Bump tar, npm-check-updates and node-gyp in /ui #5
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # | ||
|
Check failure on line 1 in .github/workflows/daily-repo-status.lock.yml
|
||
| # ___ _ | ||
| # / _ \ | | (_) | ||
| # | |_| | __ _ ___ _ __ | |_ _ | ||
| # | _ |/ _` |/ _ \ '_ \| __| |/ __| | ||
| # | | | | (_| | __/ | | | |_| | ( | ||
| # \_| |_/\__, |\___|_| |_|\__|_|\___| | ||
| # __/ | | ||
| # _ _ |___/ | ||
| # | | | | / _| | | ||
| # | | | | ___ _ __ _ __| |_| | _____ | ||
| # | |/\| |/ _ \ '__| |/ /| _| |/ _ \ \ /\ / / ___| | ||
| # \ /\ / (_) | | | | ( | | | | (_) \ V V /\__ \ | ||
| # \/ \/ \___/|_| |_|\_\|_| |_|\___/ \_/\_/ |___/ | ||
| # | ||
| # This file was automatically generated by gh-aw (v0.45.0). DO NOT EDIT. | ||
| # | ||
| # To update this file, edit githubnext/agentics/workflows/daily-repo-status.md@d19056381ba48cb1f7c78510c23069701fa7ae87 and run: | ||
| # gh aw | ||
| # Not all edits will cause changes to this file. | ||
| # | ||
| # For more information: https://github.github.com/gh-aw/introduction/overview/ | ||
| # | ||
| # This workflow creates daily repo status reports. It gathers recent | ||
| # activity (issues, PRs, discussions, releases, code changes) and | ||
| # engaging GitHub issues with productivity insights, community highlights, | ||
| # and project recommendations. | ||
| # | ||
| # Source: githubnext/agentics/workflows/daily-repo-status.md@ | ||
| # | ||
| # frontmatter-hash: | ||
| name: "Daily Repo Status" | ||
| "on": | ||
| schedule: | ||
| - cron: "25 18 * * *" | ||
| # Friendly format: daily (scattered) | ||
| workflow_dispatch: | ||
| permissions: {} | ||
| concurrency: | ||
| group: "gh-aw-${{ github.workflow }}" | ||
| run-name: "Daily Repo Status" | ||
| jobs: | ||
| activation: | ||
| runs-on: ubuntu- | ||
| permissions: | ||
| contents: | ||
| outputs: | ||
| comment_id: "" | ||
| comment_repo: "" | ||
| steps: | ||
| - name: Setup | ||
| uses: github/gh-aw/actions/setup@58d1d157fbac0f1204798500faefc4f7461ebe28 # v0.45. | ||
| with: | ||
| destination: /opt/gh-aw/ | ||
| - name: Check workflow file | ||
| uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # | ||
| env: | ||
| GH_AW_WORKFLOW_FILE: "daily-repo-status.lock.yml" | ||
| with: | ||
| script: | | ||
| const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs'); | ||
| setupGlobals(core, github, context, exec, io); | ||
| const { main } = require('/opt/gh-aw/actions/check_workflow_timestamp_api.cjs'); | ||
| await main(); | ||
| agent: | ||
| needs: | ||
| runs-on: ubuntu- | ||
| permissions: | ||
| contents: | ||
| issues: | ||
| pull-requests: | ||
| concurrency: | ||
| group: "gh-aw-copilot-${{ github.workflow }}" | ||
| env: | ||
| DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} | ||
| GH_AW_ASSETS_ALLOWED_EXTS: "" | ||
| GH_AW_ASSETS_BRANCH: "" | ||
| GH_AW_ASSETS_MAX_SIZE_KB: | ||
| GH_AW_MCP_LOG_DIR: /tmp/gh-aw/mcp-logs/ | ||
| GH_AW_SAFE_OUTPUTS: /opt/gh-aw/safeoutputs/outputs. | ||
| GH_AW_SAFE_OUTPUTS_CONFIG_PATH: /opt/gh-aw/safeoutputs/config. | ||
| GH_AW_SAFE_OUTPUTS_TOOLS_PATH: /opt/gh-aw/safeoutputs/tools. | ||
| GH_AW_WORKFLOW_ID_SANITIZED: | ||
| outputs: | ||
| checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }} | ||
| has_patch: ${{ steps.collect_output.outputs.has_patch }} | ||
| model: ${{ steps.generate_aw_info.outputs.model }} | ||
| output: ${{ steps.collect_output.outputs.output }} | ||
| output_types: ${{ steps.collect_output.outputs.output_types }} | ||
| secret_verification_result: ${{ steps.validate-secret.outputs.verification_result }} | ||
| steps: | ||
| - name: Setup | ||
| uses: github/gh-aw/actions/setup@58d1d157fbac0f1204798500faefc4f7461ebe28 # v0.45. | ||
| with: | ||
| destination: /opt/gh-aw/ | ||
| - name: Checkout | ||
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0. | ||
| with: | ||
| persist-credentials: | ||
| - name: Create gh-aw temp | ||
| run: bash /opt/gh-aw/actions/create_gh_aw_tmp_dir. | ||
| - name: Configure Git | ||
| env: | ||
| REPO_NAME: ${{ github.repository }} | ||
| SERVER_URL: ${{ github.server_url }} | ||
| run: | | ||
| git config --global user.email "github-actions[bot]@users.noreply.github.com" | ||
| git config --global user.name "github-actions[bot]" | ||
| # Re-authenticate git with GitHub | ||
| SERVER_URL_STRIPPED="${SERVER_URL#https://}" | ||
| git remote set-url origin "https://x-access-token:${{ github.token }}@${SERVER_URL_STRIPPED}/${REPO_NAME}.git" | ||
| echo "Git configured with standard GitHub Actions identity" | ||
| - name: Checkout PR | ||
| id: checkout- | ||
| if: | | ||
| github.event. | ||
| uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # | ||
| env: | ||
| GH_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} | ||
| with: | ||
| github-token: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} | ||
| script: | | ||
| const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs'); | ||
| setupGlobals(core, github, context, exec, io); | ||
| const { main } = require('/opt/gh-aw/actions/checkout_pr_branch.cjs'); | ||
| await main(); | ||
| - name: Generate agentic run | ||
| id: | ||
| uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # | ||
| with: | ||
| script: | | ||
| const fs = require('fs'); | ||
| const awInfo = { | ||
| engine_id: "copilot", | ||
| engine_name: "GitHub Copilot CLI", | ||
| model: process.env.GH_AW_MODEL_AGENT_COPILOT || "", | ||
| version: "", | ||
| agent_version: "0.0.410", | ||
| cli_version: "v0.45.0", | ||
| workflow_name: "Daily Repo Status", | ||
| experimental: false, | ||
| supports_tools_allowlist: true, | ||
| supports_http_transport: true, | ||
| run_id: context.runId, | ||
| run_number: context.runNumber, | ||
| run_attempt: process.env.GITHUB_RUN_ATTEMPT, | ||
| repository: context.repo.owner + '/' + context.repo.repo, | ||
| ref: context.ref, | ||
| sha: context.sha, | ||
| actor: context.actor, | ||
| event_name: context.eventName, | ||
| staged: false, | ||
| allowed_domains: ["defaults"], | ||
| firewall_enabled: true, | ||
| awf_version: "v0.18.0", | ||
| awmg_version: "v0.1.4", | ||
| steps: { | ||
| firewall: "squid" | ||
| }, | ||
| created_at: new Date().toISOString() | ||
| }; | ||
| // Write to /tmp/gh-aw directory to avoid inclusion in | ||
| const tmpPath = '/tmp/gh-aw/aw_info.json'; | ||
| fs.writeFileSync(tmpPath, JSON.stringify(awInfo, null, 2)); | ||
| console.log('Generated aw_info.json at:', tmpPath); | ||
| console.log(JSON.stringify(awInfo, null, 2)); | ||
| // Set model as output for reuse in other steps/ | ||
| core.setOutput('model', awInfo.model); | ||
| - name: Validate COPILOT_GITHUB_TOKEN | ||
| id: validate- | ||
| run: /opt/gh-aw/actions/validate_multi_secret.sh COPILOT_GITHUB_TOKEN 'GitHub Copilot CLI' https://github.github.com/gh-aw/reference/engines/#github-copilot- | ||
| env: | ||
| COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }} | ||
| - name: Install GitHub Copilot | ||
| run: /opt/gh-aw/actions/install_copilot_cli.sh 0.0. | ||
| - name: Install awf | ||
| run: bash /opt/gh-aw/actions/install_awf_binary.sh v0.18. | ||
| - name: Download container | ||
| run: bash /opt/gh-aw/actions/download_docker_images.sh ghcr.io/github/gh-aw-firewall/agent:0.18.0 ghcr.io/github/gh-aw-firewall/squid:0.18.0 ghcr.io/github/gh-aw-mcpg:v0.1.4 ghcr.io/github/github-mcp-server:v0.30.3 node:lts- | ||
| - name: Write Safe Outputs | ||
| run: | | ||
| mkdir -p /opt/gh-aw/ | ||
| mkdir -p /tmp/gh-aw/ | ||
| mkdir -p /tmp/gh-aw/mcp-logs/ | ||
| cat > /opt/gh-aw/safeoutputs/config.json << 'GH_AW_SAFE_OUTPUTS_CONFIG_EOF' | ||
| {"create_issue":{"max":1},"missing_data":{},"missing_tool":{},"noop":{"max":1}} | ||
| cat > /opt/gh-aw/safeoutputs/tools.json << 'GH_AW_SAFE_OUTPUTS_TOOLS_EOF' | ||
| [ | ||
| { | ||
| "description": "Create a new GitHub issue for tracking bugs, feature requests, or tasks. Use this for actionable work items that need assignment, labeling, and status tracking. For reports, announcements, or status updates that don't require task tracking, use create_discussion instead. CONSTRAINTS: Maximum 1 issue(s) can be created. Title will be prefixed with \"[repo-status] \". Labels [report daily-status] will be automatically added.", | ||
| "inputSchema": { | ||
| "additionalProperties": false, | ||
| "properties": { | ||
| "body": { | ||
| "description": "Detailed issue description in Markdown. Do NOT repeat the title as a heading since it already appears as the issue's h1. Include context, reproduction steps, or acceptance criteria as appropriate.", | ||
| "type": "string" | ||
| }, | ||
| "labels": { | ||
| "description": "Labels to categorize the issue (e.g., 'bug', 'enhancement'). Labels must exist in the repository.", | ||
| "items": { | ||
| "type": "string" | ||
| }, | ||
| "type": "array" | ||
| }, | ||
| "parent": { | ||
| "description": "Parent issue number for creating sub-issues. This is the numeric ID from the GitHub URL (e.g., 42 in github.com/owner/repo/issues/42). Can also be a temporary_id (e.g., 'aw_abc123', 'aw_Test123') from a previously created issue in the same workflow run.", | ||
| "type": [ | ||
| "number", | ||
| "string" | ||
| ] | ||
| }, | ||
| "temporary_id": { | ||
| "description": "Unique temporary identifier for referencing this issue before it's created. Format: 'aw_' followed by 3 to 8 alphanumeric characters (e.g., 'aw_abc1', 'aw_Test123'). Use '#aw_ID' in body text to reference other issues by their temporary_id; these are replaced with actual issue numbers after creation.", | ||
| "pattern": "^aw_[A-Za-z0-9]{4,8}$", | ||
| "type": "string" | ||
| }, | ||
| "title": { | ||
| "description": "Concise issue title summarizing the bug, feature, or task. The title appears as the main heading, so keep it brief and descriptive.", | ||
| "type": "string" | ||
| } | ||
| }, | ||
| "required": [ | ||
| "title", | ||
| "body" | ||
| ], | ||
| "type": "object" | ||
| }, | ||
| "name": "create_issue" | ||
| }, | ||
| { | ||
| "description": "Report that a tool or capability needed to complete the task is not available, or share any information you deem important about missing functionality or limitations. Use this when you cannot accomplish what was requested because the required functionality is missing or access is restricted.", | ||
| "inputSchema": { | ||
| "additionalProperties": false, | ||
| "properties": { | ||
| "alternatives": { | ||
| "description": "Any workarounds, manual steps, or alternative approaches the user could take (max 256 characters).", | ||
| "type": "string" | ||
| }, | ||
| "reason": { | ||
| "description": "Explanation of why this tool is needed or what information you want to share about the limitation (max 256 characters).", | ||
| "type": "string" | ||
| }, | ||
| "tool": { | ||
| "description": "Optional: Name or description of the missing tool or capability (max 128 characters). Be specific about what functionality is needed.", | ||
| "type": "string" | ||
| } | ||
| }, | ||
| "required": [ | ||
| "reason" | ||
| ], | ||
| "type": "object" | ||
| }, | ||
| "name": "missing_tool" | ||
| }, | ||
| { | ||
| "description": "Log a transparency message when no significant actions are needed. Use this to confirm workflow completion and provide visibility when analysis is complete but no changes or outputs are required (e.g., 'No issues found', 'All checks passed'). This ensures the workflow produces human-visible output even when no other actions are taken.", | ||
| "inputSchema": { | ||
| "additionalProperties": false, | ||
| "properties": { | ||
| "message": { | ||
| "description": "Status or completion message to log. Should explain what was analyzed and the outcome (e.g., 'Code review complete - no issues found', 'Analysis complete - all tests passing').", | ||
| "type": "string" | ||
| } | ||
| }, | ||
| "required": [ | ||
| "message" | ||
| ], | ||
| "type": "object" | ||
| }, | ||
| "name": "noop" | ||
| }, | ||
| { | ||
| "description": "Report that data or information needed to complete the task is not available. Use this when you cannot accomplish what was requested because required data, context, or information is missing.", | ||
| "inputSchema": { | ||
| "additionalProperties": false, | ||
| "properties": { | ||
| "alternatives": { | ||
| "description": "Any workarounds, manual steps, or alternative approaches the user could take (max 256 characters).", | ||
| "type": "string" | ||
| }, | ||
| "context": { | ||
| "description": "Additional context about the missing data or where it should come from (max 256 characters).", | ||
| "type": "string" | ||
| }, | ||
| "data_type": { | ||
| "description": "Type or description of the missing data or information (max 128 characters). Be specific about what data is needed.", | ||
| "type": "string" | ||
| }, | ||
| "reason": { | ||
| "description": "Explanation of why this data is needed to complete the task (max 256 characters).", | ||
| "type": "string" | ||
| } | ||
| }, | ||
| "required": [], | ||
| "type": "object" | ||
| }, | ||
| "name": "missing_data" | ||
| } | ||
| ] | ||
| cat > /opt/gh-aw/safeoutputs/validation.json << 'GH_AW_SAFE_OUTPUTS_VALIDATION_EOF' | ||
| { | ||
| "create_issue": { | ||
| "defaultMax": 1, | ||
| "fields": { | ||
| "body": { | ||
| "required": true, | ||
| "type": "string", | ||
| "sanitize": true, | ||
| "maxLength": | ||
| }, | ||
| "labels": { | ||
| "type": "array", | ||
| "itemType": "string", | ||
| "itemSanitize": true, | ||
| "itemMaxLength": | ||
| }, | ||
| "parent": { | ||
| "issueOrPRNumber": | ||
| }, | ||
| "repo": { | ||
| "type": "string", | ||
| "maxLength": | ||
| }, | ||
| "temporary_id": { | ||
| "type": "string" | ||
| }, | ||
| "title": { | ||
| "required": true, | ||
| "type": "string", | ||
| "sanitize": true, | ||
| "maxLength": | ||
| } | ||
| } | ||
| }, | ||
| "missing_tool": { | ||
| "defaultMax": 20, | ||
| "fields": { | ||
| "alternatives": { | ||
| "type": "string", | ||
| "sanitize": true, | ||
| "maxLength": | ||
| }, | ||
| "reason": { | ||
| "required": true, | ||
| "type": "string", | ||
| "sanitize": true, | ||
| "maxLength": | ||
| }, | ||
| "tool": { | ||
| "type": "string", | ||
| "sanitize": true, | ||
| "maxLength": | ||
| } | ||
| } | ||
| }, | ||
| "noop": { | ||
| "defaultMax": 1, | ||
| "fields": { | ||
| "message": { | ||
| "required": true, | ||
| "type": "string", | ||
| "sanitize": true, | ||
| "maxLength": | ||
| } | ||
| } | ||
| } | ||
| } | ||
| - name: Generate Safe Outputs MCP Server | ||
| id: safe-outputs- | ||
| run: | | ||
| # Generate a secure random API key (360 bits of entropy, 40+ chars) | ||
| # Mask immediately to prevent timing | ||
| API_KEY=$(openssl rand -base64 45 | tr -d '/+=') | ||
| echo "::add-mask::${API_KEY}" | ||
| PORT= | ||
| # Set outputs for next | ||
| { | ||
| echo "safe_outputs_api_key=${API_KEY}" | ||
| echo "safe_outputs_port=${PORT}" | ||
| } >> "$GITHUB_OUTPUT" | ||
| echo "Safe Outputs MCP server will run on port ${PORT}" | ||
| - name: Start Safe Outputs MCP HTTP | ||
| id: safe-outputs- | ||
| env: | ||
| DEBUG: '*' | ||
| GH_AW_SAFE_OUTPUTS_PORT: ${{ steps.safe-outputs-config.outputs.safe_outputs_port }} | ||
| GH_AW_SAFE_OUTPUTS_API_KEY: ${{ steps.safe-outputs-config.outputs.safe_outputs_api_key }} | ||
| GH_AW_SAFE_OUTPUTS_TOOLS_PATH: /opt/gh-aw/safeoutputs/tools. | ||
| GH_AW_SAFE_OUTPUTS_CONFIG_PATH: /opt/gh-aw/safeoutputs/config. | ||
| GH_AW_MCP_LOG_DIR: /tmp/gh-aw/mcp-logs/ | ||
| run: | | ||
| # Environment variables are set above to prevent template | ||
| export | ||
| export | ||
| export | ||
| export | ||
| export | ||
| export | ||
| bash /opt/gh-aw/actions/start_safe_outputs_server. | ||
| - name: Start MCP | ||
| id: start-mcp- | ||
| env: | ||
| GH_AW_SAFE_OUTPUTS: ${{ env.GH_AW_SAFE_OUTPUTS }} | ||
| GH_AW_SAFE_OUTPUTS_API_KEY: ${{ steps.safe-outputs-start.outputs.api_key }} | ||
| GH_AW_SAFE_OUTPUTS_PORT: ${{ steps.safe-outputs-start.outputs.port }} | ||
| GITHUB_MCP_SERVER_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} | ||
| run: | | ||
| set -eo | ||
| mkdir -p /tmp/gh-aw/mcp- | ||
| # Export gateway environment variables for MCP config and gateway | ||
| export MCP_GATEWAY_PORT="80" | ||
| export MCP_GATEWAY_DOMAIN="host.docker.internal" | ||
| MCP_GATEWAY_API_KEY=$(openssl rand -base64 45 | tr -d '/+=') | ||
| echo "::add-mask::${MCP_GATEWAY_API_KEY}" | ||
| export | ||
| export MCP_GATEWAY_PAYLOAD_DIR="/tmp/gh-aw/mcp-payloads" | ||
| mkdir -p "${MCP_GATEWAY_PAYLOAD_DIR}" | ||
| export DEBUG="*" | ||
| export GH_AW_ENGINE="copilot" | ||
| export MCP_GATEWAY_DOCKER_COMMAND='docker run -i --rm --network host -v /var/run/docker.sock:/var/run/docker.sock -e MCP_GATEWAY_PORT -e MCP_GATEWAY_DOMAIN -e MCP_GATEWAY_API_KEY -e MCP_GATEWAY_PAYLOAD_DIR -e DEBUG -e MCP_GATEWAY_LOG_DIR -e GH_AW_MCP_LOG_DIR -e GH_AW_SAFE_OUTPUTS -e GH_AW_SAFE_OUTPUTS_CONFIG_PATH -e GH_AW_SAFE_OUTPUTS_TOOLS_PATH -e GH_AW_ASSETS_BRANCH -e GH_AW_ASSETS_MAX_SIZE_KB -e GH_AW_ASSETS_ALLOWED_EXTS -e DEFAULT_BRANCH -e GITHUB_MCP_SERVER_TOKEN -e GITHUB_MCP_LOCKDOWN -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e GITHUB_SHA -e GITHUB_WORKSPACE -e GITHUB_TOKEN -e GITHUB_RUN_ID -e GITHUB_RUN_NUMBER -e GITHUB_RUN_ATTEMPT -e GITHUB_JOB -e GITHUB_ACTION -e GITHUB_EVENT_NAME -e GITHUB_EVENT_PATH -e GITHUB_ACTOR -e GITHUB_ACTOR_ID -e GITHUB_TRIGGERING_ACTOR -e GITHUB_WORKFLOW -e GITHUB_WORKFLOW_REF -e GITHUB_WORKFLOW_SHA -e GITHUB_REF -e GITHUB_REF_NAME -e GITHUB_REF_TYPE -e GITHUB_HEAD_REF -e GITHUB_BASE_REF -e GH_AW_SAFE_OUTPUTS_PORT -e GH_AW_SAFE_OUTPUTS_API_KEY -v /tmp/gh-aw/mcp-payloads:/tmp/gh-aw/mcp-payloads:rw -v /opt:/opt:ro -v /tmp:/tmp:rw -v '"${GITHUB_WORKSPACE}"':'"${GITHUB_WORKSPACE}"':rw ghcr.io/github/gh-aw-mcpg:v0.1.4' | ||
| mkdir -p /home/runner/. | ||
| cat << GH_AW_MCP_CONFIG_EOF | bash /opt/gh-aw/actions/start_mcp_gateway. | ||
| { | ||
| "mcpServers": { | ||
| "github": { | ||
| "type": "stdio", | ||
| "container": "ghcr.io/github/github-mcp-server:v0.30.3", | ||
| "env": { | ||
| "GITHUB_PERSONAL_ACCESS_TOKEN": "\${GITHUB_MCP_SERVER_TOKEN}", | ||
| "GITHUB_READ_ONLY": "1", | ||
| "GITHUB_TOOLSETS": "context,repos,issues,pull_requests" | ||
| } | ||
| }, | ||
| "safeoutputs": { | ||
| "type": "http", | ||
| "url": "http://host.docker.internal:$GH_AW_SAFE_OUTPUTS_PORT", | ||
| "headers": { | ||
| "Authorization": "\${GH_AW_SAFE_OUTPUTS_API_KEY}" | ||
| } | ||
| } | ||
| }, | ||
| "gateway": { | ||
| "port": $MCP_GATEWAY_PORT, | ||
| "domain": "${MCP_GATEWAY_DOMAIN}", | ||
| "apiKey": "${MCP_GATEWAY_API_KEY}", | ||
| "payloadDir": "${MCP_GATEWAY_PAYLOAD_DIR}" | ||
| } | ||
| } | ||
| - name: Generate workflow | ||
| uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # | ||
| with: | ||
| script: | | ||
| const { generateWorkflowOverview } = require('/opt/gh-aw/actions/generate_workflow_overview.cjs'); | ||
| await generateWorkflowOverview(core); | ||
| - name: Create prompt with built-in | ||
| env: | ||
| GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt. | ||
| GH_AW_SAFE_OUTPUTS: ${{ env.GH_AW_SAFE_OUTPUTS }} | ||
| GH_AW_GITHUB_ACTOR: ${{ github.actor }} | ||
| GH_AW_GITHUB_EVENT_COMMENT_ID: ${{ github.event.comment.id }} | ||
| GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER: ${{ github.event.discussion.number }} | ||
| GH_AW_GITHUB_EVENT_ISSUE_NUMBER: ${{ github.event.issue.number }} | ||
| GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER: ${{ github.event.pull_request.number }} | ||
| GH_AW_GITHUB_REPOSITORY: ${{ github.repository }} | ||
| GH_AW_GITHUB_RUN_ID: ${{ github.run_id }} | ||
| GH_AW_GITHUB_WORKSPACE: ${{ github.workspace }} | ||
| run: | | ||
| bash /opt/gh-aw/actions/create_prompt_first. | ||
| cat << 'GH_AW_PROMPT_EOF' > "$GH_AW_PROMPT" | ||
| <system> | ||
| cat "/opt/gh-aw/prompts/xpia.md" >> "$GH_AW_PROMPT" | ||
| cat "/opt/gh-aw/prompts/temp_folder_prompt.md" >> "$GH_AW_PROMPT" | ||
| cat "/opt/gh-aw/prompts/markdown.md" >> "$GH_AW_PROMPT" | ||
| cat << 'GH_AW_PROMPT_EOF' >> "$GH_AW_PROMPT" | ||
| <safe-outputs> | ||
| <description>GitHub API Access Instructions</description> | ||
| <important> | ||
| The gh CLI is NOT authenticated. Do NOT use gh commands for GitHub operations. | ||
| </important> | ||
| <instructions> | ||
| To create or modify GitHub resources (issues, discussions, pull requests, etc.), you MUST call the appropriate safe output tool. Simply writing content will NOT work - the workflow requires actual tool calls. | ||
| Temporary IDs: Some safe output tools support a temporary ID field (usually named temporary_id) so you can reference newly-created items elsewhere in the SAME agent output (for example, using #aw_abc1 in a later body). | ||
| **IMPORTANT - temporary_id format rules:** | ||
| - If you DON'T need to reference the item later, OMIT the temporary_id field entirely (it will be auto-generated if needed) | ||
| - If you DO need cross-references/chaining, you MUST match this EXACT validation regex: /^aw_[A-Za-z0-9]{3,8}$/ | ||
| - Format: aw_ prefix followed by 3 to 8 alphanumeric characters (A-Z, a-z, 0-9, case-insensitive) | ||
| - Valid alphanumeric characters: | ||
| - INVALID examples: aw_ab (too short), aw_123456789 (too long), aw_test-id (contains hyphen), aw_id_123 (contains underscore) | ||
| - VALID examples: aw_abc, aw_abc1, aw_Test123, aw_A1B2C3D4, | ||
| - To generate valid IDs: use 3-8 random alphanumeric characters or omit the field to let the system auto- | ||
| Do NOT invent other aw_* formats — downstream steps will reject them with validation errors matching against /^aw_[A-Za-z0-9]{3,8}$/i. | ||
| Discover available tools from the safeoutputs MCP server. | ||
| **Critical**: Tool calls write structured data that downstream jobs process. Without tool calls, follow-up actions will be skipped. | ||
| **Note**: If you made no other safe output tool calls during this workflow execution, call the "noop" tool to provide a status message indicating completion or that no actions were needed. | ||
| </instructions> | ||
| </safe-outputs> | ||
| <github-context> | ||
| The following GitHub context information is available for this workflow: | ||
| {{#if __GH_AW_GITHUB_ACTOR__ }} | ||
| - **actor**: | ||
| {{/if}} | ||
| {{#if __GH_AW_GITHUB_REPOSITORY__ }} | ||
| - **repository**: | ||
| {{/if}} | ||
| {{#if __GH_AW_GITHUB_WORKSPACE__ }} | ||
| - **workspace**: | ||
| {{/if}} | ||
| {{#if __GH_AW_GITHUB_EVENT_ISSUE_NUMBER__ }} | ||
| - **issue-number**: # | ||
| {{/if}} | ||
| {{#if __GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER__ }} | ||
| - **discussion-number**: # | ||
| {{/if}} | ||
| {{#if __GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER__ }} | ||
| - **pull-request-number**: # | ||
| {{/if}} | ||
| {{#if __GH_AW_GITHUB_EVENT_COMMENT_ID__ }} | ||
| - **comment-id**: | ||
| {{/if}} | ||
| {{#if __GH_AW_GITHUB_RUN_ID__ }} | ||
| - **workflow-run-id**: | ||
| {{/if}} | ||
| </github-context> | ||
| cat << 'GH_AW_PROMPT_EOF' >> "$GH_AW_PROMPT" | ||
| </system> | ||
| cat << 'GH_AW_PROMPT_EOF' >> "$GH_AW_PROMPT" | ||
| {{#runtime-import .github/workflows/daily-repo-status.md}} | ||
| - name: Substitute | ||
| uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # | ||
| env: | ||
| GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt. | ||
| GH_AW_GITHUB_ACTOR: ${{ github.actor }} | ||
| GH_AW_GITHUB_EVENT_COMMENT_ID: ${{ github.event.comment.id }} | ||
| GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER: ${{ github.event.discussion.number }} | ||
| GH_AW_GITHUB_EVENT_ISSUE_NUMBER: ${{ github.event.issue.number }} | ||
| GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER: ${{ github.event.pull_request.number }} | ||
| GH_AW_GITHUB_REPOSITORY: ${{ github.repository }} | ||
| GH_AW_GITHUB_RUN_ID: ${{ github.run_id }} | ||
| GH_AW_GITHUB_WORKSPACE: ${{ github.workspace }} | ||
| with: | ||
| script: | | ||
| const substitutePlaceholders = require('/opt/gh-aw/actions/substitute_placeholders.cjs'); | ||
| // Call the substitution | ||
| return await substitutePlaceholders({ | ||
| file: process.env.GH_AW_PROMPT, | ||
| substitutions: { | ||
| GH_AW_GITHUB_ACTOR: process.env.GH_AW_GITHUB_ACTOR, | ||
| GH_AW_GITHUB_EVENT_COMMENT_ID: process.env.GH_AW_GITHUB_EVENT_COMMENT_ID, | ||
| GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER: process.env.GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER, | ||
| GH_AW_GITHUB_EVENT_ISSUE_NUMBER: process.env.GH_AW_GITHUB_EVENT_ISSUE_NUMBER, | ||
| GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER: process.env.GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER, | ||
| GH_AW_GITHUB_REPOSITORY: process.env.GH_AW_GITHUB_REPOSITORY, | ||
| GH_AW_GITHUB_RUN_ID: process.env.GH_AW_GITHUB_RUN_ID, | ||
| GH_AW_GITHUB_WORKSPACE: process.env. | ||
| } | ||
| }); | ||
| - name: Interpolate variables and render | ||
| uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # | ||
| env: | ||
| GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt. | ||
| with: | ||
| script: | | ||
| const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs'); | ||
| setupGlobals(core, github, context, exec, io); | ||
| const { main } = require('/opt/gh-aw/actions/interpolate_prompt.cjs'); | ||
| await main(); | ||
| - name: Validate prompt | ||
| env: | ||
| GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt. | ||
| run: bash /opt/gh-aw/actions/validate_prompt_placeholders. | ||
| - name: Print | ||
| env: | ||
| GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt. | ||
| run: bash /opt/gh-aw/actions/print_prompt_summary. | ||
| - name: Clean git | ||
| run: bash /opt/gh-aw/actions/clean_git_credentials. | ||
| - name: Execute GitHub Copilot | ||
| id: | ||
| # Copilot CLI tool arguments (sorted): | ||
| timeout-minutes: | ||
| run: | | ||
| set -o | ||
| sudo -E awf --env-all --container-workdir "${GITHUB_WORKSPACE}" --allow-domains api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,github.com,host.docker.internal,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,ppa.launchpad.net,raw.githubusercontent.com,registry.npmjs.org,s.symcb.com,s.symcd.com,security.ubuntu.com,telemetry.enterprise.githubcopilot.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com --log-level info --proxy-logs-dir /tmp/gh-aw/sandbox/firewall/logs --enable-host-access --image-tag 0.18.0 --skip-pull \ | ||
| -- /bin/bash -c '/usr/local/bin/copilot --add-dir /tmp/gh-aw/ --log-level all --log-dir /tmp/gh-aw/sandbox/agent/logs/ --add-dir "${GITHUB_WORKSPACE}" --disable-builtin-mcps --allow-all-tools --allow-all-paths --share /tmp/gh-aw/sandbox/agent/logs/conversation.md --prompt "$(cat /tmp/gh-aw/aw-prompts/prompt.txt)"${GH_AW_MODEL_AGENT_COPILOT:+ --model "$GH_AW_MODEL_AGENT_COPILOT"}' 2>&1 | tee -a /tmp/gh-aw/agent-stdio. | ||
| env: | ||
| COPILOT_AGENT_RUNNER_TYPE: | ||
| COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }} | ||
| GH_AW_MCP_CONFIG: /home/runner/.copilot/mcp-config. | ||
| GH_AW_MODEL_AGENT_COPILOT: ${{ vars.GH_AW_MODEL_AGENT_COPILOT || '' }} | ||
| GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt. | ||
| GH_AW_SAFE_OUTPUTS: ${{ env.GH_AW_SAFE_OUTPUTS }} | ||
| GITHUB_HEAD_REF: ${{ github.head_ref }} | ||
| GITHUB_REF_NAME: ${{ github.ref_name }} | ||
| GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }} | ||
| GITHUB_WORKSPACE: ${{ github.workspace }} | ||
| XDG_CONFIG_HOME: /home/ | ||
| - name: Configure Git | ||
| env: | ||
| REPO_NAME: ${{ github.repository }} | ||
| SERVER_URL: ${{ github.server_url }} | ||
| run: | | ||
| git config --global user.email "github-actions[bot]@users.noreply.github.com" | ||
| git config --global user.name "github-actions[bot]" | ||
| # Re-authenticate git with GitHub | ||
| SERVER_URL_STRIPPED="${SERVER_URL#https://}" | ||
| git remote set-url origin "https://x-access-token:${{ github.token }}@${SERVER_URL_STRIPPED}/${REPO_NAME}.git" | ||
| echo "Git configured with standard GitHub Actions identity" | ||
| - name: Copy Copilot session state files to | ||
| if: always() | ||
| continue-on-error: | ||
| run: | | ||
| # Copy Copilot session state files to logs folder for artifact | ||
| # This ensures they are in /tmp/gh-aw/ where secret redaction can scan | ||
| SESSION_STATE_DIR="$HOME/.copilot/session-state" | ||
| LOGS_DIR="/tmp/gh-aw/sandbox/agent/logs" | ||
| if [ -d "$SESSION_STATE_DIR" ]; | ||
| echo "Copying Copilot session state files from $SESSION_STATE_DIR to $LOGS_DIR" | ||
| mkdir -p "$LOGS_DIR" | ||
| cp -v "$SESSION_STATE_DIR"/*.jsonl "$LOGS_DIR/" 2>/dev/null || | ||
| echo "Session state files copied successfully" | ||
| echo "No session-state directory found at $SESSION_STATE_DIR" | ||
| - name: Stop MCP | ||
| if: always() | ||
| continue-on-error: | ||
| env: | ||
| MCP_GATEWAY_PORT: ${{ steps.start-mcp-gateway.outputs.gateway-port }} | ||
| MCP_GATEWAY_API_KEY: ${{ steps.start-mcp-gateway.outputs.gateway-api-key }} | ||
| GATEWAY_PID: ${{ steps.start-mcp-gateway.outputs.gateway-pid }} | ||
| run: | | ||
| bash /opt/gh-aw/actions/stop_mcp_gateway.sh "$GATEWAY_PID" | ||
| - name: Redact secrets in | ||
| if: always() | ||
| uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # | ||
| with: | ||
| script: | | ||
| const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs'); | ||
| setupGlobals(core, github, context, exec, io); | ||
| const { main } = require('/opt/gh-aw/actions/redact_secrets.cjs'); | ||
| await main(); | ||
| env: | ||
| GH_AW_SECRET_NAMES: 'COPILOT_GITHUB_TOKEN,GH_AW_GITHUB_MCP_SERVER_TOKEN,GH_AW_GITHUB_TOKEN,GITHUB_TOKEN' | ||
| SECRET_COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }} | ||
| SECRET_GH_AW_GITHUB_MCP_SERVER_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN }} | ||
| SECRET_GH_AW_GITHUB_TOKEN: ${{ secrets.GH_AW_GITHUB_TOKEN }} | ||
| SECRET_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
| - name: Upload Safe | ||
| if: always() | ||
| uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0. | ||
| with: | ||
| name: safe- | ||
| path: ${{ env.GH_AW_SAFE_OUTPUTS }} | ||
| if-no-files-found: | ||
| - name: Ingest agent | ||
| id: | ||
| if: always() | ||
| uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # | ||
| env: | ||
| GH_AW_SAFE_OUTPUTS: ${{ env.GH_AW_SAFE_OUTPUTS }} | ||
| GH_AW_ALLOWED_DOMAINS: "api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,github.com,host.docker.internal,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,ppa.launchpad.net,raw.githubusercontent.com,registry.npmjs.org,s.symcb.com,s.symcd.com,security.ubuntu.com,telemetry.enterprise.githubcopilot.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com" | ||
| GITHUB_SERVER_URL: ${{ github.server_url }} | ||
| GITHUB_API_URL: ${{ github.api_url }} | ||
| with: | ||
| script: | | ||
| const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs'); | ||
| setupGlobals(core, github, context, exec, io); | ||
| const { main } = require('/opt/gh-aw/actions/collect_ndjson_output.cjs'); | ||
| await main(); | ||
| - name: Upload sanitized agent | ||
| if: always() && env. | ||
| uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0. | ||
| with: | ||
| name: agent- | ||
| path: ${{ env.GH_AW_AGENT_OUTPUT }} | ||
| if-no-files-found: | ||
| - name: Upload engine output | ||
| uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0. | ||
| with: | ||
| name: | ||
| path: | | ||
| /tmp/gh-aw/sandbox/agent/logs/ | ||
| /tmp/gh-aw/redacted-urls. | ||
| if-no-files-found: | ||
| - name: Parse agent logs for step | ||
| if: always() | ||
| uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # | ||
| env: | ||
| GH_AW_AGENT_OUTPUT: /tmp/gh-aw/sandbox/agent/logs/ | ||
| with: | ||
| script: | | ||
| const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs'); | ||
| setupGlobals(core, github, context, exec, io); | ||
| const { main } = require('/opt/gh-aw/actions/parse_copilot_log.cjs'); | ||
| await main(); | ||
| - name: Parse MCP Gateway logs for step | ||
| if: always() | ||
| uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # | ||
| with: | ||
| script: | | ||
| const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs'); | ||
| setupGlobals(core, github, context, exec, io); | ||
| const { main } = require('/opt/gh-aw/actions/parse_mcp_gateway_log.cjs'); | ||
| await main(); | ||
| - name: Print firewall | ||
| if: always() | ||
| continue-on-error: | ||
| env: | ||
| AWF_LOGS_DIR: /tmp/gh-aw/sandbox/firewall/ | ||
| run: | | ||
| # Fix permissions on firewall logs so they can be uploaded as | ||
| # AWF runs with sudo, creating files owned by | ||
| sudo chmod -R a+r /tmp/gh-aw/sandbox/firewall/logs 2>/dev/null || | ||
| # Only run awf logs summary if awf command exists (it may not be installed if workflow failed before install step) | ||
| if command -v awf &> /dev/null; | ||
| awf logs summary | tee -a "$GITHUB_STEP_SUMMARY" | ||
| echo 'AWF binary not installed, skipping firewall log summary' | ||
| - name: Upload agent | ||
| if: always() | ||
| continue-on-error: | ||
| uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0. | ||
| with: | ||
| name: agent- | ||
| path: | | ||
| /tmp/gh-aw/aw-prompts/prompt. | ||
| /tmp/gh-aw/aw_info. | ||
| /tmp/gh-aw/mcp-logs/ | ||
| /tmp/gh-aw/sandbox/firewall/logs/ | ||
| /tmp/gh-aw/agent-stdio. | ||
| /tmp/gh-aw/agent/ | ||
| if-no-files-found: | ||
| conclusion: | ||
| needs: | ||
| - | ||
| - | ||
| - | ||
| - | ||
| if: (always()) && (needs.agent.result != 'skipped') | ||
| runs-on: ubuntu- | ||
| permissions: | ||
| contents: | ||
| issues: | ||
| outputs: | ||
| noop_message: ${{ steps.noop.outputs.noop_message }} | ||
| tools_reported: ${{ steps.missing_tool.outputs.tools_reported }} | ||
| total_count: ${{ steps.missing_tool.outputs.total_count }} | ||
| steps: | ||
| - name: Setup | ||
| uses: github/gh-aw/actions/setup@58d1d157fbac0f1204798500faefc4f7461ebe28 # v0.45. | ||
| with: | ||
| destination: /opt/gh-aw/ | ||
| - name: Download agent output | ||
| continue-on-error: | ||
| uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0. | ||
| with: | ||
| name: agent- | ||
| path: /tmp/gh-aw/safeoutputs/ | ||
| - name: Setup agent output environment | ||
| run: | | ||
| mkdir -p /tmp/gh-aw/safeoutputs/ | ||
| find "/tmp/gh-aw/safeoutputs/" -type f - | ||
| echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/safeoutputs/agent_output.json" >> "$GITHUB_ENV" | ||
| - name: Process No-Op | ||
| id: | ||
| uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # | ||
| env: | ||
| GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }} | ||
| GH_AW_NOOP_MAX: | ||
| GH_AW_WORKFLOW_NAME: "Daily Repo Status" | ||
| GH_AW_WORKFLOW_SOURCE: "githubnext/agentics/workflows/daily-repo-status.md@d19056381ba48cb1f7c78510c23069701fa7ae87" | ||
| GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/githubnext/agentics/tree/d19056381ba48cb1f7c78510c23069701fa7ae87/workflows/daily-repo-status.md" | ||
| with: | ||
| github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} | ||
| script: | | ||
| const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs'); | ||
| setupGlobals(core, github, context, exec, io); | ||
| const { main } = require('/opt/gh-aw/actions/noop.cjs'); | ||
| await main(); | ||
| - name: Record Missing | ||
| id: | ||
| uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # | ||
| env: | ||
| GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }} | ||
| GH_AW_WORKFLOW_NAME: "Daily Repo Status" | ||
| GH_AW_WORKFLOW_SOURCE: "githubnext/agentics/workflows/daily-repo-status.md@d19056381ba48cb1f7c78510c23069701fa7ae87" | ||
| GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/githubnext/agentics/tree/d19056381ba48cb1f7c78510c23069701fa7ae87/workflows/daily-repo-status.md" | ||
| with: | ||
| github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} | ||
| script: | | ||
| const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs'); | ||
| setupGlobals(core, github, context, exec, io); | ||
| const { main } = require('/opt/gh-aw/actions/missing_tool.cjs'); | ||
| await main(); | ||
| - name: Handle Agent | ||
| id: | ||
| uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # | ||
| env: | ||
| GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }} | ||
| GH_AW_WORKFLOW_NAME: "Daily Repo Status" | ||
| GH_AW_WORKFLOW_SOURCE: "githubnext/agentics/workflows/daily-repo-status.md@d19056381ba48cb1f7c78510c23069701fa7ae87" | ||
| GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/githubnext/agentics/tree/d19056381ba48cb1f7c78510c23069701fa7ae87/workflows/daily-repo-status.md" | ||
| GH_AW_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }} | ||
| GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }} | ||
| GH_AW_WORKFLOW_ID: "daily-repo-status" | ||
| GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.agent.outputs.secret_verification_result }} | ||
| GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }} | ||
| with: | ||
| github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} | ||
| script: | | ||
| const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs'); | ||
| setupGlobals(core, github, context, exec, io); | ||
| const { main } = require('/opt/gh-aw/actions/handle_agent_failure.cjs'); | ||
| await main(); | ||
| - name: Handle No-Op | ||
| id: | ||
| uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # | ||
| env: | ||
| GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }} | ||
| GH_AW_WORKFLOW_NAME: "Daily Repo Status" | ||
| GH_AW_WORKFLOW_SOURCE: "githubnext/agentics/workflows/daily-repo-status.md@d19056381ba48cb1f7c78510c23069701fa7ae87" | ||
| GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/githubnext/agentics/tree/d19056381ba48cb1f7c78510c23069701fa7ae87/workflows/daily-repo-status.md" | ||
| GH_AW_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }} | ||
| GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }} | ||
| GH_AW_NOOP_MESSAGE: ${{ steps.noop.outputs.noop_message }} | ||
| GH_AW_NOOP_REPORT_AS_ISSUE: "true" | ||
| with: | ||
| github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} | ||
| script: | | ||
| const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs'); | ||
| setupGlobals(core, github, context, exec, io); | ||
| const { main } = require('/opt/gh-aw/actions/handle_noop_message.cjs'); | ||
| await main(); | ||
| detection: | ||
| needs: | ||
| if: needs.agent.outputs.output_types != '' || needs.agent.outputs.has_patch == 'true' | ||
| runs-on: ubuntu- | ||
| permissions: {} | ||
| concurrency: | ||
| group: "gh-aw-copilot-${{ github.workflow }}" | ||
| timeout-minutes: | ||
| outputs: | ||
| success: ${{ steps.parse_results.outputs.success }} | ||
| steps: | ||
| - name: Setup | ||
| uses: github/gh-aw/actions/setup@58d1d157fbac0f1204798500faefc4f7461ebe28 # v0.45. | ||
| with: | ||
| destination: /opt/gh-aw/ | ||
| - name: Download agent | ||
| continue-on-error: | ||
| uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0. | ||
| with: | ||
| name: agent- | ||
| path: /tmp/gh-aw/threat-detection/ | ||
| - name: Download agent output | ||
| continue-on-error: | ||
| uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0. | ||
| with: | ||
| name: agent- | ||
| path: /tmp/gh-aw/threat-detection/ | ||
| - name: Echo agent output | ||
| env: | ||
| AGENT_OUTPUT_TYPES: ${{ needs.agent.outputs.output_types }} | ||
| run: | | ||
| echo "Agent output-types: $AGENT_OUTPUT_TYPES" | ||
| - name: Setup threat | ||
| uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # | ||
| env: | ||
| WORKFLOW_NAME: "Daily Repo Status" | ||
| WORKFLOW_DESCRIPTION: "This workflow creates daily repo status reports. It gathers recent repository\nactivity (issues, PRs, discussions, releases, code changes) and generates\nengaging GitHub issues with productivity insights, community highlights,\nand project recommendations." | ||
| HAS_PATCH: ${{ needs.agent.outputs.has_patch }} | ||
| with: | ||
| script: | | ||
| const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs'); | ||
| setupGlobals(core, github, context, exec, io); | ||
| const { main } = require('/opt/gh-aw/actions/setup_threat_detection.cjs'); | ||
| await main(); | ||
| - name: Ensure threat-detection directory and | ||
| run: | | ||
| mkdir -p /tmp/gh-aw/threat- | ||
| touch /tmp/gh-aw/threat-detection/detection. | ||
| - name: Validate COPILOT_GITHUB_TOKEN | ||
| id: validate- | ||
| run: /opt/gh-aw/actions/validate_multi_secret.sh COPILOT_GITHUB_TOKEN 'GitHub Copilot CLI' https://github.github.com/gh-aw/reference/engines/#github-copilot- | ||
| env: | ||
| COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }} | ||
| - name: Install GitHub Copilot | ||
| run: /opt/gh-aw/actions/install_copilot_cli.sh 0.0. | ||
| - name: Execute GitHub Copilot | ||
| id: | ||
| # Copilot CLI tool arguments (sorted): | ||
| # --allow-tool shell(cat) | ||
| # --allow-tool shell(grep) | ||
| # --allow-tool shell(head) | ||
| # --allow-tool shell(jq) | ||
| # --allow-tool shell(ls) | ||
| # --allow-tool shell(tail) | ||
| # --allow-tool shell(wc) | ||
| timeout-minutes: | ||
| run: | | ||
| set -o | ||
| COPILOT_CLI_INSTRUCTION="$(cat /tmp/gh-aw/aw-prompts/prompt.txt)" | ||
| mkdir -p /tmp/ | ||
| mkdir -p /tmp/gh-aw/ | ||
| mkdir -p /tmp/gh-aw/agent/ | ||
| mkdir -p /tmp/gh-aw/sandbox/agent/logs/ | ||
| copilot --add-dir /tmp/ --add-dir /tmp/gh-aw/ --add-dir /tmp/gh-aw/agent/ --log-level all --log-dir /tmp/gh-aw/sandbox/agent/logs/ --disable-builtin-mcps --allow-tool 'shell(cat)' --allow-tool 'shell(grep)' --allow-tool 'shell(head)' --allow-tool 'shell(jq)' --allow-tool 'shell(ls)' --allow-tool 'shell(tail)' --allow-tool 'shell(wc)' --share /tmp/gh-aw/sandbox/agent/logs/conversation.md --prompt "$COPILOT_CLI_INSTRUCTION"${GH_AW_MODEL_DETECTION_COPILOT:+ --model "$GH_AW_MODEL_DETECTION_COPILOT"} 2>&1 | tee /tmp/gh-aw/threat-detection/detection. | ||
| env: | ||
| COPILOT_AGENT_RUNNER_TYPE: | ||
| COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }} | ||
| GH_AW_MODEL_DETECTION_COPILOT: ${{ vars.GH_AW_MODEL_DETECTION_COPILOT || '' }} | ||
| GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt. | ||
| GITHUB_HEAD_REF: ${{ github.head_ref }} | ||
| GITHUB_REF_NAME: ${{ github.ref_name }} | ||
| GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }} | ||
| GITHUB_WORKSPACE: ${{ github.workspace }} | ||
| XDG_CONFIG_HOME: /home/ | ||
| - name: Parse threat detection | ||
| id: | ||
| uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # | ||
| with: | ||
| script: | | ||
| const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs'); | ||
| setupGlobals(core, github, context, exec, io); | ||
| const { main } = require('/opt/gh-aw/actions/parse_threat_detection_results.cjs'); | ||
| await main(); | ||
| - name: Upload threat detection | ||
| if: always() | ||
| uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0. | ||
| with: | ||
| name: threat-detection. | ||
| path: /tmp/gh-aw/threat-detection/detection. | ||
| if-no-files-found: | ||
| safe_outputs: | ||
| needs: | ||
| - | ||
| - | ||
| if: ((!cancelled()) && (needs.agent.result != 'skipped')) && (needs.detection.outputs.success == 'true') | ||
| runs-on: ubuntu- | ||
| permissions: | ||
| contents: | ||
| issues: | ||
| timeout-minutes: | ||
| env: | ||
| GH_AW_ENGINE_ID: "copilot" | ||
| GH_AW_WORKFLOW_ID: "daily-repo-status" | ||
| GH_AW_WORKFLOW_NAME: "Daily Repo Status" | ||
| GH_AW_WORKFLOW_SOURCE: "githubnext/agentics/workflows/daily-repo-status.md@d19056381ba48cb1f7c78510c23069701fa7ae87" | ||
| GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/githubnext/agentics/tree/d19056381ba48cb1f7c78510c23069701fa7ae87/workflows/daily-repo-status.md" | ||
| outputs: | ||
| create_discussion_error_count: ${{ steps.process_safe_outputs.outputs.create_discussion_error_count }} | ||
| create_discussion_errors: ${{ steps.process_safe_outputs.outputs.create_discussion_errors }} | ||
| process_safe_outputs_processed_count: ${{ steps.process_safe_outputs.outputs.processed_count }} | ||
| process_safe_outputs_temporary_id_map: ${{ steps.process_safe_outputs.outputs.temporary_id_map }} | ||
| steps: | ||
| - name: Setup | ||
| uses: github/gh-aw/actions/setup@58d1d157fbac0f1204798500faefc4f7461ebe28 # v0.45. | ||
| with: | ||
| destination: /opt/gh-aw/ | ||
| - name: Download agent output | ||
| continue-on-error: | ||
| uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0. | ||
| with: | ||
| name: agent- | ||
| path: /tmp/gh-aw/safeoutputs/ | ||
| - name: Setup agent output environment | ||
| run: | | ||
| mkdir -p /tmp/gh-aw/safeoutputs/ | ||
| find "/tmp/gh-aw/safeoutputs/" -type f - | ||
| echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/safeoutputs/agent_output.json" >> "$GITHUB_ENV" | ||
| - name: Process Safe | ||
| id: | ||
| uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # | ||
| env: | ||
| GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }} | ||
| GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"create_issue\":{\"labels\":[\"report\",\"daily-status\"],\"max\":1,\"title_prefix\":\"[repo-status] \"},\"missing_data\":{},\"missing_tool\":{}}" | ||
| with: | ||
| github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} | ||
| script: | | ||
| const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs'); | ||
| setupGlobals(core, github, context, exec, io); | ||
| const { main } = require('/opt/gh-aw/actions/safe_output_handler_manager.cjs'); | ||
| await main(); | ||
