: Landon Cox Date: Mon, 3 Aug 2026 11:40:31 -0700 Subject: [PATCH 1/4] feat: add Auth Doctor workflow Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 79dfde80-9308-4d73-bd34-3ec5bc114cd7 --- .github/workflows/auth-doctor.lock.yml | 1468 +++++++++++++++++++++++ .github/workflows/auth-doctor.md | 196 +++ README.md | 2 + docs/api-proxy-sidecar.md | 6 + docs/auth-matrix.md | 6 + docs/authentication-architecture.md | 18 +- docs/diagnosing-awf-failures.md | 4 + docs/environment.md | 4 + scripts/ci/auth-doctor-workflow.test.ts | 59 + 9 files changed, 1759 insertions(+), 4 deletions(-) create mode 100644 .github/workflows/auth-doctor.lock.yml create mode 100644 .github/workflows/auth-doctor.md create mode 100644 scripts/ci/auth-doctor-workflow.test.ts diff --git a/.github/workflows/auth-doctor.lock.yml b/.github/workflows/auth-doctor.lock.yml new file mode 100644 index 000000000..fdb8d69f2 --- /dev/null +++ b/.github/workflows/auth-doctor.lock.yml @@ -0,0 +1,1468 @@ +# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"dbe67338549fa3940a0a44677cd4f4ba24ceac2c9c8a5a1adf8524ab900492b7","body_hash":"31a8f08b147c35aedf1ac9d71e5ab4ec87ae7442281129178c4667c2aa885d21","compiler_version":"v0.84.3","strict":true,"agent_id":"copilot","engine_versions":{"copilot":"1.0.77"}} +# gh-aw-manifest: {"version":1,"secrets":["COPILOT_GITHUB_TOKEN","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/cache","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/cache/restore","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/cache/save","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/checkout","sha":"3d3c42e5aac5ba805825da76410c181273ba90b1","version":"v7.0.1"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"},{"repo":"github/gh-aw-actions/setup","sha":"c863074e6da7866f66d9ce31ce11429384406f5f","version":"v0.84.3"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.27.43","digest":"sha256:04e2d1987a565000a8f114b89d806ae7a3864dd4f944be65275b28c93d8690e6","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.27.43@sha256:04e2d1987a565000a8f114b89d806ae7a3864dd4f944be65275b28c93d8690e6"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.43","digest":"sha256:d85f57975af5ea23af4996e41ed73fbc8f5b4a47402472bfe82e508f352cb0c1","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.43@sha256:d85f57975af5ea23af4996e41ed73fbc8f5b4a47402472bfe82e508f352cb0c1"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.27.43","digest":"sha256:26be5e0b8c8f4c41c8a59126b29bb5d80b07253597472ded2a16bdd75abcbf9d","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.27.43@sha256:26be5e0b8c8f4c41c8a59126b29bb5d80b07253597472ded2a16bdd75abcbf9d"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.4.7","digest":"sha256:7545220a9aca134b71e51193ee0eaf4c50756ebf8fbd25a63ae7556e62815c00","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.4.7@sha256:7545220a9aca134b71e51193ee0eaf4c50756ebf8fbd25a63ae7556e62815c00"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b","pinned_image":"ghcr.io/github/gh-aw-node@sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b"},{"image":"ghcr.io/github/github-mcp-server:v1.8.0","digest":"sha256:d5a18c04b92714c309eb46a2305087e91a4dbd80420f6e462656699f95093520","pinned_image":"ghcr.io/github/github-mcp-server:v1.8.0@sha256:d5a18c04b92714c309eb46a2305087e91a4dbd80420f6e462656699f95093520"}]} +# This file was automatically generated by gh-aw (v0.84.3). DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md +# +# ___ _ _ +# / _ \ | | (_) +# | |_| | __ _ ___ _ __ | |_ _ ___ +# | _ |/ _` |/ _ \ '_ \| __| |/ __| +# | | | | (_| | __/ | | | |_| | (__ +# \_| |_/\__, |\___|_| |_|\__|_|\___| +# __/ | +# _ _ |___/ +# | | | | / _| | +# | | | | ___ _ __ _ __| |_| | _____ ____ +# | |/\| |/ _ \ '__| |/ /| _| |/ _ \ \ /\ / / ___| +# \ /\ / (_) | | | | ( | | | | (_) \ V V /\__ \ +# \/ \/ \___/|_| |_|\_\|_| |_|\___/ \_/\_/ |___/ +# +# +# To update this file, edit the corresponding .md file and run: +# gh aw compile +# Not all edits will cause changes to this file. +# +# For more information: https://github.github.com/gh-aw/introduction/overview/ +# +# Diagnoses AWF authentication, API-proxy, and HTTP MCP GitHub OIDC configuration from issue reports and workflow evidence without exposing credentials. +# +# Secrets used: +# - COPILOT_GITHUB_TOKEN +# - GH_AW_GITHUB_MCP_SERVER_TOKEN +# - GH_AW_GITHUB_TOKEN +# - GITHUB_TOKEN +# +# Custom actions used: +# - actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 +# - actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 +# - actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 +# - actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 +# - actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 +# - actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 +# - actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 (source v9) +# - actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 +# - github/gh-aw-actions/setup@c863074e6da7866f66d9ce31ce11429384406f5f # v0.84.3 +# +# Container images used: +# - ghcr.io/github/gh-aw-firewall/agent:0.27.43@sha256:04e2d1987a565000a8f114b89d806ae7a3864dd4f944be65275b28c93d8690e6 +# - ghcr.io/github/gh-aw-firewall/api-proxy:0.27.43@sha256:d85f57975af5ea23af4996e41ed73fbc8f5b4a47402472bfe82e508f352cb0c1 +# - ghcr.io/github/gh-aw-firewall/squid:0.27.43@sha256:26be5e0b8c8f4c41c8a59126b29bb5d80b07253597472ded2a16bdd75abcbf9d +# - ghcr.io/github/gh-aw-mcpg:v0.4.7@sha256:7545220a9aca134b71e51193ee0eaf4c50756ebf8fbd25a63ae7556e62815c00 +# - ghcr.io/github/gh-aw-node@sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b +# - ghcr.io/github/github-mcp-server:v1.8.0@sha256:d5a18c04b92714c309eb46a2305087e91a4dbd80420f6e462656699f95093520 + +name: "Auth Doctor" +on: + issue_comment: + types: + - created + - edited +# roles: all # Roles processed as role check in pre-activation job + +permissions: {} + +concurrency: + group: "gh-aw-${{ github.workflow }}-${{ github.event.issue.number || github.event.pull_request.number || github.run_id }}" + +run-name: "Auth Doctor" + +jobs: + activation: + needs: pre_activation + if: "needs.pre_activation.outputs.activated == 'true' && ((github.event_name == 'issue_comment') && (github.event_name == 'issue_comment' && (startsWith(github.event.comment.body, '/auth-doctor ') || startsWith(github.event.comment.body, '/auth-doctor\n') || github.event.comment.body == '/auth-doctor') && github.event.issue.pull_request == null) || !(github.event_name == 'issue_comment'))" + runs-on: ubuntu-slim + permissions: + actions: read + contents: read + issues: write + pull-requests: write + env: + GH_AW_MAX_DAILY_AI_CREDITS: ${{ vars.GH_AW_DEFAULT_MAX_DAILY_AI_CREDITS || '5000' }} + GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} + outputs: + body: ${{ steps.sanitized.outputs.body }} + comment_id: ${{ steps.add-comment.outputs.comment-id }} + comment_repo: ${{ steps.add-comment.outputs.comment-repo }} + comment_url: ${{ steps.add-comment.outputs.comment-url }} + daily_ai_credits_exceeded: ${{ steps.daily-effective-workflow-guardrail.outputs.daily_ai_credits_exceeded == 'true' }} + daily_ai_credits_threshold: ${{ steps.daily-effective-workflow-guardrail.outputs.daily_ai_credits_threshold || '' }} + daily_ai_credits_total_effective_tokens: ${{ steps.daily-effective-workflow-guardrail.outputs.daily_ai_credits_total_effective_tokens || '' }} + engine_id: ${{ steps.generate_aw_info.outputs.engine_id }} + lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }} + model: ${{ steps.generate_aw_info.outputs.model }} + oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }} + setup-parent-span-id: ${{ steps.setup.outputs.parent-span-id || steps.setup.outputs.span-id }} + setup-span-id: ${{ steps.setup.outputs.span-id }} + setup-trace-id: ${{ steps.setup.outputs.trace-id }} + slash_command: ${{ needs.pre_activation.outputs.matched_command }} + stale_lock_file_failed: ${{ steps.check-lock-file.outputs.stale_lock_file_failed == 'true' }} + text: ${{ steps.sanitized.outputs.text }} + title: ${{ steps.sanitized.outputs.title }} + steps: + - name: Setup Scripts + id: setup + uses: github/gh-aw-actions/setup@c863074e6da7866f66d9ce31ce11429384406f5f # v0.84.3 + with: + destination: ${{ runner.temp }}/gh-aw/actions + job-name: ${{ github.job }} + trace-id: ${{ needs.pre_activation.outputs.setup-trace-id }} + parent-span-id: ${{ needs.pre_activation.outputs.setup-parent-span-id || needs.pre_activation.outputs.setup-span-id }} + safe-output-artifact-client: ${{ env.GH_AW_MAX_DAILY_AI_CREDITS != '' }} + env: + GH_AW_SETUP_WORKFLOW_NAME: "Auth Doctor" + GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/auth-doctor.lock.yml@${{ github.ref }} + GH_AW_INFO_VERSION: "1.0.77" + GH_AW_INFO_AWF_VERSION: "v0.27.43" + GH_AW_INFO_ENGINE_ID: "copilot" + - name: Generate agentic run info + id: generate_aw_info + env: + GH_AW_INFO_ENGINE_ID: "copilot" + GH_AW_INFO_ENGINE_NAME: "GitHub Copilot CLI" + GH_AW_INFO_MODEL: ${{ vars.GH_AW_MODEL_AGENT_COPILOT || vars.GH_AW_DEFAULT_MODEL_COPILOT || 'auto' }} + GH_AW_INFO_VERSION: "1.0.77" + GH_AW_INFO_AGENT_VERSION: "1.0.77" + GH_AW_INFO_CLI_VERSION: "v0.84.3" + GH_AW_INFO_WORKFLOW_NAME: "Auth Doctor" + GH_AW_INFO_EXPERIMENTAL: "false" + GH_AW_INFO_SUPPORTS_TOOLS_ALLOWLIST: "true" + GH_AW_INFO_STAGED: "false" + GH_AW_INFO_ALLOWED_DOMAINS: '["github"]' + GH_AW_INFO_FIREWALL_ENABLED: "true" + GH_AW_INFO_AWF_VERSION: "v0.27.43" + GH_AW_INFO_AWMG_VERSION: "" + GH_AW_INFO_FIREWALL_TYPE: "squid" + GH_AW_COMPILED_STRICT: "true" + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + with: + script: | + const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs'); + setupGlobals(core, github, context, exec, io, getOctokit); + const { main } = require('${{ runner.temp }}/gh-aw/actions/generate_aw_info.cjs'); + await main(core, context); + - name: Restore daily AIC usage cache + id: restore-daily-aic-cache + if: ${{ env.GH_AW_MAX_DAILY_AI_CREDITS != '' }} + continue-on-error: true + uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 + with: + key: agentic-workflow-usage-authdoctor-${{ github.run_id }} + restore-keys: agentic-workflow-usage-authdoctor- + path: /tmp/gh-aw/agentic-workflow-usage-cache.jsonl + - name: Restore daily AIC usage cache (artifact fallback) + id: restore-daily-aic-cache-fallback + if: ${{ env.GH_AW_MAX_DAILY_AI_CREDITS != '' }} + continue-on-error: true + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + env: + GH_AW_RESTORE_DAILY_AIC_CACHE_HIT: ${{ steps.restore-daily-aic-cache.outputs.cache-hit }} + GH_AW_RESTORE_DAILY_AIC_CACHE_MATCHED_KEY: ${{ steps.restore-daily-aic-cache.outputs.cache-matched-key }} + with: + github-token: ${{ secrets.GITHUB_TOKEN }} + script: | + const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs'); + setupGlobals(core, github, context, exec, io, getOctokit); + const { main } = require('${{ runner.temp }}/gh-aw/actions/restore_aic_usage_cache_fallback.cjs'); + await main(); + - name: Check daily workflow token guardrail + id: daily-effective-workflow-guardrail + if: ${{ env.GH_AW_MAX_DAILY_AI_CREDITS != '' }} + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + env: + GH_AW_WORKFLOW_NAME: "Auth Doctor" + GH_AW_WORKFLOW_ID: "auth-doctor" + GH_AW_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }} + GH_AW_WORKFLOW_DISPATCH_AW_CONTEXT: ${{ github.event.inputs.aw_context || '' }} + GH_AW_HAS_SLASH_COMMAND: "true" + GH_AW_HAS_LABEL_COMMAND: "false" + GH_AW_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + GH_AW_MAX_DAILY_AI_CREDITS: ${{ vars.GH_AW_DEFAULT_MAX_DAILY_AI_CREDITS || '5000' }} + with: + github-token: ${{ secrets.GITHUB_TOKEN }} + script: | + const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs'); + setupGlobals(core, github, context, exec, io, getOctokit); + const { main } = require('${{ runner.temp }}/gh-aw/actions/check_daily_aic_workflow_guardrail.cjs'); + await main(); + - name: Add eyes reaction for immediate feedback + id: react + if: github.event_name == 'issues' || github.event_name == 'issue_comment' || github.event_name == 'pull_request_review_comment' || github.event_name == 'discussion' || github.event_name == 'discussion_comment' || github.event_name == 'pull_request' && github.event.pull_request.head.repo.id == github.repository_id + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + env: + GH_AW_REACTION: "eyes" + with: + github-token: ${{ secrets.GITHUB_TOKEN }} + script: | + const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs'); + setupGlobals(core, github, context, exec, io, getOctokit); + const { main } = require('${{ runner.temp }}/gh-aw/actions/add_reaction.cjs'); + await main(); + - name: Check for OAuth tokens + id: check-oauth-tokens + run: bash "${RUNNER_TEMP}/gh-aw/actions/check_oauth_tokens.sh" + env: + COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }} + GH_AW_GITHUB_TOKEN: ${{ secrets.GH_AW_GITHUB_TOKEN }} + GH_AW_GITHUB_MCP_SERVER_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN }} + - name: Checkout .github and .agents folders + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + sparse-checkout: | + .github + .agents + .antigravity + .claude + .codex + .gemini + .opencode + .pi + sparse-checkout-cone-mode: true + fetch-depth: 1 + - name: Save agent config folders for base branch restoration + env: + GH_AW_AGENT_FOLDERS: ".agents .antigravity .claude .codex .gemini .github .opencode .pi" + GH_AW_AGENT_FILES: "AGENTS.md ANTIGRAVITY.md CLAUDE.md GEMINI.md PI.md opencode.jsonc" + # poutine:ignore untrusted_checkout_exec + run: bash "${RUNNER_TEMP}/gh-aw/actions/save_base_github_folders.sh" + - name: Check workflow lock file + id: check-lock-file + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + env: + GH_AW_WORKFLOW_FILE: "auth-doctor.lock.yml" + GH_AW_CONTEXT_WORKFLOW_REF: "${{ github.workflow_ref }}" + with: + script: | + const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs'); + setupGlobals(core, github, context, exec, io, getOctokit); + const { main } = require('${{ runner.temp }}/gh-aw/actions/check_workflow_timestamp_api.cjs'); + await main(); + - name: Check compile-agentic version + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + env: + GH_AW_COMPILED_VERSION: "v0.84.3" + with: + script: | + const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs'); + setupGlobals(core, github, context, exec, io, getOctokit); + const { main } = require('${{ runner.temp }}/gh-aw/actions/check_version_updates.cjs'); + await main(); + - name: Compute current body text + id: sanitized + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + env: + GH_AW_ALLOWED_DOMAINS: "*.githubusercontent.com,api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,codeload.github.com,docs.github.com,github-cloud.githubusercontent.com,github-cloud.s3.amazonaws.com,github.blog,github.com,github.githubassets.com,host.docker.internal,lfs.github.com,objects.githubusercontent.com,patch-diff.githubusercontent.com,patchdiff.githubusercontent.com,raw.githubusercontent.com,registry.npmjs.org,telemetry.enterprise.githubcopilot.com" + with: + script: | + const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs'); + setupGlobals(core, github, context, exec, io, getOctokit); + const { main } = require('${{ runner.temp }}/gh-aw/actions/compute_text.cjs'); + await main(); + - name: Add comment with workflow run link + id: add-comment + if: github.event_name == 'issues' || github.event_name == 'issue_comment' || github.event_name == 'pull_request_review_comment' || github.event_name == 'discussion' || github.event_name == 'discussion_comment' || github.event_name == 'pull_request' && github.event.pull_request.head.repo.id == github.repository_id + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + env: + GH_AW_WORKFLOW_NAME: "Auth Doctor" + with: + script: | + const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs'); + setupGlobals(core, github, context, exec, io, getOctokit); + const { main } = require('${{ runner.temp }}/gh-aw/actions/add_workflow_run_comment.cjs'); + await main(); + - name: Log runtime features + if: ${{ contains(toJSON(vars), '"GH_AW_RUNTIME_FEATURES":') }} + run: bash "${RUNNER_TEMP}/gh-aw/actions/log_runtime_features_summary.sh" + - name: Create prompt with built-in context + env: + GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt + GH_AW_SAFE_OUTPUTS: ${{ runner.temp }}/gh-aw/safeoutputs/outputs.jsonl + GH_AW_EXPR_1A3A194A: ${{ github.event.discussion.number || (fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_type == 'discussion' && fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_number) }} + GH_AW_EXPR_463A214A: ${{ github.event.pull_request.number || (fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_type == 'pull_request' && fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_number) }} + GH_AW_EXPR_802A9F6A: ${{ github.event.issue.number || (fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_type == 'issue' && fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_number) }} + GH_AW_EXPR_FF1D34CE: ${{ github.event.comment.id || fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').comment_id }} + GH_AW_GITHUB_ACTOR: ${{ github.actor }} + GH_AW_GITHUB_EVENT_ISSUE_NUMBER: ${{ github.event.issue.number }} + GH_AW_GITHUB_REPOSITORY: ${{ github.repository }} + GH_AW_GITHUB_RUN_ID: ${{ github.run_id }} + GH_AW_GITHUB_WORKSPACE: ${{ github.workspace }} + GH_AW_IS_PR_COMMENT: ${{ github.event.issue.pull_request && 'true' || '' }} + GH_AW_STEPS_SANITIZED_OUTPUTS_TEXT: ${{ steps.sanitized.outputs.text }} + # poutine:ignore untrusted_checkout_exec + run: | + bash "${RUNNER_TEMP}/gh-aw/actions/create_prompt_first.sh" + { + cat << 'GH_AW_PROMPT_692a20b31f1c17a2_EOF' + + GH_AW_PROMPT_692a20b31f1c17a2_EOF + cat "${RUNNER_TEMP}/gh-aw/prompts/xpia.md" + cat "${RUNNER_TEMP}/gh-aw/prompts/temp_folder_prompt.md" + cat "${RUNNER_TEMP}/gh-aw/prompts/markdown.md" + cat "${RUNNER_TEMP}/gh-aw/prompts/cache_memory_prompt.md" + cat "${RUNNER_TEMP}/gh-aw/prompts/safe_outputs_prompt.md" + cat << 'GH_AW_PROMPT_692a20b31f1c17a2_EOF' + + Tools: add_comment, create_issue, missing_tool, missing_data, noop + + GH_AW_PROMPT_692a20b31f1c17a2_EOF + cat "${RUNNER_TEMP}/gh-aw/prompts/mcp_cli_tools_prompt.md" + cat << 'GH_AW_PROMPT_692a20b31f1c17a2_EOF' + + The following GitHub context information is available for this workflow: + {{#if github.actor}} + - **actor**: __GH_AW_GITHUB_ACTOR__ + {{/if}} + {{#if github.repository}} + - **repository**: __GH_AW_GITHUB_REPOSITORY__ + {{/if}} + {{#if github.workspace}} + - **workspace**: __GH_AW_GITHUB_WORKSPACE__ + {{/if}} + {{#if github.event.issue.number || (github.aw.context.item_type == 'issue' && github.aw.context.item_number)}} + - **issue-number**: #__GH_AW_EXPR_802A9F6A__ + {{/if}} + {{#if github.event.discussion.number || (github.aw.context.item_type == 'discussion' && github.aw.context.item_number)}} + - **discussion-number**: #__GH_AW_EXPR_1A3A194A__ + {{/if}} + {{#if github.event.pull_request.number || (github.aw.context.item_type == 'pull_request' && github.aw.context.item_number)}} + - **pull-request-number**: #__GH_AW_EXPR_463A214A__ + {{/if}} + {{#if github.event.comment.id || github.aw.context.comment_id}} + - **comment-id**: __GH_AW_EXPR_FF1D34CE__ + {{/if}} + {{#if github.run_id}} + - **workflow-run-id**: __GH_AW_GITHUB_RUN_ID__ + {{/if}} + + + GH_AW_PROMPT_692a20b31f1c17a2_EOF + cat "${RUNNER_TEMP}/gh-aw/prompts/github_mcp_tools_with_safeoutputs_prompt.md" + if [ "$GITHUB_EVENT_NAME" = "issue_comment" ] && [ -n "$GH_AW_IS_PR_COMMENT" ] || [ "$GITHUB_EVENT_NAME" = "pull_request_review_comment" ] || [ "$GITHUB_EVENT_NAME" = "pull_request_review" ]; then + cat "${RUNNER_TEMP}/gh-aw/prompts/pr_context_prompt.md" + fi + cat << 'GH_AW_PROMPT_692a20b31f1c17a2_EOF' + + {{#runtime-import .github/workflows/auth-doctor.md}} + GH_AW_PROMPT_692a20b31f1c17a2_EOF + } > "$GH_AW_PROMPT" + - name: Interpolate variables and render templates + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + env: + GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt + GH_AW_ENGINE_ID: "copilot" + GH_AW_GITHUB_EVENT_ISSUE_NUMBER: ${{ github.event.issue.number }} + GH_AW_GITHUB_REPOSITORY: ${{ github.repository }} + GH_AW_STEPS_SANITIZED_OUTPUTS_TEXT: ${{ steps.sanitized.outputs.text }} + with: + script: | + const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs'); + setupGlobals(core, github, context, exec, io, getOctokit); + const { main } = require('${{ runner.temp }}/gh-aw/actions/interpolate_prompt.cjs'); + await main(); + - name: Substitute placeholders + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + env: + GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt + GH_AW_ALLOWED_EXTENSIONS: '' + GH_AW_CACHE_DESCRIPTION: '' + GH_AW_CACHE_DIR: '/tmp/gh-aw/cache-memory/' + GH_AW_EXPR_1A3A194A: ${{ github.event.discussion.number || (fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_type == 'discussion' && fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_number) }} + GH_AW_EXPR_463A214A: ${{ github.event.pull_request.number || (fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_type == 'pull_request' && fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_number) }} + GH_AW_EXPR_802A9F6A: ${{ github.event.issue.number || (fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_type == 'issue' && fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_number) }} + GH_AW_EXPR_FF1D34CE: ${{ github.event.comment.id || fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').comment_id }} + GH_AW_GITHUB_ACTOR: ${{ github.actor }} + GH_AW_GITHUB_EVENT_ISSUE_NUMBER: ${{ github.event.issue.number }} + GH_AW_GITHUB_REPOSITORY: ${{ github.repository }} + GH_AW_GITHUB_RUN_ID: ${{ github.run_id }} + GH_AW_GITHUB_WORKSPACE: ${{ github.workspace }} + GH_AW_IS_PR_COMMENT: ${{ github.event.issue.pull_request && 'true' || '' }} + GH_AW_MCP_CLI_SERVERS_LIST: "- `github` — run `github --help` to see available tools\n- `safeoutputs` — run `safeoutputs --help` to see available tools" + GH_AW_NEEDS_PRE_ACTIVATION_OUTPUTS_ACTIVATED: ${{ needs.pre_activation.outputs.activated }} + GH_AW_NEEDS_PRE_ACTIVATION_OUTPUTS_MATCHED_COMMAND: ${{ needs.pre_activation.outputs.matched_command }} + GH_AW_STEPS_SANITIZED_OUTPUTS_TEXT: ${{ steps.sanitized.outputs.text }} + with: + script: | + const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs'); + setupGlobals(core, github, context, exec, io, getOctokit); + + const substitutePlaceholders = require('${{ runner.temp }}/gh-aw/actions/substitute_placeholders.cjs'); + + // Call the substitution function + return await substitutePlaceholders({ + file: process.env.GH_AW_PROMPT, + substitutions: { + GH_AW_ALLOWED_EXTENSIONS: process.env.GH_AW_ALLOWED_EXTENSIONS, + GH_AW_CACHE_DESCRIPTION: process.env.GH_AW_CACHE_DESCRIPTION, + GH_AW_CACHE_DIR: process.env.GH_AW_CACHE_DIR, + GH_AW_EXPR_1A3A194A: process.env.GH_AW_EXPR_1A3A194A, + GH_AW_EXPR_463A214A: process.env.GH_AW_EXPR_463A214A, + GH_AW_EXPR_802A9F6A: process.env.GH_AW_EXPR_802A9F6A, + GH_AW_EXPR_FF1D34CE: process.env.GH_AW_EXPR_FF1D34CE, + GH_AW_GITHUB_ACTOR: process.env.GH_AW_GITHUB_ACTOR, + GH_AW_GITHUB_EVENT_ISSUE_NUMBER: process.env.GH_AW_GITHUB_EVENT_ISSUE_NUMBER, + GH_AW_GITHUB_REPOSITORY: process.env.GH_AW_GITHUB_REPOSITORY, + GH_AW_GITHUB_RUN_ID: process.env.GH_AW_GITHUB_RUN_ID, + GH_AW_GITHUB_WORKSPACE: process.env.GH_AW_GITHUB_WORKSPACE, + GH_AW_IS_PR_COMMENT: process.env.GH_AW_IS_PR_COMMENT, + GH_AW_MCP_CLI_SERVERS_LIST: process.env.GH_AW_MCP_CLI_SERVERS_LIST, + GH_AW_NEEDS_PRE_ACTIVATION_OUTPUTS_ACTIVATED: process.env.GH_AW_NEEDS_PRE_ACTIVATION_OUTPUTS_ACTIVATED, + GH_AW_NEEDS_PRE_ACTIVATION_OUTPUTS_MATCHED_COMMAND: process.env.GH_AW_NEEDS_PRE_ACTIVATION_OUTPUTS_MATCHED_COMMAND, + GH_AW_STEPS_SANITIZED_OUTPUTS_TEXT: process.env.GH_AW_STEPS_SANITIZED_OUTPUTS_TEXT + } + }); + - name: Validate prompt placeholders + env: + GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt + # poutine:ignore untrusted_checkout_exec + run: bash "${RUNNER_TEMP}/gh-aw/actions/validate_prompt_placeholders.sh" + - name: Print prompt + env: + GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt + # poutine:ignore untrusted_checkout_exec + run: bash "${RUNNER_TEMP}/gh-aw/actions/print_prompt_summary.sh" + - name: Upload activation artifact + if: success() + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + with: + name: activation + include-hidden-files: true + path: | + /tmp/gh-aw/aw_info.json + /tmp/gh-aw/models.json + /tmp/gh-aw/aw-prompts/prompt.txt + /tmp/gh-aw/aw-prompts/prompt-template.txt + /tmp/gh-aw/aw-prompts/prompt-import-tree.json + /tmp/gh-aw/github_rate_limits.jsonl + /tmp/gh-aw/base + /tmp/gh-aw/.github/agents + /tmp/gh-aw/.github/skills + if-no-files-found: ignore + retention-days: 1 + + agent: + needs: activation + if: needs.activation.outputs.daily_ai_credits_exceeded != 'true' + runs-on: ubuntu-latest + permissions: + actions: read + contents: read + copilot-requests: write + issues: read + pull-requests: read + env: + DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} + GH_AW_ASSETS_ALLOWED_EXTS: "" + GH_AW_ASSETS_BRANCH: "" + GH_AW_ASSETS_MAX_SIZE_KB: 0 + GH_AW_MCP_LOG_DIR: /tmp/gh-aw/mcp-logs/safeoutputs + GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} + GH_AW_WORKFLOW_ID_SANITIZED: authdoctor + outputs: + agentic_engine_timeout: ${{ steps.detect-agent-errors.outputs.agentic_engine_timeout || 'false' }} + ai_credits_rate_limit_error: ${{ steps.parse-mcp-gateway.outputs.ai_credits_rate_limit_error || 'false' }} + aic: ${{ steps.parse-mcp-gateway.outputs.aic }} + ambient_context: ${{ steps.parse-mcp-gateway.outputs.ambient_context }} + cache_memory_restore_0_cache_hit: ${{ steps.restore_cache_memory_0.outputs.cache-hit || 'false' }} + cache_memory_restore_0_matched_key: ${{ steps.restore_cache_memory_0.outputs.cache-matched-key || '' }} + checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }} + effective_tokens: ${{ steps.parse-mcp-gateway.outputs.effective_tokens }} + has_patch: ${{ steps.collect_output.outputs.has_patch }} + http_400_response_error: ${{ steps.detect-agent-errors.outputs.http_400_response_error || 'false' }} + inference_access_error: ${{ steps.detect-agent-errors.outputs.inference_access_error || 'false' }} + invocation_cap_exceeded: ${{ steps.detect-agent-errors.outputs.invocation_cap_exceeded || 'false' }} + max_cache_misses_exceeded: ${{ steps.detect-agent-errors.outputs.max_cache_misses_exceeded || 'false' }} + mcp_policy_error: ${{ steps.detect-agent-errors.outputs.mcp_policy_error || 'false' }} + missing_model_pricing_error: ${{ steps.detect-agent-errors.outputs.missing_model_pricing_error || 'false' }} + missing_model_pricing_model_name: ${{ steps.detect-agent-errors.outputs.missing_model_pricing_model_name || '' }} + model: ${{ needs.activation.outputs.model }} + model_not_supported_error: ${{ steps.detect-agent-errors.outputs.model_not_supported_error || 'false' }} + output: ${{ steps.collect_output.outputs.output }} + output_types: ${{ steps.collect_output.outputs.output_types }} + setup-parent-span-id: ${{ steps.setup.outputs.parent-span-id || steps.setup.outputs.span-id }} + setup-span-id: ${{ steps.setup.outputs.span-id }} + setup-trace-id: ${{ steps.setup.outputs.trace-id }} + unknown_model_ai_credits: ${{ steps.parse-mcp-gateway.outputs.unknown_model_ai_credits || 'false' }} + steps: + - name: Setup Scripts + id: setup + uses: github/gh-aw-actions/setup@c863074e6da7866f66d9ce31ce11429384406f5f # v0.84.3 + with: + destination: ${{ runner.temp }}/gh-aw/actions + job-name: ${{ github.job }} + trace-id: ${{ needs.activation.outputs.setup-trace-id }} + parent-span-id: ${{ needs.activation.outputs.setup-parent-span-id || needs.activation.outputs.setup-span-id }} + env: + GH_AW_SETUP_WORKFLOW_NAME: "Auth Doctor" + GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/auth-doctor.lock.yml@${{ github.ref }} + GH_AW_INFO_VERSION: "1.0.77" + GH_AW_INFO_AWF_VERSION: "v0.27.43" + GH_AW_INFO_ENGINE_ID: "copilot" + - name: Set runtime paths + id: set-runtime-paths + run: | + { + echo "GH_AW_SAFE_OUTPUTS=${RUNNER_TEMP}/gh-aw/safeoutputs/outputs.jsonl" + echo "GH_AW_SAFE_OUTPUTS_CONFIG_PATH=${RUNNER_TEMP}/gh-aw/safeoutputs/config.json" + echo "GH_AW_SAFE_OUTPUTS_TOOLS_PATH=${RUNNER_TEMP}/gh-aw/safeoutputs/tools.json" + } >> "$GITHUB_OUTPUT" + - name: Checkout repository + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + - name: Create gh-aw temp directory + run: bash "${RUNNER_TEMP}/gh-aw/actions/create_gh_aw_tmp_dir.sh" + - name: Configure gh CLI for GitHub Enterprise + run: bash "${RUNNER_TEMP}/gh-aw/actions/configure_gh_for_ghe.sh" + env: + GH_TOKEN: ${{ github.token }} + - name: Download activation artifact + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + with: + name: activation + path: /tmp/gh-aw + # Cache memory file share configuration from frontmatter processed below + - name: Create cache-memory directory + run: bash "${RUNNER_TEMP}/gh-aw/actions/create_cache_memory_dir.sh" + - name: Restore cache-memory file share data + id: restore_cache_memory_0 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 + with: + key: memory-none-nopolicy-${{ env.GH_AW_WORKFLOW_ID_SANITIZED }}-${{ github.run_id }} + path: /tmp/gh-aw/cache-memory + restore-keys: | + memory-none-nopolicy-${{ env.GH_AW_WORKFLOW_ID_SANITIZED }}- + - name: Setup cache-memory git repository + env: + GH_AW_CACHE_DIR: /tmp/gh-aw/cache-memory + GH_AW_MIN_INTEGRITY: none + run: bash "${RUNNER_TEMP}/gh-aw/actions/setup_cache_memory_git.sh" + - name: Configure Git credentials + env: + GITHUB_REPOSITORY: ${{ github.repository }} + GITHUB_SERVER_URL: ${{ github.server_url }} + GITHUB_TOKEN: ${{ github.token }} + run: bash "${RUNNER_TEMP}/gh-aw/actions/configure_git_credentials.sh" + - name: Checkout PR branch + id: checkout-pr + if: | + github.event.pull_request || github.event.issue.pull_request || github.event_name == 'workflow_dispatch' && fromJSON(github.event.inputs.aw_context || '{}').item_type == 'pull_request' + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + env: + GH_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} + with: + github-token: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} + script: | + const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs'); + setupGlobals(core, github, context, exec, io, getOctokit); + const { main } = require('${{ runner.temp }}/gh-aw/actions/checkout_pr_branch.cjs'); + await main(); + - name: Install GitHub Copilot CLI + run: bash "${RUNNER_TEMP}/gh-aw/actions/install_copilot_cli.sh" + env: + GH_HOST: github.com + GH_AW_COMPILED_VERSION: v0.84.3 + - name: Install AWF binary + run: bash "${RUNNER_TEMP}/gh-aw/actions/install_awf_binary.sh" v0.27.43 --rootless + - name: Determine automatic lockdown mode for GitHub MCP Server + id: determine-automatic-lockdown + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 (source v9) + env: + GH_AW_GITHUB_TOKEN: ${{ secrets.GH_AW_GITHUB_TOKEN }} + GH_AW_GITHUB_MCP_SERVER_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN }} + with: + script: | + const determineAutomaticLockdown = require('${{ runner.temp }}/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); + - name: Restore agent config folders from base branch + if: steps.checkout-pr.outcome == 'success' + env: + GH_AW_AGENT_FOLDERS: ".agents .antigravity .claude .codex .gemini .github .opencode .pi" + GH_AW_AGENT_FILES: "AGENTS.md ANTIGRAVITY.md CLAUDE.md GEMINI.md PI.md opencode.jsonc" + run: bash "${RUNNER_TEMP}/gh-aw/actions/restore_base_github_folders.sh" + - name: Restore inline sub-agents from activation artifact + env: + GH_AW_SUB_AGENT_DIR: ".github/agents" + GH_AW_SUB_AGENT_EXT: ".agent.md" + run: bash "${RUNNER_TEMP}/gh-aw/actions/restore_inline_sub_agents.sh" + - name: Restore inline skills from activation artifact + env: + GH_AW_SKILL_DIR: ".github/skills" + run: bash "${RUNNER_TEMP}/gh-aw/actions/restore_inline_skills.sh" + - name: Download container images + run: bash "${RUNNER_TEMP}/gh-aw/actions/download_docker_images.sh" ghcr.io/github/gh-aw-firewall/agent:0.27.43@sha256:04e2d1987a565000a8f114b89d806ae7a3864dd4f944be65275b28c93d8690e6 ghcr.io/github/gh-aw-firewall/api-proxy:0.27.43@sha256:d85f57975af5ea23af4996e41ed73fbc8f5b4a47402472bfe82e508f352cb0c1 ghcr.io/github/gh-aw-firewall/squid:0.27.43@sha256:26be5e0b8c8f4c41c8a59126b29bb5d80b07253597472ded2a16bdd75abcbf9d ghcr.io/github/gh-aw-mcpg:v0.4.7@sha256:7545220a9aca134b71e51193ee0eaf4c50756ebf8fbd25a63ae7556e62815c00 ghcr.io/github/gh-aw-node@sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b ghcr.io/github/github-mcp-server:v1.8.0@sha256:d5a18c04b92714c309eb46a2305087e91a4dbd80420f6e462656699f95093520 + - name: Generate Safe Outputs Config + run: | + mkdir -p "${RUNNER_TEMP}/gh-aw/safeoutputs" + mkdir -p /tmp/gh-aw/safeoutputs + mkdir -p /tmp/gh-aw/mcp-logs/safeoutputs + cat > "${RUNNER_TEMP}/gh-aw/safeoutputs/config.json" << 'GH_AW_SAFE_OUTPUTS_CONFIG_1b26556e625f491f_EOF' + {"add_comment":{"max":1},"create_issue":{"max":1,"title_prefix":"🩺 Auth Doctor"},"create_report_incomplete_issue":{},"mentions":{"enabled":false},"missing_data":{},"missing_tool":{},"noop":{"max":1,"report-as-issue":"true"},"report_incomplete":{}} + GH_AW_SAFE_OUTPUTS_CONFIG_1b26556e625f491f_EOF + - name: Generate Safe Outputs Tools + env: + GH_AW_TOOLS_META_JSON: | + { + "description_suffixes": { + "add_comment": " CONSTRAINTS: Maximum 1 comment(s) can be added. Supports reply_to_id for discussion threading.", + "create_issue": " CONSTRAINTS: Maximum 1 issue(s) can be created. Title will be prefixed with \"🩺 Auth Doctor\"." + }, + "repo_params": {}, + "dynamic_tools": [] + } + GH_AW_VALIDATION_JSON: | + { + "add_comment": { + "defaultMax": 1, + "fields": { + "body": { + "required": true, + "type": "string", + "sanitize": true, + "maxLength": 65000 + }, + "item_number": { + "issueOrPRNumber": true + }, + "reply_to_id": { + "type": "string", + "maxLength": 256 + }, + "repo": { + "type": "string", + "maxLength": 256 + } + } + }, + "create_issue": { + "defaultMax": 1, + "fields": { + "body": { + "required": true, + "type": "string", + "sanitize": true, + "maxLength": 65000, + "minLength": 20 + }, + "fields": { + "type": "array" + }, + "labels": { + "type": "array", + "itemType": "string", + "itemSanitize": true, + "itemMaxLength": 128 + }, + "parent": { + "issueOrPRNumber": true + }, + "repo": { + "type": "string", + "maxLength": 256 + }, + "temporary_id": { + "type": "string" + }, + "title": { + "required": true, + "type": "string", + "sanitize": true, + "maxLength": 128 + } + } + }, + "mentions": { + "enabled": false + }, + "missing_data": { + "defaultMax": 20, + "fields": { + "alternatives": { + "type": "string", + "sanitize": true, + "maxLength": 256 + }, + "context": { + "type": "string", + "sanitize": true, + "maxLength": 256 + }, + "data_type": { + "type": "string", + "sanitize": true, + "maxLength": 128 + }, + "reason": { + "type": "string", + "sanitize": true, + "maxLength": 256 + } + } + }, + "missing_tool": { + "defaultMax": 20, + "fields": { + "alternatives": { + "type": "string", + "sanitize": true, + "maxLength": 512 + }, + "reason": { + "required": true, + "type": "string", + "sanitize": true, + "maxLength": 256 + }, + "tool": { + "type": "string", + "sanitize": true, + "maxLength": 128 + } + } + }, + "noop": { + "defaultMax": 1, + "fields": { + "message": { + "required": true, + "type": "string", + "sanitize": true, + "maxLength": 65000 + } + } + }, + "report_incomplete": { + "defaultMax": 5, + "fields": { + "details": { + "type": "string", + "sanitize": true, + "maxLength": 65000 + }, + "reason": { + "required": true, + "type": "string", + "sanitize": true, + "maxLength": 1024 + } + } + } + } + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + with: + script: | + const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs'); + setupGlobals(core, github, context, exec, io, getOctokit); + const { main } = require('${{ runner.temp }}/gh-aw/actions/generate_safe_outputs_tools.cjs'); + await main(); + - name: Start MCP Gateway + id: start-mcp-gateway + env: + GH_AW_POLICY_ALLOW_CREATE_PULL_REQUEST: ${{ vars.GH_AW_POLICY_ALLOW_CREATE_PULL_REQUEST || 'true' }} + GH_AW_SAFE_OUTPUTS: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS }} + GH_AW_SAFE_OUTPUTS_CONFIG_PATH: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS_CONFIG_PATH }} + GH_AW_SAFE_OUTPUTS_TOOLS_PATH: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS_TOOLS_PATH }} + GH_AW_SINK_VISIBILITY: ${{ steps.determine-automatic-lockdown.outputs.visibility }} + GITHUB_MCP_GUARD_MIN_INTEGRITY: ${{ steps.determine-automatic-lockdown.outputs.min_integrity }} + GITHUB_MCP_GUARD_REPOS: ${{ steps.determine-automatic-lockdown.outputs.repos }} + GITHUB_MCP_SERVER_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + run: | + set -eo pipefail + mkdir -p "${RUNNER_TEMP}/gh-aw/mcp-config" + + # Export gateway environment variables for MCP config and gateway script + export MCP_GATEWAY_PORT="8080" + export MCP_GATEWAY_DOMAIN="awmg-mcpg" + export MCP_GATEWAY_HOST_DOMAIN="localhost" + MCP_GATEWAY_API_KEY=$(openssl rand -base64 45 | tr -d '/+=') + echo "::add-mask::${MCP_GATEWAY_API_KEY}" + export MCP_GATEWAY_API_KEY + export MCP_GATEWAY_PAYLOAD_DIR="/tmp/gh-aw/mcp-payloads" + mkdir -p "${MCP_GATEWAY_PAYLOAD_DIR}" + export MCP_GATEWAY_PAYLOAD_SIZE_THRESHOLD="524288" + export DEBUG="*" + + export GH_AW_ENGINE="copilot" + MCP_GATEWAY_UID=$(id -u 2>/dev/null || echo '0') + MCP_GATEWAY_GID=$(id -g 2>/dev/null || echo '0') + source "${RUNNER_TEMP}/gh-aw/actions/resolve_docker_socket_gid.sh" + export MCP_GATEWAY_DOCKER_COMMAND='docker run -i --rm --network bridge -p 127.0.0.1:'"${MCP_GATEWAY_PORT}"':'"${MCP_GATEWAY_PORT}"' --name awmg-mcpg --add-host host.docker.internal:host-gateway --user '"${MCP_GATEWAY_UID}"':'"${MCP_GATEWAY_GID}"' --group-add '"${DOCKER_SOCK_GID}"' -v '"${DOCKER_SOCK_PATH}"':/var/run/docker.sock -e MCP_GATEWAY_PORT -e MCP_GATEWAY_DOMAIN -e MCP_GATEWAY_API_KEY -e MCP_GATEWAY_PAYLOAD_DIR -e MCP_GATEWAY_PAYLOAD_SIZE_THRESHOLD -e DOCKER_HOST=unix:///var/run/docker.sock -e DEBUG -e MCP_GATEWAY_LOG_DIR -e GH_AW_MCP_LOG_DIR -e GH_AW_SAFE_OUTPUTS -e GH_AW_SAFE_OUTPUTS_CONFIG_PATH -e GH_AW_SAFE_OUTPUTS_TOOLS_PATH -e GH_AW_POLICY_ALLOW_CREATE_PULL_REQUEST -e GH_AW_ASSETS_BRANCH -e GH_AW_ASSETS_MAX_SIZE_KB -e GH_AW_ASSETS_ALLOWED_EXTS -e DEFAULT_BRANCH -e GITHUB_MCP_SERVER_TOKEN -e GITHUB_MCP_GUARD_MIN_INTEGRITY -e GITHUB_MCP_GUARD_REPOS -e GH_AW_SINK_VISIBILITY -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e GITHUB_SHA -e GITHUB_WORKSPACE -e GITHUB_TOKEN -e GITHUB_RUN_ID -e GITHUB_RUN_NUMBER -e GITHUB_RUN_ATTEMPT -e GITHUB_JOB -e GITHUB_ACTION -e GITHUB_EVENT_NAME -e GITHUB_EVENT_PATH -e GITHUB_ACTOR -e GITHUB_ACTOR_ID -e GITHUB_TRIGGERING_ACTOR -e GITHUB_WORKFLOW -e GITHUB_WORKFLOW_REF -e GITHUB_WORKFLOW_SHA -e GITHUB_REF -e GITHUB_REF_NAME -e GITHUB_REF_TYPE -e GITHUB_HEAD_REF -e GITHUB_BASE_REF -e RUNNER_TEMP -v /tmp/gh-aw/mcp-payloads:/tmp/gh-aw/mcp-payloads:rw -v /opt:/opt:ro -v /tmp:/tmp:rw -v '"${GITHUB_WORKSPACE}"':'"${GITHUB_WORKSPACE}"':rw -v '"${RUNNER_TEMP}"'/gh-aw/safeoutputs:'"${RUNNER_TEMP}"'/gh-aw/safeoutputs:rw ghcr.io/github/gh-aw-mcpg:v0.4.7' + + mkdir -p "$HOME/.copilot" + GH_AW_NODE=$(which node 2>/dev/null || command -v node 2>/dev/null || echo node) + cat << GH_AW_MCP_CONFIG_bd6748a39fe70b8b_EOF | "$GH_AW_NODE" "${RUNNER_TEMP}/gh-aw/actions/start_mcp_gateway.cjs" + { + "mcpServers": { + "github": { + "type": "stdio", + "container": "ghcr.io/github/github-mcp-server:v1.8.0", + "env": { + "GITHUB_FEATURES": "fields_param", + "GITHUB_HOST": "${GITHUB_SERVER_URL}", + "GITHUB_PERSONAL_ACCESS_TOKEN": "${GITHUB_MCP_SERVER_TOKEN}", + "GITHUB_READ_ONLY": "1", + "GITHUB_TOOLSETS": "context,repos,issues,pull_requests" + }, + "guard-policies": { + "allow-only": { + "min-integrity": "$GITHUB_MCP_GUARD_MIN_INTEGRITY", + "repos": "$GITHUB_MCP_GUARD_REPOS" + } + } + }, + "safeoutputs": { + "type": "stdio", + "container": "ghcr.io/github/gh-aw-node", + "mounts": ["\${GITHUB_WORKSPACE}:\${GITHUB_WORKSPACE}:rw", "${RUNNER_TEMP}/gh-aw/safeoutputs:${RUNNER_TEMP}/gh-aw/safeoutputs:rw", "/tmp/gh-aw:/tmp/gh-aw:rw"], + "args": ["-w", "\${GITHUB_WORKSPACE}"], + "entrypoint": "sh", + "entrypointArgs": ["-c", "sh ${RUNNER_TEMP}/gh-aw/safeoutputs/start_safe_outputs_mcp.sh"], + "env": { + "DEBUG": "*", + "DEFAULT_BRANCH": "\${DEFAULT_BRANCH}", + "GH_AW_ASSETS_ALLOWED_EXTS": "\${GH_AW_ASSETS_ALLOWED_EXTS}", + "GH_AW_ASSETS_BRANCH": "\${GH_AW_ASSETS_BRANCH}", + "GH_AW_ASSETS_MAX_SIZE_KB": "\${GH_AW_ASSETS_MAX_SIZE_KB}", + "GH_AW_MCP_LOG_DIR": "\${GH_AW_MCP_LOG_DIR}", + "GH_AW_SAFE_OUTPUTS": "\${GH_AW_SAFE_OUTPUTS}", + "GH_AW_SAFE_OUTPUTS_CONFIG_PATH": "\${GH_AW_SAFE_OUTPUTS_CONFIG_PATH}", + "GH_AW_SAFE_OUTPUTS_TOOLS_PATH": "\${GH_AW_SAFE_OUTPUTS_TOOLS_PATH}", + "GH_AW_POLICY_ALLOW_CREATE_PULL_REQUEST": "\${GH_AW_POLICY_ALLOW_CREATE_PULL_REQUEST}", + "GITHUB_REPOSITORY": "\${GITHUB_REPOSITORY}", + "GITHUB_SHA": "\${GITHUB_SHA}", + "GITHUB_TOKEN": "\${GITHUB_TOKEN}", + "GITHUB_WORKSPACE": "\${GITHUB_WORKSPACE}", + "RUNNER_TEMP": "\${RUNNER_TEMP}" + }, + "guard-policies": { + "write-sink": { + "accept": [ + "*" + ], + "sink-visibility": "${GH_AW_SINK_VISIBILITY}" + } + } + } + }, + "gateway": { + "port": $MCP_GATEWAY_PORT, + "domain": "${MCP_GATEWAY_DOMAIN}", + "apiKey": "${MCP_GATEWAY_API_KEY}", + "payloadDir": "${MCP_GATEWAY_PAYLOAD_DIR}", + "startupTimeout": 120 + } + } + GH_AW_MCP_CONFIG_bd6748a39fe70b8b_EOF + - name: Mount MCP servers as CLIs + id: mount-mcp-clis + continue-on-error: true + env: + MCP_GATEWAY_API_KEY: ${{ steps.start-mcp-gateway.outputs.gateway-api-key }} + MCP_GATEWAY_DOMAIN: ${{ steps.start-mcp-gateway.outputs.gateway-domain }} + MCP_GATEWAY_PORT: ${{ steps.start-mcp-gateway.outputs.gateway-port }} + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + with: + script: | + const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs'); + setupGlobals(core, github, context, exec, io); + const { main } = require('${{ runner.temp }}/gh-aw/actions/mount_mcp_as_cli.cjs'); + await main(); + - name: Clean credentials + continue-on-error: true + run: bash "${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh" + - name: Audit pre-agent workspace + id: pre_agent_audit + continue-on-error: true + run: bash "${RUNNER_TEMP}/gh-aw/actions/audit_pre_agent_workspace.sh" + - name: Execute GitHub Copilot CLI + id: agentic_execution + # Copilot CLI tool arguments (sorted): + timeout-minutes: 15 + run: | + set -o pipefail + printf '%s' "$(date +%s%3N)" > /tmp/gh-aw/agent_cli_start_ms.txt + trap 'gh_aw_exit_code=$?; mkdir -p /tmp/gh-aw >/dev/null 2>&1 || true; printf "%s" "$gh_aw_exit_code" > /tmp/gh-aw/agent_execution_exit_code.txt || true; rm -f "$HOME/.copilot/settings.json"' EXIT + mkdir -p "$HOME/.copilot" + printf '%s' '{"builtInAgents":{"rubberDuck":false}}' > "$HOME/.copilot/settings.json" + export XDG_CONFIG_HOME="$HOME" + export GH_AW_MCP_CONFIG="$HOME/.copilot/mcp-config.json" + touch /tmp/gh-aw/agent-step-summary.md + GH_AW_NODE_BIN=$(command -v node 2>/dev/null || true) + export GH_AW_NODE_BIN + export COPILOT_API_KEY="$COPILOT_DUMMY_BYOK" + (umask 177 && touch /tmp/gh-aw/agent-stdio.log) + GH_AW_MAX_AI_CREDITS="${GH_AW_MAX_AI_CREDITS:-1000}" + printf '%s\n' "{\"\$schema\":\"https://github.com/github/gh-aw-firewall/releases/download/v0.27.43/awf-config.schema.json\",\"network\":{\"allowDomains\":[\"*.githubusercontent.com\",\"api.business.githubcopilot.com\",\"api.enterprise.githubcopilot.com\",\"api.github.com\",\"api.githubcopilot.com\",\"api.individual.githubcopilot.com\",\"codeload.github.com\",\"docs.github.com\",\"github-cloud.githubusercontent.com\",\"github-cloud.s3.amazonaws.com\",\"github.blog\",\"github.com\",\"github.githubassets.com\",\"host.docker.internal\",\"lfs.github.com\",\"objects.githubusercontent.com\",\"patch-diff.githubusercontent.com\",\"patchdiff.githubusercontent.com\",\"raw.githubusercontent.com\",\"registry.npmjs.org\",\"telemetry.enterprise.githubcopilot.com\"],\"isolation\":true,\"topologyAttach\":[\"awmg-mcpg\"]},\"apiProxy\":{\"enabled\":true,\"enableTokenSteering\":true,\"maxRuns\":500,\"maxAiCredits\":${GH_AW_MAX_AI_CREDITS},\"maxCacheMisses\":5,\"models\":{\"agent\":[\"sonnet-6x\",\"gpt-5.4\",\"gpt-5.5\",\"gpt-5.6\",\"gpt-5.3\",\"gemini-pro\",\"any\"],\"antigravity\":[\"copilot/antigravity*\",\"google/antigravity*\",\"gemini/antigravity*\"],\"any\":[\"copilot/*\",\"anthropic/*\",\"openai/*\",\"google/*\",\"gemini/*\"],\"auto\":[\"copilot/auto\",\"large\"],\"claude\":[\"agent\"],\"codex\":[\"agent\"],\"coding\":[\"copilot/gpt-5*codex*\",\"openai/gpt-5*codex*\",\"gpt-5-codex\",\"kimi\"],\"computer-use\":[\"copilot/*computer-use*\",\"google/*computer-use*\",\"gemini/*computer-use*\",\"openai/*computer-use*\"],\"copilot\":[\"agent\"],\"deep-research\":[\"copilot/deep-research*\",\"copilot/o3-deep-research*\",\"copilot/o4-mini-deep-research*\",\"google/deep-research*\",\"gemini/deep-research*\",\"openai/o3-deep-research*\",\"openai/o4-mini-deep-research*\"],\"detection\":[\"small\"],\"evals\":[\"small\"],\"fable\":[\"copilot/*fable*\",\"anthropic/*fable*\"],\"gemini\":[\"agent\"],\"gemini-3-flash\":[\"copilot/gemini-3*flash*\",\"google/gemini-3*flash*\",\"gemini/gemini-3*flash*\"],\"gemini-3-pro\":[\"copilot/gemini-3*pro*\",\"google/gemini-3*pro*\",\"google/nano-banana*\",\"gemini/gemini-3*pro*\"],\"gemini-3.1-flash\":[\"copilot/gemini-3.1*flash*\",\"google/gemini-3.1*flash*\",\"gemini/gemini-3.1*flash*\"],\"gemini-3.1-pro\":[\"copilot/gemini-3.1*pro*\",\"google/gemini-3.1*pro*\",\"gemini/gemini-3.1*pro*\"],\"gemini-3.5-flash\":[\"copilot/gemini-3.5*flash*\",\"google/gemini-3.5*flash*\",\"gemini/gemini-3.5*flash*\"],\"gemini-3.6-flash\":[\"copilot/gemini-3.6*flash*\",\"google/gemini-3.6*flash*\",\"gemini/gemini-3.6*flash*\"],\"gemini-flash\":[\"copilot/gemini-*flash*\",\"google/gemini-*flash*\",\"gemini/gemini-*flash*\"],\"gemini-flash-lite\":[\"copilot/gemini-*flash*lite*\",\"google/gemini-*flash*lite*\",\"gemini/gemini-*flash*lite*\"],\"gemini-omni\":[\"copilot/gemini-omni*\",\"google/gemini-omni*\",\"gemini/gemini-omni*\"],\"gemini-pro\":[\"copilot/gemini-*pro*\",\"google/gemini-*pro*\",\"gemini/gemini-*pro*\"],\"gemma\":[\"copilot/gemma*\",\"google/gemma*\",\"gemini/gemma*\"],\"gpt-5\":[\"copilot/gpt-5*\",\"openai/gpt-5*\"],\"gpt-5-codex\":[\"copilot/gpt-5*codex*\",\"openai/gpt-5*codex*\"],\"gpt-5-mini\":[\"copilot/gpt-5*mini*\",\"openai/gpt-5*mini*\"],\"gpt-5-nano\":[\"copilot/gpt-5*nano*\",\"openai/gpt-5*nano*\"],\"gpt-5-pro\":[\"copilot/gpt-5*pro*\",\"openai/gpt-5*pro*\"],\"gpt-5.1\":[\"copilot/gpt-5.1*\",\"openai/gpt-5.1*\"],\"gpt-5.2\":[\"copilot/gpt-5.2*\",\"openai/gpt-5.2*\"],\"gpt-5.3\":[\"copilot/gpt-5.3*\",\"openai/gpt-5.3*\"],\"gpt-5.4\":[\"copilot/gpt-5.4*\",\"openai/gpt-5.4*\"],\"gpt-5.5\":[\"copilot/gpt-5.5*\",\"openai/gpt-5.5*\"],\"gpt-5.6\":[\"copilot/gpt-5.6*\",\"openai/gpt-5.6*\"],\"grok\":[\"copilot/*grok*\",\"openai/*grok*\"],\"haiku\":[\"copilot/*haiku*\",\"anthropic/*haiku*\"],\"image-generation\":[\"copilot/gpt-image*\",\"openai/gpt-image*\",\"openai/chatgpt-image*\",\"copilot/gemini-*image*\",\"google/gemini-*image*\",\"gemini/gemini-*image*\",\"google/imagen*\"],\"kimi\":[\"copilot/kimi*\",\"openai/kimi*\"],\"kiwi\":[\"copilot/kiwi*\",\"openai/kiwi*\"],\"large\":[\"sonnet\",\"gpt-5-pro\",\"gpt-5\",\"gemini-pro\"],\"lyria\":[\"google/lyria*\",\"gemini/lyria*\",\"copilot/lyria*\"],\"mai-code\":[\"copilot/MAI-Code*\",\"copilot/mai-code*\",\"openai/MAI-Code*\"],\"mai-code-1-flash-picker\":[\"copilot/MAI-Code-1-Flash-picker*\",\"copilot/mai-code-1-flash-picker*\",\"openai/MAI-Code-1-Flash-picker*\"],\"mini\":[\"haiku\",\"gpt-5-mini\",\"gpt-5-nano\",\"gemini-flash-lite\"],\"nano-banana\":[\"copilot/nano-banana*\",\"google/nano-banana*\",\"gemini/nano-banana*\"],\"opus\":[\"copilot/*opus*\",\"anthropic/*opus*\"],\"opusplan\":[\"opus?effort=high\"],\"raptor-mini\":[\"copilot/raptor*\",\"openai/raptor*\"],\"reasoning\":[\"copilot/o1*\",\"copilot/o3*\",\"copilot/o4*\",\"openai/o1*\",\"openai/o3*\",\"openai/o4*\"],\"robotics\":[\"copilot/*robotics*\",\"google/*robotics*\",\"gemini/*robotics*\"],\"small\":[\"mini\"],\"small-agent\":[\"haiku\",\"gpt-5-mini\",\"gemini-flash\"],\"sonnet\":[\"copilot/*sonnet*\",\"anthropic/*sonnet*\"],\"sonnet-6x\":[\"copilot/*sonnet-4.5*\",\"copilot/*sonnet-4.6*\",\"copilot/*sonnet-5*\",\"copilot/*sonnet-4-5-*\",\"anthropic/*sonnet-4-5-*\",\"copilot/*sonnet-4-6*\",\"anthropic/*sonnet-4-6*\",\"anthropic/*sonnet-5*\"],\"summarization\":[\"haiku\",\"gpt-5-mini\",\"gemini-flash-lite\",\"mini\"],\"veo\":[\"google/veo*\",\"gemini/veo*\"],\"vision\":[\"copilot/gemini-*image*\",\"google/gemini-*image*\",\"gemini/gemini-*image*\",\"copilot/gemini-*flash*\",\"google/gemini-*flash*\",\"gemini/gemini-*flash*\"]}},\"container\":{\"imageTag\":\"0.27.43,squid=sha256:26be5e0b8c8f4c41c8a59126b29bb5d80b07253597472ded2a16bdd75abcbf9d,agent=sha256:04e2d1987a565000a8f114b89d806ae7a3864dd4f944be65275b28c93d8690e6,api-proxy=sha256:d85f57975af5ea23af4996e41ed73fbc8f5b4a47402472bfe82e508f352cb0c1,cli-proxy=sha256:65c45ea2967984d0024f3df61bc71335658a77ede96c8d9665da7a5f33a795ab\"},\"logging\":{\"proxyLogsDir\":\"/tmp/gh-aw/sandbox/firewall/logs\",\"auditDir\":\"/tmp/gh-aw/sandbox/firewall/audit\"}}" > "${RUNNER_TEMP}/gh-aw/awf-config.json" + cp "${RUNNER_TEMP}/gh-aw/awf-config.json" /tmp/gh-aw/awf-config.json + export GH_AW_MODELS_JSON_PATH="/tmp/gh-aw/models.json" + GH_AW_DOCKER_HOST="" + if [[ "${DOCKER_HOST:-}" =~ ^tcp:// ]]; then + GH_AW_DOCKER_HOST="${DOCKER_HOST}" + fi + if [[ "${DOCKER_HOST:-}" =~ ^tcp:// ]]; then + GH_AW_CHROOT_BINARIES_SOURCE_PATH="${RUNNER_TEMP}/gh-aw" GH_AW_CHROOT_IDENTITY_HOME="${RUNNER_TEMP}/gh-aw/home" node "${RUNNER_TEMP}/gh-aw/actions/patch_awf_chroot_config.cjs" + fi + GH_AW_TOOL_CACHE_MOUNT="" + GH_AW_TOOL_CACHE="${RUNNER_TOOL_CACHE:?RUNNER_TOOL_CACHE must be set}" + if [ -d "$GH_AW_TOOL_CACHE" ]; then + if [[ "$GH_AW_TOOL_CACHE" != /opt/* ]]; then + GH_AW_TOOL_CACHE_MOUNT="$GH_AW_TOOL_CACHE:$GH_AW_TOOL_CACHE:ro" + fi + fi + # shellcheck disable=SC1003,SC2016,SC2086 + awf --config "${RUNNER_TEMP}/gh-aw/awf-config.json" --container-workdir "${GITHUB_WORKSPACE}" --mount "${RUNNER_TEMP}/gh-aw:${RUNNER_TEMP}/gh-aw:ro" --mount "${RUNNER_TEMP}/gh-aw:/host${RUNNER_TEMP}/gh-aw:ro" ${GH_AW_TOOL_CACHE_MOUNT:+--mount "$GH_AW_TOOL_CACHE_MOUNT"} ${GH_AW_DOCKER_HOST:+--docker-host "$GH_AW_DOCKER_HOST"} --env-all --exclude-env COPILOT_GITHUB_TOKEN --exclude-env GITHUB_MCP_SERVER_TOKEN --exclude-env MCP_GATEWAY_API_KEY --log-level info --skip-pull \ + -- /bin/bash -c 'set +o histexpand; export PATH="${RUNNER_TEMP}/gh-aw/mcp-cli/bin:$PATH" && : "${RUNNER_TOOL_CACHE:?RUNNER_TOOL_CACHE must be set}"; GH_AW_TOOL_CACHE="$RUNNER_TOOL_CACHE"; export PATH="$(find "$GH_AW_TOOL_CACHE" -maxdepth 5 -type d -name bin 2>/dev/null | tr '\''\n'\'' '\'':'\'')$PATH"; [ -n "$GOROOT" ] && export PATH="$GOROOT/bin:$PATH" || true; [ -n "$ERLANG_HOME" ] && export PATH="$ERLANG_HOME/bin:$PATH" || true && GH_AW_NODE_EXEC="${GH_AW_NODE_BIN:-}"; if [ -z "$GH_AW_NODE_EXEC" ] || [ ! -x "$GH_AW_NODE_EXEC" ]; then GH_AW_NODE_EXEC="$(command -v node 2>/dev/null || true)"; fi; if [ -z "$GH_AW_NODE_EXEC" ]; then echo "node runtime missing on this runner — check runtimes.node in workflow YAML" >&2; exit 127; fi; GH_AW_NPM_GLOBAL_ROOT="$(npm root -g 2>/dev/null || true)"; if [ -n "$GH_AW_NPM_GLOBAL_ROOT" ]; then export NODE_PATH="${GH_AW_NPM_GLOBAL_ROOT}${NODE_PATH:+:${NODE_PATH}}"; fi; "$GH_AW_NODE_EXEC" ${RUNNER_TEMP}/gh-aw/actions/copilot_harness.cjs /usr/local/bin/copilot --add-dir /tmp/gh-aw/ --log-level all --log-dir /tmp/gh-aw/sandbox/agent/logs/ --disable-builtin-mcps --no-ask-user --allow-all-tools --add-dir /tmp/gh-aw/cache-memory/ --allow-all-paths --add-dir "${GITHUB_WORKSPACE}" --prompt-file /tmp/gh-aw/aw-prompts/prompt.txt' 2>&1 | tee -a /tmp/gh-aw/agent-stdio.log + env: + AWF_REFLECT_ENABLED: 1 + COPILOT_AGENT_RUNNER_TYPE: STANDALONE + COPILOT_DUMMY_BYOK: dummy-byok-key-for-offline-mode + COPILOT_GITHUB_TOKEN: ${{ github.token }} + COPILOT_MODEL: ${{ vars.GH_AW_MODEL_AGENT_COPILOT || vars.GH_AW_DEFAULT_MODEL_COPILOT || 'auto' }} + GH_AW_LLM_PROVIDER: github + GH_AW_MAX_AI_CREDITS: ${{ vars.GH_AW_DEFAULT_MAX_AI_CREDITS || '1000' }} + GH_AW_MAX_TURNS: ${{ vars.GH_AW_DEFAULT_MAX_TURNS || '' }} + GH_AW_PHASE: agent + GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt + GH_AW_SAFE_OUTPUTS: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS }} + GH_AW_TIMEOUT_MINUTES: 15 + GH_AW_VERSION: v0.84.3 + GITHUB_API_URL: ${{ github.api_url }} + GITHUB_AW: true + GITHUB_COPILOT_INTEGRATION_ID: agentic-workflows + GITHUB_HEAD_REF: ${{ github.head_ref }} + GITHUB_MCP_SERVER_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} + GITHUB_REF_NAME: ${{ github.ref_name }} + GITHUB_SERVER_URL: ${{ github.server_url }} + GITHUB_STEP_SUMMARY: /tmp/gh-aw/agent-step-summary.md + GITHUB_WORKSPACE: ${{ github.workspace }} + GIT_AUTHOR_EMAIL: github-actions[bot]@users.noreply.github.com + GIT_AUTHOR_NAME: github-actions[bot] + GIT_COMMITTER_EMAIL: github-actions[bot]@users.noreply.github.com + GIT_COMMITTER_NAME: github-actions[bot] + RUNNER_TEMP: ${{ runner.temp }} + S2STOKENS: true + TRACEPARENT: ${{ env.GITHUB_AW_OTEL_TRACE_ID != '' && env.GITHUB_AW_OTEL_PARENT_SPAN_ID != '' && format('00-{0}-{1}-01', env.GITHUB_AW_OTEL_TRACE_ID, env.GITHUB_AW_OTEL_PARENT_SPAN_ID) || '' }} + - name: Detect agent errors + if: always() + id: detect-agent-errors + continue-on-error: true + run: node "${RUNNER_TEMP}/gh-aw/actions/detect_agent_errors.cjs" + - name: Configure Git credentials + env: + GITHUB_REPOSITORY: ${{ github.repository }} + GITHUB_SERVER_URL: ${{ github.server_url }} + GITHUB_TOKEN: ${{ github.token }} + run: bash "${RUNNER_TEMP}/gh-aw/actions/configure_git_credentials.sh" + - name: Copy Copilot session state files to logs + if: always() + continue-on-error: true + run: bash "${RUNNER_TEMP}/gh-aw/actions/copy_copilot_session_state.sh" + - name: Stop MCP Gateway + if: always() + continue-on-error: true + env: + MCP_GATEWAY_PORT: ${{ steps.start-mcp-gateway.outputs.gateway-port }} + MCP_GATEWAY_API_KEY: ${{ steps.start-mcp-gateway.outputs.gateway-api-key }} + GATEWAY_PID: ${{ steps.start-mcp-gateway.outputs.gateway-pid }} + run: | + bash "${RUNNER_TEMP}/gh-aw/actions/stop_mcp_gateway.sh" "$GATEWAY_PID" + - name: Redact secrets in logs + if: always() + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + with: + script: | + const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs'); + setupGlobals(core, github, context, exec, io, getOctokit); + const { main } = require('${{ runner.temp }}/gh-aw/actions/redact_secrets.cjs'); + await main(); + env: + GH_AW_SECRET_NAMES: 'GH_AW_GITHUB_MCP_SERVER_TOKEN,GH_AW_GITHUB_TOKEN,GITHUB_TOKEN' + SECRET_GH_AW_GITHUB_MCP_SERVER_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN }} + SECRET_GH_AW_GITHUB_TOKEN: ${{ secrets.GH_AW_GITHUB_TOKEN }} + SECRET_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + - name: Append agent step summary + if: always() + run: bash "${RUNNER_TEMP}/gh-aw/actions/append_agent_step_summary.sh" + - name: Copy Safe Outputs + if: always() + env: + GH_AW_SAFE_OUTPUTS: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS }} + run: | + mkdir -p /tmp/gh-aw + cp "$GH_AW_SAFE_OUTPUTS" /tmp/gh-aw/safeoutputs.jsonl 2>/dev/null || true + - name: Ingest agent output + id: collect_output + if: always() + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + env: + GH_AW_SAFE_OUTPUTS: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS }} + GH_AW_ALLOWED_DOMAINS: "*.githubusercontent.com,api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,codeload.github.com,docs.github.com,github-cloud.githubusercontent.com,github-cloud.s3.amazonaws.com,github.blog,github.com,github.githubassets.com,host.docker.internal,lfs.github.com,objects.githubusercontent.com,patch-diff.githubusercontent.com,patchdiff.githubusercontent.com,raw.githubusercontent.com,registry.npmjs.org,telemetry.enterprise.githubcopilot.com" + GH_AW_ALLOWED_GITHUB_REFS: "" + GITHUB_SERVER_URL: ${{ github.server_url }} + GITHUB_API_URL: ${{ github.api_url }} + GH_AW_COMMANDS: "[\"auth-doctor\"]" + with: + script: | + const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs'); + setupGlobals(core, github, context, exec, io, getOctokit); + const { main } = require('${{ runner.temp }}/gh-aw/actions/collect_ndjson_output.cjs'); + await main(); + - name: Parse agent logs for step summary + if: always() + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + env: + GH_AW_AGENT_OUTPUT: /tmp/gh-aw/sandbox/agent/logs/ + GH_AW_SAFE_OUTPUTS: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS }} + with: + script: | + const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs'); + setupGlobals(core, github, context, exec, io, getOctokit); + const { main } = require('${{ runner.temp }}/gh-aw/actions/parse_copilot_log.cjs'); + await main(); + - name: Parse MCP Gateway logs for step summary + if: always() + id: parse-mcp-gateway + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + with: + script: | + const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs'); + setupGlobals(core, github, context, exec, io, getOctokit); + const { main } = require('${{ runner.temp }}/gh-aw/actions/parse_mcp_gateway_log.cjs'); + await main(); + - name: Print firewall logs + if: always() + continue-on-error: true + env: + AWF_LOGS_DIR: /tmp/gh-aw/sandbox/firewall/logs + run: bash "${RUNNER_TEMP}/gh-aw/actions/print_firewall_logs.sh" --rootless + - name: Parse token usage for step summary + if: always() + continue-on-error: true + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + with: + script: | + const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs'); + setupGlobals(core, github, context, exec, io, getOctokit); + const { main } = require('${{ runner.temp }}/gh-aw/actions/parse_token_usage.cjs'); + await main(); + - name: Print AWF reflect summary + if: always() + continue-on-error: true + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + with: + script: | + const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs'); + setupGlobals(core, github, context, exec, io, getOctokit); + const { main } = require('${{ runner.temp }}/gh-aw/actions/awf_reflect_summary.cjs'); + await main(); + - name: Write agent output placeholder if missing + if: always() + run: | + if [ ! -f /tmp/gh-aw/agent_output.json ]; then + echo '{"items":[]}' > /tmp/gh-aw/agent_output.json + fi + - name: Commit cache-memory changes + if: always() + env: + GH_AW_CACHE_DIR: /tmp/gh-aw/cache-memory + run: bash "${RUNNER_TEMP}/gh-aw/actions/commit_cache_memory_git.sh" + - name: Upload agent artifacts + if: always() + continue-on-error: true + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + with: + name: agent + path: | + /tmp/gh-aw/aw-prompts/prompt.txt + /tmp/gh-aw/sandbox/agent/logs/ + /tmp/gh-aw/redacted-urls.log + /tmp/gh-aw/mcp-logs/ + /tmp/gh-aw/agent_usage.json + /tmp/gh-aw/agent-stdio.log + /tmp/gh-aw/pre-agent-audit.txt + /tmp/gh-aw/agent/ + /tmp/gh-aw/github_rate_limits.jsonl + /tmp/gh-aw/safeoutputs.jsonl + /tmp/gh-aw/agent_output.json + /tmp/gh-aw/awf-config.json + /tmp/gh-aw/sandbox/firewall/logs/ + /tmp/gh-aw/sandbox/firewall/audit/ + /tmp/gh-aw/sandbox/firewall/awf-reflect.json + if-no-files-found: ignore + + conclusion: + needs: + - activation + - agent + - safe_outputs + if: > + always() && (needs.agent.result != 'skipped' || needs.activation.outputs.lockdown_check_failed == 'true' || + needs.activation.outputs.oauth_token_check_failed == 'true' || needs.activation.outputs.stale_lock_file_failed == 'true' || + needs.activation.outputs.daily_ai_credits_exceeded == 'true') + runs-on: ubuntu-slim + permissions: + issues: write + pull-requests: write + concurrency: + group: "gh-aw-conclusion-auth-doctor" + cancel-in-progress: false + queue: max + env: + GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} + outputs: + incomplete_count: ${{ steps.report_incomplete.outputs.incomplete_count }} + noop_message: ${{ steps.noop.outputs.noop_message }} + tools_reported: ${{ steps.missing_tool.outputs.tools_reported }} + total_count: ${{ steps.missing_tool.outputs.total_count }} + steps: + - name: Setup Scripts + id: setup + uses: github/gh-aw-actions/setup@c863074e6da7866f66d9ce31ce11429384406f5f # v0.84.3 + with: + destination: ${{ runner.temp }}/gh-aw/actions + job-name: ${{ github.job }} + trace-id: ${{ needs.activation.outputs.setup-trace-id }} + parent-span-id: ${{ needs.activation.outputs.setup-parent-span-id || needs.activation.outputs.setup-span-id }} + env: + GH_AW_SETUP_WORKFLOW_NAME: "Auth Doctor" + GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/auth-doctor.lock.yml@${{ github.ref }} + GH_AW_INFO_VERSION: "1.0.77" + GH_AW_INFO_AWF_VERSION: "v0.27.43" + GH_AW_INFO_ENGINE_ID: "copilot" + - name: Download agent output artifact + id: download-agent-output + continue-on-error: true + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + with: + name: agent + path: /tmp/gh-aw/ + - name: Setup agent output environment variable + id: setup-agent-output-env + if: steps.download-agent-output.outcome == 'success' + run: | + mkdir -p /tmp/gh-aw/ + find "/tmp/gh-aw/" -type f -print + echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" + - name: Download safe outputs items manifest + id: download-safe-outputs-manifest + if: always() + continue-on-error: true + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + with: + name: safe-outputs-items + path: /tmp/gh-aw/ + - name: Collect usage artifact files + if: always() + continue-on-error: true + run: bash "${RUNNER_TEMP}/gh-aw/actions/collect_usage_artifact_files.sh" + - name: Upload usage artifact + if: always() + continue-on-error: true + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + with: + name: usage + path: | + /tmp/gh-aw/usage/aw_info.json + /tmp/gh-aw/usage/aw-info.jsonl + /tmp/gh-aw/usage/agent_usage.json + /tmp/gh-aw/usage/agent_usage.jsonl + /tmp/gh-aw/usage/detection_usage.jsonl + /tmp/gh-aw/usage/evals.jsonl + /tmp/gh-aw/usage/github_rate_limits.jsonl + /tmp/gh-aw/usage/agent/token_usage.jsonl + /tmp/gh-aw/usage/detection/token_usage.jsonl + /tmp/gh-aw/usage/activity/summary.json + if-no-files-found: ignore + - name: Restore daily AIC usage cache + id: restore-daily-aic-cache-conclusion + if: always() + continue-on-error: true + uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 + with: + key: agentic-workflow-usage-authdoctor-${{ github.run_id }} + restore-keys: agentic-workflow-usage-authdoctor- + path: /tmp/gh-aw/agentic-workflow-usage-cache.jsonl + - name: Write daily AIC usage cache entry + id: write-daily-aic-cache + if: always() + continue-on-error: true + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + with: + github-token: ${{ github.token }} + script: | + const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs'); + setupGlobals(core, github, context); + const { main } = require('${{ runner.temp }}/gh-aw/actions/write_daily_aic_usage_cache.cjs'); + await main(); + - name: Save daily AIC usage cache + id: save-daily-aic-cache + if: always() + continue-on-error: true + uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 + with: + key: agentic-workflow-usage-authdoctor-${{ github.run_id }} + path: /tmp/gh-aw/agentic-workflow-usage-cache.jsonl + - name: Upload daily AIC usage cache artifact + id: upload-daily-aic-cache + if: always() + continue-on-error: true + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + with: + name: aic-usage-cache + path: /tmp/gh-aw/agentic-workflow-usage-cache.jsonl + if-no-files-found: ignore + retention-days: 7 + - name: Process no-op messages + id: noop + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + env: + GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }} + GH_AW_NOOP_MAX: "1" + GH_AW_WORKFLOW_NAME: "Auth Doctor" + GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/${{ github.repository }}/blob/${{ github.ref_name }}/.github/workflows/auth-doctor.md" + GH_AW_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }} + GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }} + GH_AW_NOOP_REPORT_AS_ISSUE: "true" + GH_AW_AIC: ${{ needs.agent.outputs.aic }} + GH_AW_AMBIENT_CONTEXT: ${{ needs.agent.outputs.ambient_context }} + GH_AW_WORKFLOW_ID: "auth-doctor" + with: + github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} + script: | + const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs'); + setupGlobals(core, github, context, exec, io, getOctokit); + const { main } = require('${{ runner.temp }}/gh-aw/actions/handle_noop_message.cjs'); + await main(); + - name: Record missing tool + id: missing_tool + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + env: + GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }} + GH_AW_MISSING_TOOL_CREATE_ISSUE: "true" + GH_AW_WORKFLOW_NAME: "Auth Doctor" + GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/${{ github.repository }}/blob/${{ github.ref_name }}/.github/workflows/auth-doctor.md" + with: + github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} + script: | + const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs'); + setupGlobals(core, github, context, exec, io, getOctokit); + const { main } = require('${{ runner.temp }}/gh-aw/actions/missing_tool.cjs'); + await main(); + - name: Record incomplete + id: report_incomplete + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + env: + GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }} + GH_AW_REPORT_INCOMPLETE_CREATE_ISSUE: "true" + GH_AW_WORKFLOW_NAME: "Auth Doctor" + GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/${{ github.repository }}/blob/${{ github.ref_name }}/.github/workflows/auth-doctor.md" + with: + github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} + script: | + const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs'); + setupGlobals(core, github, context, exec, io, getOctokit); + const { main } = require('${{ runner.temp }}/gh-aw/actions/report_incomplete_handler.cjs'); + await main(); + - name: Handle agent failure + id: handle_agent_failure + if: always() + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + env: + GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }} + GH_AW_WORKFLOW_NAME: "Auth Doctor" + GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/${{ github.repository }}/blob/${{ github.ref_name }}/.github/workflows/auth-doctor.md" + GH_AW_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }} + GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }} + GH_AW_WORKFLOW_ID: "auth-doctor" + GH_AW_ACTION_FAILURE_ISSUE_EXPIRES_HOURS: "168" + GH_AW_ENGINE_ID: "copilot" + GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }} + GH_AW_EFFECTIVE_TOKENS: ${{ needs.agent.outputs.effective_tokens || '' }} + GH_AW_AI_CREDITS_RATE_LIMIT_ERROR: ${{ needs.agent.outputs.ai_credits_rate_limit_error || 'false' }} + GH_AW_UNKNOWN_MODEL_AI_CREDITS: ${{ needs.agent.outputs.unknown_model_ai_credits || 'false' }} + GH_AW_AIC: ${{ needs.agent.outputs.aic }} + GH_AW_MAX_AI_CREDITS: ${{ vars.GH_AW_DEFAULT_MAX_AI_CREDITS || '1000' }} + GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }} + GH_AW_MCP_POLICY_ERROR: ${{ needs.agent.outputs.mcp_policy_error }} + GH_AW_AGENTIC_ENGINE_TIMEOUT: ${{ needs.agent.outputs.agentic_engine_timeout }} + GH_AW_MODEL_NOT_SUPPORTED_ERROR: ${{ needs.agent.outputs.model_not_supported_error }} + GH_AW_HTTP_400_RESPONSE_ERROR: ${{ needs.agent.outputs.http_400_response_error }} + GH_AW_MAX_CACHE_MISSES_EXCEEDED: ${{ needs.agent.outputs.max_cache_misses_exceeded }} + GH_AW_MISSING_MODEL_PRICING_ERROR: ${{ needs.agent.outputs.missing_model_pricing_error }} + GH_AW_MISSING_MODEL_PRICING_MODEL_NAME: ${{ needs.agent.outputs.missing_model_pricing_model_name }} + GH_AW_ENGINE_API_HOSTS: "api.enterprise.githubcopilot.com,api.githubcopilot.com,api.business.githubcopilot.com,api.individual.githubcopilot.com" + GH_AW_LOCKDOWN_CHECK_FAILED: ${{ needs.activation.outputs.lockdown_check_failed }} + GH_AW_OAUTH_TOKEN_CHECK_FAILED: ${{ needs.activation.outputs.oauth_token_check_failed }} + GH_AW_STALE_LOCK_FILE_FAILED: ${{ needs.activation.outputs.stale_lock_file_failed }} + GH_AW_DAILY_AI_CREDITS_EXCEEDED: ${{ needs.activation.outputs.daily_ai_credits_exceeded }} + GH_AW_DAILY_AI_CREDITS_TOTAL_EFFECTIVE_TOKENS: ${{ needs.activation.outputs.daily_ai_credits_total_effective_tokens }} + GH_AW_DAILY_AI_CREDITS_THRESHOLD: ${{ needs.activation.outputs.daily_ai_credits_threshold }} + GH_AW_GROUP_REPORTS: "false" + GH_AW_FAILURE_REPORT_AS_ISSUE: "true" + GH_AW_MISSING_TOOL_REPORT_AS_FAILURE: "true" + GH_AW_MISSING_DATA_REPORT_AS_FAILURE: "true" + GH_AW_TIMEOUT_MINUTES: "15" + GH_AW_CACHE_MEMORY_ENABLED: "true" + GH_AW_CACHE_MEMORY_RESTORE_0_MATCHED_KEY: ${{ needs.agent.outputs.cache_memory_restore_0_matched_key || '' }} + GH_AW_CACHE_MEMORY_RESTORE_0_CACHE_HIT: ${{ needs.agent.outputs.cache_memory_restore_0_cache_hit || 'false' }} + with: + github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} + script: | + const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs'); + setupGlobals(core, github, context, exec, io, getOctokit); + const { main } = require('${{ runner.temp }}/gh-aw/actions/handle_agent_failure.cjs'); + await main(); + - name: Update reaction comment with completion status + id: conclusion + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + env: + GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }} + GH_AW_COMMENT_ID: ${{ needs.activation.outputs.comment_id }} + GH_AW_COMMENT_REPO: ${{ needs.activation.outputs.comment_repo }} + GH_AW_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }} + GH_AW_WORKFLOW_NAME: "Auth Doctor" + GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }} + GH_AW_SAFE_OUTPUTS_RESULT: ${{ needs.safe_outputs.result }} + with: + github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} + script: | + const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs'); + setupGlobals(core, github, context, exec, io, getOctokit); + const { main } = require('${{ runner.temp }}/gh-aw/actions/notify_comment_error.cjs'); + await main(); + + pre_activation: + if: "(github.event_name == 'issue_comment') && (github.event_name == 'issue_comment' && (startsWith(github.event.comment.body, '/auth-doctor ') || startsWith(github.event.comment.body, '/auth-doctor\n') || github.event.comment.body == '/auth-doctor') && github.event.issue.pull_request == null) || !(github.event_name == 'issue_comment')" + runs-on: ubuntu-slim + env: + GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} + outputs: + activated: ${{ steps.check_command_position.outputs.command_position_ok == 'true' }} + matched_command: ${{ steps.check_command_position.outputs.matched_command }} + setup-parent-span-id: ${{ steps.setup.outputs.parent-span-id || steps.setup.outputs.span-id }} + setup-span-id: ${{ steps.setup.outputs.span-id }} + setup-trace-id: ${{ steps.setup.outputs.trace-id }} + steps: + - name: Setup Scripts + id: setup + uses: github/gh-aw-actions/setup@c863074e6da7866f66d9ce31ce11429384406f5f # v0.84.3 + with: + destination: ${{ runner.temp }}/gh-aw/actions + job-name: ${{ github.job }} + env: + GH_AW_SETUP_WORKFLOW_NAME: "Auth Doctor" + GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/auth-doctor.lock.yml@${{ github.ref }} + GH_AW_INFO_VERSION: "1.0.77" + GH_AW_INFO_AWF_VERSION: "v0.27.43" + GH_AW_INFO_ENGINE_ID: "copilot" + - name: Check command position + id: check_command_position + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + env: + GH_AW_COMMANDS: "[\"auth-doctor\"]" + with: + script: | + const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs'); + setupGlobals(core, github, context, exec, io, getOctokit); + const { main } = require('${{ runner.temp }}/gh-aw/actions/check_command_position.cjs'); + await main(); + + safe_outputs: + needs: + - activation + - agent + if: (!cancelled()) && needs.agent.result != 'skipped' + runs-on: ubuntu-slim + permissions: + issues: write + pull-requests: write + timeout-minutes: 45 + env: + GH_AW_AGENT_AIC: ${{ needs.agent.outputs.aic }} + GH_AW_AIC: ${{ needs.agent.outputs.aic }} + GH_AW_AMBIENT_CONTEXT: ${{ needs.agent.outputs.ambient_context }} + GH_AW_CALLER_WORKFLOW_ID: "${{ github.repository }}/auth-doctor" + GH_AW_COMMANDS: "[\"auth-doctor\"]" + GH_AW_EFFECTIVE_TOKENS: ${{ needs.agent.outputs.effective_tokens }} + GH_AW_ENGINE_ID: "copilot" + GH_AW_ENGINE_MODEL: ${{ needs.agent.outputs.model }} + GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} + GH_AW_WORKFLOW_ID: "auth-doctor" + GH_AW_WORKFLOW_NAME: "Auth Doctor" + GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/${{ github.repository }}/blob/${{ github.ref_name }}/.github/workflows/auth-doctor.md" + outputs: + code_push_failure_count: ${{ steps.process_safe_outputs.outputs.code_push_failure_count }} + code_push_failure_errors: ${{ steps.process_safe_outputs.outputs.code_push_failure_errors }} + comment_id: ${{ steps.process_safe_outputs.outputs.comment_id }} + comment_url: ${{ steps.process_safe_outputs.outputs.comment_url }} + create_discussion_error_count: ${{ steps.process_safe_outputs.outputs.create_discussion_error_count }} + create_discussion_errors: ${{ steps.process_safe_outputs.outputs.create_discussion_errors }} + created_issue_number: ${{ steps.process_safe_outputs.outputs.created_issue_number }} + created_issue_url: ${{ steps.process_safe_outputs.outputs.created_issue_url }} + process_safe_outputs_processed_count: ${{ steps.process_safe_outputs.outputs.processed_count }} + process_safe_outputs_temporary_id_map: ${{ steps.process_safe_outputs.outputs.temporary_id_map }} + steps: + - name: Setup Scripts + id: setup + uses: github/gh-aw-actions/setup@c863074e6da7866f66d9ce31ce11429384406f5f # v0.84.3 + with: + destination: ${{ runner.temp }}/gh-aw/actions + job-name: ${{ github.job }} + trace-id: ${{ needs.activation.outputs.setup-trace-id }} + parent-span-id: ${{ needs.activation.outputs.setup-parent-span-id || needs.activation.outputs.setup-span-id }} + env: + GH_AW_SETUP_WORKFLOW_NAME: "Auth Doctor" + GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/auth-doctor.lock.yml@${{ github.ref }} + GH_AW_INFO_VERSION: "1.0.77" + GH_AW_INFO_AWF_VERSION: "v0.27.43" + GH_AW_INFO_ENGINE_ID: "copilot" + - name: Download agent output artifact + id: download-agent-output + continue-on-error: true + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + with: + name: agent + path: /tmp/gh-aw/ + - name: Setup agent output environment variable + id: setup-agent-output-env + if: steps.download-agent-output.outcome == 'success' + run: | + mkdir -p /tmp/gh-aw/ + find "/tmp/gh-aw/" -type f -print + echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" + - name: Configure GH_HOST for enterprise compatibility + id: ghes-host-config + shell: bash + run: | # zizmor: ignore[github-env] - GITHUB_SERVER_URL is set by GitHub Actions, not user input. + # Derive GH_HOST from GITHUB_SERVER_URL so the gh CLI targets the correct + # GitHub instance (GHES/GHEC). On github.com this is a harmless no-op. + GH_HOST="${GITHUB_SERVER_URL#https://}" + GH_HOST="${GH_HOST#http://}" + echo "GH_HOST=${GH_HOST}" >> "$GITHUB_ENV" + - name: Process Safe Outputs + id: process_safe_outputs + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + env: + GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }} + GH_AW_COMMENT_ID: ${{ needs.activation.outputs.comment_id }} + GH_AW_ALLOWED_DOMAINS: "*.githubusercontent.com,api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,codeload.github.com,docs.github.com,github-cloud.githubusercontent.com,github-cloud.s3.amazonaws.com,github.blog,github.com,github.githubassets.com,host.docker.internal,lfs.github.com,objects.githubusercontent.com,patch-diff.githubusercontent.com,patchdiff.githubusercontent.com,raw.githubusercontent.com,registry.npmjs.org,telemetry.enterprise.githubcopilot.com" + GITHUB_SERVER_URL: ${{ github.server_url }} + GITHUB_API_URL: ${{ github.api_url }} + GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"add_comment\":{\"max\":1},\"create_issue\":{\"max\":1,\"title_prefix\":\"🩺 Auth Doctor\"},\"create_report_incomplete_issue\":{},\"mentions\":{\"enabled\":false},\"missing_data\":{},\"missing_tool\":{},\"noop\":{\"max\":1,\"report-as-issue\":\"true\"},\"report_incomplete\":{}}" + with: + github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} + script: | + const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs'); + setupGlobals(core, github, context, exec, io, getOctokit); + const { main } = require('${{ runner.temp }}/gh-aw/actions/process_safe_outputs.cjs'); + await main(); + - name: Upload Safe Outputs Items + if: always() + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + with: + name: safe-outputs-items + path: | + /tmp/gh-aw/safe-output-items.jsonl + /tmp/gh-aw/temporary-id-map.json + /tmp/gh-aw/process-safe-outputs.stdout.log + /tmp/gh-aw/process-safe-outputs.stderr.log + if-no-files-found: ignore diff --git a/.github/workflows/auth-doctor.md b/.github/workflows/auth-doctor.md new file mode 100644 index 000000000..91f37c6c4 --- /dev/null +++ b/.github/workflows/auth-doctor.md @@ -0,0 +1,196 @@ +--- +name: Auth Doctor +description: Diagnoses AWF authentication, API-proxy, and HTTP MCP GitHub OIDC configuration from issue reports and workflow evidence without exposing credentials. +on: + roles: all + slash_command: + name: auth-doctor + events: [issue_comment] +permissions: + actions: read + copilot-requests: write + contents: read + issues: read + pull-requests: read +tools: + github: + toolsets: [default] + cache-memory: true +sandbox: + agent: + id: awf +network: + allowed: + - github +safe-outputs: + threat-detection: + enabled: false + mentions: false + allowed-github-references: [] + create-issue: + title-prefix: "🩺 Auth Doctor" + max: 1 + add-comment: + max: 1 +timeout-minutes: 15 +--- + +# Auth Doctor + +You diagnose AWF authentication, API-proxy routing, and HTTP MCP GitHub OIDC failures from repository configuration, workflow metadata, sanitized logs, and non-secret health information. + +## Trigger Context + +- **Repository:** ${{ github.repository }} +- **Issue:** #${{ github.event.issue.number }} +- **Request:** `${{ steps.sanitized.outputs.text }}` + +## Safety Contract + +Treat every credential value as prohibited output. + +- Never print, quote, summarize, decode, hash, compare, or return any API key, token, JWT, cloud credential, cookie, client secret, authorization header, or `ACTIONS_ID_TOKEN_REQUEST_TOKEN`. +- Never request or display an Actions OIDC JWT, exchanged Azure/GCP/Anthropic access token, AWS access key, secret access key, session token, Copilot token, or provider API key. +- Report only whether a variable or field is **configured**, **missing**, **inconsistent**, or **not safely observable**. Use `` or `` when a name must be shown. +- Never run `printenv`, `env`, `set`, `docker inspect`, `docker compose config`, or broad process/environment dumps. Never `cat` an env file, generated Compose file, or raw log. +- Do not probe provider token endpoints or make inference requests. Do not mint or exchange credentials. +- If evidence cannot be obtained without exposing a credential, label the check `not safely observable` and fail closed. + +## Diagnostic Playbook + +### 1. Establish the failing path + +Identify the engine/provider, auth mode, AWF version, gh-aw compiler version, runner type, API target hostname, and whether the failure is in: + +1. runner configuration, +2. AWF API-proxy startup or routing, +3. provider authentication, +4. GitHub/Copilot authentication, or +5. the separately launched MCP gateway. + +Do not infer the target run's configuration from this Doctor run's own environment. + +### 2. Prefer metadata and presence-only inspection + +Use GitHub read tools to inspect workflow source, compiled lock files, run/job conclusions, and annotations. Read linked logs only when metadata cannot distinguish the candidates. + +When a log is required, download it to a temporary file without echoing it, redact credential-shaped values and sensitive headers into a second file, and inspect only the redacted copy. At minimum redact: + +- `Authorization`, `Proxy-Authorization`, `x-api-key`, `x-goog-api-key`, cookies, and signed AWS headers; +- `ACTIONS_ID_TOKEN_REQUEST_TOKEN` and any value associated with `ACTIONS_ID_TOKEN_REQUEST_URL`; +- JWT-like strings, GitHub tokens, OpenAI/Anthropic/Gemini keys, and AWS temporary credential fields. + +Delete both files after the check. If safe redaction is uncertain, do not read the log. + +For configuration files, parse only key names and non-secret routing metadata. Never render values from `secrets.*`, env files, Docker Compose environments, or credential fields. + +### 3. Check API-proxy configuration and routes + +Confirm `--enable-api-proxy` or equivalent AWF config is active, then classify each requested route: + +| Path | Sidecar route | Required configuration evidence | Common inconsistency | +|---|---:|---|---| +| OpenAI | `10000` | static `OPENAI_API_KEY`, or a compatible OIDC provider plus target | key/auth mode present but OpenAI target absent from allowlist | +| Anthropic | `10001` | static `ANTHROPIC_API_KEY`, or Anthropic WIF fields | static key and WIF mixed; required federation IDs missing | +| GitHub Copilot / Copilot BYOK | `10002` | `COPILOT_GITHUB_TOKEN`, or `COPILOT_PROVIDER_API_KEY` with provider routing | BYOK key without base URL; incompatible GitHub instance target | +| Gemini | `10003` | static `GEMINI_API_KEY` | treating Gemini API-key mode as GCP OIDC | +| Vertex AI | `10004` | static `GOOGLE_API_KEY`, or GCP OIDC with Vertex target | GCP WIF selected but Vertex target/allowlist missing | + +For GitHub Copilot, distinguish github.com, GHEC (`*.ghe.com`), and GHES routing. Flag a classic PAT combined with `COPILOT_MODEL` as a possible `/models` startup incompatibility without examining the token prefix or value; rely only on an explicit report that the credential is a classic PAT. + +When execution access is genuinely attached to the failing environment, safe sidecar checks are: + +- TCP reachability to the configured internal route; +- `GET http://:10000/health`, retaining only `status`, provider booleans, `key_validation.complete`, and `models_fetch_complete`; +- `GET http://:10000/reflect`, retaining only endpoint `provider`, `port`, and `configured`. + +Do not include `key_validation.results`, models, headers, request bodies, logs, or upstream responses in the report. A listener being reachable proves route availability, not credential validity. + +### 4. Check static-auth prerequisites + +For the selected provider, verify presence-only evidence for the required runner-level variable, that `sudo --preserve-env=` or equivalent preserves it for the AWF process, and that the upstream hostname is explicitly allowed. + +Flag these unsupported or inconsistent combinations: + +- Gemini API-key routing with `AWF_AUTH_TYPE=github-oidc`; GCP WIF uses the Vertex route instead. +- OIDC provider settings without API-proxy enablement. +- A custom provider target missing from `network.allowed` or AWF's domain allowlist. +- Static and OIDC credentials configured for the same path where precedence is ambiguous. +- Copilot BYOK credentials without a compatible provider base URL/target. + +### 5. Check GitHub Actions OIDC prerequisites + +OIDC via the AWF API proxy requires: + +- job permission `id-token: write`; +- `AWF_AUTH_TYPE=github-oidc`; +- a supported `AWF_AUTH_PROVIDER`; +- provider-specific non-secret configuration; and +- the Actions request URL/token to be available to the API-proxy sidecar. + +Check required configuration by name only: + +| Provider | Required names | Expected route | +|---|---|---| +| Azure | `AWF_AUTH_AZURE_TENANT_ID`, `AWF_AUTH_AZURE_CLIENT_ID` | Azure OpenAI through the OpenAI adapter | +| AWS | `AWF_AUTH_AWS_ROLE_ARN`, `AWF_AUTH_AWS_REGION` | Bedrock with sidecar SigV4 signing | +| GCP | `AWF_AUTH_GCP_WORKLOAD_IDENTITY_PROVIDER`; service account optional | Vertex AI; optional service-account impersonation | +| Anthropic | federation rule, organization, and service-account IDs; workspace conditional | Anthropic WIF | + +Never inspect the Actions request token or a minted/exchanged credential. + +Current `main` compatibility caveat: AWF forwards the Actions OIDC variables to the sidecar when API-proxy OIDC is active, but current-main agent environment passthrough can also expose them to the agent. Do not inspect them. github/gh-aw-firewall#6894 is the related isolation change and github/gh-aw#50053 tracks gh-aw compiler/runtime and existing-lock compatibility; do not describe either as shipped on `main` until verified there. + +### 6. Keep MCP gateway OIDC separate + +HTTP MCP `auth.type: github-oidc` is a runner-to-gateway trust path, not an AWF API-proxy route: + +- gh-aw launches/configures the MCP gateway in a runner-owned workflow step. +- AWF does not launch or configure mcpg. +- the gateway configuration should contain only auth type/audience metadata, never Actions credential values; +- the generated job should grant `id-token: write`; +- the runner should pass the Actions OIDC variables directly to the gateway launch; +- the gateway mints the audience-bound JWT and adds the authorization header to the remote MCP request. + +Do not recommend exposing the Actions OIDC variables to the AWF agent to repair MCP auth. For precompiled lock workflows, label compatibility `unverified` unless the lock's runner-to-gateway behavior is established; cite github/gh-aw#50053 as the open rollout tracker. + +### 7. Recommend the smallest safe fix + +Prefer one concrete change: add a missing permission, export/preserve a named variable, complete a provider config field, correct a target/route, add one required hostname, enable the API proxy, recompile an affected gh-aw lock file, or separate conflicting auth modes. + +Do not suggest printing credentials, disabling masking, broadening network access, using `--env-all`, or passing OIDC request variables into the agent. + +## Output Requirements + +Use GitHub-flavored Markdown with this structure: + +### Summary + +- failing trust path +- provider/auth mode +- overall status: `configured`, `incomplete`, `inconsistent`, `route unavailable`, or `not safely observable` +- confidence + +### Findings + +For each check, report only: check name, status, non-secret evidence, and impact. Keep critical findings visible and put secondary detail in `
` blocks. + +### Recommended Fix + +Give the smallest actionable configuration change and state whether it applies to current `main` or depends on pending compatibility work. + +### Safe Next Probe + +Include only when needed. The probe must return metadata, booleans, status codes, or redacted output. + +### References + +Include up to three directly relevant links. Use full URLs for github/gh-aw#50053 and github/gh-aw-firewall#6894 so safe-output reference escaping does not create unintended backlinks. + +Use GitHub alert syntax for warnings and cautions. Never use credential values or emoji as severity markers. + +## Safe Output Policy + +- Use `add-comment` when the current issue has enough context for a useful diagnosis. +- Use `create-issue` only when a separate follow-up item is genuinely required. The title prefix is already configured. +- Use `noop` when the request has no AWF authentication/API-proxy/MCP OIDC signal or no visible action is needed. diff --git a/README.md b/README.md index d07006ab6..cd2fc37fc 100644 --- a/README.md +++ b/README.md @@ -80,6 +80,7 @@ See [GitHub Actions](docs/github_actions.md) for advanced setup and `awf logs su - [Chroot mode](docs/chroot-mode.md) — use host binaries with network isolation (glibc-based daemon hosts) - [API proxy sidecar](docs/api-proxy-sidecar.md) — secure credential management for LLM APIs - [Authentication architecture](docs/authentication-architecture.md) — deep dive into token handling and credential isolation +- [Authentication matrix](docs/auth-matrix.md) — supported static, BYOK, and OIDC provider combinations - [SSL Bump](docs/ssl-bump.md) — HTTPS content inspection for URL path filtering - [GitHub Actions](docs/github_actions.md) — CI/CD integration and MCP server setup - [Environment variables](docs/environment.md) — passing environment variables to containers @@ -89,6 +90,7 @@ See [GitHub Actions](docs/github_actions.md) for advanced setup and `awf logs su - [Compatibility](docs/compatibility.md) — supported Node.js, OS, and Docker versions - [Troubleshooting](docs/troubleshooting.md) — common issues and fixes - [Diagnosing AWF failures](docs/diagnosing-awf-failures.md) — use the Self-Hosted Runner Doctor agent to triage self-hosted/ARC/GHES/GHEC failures +- [Auth Doctor workflow](.github/workflows/auth-doctor.md) — comment `/auth-doctor` on an issue to diagnose authentication and API-proxy configuration without exposing credentials - [Image verification](docs/image-verification.md) — cosign signature verification ## Development diff --git a/docs/api-proxy-sidecar.md b/docs/api-proxy-sidecar.md index a4625d304..08e104ab0 100644 --- a/docs/api-proxy-sidecar.md +++ b/docs/api-proxy-sidecar.md @@ -600,6 +600,8 @@ and are normalized to dollars per million tokens inside the proxy. ## Troubleshooting +For a report that checks permissions, provider-field presence, route availability, and allowlists without returning credentials, comment `/auth-doctor` on an issue. The [Auth Doctor workflow](../.github/workflows/auth-doctor.md) treats a reachable listener as route evidence only and never probes a token endpoint or inference API. + ### Gemini proxy returns 503 When `--enable-api-proxy` is active **and `GEMINI_API_KEY` is provided to the AWF runner**, `GOOGLE_GEMINI_BASE_URL`, `GEMINI_API_BASE_URL`, and a placeholder `GEMINI_API_KEY` are injected into the agent container. If the real `GEMINI_API_KEY` was not set in the AWF runner environment, the Gemini routing vars are never set and the api-proxy Gemini listener (port 10003) responds with **503** to any requests that do reach it. @@ -684,6 +686,10 @@ AWF supports OIDC-based credential exchange with multiple cloud providers via Gi | `ACTIONS_ID_TOKEN_REQUEST_URL` | ✅ | Provided automatically by the GitHub Actions runtime | | `ACTIONS_ID_TOKEN_REQUEST_TOKEN` | ✅ | Provided automatically by the GitHub Actions runtime | +Never print or inspect either Actions OIDC variable. Auth Doctor checks the `id-token: write` permission and the presence/consistency of non-secret provider configuration instead. + +On current `main`, AWF forwards these variables to the API-proxy sidecar when OIDC is active, while the general agent passthrough can also expose them to the agent. [PR #6894](https://github.com/github/gh-aw-firewall/pull/6894) is the related isolation change. [github/gh-aw#50053](https://github.com/github/gh-aw/issues/50053) tracks the separate gh-aw runner-to-mcpg path and compatibility for existing lock files; do not pass OIDC variables to the agent as an MCP workaround. + When `AWF_AUTH_TYPE=github-oidc` is set but `ACTIONS_ID_TOKEN_REQUEST_URL`/`ACTIONS_ID_TOKEN_REQUEST_TOKEN` are not available in the sidecar, Anthropic OIDC requests fail closed with: - `503 Anthropic OIDC requires ACTIONS_ID_TOKEN_REQUEST_URL and ACTIONS_ID_TOKEN_REQUEST_TOKEN (permissions: id-token: write).` diff --git a/docs/auth-matrix.md b/docs/auth-matrix.md index 551ab2c0b..de6e6f7c9 100644 --- a/docs/auth-matrix.md +++ b/docs/auth-matrix.md @@ -2,6 +2,8 @@ This document describes every authentication combination supported by AWF's api-proxy sidecar, including how each provider's auth works, what configuration is required, and how the proxy transforms credentials before forwarding to upstream APIs. +For a presence-only diagnosis of a workflow or run, comment `/auth-doctor` on an issue in this repository. The [Auth Doctor workflow](../.github/workflows/auth-doctor.md) checks permissions, provider fields, route availability, and allowlists without returning credential values. + ## Table of Contents - [Dimensions Overview](#dimensions-overview) @@ -204,6 +206,10 @@ All OIDC flows require GitHub Actions runtime tokens: - `ACTIONS_ID_TOKEN_REQUEST_URL` — endpoint to mint OIDC JWTs - `ACTIONS_ID_TOKEN_REQUEST_TOKEN` — auth token for the OIDC endpoint +The Auth Doctor treats both as non-observable credentials: it checks `id-token: write` and sidecar configuration but never requests or prints either value, a minted JWT, or exchanged cloud credentials. On current `main`, these variables are forwarded to the API-proxy sidecar for OIDC and may also reach the agent through the current passthrough behavior. [PR #6894](https://github.com/github/gh-aw-firewall/pull/6894) is the related isolation change, while [github/gh-aw#50053](https://github.com/github/gh-aw/issues/50053) tracks compiler/runtime and existing-lock compatibility. + +HTTP MCP `auth.type: github-oidc` is separate from this matrix: gh-aw launches mcpg from a runner-owned step and passes OIDC capability directly to that gateway. AWF does not launch or configure mcpg, and the OIDC request variables should not be exposed to the AWF agent to support MCP authentication. + ### Azure (Entra ID) | Config | Env Var | Required | diff --git a/docs/authentication-architecture.md b/docs/authentication-architecture.md index 77a093acd..8d7310c96 100644 --- a/docs/authentication-architecture.md +++ b/docs/authentication-architecture.md @@ -587,7 +587,7 @@ In a standard GitHub Actions workflow (without AWF), OIDC federation works like ### How AWF OIDC works (credential isolation) -AWF moves the entire OIDC exchange into the api-proxy sidecar, so the agent never sees any credential: +AWF moves the OIDC mint/exchange operation into the api-proxy sidecar, so provider credentials do not need to enter the agent. On current `main`, the Actions OIDC request variables are still part of the default agent passthrough even though the sidecar also receives them. Do not inspect or log those values. [PR #6894](https://github.com/github/gh-aw-firewall/pull/6894) is the related isolation change and [github/gh-aw#50053](https://github.com/github/gh-aw/issues/50053) tracks gh-aw compatibility, including existing compiled lock files. ``` ┌─────────────────────────────┐ ┌───────────────────────────────────────┐ @@ -595,8 +595,9 @@ AWF moves the entire OIDC exchange into the api-proxy sidecar, so the agent neve │ 172.30.0.20 │ │ 172.30.0.30 │ │ │ │ │ │ Environment: │ │ Environment: │ -│ ✗ No ACTIONS_ID_TOKEN_* │ │ ✓ ACTIONS_ID_TOKEN_REQUEST_URL │ -│ ✗ No cloud credentials │ │ ✓ ACTIONS_ID_TOKEN_REQUEST_TOKEN │ +│ ⚠ Current main may receive │ │ ✓ ACTIONS_ID_TOKEN_REQUEST_URL │ +│ ACTIONS_ID_TOKEN_* │ │ ✓ ACTIONS_ID_TOKEN_REQUEST_TOKEN │ +│ ✗ No cloud credentials │ │ ✓ Provider-specific configuration │ │ ✗ No API keys │ │ ✓ AWF_AUTH_TYPE=github-oidc │ │ ✓ OPENAI_BASE_URL= │ │ ✓ AWF_AUTH_PROVIDER=azure|aws|gcp|anthropic │ │ http://172.30.0.30:10000 │ │ ✓ Provider-specific config │ @@ -633,9 +634,11 @@ Host environment Sidecar container Agent container AWF_AUTH_TYPE=github-oidc ──► AWF_AUTH_TYPE ✓ ✗ (excluded) AWF_AUTH_PROVIDER=azure ──► AWF_AUTH_PROVIDER ✓ ✗ (excluded) AWF_AUTH_AZURE_TENANT_ID=... ──► AWF_AUTH_AZURE_TENANT_ID ✓ ✗ (excluded) -ACTIONS_ID_TOKEN_REQUEST_URL ──► forwarded when type=oidc ✓ ✗ (excluded) +ACTIONS_ID_TOKEN_REQUEST_URL ──► forwarded when type=oidc ✓ ⚠ current passthrough ``` +The table above describes the intended provider-config boundary. Current `main` still permits the two `ACTIONS_ID_TOKEN_REQUEST_*` variables through the general agent environment path; it does not exclude them in `buildExclusionSet()`. Treat their values as secrets and use only presence/configuration checks until the isolation and compiler compatibility work linked above is on `main`. + #### Step 2: GitHub OIDC token minting The sidecar's token provider (`github-oidc.js`) calls `ACTIONS_ID_TOKEN_REQUEST_URL` with a provider-appropriate audience claim: @@ -710,6 +713,12 @@ When the agent sends a request to the sidecar, the provider adapter injects the | Anthropic | Authorization header | | AWS | SigV4 request signing (method, path, headers, body hash) | +### MCP gateway OIDC is a separate trust path + +For an HTTP MCP server configured with `auth.type: github-oidc`, gh-aw starts mcpg in a runner-owned workflow step. The runner supplies the Actions OIDC variables directly to that gateway; the gateway mints an audience-bound JWT and injects it into the remote MCP request. AWF does not launch or configure mcpg, and its API proxy is not involved in that flow. + +The generated gateway configuration should contain only auth type/audience metadata, never the Actions request URL/token values. Do not expose those variables to the AWF agent as an MCP authentication workaround. See [github/gh-aw#50053](https://github.com/github/gh-aw/issues/50053) for compatibility validation and rollout status. + ### Comparison: static keys vs OIDC | Property | Static API keys | OIDC federation | @@ -765,6 +774,7 @@ This architecture provides **transparent operation** (SDKs work without code cha ## Related documentation +- [Auth Doctor workflow](../.github/workflows/auth-doctor.md) — non-secret authentication and route diagnostics via `/auth-doctor` - [API Proxy Sidecar](./api-proxy-sidecar.md) — user-facing guide for enabling the API proxy - [Security](./security.md) — overall security model - [Architecture](./architecture.md) — overall system architecture diff --git a/docs/diagnosing-awf-failures.md b/docs/diagnosing-awf-failures.md index ee6c2a25b..5177cb338 100644 --- a/docs/diagnosing-awf-failures.md +++ b/docs/diagnosing-awf-failures.md @@ -68,3 +68,7 @@ agent and use it to diagnose my failure. the failure is clearly on a GitHub-hosted runner with no ARC/DinD/GHES/GHEC, custom `DOCKER_HOST`, or corporate-proxy involvement, the Doctor will say so and stop. + +## Authentication and API-proxy failures + +For authentication, API-proxy routing, provider OIDC, or HTTP MCP GitHub OIDC failures, comment `/auth-doctor` on the relevant issue instead. The [Auth Doctor workflow](../.github/workflows/auth-doctor.md) mirrors the Runner Doctor's issue/comment reporting model but uses presence-only configuration checks, redacted evidence, and non-secret health fields. It never returns API keys, authorization headers, Actions OIDC request tokens, minted JWTs, or exchanged cloud credentials. diff --git a/docs/environment.md b/docs/environment.md index c88317688..8a9bae5fe 100644 --- a/docs/environment.md +++ b/docs/environment.md @@ -23,6 +23,8 @@ awf --env-file /tmp/runtime-paths.env -e MY_VAR=override 'command' When using `sudo -E`, these host variables are automatically passed: `GITHUB_TOKEN`, `GH_TOKEN`, `GITHUB_PERSONAL_ACCESS_TOKEN`, `USER`, `TERM`, `HOME`, `XDG_CONFIG_HOME`. +On current `main`, GitHub Actions also supplies `ACTIONS_ID_TOKEN_REQUEST_URL` and `ACTIONS_ID_TOKEN_REQUEST_TOKEN` when the job grants `id-token: write`, and AWF's default passthrough can place them in the agent environment. Never print or inspect either value. The API-proxy sidecar receives them directly when `AWF_AUTH_TYPE=github-oidc`; [PR #6894](https://github.com/github/gh-aw-firewall/pull/6894) is the related agent-isolation change. + The following are always set/overridden: `PATH` (container values). ### Self-hosted runner home directory support @@ -46,6 +48,8 @@ Using `--env-all` passes all host environment variables to the container, which **Excluded variables** (even with `--env-all`): `PATH`, `PWD`, `OLDPWD`, `SHLVL`, `_`, `SUDO_*` +`--env-all` is not a safe way to troubleshoot authentication. Use the [Auth Doctor workflow](../.github/workflows/auth-doctor.md), which reports only configuration presence and route status. In particular, do not expose Actions OIDC request variables to the agent to support HTTP MCP `auth.type: github-oidc`: gh-aw launches mcpg separately from a runner-owned step, and [github/gh-aw#50053](https://github.com/github/gh-aw/issues/50053) tracks that boundary and existing-lock compatibility. + **Proxy variables:** `HTTP_PROXY`, `HTTPS_PROXY`, `http_proxy`, `https_proxy`, `NO_PROXY`, `no_proxy`, `ALL_PROXY`, and `FTP_PROXY` (all case variants) from the host are **excluded from container passthrough** when using `--env-all`. The firewall sets its own proxy variables pointing to Squid inside the container. However, host proxy variables **are read** for upstream proxy auto-detection — if the host has `https_proxy`/`http_proxy` set, AWF configures Squid to chain outbound traffic through that corporate proxy (see [Upstream Proxy Support](#upstream-corporate-proxy-support)). ## `--env-file` Support diff --git a/scripts/ci/auth-doctor-workflow.test.ts b/scripts/ci/auth-doctor-workflow.test.ts new file mode 100644 index 000000000..86c850c68 --- /dev/null +++ b/scripts/ci/auth-doctor-workflow.test.ts @@ -0,0 +1,59 @@ +import * as fs from 'fs'; +import * as path from 'path'; + +const workflowsDir = path.resolve(__dirname, '../../.github/workflows'); +const sourcePath = path.join(workflowsDir, 'auth-doctor.md'); +const lockPath = path.join(workflowsDir, 'auth-doctor.lock.yml'); + +describe('auth doctor workflow config', () => { + it('mirrors the runner doctor trigger and safe-output UX', () => { + const source = fs.readFileSync(sourcePath, 'utf-8'); + + expect(source).toContain('name: Auth Doctor'); + expect(source).toContain('roles: all'); + expect(source).toContain('slash_command:'); + expect(source).toContain('name: auth-doctor'); + expect(source).toContain('actions: read'); + expect(source).toContain('title-prefix: "🩺 Auth Doctor"'); + expect(source).toContain('add-comment:'); + expect(source).toContain('create-issue:'); + }); + + it('covers supported auth paths and preserves credential boundaries', () => { + const source = fs.readFileSync(sourcePath, 'utf-8'); + + for (const expected of [ + 'OpenAI', + 'Anthropic', + 'GitHub Copilot / Copilot BYOK', + 'Gemini', + 'Vertex AI', + 'Azure', + 'AWS', + 'GCP', + 'Anthropic WIF', + 'auth.type: github-oidc', + 'github/gh-aw#50053', + 'github/gh-aw-firewall#6894', + ]) { + expect(source).toContain(expected); + } + + expect(source).toContain('AWF does not launch or configure mcpg.'); + expect(source).toContain('Do not recommend exposing the Actions OIDC variables to the AWF agent'); + expect(source).toContain('Never inspect the Actions request token or a minted/exchanged credential.'); + expect(source).not.toContain('${{ secrets.'); + expect(source).not.toContain('${{ env.'); + }); + + it('compiles the trigger, permissions, and safe outputs into the lock workflow', () => { + const lock = fs.readFileSync(lockPath, 'utf-8'); + + expect(lock).toContain('auth-doctor'); + expect(lock).toContain('actions: read'); + expect(lock).toContain('issues: read'); + expect(lock).toContain('pull-requests: read'); + expect(lock).toContain('🩺 Auth Doctor'); + expect(lock).toMatch(/github\/gh-aw(?:-actions\/|\/actions\/)setup@(?:[a-f0-9]{40}|v\d+\.\d+\.\d+)/); + }); +}); From 7372e25618c7415b9f3fc1655cab58397b7318de Mon Sep 17 00:00:00 2001 From: Landon Cox Date: Mon, 3 Aug 2026 11:53:10 -0700 Subject: [PATCH 2/4] fix: replace Auth Doctor with updater Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 79dfde80-9308-4d73-bd34-3ec5bc114cd7 --- ....lock.yml => auth-doctor-updater.lock.yml} | 291 +++++++----------- .github/workflows/auth-doctor-updater.md | 194 ++++++++++++ .github/workflows/auth-doctor.md | 196 ------------ README.md | 2 +- docs/api-proxy-sidecar.md | 4 +- docs/auth-matrix.md | 4 +- docs/authentication-architecture.md | 2 +- docs/diagnosing-awf-failures.md | 4 - docs/environment.md | 2 +- .../ci/auth-doctor-updater-workflow.test.ts | 61 ++++ scripts/ci/auth-doctor-workflow.test.ts | 59 ---- 11 files changed, 367 insertions(+), 452 deletions(-) rename .github/workflows/{auth-doctor.lock.yml => auth-doctor-updater.lock.yml} (80%) create mode 100644 .github/workflows/auth-doctor-updater.md delete mode 100644 .github/workflows/auth-doctor.md create mode 100644 scripts/ci/auth-doctor-updater-workflow.test.ts delete mode 100644 scripts/ci/auth-doctor-workflow.test.ts diff --git a/.github/workflows/auth-doctor.lock.yml b/.github/workflows/auth-doctor-updater.lock.yml similarity index 80% rename from .github/workflows/auth-doctor.lock.yml rename to .github/workflows/auth-doctor-updater.lock.yml index fdb8d69f2..0483230a5 100644 --- a/.github/workflows/auth-doctor.lock.yml +++ b/.github/workflows/auth-doctor-updater.lock.yml @@ -1,4 +1,4 @@ -# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"dbe67338549fa3940a0a44677cd4f4ba24ceac2c9c8a5a1adf8524ab900492b7","body_hash":"31a8f08b147c35aedf1ac9d71e5ab4ec87ae7442281129178c4667c2aa885d21","compiler_version":"v0.84.3","strict":true,"agent_id":"copilot","engine_versions":{"copilot":"1.0.77"}} +# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"2864040421574692c410b1e629885acb4fd3b3eac8bf62da4e842fac9aad846b","body_hash":"77758246f780bd91840a9ef97a46b75118b6c884196a41ef21fb78c9524ec880","compiler_version":"v0.84.3","strict":true,"agent_id":"copilot","engine_versions":{"copilot":"1.0.77"}} # gh-aw-manifest: {"version":1,"secrets":["COPILOT_GITHUB_TOKEN","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/cache","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/cache/restore","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/cache/save","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/checkout","sha":"3d3c42e5aac5ba805825da76410c181273ba90b1","version":"v7.0.1"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"},{"repo":"github/gh-aw-actions/setup","sha":"c863074e6da7866f66d9ce31ce11429384406f5f","version":"v0.84.3"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.27.43","digest":"sha256:04e2d1987a565000a8f114b89d806ae7a3864dd4f944be65275b28c93d8690e6","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.27.43@sha256:04e2d1987a565000a8f114b89d806ae7a3864dd4f944be65275b28c93d8690e6"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.43","digest":"sha256:d85f57975af5ea23af4996e41ed73fbc8f5b4a47402472bfe82e508f352cb0c1","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.43@sha256:d85f57975af5ea23af4996e41ed73fbc8f5b4a47402472bfe82e508f352cb0c1"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.27.43","digest":"sha256:26be5e0b8c8f4c41c8a59126b29bb5d80b07253597472ded2a16bdd75abcbf9d","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.27.43@sha256:26be5e0b8c8f4c41c8a59126b29bb5d80b07253597472ded2a16bdd75abcbf9d"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.4.7","digest":"sha256:7545220a9aca134b71e51193ee0eaf4c50756ebf8fbd25a63ae7556e62815c00","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.4.7@sha256:7545220a9aca134b71e51193ee0eaf4c50756ebf8fbd25a63ae7556e62815c00"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b","pinned_image":"ghcr.io/github/gh-aw-node@sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b"},{"image":"ghcr.io/github/github-mcp-server:v1.8.0","digest":"sha256:d5a18c04b92714c309eb46a2305087e91a4dbd80420f6e462656699f95093520","pinned_image":"ghcr.io/github/github-mcp-server:v1.8.0@sha256:d5a18c04b92714c309eb46a2305087e91a4dbd80420f6e462656699f95093520"}]} # This file was automatically generated by gh-aw (v0.84.3). DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md # @@ -23,7 +23,7 @@ # # For more information: https://github.github.com/gh-aw/introduction/overview/ # -# Diagnoses AWF authentication, API-proxy, and HTTP MCP GitHub OIDC configuration from issue reports and workflow evidence without exposing credentials. +# Daily workflow that reviews provider authentication guidance, repository changes, and related issues and proposes documentation updates for AWF authentication and API-proxy behavior. # # Secrets used: # - COPILOT_GITHUB_TOKEN @@ -50,39 +50,42 @@ # - ghcr.io/github/gh-aw-node@sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b # - ghcr.io/github/github-mcp-server:v1.8.0@sha256:d5a18c04b92714c309eb46a2305087e91a4dbd80420f6e462656699f95093520 -name: "Auth Doctor" +name: "Auth Doctor Updater" on: - issue_comment: - types: - - created - - edited -# roles: all # Roles processed as role check in pre-activation job + schedule: + - cron: "6 3 * * *" # Friendly format: daily (scattered) + # skip-if-match: # Skip-if-match processed as search check in pre-activation job + # max: 1 + # query: is:issue is:open label:documentation in:title "Auth Doctor Update" + workflow_dispatch: + inputs: + aw_context: + default: "" + description: "Agent caller context (used internally by Agentic Workflows)." + required: false + type: string permissions: {} concurrency: - group: "gh-aw-${{ github.workflow }}-${{ github.event.issue.number || github.event.pull_request.number || github.run_id }}" + group: "gh-aw-${{ github.workflow }}" -run-name: "Auth Doctor" +run-name: "Auth Doctor Updater" jobs: activation: needs: pre_activation - if: "needs.pre_activation.outputs.activated == 'true' && ((github.event_name == 'issue_comment') && (github.event_name == 'issue_comment' && (startsWith(github.event.comment.body, '/auth-doctor ') || startsWith(github.event.comment.body, '/auth-doctor\n') || github.event.comment.body == '/auth-doctor') && github.event.issue.pull_request == null) || !(github.event_name == 'issue_comment'))" + if: needs.pre_activation.outputs.activated == 'true' runs-on: ubuntu-slim permissions: actions: read contents: read - issues: write - pull-requests: write env: GH_AW_MAX_DAILY_AI_CREDITS: ${{ vars.GH_AW_DEFAULT_MAX_DAILY_AI_CREDITS || '5000' }} GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} outputs: - body: ${{ steps.sanitized.outputs.body }} - comment_id: ${{ steps.add-comment.outputs.comment-id }} - comment_repo: ${{ steps.add-comment.outputs.comment-repo }} - comment_url: ${{ steps.add-comment.outputs.comment-url }} + comment_id: "" + comment_repo: "" daily_ai_credits_exceeded: ${{ steps.daily-effective-workflow-guardrail.outputs.daily_ai_credits_exceeded == 'true' }} daily_ai_credits_threshold: ${{ steps.daily-effective-workflow-guardrail.outputs.daily_ai_credits_threshold || '' }} daily_ai_credits_total_effective_tokens: ${{ steps.daily-effective-workflow-guardrail.outputs.daily_ai_credits_total_effective_tokens || '' }} @@ -93,10 +96,7 @@ jobs: setup-parent-span-id: ${{ steps.setup.outputs.parent-span-id || steps.setup.outputs.span-id }} setup-span-id: ${{ steps.setup.outputs.span-id }} setup-trace-id: ${{ steps.setup.outputs.trace-id }} - slash_command: ${{ needs.pre_activation.outputs.matched_command }} stale_lock_file_failed: ${{ steps.check-lock-file.outputs.stale_lock_file_failed == 'true' }} - text: ${{ steps.sanitized.outputs.text }} - title: ${{ steps.sanitized.outputs.title }} steps: - name: Setup Scripts id: setup @@ -108,8 +108,8 @@ jobs: parent-span-id: ${{ needs.pre_activation.outputs.setup-parent-span-id || needs.pre_activation.outputs.setup-span-id }} safe-output-artifact-client: ${{ env.GH_AW_MAX_DAILY_AI_CREDITS != '' }} env: - GH_AW_SETUP_WORKFLOW_NAME: "Auth Doctor" - GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/auth-doctor.lock.yml@${{ github.ref }} + GH_AW_SETUP_WORKFLOW_NAME: "Auth Doctor Updater" + GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/auth-doctor-updater.lock.yml@${{ github.ref }} GH_AW_INFO_VERSION: "1.0.77" GH_AW_INFO_AWF_VERSION: "v0.27.43" GH_AW_INFO_ENGINE_ID: "copilot" @@ -122,11 +122,11 @@ jobs: GH_AW_INFO_VERSION: "1.0.77" GH_AW_INFO_AGENT_VERSION: "1.0.77" GH_AW_INFO_CLI_VERSION: "v0.84.3" - GH_AW_INFO_WORKFLOW_NAME: "Auth Doctor" + GH_AW_INFO_WORKFLOW_NAME: "Auth Doctor Updater" GH_AW_INFO_EXPERIMENTAL: "false" GH_AW_INFO_SUPPORTS_TOOLS_ALLOWLIST: "true" GH_AW_INFO_STAGED: "false" - GH_AW_INFO_ALLOWED_DOMAINS: '["github"]' + GH_AW_INFO_ALLOWED_DOMAINS: '["github","platform.openai.com","learn.microsoft.com","docs.aws.amazon.com","cloud.google.com","docs.anthropic.com","platform.claude.com","ai.google.dev","docs.github.com"]' GH_AW_INFO_FIREWALL_ENABLED: "true" GH_AW_INFO_AWF_VERSION: "v0.27.43" GH_AW_INFO_AWMG_VERSION: "" @@ -145,8 +145,8 @@ jobs: continue-on-error: true uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: - key: agentic-workflow-usage-authdoctor-${{ github.run_id }} - restore-keys: agentic-workflow-usage-authdoctor- + key: agentic-workflow-usage-authdoctorupdater-${{ github.run_id }} + restore-keys: agentic-workflow-usage-authdoctorupdater- path: /tmp/gh-aw/agentic-workflow-usage-cache.jsonl - name: Restore daily AIC usage cache (artifact fallback) id: restore-daily-aic-cache-fallback @@ -168,11 +168,11 @@ jobs: if: ${{ env.GH_AW_MAX_DAILY_AI_CREDITS != '' }} uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 env: - GH_AW_WORKFLOW_NAME: "Auth Doctor" - GH_AW_WORKFLOW_ID: "auth-doctor" + GH_AW_WORKFLOW_NAME: "Auth Doctor Updater" + GH_AW_WORKFLOW_ID: "auth-doctor-updater" GH_AW_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }} GH_AW_WORKFLOW_DISPATCH_AW_CONTEXT: ${{ github.event.inputs.aw_context || '' }} - GH_AW_HAS_SLASH_COMMAND: "true" + GH_AW_HAS_SLASH_COMMAND: "false" GH_AW_HAS_LABEL_COMMAND: "false" GH_AW_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} GH_AW_MAX_DAILY_AI_CREDITS: ${{ vars.GH_AW_DEFAULT_MAX_DAILY_AI_CREDITS || '5000' }} @@ -183,19 +183,6 @@ jobs: setupGlobals(core, github, context, exec, io, getOctokit); const { main } = require('${{ runner.temp }}/gh-aw/actions/check_daily_aic_workflow_guardrail.cjs'); await main(); - - name: Add eyes reaction for immediate feedback - id: react - if: github.event_name == 'issues' || github.event_name == 'issue_comment' || github.event_name == 'pull_request_review_comment' || github.event_name == 'discussion' || github.event_name == 'discussion_comment' || github.event_name == 'pull_request' && github.event.pull_request.head.repo.id == github.repository_id - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 - env: - GH_AW_REACTION: "eyes" - with: - github-token: ${{ secrets.GITHUB_TOKEN }} - script: | - const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs'); - setupGlobals(core, github, context, exec, io, getOctokit); - const { main } = require('${{ runner.temp }}/gh-aw/actions/add_reaction.cjs'); - await main(); - name: Check for OAuth tokens id: check-oauth-tokens run: bash "${RUNNER_TEMP}/gh-aw/actions/check_oauth_tokens.sh" @@ -228,7 +215,7 @@ jobs: id: check-lock-file uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 env: - GH_AW_WORKFLOW_FILE: "auth-doctor.lock.yml" + GH_AW_WORKFLOW_FILE: "auth-doctor-updater.lock.yml" GH_AW_CONTEXT_WORKFLOW_REF: "${{ github.workflow_ref }}" with: script: | @@ -246,29 +233,6 @@ jobs: setupGlobals(core, github, context, exec, io, getOctokit); const { main } = require('${{ runner.temp }}/gh-aw/actions/check_version_updates.cjs'); await main(); - - name: Compute current body text - id: sanitized - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 - env: - GH_AW_ALLOWED_DOMAINS: "*.githubusercontent.com,api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,codeload.github.com,docs.github.com,github-cloud.githubusercontent.com,github-cloud.s3.amazonaws.com,github.blog,github.com,github.githubassets.com,host.docker.internal,lfs.github.com,objects.githubusercontent.com,patch-diff.githubusercontent.com,patchdiff.githubusercontent.com,raw.githubusercontent.com,registry.npmjs.org,telemetry.enterprise.githubcopilot.com" - with: - script: | - const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs'); - setupGlobals(core, github, context, exec, io, getOctokit); - const { main } = require('${{ runner.temp }}/gh-aw/actions/compute_text.cjs'); - await main(); - - name: Add comment with workflow run link - id: add-comment - if: github.event_name == 'issues' || github.event_name == 'issue_comment' || github.event_name == 'pull_request_review_comment' || github.event_name == 'discussion' || github.event_name == 'discussion_comment' || github.event_name == 'pull_request' && github.event.pull_request.head.repo.id == github.repository_id - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 - env: - GH_AW_WORKFLOW_NAME: "Auth Doctor" - with: - script: | - const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs'); - setupGlobals(core, github, context, exec, io, getOctokit); - const { main } = require('${{ runner.temp }}/gh-aw/actions/add_workflow_run_comment.cjs'); - await main(); - name: Log runtime features if: ${{ contains(toJSON(vars), '"GH_AW_RUNTIME_FEATURES":') }} run: bash "${RUNNER_TEMP}/gh-aw/actions/log_runtime_features_summary.sh" @@ -281,31 +245,28 @@ jobs: GH_AW_EXPR_802A9F6A: ${{ github.event.issue.number || (fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_type == 'issue' && fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_number) }} GH_AW_EXPR_FF1D34CE: ${{ github.event.comment.id || fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').comment_id }} GH_AW_GITHUB_ACTOR: ${{ github.actor }} - GH_AW_GITHUB_EVENT_ISSUE_NUMBER: ${{ github.event.issue.number }} GH_AW_GITHUB_REPOSITORY: ${{ github.repository }} GH_AW_GITHUB_RUN_ID: ${{ github.run_id }} GH_AW_GITHUB_WORKSPACE: ${{ github.workspace }} - GH_AW_IS_PR_COMMENT: ${{ github.event.issue.pull_request && 'true' || '' }} - GH_AW_STEPS_SANITIZED_OUTPUTS_TEXT: ${{ steps.sanitized.outputs.text }} # poutine:ignore untrusted_checkout_exec run: | bash "${RUNNER_TEMP}/gh-aw/actions/create_prompt_first.sh" { - cat << 'GH_AW_PROMPT_692a20b31f1c17a2_EOF' + cat << 'GH_AW_PROMPT_267715395a9529db_EOF' - GH_AW_PROMPT_692a20b31f1c17a2_EOF + GH_AW_PROMPT_267715395a9529db_EOF cat "${RUNNER_TEMP}/gh-aw/prompts/xpia.md" cat "${RUNNER_TEMP}/gh-aw/prompts/temp_folder_prompt.md" cat "${RUNNER_TEMP}/gh-aw/prompts/markdown.md" cat "${RUNNER_TEMP}/gh-aw/prompts/cache_memory_prompt.md" cat "${RUNNER_TEMP}/gh-aw/prompts/safe_outputs_prompt.md" - cat << 'GH_AW_PROMPT_692a20b31f1c17a2_EOF' + cat << 'GH_AW_PROMPT_267715395a9529db_EOF' - Tools: add_comment, create_issue, missing_tool, missing_data, noop + Tools: create_issue, missing_tool, missing_data, noop - GH_AW_PROMPT_692a20b31f1c17a2_EOF + GH_AW_PROMPT_267715395a9529db_EOF cat "${RUNNER_TEMP}/gh-aw/prompts/mcp_cli_tools_prompt.md" - cat << 'GH_AW_PROMPT_692a20b31f1c17a2_EOF' + cat << 'GH_AW_PROMPT_267715395a9529db_EOF' The following GitHub context information is available for this workflow: {{#if github.actor}} @@ -334,24 +295,19 @@ jobs: {{/if}} - GH_AW_PROMPT_692a20b31f1c17a2_EOF + GH_AW_PROMPT_267715395a9529db_EOF cat "${RUNNER_TEMP}/gh-aw/prompts/github_mcp_tools_with_safeoutputs_prompt.md" - if [ "$GITHUB_EVENT_NAME" = "issue_comment" ] && [ -n "$GH_AW_IS_PR_COMMENT" ] || [ "$GITHUB_EVENT_NAME" = "pull_request_review_comment" ] || [ "$GITHUB_EVENT_NAME" = "pull_request_review" ]; then - cat "${RUNNER_TEMP}/gh-aw/prompts/pr_context_prompt.md" - fi - cat << 'GH_AW_PROMPT_692a20b31f1c17a2_EOF' + cat << 'GH_AW_PROMPT_267715395a9529db_EOF' - {{#runtime-import .github/workflows/auth-doctor.md}} - GH_AW_PROMPT_692a20b31f1c17a2_EOF + {{#runtime-import .github/workflows/auth-doctor-updater.md}} + GH_AW_PROMPT_267715395a9529db_EOF } > "$GH_AW_PROMPT" - name: Interpolate variables and render templates uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 env: GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt GH_AW_ENGINE_ID: "copilot" - GH_AW_GITHUB_EVENT_ISSUE_NUMBER: ${{ github.event.issue.number }} GH_AW_GITHUB_REPOSITORY: ${{ github.repository }} - GH_AW_STEPS_SANITIZED_OUTPUTS_TEXT: ${{ steps.sanitized.outputs.text }} with: script: | const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs'); @@ -370,15 +326,11 @@ jobs: GH_AW_EXPR_802A9F6A: ${{ github.event.issue.number || (fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_type == 'issue' && fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_number) }} GH_AW_EXPR_FF1D34CE: ${{ github.event.comment.id || fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').comment_id }} GH_AW_GITHUB_ACTOR: ${{ github.actor }} - GH_AW_GITHUB_EVENT_ISSUE_NUMBER: ${{ github.event.issue.number }} GH_AW_GITHUB_REPOSITORY: ${{ github.repository }} GH_AW_GITHUB_RUN_ID: ${{ github.run_id }} GH_AW_GITHUB_WORKSPACE: ${{ github.workspace }} - GH_AW_IS_PR_COMMENT: ${{ github.event.issue.pull_request && 'true' || '' }} GH_AW_MCP_CLI_SERVERS_LIST: "- `github` — run `github --help` to see available tools\n- `safeoutputs` — run `safeoutputs --help` to see available tools" GH_AW_NEEDS_PRE_ACTIVATION_OUTPUTS_ACTIVATED: ${{ needs.pre_activation.outputs.activated }} - GH_AW_NEEDS_PRE_ACTIVATION_OUTPUTS_MATCHED_COMMAND: ${{ needs.pre_activation.outputs.matched_command }} - GH_AW_STEPS_SANITIZED_OUTPUTS_TEXT: ${{ steps.sanitized.outputs.text }} with: script: | const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs'); @@ -398,15 +350,11 @@ jobs: GH_AW_EXPR_802A9F6A: process.env.GH_AW_EXPR_802A9F6A, GH_AW_EXPR_FF1D34CE: process.env.GH_AW_EXPR_FF1D34CE, GH_AW_GITHUB_ACTOR: process.env.GH_AW_GITHUB_ACTOR, - GH_AW_GITHUB_EVENT_ISSUE_NUMBER: process.env.GH_AW_GITHUB_EVENT_ISSUE_NUMBER, GH_AW_GITHUB_REPOSITORY: process.env.GH_AW_GITHUB_REPOSITORY, GH_AW_GITHUB_RUN_ID: process.env.GH_AW_GITHUB_RUN_ID, GH_AW_GITHUB_WORKSPACE: process.env.GH_AW_GITHUB_WORKSPACE, - GH_AW_IS_PR_COMMENT: process.env.GH_AW_IS_PR_COMMENT, GH_AW_MCP_CLI_SERVERS_LIST: process.env.GH_AW_MCP_CLI_SERVERS_LIST, - GH_AW_NEEDS_PRE_ACTIVATION_OUTPUTS_ACTIVATED: process.env.GH_AW_NEEDS_PRE_ACTIVATION_OUTPUTS_ACTIVATED, - GH_AW_NEEDS_PRE_ACTIVATION_OUTPUTS_MATCHED_COMMAND: process.env.GH_AW_NEEDS_PRE_ACTIVATION_OUTPUTS_MATCHED_COMMAND, - GH_AW_STEPS_SANITIZED_OUTPUTS_TEXT: process.env.GH_AW_STEPS_SANITIZED_OUTPUTS_TEXT + GH_AW_NEEDS_PRE_ACTIVATION_OUTPUTS_ACTIVATED: process.env.GH_AW_NEEDS_PRE_ACTIVATION_OUTPUTS_ACTIVATED } }); - name: Validate prompt placeholders @@ -443,11 +391,13 @@ jobs: if: needs.activation.outputs.daily_ai_credits_exceeded != 'true' runs-on: ubuntu-latest permissions: - actions: read contents: read copilot-requests: write issues: read pull-requests: read + concurrency: + group: "gh-aw-copilot-${{ github.workflow }}" + queue: max env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} GH_AW_ASSETS_ALLOWED_EXTS: "" @@ -455,7 +405,7 @@ jobs: GH_AW_ASSETS_MAX_SIZE_KB: 0 GH_AW_MCP_LOG_DIR: /tmp/gh-aw/mcp-logs/safeoutputs GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} - GH_AW_WORKFLOW_ID_SANITIZED: authdoctor + GH_AW_WORKFLOW_ID_SANITIZED: authdoctorupdater outputs: agentic_engine_timeout: ${{ steps.detect-agent-errors.outputs.agentic_engine_timeout || 'false' }} ai_credits_rate_limit_error: ${{ steps.parse-mcp-gateway.outputs.ai_credits_rate_limit_error || 'false' }} @@ -491,8 +441,8 @@ jobs: trace-id: ${{ needs.activation.outputs.setup-trace-id }} parent-span-id: ${{ needs.activation.outputs.setup-parent-span-id || needs.activation.outputs.setup-span-id }} env: - GH_AW_SETUP_WORKFLOW_NAME: "Auth Doctor" - GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/auth-doctor.lock.yml@${{ github.ref }} + GH_AW_SETUP_WORKFLOW_NAME: "Auth Doctor Updater" + GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/auth-doctor-updater.lock.yml@${{ github.ref }} GH_AW_INFO_VERSION: "1.0.77" GH_AW_INFO_AWF_VERSION: "v0.27.43" GH_AW_INFO_ENGINE_ID: "copilot" @@ -535,6 +485,9 @@ jobs: GH_AW_CACHE_DIR: /tmp/gh-aw/cache-memory GH_AW_MIN_INTEGRITY: none run: bash "${RUNNER_TEMP}/gh-aw/actions/setup_cache_memory_git.sh" + - name: Compute scan window + run: "# Look back two days so a missed daily run does not create a coverage gap.\n# Overlap is de-duplicated against existing documentation and proposals.\nSINCE=$(date -u -d '2 days ago' +%Y-%m-%d)\nmkdir -p /tmp/gh-aw/agent\necho \"$SINCE\" > /tmp/gh-aw/agent/scan-since.txt\necho \"Scanning for authentication guidance updated since $SINCE\"" + - name: Configure Git credentials env: GITHUB_REPOSITORY: ${{ github.repository }} @@ -594,44 +547,21 @@ jobs: mkdir -p "${RUNNER_TEMP}/gh-aw/safeoutputs" mkdir -p /tmp/gh-aw/safeoutputs mkdir -p /tmp/gh-aw/mcp-logs/safeoutputs - cat > "${RUNNER_TEMP}/gh-aw/safeoutputs/config.json" << 'GH_AW_SAFE_OUTPUTS_CONFIG_1b26556e625f491f_EOF' - {"add_comment":{"max":1},"create_issue":{"max":1,"title_prefix":"🩺 Auth Doctor"},"create_report_incomplete_issue":{},"mentions":{"enabled":false},"missing_data":{},"missing_tool":{},"noop":{"max":1,"report-as-issue":"true"},"report_incomplete":{}} - GH_AW_SAFE_OUTPUTS_CONFIG_1b26556e625f491f_EOF + cat > "${RUNNER_TEMP}/gh-aw/safeoutputs/config.json" << 'GH_AW_SAFE_OUTPUTS_CONFIG_0df50569eef0527e_EOF' + {"create_issue":{"expires":720,"labels":["documentation","automated"],"max":1,"title_prefix":"🩺 Auth Doctor Update"},"create_report_incomplete_issue":{},"mentions":{"enabled":false},"missing_data":{},"missing_tool":{},"noop":{"max":1,"report-as-issue":"true"},"report_incomplete":{}} + GH_AW_SAFE_OUTPUTS_CONFIG_0df50569eef0527e_EOF - name: Generate Safe Outputs Tools env: GH_AW_TOOLS_META_JSON: | { "description_suffixes": { - "add_comment": " CONSTRAINTS: Maximum 1 comment(s) can be added. Supports reply_to_id for discussion threading.", - "create_issue": " CONSTRAINTS: Maximum 1 issue(s) can be created. Title will be prefixed with \"🩺 Auth Doctor\"." + "create_issue": " CONSTRAINTS: Maximum 1 issue(s) can be created. Title will be prefixed with \"🩺 Auth Doctor Update\". Labels [\"documentation\" \"automated\"] will be automatically added." }, "repo_params": {}, "dynamic_tools": [] } GH_AW_VALIDATION_JSON: | { - "add_comment": { - "defaultMax": 1, - "fields": { - "body": { - "required": true, - "type": "string", - "sanitize": true, - "maxLength": 65000 - }, - "item_number": { - "issueOrPRNumber": true - }, - "reply_to_id": { - "type": "string", - "maxLength": 256 - }, - "repo": { - "type": "string", - "maxLength": 256 - } - } - }, "create_issue": { "defaultMax": 1, "fields": { @@ -876,7 +806,7 @@ jobs: - name: Execute GitHub Copilot CLI id: agentic_execution # Copilot CLI tool arguments (sorted): - timeout-minutes: 15 + timeout-minutes: 20 run: | set -o pipefail printf '%s' "$(date +%s%3N)" > /tmp/gh-aw/agent_cli_start_ms.txt @@ -891,7 +821,7 @@ jobs: export COPILOT_API_KEY="$COPILOT_DUMMY_BYOK" (umask 177 && touch /tmp/gh-aw/agent-stdio.log) GH_AW_MAX_AI_CREDITS="${GH_AW_MAX_AI_CREDITS:-1000}" - printf '%s\n' "{\"\$schema\":\"https://github.com/github/gh-aw-firewall/releases/download/v0.27.43/awf-config.schema.json\",\"network\":{\"allowDomains\":[\"*.githubusercontent.com\",\"api.business.githubcopilot.com\",\"api.enterprise.githubcopilot.com\",\"api.github.com\",\"api.githubcopilot.com\",\"api.individual.githubcopilot.com\",\"codeload.github.com\",\"docs.github.com\",\"github-cloud.githubusercontent.com\",\"github-cloud.s3.amazonaws.com\",\"github.blog\",\"github.com\",\"github.githubassets.com\",\"host.docker.internal\",\"lfs.github.com\",\"objects.githubusercontent.com\",\"patch-diff.githubusercontent.com\",\"patchdiff.githubusercontent.com\",\"raw.githubusercontent.com\",\"registry.npmjs.org\",\"telemetry.enterprise.githubcopilot.com\"],\"isolation\":true,\"topologyAttach\":[\"awmg-mcpg\"]},\"apiProxy\":{\"enabled\":true,\"enableTokenSteering\":true,\"maxRuns\":500,\"maxAiCredits\":${GH_AW_MAX_AI_CREDITS},\"maxCacheMisses\":5,\"models\":{\"agent\":[\"sonnet-6x\",\"gpt-5.4\",\"gpt-5.5\",\"gpt-5.6\",\"gpt-5.3\",\"gemini-pro\",\"any\"],\"antigravity\":[\"copilot/antigravity*\",\"google/antigravity*\",\"gemini/antigravity*\"],\"any\":[\"copilot/*\",\"anthropic/*\",\"openai/*\",\"google/*\",\"gemini/*\"],\"auto\":[\"copilot/auto\",\"large\"],\"claude\":[\"agent\"],\"codex\":[\"agent\"],\"coding\":[\"copilot/gpt-5*codex*\",\"openai/gpt-5*codex*\",\"gpt-5-codex\",\"kimi\"],\"computer-use\":[\"copilot/*computer-use*\",\"google/*computer-use*\",\"gemini/*computer-use*\",\"openai/*computer-use*\"],\"copilot\":[\"agent\"],\"deep-research\":[\"copilot/deep-research*\",\"copilot/o3-deep-research*\",\"copilot/o4-mini-deep-research*\",\"google/deep-research*\",\"gemini/deep-research*\",\"openai/o3-deep-research*\",\"openai/o4-mini-deep-research*\"],\"detection\":[\"small\"],\"evals\":[\"small\"],\"fable\":[\"copilot/*fable*\",\"anthropic/*fable*\"],\"gemini\":[\"agent\"],\"gemini-3-flash\":[\"copilot/gemini-3*flash*\",\"google/gemini-3*flash*\",\"gemini/gemini-3*flash*\"],\"gemini-3-pro\":[\"copilot/gemini-3*pro*\",\"google/gemini-3*pro*\",\"google/nano-banana*\",\"gemini/gemini-3*pro*\"],\"gemini-3.1-flash\":[\"copilot/gemini-3.1*flash*\",\"google/gemini-3.1*flash*\",\"gemini/gemini-3.1*flash*\"],\"gemini-3.1-pro\":[\"copilot/gemini-3.1*pro*\",\"google/gemini-3.1*pro*\",\"gemini/gemini-3.1*pro*\"],\"gemini-3.5-flash\":[\"copilot/gemini-3.5*flash*\",\"google/gemini-3.5*flash*\",\"gemini/gemini-3.5*flash*\"],\"gemini-3.6-flash\":[\"copilot/gemini-3.6*flash*\",\"google/gemini-3.6*flash*\",\"gemini/gemini-3.6*flash*\"],\"gemini-flash\":[\"copilot/gemini-*flash*\",\"google/gemini-*flash*\",\"gemini/gemini-*flash*\"],\"gemini-flash-lite\":[\"copilot/gemini-*flash*lite*\",\"google/gemini-*flash*lite*\",\"gemini/gemini-*flash*lite*\"],\"gemini-omni\":[\"copilot/gemini-omni*\",\"google/gemini-omni*\",\"gemini/gemini-omni*\"],\"gemini-pro\":[\"copilot/gemini-*pro*\",\"google/gemini-*pro*\",\"gemini/gemini-*pro*\"],\"gemma\":[\"copilot/gemma*\",\"google/gemma*\",\"gemini/gemma*\"],\"gpt-5\":[\"copilot/gpt-5*\",\"openai/gpt-5*\"],\"gpt-5-codex\":[\"copilot/gpt-5*codex*\",\"openai/gpt-5*codex*\"],\"gpt-5-mini\":[\"copilot/gpt-5*mini*\",\"openai/gpt-5*mini*\"],\"gpt-5-nano\":[\"copilot/gpt-5*nano*\",\"openai/gpt-5*nano*\"],\"gpt-5-pro\":[\"copilot/gpt-5*pro*\",\"openai/gpt-5*pro*\"],\"gpt-5.1\":[\"copilot/gpt-5.1*\",\"openai/gpt-5.1*\"],\"gpt-5.2\":[\"copilot/gpt-5.2*\",\"openai/gpt-5.2*\"],\"gpt-5.3\":[\"copilot/gpt-5.3*\",\"openai/gpt-5.3*\"],\"gpt-5.4\":[\"copilot/gpt-5.4*\",\"openai/gpt-5.4*\"],\"gpt-5.5\":[\"copilot/gpt-5.5*\",\"openai/gpt-5.5*\"],\"gpt-5.6\":[\"copilot/gpt-5.6*\",\"openai/gpt-5.6*\"],\"grok\":[\"copilot/*grok*\",\"openai/*grok*\"],\"haiku\":[\"copilot/*haiku*\",\"anthropic/*haiku*\"],\"image-generation\":[\"copilot/gpt-image*\",\"openai/gpt-image*\",\"openai/chatgpt-image*\",\"copilot/gemini-*image*\",\"google/gemini-*image*\",\"gemini/gemini-*image*\",\"google/imagen*\"],\"kimi\":[\"copilot/kimi*\",\"openai/kimi*\"],\"kiwi\":[\"copilot/kiwi*\",\"openai/kiwi*\"],\"large\":[\"sonnet\",\"gpt-5-pro\",\"gpt-5\",\"gemini-pro\"],\"lyria\":[\"google/lyria*\",\"gemini/lyria*\",\"copilot/lyria*\"],\"mai-code\":[\"copilot/MAI-Code*\",\"copilot/mai-code*\",\"openai/MAI-Code*\"],\"mai-code-1-flash-picker\":[\"copilot/MAI-Code-1-Flash-picker*\",\"copilot/mai-code-1-flash-picker*\",\"openai/MAI-Code-1-Flash-picker*\"],\"mini\":[\"haiku\",\"gpt-5-mini\",\"gpt-5-nano\",\"gemini-flash-lite\"],\"nano-banana\":[\"copilot/nano-banana*\",\"google/nano-banana*\",\"gemini/nano-banana*\"],\"opus\":[\"copilot/*opus*\",\"anthropic/*opus*\"],\"opusplan\":[\"opus?effort=high\"],\"raptor-mini\":[\"copilot/raptor*\",\"openai/raptor*\"],\"reasoning\":[\"copilot/o1*\",\"copilot/o3*\",\"copilot/o4*\",\"openai/o1*\",\"openai/o3*\",\"openai/o4*\"],\"robotics\":[\"copilot/*robotics*\",\"google/*robotics*\",\"gemini/*robotics*\"],\"small\":[\"mini\"],\"small-agent\":[\"haiku\",\"gpt-5-mini\",\"gemini-flash\"],\"sonnet\":[\"copilot/*sonnet*\",\"anthropic/*sonnet*\"],\"sonnet-6x\":[\"copilot/*sonnet-4.5*\",\"copilot/*sonnet-4.6*\",\"copilot/*sonnet-5*\",\"copilot/*sonnet-4-5-*\",\"anthropic/*sonnet-4-5-*\",\"copilot/*sonnet-4-6*\",\"anthropic/*sonnet-4-6*\",\"anthropic/*sonnet-5*\"],\"summarization\":[\"haiku\",\"gpt-5-mini\",\"gemini-flash-lite\",\"mini\"],\"veo\":[\"google/veo*\",\"gemini/veo*\"],\"vision\":[\"copilot/gemini-*image*\",\"google/gemini-*image*\",\"gemini/gemini-*image*\",\"copilot/gemini-*flash*\",\"google/gemini-*flash*\",\"gemini/gemini-*flash*\"]}},\"container\":{\"imageTag\":\"0.27.43,squid=sha256:26be5e0b8c8f4c41c8a59126b29bb5d80b07253597472ded2a16bdd75abcbf9d,agent=sha256:04e2d1987a565000a8f114b89d806ae7a3864dd4f944be65275b28c93d8690e6,api-proxy=sha256:d85f57975af5ea23af4996e41ed73fbc8f5b4a47402472bfe82e508f352cb0c1,cli-proxy=sha256:65c45ea2967984d0024f3df61bc71335658a77ede96c8d9665da7a5f33a795ab\"},\"logging\":{\"proxyLogsDir\":\"/tmp/gh-aw/sandbox/firewall/logs\",\"auditDir\":\"/tmp/gh-aw/sandbox/firewall/audit\"}}" > "${RUNNER_TEMP}/gh-aw/awf-config.json" + printf '%s\n' "{\"\$schema\":\"https://github.com/github/gh-aw-firewall/releases/download/v0.27.43/awf-config.schema.json\",\"network\":{\"allowDomains\":[\"*.githubusercontent.com\",\"ai.google.dev\",\"api.business.githubcopilot.com\",\"api.enterprise.githubcopilot.com\",\"api.github.com\",\"api.githubcopilot.com\",\"api.individual.githubcopilot.com\",\"cloud.google.com\",\"codeload.github.com\",\"docs.anthropic.com\",\"docs.aws.amazon.com\",\"docs.github.com\",\"github-cloud.githubusercontent.com\",\"github-cloud.s3.amazonaws.com\",\"github.blog\",\"github.com\",\"github.githubassets.com\",\"host.docker.internal\",\"learn.microsoft.com\",\"lfs.github.com\",\"objects.githubusercontent.com\",\"patch-diff.githubusercontent.com\",\"patchdiff.githubusercontent.com\",\"platform.claude.com\",\"platform.openai.com\",\"raw.githubusercontent.com\",\"registry.npmjs.org\",\"telemetry.enterprise.githubcopilot.com\"],\"isolation\":true,\"topologyAttach\":[\"awmg-mcpg\"]},\"apiProxy\":{\"enabled\":true,\"enableTokenSteering\":true,\"maxRuns\":500,\"maxAiCredits\":${GH_AW_MAX_AI_CREDITS},\"maxCacheMisses\":5,\"models\":{\"agent\":[\"sonnet-6x\",\"gpt-5.4\",\"gpt-5.5\",\"gpt-5.6\",\"gpt-5.3\",\"gemini-pro\",\"any\"],\"antigravity\":[\"copilot/antigravity*\",\"google/antigravity*\",\"gemini/antigravity*\"],\"any\":[\"copilot/*\",\"anthropic/*\",\"openai/*\",\"google/*\",\"gemini/*\"],\"auto\":[\"copilot/auto\",\"large\"],\"claude\":[\"agent\"],\"codex\":[\"agent\"],\"coding\":[\"copilot/gpt-5*codex*\",\"openai/gpt-5*codex*\",\"gpt-5-codex\",\"kimi\"],\"computer-use\":[\"copilot/*computer-use*\",\"google/*computer-use*\",\"gemini/*computer-use*\",\"openai/*computer-use*\"],\"copilot\":[\"agent\"],\"deep-research\":[\"copilot/deep-research*\",\"copilot/o3-deep-research*\",\"copilot/o4-mini-deep-research*\",\"google/deep-research*\",\"gemini/deep-research*\",\"openai/o3-deep-research*\",\"openai/o4-mini-deep-research*\"],\"detection\":[\"small\"],\"evals\":[\"small\"],\"fable\":[\"copilot/*fable*\",\"anthropic/*fable*\"],\"gemini\":[\"agent\"],\"gemini-3-flash\":[\"copilot/gemini-3*flash*\",\"google/gemini-3*flash*\",\"gemini/gemini-3*flash*\"],\"gemini-3-pro\":[\"copilot/gemini-3*pro*\",\"google/gemini-3*pro*\",\"google/nano-banana*\",\"gemini/gemini-3*pro*\"],\"gemini-3.1-flash\":[\"copilot/gemini-3.1*flash*\",\"google/gemini-3.1*flash*\",\"gemini/gemini-3.1*flash*\"],\"gemini-3.1-pro\":[\"copilot/gemini-3.1*pro*\",\"google/gemini-3.1*pro*\",\"gemini/gemini-3.1*pro*\"],\"gemini-3.5-flash\":[\"copilot/gemini-3.5*flash*\",\"google/gemini-3.5*flash*\",\"gemini/gemini-3.5*flash*\"],\"gemini-3.6-flash\":[\"copilot/gemini-3.6*flash*\",\"google/gemini-3.6*flash*\",\"gemini/gemini-3.6*flash*\"],\"gemini-flash\":[\"copilot/gemini-*flash*\",\"google/gemini-*flash*\",\"gemini/gemini-*flash*\"],\"gemini-flash-lite\":[\"copilot/gemini-*flash*lite*\",\"google/gemini-*flash*lite*\",\"gemini/gemini-*flash*lite*\"],\"gemini-omni\":[\"copilot/gemini-omni*\",\"google/gemini-omni*\",\"gemini/gemini-omni*\"],\"gemini-pro\":[\"copilot/gemini-*pro*\",\"google/gemini-*pro*\",\"gemini/gemini-*pro*\"],\"gemma\":[\"copilot/gemma*\",\"google/gemma*\",\"gemini/gemma*\"],\"gpt-5\":[\"copilot/gpt-5*\",\"openai/gpt-5*\"],\"gpt-5-codex\":[\"copilot/gpt-5*codex*\",\"openai/gpt-5*codex*\"],\"gpt-5-mini\":[\"copilot/gpt-5*mini*\",\"openai/gpt-5*mini*\"],\"gpt-5-nano\":[\"copilot/gpt-5*nano*\",\"openai/gpt-5*nano*\"],\"gpt-5-pro\":[\"copilot/gpt-5*pro*\",\"openai/gpt-5*pro*\"],\"gpt-5.1\":[\"copilot/gpt-5.1*\",\"openai/gpt-5.1*\"],\"gpt-5.2\":[\"copilot/gpt-5.2*\",\"openai/gpt-5.2*\"],\"gpt-5.3\":[\"copilot/gpt-5.3*\",\"openai/gpt-5.3*\"],\"gpt-5.4\":[\"copilot/gpt-5.4*\",\"openai/gpt-5.4*\"],\"gpt-5.5\":[\"copilot/gpt-5.5*\",\"openai/gpt-5.5*\"],\"gpt-5.6\":[\"copilot/gpt-5.6*\",\"openai/gpt-5.6*\"],\"grok\":[\"copilot/*grok*\",\"openai/*grok*\"],\"haiku\":[\"copilot/*haiku*\",\"anthropic/*haiku*\"],\"image-generation\":[\"copilot/gpt-image*\",\"openai/gpt-image*\",\"openai/chatgpt-image*\",\"copilot/gemini-*image*\",\"google/gemini-*image*\",\"gemini/gemini-*image*\",\"google/imagen*\"],\"kimi\":[\"copilot/kimi*\",\"openai/kimi*\"],\"kiwi\":[\"copilot/kiwi*\",\"openai/kiwi*\"],\"large\":[\"sonnet\",\"gpt-5-pro\",\"gpt-5\",\"gemini-pro\"],\"lyria\":[\"google/lyria*\",\"gemini/lyria*\",\"copilot/lyria*\"],\"mai-code\":[\"copilot/MAI-Code*\",\"copilot/mai-code*\",\"openai/MAI-Code*\"],\"mai-code-1-flash-picker\":[\"copilot/MAI-Code-1-Flash-picker*\",\"copilot/mai-code-1-flash-picker*\",\"openai/MAI-Code-1-Flash-picker*\"],\"mini\":[\"haiku\",\"gpt-5-mini\",\"gpt-5-nano\",\"gemini-flash-lite\"],\"nano-banana\":[\"copilot/nano-banana*\",\"google/nano-banana*\",\"gemini/nano-banana*\"],\"opus\":[\"copilot/*opus*\",\"anthropic/*opus*\"],\"opusplan\":[\"opus?effort=high\"],\"raptor-mini\":[\"copilot/raptor*\",\"openai/raptor*\"],\"reasoning\":[\"copilot/o1*\",\"copilot/o3*\",\"copilot/o4*\",\"openai/o1*\",\"openai/o3*\",\"openai/o4*\"],\"robotics\":[\"copilot/*robotics*\",\"google/*robotics*\",\"gemini/*robotics*\"],\"small\":[\"mini\"],\"small-agent\":[\"haiku\",\"gpt-5-mini\",\"gemini-flash\"],\"sonnet\":[\"copilot/*sonnet*\",\"anthropic/*sonnet*\"],\"sonnet-6x\":[\"copilot/*sonnet-4.5*\",\"copilot/*sonnet-4.6*\",\"copilot/*sonnet-5*\",\"copilot/*sonnet-4-5-*\",\"anthropic/*sonnet-4-5-*\",\"copilot/*sonnet-4-6*\",\"anthropic/*sonnet-4-6*\",\"anthropic/*sonnet-5*\"],\"summarization\":[\"haiku\",\"gpt-5-mini\",\"gemini-flash-lite\",\"mini\"],\"veo\":[\"google/veo*\",\"gemini/veo*\"],\"vision\":[\"copilot/gemini-*image*\",\"google/gemini-*image*\",\"gemini/gemini-*image*\",\"copilot/gemini-*flash*\",\"google/gemini-*flash*\",\"gemini/gemini-*flash*\"]}},\"container\":{\"imageTag\":\"0.27.43,squid=sha256:26be5e0b8c8f4c41c8a59126b29bb5d80b07253597472ded2a16bdd75abcbf9d,agent=sha256:04e2d1987a565000a8f114b89d806ae7a3864dd4f944be65275b28c93d8690e6,api-proxy=sha256:d85f57975af5ea23af4996e41ed73fbc8f5b4a47402472bfe82e508f352cb0c1,cli-proxy=sha256:65c45ea2967984d0024f3df61bc71335658a77ede96c8d9665da7a5f33a795ab\"},\"logging\":{\"proxyLogsDir\":\"/tmp/gh-aw/sandbox/firewall/logs\",\"auditDir\":\"/tmp/gh-aw/sandbox/firewall/audit\"}}" > "${RUNNER_TEMP}/gh-aw/awf-config.json" cp "${RUNNER_TEMP}/gh-aw/awf-config.json" /tmp/gh-aw/awf-config.json export GH_AW_MODELS_JSON_PATH="/tmp/gh-aw/models.json" GH_AW_DOCKER_HOST="" @@ -923,7 +853,7 @@ jobs: GH_AW_PHASE: agent GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt GH_AW_SAFE_OUTPUTS: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS }} - GH_AW_TIMEOUT_MINUTES: 15 + GH_AW_TIMEOUT_MINUTES: 20 GH_AW_VERSION: v0.84.3 GITHUB_API_URL: ${{ github.api_url }} GITHUB_AW: true @@ -995,11 +925,10 @@ jobs: uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 env: GH_AW_SAFE_OUTPUTS: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS }} - GH_AW_ALLOWED_DOMAINS: "*.githubusercontent.com,api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,codeload.github.com,docs.github.com,github-cloud.githubusercontent.com,github-cloud.s3.amazonaws.com,github.blog,github.com,github.githubassets.com,host.docker.internal,lfs.github.com,objects.githubusercontent.com,patch-diff.githubusercontent.com,patchdiff.githubusercontent.com,raw.githubusercontent.com,registry.npmjs.org,telemetry.enterprise.githubcopilot.com" + GH_AW_ALLOWED_DOMAINS: "*.githubusercontent.com,ai.google.dev,api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,cloud.google.com,codeload.github.com,docs.anthropic.com,docs.aws.amazon.com,docs.github.com,github-cloud.githubusercontent.com,github-cloud.s3.amazonaws.com,github.blog,github.com,github.githubassets.com,host.docker.internal,learn.microsoft.com,lfs.github.com,objects.githubusercontent.com,patch-diff.githubusercontent.com,patchdiff.githubusercontent.com,platform.claude.com,platform.openai.com,raw.githubusercontent.com,registry.npmjs.org,telemetry.enterprise.githubcopilot.com" GH_AW_ALLOWED_GITHUB_REFS: "" GITHUB_SERVER_URL: ${{ github.server_url }} GITHUB_API_URL: ${{ github.api_url }} - GH_AW_COMMANDS: "[\"auth-doctor\"]" with: script: | const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs'); @@ -1101,9 +1030,8 @@ jobs: runs-on: ubuntu-slim permissions: issues: write - pull-requests: write concurrency: - group: "gh-aw-conclusion-auth-doctor" + group: "gh-aw-conclusion-auth-doctor-updater" cancel-in-progress: false queue: max env: @@ -1123,8 +1051,8 @@ jobs: trace-id: ${{ needs.activation.outputs.setup-trace-id }} parent-span-id: ${{ needs.activation.outputs.setup-parent-span-id || needs.activation.outputs.setup-span-id }} env: - GH_AW_SETUP_WORKFLOW_NAME: "Auth Doctor" - GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/auth-doctor.lock.yml@${{ github.ref }} + GH_AW_SETUP_WORKFLOW_NAME: "Auth Doctor Updater" + GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/auth-doctor-updater.lock.yml@${{ github.ref }} GH_AW_INFO_VERSION: "1.0.77" GH_AW_INFO_AWF_VERSION: "v0.27.43" GH_AW_INFO_ENGINE_ID: "copilot" @@ -1178,8 +1106,8 @@ jobs: continue-on-error: true uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: - key: agentic-workflow-usage-authdoctor-${{ github.run_id }} - restore-keys: agentic-workflow-usage-authdoctor- + key: agentic-workflow-usage-authdoctorupdater-${{ github.run_id }} + restore-keys: agentic-workflow-usage-authdoctorupdater- path: /tmp/gh-aw/agentic-workflow-usage-cache.jsonl - name: Write daily AIC usage cache entry id: write-daily-aic-cache @@ -1199,7 +1127,7 @@ jobs: continue-on-error: true uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: - key: agentic-workflow-usage-authdoctor-${{ github.run_id }} + key: agentic-workflow-usage-authdoctorupdater-${{ github.run_id }} path: /tmp/gh-aw/agentic-workflow-usage-cache.jsonl - name: Upload daily AIC usage cache artifact id: upload-daily-aic-cache @@ -1217,14 +1145,14 @@ jobs: env: GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }} GH_AW_NOOP_MAX: "1" - GH_AW_WORKFLOW_NAME: "Auth Doctor" - GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/${{ github.repository }}/blob/${{ github.ref_name }}/.github/workflows/auth-doctor.md" + GH_AW_WORKFLOW_NAME: "Auth Doctor Updater" + GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/${{ github.repository }}/blob/${{ github.ref_name }}/.github/workflows/auth-doctor-updater.md" GH_AW_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }} GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }} GH_AW_NOOP_REPORT_AS_ISSUE: "true" GH_AW_AIC: ${{ needs.agent.outputs.aic }} GH_AW_AMBIENT_CONTEXT: ${{ needs.agent.outputs.ambient_context }} - GH_AW_WORKFLOW_ID: "auth-doctor" + GH_AW_WORKFLOW_ID: "auth-doctor-updater" with: github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} script: | @@ -1238,8 +1166,8 @@ jobs: env: GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }} GH_AW_MISSING_TOOL_CREATE_ISSUE: "true" - GH_AW_WORKFLOW_NAME: "Auth Doctor" - GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/${{ github.repository }}/blob/${{ github.ref_name }}/.github/workflows/auth-doctor.md" + GH_AW_WORKFLOW_NAME: "Auth Doctor Updater" + GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/${{ github.repository }}/blob/${{ github.ref_name }}/.github/workflows/auth-doctor-updater.md" with: github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} script: | @@ -1253,8 +1181,8 @@ jobs: env: GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }} GH_AW_REPORT_INCOMPLETE_CREATE_ISSUE: "true" - GH_AW_WORKFLOW_NAME: "Auth Doctor" - GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/${{ github.repository }}/blob/${{ github.ref_name }}/.github/workflows/auth-doctor.md" + GH_AW_WORKFLOW_NAME: "Auth Doctor Updater" + GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/${{ github.repository }}/blob/${{ github.ref_name }}/.github/workflows/auth-doctor-updater.md" with: github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} script: | @@ -1268,11 +1196,11 @@ jobs: uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 env: GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }} - GH_AW_WORKFLOW_NAME: "Auth Doctor" - GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/${{ github.repository }}/blob/${{ github.ref_name }}/.github/workflows/auth-doctor.md" + GH_AW_WORKFLOW_NAME: "Auth Doctor Updater" + GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/${{ github.repository }}/blob/${{ github.ref_name }}/.github/workflows/auth-doctor-updater.md" GH_AW_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }} GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }} - GH_AW_WORKFLOW_ID: "auth-doctor" + GH_AW_WORKFLOW_ID: "auth-doctor-updater" GH_AW_ACTION_FAILURE_ISSUE_EXPIRES_HOURS: "168" GH_AW_ENGINE_ID: "copilot" GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }} @@ -1300,7 +1228,7 @@ jobs: GH_AW_FAILURE_REPORT_AS_ISSUE: "true" GH_AW_MISSING_TOOL_REPORT_AS_FAILURE: "true" GH_AW_MISSING_DATA_REPORT_AS_FAILURE: "true" - GH_AW_TIMEOUT_MINUTES: "15" + GH_AW_TIMEOUT_MINUTES: "20" GH_AW_CACHE_MEMORY_ENABLED: "true" GH_AW_CACHE_MEMORY_RESTORE_0_MATCHED_KEY: ${{ needs.agent.outputs.cache_memory_restore_0_matched_key || '' }} GH_AW_CACHE_MEMORY_RESTORE_0_CACHE_HIT: ${{ needs.agent.outputs.cache_memory_restore_0_cache_hit || 'false' }} @@ -1311,33 +1239,14 @@ jobs: setupGlobals(core, github, context, exec, io, getOctokit); const { main } = require('${{ runner.temp }}/gh-aw/actions/handle_agent_failure.cjs'); await main(); - - name: Update reaction comment with completion status - id: conclusion - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 - env: - GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }} - GH_AW_COMMENT_ID: ${{ needs.activation.outputs.comment_id }} - GH_AW_COMMENT_REPO: ${{ needs.activation.outputs.comment_repo }} - GH_AW_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }} - GH_AW_WORKFLOW_NAME: "Auth Doctor" - GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }} - GH_AW_SAFE_OUTPUTS_RESULT: ${{ needs.safe_outputs.result }} - with: - github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} - script: | - const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs'); - setupGlobals(core, github, context, exec, io, getOctokit); - const { main } = require('${{ runner.temp }}/gh-aw/actions/notify_comment_error.cjs'); - await main(); pre_activation: - if: "(github.event_name == 'issue_comment') && (github.event_name == 'issue_comment' && (startsWith(github.event.comment.body, '/auth-doctor ') || startsWith(github.event.comment.body, '/auth-doctor\n') || github.event.comment.body == '/auth-doctor') && github.event.issue.pull_request == null) || !(github.event_name == 'issue_comment')" runs-on: ubuntu-slim env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} outputs: - activated: ${{ steps.check_command_position.outputs.command_position_ok == 'true' }} - matched_command: ${{ steps.check_command_position.outputs.matched_command }} + activated: ${{ steps.check_membership.outputs.is_team_member == 'true' && steps.check_skip_if_match.outputs.skip_check_ok == 'true' }} + matched_command: '' setup-parent-span-id: ${{ steps.setup.outputs.parent-span-id || steps.setup.outputs.span-id }} setup-span-id: ${{ steps.setup.outputs.span-id }} setup-trace-id: ${{ steps.setup.outputs.trace-id }} @@ -1349,21 +1258,35 @@ jobs: destination: ${{ runner.temp }}/gh-aw/actions job-name: ${{ github.job }} env: - GH_AW_SETUP_WORKFLOW_NAME: "Auth Doctor" - GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/auth-doctor.lock.yml@${{ github.ref }} + GH_AW_SETUP_WORKFLOW_NAME: "Auth Doctor Updater" + GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/auth-doctor-updater.lock.yml@${{ github.ref }} GH_AW_INFO_VERSION: "1.0.77" GH_AW_INFO_AWF_VERSION: "v0.27.43" GH_AW_INFO_ENGINE_ID: "copilot" - - name: Check command position - id: check_command_position + - name: Check team membership for workflow + id: check_membership + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + env: + GH_AW_REQUIRED_ROLES: "admin,maintainer,write" + with: + github-token: ${{ secrets.GITHUB_TOKEN }} + script: | + const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs'); + setupGlobals(core, github, context, exec, io, getOctokit); + const { main } = require('${{ runner.temp }}/gh-aw/actions/check_membership.cjs'); + await main(); + - name: Check skip-if-match query + id: check_skip_if_match uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 env: - GH_AW_COMMANDS: "[\"auth-doctor\"]" + GH_AW_SKIP_QUERY: "is:issue is:open label:documentation in:title \"Auth Doctor Update\"" + GH_AW_WORKFLOW_NAME: "Auth Doctor Updater" + GH_AW_SKIP_MAX_MATCHES: "1" with: script: | const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs'); setupGlobals(core, github, context, exec, io, getOctokit); - const { main } = require('${{ runner.temp }}/gh-aw/actions/check_command_position.cjs'); + const { main } = require('${{ runner.temp }}/gh-aw/actions/check_skip_if_match.cjs'); await main(); safe_outputs: @@ -1374,26 +1297,22 @@ jobs: runs-on: ubuntu-slim permissions: issues: write - pull-requests: write timeout-minutes: 45 env: GH_AW_AGENT_AIC: ${{ needs.agent.outputs.aic }} GH_AW_AIC: ${{ needs.agent.outputs.aic }} GH_AW_AMBIENT_CONTEXT: ${{ needs.agent.outputs.ambient_context }} - GH_AW_CALLER_WORKFLOW_ID: "${{ github.repository }}/auth-doctor" - GH_AW_COMMANDS: "[\"auth-doctor\"]" + GH_AW_CALLER_WORKFLOW_ID: "${{ github.repository }}/auth-doctor-updater" GH_AW_EFFECTIVE_TOKENS: ${{ needs.agent.outputs.effective_tokens }} GH_AW_ENGINE_ID: "copilot" GH_AW_ENGINE_MODEL: ${{ needs.agent.outputs.model }} GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} - GH_AW_WORKFLOW_ID: "auth-doctor" - GH_AW_WORKFLOW_NAME: "Auth Doctor" - GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/${{ github.repository }}/blob/${{ github.ref_name }}/.github/workflows/auth-doctor.md" + GH_AW_WORKFLOW_ID: "auth-doctor-updater" + GH_AW_WORKFLOW_NAME: "Auth Doctor Updater" + GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/${{ github.repository }}/blob/${{ github.ref_name }}/.github/workflows/auth-doctor-updater.md" outputs: code_push_failure_count: ${{ steps.process_safe_outputs.outputs.code_push_failure_count }} code_push_failure_errors: ${{ steps.process_safe_outputs.outputs.code_push_failure_errors }} - comment_id: ${{ steps.process_safe_outputs.outputs.comment_id }} - comment_url: ${{ steps.process_safe_outputs.outputs.comment_url }} create_discussion_error_count: ${{ steps.process_safe_outputs.outputs.create_discussion_error_count }} create_discussion_errors: ${{ steps.process_safe_outputs.outputs.create_discussion_errors }} created_issue_number: ${{ steps.process_safe_outputs.outputs.created_issue_number }} @@ -1410,8 +1329,8 @@ jobs: trace-id: ${{ needs.activation.outputs.setup-trace-id }} parent-span-id: ${{ needs.activation.outputs.setup-parent-span-id || needs.activation.outputs.setup-span-id }} env: - GH_AW_SETUP_WORKFLOW_NAME: "Auth Doctor" - GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/auth-doctor.lock.yml@${{ github.ref }} + GH_AW_SETUP_WORKFLOW_NAME: "Auth Doctor Updater" + GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/auth-doctor-updater.lock.yml@${{ github.ref }} GH_AW_INFO_VERSION: "1.0.77" GH_AW_INFO_AWF_VERSION: "v0.27.43" GH_AW_INFO_ENGINE_ID: "copilot" @@ -1444,10 +1363,10 @@ jobs: env: GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }} GH_AW_COMMENT_ID: ${{ needs.activation.outputs.comment_id }} - GH_AW_ALLOWED_DOMAINS: "*.githubusercontent.com,api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,codeload.github.com,docs.github.com,github-cloud.githubusercontent.com,github-cloud.s3.amazonaws.com,github.blog,github.com,github.githubassets.com,host.docker.internal,lfs.github.com,objects.githubusercontent.com,patch-diff.githubusercontent.com,patchdiff.githubusercontent.com,raw.githubusercontent.com,registry.npmjs.org,telemetry.enterprise.githubcopilot.com" + GH_AW_ALLOWED_DOMAINS: "*.githubusercontent.com,ai.google.dev,api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,cloud.google.com,codeload.github.com,docs.anthropic.com,docs.aws.amazon.com,docs.github.com,github-cloud.githubusercontent.com,github-cloud.s3.amazonaws.com,github.blog,github.com,github.githubassets.com,host.docker.internal,learn.microsoft.com,lfs.github.com,objects.githubusercontent.com,patch-diff.githubusercontent.com,patchdiff.githubusercontent.com,platform.claude.com,platform.openai.com,raw.githubusercontent.com,registry.npmjs.org,telemetry.enterprise.githubcopilot.com" GITHUB_SERVER_URL: ${{ github.server_url }} GITHUB_API_URL: ${{ github.api_url }} - GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"add_comment\":{\"max\":1},\"create_issue\":{\"max\":1,\"title_prefix\":\"🩺 Auth Doctor\"},\"create_report_incomplete_issue\":{},\"mentions\":{\"enabled\":false},\"missing_data\":{},\"missing_tool\":{},\"noop\":{\"max\":1,\"report-as-issue\":\"true\"},\"report_incomplete\":{}}" + GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"create_issue\":{\"expires\":720,\"labels\":[\"documentation\",\"automated\"],\"max\":1,\"title_prefix\":\"🩺 Auth Doctor Update\"},\"create_report_incomplete_issue\":{},\"mentions\":{\"enabled\":false},\"missing_data\":{},\"missing_tool\":{},\"noop\":{\"max\":1,\"report-as-issue\":\"true\"},\"report_incomplete\":{}}" with: github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} script: | diff --git a/.github/workflows/auth-doctor-updater.md b/.github/workflows/auth-doctor-updater.md new file mode 100644 index 000000000..41642ba8b --- /dev/null +++ b/.github/workflows/auth-doctor-updater.md @@ -0,0 +1,194 @@ +--- +name: Auth Doctor Updater +description: Daily workflow that reviews provider authentication guidance, repository changes, and related issues and proposes documentation updates for AWF authentication and API-proxy behavior. +on: + schedule: daily + workflow_dispatch: + skip-if-match: + query: 'is:issue is:open label:documentation in:title "Auth Doctor Update"' + max: 1 +permissions: + copilot-requests: write + contents: read + issues: read + pull-requests: read +tools: + github: + toolsets: [default] + web-fetch: + bash: true + cache-memory: true +sandbox: + agent: + id: awf +network: + allowed: + - github + - platform.openai.com + - learn.microsoft.com + - docs.aws.amazon.com + - cloud.google.com + - docs.anthropic.com + - platform.claude.com + - ai.google.dev + - docs.github.com +safe-outputs: + threat-detection: + enabled: false + mentions: false + allowed-github-references: [] + create-issue: + title-prefix: "🩺 Auth Doctor Update" + labels: [documentation, automated] + max: 1 + expires: 30d +timeout-minutes: 20 +steps: + - name: Compute scan window + run: | + # Look back two days so a missed daily run does not create a coverage gap. + # Overlap is de-duplicated against existing documentation and proposals. + SINCE=$(date -u -d '2 days ago' +%Y-%m-%d) + mkdir -p /tmp/gh-aw/agent + echo "$SINCE" > /tmp/gh-aw/agent/scan-since.txt + echo "Scanning for authentication guidance updated since $SINCE" +--- + +# Auth Doctor Updater + +You maintain this repository's documentation for AWF authentication, API-proxy routing, and related gh-aw HTTP MCP GitHub OIDC behavior. Each day, reconcile current repository implementation and recent changes with official provider guidance, then propose precise documentation corrections. + +You do **not** edit files yourself. Your only output is one proposed-changes issue or a `noop`. + +## Scan Window + +- **Repository:** ${{ github.repository }} +- **Since (UTC date):** read from `/tmp/gh-aw/agent/scan-since.txt` + +Consider relevant issues, pull requests, releases, and documentation updates on or after the scan window. The window overlaps the previous daily run; de-duplicate anything already documented or proposed. + +## Step 1 — Read the Current Documentation and Implementation + +Read these documentation files in full: + +```bash +cat README.md +cat docs/auth-matrix.md +cat docs/authentication-architecture.md +cat docs/api-proxy-sidecar.md +cat docs/environment.md +cat docs/awf-config-spec.md +cat docs/github_actions.md +``` + +Verify concrete claims against current code, especially: + +```bash +cat src/services/api-proxy-env-config.ts +cat src/services/api-proxy-credential-env.ts +cat src/services/agent-environment/excluded-vars.ts +cat src/services/agent-environment/env-passthrough.ts +cat containers/api-proxy/management.js +cat containers/api-proxy/startup.js +cat containers/agent/api-proxy-health-check.sh +``` + +Use `rg` to locate provider adapters, OIDC token providers, schema fields, tests, and any additional documentation that makes the same claim. Treat implementation and tests on the default branch as the source of truth for shipped AWF behavior. + +## Step 2 — Research Recent Repository Lessons + +Read the scan date, then search this repository for issues and pull requests updated since that date. Search several combinations of: + +`authentication`, `api-proxy`, `OIDC`, `WIF`, `OpenAI`, `Anthropic`, `Copilot`, `BYOK`, `Gemini`, `Vertex`, `Azure`, `Entra`, `AWS`, `Bedrock`, `GCP`, `workload identity`, `ACTIONS_ID_TOKEN`, `mcpg`, `github-oidc`, `authorization header`, `credential isolation`, `health`, `reflect`. + +Include open and closed issues plus merged pull requests. Read bodies and key comments to establish whether behavior is shipped on `main`, pending on another branch, or still unresolved. In particular, do not assume github/gh-aw-firewall#6894 or github/gh-aw#50053 is on the current default branch without verifying it. + +## Step 3 — Check Official Provider Guidance + +Use `web-fetch` only for the allowlisted official documentation sites: + +- OpenAI API authentication and endpoints: `https://platform.openai.com/docs/` +- Azure OpenAI and Entra workload identity: `https://learn.microsoft.com/azure/ai-services/openai/` and `https://learn.microsoft.com/entra/workload-id/` +- AWS IAM OIDC federation and Bedrock runtime authentication: `https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_oidc.html` and `https://docs.aws.amazon.com/bedrock/` +- GCP workload identity federation and Vertex AI authentication: `https://cloud.google.com/iam/docs/workload-identity-federation` and `https://cloud.google.com/vertex-ai/docs/authentication` +- Anthropic API authentication and WIF: `https://docs.anthropic.com/` and `https://platform.claude.com/docs/` +- Gemini API-key authentication: `https://ai.google.dev/gemini-api/docs/api-key` +- GitHub Actions OIDC: `https://docs.github.com/actions/concepts/security/openid-connect` + +Look for factual changes only: required permissions, supported auth modes, provider field names, audiences/scopes, endpoint or header behavior, route requirements, credential precedence, and deprecations. Ignore marketing or prose-only differences. + +Never submit credentials, repository data, workflow logs, or configuration values to provider documentation sites. These checks are public documentation reads only. + +## Step 4 — Audit the Supported Auth Matrix + +Confirm the documentation consistently covers: + +- static OpenAI and Anthropic keys; +- GitHub Copilot/GitHub auth and Copilot BYOK; +- static Gemini and Vertex API-key routes; +- Azure, AWS Bedrock, GCP Vertex, and Anthropic WIF through API-proxy OIDC; +- API-proxy enablement, provider route/listener availability, `/health`, and `/reflect`; +- required `id-token: write` and provider-specific non-secret configuration; +- unsupported or conflicting combinations, including Gemini API-key mode versus GCP WIF/Vertex; +- GitHub.com, GHEC, and GHES Copilot routing where supported. + +Keep the API proxy and MCP gateway as separate trust paths: + +- AWF owns the API-proxy sidecar and provider credential injection. +- gh-aw launches/configures mcpg in a runner-owned workflow step for HTTP MCP `auth.type: github-oidc`. +- AWF does not launch or configure mcpg. +- Actions OIDC request tokens, minted JWTs, exchanged cloud credentials, API keys, and authorization headers must never be exposed to the agent or reproduced in documentation examples. + +## Step 5 — Classify Each Finding + +For every candidate, choose one: + +- **Already accurate** — implementation and official guidance match the docs; skip. +- **Shipped behavior missing from docs** — propose the narrowest addition and cite the merged source. +- **Stale or incorrect claim** — provide replacement wording and evidence. +- **Pending behavior presented as shipped** — add a current-main caveat and link the pending work. +- **Cross-document inconsistency** — identify every file that must change together. +- **Unverified provider change** — do not propose an update; state what evidence is missing. + +Do not infer support from an unmerged pull request, a feature request, or provider documentation alone. AWF support requires current default-branch implementation and tests. + +## Step 6 — Avoid Duplicate Proposals + +Search open issues with the `documentation` label and `Auth Doctor Update` in the title. If an existing proposal covers the same findings, call `noop` instead of opening another issue. + +## Output + +If concrete, not-yet-captured corrections exist, call `create-issue` once with: + +### Summary + +- scan window +- sources reviewed +- number of required documentation corrections + +### Current-Main Findings + +For each finding: affected auth path, shipped/pending status, implementation evidence, and official documentation evidence. + +### Proposed Documentation Changes + +Group exact replacement or insertion text by file. Include only files that genuinely need changes, and keep terminology consistent across all affected documents. + +### Validation Plan + +List the targeted source/tests to re-check, Markdown lint, docs build, and any schema or workflow compilation needed for the proposed edits. + +### Sources + +Link every repository issue/pull request and official provider page used. Use full URLs and do not include credential-bearing URLs or copied headers. + +If no concrete corrections exist, call `noop` with the scan window and a one-line explanation. Never open an empty, speculative, or prose-only issue. + +## Guardrails + +- Propose documentation edits only; never modify code, create a branch, or open a pull request. +- Never print, inspect, request, decode, hash, or reproduce secret values, Actions OIDC request tokens, minted JWTs, exchanged cloud credentials, API keys, cookies, or authorization headers. +- Never run credential probes, token exchanges, inference requests, broad environment dumps, `docker inspect`, or `docker compose config`. +- Treat identifiers such as tenant IDs, client IDs, role ARNs, service-account emails, and federation resource names as configuration metadata, but redact user-specific values in proposals. +- Prefer the smallest evidence-backed correction and preserve valid existing guidance. +- Fail closed: if a claim cannot be verified safely, classify it as unverified rather than guessing. diff --git a/.github/workflows/auth-doctor.md b/.github/workflows/auth-doctor.md deleted file mode 100644 index 91f37c6c4..000000000 --- a/.github/workflows/auth-doctor.md +++ /dev/null @@ -1,196 +0,0 @@ ---- -name: Auth Doctor -description: Diagnoses AWF authentication, API-proxy, and HTTP MCP GitHub OIDC configuration from issue reports and workflow evidence without exposing credentials. -on: - roles: all - slash_command: - name: auth-doctor - events: [issue_comment] -permissions: - actions: read - copilot-requests: write - contents: read - issues: read - pull-requests: read -tools: - github: - toolsets: [default] - cache-memory: true -sandbox: - agent: - id: awf -network: - allowed: - - github -safe-outputs: - threat-detection: - enabled: false - mentions: false - allowed-github-references: [] - create-issue: - title-prefix: "🩺 Auth Doctor" - max: 1 - add-comment: - max: 1 -timeout-minutes: 15 ---- - -# Auth Doctor - -You diagnose AWF authentication, API-proxy routing, and HTTP MCP GitHub OIDC failures from repository configuration, workflow metadata, sanitized logs, and non-secret health information. - -## Trigger Context - -- **Repository:** ${{ github.repository }} -- **Issue:** #${{ github.event.issue.number }} -- **Request:** `${{ steps.sanitized.outputs.text }}` - -## Safety Contract - -Treat every credential value as prohibited output. - -- Never print, quote, summarize, decode, hash, compare, or return any API key, token, JWT, cloud credential, cookie, client secret, authorization header, or `ACTIONS_ID_TOKEN_REQUEST_TOKEN`. -- Never request or display an Actions OIDC JWT, exchanged Azure/GCP/Anthropic access token, AWS access key, secret access key, session token, Copilot token, or provider API key. -- Report only whether a variable or field is **configured**, **missing**, **inconsistent**, or **not safely observable**. Use `` or `` when a name must be shown. -- Never run `printenv`, `env`, `set`, `docker inspect`, `docker compose config`, or broad process/environment dumps. Never `cat` an env file, generated Compose file, or raw log. -- Do not probe provider token endpoints or make inference requests. Do not mint or exchange credentials. -- If evidence cannot be obtained without exposing a credential, label the check `not safely observable` and fail closed. - -## Diagnostic Playbook - -### 1. Establish the failing path - -Identify the engine/provider, auth mode, AWF version, gh-aw compiler version, runner type, API target hostname, and whether the failure is in: - -1. runner configuration, -2. AWF API-proxy startup or routing, -3. provider authentication, -4. GitHub/Copilot authentication, or -5. the separately launched MCP gateway. - -Do not infer the target run's configuration from this Doctor run's own environment. - -### 2. Prefer metadata and presence-only inspection - -Use GitHub read tools to inspect workflow source, compiled lock files, run/job conclusions, and annotations. Read linked logs only when metadata cannot distinguish the candidates. - -When a log is required, download it to a temporary file without echoing it, redact credential-shaped values and sensitive headers into a second file, and inspect only the redacted copy. At minimum redact: - -- `Authorization`, `Proxy-Authorization`, `x-api-key`, `x-goog-api-key`, cookies, and signed AWS headers; -- `ACTIONS_ID_TOKEN_REQUEST_TOKEN` and any value associated with `ACTIONS_ID_TOKEN_REQUEST_URL`; -- JWT-like strings, GitHub tokens, OpenAI/Anthropic/Gemini keys, and AWS temporary credential fields. - -Delete both files after the check. If safe redaction is uncertain, do not read the log. - -For configuration files, parse only key names and non-secret routing metadata. Never render values from `secrets.*`, env files, Docker Compose environments, or credential fields. - -### 3. Check API-proxy configuration and routes - -Confirm `--enable-api-proxy` or equivalent AWF config is active, then classify each requested route: - -| Path | Sidecar route | Required configuration evidence | Common inconsistency | -|---|---:|---|---| -| OpenAI | `10000` | static `OPENAI_API_KEY`, or a compatible OIDC provider plus target | key/auth mode present but OpenAI target absent from allowlist | -| Anthropic | `10001` | static `ANTHROPIC_API_KEY`, or Anthropic WIF fields | static key and WIF mixed; required federation IDs missing | -| GitHub Copilot / Copilot BYOK | `10002` | `COPILOT_GITHUB_TOKEN`, or `COPILOT_PROVIDER_API_KEY` with provider routing | BYOK key without base URL; incompatible GitHub instance target | -| Gemini | `10003` | static `GEMINI_API_KEY` | treating Gemini API-key mode as GCP OIDC | -| Vertex AI | `10004` | static `GOOGLE_API_KEY`, or GCP OIDC with Vertex target | GCP WIF selected but Vertex target/allowlist missing | - -For GitHub Copilot, distinguish github.com, GHEC (`*.ghe.com`), and GHES routing. Flag a classic PAT combined with `COPILOT_MODEL` as a possible `/models` startup incompatibility without examining the token prefix or value; rely only on an explicit report that the credential is a classic PAT. - -When execution access is genuinely attached to the failing environment, safe sidecar checks are: - -- TCP reachability to the configured internal route; -- `GET http://:10000/health`, retaining only `status`, provider booleans, `key_validation.complete`, and `models_fetch_complete`; -- `GET http://:10000/reflect`, retaining only endpoint `provider`, `port`, and `configured`. - -Do not include `key_validation.results`, models, headers, request bodies, logs, or upstream responses in the report. A listener being reachable proves route availability, not credential validity. - -### 4. Check static-auth prerequisites - -For the selected provider, verify presence-only evidence for the required runner-level variable, that `sudo --preserve-env=` or equivalent preserves it for the AWF process, and that the upstream hostname is explicitly allowed. - -Flag these unsupported or inconsistent combinations: - -- Gemini API-key routing with `AWF_AUTH_TYPE=github-oidc`; GCP WIF uses the Vertex route instead. -- OIDC provider settings without API-proxy enablement. -- A custom provider target missing from `network.allowed` or AWF's domain allowlist. -- Static and OIDC credentials configured for the same path where precedence is ambiguous. -- Copilot BYOK credentials without a compatible provider base URL/target. - -### 5. Check GitHub Actions OIDC prerequisites - -OIDC via the AWF API proxy requires: - -- job permission `id-token: write`; -- `AWF_AUTH_TYPE=github-oidc`; -- a supported `AWF_AUTH_PROVIDER`; -- provider-specific non-secret configuration; and -- the Actions request URL/token to be available to the API-proxy sidecar. - -Check required configuration by name only: - -| Provider | Required names | Expected route | -|---|---|---| -| Azure | `AWF_AUTH_AZURE_TENANT_ID`, `AWF_AUTH_AZURE_CLIENT_ID` | Azure OpenAI through the OpenAI adapter | -| AWS | `AWF_AUTH_AWS_ROLE_ARN`, `AWF_AUTH_AWS_REGION` | Bedrock with sidecar SigV4 signing | -| GCP | `AWF_AUTH_GCP_WORKLOAD_IDENTITY_PROVIDER`; service account optional | Vertex AI; optional service-account impersonation | -| Anthropic | federation rule, organization, and service-account IDs; workspace conditional | Anthropic WIF | - -Never inspect the Actions request token or a minted/exchanged credential. - -Current `main` compatibility caveat: AWF forwards the Actions OIDC variables to the sidecar when API-proxy OIDC is active, but current-main agent environment passthrough can also expose them to the agent. Do not inspect them. github/gh-aw-firewall#6894 is the related isolation change and github/gh-aw#50053 tracks gh-aw compiler/runtime and existing-lock compatibility; do not describe either as shipped on `main` until verified there. - -### 6. Keep MCP gateway OIDC separate - -HTTP MCP `auth.type: github-oidc` is a runner-to-gateway trust path, not an AWF API-proxy route: - -- gh-aw launches/configures the MCP gateway in a runner-owned workflow step. -- AWF does not launch or configure mcpg. -- the gateway configuration should contain only auth type/audience metadata, never Actions credential values; -- the generated job should grant `id-token: write`; -- the runner should pass the Actions OIDC variables directly to the gateway launch; -- the gateway mints the audience-bound JWT and adds the authorization header to the remote MCP request. - -Do not recommend exposing the Actions OIDC variables to the AWF agent to repair MCP auth. For precompiled lock workflows, label compatibility `unverified` unless the lock's runner-to-gateway behavior is established; cite github/gh-aw#50053 as the open rollout tracker. - -### 7. Recommend the smallest safe fix - -Prefer one concrete change: add a missing permission, export/preserve a named variable, complete a provider config field, correct a target/route, add one required hostname, enable the API proxy, recompile an affected gh-aw lock file, or separate conflicting auth modes. - -Do not suggest printing credentials, disabling masking, broadening network access, using `--env-all`, or passing OIDC request variables into the agent. - -## Output Requirements - -Use GitHub-flavored Markdown with this structure: - -### Summary - -- failing trust path -- provider/auth mode -- overall status: `configured`, `incomplete`, `inconsistent`, `route unavailable`, or `not safely observable` -- confidence - -### Findings - -For each check, report only: check name, status, non-secret evidence, and impact. Keep critical findings visible and put secondary detail in `
` blocks. - -### Recommended Fix - -Give the smallest actionable configuration change and state whether it applies to current `main` or depends on pending compatibility work. - -### Safe Next Probe - -Include only when needed. The probe must return metadata, booleans, status codes, or redacted output. - -### References - -Include up to three directly relevant links. Use full URLs for github/gh-aw#50053 and github/gh-aw-firewall#6894 so safe-output reference escaping does not create unintended backlinks. - -Use GitHub alert syntax for warnings and cautions. Never use credential values or emoji as severity markers. - -## Safe Output Policy - -- Use `add-comment` when the current issue has enough context for a useful diagnosis. -- Use `create-issue` only when a separate follow-up item is genuinely required. The title prefix is already configured. -- Use `noop` when the request has no AWF authentication/API-proxy/MCP OIDC signal or no visible action is needed. diff --git a/README.md b/README.md index cd2fc37fc..64f88cb7f 100644 --- a/README.md +++ b/README.md @@ -90,7 +90,7 @@ See [GitHub Actions](docs/github_actions.md) for advanced setup and `awf logs su - [Compatibility](docs/compatibility.md) — supported Node.js, OS, and Docker versions - [Troubleshooting](docs/troubleshooting.md) — common issues and fixes - [Diagnosing AWF failures](docs/diagnosing-awf-failures.md) — use the Self-Hosted Runner Doctor agent to triage self-hosted/ARC/GHES/GHEC failures -- [Auth Doctor workflow](.github/workflows/auth-doctor.md) — comment `/auth-doctor` on an issue to diagnose authentication and API-proxy configuration without exposing credentials +- [Auth Doctor Updater workflow](.github/workflows/auth-doctor-updater.md) — daily/manual audit that proposes evidence-backed authentication and API-proxy documentation corrections - [Image verification](docs/image-verification.md) — cosign signature verification ## Development diff --git a/docs/api-proxy-sidecar.md b/docs/api-proxy-sidecar.md index 08e104ab0..b173b8db2 100644 --- a/docs/api-proxy-sidecar.md +++ b/docs/api-proxy-sidecar.md @@ -600,7 +600,7 @@ and are normalized to dollars per million tokens inside the proxy. ## Troubleshooting -For a report that checks permissions, provider-field presence, route availability, and allowlists without returning credentials, comment `/auth-doctor` on an issue. The [Auth Doctor workflow](../.github/workflows/auth-doctor.md) treats a reachable listener as route evidence only and never probes a token endpoint or inference API. +The [Auth Doctor Updater workflow](../.github/workflows/auth-doctor-updater.md) periodically audits this guide against current implementation, recent repository changes, and official provider guidance. It proposes documentation updates without probing credentials, exchanging tokens, or calling inference APIs. ### Gemini proxy returns 503 @@ -686,7 +686,7 @@ AWF supports OIDC-based credential exchange with multiple cloud providers via Gi | `ACTIONS_ID_TOKEN_REQUEST_URL` | ✅ | Provided automatically by the GitHub Actions runtime | | `ACTIONS_ID_TOKEN_REQUEST_TOKEN` | ✅ | Provided automatically by the GitHub Actions runtime | -Never print or inspect either Actions OIDC variable. Auth Doctor checks the `id-token: write` permission and the presence/consistency of non-secret provider configuration instead. +Never print or inspect either Actions OIDC variable. Documentation audits should verify the `id-token: write` permission and the presence/consistency of non-secret provider configuration instead. On current `main`, AWF forwards these variables to the API-proxy sidecar when OIDC is active, while the general agent passthrough can also expose them to the agent. [PR #6894](https://github.com/github/gh-aw-firewall/pull/6894) is the related isolation change. [github/gh-aw#50053](https://github.com/github/gh-aw/issues/50053) tracks the separate gh-aw runner-to-mcpg path and compatibility for existing lock files; do not pass OIDC variables to the agent as an MCP workaround. diff --git a/docs/auth-matrix.md b/docs/auth-matrix.md index de6e6f7c9..b0ba237b1 100644 --- a/docs/auth-matrix.md +++ b/docs/auth-matrix.md @@ -2,7 +2,7 @@ This document describes every authentication combination supported by AWF's api-proxy sidecar, including how each provider's auth works, what configuration is required, and how the proxy transforms credentials before forwarding to upstream APIs. -For a presence-only diagnosis of a workflow or run, comment `/auth-doctor` on an issue in this repository. The [Auth Doctor workflow](../.github/workflows/auth-doctor.md) checks permissions, provider fields, route availability, and allowlists without returning credential values. +The [Auth Doctor Updater workflow](../.github/workflows/auth-doctor-updater.md) periodically compares this matrix with current default-branch implementation, recent issues and pull requests, and official provider guidance. It opens a deduplicated proposal issue only when an evidence-backed documentation correction is needed. ## Table of Contents @@ -206,7 +206,7 @@ All OIDC flows require GitHub Actions runtime tokens: - `ACTIONS_ID_TOKEN_REQUEST_URL` — endpoint to mint OIDC JWTs - `ACTIONS_ID_TOKEN_REQUEST_TOKEN` — auth token for the OIDC endpoint -The Auth Doctor treats both as non-observable credentials: it checks `id-token: write` and sidecar configuration but never requests or prints either value, a minted JWT, or exchanged cloud credentials. On current `main`, these variables are forwarded to the API-proxy sidecar for OIDC and may also reach the agent through the current passthrough behavior. [PR #6894](https://github.com/github/gh-aw-firewall/pull/6894) is the related isolation change, while [github/gh-aw#50053](https://github.com/github/gh-aw/issues/50053) tracks compiler/runtime and existing-lock compatibility. +Documentation audits treat both as non-observable credentials: they verify `id-token: write` and sidecar configuration but never request or print either value, a minted JWT, or exchanged cloud credentials. On current `main`, these variables are forwarded to the API-proxy sidecar for OIDC and may also reach the agent through the current passthrough behavior. [PR #6894](https://github.com/github/gh-aw-firewall/pull/6894) is the related isolation change, while [github/gh-aw#50053](https://github.com/github/gh-aw/issues/50053) tracks compiler/runtime and existing-lock compatibility. HTTP MCP `auth.type: github-oidc` is separate from this matrix: gh-aw launches mcpg from a runner-owned step and passes OIDC capability directly to that gateway. AWF does not launch or configure mcpg, and the OIDC request variables should not be exposed to the AWF agent to support MCP authentication. diff --git a/docs/authentication-architecture.md b/docs/authentication-architecture.md index 8d7310c96..f0941bb6e 100644 --- a/docs/authentication-architecture.md +++ b/docs/authentication-architecture.md @@ -774,7 +774,7 @@ This architecture provides **transparent operation** (SDKs work without code cha ## Related documentation -- [Auth Doctor workflow](../.github/workflows/auth-doctor.md) — non-secret authentication and route diagnostics via `/auth-doctor` +- [Auth Doctor Updater workflow](../.github/workflows/auth-doctor-updater.md) — recurring audit of authentication and API-proxy documentation against implementation and official guidance - [API Proxy Sidecar](./api-proxy-sidecar.md) — user-facing guide for enabling the API proxy - [Security](./security.md) — overall security model - [Architecture](./architecture.md) — overall system architecture diff --git a/docs/diagnosing-awf-failures.md b/docs/diagnosing-awf-failures.md index 5177cb338..ee6c2a25b 100644 --- a/docs/diagnosing-awf-failures.md +++ b/docs/diagnosing-awf-failures.md @@ -68,7 +68,3 @@ agent and use it to diagnose my failure. the failure is clearly on a GitHub-hosted runner with no ARC/DinD/GHES/GHEC, custom `DOCKER_HOST`, or corporate-proxy involvement, the Doctor will say so and stop. - -## Authentication and API-proxy failures - -For authentication, API-proxy routing, provider OIDC, or HTTP MCP GitHub OIDC failures, comment `/auth-doctor` on the relevant issue instead. The [Auth Doctor workflow](../.github/workflows/auth-doctor.md) mirrors the Runner Doctor's issue/comment reporting model but uses presence-only configuration checks, redacted evidence, and non-secret health fields. It never returns API keys, authorization headers, Actions OIDC request tokens, minted JWTs, or exchanged cloud credentials. diff --git a/docs/environment.md b/docs/environment.md index 8a9bae5fe..e15c3f6db 100644 --- a/docs/environment.md +++ b/docs/environment.md @@ -48,7 +48,7 @@ Using `--env-all` passes all host environment variables to the container, which **Excluded variables** (even with `--env-all`): `PATH`, `PWD`, `OLDPWD`, `SHLVL`, `_`, `SUDO_*` -`--env-all` is not a safe way to troubleshoot authentication. Use the [Auth Doctor workflow](../.github/workflows/auth-doctor.md), which reports only configuration presence and route status. In particular, do not expose Actions OIDC request variables to the agent to support HTTP MCP `auth.type: github-oidc`: gh-aw launches mcpg separately from a runner-owned step, and [github/gh-aw#50053](https://github.com/github/gh-aw/issues/50053) tracks that boundary and existing-lock compatibility. +`--env-all` is not a safe way to troubleshoot authentication. Do not expose Actions OIDC request variables to the agent to support HTTP MCP `auth.type: github-oidc`: gh-aw launches mcpg separately from a runner-owned step, and [github/gh-aw#50053](https://github.com/github/gh-aw/issues/50053) tracks that boundary and existing-lock compatibility. The [Auth Doctor Updater workflow](../.github/workflows/auth-doctor-updater.md) audits this guidance without running credential probes. **Proxy variables:** `HTTP_PROXY`, `HTTPS_PROXY`, `http_proxy`, `https_proxy`, `NO_PROXY`, `no_proxy`, `ALL_PROXY`, and `FTP_PROXY` (all case variants) from the host are **excluded from container passthrough** when using `--env-all`. The firewall sets its own proxy variables pointing to Squid inside the container. However, host proxy variables **are read** for upstream proxy auto-detection — if the host has `https_proxy`/`http_proxy` set, AWF configures Squid to chain outbound traffic through that corporate proxy (see [Upstream Proxy Support](#upstream-corporate-proxy-support)). diff --git a/scripts/ci/auth-doctor-updater-workflow.test.ts b/scripts/ci/auth-doctor-updater-workflow.test.ts new file mode 100644 index 000000000..a5d384ed8 --- /dev/null +++ b/scripts/ci/auth-doctor-updater-workflow.test.ts @@ -0,0 +1,61 @@ +import * as fs from 'fs'; +import * as path from 'path'; + +const workflowsDir = path.resolve(__dirname, '../../.github/workflows'); +const sourcePath = path.join(workflowsDir, 'auth-doctor-updater.md'); +const lockPath = path.join(workflowsDir, 'auth-doctor-updater.lock.yml'); + +describe('auth doctor updater workflow config', () => { + it('mirrors the runner doctor updater cadence and proposal-issue contract', () => { + const source = fs.readFileSync(sourcePath, 'utf-8'); + + expect(source).toContain('name: Auth Doctor Updater'); + expect(source).toContain('schedule: daily'); + expect(source).toContain('workflow_dispatch:'); + expect(source).toContain('Compute scan window'); + expect(source).toContain('title-prefix: "🩺 Auth Doctor Update"'); + expect(source).toContain('labels: [documentation, automated]'); + expect(source).toContain('Your only output is one proposed-changes issue or a `noop`.'); + expect(source).toContain('never modify code, create a branch, or open a pull request'); + }); + + it('audits supported auth paths and keeps trust boundaries explicit', () => { + const source = fs.readFileSync(sourcePath, 'utf-8'); + + for (const expected of [ + 'OpenAI', + 'Anthropic', + 'GitHub Copilot', + 'BYOK', + 'Gemini', + 'Vertex', + 'Azure', + 'AWS Bedrock', + 'GCP Vertex', + 'Anthropic WIF', + 'auth.type: github-oidc', + 'github/gh-aw#50053', + 'github/gh-aw-firewall#6894', + ]) { + expect(source).toContain(expected); + } + + expect(source).toContain('AWF does not launch or configure mcpg.'); + expect(source).toContain('Never run credential probes, token exchanges, inference requests'); + expect(source).not.toContain('${{ secrets.'); + expect(source).not.toContain('${{ env.'); + }); + + it('compiles the schedule, scan window, permissions, and safe outputs', () => { + const lock = fs.readFileSync(lockPath, 'utf-8'); + + expect(lock).toContain('schedule:'); + expect(lock).toContain('cron:'); + expect(lock).toContain('issues: read'); + expect(lock).toContain('pull-requests: read'); + expect(lock).toContain('🩺 Auth Doctor Update'); + expect(lock).toContain('Compute scan window'); + expect(lock).toMatch(/memory-none-nopolicy-\$\{\{ env\.GH_AW_WORKFLOW_ID_SANITIZED \}\}-/); + expect(lock).toMatch(/github\/gh-aw(?:-actions\/|\/actions\/)setup@[a-f0-9]{40}/); + }); +}); diff --git a/scripts/ci/auth-doctor-workflow.test.ts b/scripts/ci/auth-doctor-workflow.test.ts deleted file mode 100644 index 86c850c68..000000000 --- a/scripts/ci/auth-doctor-workflow.test.ts +++ /dev/null @@ -1,59 +0,0 @@ -import * as fs from 'fs'; -import * as path from 'path'; - -const workflowsDir = path.resolve(__dirname, '../../.github/workflows'); -const sourcePath = path.join(workflowsDir, 'auth-doctor.md'); -const lockPath = path.join(workflowsDir, 'auth-doctor.lock.yml'); - -describe('auth doctor workflow config', () => { - it('mirrors the runner doctor trigger and safe-output UX', () => { - const source = fs.readFileSync(sourcePath, 'utf-8'); - - expect(source).toContain('name: Auth Doctor'); - expect(source).toContain('roles: all'); - expect(source).toContain('slash_command:'); - expect(source).toContain('name: auth-doctor'); - expect(source).toContain('actions: read'); - expect(source).toContain('title-prefix: "🩺 Auth Doctor"'); - expect(source).toContain('add-comment:'); - expect(source).toContain('create-issue:'); - }); - - it('covers supported auth paths and preserves credential boundaries', () => { - const source = fs.readFileSync(sourcePath, 'utf-8'); - - for (const expected of [ - 'OpenAI', - 'Anthropic', - 'GitHub Copilot / Copilot BYOK', - 'Gemini', - 'Vertex AI', - 'Azure', - 'AWS', - 'GCP', - 'Anthropic WIF', - 'auth.type: github-oidc', - 'github/gh-aw#50053', - 'github/gh-aw-firewall#6894', - ]) { - expect(source).toContain(expected); - } - - expect(source).toContain('AWF does not launch or configure mcpg.'); - expect(source).toContain('Do not recommend exposing the Actions OIDC variables to the AWF agent'); - expect(source).toContain('Never inspect the Actions request token or a minted/exchanged credential.'); - expect(source).not.toContain('${{ secrets.'); - expect(source).not.toContain('${{ env.'); - }); - - it('compiles the trigger, permissions, and safe outputs into the lock workflow', () => { - const lock = fs.readFileSync(lockPath, 'utf-8'); - - expect(lock).toContain('auth-doctor'); - expect(lock).toContain('actions: read'); - expect(lock).toContain('issues: read'); - expect(lock).toContain('pull-requests: read'); - expect(lock).toContain('🩺 Auth Doctor'); - expect(lock).toMatch(/github\/gh-aw(?:-actions\/|\/actions\/)setup@(?:[a-f0-9]{40}|v\d+\.\d+\.\d+)/); - }); -}); From eaa169f7a531cab3e5f4eec2158972ed39c459c4 Mon Sep 17 00:00:00 2001 From: Landon Cox Date: Mon, 3 Aug 2026 12:02:52 -0700 Subject: [PATCH 3/4] fix: make Auth Doctor Updater open docs PRs Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 79dfde80-9308-4d73-bd34-3ec5bc114cd7 --- .../workflows/auth-doctor-updater.lock.yml | 104 ++++++++++++------ .github/workflows/auth-doctor-updater.md | 79 ++++++++----- README.md | 2 +- docs/api-proxy-sidecar.md | 2 +- docs/auth-matrix.md | 2 +- .../ci/auth-doctor-updater-workflow.test.ts | 18 ++- 6 files changed, 132 insertions(+), 75 deletions(-) diff --git a/.github/workflows/auth-doctor-updater.lock.yml b/.github/workflows/auth-doctor-updater.lock.yml index 0483230a5..843874f2e 100644 --- a/.github/workflows/auth-doctor-updater.lock.yml +++ b/.github/workflows/auth-doctor-updater.lock.yml @@ -1,5 +1,5 @@ -# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"2864040421574692c410b1e629885acb4fd3b3eac8bf62da4e842fac9aad846b","body_hash":"77758246f780bd91840a9ef97a46b75118b6c884196a41ef21fb78c9524ec880","compiler_version":"v0.84.3","strict":true,"agent_id":"copilot","engine_versions":{"copilot":"1.0.77"}} -# gh-aw-manifest: {"version":1,"secrets":["COPILOT_GITHUB_TOKEN","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/cache","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/cache/restore","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/cache/save","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/checkout","sha":"3d3c42e5aac5ba805825da76410c181273ba90b1","version":"v7.0.1"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"},{"repo":"github/gh-aw-actions/setup","sha":"c863074e6da7866f66d9ce31ce11429384406f5f","version":"v0.84.3"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.27.43","digest":"sha256:04e2d1987a565000a8f114b89d806ae7a3864dd4f944be65275b28c93d8690e6","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.27.43@sha256:04e2d1987a565000a8f114b89d806ae7a3864dd4f944be65275b28c93d8690e6"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.43","digest":"sha256:d85f57975af5ea23af4996e41ed73fbc8f5b4a47402472bfe82e508f352cb0c1","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.43@sha256:d85f57975af5ea23af4996e41ed73fbc8f5b4a47402472bfe82e508f352cb0c1"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.27.43","digest":"sha256:26be5e0b8c8f4c41c8a59126b29bb5d80b07253597472ded2a16bdd75abcbf9d","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.27.43@sha256:26be5e0b8c8f4c41c8a59126b29bb5d80b07253597472ded2a16bdd75abcbf9d"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.4.7","digest":"sha256:7545220a9aca134b71e51193ee0eaf4c50756ebf8fbd25a63ae7556e62815c00","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.4.7@sha256:7545220a9aca134b71e51193ee0eaf4c50756ebf8fbd25a63ae7556e62815c00"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b","pinned_image":"ghcr.io/github/gh-aw-node@sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b"},{"image":"ghcr.io/github/github-mcp-server:v1.8.0","digest":"sha256:d5a18c04b92714c309eb46a2305087e91a4dbd80420f6e462656699f95093520","pinned_image":"ghcr.io/github/github-mcp-server:v1.8.0@sha256:d5a18c04b92714c309eb46a2305087e91a4dbd80420f6e462656699f95093520"}]} +# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"2ea4fa37820ae8ac456054adb08f719998ffd33942546dbf48329c73160ace26","body_hash":"194d911ab23f94ad76ff451de56ad092f2212950f73cb16ca296bf5be007a86a","compiler_version":"v0.84.3","strict":true,"agent_id":"copilot","engine_versions":{"copilot":"1.0.77"}} +# gh-aw-manifest: {"version":1,"secrets":["COPILOT_GITHUB_TOKEN","GH_AW_CI_TRIGGER_TOKEN","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/cache","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/cache/restore","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/cache/save","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/checkout","sha":"3d3c42e5aac5ba805825da76410c181273ba90b1","version":"v7.0.1"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"},{"repo":"github/gh-aw-actions/setup","sha":"c863074e6da7866f66d9ce31ce11429384406f5f","version":"v0.84.3"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.27.43","digest":"sha256:04e2d1987a565000a8f114b89d806ae7a3864dd4f944be65275b28c93d8690e6","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.27.43@sha256:04e2d1987a565000a8f114b89d806ae7a3864dd4f944be65275b28c93d8690e6"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.43","digest":"sha256:d85f57975af5ea23af4996e41ed73fbc8f5b4a47402472bfe82e508f352cb0c1","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.43@sha256:d85f57975af5ea23af4996e41ed73fbc8f5b4a47402472bfe82e508f352cb0c1"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.27.43","digest":"sha256:26be5e0b8c8f4c41c8a59126b29bb5d80b07253597472ded2a16bdd75abcbf9d","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.27.43@sha256:26be5e0b8c8f4c41c8a59126b29bb5d80b07253597472ded2a16bdd75abcbf9d"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.4.7","digest":"sha256:7545220a9aca134b71e51193ee0eaf4c50756ebf8fbd25a63ae7556e62815c00","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.4.7@sha256:7545220a9aca134b71e51193ee0eaf4c50756ebf8fbd25a63ae7556e62815c00"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b","pinned_image":"ghcr.io/github/gh-aw-node@sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b"},{"image":"ghcr.io/github/github-mcp-server:v1.8.0","digest":"sha256:d5a18c04b92714c309eb46a2305087e91a4dbd80420f6e462656699f95093520","pinned_image":"ghcr.io/github/github-mcp-server:v1.8.0@sha256:d5a18c04b92714c309eb46a2305087e91a4dbd80420f6e462656699f95093520"}]} # This file was automatically generated by gh-aw (v0.84.3). DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md # # ___ _ _ @@ -23,10 +23,11 @@ # # For more information: https://github.github.com/gh-aw/introduction/overview/ # -# Daily workflow that reviews provider authentication guidance, repository changes, and related issues and proposes documentation updates for AWF authentication and API-proxy behavior. +# Daily workflow that reviews provider authentication guidance and repository changes, updates approved AWF authentication and API-proxy docs, and opens a pull request. # # Secrets used: # - COPILOT_GITHUB_TOKEN +# - GH_AW_CI_TRIGGER_TOKEN # - GH_AW_GITHUB_MCP_SERVER_TOKEN # - GH_AW_GITHUB_TOKEN # - GITHUB_TOKEN @@ -56,7 +57,7 @@ on: - cron: "6 3 * * *" # Friendly format: daily (scattered) # skip-if-match: # Skip-if-match processed as search check in pre-activation job # max: 1 - # query: is:issue is:open label:documentation in:title "Auth Doctor Update" + # query: is:pr is:open in:title "[docs] auth:" workflow_dispatch: inputs: aw_context: @@ -252,21 +253,24 @@ jobs: run: | bash "${RUNNER_TEMP}/gh-aw/actions/create_prompt_first.sh" { - cat << 'GH_AW_PROMPT_267715395a9529db_EOF' + cat << 'GH_AW_PROMPT_ac03f1574928b915_EOF' - GH_AW_PROMPT_267715395a9529db_EOF + GH_AW_PROMPT_ac03f1574928b915_EOF cat "${RUNNER_TEMP}/gh-aw/prompts/xpia.md" cat "${RUNNER_TEMP}/gh-aw/prompts/temp_folder_prompt.md" cat "${RUNNER_TEMP}/gh-aw/prompts/markdown.md" cat "${RUNNER_TEMP}/gh-aw/prompts/cache_memory_prompt.md" cat "${RUNNER_TEMP}/gh-aw/prompts/safe_outputs_prompt.md" - cat << 'GH_AW_PROMPT_267715395a9529db_EOF' + cat << 'GH_AW_PROMPT_ac03f1574928b915_EOF' - Tools: create_issue, missing_tool, missing_data, noop + Tools: create_pull_request, missing_tool, missing_data, noop + GH_AW_PROMPT_ac03f1574928b915_EOF + cat "${RUNNER_TEMP}/gh-aw/prompts/safe_outputs_create_pull_request.md" + cat << 'GH_AW_PROMPT_ac03f1574928b915_EOF' - GH_AW_PROMPT_267715395a9529db_EOF + GH_AW_PROMPT_ac03f1574928b915_EOF cat "${RUNNER_TEMP}/gh-aw/prompts/mcp_cli_tools_prompt.md" - cat << 'GH_AW_PROMPT_267715395a9529db_EOF' + cat << 'GH_AW_PROMPT_ac03f1574928b915_EOF' The following GitHub context information is available for this workflow: {{#if github.actor}} @@ -295,12 +299,12 @@ jobs: {{/if}} - GH_AW_PROMPT_267715395a9529db_EOF + GH_AW_PROMPT_ac03f1574928b915_EOF cat "${RUNNER_TEMP}/gh-aw/prompts/github_mcp_tools_with_safeoutputs_prompt.md" - cat << 'GH_AW_PROMPT_267715395a9529db_EOF' + cat << 'GH_AW_PROMPT_ac03f1574928b915_EOF' {{#runtime-import .github/workflows/auth-doctor-updater.md}} - GH_AW_PROMPT_267715395a9529db_EOF + GH_AW_PROMPT_ac03f1574928b915_EOF } > "$GH_AW_PROMPT" - name: Interpolate variables and render templates uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 @@ -547,33 +551,43 @@ jobs: mkdir -p "${RUNNER_TEMP}/gh-aw/safeoutputs" mkdir -p /tmp/gh-aw/safeoutputs mkdir -p /tmp/gh-aw/mcp-logs/safeoutputs - cat > "${RUNNER_TEMP}/gh-aw/safeoutputs/config.json" << 'GH_AW_SAFE_OUTPUTS_CONFIG_0df50569eef0527e_EOF' - {"create_issue":{"expires":720,"labels":["documentation","automated"],"max":1,"title_prefix":"🩺 Auth Doctor Update"},"create_report_incomplete_issue":{},"mentions":{"enabled":false},"missing_data":{},"missing_tool":{},"noop":{"max":1,"report-as-issue":"true"},"report_incomplete":{}} - GH_AW_SAFE_OUTPUTS_CONFIG_0df50569eef0527e_EOF + cat > "${RUNNER_TEMP}/gh-aw/safeoutputs/config.json" << 'GH_AW_SAFE_OUTPUTS_CONFIG_cab17dfc2cab2bb7_EOF' + {"create_pull_request":{"allowed_files":["README.md","docs/api-proxy-sidecar.md","docs/auth-matrix.md","docs/authentication-architecture.md","docs/awf-config-spec.md","docs/environment.md","docs/github_actions.md","docs/security.md","docs/usage.md"],"draft":false,"labels":["documentation","ai-generated"],"max":1,"max_patch_files":100,"max_patch_size":4096,"protect_top_level_dot_folders":true,"protected_files":["package.json","bun.lockb","bunfig.toml","deno.json","deno.jsonc","deno.lock","global.json","NuGet.Config","Directory.Packages.props","mix.exs","mix.lock","go.mod","go.sum","stack.yaml","stack.yaml.lock","pom.xml","build.gradle","build.gradle.kts","settings.gradle","settings.gradle.kts","gradle.properties","package-lock.json","yarn.lock","pnpm-lock.yaml","npm-shrinkwrap.json","requirements.txt","Pipfile","Pipfile.lock","pyproject.toml","setup.py","setup.cfg","Gemfile","Gemfile.lock","uv.lock","CODEOWNERS","DESIGN.md","README.md","CONTRIBUTING.md","CHANGELOG.md","SECURITY.md","CODE_OF_CONDUCT.md","AGENTS.md","CLAUDE.md","GEMINI.md"],"protected_files_policy":"request_review","reviewers":["copilot"],"title_prefix":"[docs] auth: "},"create_report_incomplete_issue":{},"missing_data":{},"missing_tool":{},"noop":{"max":1,"report-as-issue":"true"},"report_incomplete":{}} + GH_AW_SAFE_OUTPUTS_CONFIG_cab17dfc2cab2bb7_EOF - name: Generate Safe Outputs Tools env: GH_AW_TOOLS_META_JSON: | { "description_suffixes": { - "create_issue": " CONSTRAINTS: Maximum 1 issue(s) can be created. Title will be prefixed with \"🩺 Auth Doctor Update\". Labels [\"documentation\" \"automated\"] will be automatically added." + "create_pull_request": " CONSTRAINTS: Maximum 1 pull request(s) can be created. Title will be prefixed with \"[docs] auth: \". Labels [\"documentation\" \"ai-generated\"] will be automatically added. Reviewers [\"copilot\"] will be assigned." }, "repo_params": {}, "dynamic_tools": [] } GH_AW_VALIDATION_JSON: | { - "create_issue": { + "create_pull_request": { "defaultMax": 1, "fields": { + "base": { + "type": "string", + "sanitize": true, + "maxLength": 128 + }, "body": { "required": true, "type": "string", "sanitize": true, - "maxLength": 65000, - "minLength": 20 + "maxLength": 65000 }, - "fields": { - "type": "array" + "branch": { + "required": true, + "type": "string", + "sanitize": true, + "maxLength": 256 + }, + "draft": { + "type": "boolean" }, "labels": { "type": "array", @@ -581,16 +595,10 @@ jobs: "itemSanitize": true, "itemMaxLength": 128 }, - "parent": { - "issueOrPRNumber": true - }, "repo": { "type": "string", "maxLength": 256 }, - "temporary_id": { - "type": "string" - }, "title": { "required": true, "type": "string", @@ -599,9 +607,6 @@ jobs: } } }, - "mentions": { - "enabled": false - }, "missing_data": { "defaultMax": 20, "fields": { @@ -926,7 +931,6 @@ jobs: env: GH_AW_SAFE_OUTPUTS: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS }} GH_AW_ALLOWED_DOMAINS: "*.githubusercontent.com,ai.google.dev,api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,cloud.google.com,codeload.github.com,docs.anthropic.com,docs.aws.amazon.com,docs.github.com,github-cloud.githubusercontent.com,github-cloud.s3.amazonaws.com,github.blog,github.com,github.githubassets.com,host.docker.internal,learn.microsoft.com,lfs.github.com,objects.githubusercontent.com,patch-diff.githubusercontent.com,patchdiff.githubusercontent.com,platform.claude.com,platform.openai.com,raw.githubusercontent.com,registry.npmjs.org,telemetry.enterprise.githubcopilot.com" - GH_AW_ALLOWED_GITHUB_REFS: "" GITHUB_SERVER_URL: ${{ github.server_url }} GITHUB_API_URL: ${{ github.api_url }} with: @@ -1012,6 +1016,8 @@ jobs: /tmp/gh-aw/github_rate_limits.jsonl /tmp/gh-aw/safeoutputs.jsonl /tmp/gh-aw/agent_output.json + /tmp/gh-aw/aw-*.patch + /tmp/gh-aw/aw-*.bundle /tmp/gh-aw/awf-config.json /tmp/gh-aw/sandbox/firewall/logs/ /tmp/gh-aw/sandbox/firewall/audit/ @@ -1029,7 +1035,9 @@ jobs: needs.activation.outputs.daily_ai_credits_exceeded == 'true') runs-on: ubuntu-slim permissions: + contents: write issues: write + pull-requests: write concurrency: group: "gh-aw-conclusion-auth-doctor-updater" cancel-in-progress: false @@ -1218,6 +1226,8 @@ jobs: GH_AW_MISSING_MODEL_PRICING_ERROR: ${{ needs.agent.outputs.missing_model_pricing_error }} GH_AW_MISSING_MODEL_PRICING_MODEL_NAME: ${{ needs.agent.outputs.missing_model_pricing_model_name }} GH_AW_ENGINE_API_HOSTS: "api.enterprise.githubcopilot.com,api.githubcopilot.com,api.business.githubcopilot.com,api.individual.githubcopilot.com" + GH_AW_CODE_PUSH_FAILURE_ERRORS: ${{ needs.safe_outputs.outputs.code_push_failure_errors }} + GH_AW_CODE_PUSH_FAILURE_COUNT: ${{ needs.safe_outputs.outputs.code_push_failure_count }} GH_AW_LOCKDOWN_CHECK_FAILED: ${{ needs.activation.outputs.lockdown_check_failed }} GH_AW_OAUTH_TOKEN_CHECK_FAILED: ${{ needs.activation.outputs.oauth_token_check_failed }} GH_AW_STALE_LOCK_FILE_FAILED: ${{ needs.activation.outputs.stale_lock_file_failed }} @@ -1279,7 +1289,7 @@ jobs: id: check_skip_if_match uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 env: - GH_AW_SKIP_QUERY: "is:issue is:open label:documentation in:title \"Auth Doctor Update\"" + GH_AW_SKIP_QUERY: "is:pr is:open in:title \"[docs] auth:\"" GH_AW_WORKFLOW_NAME: "Auth Doctor Updater" GH_AW_SKIP_MAX_MATCHES: "1" with: @@ -1296,7 +1306,9 @@ jobs: if: (!cancelled()) && needs.agent.result != 'skipped' runs-on: ubuntu-slim permissions: + contents: write issues: write + pull-requests: write timeout-minutes: 45 env: GH_AW_AGENT_AIC: ${{ needs.agent.outputs.aic }} @@ -1315,8 +1327,8 @@ jobs: code_push_failure_errors: ${{ steps.process_safe_outputs.outputs.code_push_failure_errors }} create_discussion_error_count: ${{ steps.process_safe_outputs.outputs.create_discussion_error_count }} create_discussion_errors: ${{ steps.process_safe_outputs.outputs.create_discussion_errors }} - created_issue_number: ${{ steps.process_safe_outputs.outputs.created_issue_number }} - created_issue_url: ${{ steps.process_safe_outputs.outputs.created_issue_url }} + created_pr_number: ${{ steps.process_safe_outputs.outputs.created_pr_number }} + created_pr_url: ${{ steps.process_safe_outputs.outputs.created_pr_url }} process_safe_outputs_processed_count: ${{ steps.process_safe_outputs.outputs.processed_count }} process_safe_outputs_temporary_id_map: ${{ steps.process_safe_outputs.outputs.temporary_id_map }} steps: @@ -1348,6 +1360,25 @@ jobs: mkdir -p /tmp/gh-aw/ find "/tmp/gh-aw/" -type f -print echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" + - name: Download patch artifact + continue-on-error: true + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + with: + name: agent + path: /tmp/gh-aw/ + - name: Checkout repository + if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request') + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: true + token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} + - name: Configure Git credentials + if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request') + env: + GITHUB_REPOSITORY: ${{ github.repository }} + GITHUB_SERVER_URL: ${{ github.server_url }} + GIT_TOKEN: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} + run: bash "${RUNNER_TEMP}/gh-aw/actions/configure_git_credentials.sh" - name: Configure GH_HOST for enterprise compatibility id: ghes-host-config shell: bash @@ -1366,7 +1397,8 @@ jobs: GH_AW_ALLOWED_DOMAINS: "*.githubusercontent.com,ai.google.dev,api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,cloud.google.com,codeload.github.com,docs.anthropic.com,docs.aws.amazon.com,docs.github.com,github-cloud.githubusercontent.com,github-cloud.s3.amazonaws.com,github.blog,github.com,github.githubassets.com,host.docker.internal,learn.microsoft.com,lfs.github.com,objects.githubusercontent.com,patch-diff.githubusercontent.com,patchdiff.githubusercontent.com,platform.claude.com,platform.openai.com,raw.githubusercontent.com,registry.npmjs.org,telemetry.enterprise.githubcopilot.com" GITHUB_SERVER_URL: ${{ github.server_url }} GITHUB_API_URL: ${{ github.api_url }} - GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"create_issue\":{\"expires\":720,\"labels\":[\"documentation\",\"automated\"],\"max\":1,\"title_prefix\":\"🩺 Auth Doctor Update\"},\"create_report_incomplete_issue\":{},\"mentions\":{\"enabled\":false},\"missing_data\":{},\"missing_tool\":{},\"noop\":{\"max\":1,\"report-as-issue\":\"true\"},\"report_incomplete\":{}}" + GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"create_pull_request\":{\"allowed_files\":[\"README.md\",\"docs/api-proxy-sidecar.md\",\"docs/auth-matrix.md\",\"docs/authentication-architecture.md\",\"docs/awf-config-spec.md\",\"docs/environment.md\",\"docs/github_actions.md\",\"docs/security.md\",\"docs/usage.md\"],\"draft\":false,\"labels\":[\"documentation\",\"ai-generated\"],\"max\":1,\"max_patch_files\":100,\"max_patch_size\":4096,\"protect_top_level_dot_folders\":true,\"protected_files\":[\"package.json\",\"bun.lockb\",\"bunfig.toml\",\"deno.json\",\"deno.jsonc\",\"deno.lock\",\"global.json\",\"NuGet.Config\",\"Directory.Packages.props\",\"mix.exs\",\"mix.lock\",\"go.mod\",\"go.sum\",\"stack.yaml\",\"stack.yaml.lock\",\"pom.xml\",\"build.gradle\",\"build.gradle.kts\",\"settings.gradle\",\"settings.gradle.kts\",\"gradle.properties\",\"package-lock.json\",\"yarn.lock\",\"pnpm-lock.yaml\",\"npm-shrinkwrap.json\",\"requirements.txt\",\"Pipfile\",\"Pipfile.lock\",\"pyproject.toml\",\"setup.py\",\"setup.cfg\",\"Gemfile\",\"Gemfile.lock\",\"uv.lock\",\"CODEOWNERS\",\"DESIGN.md\",\"README.md\",\"CONTRIBUTING.md\",\"CHANGELOG.md\",\"SECURITY.md\",\"CODE_OF_CONDUCT.md\",\"AGENTS.md\",\"CLAUDE.md\",\"GEMINI.md\"],\"protected_files_policy\":\"request_review\",\"reviewers\":[\"copilot\"],\"title_prefix\":\"[docs] auth: \"},\"create_report_incomplete_issue\":{},\"missing_data\":{},\"missing_tool\":{},\"noop\":{\"max\":1,\"report-as-issue\":\"true\"},\"report_incomplete\":{}}" + GH_AW_CI_TRIGGER_TOKEN: ${{ secrets.GH_AW_CI_TRIGGER_TOKEN }} with: github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} script: | diff --git a/.github/workflows/auth-doctor-updater.md b/.github/workflows/auth-doctor-updater.md index 41642ba8b..53d48414c 100644 --- a/.github/workflows/auth-doctor-updater.md +++ b/.github/workflows/auth-doctor-updater.md @@ -1,11 +1,11 @@ --- name: Auth Doctor Updater -description: Daily workflow that reviews provider authentication guidance, repository changes, and related issues and proposes documentation updates for AWF authentication and API-proxy behavior. +description: Daily workflow that reviews provider authentication guidance and repository changes, updates approved AWF authentication and API-proxy docs, and opens a pull request. on: schedule: daily workflow_dispatch: skip-if-match: - query: 'is:issue is:open label:documentation in:title "Auth Doctor Update"' + query: 'is:pr is:open in:title "[docs] auth:"' max: 1 permissions: copilot-requests: write @@ -18,6 +18,7 @@ tools: web-fetch: bash: true cache-memory: true + edit: sandbox: agent: id: awf @@ -35,13 +36,21 @@ network: safe-outputs: threat-detection: enabled: false - mentions: false - allowed-github-references: [] - create-issue: - title-prefix: "🩺 Auth Doctor Update" - labels: [documentation, automated] - max: 1 - expires: 30d + create-pull-request: + title-prefix: "[docs] auth: " + labels: [documentation, ai-generated] + reviewers: copilot + draft: false + allowed-files: + - README.md + - docs/api-proxy-sidecar.md + - docs/auth-matrix.md + - docs/authentication-architecture.md + - docs/awf-config-spec.md + - docs/environment.md + - docs/github_actions.md + - docs/security.md + - docs/usage.md timeout-minutes: 20 steps: - name: Compute scan window @@ -56,16 +65,16 @@ steps: # Auth Doctor Updater -You maintain this repository's documentation for AWF authentication, API-proxy routing, and related gh-aw HTTP MCP GitHub OIDC behavior. Each day, reconcile current repository implementation and recent changes with official provider guidance, then propose precise documentation corrections. +You maintain this repository's documentation for AWF authentication, API-proxy routing, and related gh-aw HTTP MCP GitHub OIDC behavior. Each day, reconcile current repository implementation and recent changes with official provider guidance, apply precise corrections to approved documentation files, and open one pull request. -You do **not** edit files yourself. Your only output is one proposed-changes issue or a `noop`. +Your only visible output is one documentation pull request through the configured safe output, or a `noop`. ## Scan Window - **Repository:** ${{ github.repository }} - **Since (UTC date):** read from `/tmp/gh-aw/agent/scan-since.txt` -Consider relevant issues, pull requests, releases, and documentation updates on or after the scan window. The window overlaps the previous daily run; de-duplicate anything already documented or proposed. +Consider relevant issues, pull requests, releases, and documentation updates on or after the scan window. The window overlaps the previous daily run; de-duplicate anything already documented or covered by an open updater pull request. ## Step 1 — Read the Current Documentation and Implementation @@ -144,49 +153,59 @@ Keep the API proxy and MCP gateway as separate trust paths: For every candidate, choose one: - **Already accurate** — implementation and official guidance match the docs; skip. -- **Shipped behavior missing from docs** — propose the narrowest addition and cite the merged source. -- **Stale or incorrect claim** — provide replacement wording and evidence. +- **Shipped behavior missing from docs** — make the narrowest addition and cite the merged source. +- **Stale or incorrect claim** — replace it with evidence-backed wording. - **Pending behavior presented as shipped** — add a current-main caveat and link the pending work. - **Cross-document inconsistency** — identify every file that must change together. - **Unverified provider change** — do not propose an update; state what evidence is missing. Do not infer support from an unmerged pull request, a feature request, or provider documentation alone. AWF support requires current default-branch implementation and tests. -## Step 6 — Avoid Duplicate Proposals +## Step 6 — Avoid Duplicate Pull Requests -Search open issues with the `documentation` label and `Auth Doctor Update` in the title. If an existing proposal covers the same findings, call `noop` instead of opening another issue. +Search open pull requests with `[docs] auth:` in the title. If an existing updater pull request covers the same findings, call `noop` instead of opening another pull request. -## Output +## Step 7 — Apply and Validate Documentation Changes -If concrete, not-yet-captured corrections exist, call `create-issue` once with: +Edit only the files allowed by `safe-outputs.create-pull-request.allowed-files`. Do not modify source code, tests, schemas, workflow files, generated files, or dependencies. -### Summary +Before creating the pull request: + +1. Review the diff and remove unrelated or cosmetic changes. +2. Confirm every factual change has current-main implementation evidence and an official or repository source. +3. Keep terminology and links consistent across every affected auth document. +4. Check Markdown structure, relative links, code fences, tables, and examples. +5. Search the diff for token/key/JWT values and credential-bearing URLs. Remove any such content. -- scan window -- sources reviewed -- number of required documentation corrections +## Output + +If concrete corrections were applied, call `create-pull-request` once. The title prefix, labels, reviewer, draft state, and file allowlist are already configured. -### Current-Main Findings +Use this pull request body: + +### Summary -For each finding: affected auth path, shipped/pending status, implementation evidence, and official documentation evidence. +- scan window and sources reviewed +- corrected authentication paths +- current-main versus pending behavior clarified -### Proposed Documentation Changes +### Documentation Changes -Group exact replacement or insertion text by file. Include only files that genuinely need changes, and keep terminology consistent across all affected documents. +List each changed file and the factual correction made. -### Validation Plan +### Validation -List the targeted source/tests to re-check, Markdown lint, docs build, and any schema or workflow compilation needed for the proposed edits. +List the implementation/tests checked, Markdown/link review performed, and credential-leakage diff review. ### Sources Link every repository issue/pull request and official provider page used. Use full URLs and do not include credential-bearing URLs or copied headers. -If no concrete corrections exist, call `noop` with the scan window and a one-line explanation. Never open an empty, speculative, or prose-only issue. +If no concrete corrections were applied, call `noop` with the scan window and a one-line explanation. Never open an empty, speculative, or prose-only pull request. ## Guardrails -- Propose documentation edits only; never modify code, create a branch, or open a pull request. +- Modify approved documentation files only. Use the safe output for branch, commit, and pull-request creation; never run `git commit`, `git push`, or `gh pr create`. - Never print, inspect, request, decode, hash, or reproduce secret values, Actions OIDC request tokens, minted JWTs, exchanged cloud credentials, API keys, cookies, or authorization headers. - Never run credential probes, token exchanges, inference requests, broad environment dumps, `docker inspect`, or `docker compose config`. - Treat identifiers such as tenant IDs, client IDs, role ARNs, service-account emails, and federation resource names as configuration metadata, but redact user-specific values in proposals. diff --git a/README.md b/README.md index 64f88cb7f..3d82970ed 100644 --- a/README.md +++ b/README.md @@ -90,7 +90,7 @@ See [GitHub Actions](docs/github_actions.md) for advanced setup and `awf logs su - [Compatibility](docs/compatibility.md) — supported Node.js, OS, and Docker versions - [Troubleshooting](docs/troubleshooting.md) — common issues and fixes - [Diagnosing AWF failures](docs/diagnosing-awf-failures.md) — use the Self-Hosted Runner Doctor agent to triage self-hosted/ARC/GHES/GHEC failures -- [Auth Doctor Updater workflow](.github/workflows/auth-doctor-updater.md) — daily/manual audit that proposes evidence-backed authentication and API-proxy documentation corrections +- [Auth Doctor Updater workflow](.github/workflows/auth-doctor-updater.md) — daily/manual audit that opens bounded PRs with evidence-backed authentication and API-proxy documentation corrections - [Image verification](docs/image-verification.md) — cosign signature verification ## Development diff --git a/docs/api-proxy-sidecar.md b/docs/api-proxy-sidecar.md index b173b8db2..e9f20a117 100644 --- a/docs/api-proxy-sidecar.md +++ b/docs/api-proxy-sidecar.md @@ -600,7 +600,7 @@ and are normalized to dollars per million tokens inside the proxy. ## Troubleshooting -The [Auth Doctor Updater workflow](../.github/workflows/auth-doctor-updater.md) periodically audits this guide against current implementation, recent repository changes, and official provider guidance. It proposes documentation updates without probing credentials, exchanging tokens, or calling inference APIs. +The [Auth Doctor Updater workflow](../.github/workflows/auth-doctor-updater.md) periodically audits this guide against current implementation, recent repository changes, and official provider guidance. It opens file-bounded documentation pull requests without probing credentials, exchanging tokens, or calling inference APIs. ### Gemini proxy returns 503 diff --git a/docs/auth-matrix.md b/docs/auth-matrix.md index b0ba237b1..330107b64 100644 --- a/docs/auth-matrix.md +++ b/docs/auth-matrix.md @@ -2,7 +2,7 @@ This document describes every authentication combination supported by AWF's api-proxy sidecar, including how each provider's auth works, what configuration is required, and how the proxy transforms credentials before forwarding to upstream APIs. -The [Auth Doctor Updater workflow](../.github/workflows/auth-doctor-updater.md) periodically compares this matrix with current default-branch implementation, recent issues and pull requests, and official provider guidance. It opens a deduplicated proposal issue only when an evidence-backed documentation correction is needed. +The [Auth Doctor Updater workflow](../.github/workflows/auth-doctor-updater.md) periodically compares this matrix with current default-branch implementation, recent issues and pull requests, and official provider guidance. It opens a deduplicated, file-bounded pull request only when an evidence-backed documentation correction is needed. ## Table of Contents diff --git a/scripts/ci/auth-doctor-updater-workflow.test.ts b/scripts/ci/auth-doctor-updater-workflow.test.ts index a5d384ed8..ea235b4bf 100644 --- a/scripts/ci/auth-doctor-updater-workflow.test.ts +++ b/scripts/ci/auth-doctor-updater-workflow.test.ts @@ -6,17 +6,21 @@ const sourcePath = path.join(workflowsDir, 'auth-doctor-updater.md'); const lockPath = path.join(workflowsDir, 'auth-doctor-updater.lock.yml'); describe('auth doctor updater workflow config', () => { - it('mirrors the runner doctor updater cadence and proposal-issue contract', () => { + it('uses updater cadence with a bounded documentation PR contract', () => { const source = fs.readFileSync(sourcePath, 'utf-8'); expect(source).toContain('name: Auth Doctor Updater'); expect(source).toContain('schedule: daily'); expect(source).toContain('workflow_dispatch:'); expect(source).toContain('Compute scan window'); - expect(source).toContain('title-prefix: "🩺 Auth Doctor Update"'); - expect(source).toContain('labels: [documentation, automated]'); - expect(source).toContain('Your only output is one proposed-changes issue or a `noop`.'); - expect(source).toContain('never modify code, create a branch, or open a pull request'); + expect(source).toContain('query: \'is:pr is:open in:title "[docs] auth:"\''); + expect(source).toContain('title-prefix: "[docs] auth: "'); + expect(source).toContain('labels: [documentation, ai-generated]'); + expect(source).toContain('create-pull-request:'); + expect(source).toContain('allowed-files:'); + expect(source).toContain('docs/auth-matrix.md'); + expect(source).toContain('never run `git commit`, `git push`, or `gh pr create`'); + expect(source).not.toContain('create-issue:'); }); it('audits supported auth paths and keeps trust boundaries explicit', () => { @@ -53,8 +57,10 @@ describe('auth doctor updater workflow config', () => { expect(lock).toContain('cron:'); expect(lock).toContain('issues: read'); expect(lock).toContain('pull-requests: read'); - expect(lock).toContain('🩺 Auth Doctor Update'); + expect(lock).toContain('[docs] auth:'); expect(lock).toContain('Compute scan window'); + expect(lock).toContain('create_pull_request'); + expect(lock).toContain('docs/auth-matrix.md'); expect(lock).toMatch(/memory-none-nopolicy-\$\{\{ env\.GH_AW_WORKFLOW_ID_SANITIZED \}\}-/); expect(lock).toMatch(/github\/gh-aw(?:-actions\/|\/actions\/)setup@[a-f0-9]{40}/); }); From ba6a128a73c004774fd8ce607b4667f11646c996 Mon Sep 17 00:00:00 2001 From: Landon Cox Date: Mon, 3 Aug 2026 14:33:33 -0700 Subject: [PATCH 4/4] fix: address dependency audit failures Use the available AJV release that avoids vulnerable fast-uri, and pin the docs build to a patched PostCSS release. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 79dfde80-9308-4d73-bd34-3ec5bc114cd7 --- docs-site/package-lock.json | 50 +++++++++++++++++++------------------ docs-site/package.json | 2 ++ package-lock.json | 30 +++++----------------- package.json | 2 +- 4 files changed, 35 insertions(+), 49 deletions(-) diff --git a/docs-site/package-lock.json b/docs-site/package-lock.json index 80ca69784..d47f66c24 100644 --- a/docs-site/package-lock.json +++ b/docs-site/package-lock.json @@ -2860,15 +2860,15 @@ } }, "node_modules/ajv": { - "version": "8.20.0", - "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.20.0.tgz", - "integrity": "sha512-Thbli+OlOj+iMPYFBVBfJ3OmCAnaSyNn4M1vz9T6Gka5Jt9ba/HIR56joy65tY6kx/FCF5VXNB819Y7/GUrBGA==", + "version": "8.16.0", + "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.16.0.tgz", + "integrity": "sha1-IuKpK5TwBffg+cnTllLvC49vDLQ=", "license": "MIT", "dependencies": { "fast-deep-equal": "^3.1.3", - "fast-uri": "^3.0.1", "json-schema-traverse": "^1.0.0", - "require-from-string": "^2.0.2" + "require-from-string": "^2.0.2", + "uri-js": "^4.4.1" }, "funding": { "type": "github", @@ -4445,22 +4445,6 @@ "fast-string-truncated-width": "^3.0.2" } }, - "node_modules/fast-uri": { - "version": "3.1.4", - "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.4.tgz", - "integrity": "sha512-8JnbkQ4juDyvYs4mgFGQqg4yCYtFDtUtmp2QIQq11ZZe5CFQ5wcqm1rqDgAh/QdMySuBnPzMUiJUNZG5N/AiQw==", - "funding": [ - { - "type": "github", - "url": "https://github.com/sponsors/fastify" - }, - { - "type": "opencollective", - "url": "https://opencollective.com/fastify" - } - ], - "license": "BSD-3-Clause" - }, "node_modules/fast-wrap-ansi": { "version": "0.2.2", "resolved": "https://registry.npmjs.org/fast-wrap-ansi/-/fast-wrap-ansi-0.2.2.tgz", @@ -6961,9 +6945,9 @@ } }, "node_modules/postcss": { - "version": "8.5.22", - "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.22.tgz", - "integrity": "sha512-KBDEIpLrvpv16pp3K0Fw+UCoZfopFjjgeB+0tA/aaThfEE74kKDLrgg603YvOWJyg3+WYtyq3xYsQWsIyZlPqQ==", + "version": "8.5.23", + "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.23.tgz", + "integrity": "sha1-NJNVARb0eEhymDAdLC6NxaVuZZQ=", "funding": [ { "type": "opencollective", @@ -7069,6 +7053,15 @@ "url": "https://github.com/sponsors/wooorm" } }, + "node_modules/punycode": { + "version": "2.3.1", + "resolved": "https://registry.npmjs.org/punycode/-/punycode-2.3.1.tgz", + "integrity": "sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==", + "license": "MIT", + "engines": { + "node": ">=6" + } + }, "node_modules/radix3": { "version": "1.1.2", "resolved": "https://registry.npmjs.org/radix3/-/radix3-1.1.2.tgz", @@ -8246,6 +8239,15 @@ "url": "https://paulmillr.com/funding/" } }, + "node_modules/uri-js": { + "version": "4.4.1", + "resolved": "https://registry.npmjs.org/uri-js/-/uri-js-4.4.1.tgz", + "integrity": "sha512-7rKUyy33Q1yc98pQ1DAmLtwX109F7TIfWlW1Ydo8Wl1ii1SeHieeh0HHfPeL2fMXK6z0s8ecKs9frCuLJvndBg==", + "license": "BSD-2-Clause", + "dependencies": { + "punycode": "^2.1.0" + } + }, "node_modules/url-extras": { "version": "0.1.0", "resolved": "https://registry.npmjs.org/url-extras/-/url-extras-0.1.0.tgz", diff --git a/docs-site/package.json b/docs-site/package.json index 6b99a9878..b2be16d3d 100644 --- a/docs-site/package.json +++ b/docs-site/package.json @@ -22,6 +22,8 @@ "overrides": { "diff": "8.0.3", "esbuild": "^0.28.1", + "ajv": "8.16.0", + "postcss": "8.5.23", "svgo": "^4.0.2", "vite": "8.0.16", "yaml": "^2.9.0" diff --git a/package-lock.json b/package-lock.json index a54d43a18..ca9a92310 100644 --- a/package-lock.json +++ b/package-lock.json @@ -9,7 +9,7 @@ "version": "0.23.1", "license": "MIT", "dependencies": { - "ajv": "^8.20.0", + "ajv": "8.16.0", "chalk": "^4.1.2", "commander": "^12.1.0", "execa": "^5.1.1", @@ -4308,15 +4308,15 @@ } }, "node_modules/ajv": { - "version": "8.20.0", - "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.20.0.tgz", - "integrity": "sha512-Thbli+OlOj+iMPYFBVBfJ3OmCAnaSyNn4M1vz9T6Gka5Jt9ba/HIR56joy65tY6kx/FCF5VXNB819Y7/GUrBGA==", + "version": "8.16.0", + "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.16.0.tgz", + "integrity": "sha1-IuKpK5TwBffg+cnTllLvC49vDLQ=", "license": "MIT", "dependencies": { "fast-deep-equal": "^3.1.3", - "fast-uri": "^3.0.1", "json-schema-traverse": "^1.0.0", - "require-from-string": "^2.0.2" + "require-from-string": "^2.0.2", + "uri-js": "^4.4.1" }, "funding": { "type": "github", @@ -5624,22 +5624,6 @@ "dev": true, "license": "MIT" }, - "node_modules/fast-uri": { - "version": "3.1.4", - "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.4.tgz", - "integrity": "sha512-8JnbkQ4juDyvYs4mgFGQqg4yCYtFDtUtmp2QIQq11ZZe5CFQ5wcqm1rqDgAh/QdMySuBnPzMUiJUNZG5N/AiQw==", - "funding": [ - { - "type": "github", - "url": "https://github.com/sponsors/fastify" - }, - { - "type": "opencollective", - "url": "https://opencollective.com/fastify" - } - ], - "license": "BSD-3-Clause" - }, "node_modules/fastq": { "version": "1.20.1", "resolved": "https://registry.npmjs.org/fastq/-/fastq-1.20.1.tgz", @@ -8515,7 +8499,6 @@ "version": "2.3.1", "resolved": "https://registry.npmjs.org/punycode/-/punycode-2.3.1.tgz", "integrity": "sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==", - "dev": true, "license": "MIT", "engines": { "node": ">=6" @@ -9457,7 +9440,6 @@ "version": "4.4.1", "resolved": "https://registry.npmjs.org/uri-js/-/uri-js-4.4.1.tgz", "integrity": "sha512-7rKUyy33Q1yc98pQ1DAmLtwX109F7TIfWlW1Ydo8Wl1ii1SeHieeh0HHfPeL2fMXK6z0s8ecKs9frCuLJvndBg==", - "dev": true, "license": "BSD-2-Clause", "dependencies": { "punycode": "^2.1.0" diff --git a/package.json b/package.json index e5b4d94ca..121da1e6f 100644 --- a/package.json +++ b/package.json @@ -46,7 +46,7 @@ "author": "GitHub", "license": "MIT", "dependencies": { - "ajv": "^8.20.0", + "ajv": "8.16.0", "chalk": "^4.1.2", "commander": "^12.1.0", "execa": "^5.1.1",