OpenCode
68a9071cf1
Local branch had diverged from origin/master (sibling commits on the same base). Rewrote local history linearly on top of origin/master, folding in all local content: exa/hot-platform discovery hunters, leaks ledger, nightly sweep orchestrator, updated .gitignore and skill docs, plus the latest hunt output and vault state. Remote-only files (vault keys, channel scripts) were restored rather than dropped, so the resulting tree is a full union of both sides.
1 line
220 KiB
JSON
1 line
220 KiB
JSON
{"repo": "arp-0515/automatic-barrier", "files": {".github/workflows/issue-triage.lock.yml": {"e2cebed0e1db5b318580a02ad700fd2aa28b8a23": {"t": 1786068427.8496704, "n": 113203, "h": "1061e698b5a05f8d", "c": "# gh-aw-metadata: {\"schema_version\":\"v4\",\"frontmatter_hash\":\"d97ec983e46af9c19acaeff0a0c1e66f28ea71844285f8fa3db1a46f02757fec\",\"body_hash\":\"a7dd6dc846c988e38b3e0292da02e0796f06da1e92c9fda5fb4724b52fd5c290\",\"compiler_version\":\"v0.79.4\",\"strict\":true,\"agent_id\":\"codex\",\"agent_model\":\"gpt-5.4\",\"engine_versions\":{\"codex\":\"0.137.0\"}}\n# gh-aw-manifest: {\"version\":1,\"secrets\":[\"CODEX_API_KEY\",\"GH_AW_GITHUB_MCP_SERVER_TOKEN\",\"GH_AW_GITHUB_TOKEN\",\"GITHUB_TOKEN\",\"OPENAI_API_KEY\",\"PIXEL_API_KEY\"],\"actions\":[{\"repo\":\"actions/checkout\",\"sha\":\"df4cb1c069e1874edd31b4311f1884172cec0e10\",\"version\":\"v6.0.3\"},{\"repo\":\"actions/download-artifact\",\"sha\":\"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c\",\"version\":\"v8.0.1\"},{\"repo\":\"actions/github-script\",\"sha\":\"3a2844b7e9c422d3c10d287c895573f7108da1b3\",\"version\":\"v9.0.0\"},{\"repo\":\"actions/setup-node\",\"sha\":\"48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e\",\"version\":\"v6.4.0\"},{\"repo\":\"actions/upload-artifact\",\"sha\":\"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a\",\"version\":\"v7.0.1\"},{\"repo\":\"github/gh-aw-actions/setup\",\"sha\":\"7cfd95b59ca996b7e2bebd6222e21ddd187a4e91\",\"version\":\"v0.79.4\"}],\"containers\":[{\"image\":\"ghcr.io/github/gh-aw-firewall/agent:0.27.0\"},{\"image\":\"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.0\"},{\"image\":\"ghcr.io/github/gh-aw-firewall/squid:0.27.0\"},{\"image\":\"ghcr.io/github/gh-aw-mcpg:v0.3.25\",\"digest\":\"sha256:c10331ad17668ef89f38f5e356678788a40b0cd5fef96e8f92e1d9c1de47cbaa\",\"pinned_image\":\"ghcr.io/github/gh-aw-mcpg:v0.3.25@sha256:c10331ad17668ef89f38f5e356678788a40b0cd5fef96e8f92e1d9c1de47cbaa\"},{\"image\":\"ghcr.io/github/github-mcp-server:v1.1.2\",\"digest\":\"sha256:30197479d8036c7811892bc07e06f9a05c9ef3cdd79bc59f256d50647f95788c\",\"pinned_image\":\"ghcr.io/github/github-mcp-server:v1.1.2@sha256:30197479d8036c7811892bc07e06f9a05c9ef3cdd79bc59f256d50647f95788c\"},{\"image\":\"node:lts-alpine\",\"digest\":\"sha256:2bdb65ed1dab192432bc31c95f94155ca5ad7fc1392fb7eb7526ab682fa5bf14\",\"pinned_image\":\"node:lts-alpine@sha256:2bdb65ed1dab192432bc31c95f94155ca5ad7fc1392fb7eb7526ab682fa5bf14\"}]}\n# ___ _ _ \n# / _ \\ | | (_) \n# | |_| | __ _ ___ _ __ | |_ _ ___ \n# | _ |/ _` |/ _ \\ '_ \\| __| |/ __|\n# | | | | (_| | __/ | | | |_| | (__ \n# \\_| |_/\\__, |\\___|_| |_|\\__|_|\\___|\n# __/ |\n# _ _ |___/ \n# | | | | / _| |\n# | | | | ___ _ __ _ __| |_| | _____ ____\n# | |/\\| |/ _ \\ '__| |/ /| _| |/ _ \\ \\ /\\ / / ___|\n# \\ /\\ / (_) | | | | ( | | | | (_) \\ V V /\\__ \\\n# \\/ \\/ \\___/|_| |_|\\_\\|_| |_|\\___/ \\_/\\_/ |___/\n#\n# This file was automatically generated by gh-aw (v0.79.4). DO NOT EDIT.\n#\n# To update this file, edit the corresponding .md file and run:\n# gh aw compile\n# Not all edits will cause changes to this file.\n#\n# For more information: https://github.github.com/gh-aw/introduction/overview/\n#\n# 对新打开的 issue 进行分类、打标签，并路由到对应的处理工作流\n#\n# Resolved workflow manifest:\n# Imports:\n# - shared/engine.md\n# - shared/network.md\n#\n# Secrets used:\n# - CODEX_API_KEY\n# - GH_AW_GITHUB_MCP_SERVER_TOKEN\n# - GH_AW_GITHUB_TOKEN\n# - GITHUB_TOKEN\n# - OPENAI_API_KEY\n# - PIXEL_API_KEY\n#\n# Custom actions used:\n# - actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3\n# - actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1\n# - actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n# - actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0\n# - actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1\n# - github/gh-aw-actions/setup@7cfd95b59ca996b7e2bebd6222e21ddd187a4e91 # v0.79.4\n#\n# Container images used:\n# - ghcr.io/github/gh-aw-firewall/agent:0.27.0\n# - ghcr.io/github/gh-aw-firewall/api-proxy:0.27.0\n# - ghcr.io/github/gh-aw-firewall/squid:0.27.0\n# - ghcr.io/github/gh-aw-mcpg:v0.3.25@sha256:c10331ad17668ef89f38f5e356678788a40b0cd5fef96e8f92e1d9c1de47cbaa\n# - ghcr.io/github/github-mcp-server:v1.1.2@sha256:30197479d8036c7811892bc07e06f9a05c9ef3cdd79bc59f256d50647f95788c\n# - node:lts-alpine@sha256:2bdb65ed1dab192432bc31c95f94155ca5ad7fc1392fb7eb7526ab682fa5bf14\n\nname: \"Issue Triage\"\non:\n issues:\n types:\n - opened\n - reopened\n # roles: all # Roles processed as role check in pre-activation job\n workflow_dispatch:\n inputs:\n aw_context:\n default: \"\"\n description: \"Agent caller context (used internally by Agentic Workflows).\"\n required: false\n type: string\n issue_number:\n description: 要分类的 issue 编号\n required: true\n type: string\n\npermissions: {}\n\nconcurrency:\n group: \"gh-aw-${{ github.workflow }}-${{ github.event.issue.number || github.run_id }}\"\n\nrun-name: \"Issue Triage\"\n\njobs:\n activation:\n runs-on: ubuntu-slim\n permissions:\n actions: read\n contents: read\n env:\n GH_AW_MAX_DAILY_AI_CREDITS: ${{ vars.GH_AW_DEFAULT_MAX_DAILY_AI_CREDITS || '5000' }}\n outputs:\n body: ${{ steps.sanitized.outputs.body }}\n comment_id: \"\"\n comment_repo: \"\"\n daily_effective_workflow_exceeded: ${{ steps.daily-effective-workflow-guardrail.outputs.daily_effective_workflow_exceeded == 'true' }}\n daily_effective_workflow_threshold: ${{ steps.daily-effective-workflow-guardrail.outputs.daily_effective_workflow_threshold || '' }}\n daily_effective_workflow_total_effective_tokens: ${{ steps.daily-effective-workflow-guardrail.outputs.daily_effective_workflow_total_effective_tokens || '' }}\n engine_id: ${{ steps.generate_aw_info.outputs.engine_id }}\n lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }}\n model: ${{ steps.generate_aw_info.outputs.model }}\n secret_verification_result: ${{ steps.validate-secret.outputs.verification_result }}\n setup-parent-span-id: ${{ steps.setup.outputs.parent-span-id || steps.setup.outputs.span-id }}\n setup-span-id: ${{ steps.setup.outputs.span-id }}\n setup-trace-id: ${{ steps.setup.outputs.trace-id }}\n stale_lock_file_failed: ${{ steps.check-lock-file.outputs.stale_lock_file_failed == 'true' }}\n text: ${{ steps.sanitized.outputs.text }}\n title: ${{ steps.sanitized.outputs.title }}\n steps:\n - name: Setup Scripts\n id: setup\n uses: github/gh-aw-actions/setup@7cfd95b59ca996b7e2bebd6222e21ddd187a4e91 # v0.79.4\n with:\n destination: ${{ runner.temp }}/gh-aw/actions\n job-name: ${{ github.job }}\n safe-output-artifact-client: ${{ env.GH_AW_MAX_DAILY_AI_CREDITS != '' }}\n env:\n GH_AW_SETUP_WORKFLOW_NAME: \"Issue Triage\"\n GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/issue-triage.lock.yml@${{ github.ref }}\n GH_AW_INFO_VERSION: \"0.137.0\"\n GH_AW_INFO_AWF_VERSION: \"v0.27.0\"\n GH_AW_INFO_ENGINE_ID: \"codex\"\n - name: Generate agentic run info\n id: generate_aw_info\n env:\n GH_AW_INFO_ENGINE_ID: \"codex\"\n GH_AW_INFO_ENGINE_NAME: \"Codex\"\n GH_AW_INFO_MODEL: \"gpt-5.4\"\n GH_AW_INFO_VERSION: \"0.137.0\"\n GH_AW_INFO_AGENT_VERSION: \"0.137.0\"\n GH_AW_INFO_CLI_VERSION: \"v0.79.4\"\n GH_AW_INFO_WORKFLOW_NAME: \"Issue Triage\"\n GH_AW_INFO_EXPERIMENTAL: \"false\"\n GH_AW_INFO_SUPPORTS_TOOLS_ALLOWLIST: \"true\"\n GH_AW_INFO_STAGED: \"false\"\n GH_AW_INFO_ALLOWED_DOMAINS: '[\"ai-pixel.online\",\"api-inference.modelscope.cn\",\"api.commandcode.ai\",\"api.deepseek.com\",\"api.minimaxi.com\",\"defaults\",\"open.bigmodel.cn\",\"opencode.ai\"]'\n GH_AW_INFO_FIREWALL_ENABLED: \"true\"\n GH_AW_INFO_AWF_VERSION: \"v0.27.0\"\n GH_AW_INFO_AWMG_VERSION: \"\"\n GH_AW_INFO_FIREWALL_TYPE: \"squid\"\n GH_AW_COMPILED_STRICT: \"true\"\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n with:\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/generate_aw_info.cjs');\n await main(core, context);\n - name: Check daily workflow token guardrail\n id: daily-effective-workflow-guardrail\n if: ${{ env.GH_AW_MAX_DAILY_AI_CREDITS != '' }}\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n env:\n GH_AW_WORKFLOW_NAME: \"Issue Triage\"\n GH_AW_WORKFLOW_ID: \"issue-triage\"\n GH_AW_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}\n GH_AW_WORKFLOW_DISPATCH_AW_CONTEXT: ${{ github.event.inputs.aw_context || '' }}\n GH_AW_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}\n GH_AW_MAX_DAILY_AI_CREDITS: ${{ vars.GH_AW_DEFAULT_MAX_DAILY_AI_CREDITS || '5000' }}\n with:\n github-token: ${{ secrets.GITHUB_TOKEN }}\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/check_daily_aic_workflow_guardrail.cjs');\n await main();\n - name: Validate CODEX_API_KEY or OPENAI_API_KEY secret\n id: validate-secret\n run: bash \"${RUNNER_TEMP}/gh-aw/actions/validate_multi_secret.sh\" CODEX_API_KEY OPENAI_API_KEY Codex https://github.github.com/gh-aw/reference/engines/#openai-codex\n env:\n CODEX_API_KEY: ${{ secrets.CODEX_API_KEY }}\n OPENAI_API_KEY: ${{ secrets.PIXEL_API_KEY }}\n - name: Checkout .github and .agents folders\n uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3\n with:\n persist-credentials: false\n sparse-checkout: |\n .github\n .agents\n .antigravity\n .claude\n .codex\n .crush\n .gemini\n .opencode\n .pi\n sparse-checkout-cone-mode: true\n fetch-depth: 1\n - name: Save agent config folders for base branch restoration\n env:\n GH_AW_AGENT_FOLDERS: \".agents .antigravity .claude .codex .crush .gemini .github .opencode .pi\"\n GH_AW_AGENT_FILES: \".crush.json AGENTS.md ANTIGRAVITY.md CLAUDE.md GEMINI.md PI.md opencode.jsonc\"\n # poutine:ignore untrusted_checkout_exec\n run: bash \"${RUNNER_TEMP}/gh-aw/actions/save_base_github_folders.sh\"\n - name: Check workflow lock file\n id: check-lock-file\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n env:\n GH_AW_WORKFLOW_FILE: \"issue-triage.lock.yml\"\n GH_AW_CONTEXT_WORKFLOW_REF: \"${{ github.workflow_ref }}\"\n with:\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/check_workflow_timestamp_api.cjs');\n await main();\n - name: Check compile-agentic version\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n env:\n GH_AW_COMPILED_VERSION: \"v0.79.4\"\n with:\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/check_version_updates.cjs');\n await main();\n - name: Compute current body text\n id: sanitized\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n env:\n GH_AW_ALLOWED_DOMAINS: \"172.30.0.1,ai-pixel.online,api-inference.modelscope.cn,api.commandcode.ai,api.deepseek.com,api.minimaxi.com,api.openai.com,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,chatgpt.com,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,host.docker.internal,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,open.bigmodel.cn,openai.com,opencode.ai,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,ppa.launchpad.net,s.symcb.com,s.symcd.com,security.ubuntu.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com,www.googleapis.com\"\n with:\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/compute_text.cjs');\n await main();\n - name: Create prompt with built-in context\n env:\n GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt\n GH_AW_SAFE_OUTPUTS: ${{ runner.temp }}/gh-aw/safeoutputs/outputs.jsonl\n GH_AW_EXPR_1A3A194A: ${{ github.event.discussion.number || (fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_type == 'discussion' && fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_number) }}\n GH_AW_EXPR_463A214A: ${{ github.event.pull_request.number || (fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_type == 'pull_request' && fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_number) }}\n GH_AW_EXPR_54492A5B: ${{ github.event.issue.number || inputs.issue_number }}\n GH_AW_EXPR_802A9F6A: ${{ github.event.issue.number || (fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_type == 'issue' && fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_number) }}\n GH_AW_EXPR_FF1D34CE: ${{ github.event.comment.id || fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').comment_id }}\n GH_AW_GITHUB_ACTOR: ${{ github.actor }}\n GH_AW_GITHUB_EVENT_ISSUE_TITLE: ${{ github.event.issue.title }}\n GH_AW_GITHUB_REPOSITORY: ${{ github.repository }}\n GH_AW_GITHUB_RUN_ID: ${{ github.run_id }}\n GH_AW_GITHUB_WORKSPACE: ${{ github.workspace }}\n GH_AW_INPUTS_ISSUE_NUMBER: ${{ inputs.issue_number }}\n # poutine:ignore untrusted_checkout_exec\n run: |\n bash \"${RUNNER_TEMP}/gh-aw/actions/create_prompt_first.sh\"\n {\n cat << 'GH_AW_PROMPT_9e10a58f1e12d9c2_EOF'\n <system>\n GH_AW_PROMPT_9e10a58f1e12d9c2_EOF\n cat \"${RUNNER_TEMP}/gh-aw/prompts/xpia.md\"\n cat \"${RUNNER_TEMP}/gh-aw/prompts/temp_folder_prompt.md\"\n cat \"${RUNNER_TEMP}/gh-aw/prompts/markdown.md\"\n cat \"${RUNNER_TEMP}/gh-aw/prompts/safe_outputs_prompt.md\"\n cat << 'GH_AW_PROMPT_9e10a58f1e12d9c2_EOF'\n <safe-output-tools>\n Tools: add_comment, add_labels(max:2), call_workflow, missing_tool, missing_data, noop\n </safe-output-tools>\n GH_AW_PROMPT_9e10a58f1e12d9c2_EOF\n cat \"${RUNNER_TEMP}/gh-aw/prompts/mcp_cli_tools_prompt.md\"\n cat << 'GH_AW_PROMPT_9e10a58f1e12d9c2_EOF'\n <github-context>\n The following GitHub context information is available for this workflow:\n {{#if github.actor}}\n - **actor**: __GH_AW_GITHUB_ACTOR__\n {{/if}}\n {{#if github.repository}}\n - **repository**: __GH_AW_GITHUB_REPOSITORY__\n {{/if}}\n {{#if github.workspace}}\n - **workspace**: __GH_AW_GITHUB_WORKSPACE__\n {{/if}}\n {{#if github.event.issue.number || (github.aw.context.item_type == 'issue' && github.aw.context.item_number)}}\n - **issue-number**: #__GH_AW_EXPR_802A9F6A__\n {{/if}}\n {{#if github.event.discussion.number || (github.aw.context.item_type == 'discussion' && github.aw.context.item_number)}}\n - **discussion-number**: #__GH_AW_EXPR_1A3A194A__\n {{/if}}\n {{#if github.event.pull_request.number || (github.aw.context.item_type == 'pull_request' && github.aw.context.item_number)}}\n - **pull-request-number**: #__GH_AW_EXPR_463A214A__\n {{/if}}\n {{#if github.event.comment.id || github.aw.context.comment_id}}\n - **comment-id**: __GH_AW_EXPR_FF1D34CE__\n {{/if}}\n {{#if github.run_id}}\n - **workflow-run-id**: __GH_AW_GITHUB_RUN_ID__\n {{/if}}\n </github-context>\n \n GH_AW_PROMPT_9e10a58f1e12d9c2_EOF\n cat \"${RUNNER_TEMP}/gh-aw/prompts/github_mcp_tools_with_safeoutputs_prompt.md\"\n cat << 'GH_AW_PROMPT_9e10a58f1e12d9c2_EOF'\n </system>\n {{#runtime-import .github/workflows/shared/engine.md}}\n {{#runtime-import .github/workflows/shared/network.md}}\n {{#runtime-import .github/workflows/issue-triage.md}}\n GH_AW_PROMPT_9e10a58f1e12d9c2_EOF\n } > \"$GH_AW_PROMPT\"\n - name: Interpolate variables and render templates\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n env:\n GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt\n GH_AW_ENGINE_ID: \"codex\"\n GH_AW_GITHUB_ACTOR: ${{ github.actor }}\n GH_AW_EXPR_54492A5B: ${{ github.event.issue.number || inputs.issue_number }}\n GH_AW_GITHUB_EVENT_ISSUE_TITLE: ${{ github.event.issue.title }}\n GH_AW_GITHUB_REPOSITORY: ${{ github.repository }}\n GH_AW_INPUTS_ISSUE_NUMBER: ${{ inputs.issue_number }}\n with:\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/interpolate_prompt.cjs');\n await main();\n - name: Substitute placeholders\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n env:\n GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt\n GH_AW_EXPR_1A3A194A: ${{ github.event.discussion.number || (fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_type == 'discussion' && fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_number) }}\n GH_AW_EXPR_463A214A: ${{ github.event.pull_request.number || (fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_type == 'pull_request' && fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_number) }}\n GH_AW_EXPR_54492A5B: ${{ github.event.issue.number || inputs.issue_number }}\n GH_AW_EXPR_802A9F6A: ${{ github.event.issue.number || (fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_type == 'issue' && fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_number) }}\n GH_AW_EXPR_FF1D34CE: ${{ github.event.comment.id || fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').comment_id }}\n GH_AW_GITHUB_ACTOR: ${{ github.actor }}\n GH_AW_GITHUB_EVENT_ISSUE_TITLE: ${{ github.event.issue.title }}\n GH_AW_GITHUB_REPOSITORY: ${{ github.repository }}\n GH_AW_GITHUB_RUN_ID: ${{ github.run_id }}\n GH_AW_GITHUB_WORKSPACE: ${{ github.workspace }}\n GH_AW_INPUTS_ISSUE_NUMBER: ${{ inputs.issue_number }}\n GH_AW_MCP_CLI_SERVERS_LIST: '- `safeoutputs` — run `safeoutputs --help` to see available tools'\n with:\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n \n const substitutePlaceholders = require('${{ runner.temp }}/gh-aw/actions/substitute_placeholders.cjs');\n \n // Call the substitution function\n return await substitutePlaceholders({\n file: process.env.GH_AW_PROMPT,\n substitutions: {\n GH_AW_EXPR_1A3A194A: process.env.GH_AW_EXPR_1A3A194A,\n GH_AW_EXPR_463A214A: process.env.GH_AW_EXPR_463A214A,\n GH_AW_EXPR_54492A5B: process.env.GH_AW_EXPR_54492A5B,\n GH_AW_EXPR_802A9F6A: process.env.GH_AW_EXPR_802A9F6A,\n GH_AW_EXPR_FF1D34CE: process.env.GH_AW_EXPR_FF1D34CE,\n GH_AW_GITHUB_ACTOR: process.env.GH_AW_GITHUB_ACTOR,\n GH_AW_GITHUB_EVENT_ISSUE_TITLE: process.env.GH_AW_GITHUB_EVENT_ISSUE_TITLE,\n GH_AW_GITHUB_REPOSITORY: process.env.GH_AW_GITHUB_REPOSITORY,\n GH_AW_GITHUB_RUN_ID: process.env.GH_AW_GITHUB_RUN_ID,\n GH_AW_GITHUB_WORKSPACE: process.env.GH_AW_GITHUB_WORKSPACE,\n GH_AW_INPUTS_ISSUE_NUMBER: process.env.GH_AW_INPUTS_ISSUE_NUMBER,\n GH_AW_MCP_CLI_SERVERS_LIST: process.env.GH_AW_MCP_CLI_SERVERS_LIST\n }\n });\n - name: Validate prompt placeholders\n env:\n GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt\n # poutine:ignore untrusted_checkout_exec\n run: bash \"${RUNNER_TEMP}/gh-aw/actions/validate_prompt_placeholders.sh\"\n - name: Print prompt\n env:\n GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt\n # poutine:ignore untrusted_checkout_exec\n run: bash \"${RUNNER_TEMP}/gh-aw/actions/print_prompt_summary.sh\"\n - name: Upload activation artifact\n if: success()\n uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1\n with:\n name: activation\n include-hidden-files: true\n path: |\n /tmp/gh-aw/aw_info.json\n /tmp/gh-aw/model_multipliers.json\n /tmp/gh-aw/models.json\n /tmp/gh-aw/aw-prompts/prompt.txt\n /tmp/gh-aw/aw-prompts/prompt-template.txt\n /tmp/gh-aw/aw-prompts/prompt-import-tree.json\n /tmp/gh-aw/github_rate_limits.jsonl\n /tmp/gh-aw/base\n /tmp/gh-aw/.codex/agents\n /tmp/gh-aw/.codex/skills\n if-no-files-found: ignore\n retention-days: 1\n\n agent:\n needs: activation\n if: needs.activation.outputs.daily_effective_workflow_exceeded != 'true'\n runs-on: ubuntu-latest\n permissions:\n actions: read\n checks: read\n contents: read\n discussions: read\n issues: read\n pull-requests: read\n statuses: read\n env:\n DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}\n GH_AW_ASSETS_ALLOWED_EXTS: \"\"\n GH_AW_ASSETS_BRANCH: \"\"\n GH_AW_ASSETS_MAX_SIZE_KB: 0\n GH_AW_MCP_LOG_DIR: /tmp/gh-aw/mcp-logs/safeoutputs\n GH_AW_WORKFLOW_ID_SANITIZED: issuetriage\n outputs:\n agentic_engine_timeout: ${{ steps.detect-agent-errors.outputs.agentic_engine_timeout || 'false' }}\n ai_credits_rate_limit_error: ${{ steps.parse-mcp-gateway.outputs.ai_credits_rate_limit_error || 'false' }}\n aic: ${{ steps.parse-mcp-gateway.outputs.aic }}\n ambient_context: ${{ steps.parse-mcp-gateway.outputs.ambient_context }}\n checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}\n effective_tokens: ${{ steps.parse-mcp-gateway.outputs.effective_tokens }}\n has_patch: ${{ steps.collect_output.outputs.has_patch }}\n inference_access_error: ${{ steps.detect-agent-errors.outputs.inference_access_error || 'false' }}\n mcp_policy_error: ${{ steps.detect-agent-errors.outputs.mcp_policy_error || 'false' }}\n model: ${{ needs.activation.outputs.model }}\n model_not_supported_error: ${{ steps.detect-agent-errors.outputs.model_not_supported_error || 'false' }}\n output: ${{ steps.collect_output.outputs.output }}\n output_types: ${{ steps.collect_output.outputs.output_types }}\n setup-parent-span-id: ${{ steps.setup.outputs.parent-span-id || steps.setup.outputs.span-id }}\n setup-span-id: ${{ steps.setup.outputs.span-id }}\n setup-trace-id: ${{ steps.setup.outputs.trace-id }}\n steps:\n - name: Setup Scripts\n id: setup\n uses: github/gh-aw-actions/setup@7cfd95b59ca996b7e2bebd6222e21ddd187a4e91 # v0.79.4\n with:\n destination: ${{ runner.temp }}/gh-aw/actions\n job-name: ${{ github.job }}\n trace-id: ${{ needs.activation.outputs.setup-trace-id }}\n parent-span-id: ${{ needs.activation.outputs.setup-parent-span-id || needs.activation.outputs.setup-span-id }}\n env:\n GH_AW_SETUP_WORKFLOW_NAME: \"Issue Triage\"\n GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/issue-triage.lock.yml@${{ github.ref }}\n GH_AW_INFO_VERSION: \"0.137.0\"\n GH_AW_INFO_AWF_VERSION: \"v0.27.0\"\n GH_AW_INFO_ENGINE_ID: \"codex\"\n - name: Set runtime paths\n id: set-runtime-paths\n run: |\n {\n echo \"GH_AW_SAFE_OUTPUTS=${RUNNER_TEMP}/gh-aw/safeoutputs/outputs.jsonl\"\n echo \"GH_AW_SAFE_OUTPUTS_CONFIG_PATH=${RUNNER_TEMP}/gh-aw/safeoutputs/config.json\"\n echo \"GH_AW_SAFE_OUTPUTS_TOOLS_PATH=${RUNNER_TEMP}/gh-aw/safeoutputs/tools.json\"\n } >> \"$GITHUB_OUTPUT\"\n - name: Checkout repository\n uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3\n with:\n persist-credentials: false\n - name: Create gh-aw temp directory\n run: bash \"${RUNNER_TEMP}/gh-aw/actions/create_gh_aw_tmp_dir.sh\"\n - name: Configure gh CLI for GitHub Enterprise\n run: bash \"${RUNNER_TEMP}/gh-aw/actions/configure_gh_for_ghe.sh\"\n env:\n GH_TOKEN: ${{ github.token }}\n - name: Configure Git credentials\n env:\n REPO_NAME: ${{ github.repository }}\n SERVER_URL: ${{ github.server_url }}\n GITHUB_TOKEN: ${{ github.token }}\n run: |\n git config --global user.email \"github-actions[bot]@users.noreply.github.com\"\n git config --global user.name \"github-actions[bot]\"\n git config --global am.keepcr true\n # Re-authenticate git with GitHub token\n SERVER_URL_STRIPPED=\"${SERVER_URL#https://}\"\n git remote set-url origin \"https://x-access-token:${GITHUB_TOKEN}@${SERVER_URL_STRIPPED}/${REPO_NAME}.git\"\n echo \"Git configured with standard GitHub Actions identity\"\n - name: Checkout PR branch\n id: checkout-pr\n if: |\n github.event.pull_request || github.event.issue.pull_request || github.event_name == 'workflow_dispatch' && fromJSON(github.event.inputs.aw_context || '{}').item_type == 'pull_request'\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n env:\n GH_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}\n with:\n github-token: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/checkout_pr_branch.cjs');\n await main();\n - name: Setup Node.js\n uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0\n with:\n node-version: '24'\n package-manager-cache: false\n - name: Install Codex CLI\n run: npm install --ignore-scripts -g @openai/codex@0.137.0\n - name: Install AWF binary\n run: bash \"${RUNNER_TEMP}/gh-aw/actions/install_awf_binary.sh\" v0.27.0\n - name: Parse integrity filter lists\n id: parse-guard-vars\n env:\n GH_AW_BLOCKED_USERS_VAR: ${{ vars.GH_AW_GITHUB_BLOCKED_USERS || '' }}\n GH_AW_TRUSTED_USERS_VAR: ${{ vars.GH_AW_GITHUB_TRUSTED_USERS || '' }}\n GH_AW_APPROVAL_LABELS_VAR: ${{ vars.GH_AW_GITHUB_APPROVAL_LABELS || '' }}\n run: bash \"${RUNNER_TEMP}/gh-aw/actions/parse_guard_list.sh\"\n - name: Download activation artifact\n uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1\n with:\n name: activation\n path: /tmp/gh-aw\n - name: Restore agent config folders from base branch\n if: steps.checkout-pr.outcome == 'success'\n env:\n GH_AW_AGENT_FOLDERS: \".agents .antigravity .claude .codex .crush .gemini .github .opencode .pi\"\n GH_AW_AGENT_FILES: \".crush.json AGENTS.md ANTIGRAVITY.md CLAUDE.md GEMINI.md PI.md opencode.jsonc\"\n run: bash \"${RUNNER_TEMP}/gh-aw/actions/restore_base_github_folders.sh\"\n - name: Restore inline sub-agents from activation artifact\n env:\n GH_AW_SUB_AGENT_DIR: \".codex/agents\"\n GH_AW_SUB_AGENT_EXT: \".md\"\n run: bash \"${RUNNER_TEMP}/gh-aw/actions/restore_inline_sub_agents.sh\"\n - name: Restore inline skills from activation artifact\n env:\n GH_AW_SKILL_DIR: \".codex/skills\"\n run: bash \"${RUNNER_TEMP}/gh-aw/actions/restore_inline_skills.sh\"\n - name: Download container images\n run: bash \"${RUNNER_TEMP}/gh-aw/actions/download_docker_images.sh\" ghcr.io/github/gh-aw-firewall/agent:0.27.0 ghcr.io/github/gh-aw-firewall/api-proxy:0.27.0 ghcr.io/github/gh-aw-firewall/squid:0.27.0 ghcr.io/github/gh-aw-mcpg:v0.3.25@sha256:c10331ad17668ef89f38f5e356678788a40b0cd5fef96e8f92e1d9c1de47cbaa ghcr.io/github/github-mcp-server:v1.1.2@sha256:30197479d8036c7811892bc07e06f9a05c9ef3cdd79bc59f256d50647f95788c node:lts-alpine@sha256:2bdb65ed1dab192432bc31c95f94155ca5ad7fc1392fb7eb7526ab682fa5bf14\n - name: Generate Safe Outputs Config\n run: |\n mkdir -p \"${RUNNER_TEMP}/gh-aw/safeoutputs\"\n mkdir -p /tmp/gh-aw/safeoutputs\n mkdir -p /tmp/gh-aw/mcp-logs/safeoutputs\n cat > \"${RUNNER_TEMP}/gh-aw/safeoutputs/config.json\" << 'GH_AW_SAFE_OUTPUTS_CONFIG_7f05fa4491cc85b2_EOF'\n {\"add_comment\":{\"max\":1,\"target\":\"triggering\"},\"add_labels\":{\"allowed\":[\"bug\",\"enhancement\",\"question\",\"other\"],\"max\":2,\"target\":\"triggering\"},\"call_workflow\":{\"max\":1,\"workflow_files\":{\"issue-handle-bug\":\"./.github/workflows/issue-handle-bug.lock.yml\",\"issue-handle-enhancement\":\"./.github/workflows/issue-handle-enhancement.lock.yml\",\"issue-handle-other\":\"./.github/workflows/issue-handle-other.lock.yml\",\"issue-handle-question\":\"./.github/workflows/issue-handle-question.lock.yml\"},\"workflows\":[\"issue-handle-bug\",\"issue-handle-enhancement\",\"issue-handle-question\",\"issue-handle-other\"]},\"create_report_incomplete_issue\":{},\"missing_data\":{},\"missing_tool\":{},\"noop\":{\"max\":1,\"report-as-issue\":\"true\"},\"report_incomplete\":{}}\n GH_AW_SAFE_OUTPUTS_CONFIG_7f05fa4491cc85b2_EOF\n - name: Generate Safe Outputs Tools\n env:\n GH_AW_TOOLS_META_JSON: |\n {\n \"description_suffixes\": {\n \"add_comment\": \" CONSTRAINTS: Maximum 1 comment(s) can be added. Target: triggering. Supports reply_to_id for discussion threading.\",\n \"add_labels\": \" CONSTRAINTS: Maximum 2 label(s) can be added. Only these labels are allowed: [\\\"bug\\\" \\\"enhancement\\\" \\\"question\\\" \\\"other\\\"]. Target: triggering.\"\n },\n \"repo_params\": {},\n \"dynamic_tools\": [\n {\n \"_call_workflow_name\": \"issue-handle-bug\",\n \"description\": \"Call the 'issue-handle-bug' reusable workflow via workflow_call. This workflow must support workflow_call and be in .github/workflows/ directory in the same repository.\",\n \"inputSchema\": {\n \"additionalProperties\": false,\n \"properties\": {\n \"aw_context\": {\n \"default\": \"\",\n \"description\": \"Agent caller context (used internally by Agentic Workflows).\",\n \"type\": \"string\"\n },\n \"issue_number\": {\n \"description\": \"Input parameter 'issue_number' for workflow issue-handle-bug\",\n \"type\": \"string\"\n },\n \"payload\": {\n \"description\": \"Input parameter 'payload' for workflow issue-handle-bug\",\n \"type\": \"string\"\n }\n },\n \"required\": [\n \"issue_number\"\n ],\n \"type\": \"object\"\n },\n \"name\": \"issue_handle_bug\"\n },\n {\n \"_call_workflow_name\": \"issue-handle-enhancement\",\n \"description\": \"Call the 'issue-handle-enhancement' reusable workflow via workflow_call. This workflow must support workflow_call and be in .github/workflows/ directory in the same repository.\",\n \"inputSchema\": {\n \"additionalProperties\": false,\n \"properties\": {\n \"aw_context\": {\n \"default\": \"\",\n \"description\": \"Agent caller context (used internally by Agentic Workflows).\",\n \"type\": \"string\"\n },\n \"issue_number\": {\n \"description\": \"Input parameter 'issue_number' for workflow issue-handle-enhancement\",\n \"type\": \"string\"\n },\n \"payload\": {\n \"description\": \"Input parameter 'payload' for workflow issue-handle-enhancement\",\n \"type\": \"string\"\n }\n },\n \"required\": [\n \"issue_number\"\n ],\n \"type\": \"object\"\n },\n \"name\": \"issue_handle_enhancement\"\n },\n {\n \"_call_workflow_name\": \"issue-handle-question\",\n \"description\": \"Call the 'issue-handle-question' reusable workflow via workflow_call. This workflow must support workflow_call and be in .github/workflows/ directory in the same repository.\",\n \"inputSchema\": {\n \"additionalProperties\": false,\n \"properties\": {\n \"aw_context\": {\n \"default\": \"\",\n \"description\": \"Agent caller context (used internally by Agentic Workflows).\",\n \"type\": \"string\"\n },\n \"issue_number\": {\n \"description\": \"Input parameter 'issue_number' for workflow issue-handle-question\",\n \"type\": \"string\"\n },\n \"payload\": {\n \"description\": \"Input parameter 'payload' for workflow issue-handle-question\",\n \"type\": \"string\"\n }\n },\n \"required\": [\n \"issue_number\"\n ],\n \"type\": \"object\"\n },\n \"name\": \"issue_handle_question\"\n },\n {\n \"_call_workflow_name\": \"issue-handle-other\",\n \"description\": \"Call the 'issue-handle-other' reusable workflow via workflow_call. This workflow must support workflow_call and be in .github/workflows/ directory in the same repository.\",\n \"inputSchema\": {\n \"additionalProperties\": false,\n \"properties\": {\n \"aw_context\": {\n \"default\": \"\",\n \"description\": \"Agent caller context (used internally by Agentic Workflows).\",\n \"type\": \"string\"\n },\n \"issue_number\": {\n \"description\": \"Input parameter 'issue_number' for workflow issue-handle-other\",\n \"type\": \"string\"\n },\n \"payload\": {\n \"description\": \"Input parameter 'payload' for workflow issue-handle-other\",\n \"type\": \"string\"\n }\n },\n \"required\": [\n \"issue_number\"\n ],\n \"type\": \"object\"\n },\n \"name\": \"issue_handle_other\"\n }\n ]\n }\n GH_AW_VALIDATION_JSON: |\n {\n \"add_comment\": {\n \"defaultMax\": 1,\n \"fields\": {\n \"body\": {\n \"required\": true,\n \"type\": \"string\",\n \"sanitize\": true,\n \"maxLength\": 65000\n },\n \"item_number\": {\n \"issueOrPRNumber\": true\n },\n \"reply_to_id\": {\n \"type\": \"string\",\n \"maxLength\": 256\n },\n \"repo\": {\n \"type\": \"string\",\n \"maxLength\": 256\n }\n }\n },\n \"add_labels\": {\n \"defaultMax\": 5,\n \"fields\": {\n \"item_number\": {\n \"issueNumberOrTemporaryId\": true\n },\n \"labels\": {\n \"required\": true,\n \"type\": \"array\",\n \"itemType\": \"string\",\n \"itemSanitize\": true,\n \"itemMaxLength\": 128\n },\n \"repo\": {\n \"type\": \"string\",\n \"maxLength\": 256\n }\n }\n },\n \"missing_data\": {\n \"defaultMax\": 20,\n \"fields\": {\n \"alternatives\": {\n \"type\": \"string\",\n \"sanitize\": true,\n \"maxLength\": 256\n },\n \"context\": {\n \"type\": \"string\",\n \"sanitize\": true,\n \"maxLength\": 256\n },\n \"data_type\": {\n \"type\": \"string\",\n \"sanitize\": true,\n \"maxLength\": 128\n },\n \"reason\": {\n \"type\": \"string\",\n \"sanitize\": true,\n \"maxLength\": 256\n }\n }\n },\n \"missing_tool\": {\n \"defaultMax\": 20,\n \"fields\": {\n \"alternatives\": {\n \"type\": \"string\",\n \"sanitize\": true,\n \"maxLength\": 512\n },\n \"reason\": {\n \"required\": true,\n \"type\": \"string\",\n \"sanitize\": true,\n \"maxLength\": 256\n },\n \"tool\": {\n \"type\": \"string\",\n \"sanitize\": true,\n \"maxLength\": 128\n }\n }\n },\n \"noop\": {\n \"defaultMax\": 1,\n \"fields\": {\n \"message\": {\n \"required\": true,\n \"type\": \"string\",\n \"sanitize\": true,\n \"maxLength\": 65000\n }\n }\n },\n \"report_incomplete\": {\n \"defaultMax\": 5,\n \"fields\": {\n \"details\": {\n \"type\": \"string\",\n \"sanitize\": true,\n \"maxLength\": 65000\n },\n \"reason\": {\n \"required\": true,\n \"type\": \"string\",\n \"sanitize\": true,\n \"maxLength\": 1024\n }\n }\n }\n }\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n with:\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/generate_safe_outputs_tools.cjs');\n await main();\n - name: Generate Safe Outputs MCP Server Config\n id: safe-outputs-config\n run: |\n # Generate a secure random API key (360 bits of entropy, 40+ chars)\n # Mask immediately to prevent timing vulnerabilities\n API_KEY=$(openssl rand -base64 45 | tr -d '/+=')\n echo \"::add-mask::${API_KEY}\"\n \n PORT=3001\n \n # Set outputs for next steps\n {\n echo \"safe_outputs_api_key=${API_KEY}\"\n echo \"safe_outputs_port=${PORT}\"\n } >> \"$GITHUB_OUTPUT\"\n \n echo \"Safe Outputs MCP server will run on port ${PORT}\"\n \n - name: Start Safe Outputs MCP HTTP Server\n id: safe-outputs-start\n env:\n DEBUG: '*'\n GH_AW_SAFE_OUTPUTS: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS }}\n GH_AW_SAFE_OUTPUTS_PORT: ${{ steps.safe-outputs-config.outputs.safe_outputs_port }}\n GH_AW_SAFE_OUTPUTS_API_KEY: ${{ steps.safe-outputs-config.outputs.safe_outputs_api_key }}\n GH_AW_SAFE_OUTPUTS_TOOLS_PATH: ${{ runner.temp }}/gh-aw/safeoutputs/tools.json\n GH_AW_SAFE_OUTPUTS_CONFIG_PATH: ${{ runner.temp }}/gh-aw/safeoutputs/config.json\n GH_AW_MCP_LOG_DIR: /tmp/gh-aw/mcp-logs/safeoutputs\n run: |\n # Environment variables are set above to prevent template injection\n export DEBUG\n export GH_AW_SAFE_OUTPUTS\n export GH_AW_SAFE_OUTPUTS_PORT\n export GH_AW_SAFE_OUTPUTS_API_KEY\n export GH_AW_SAFE_OUTPUTS_TOOLS_PATH\n export GH_AW_SAFE_OUTPUTS_CONFIG_PATH\n export GH_AW_MCP_LOG_DIR\n \n bash \"${RUNNER_TEMP}/gh-aw/actions/start_safe_outputs_server.sh\"\n \n - name: Start MCP Gateway\n id: start-mcp-gateway\n env:\n CODEX_HOME: /tmp/gh-aw/mcp-config\n GH_AW_SAFE_OUTPUTS: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS }}\n GH_AW_SAFE_OUTPUTS_API_KEY: ${{ steps.safe-outputs-start.outputs.api_key }}\n GH_AW_SAFE_OUTPUTS_PORT: ${{ steps.safe-outputs-start.outputs.port }}\n GITHUB_MCP_SERVER_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}\n run: |\n set -eo pipefail\n mkdir -p \"${RUNNER_TEMP}/gh-aw/mcp-config\"\n \n # Export gateway environment variables for MCP config and gateway script\n export MCP_GATEWAY_PORT=\"8080\"\n export MCP_GATEWAY_DOMAIN=\"host.docker.internal\"\n export MCP_GATEWAY_HOST_DOMAIN=\"localhost\"\n MCP_GATEWAY_API_KEY=$(openssl rand -base64 45 | tr -d '/+=')\n echo \"::add-mask::${MCP_GATEWAY_API_KEY}\"\n export MCP_GATEWAY_API_KEY\n export MCP_GATEWAY_PAYLOAD_DIR=\"/tmp/gh-aw/mcp-payloads\"\n mkdir -p \"${MCP_GATEWAY_PAYLOAD_DIR}\"\n export MCP_GATEWAY_PAYLOAD_SIZE_THRESHOLD=\"524288\"\n export DEBUG=\"*\"\n \n export GH_AW_ENGINE=\"codex\"\n MCP_GATEWAY_UID=$(id -u 2>/dev/null || echo '0')\n MCP_GATEWAY_GID=$(id -g 2>/dev/null || echo '0')\n case \"${DOCKER_HOST:-}\" in\n unix://* ) DOCKER_SOCK_PATH=\"${DOCKER_HOST#unix://}\" ;;\n /* ) DOCKER_SOCK_PATH=\"$DOCKER_HOST\" ;;\n * ) DOCKER_SOCK_PATH=/var/run/docker.sock ;;\n esac\n DOCKER_SOCK_GID=$(stat -c '%g' \"$DOCKER_SOCK_PATH\" 2>/dev/null || echo '0')\n export MCP_GATEWAY_DOCKER_COMMAND='docker run -i --rm --network host --add-host host.docker.internal:127.0.0.1 --user '\"${MCP_GATEWAY_UID}\"':'\"${MCP_GATEWAY_GID}\"' --group-add '\"${DOCKER_SOCK_GID}\"' -v '\"${DOCKER_SOCK_PATH}\"':/var/run/docker.sock -e MCP_GATEWAY_PORT -e MCP_GATEWAY_DOMAIN -e MCP_GATEWAY_API_KEY -e MCP_GATEWAY_PAYLOAD_DIR -e MCP_GATEWAY_PAYLOAD_SIZE_THRESHOLD -e DOCKER_HOST=unix:///var/run/docker.sock -e DEBUG -e MCP_GATEWAY_LOG_DIR -e GH_AW_MCP_LOG_DIR -e GH_AW_SAFE_OUTPUTS -e GH_AW_SAFE_OUTPUTS_CONFIG_PATH -e GH_AW_SAFE_OUTPUTS_TOOLS_PATH -e GH_AW_ASSETS_BRANCH -e GH_AW_ASSETS_MAX_SIZE_KB -e GH_AW_ASSETS_ALLOWED_EXTS -e DEFAULT_BRANCH -e GITHUB_MCP_SERVER_TOKEN -e GITHUB_MCP_GUARD_MIN_INTEGRITY -e GITHUB_MCP_GUARD_REPOS -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e GITHUB_SHA -e GITHUB_WORKSPACE -e GITHUB_TOKEN -e GITHUB_RUN_ID -e GITHUB_RUN_NUMBER -e GITHUB_RUN_ATTEMPT -e GITHUB_JOB -e GITHUB_ACTION -e GITHUB_EVENT_NAME -e GITHUB_EVENT_PATH -e GITHUB_ACTOR -e GITHUB_ACTOR_ID -e GITHUB_TRIGGERING_ACTOR -e GITHUB_WORKFLOW -e GITHUB_WORKFLOW_REF -e GITHUB_WORKFLOW_SHA -e GITHUB_REF -e GITHUB_REF_NAME -e GITHUB_REF_TYPE -e GITHUB_HEAD_REF -e GITHUB_BASE_REF -e GH_AW_SAFE_OUTPUTS_PORT -e GH_AW_SAFE_OUTPUTS_API_KEY -e CODEX_HOME -v /tmp/gh-aw/mcp-payloads:/tmp/gh-aw/mcp-payloads:rw -v /opt:/opt:ro -v /tmp:/tmp:rw -v '\"${GITHUB_WORKSPACE}\"':'\"${GITHUB_WORKSPACE}\"':rw ghcr.io/github/gh-aw-mcpg:v0.3.25'\n \n cat > \"${RUNNER_TEMP}/gh-aw/mcp-config/config.toml\" << GH_AW_MCP_CONFIG_52f10deab68ccf89_EOF\n [history]\n persistence = \"none\"\n \n [shell_environment_policy]\n inherit = \"core\"\n include_only = [\"^CODEX_API_KEY$\", \"^GH_AW_ASSETS_ALLOWED_EXTS$\", \"^GH_AW_ASSETS_BRANCH$\", \"^GH_AW_ASSETS_MAX_SIZE_KB$\", \"^GH_AW_SAFE_OUTPUTS$\", \"^GITHUB_PERSONAL_ACCESS_TOKEN$\", \"^GITHUB_REPOSITORY$\", \"^GITHUB_SERVER_URL$\", \"^HOME$\", \"^OPENAI_API_KEY$\", \"^PATH$\"]\n \n [mcp_servers.github]\n user_agent = \"issue-triage\"\n startup_timeout_sec = 120\n tool_timeout_sec = 60\n container = \"ghcr.io/github/github-mcp-server:v1.1.2\"\n env = { \"GITHUB_HOST\" = \"$GITHUB_SERVER_URL\", \"GITHUB_PERSONAL_ACCESS_TOKEN\" = \"$GH_AW_GITHUB_TOKEN\", \"GITHUB_READ_ONLY\" = \"1\", \"GITHUB_TOOLSETS\" = \"context,repos,issues,pull_requests\" }\n env_vars = [\"GITHUB_HOST\", \"GITHUB_PERSONAL_ACCESS_TOKEN\", \"GITHUB_READ_ONLY\", \"GITHUB_TOOLSETS\"]\n \n [mcp_servers.safeoutputs]\n type = \"http\"\n url = \"http://host.docker.internal:$GH_AW_SAFE_OUTPUTS_PORT\"\n \n [mcp_servers.safeoutputs.headers]\n Authorization = \"$GH_AW_SAFE_OUTPUTS_API_KEY\"\n \n [mcp_servers.safeoutputs.\"guard-policies\"]\n \n [mcp_servers.safeoutputs.\"guard-policies\".write-sink]\n accept = [\"*\"]\n GH_AW_MCP_CONFIG_52f10deab68ccf89_EOF\n \n # Generate JSON config for MCP gateway\n GH_AW_NODE=$(which node 2>/dev/null || command -v node 2>/dev/null || echo node)\n cat << GH_AW_MCP_CONFIG_ca772287f17ffc28_EOF | \"$GH_AW_NODE\" \"${RUNNER_TEMP}/gh-aw/actions/start_mcp_gateway.cjs\"\n {\n \"mcpServers\": {\n \"github\": {\n \"container\": \"ghcr.io/github/github-mcp-server:v1.1.2\",\n \"env\": {\n \"GITHUB_HOST\": \"$GITHUB_SERVER_URL\",\n \"GITHUB_PERSONAL_ACCESS_TOKEN\": \"$GITHUB_MCP_SERVER_TOKEN\",\n \"GITHUB_READ_ONLY\": \"1\",\n \"GITHUB_TOOLSETS\": \"context,repos,issues,pull_requests\"\n },\n \"guard-policies\": {\n \"allow-only\": {\n \"approval-labels\": ${{ steps.parse-guard-vars.outputs.approval_labels }},\n \"blocked-users\": ${{ steps.parse-guard-vars.outputs.blocked_users }},\n \"min-integrity\": \"none\",\n \"repos\": \"all\",\n \"trusted-users\": ${{ steps.parse-guard-vars.outputs.trusted_users }}\n }\n }\n },\n \"safeoutputs\": {\n \"type\": \"http\",\n \"url\": \"http://host.docker.internal:$GH_AW_SAFE_OUTPUTS_PORT\",\n \"headers\": {\n \"Authorization\": \"$GH_AW_SAFE_OUTPUTS_API_KEY\"\n },\n \"guard-policies\": {\n \"write-sink\": {\n \"accept\": [\n \"*\"\n ]\n }\n }\n }\n },\n \"gateway\": {\n \"port\": $MCP_GATEWAY_PORT,\n \"domain\": \"${MCP_GATEWAY_DOMAIN}\",\n \"apiKey\": \"${MCP_GATEWAY_API_KEY}\",\n \"payloadDir\": \"${MCP_GATEWAY_PAYLOAD_DIR}\"\n }\n }\n GH_AW_MCP_CONFIG_ca772287f17ffc28_EOF\n \n # Sync converter output to writable CODEX_HOME for Codex\n mkdir -p /tmp/gh-aw/mcp-config\n cat > \"/tmp/gh-aw/mcp-config/config.toml\" << GH_AW_CODEX_SHELL_POLICY_929fca99db4cd5ec_EOF\n\n model_provider = \"openai-proxy\"\n\n [model_providers.openai-proxy]\n name = \"OpenAI AWF proxy\"\n base_url = \"http://172.30.0.30:10000\"\n env_key = \"OPENAI_API_KEY\"\n supports_websockets = false\n [shell_environment_policy]\n inherit = \"core\"\n include_only = [\"^CODEX_API_KEY$\", \"^GH_AW_ASSETS_ALLOWED_EXTS$\", \"^GH_AW_ASSETS_BRANCH$\", \"^GH_AW_ASSETS_MAX_SIZE_KB$\", \"^GH_AW_SAFE_OUTPUTS$\", \"^GITHUB_PERSONAL_ACCESS_TOKEN$\", \"^GITHUB_REPOSITORY$\", \"^GITHUB_SERVER_URL$\", \"^HOME$\", \"^OPENAI_API_KEY$\", \"^PATH$\"]\n GH_AW_CODEX_SHELL_POLICY_929fca99db4cd5ec_EOF\n awk '\n BEGIN { skip_openai_proxy = 0 }\n /^[[:space:]]*model_provider[[:space:]]*=/ { next }\n /^\\[model_providers\\.openai-proxy\\][[:space:]]*$/ { skip_openai_proxy = 1; next }\n /^\\[/ { skip_openai_proxy = 0 }\n !skip_openai_proxy { print }\n ' \"${RUNNER_TEMP}/gh-aw/mcp-config/config.toml\" >> \"/tmp/gh-aw/mcp-config/config.toml\"\n chmod 600 \"/tmp/gh-aw/mcp-config/config.toml\"\n mkdir -p \"${CODEX_HOME}\"\n if [ \"/tmp/gh-aw/mcp-config/config.toml\" != \"${CODEX_HOME}/config.toml\" ]; then cp \"/tmp/gh-aw/mcp-config/config.toml\" \"${CODEX_HOME}/config.toml\"; fi\n chmod 600 \"${CODEX_HOME}/config.toml\"\n - name: Mount MCP servers as CLIs\n id: mount-mcp-clis\n continue-on-error: true\n env:\n MCP_GATEWAY_API_KEY: ${{ steps.start-mcp-gateway.outputs.gateway-api-key }}\n MCP_GATEWAY_DOMAIN: ${{ steps.start-mcp-gateway.outputs.gateway-domain }}\n MCP_GATEWAY_PORT: ${{ steps.start-mcp-gateway.outputs.gateway-port }}\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n with:\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/mount_mcp_as_cli.cjs');\n await main();\n - name: Clean credentials\n continue-on-error: true\n run: bash \"${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh\"\n - name: Audit pre-agent workspace\n id: pre_agent_audit\n continue-on-error: true\n run: bash \"${RUNNER_TEMP}/gh-aw/actions/audit_pre_agent_workspace.sh\"\n - name: Execute Codex CLI\n id: agentic_execution\n run: |\n set -o pipefail\n printf '%s' \"$(date +%s%3N)\" > /tmp/gh-aw/agent_cli_start_ms.txt\n mkdir -p \"$CODEX_HOME/logs\" && touch /tmp/gh-aw/agent-step-summary.md\n (umask 177 && touch /tmp/gh-aw/agent-stdio.log)\n GH_AW_MAX_AI_CREDITS=\"${{ vars.GH_AW_DEFAULT_MAX_AI_CREDITS || '1000' }}\"\n printf '%s\\n' \"{\\\"\\$schema\\\":\\\"https://github.com/github/gh-aw-firewall/releases/download/v0.27.0/awf-config.schema.json\\\",\\\"network\\\":{\\\"allowDomains\\\":[\\\"172.30.0.1\\\",\\\"ai-pixel.online\\\",\\\"api-inference.modelscope.cn\\\",\\\"api.commandcode.ai\\\",\\\"api.deepseek.com\\\",\\\"api.minimaxi.com\\\",\\\"api.openai.com\\\",\\\"api.snapcraft.io\\\",\\\"archive.ubuntu.com\\\",\\\"azure.archive.ubuntu.com\\\",\\\"chatgpt.com\\\",\\\"crl.geotrust.com\\\",\\\"crl.globalsign.com\\\",\\\"crl.identrust.com\\\",\\\"crl.sectigo.com\\\",\\\"crl.thawte.com\\\",\\\"crl.usertrust.com\\\",\\\"crl.verisign.com\\\",\\\"crl3.digicert.com\\\",\\\"crl4.digicert.com\\\",\\\"crls.ssl.com\\\",\\\"host.docker.internal\\\",\\\"json-schema.org\\\",\\\"json.schemastore.org\\\",\\\"keyserver.ubuntu.com\\\",\\\"ocsp.digicert.com\\\",\\\"ocsp.geotrust.com\\\",\\\"ocsp.globalsign.com\\\",\\\"ocsp.identrust.com\\\",\\\"ocsp.sectigo.com\\\",\\\"ocsp.ssl.com\\\",\\\"ocsp.thawte.com\\\",\\\"ocsp.usertrust.com\\\",\\\"ocsp.verisign.com\\\",\\\"open.bigmodel.cn\\\",\\\"openai.com\\\",\\\"opencode.ai\\\",\\\"packagecloud.io\\\",\\\"packages.cloud.google.com\\\",\\\"packages.microsoft.com\\\",\\\"ppa.launchpad.net\\\",\\\"s.symcb.com\\\",\\\"s.symcd.com\\\",\\\"security.ubuntu.com\\\",\\\"ts-crl.ws.symantec.com\\\",\\\"ts-ocsp.ws.symantec.com\\\",\\\"www.googleapis.com\\\"]},\\\"apiProxy\\\":{\\\"enabled\\\":true,\\\"enableTokenSteering\\\":true,\\\"maxRuns\\\":500,\\\"maxAiCredits\\\":${GH_AW_MAX_AI_CREDITS},\\\"targets\\\":{\\\"openai\\\":{\\\"host\\\":\\\"ai-pixel.online\\\"}},\\\"models\\\":{\\\"agent\\\":[\\\"sonnet-6x\\\",\\\"gpt-5.4\\\",\\\"gpt-5.3\\\",\\\"gemini-pro\\\",\\\"any\\\"],\\\"antigravity\\\":[\\\"copilot/antigravity*\\\",\\\"google/antigravity*\\\",\\\"gemini/antigravity*\\\"],\\\"any\\\":[\\\"copilot/*\\\",\\\"anthropic/*\\\",\\\"openai/*\\\",\\\"google/*\\\",\\\"gemini/*\\\"],\\\"claude\\\":[\\\"agent\\\"],\\\"codex\\\":[\\\"agent\\\"],\\\"coding\\\":[\\\"copilot/gpt-5*codex*\\\",\\\"openai/gpt-5*codex*\\\",\\\"gpt-5-codex\\\"],\\\"computer-use\\\":[\\\"copilot/*computer-use*\\\",\\\"google/*computer-use*\\\",\\\"gemini/*computer-use*\\\",\\\"openai/*computer-use*\\\"],\\\"copilot\\\":[\\\"agent\\\"],\\\"deep-research\\\":[\\\"copilot/deep-research*\\\",\\\"copilot/o3-deep-research*\\\",\\\"copilot/o4-mini-deep-research*\\\",\\\"google/deep-research*\\\",\\\"gemini/deep-research*\\\",\\\"openai/o3-deep-research*\\\",\\\"openai/o4-mini-deep-research*\\\"],\\\"gemini\\\":[\\\"agent\\\"],\\\"gemini-3-flash\\\":[\\\"copilot/gemini-3*flash*\\\",\\\"google/gemini-3*flash*\\\",\\\"gemini/gemini-3*flash*\\\"],\\\"gemini-3-pro\\\":[\\\"copilot/gemini-3*pro*\\\",\\\"google/gemini-3*pro*\\\",\\\"google/nano-banana*\\\",\\\"gemini/gemini-3*pro*\\\"],\\\"gemini-3.1-flash\\\":[\\\"copilot/gemini-3.1*flash*\\\",\\\"google/gemini-3.1*flash*\\\",\\\"gemini/gemini-3.1*flash*\\\"],\\\"gemini-3.1-pro\\\":[\\\"copilot/gemini-3.1*pro*\\\",\\\"google/gemini-3.1*pro*\\\",\\\"gemini/gemini-3.1*pro*\\\"],\\\"gemini-3.5-flash\\\":[\\\"copilot/gemini-3.5*flash*\\\",\\\"google/gemini-3.5*flash*\\\",\\\"gemini/gemini-3.5*flash*\\\"],\\\"gemini-flash\\\":[\\\"copilot/gemini-*flash*\\\",\\\"google/gemini-*flash*\\\",\\\"gemini/gemini-*flash*\\\"],\\\"gemini-flash-lite\\\":[\\\"copilot/gemini-*flash*lite*\\\",\\\"google/gemini-*flash*lite*\\\",\\\"gemini/gemini-*flash*lite*\\\"],\\\"gemini-pro\\\":[\\\"copilot/gemini-*pro*\\\",\\\"google/gemini-*pro*\\\",\\\"gemini/gemini-*pro*\\\"],\\\"gemma\\\":[\\\"copilot/gemma*\\\",\\\"google/gemma*\\\",\\\"gemini/gemma*\\\"],\\\"gpt-5\\\":[\\\"copilot/gpt-5*\\\",\\\"openai/gpt-5*\\\"],\\\"gpt-5-codex\\\":[\\\"copilot/gpt-5*codex*\\\",\\\"openai/gpt-5*codex*\\\"],\\\"gpt-5-mini\\\":[\\\"copilot/gpt-5*mini*\\\",\\\"openai/gpt-5*mini*\\\"],\\\"gpt-5-nano\\\":[\\\"copilot/gpt-5*nano*\\\",\\\"openai/gpt-5*nano*\\\"],\\\"gpt-5-pro\\\":[\\\"copilot/gpt-5*pro*\\\",\\\"openai/gpt-5*pro*\\\"],\\\"gpt-5.2\\\":[\\\"copilot/gpt-5.2*\\\",\\\"openai/gpt-5.2*\\\"],\\\"gpt-5.3\\\":[\\\"copilot/gpt-5.3*\\\",\\\"openai/gpt-5.3*\\\"],\\\"gpt-5.4\\\":[\\\"copilot/gpt-5.4*\\\",\\\"openai/gpt-5.4*\\\"],\\\"gpt-5.5\\\":[\\\"copilot/gpt-5.5*\\\",\\\"openai/gpt-5.5*\\\"],\\\"haiku\\\":[\\\"copilot/*haiku*\\\",\\\"anthropic/*haiku*\\\"],\\\"large\\\":[\\\"sonnet\\\",\\\"gpt-5-pro\\\",\\\"gpt-5\\\",\\\"gemini-pro\\\"],\\\"mai-code\\\":[\\\"copilot/MAI-Code*\\\",\\\"copilot/mai-code*\\\",\\\"openai/MAI-Code*\\\"],\\\"mini\\\":[\\\"haiku\\\",\\\"gpt-5-mini\\\",\\\"gpt-5-nano\\\",\\\"gemini-flash-lite\\\"],\\\"nano-banana\\\":[\\\"copilot/nano-banana*\\\",\\\"google/nano-banana*\\\",\\\"gemini/nano-banana*\\\"],\\\"opus\\\":[\\\"copilot/*opus*\\\",\\\"anthropic/*opus*\\\"],\\\"opusplan\\\":[\\\"opus?effort=high\\\"],\\\"reasoning\\\":[\\\"copilot/o1*\\\",\\\"copilot/o3*\\\",\\\"copilot/o4*\\\",\\\"openai/o1*\\\",\\\"openai/o3*\\\",\\\"openai/o4*\\\"],\\\"robotics\\\":[\\\"copilot/*robotics*\\\",\\\"google/*robotics*\\\",\\\"gemini/*robotics*\\\"],\\\"small\\\":[\\\"mini\\\"],\\\"small-agent\\\":[\\\"haiku\\\",\\\"gpt-5-mini\\\",\\\"gemini-flash\\\"],\\\"sonnet\\\":[\\\"copilot/*sonnet*\\\",\\\"anthropic/*sonnet*\\\"],\\\"sonnet-6x\\\":[\\\"copilot/*sonnet-4.5*\\\",\\\"copilot/*sonnet-4.6*\\\",\\\"copilot/*sonnet-4-5-*\\\",\\\"anthropic/*sonnet-4-5-*\\\",\\\"copilot/*sonnet-4-6*\\\",\\\"anthropic/*sonnet-4-6*\\\"],\\\"summarization\\\":[\\\"haiku\\\",\\\"gpt-5-mini\\\",\\\"gemini-flash-lite\\\",\\\"mini\\\"],\\\"vision\\\":[\\\"copilot/gemini-*image*\\\",\\\"gemini/gemini-*image*\\\",\\\"copilot/gemini-*flash*\\\",\\\"gemini/gemini-*flash*\\\"]}},\\\"container\\\":{\\\"imageTag\\\":\\\"0.27.0\\\"}}\" > \"${RUNNER_TEMP}/gh-aw/awf-config.json\"\n GH_AW_MODEL_MULTIPLIERS_PATH=\"/tmp/gh-aw/model_multipliers.json\" node \"${RUNNER_TEMP}/gh-aw/actions/merge_awf_model_multipliers.cjs\"\n cp \"${RUNNER_TEMP}/gh-aw/awf-config.json\" /tmp/gh-aw/awf-config.json\n export GH_AW_MODELS_JSON_PATH=\"/tmp/gh-aw/models.json\"\n GH_AW_DOCKER_HOST_PATH_PREFIX_ARGS=\"\"\n if [[ \"${DOCKER_HOST:-}\" =~ ^tcp:// ]]; then\n GH_AW_DOCKER_HOST_PATH_PREFIX_ARGS=\"--docker-host-path-prefix /tmp/gh-aw\"\n fi\n GH_AW_TOOL_CACHE_MOUNT=\"\"\n GH_AW_TOOL_CACHE=\"${RUNNER_TOOL_CACHE:-/opt/hostedtoolcache}\"\n if [ -d \"$GH_AW_TOOL_CACHE\" ]; then\n if [[ \"$GH_AW_TOOL_CACHE\" != /opt/* ]]; then\n GH_AW_TOOL_CACHE_MOUNT=\"$GH_AW_TOOL_CACHE:$GH_AW_TOOL_CACHE:ro\"\n fi\n elif [ -d \"/home/runner/work/_tool\" ]; then\n GH_AW_TOOL_CACHE_MOUNT=\"/home/runner/work/_tool:/home/runner/work/_tool:ro\"\n fi\n # shellcheck disable=SC1003\n sudo -E awf --config \"${RUNNER_TEMP}/gh-aw/awf-config.json\" --container-workdir \"${GITHUB_WORKSPACE}\" --mount \"${RUNNER_TEMP}/gh-aw:${RUNNER_TEMP}/gh-aw:ro\" --mount \"${RUNNER_TEMP}/gh-aw:/host${RUNNER_TEMP}/gh-aw:ro\" ${GH_AW_TOOL_CACHE_MOUNT:+--mount \"$GH_AW_TOOL_CACHE_MOUNT\"} ${GH_AW_DOCKER_HOST_PATH_PREFIX_ARGS} --env-all --exclude-env CODEX_API_KEY --exclude-env GITHUB_MCP_SERVER_TOKEN --exclude-env MCP_GATEWAY_API_KEY --exclude-env OPENAI_API_KEY --log-level info --proxy-logs-dir /tmp/gh-aw/sandbox/firewall/logs --audit-dir /tmp/gh-aw/sandbox/firewall/audit --enable-host-access --allow-host-ports 80,443,8080 --skip-pull \\\n -- /bin/bash -c 'set +o histexpand; export PATH=\"${RUNNER_TEMP}/gh-aw/mcp-cli/bin:$PATH\" && GH_AW_TOOL_CACHE=\"${RUNNER_TOOL_CACHE:-/opt/hostedtoolcache}\"; export PATH=\"$(find \"$GH_AW_TOOL_CACHE\" /opt/hostedtoolcache /home/runner/work/_tool -maxdepth 5 -type d -name bin 2>/dev/null | tr '\\''\\n'\\'' '\\'':'\\'')$PATH\"; [ -n \"$GOROOT\" ] && export PATH=\"$GOROOT/bin:$PATH\" || true && GH_AW_NODE_EXEC=\"${GH_AW_NODE_BIN:-}\"; if [ -z \"$GH_AW_NODE_EXEC\" ] || [ ! -x \"$GH_AW_NODE_EXEC\" ]; then GH_AW_NODE_EXEC=\"$(command -v node 2>/dev/null || true)\"; fi; if [ -z \"$GH_AW_NODE_EXEC\" ]; then echo \"node runtime missing on this runner — check runtimes.node in workflow YAML\" >&2; exit 127; fi; GH_AW_NPM_GLOBAL_ROOT=\"$(npm root -g 2>/dev/null || true)\"; if [ -n \"$GH_AW_NPM_GLOBAL_ROOT\" ]; then export NODE_PATH=\"${GH_AW_NPM_GLOBAL_ROOT}${NODE_PATH:+:${NODE_PATH}}\"; fi; \"$GH_AW_NODE_EXEC\" ${RUNNER_TEMP}/gh-aw/actions/codex_harness.cjs codex exec${GH_AW_MODEL_AGENT_CODEX:+ --model \"$GH_AW_MODEL_AGENT_CODEX\"} -c web_search=\"disabled\" -c fetch=\"disabled\" --dangerously-bypass-approvals-and-sandbox --skip-git-repo-check --prompt-file /tmp/gh-aw/aw-prompts/prompt.txt' 2>&1 | tee -a /tmp/gh-aw/agent-stdio.log\n env:\n CODEX_API_KEY: ${{ secrets.CODEX_API_KEY || secrets.OPENAI_API_KEY }}\n CODEX_HOME: /tmp/gh-aw/mcp-config\n GH_AW_MAX_TURNS: ${{ vars.GH_AW_DEFAULT_MAX_TURNS || '' }}\n GH_AW_MCP_CONFIG: ${{ runner.temp }}/gh-aw/mcp-config/config.toml\n GH_AW_MODEL_AGENT_CODEX: gpt-5.4\n GH_AW_PHASE: agent\n GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt\n GH_AW_SAFE_OUTPUTS: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS }}\n GH_AW_VERSION: v0.79.4\n GITHUB_AW: true\n GITHUB_STEP_SUMMARY: /tmp/gh-aw/agent-step-summary.md\n GIT_AUTHOR_EMAIL: github-actions[bot]@users.noreply.github.com\n GIT_AUTHOR_NAME: github-actions[bot]\n GIT_COMMITTER_EMAIL: github-actions[bot]@users.noreply.github.com\n GIT_COMMITTER_NAME: github-actions[bot]\n OPENAI_API_KEY: ${{ secrets.PIXEL_API_KEY }}\n OPENAI_BASE_URL: https://ai-pixel.online\n RUNNER_TEMP: ${{ runner.temp }}\n RUST_LOG: ${{ runner.debug == 1 && 'trace,hyper_util=info,mio=info,reqwest=info,os_info=info,codex_otel=warn,codex_core=debug,ocodex_exec=debug' || 'warn' }}\n - name: Detect agent errors\n if: always()\n id: detect-agent-errors\n continue-on-error: true\n run: node \"${RUNNER_TEMP}/gh-aw/actions/detect_agent_errors.cjs\"\n - name: Configure Git credentials\n env:\n REPO_NAME: ${{ github.repository }}\n SERVER_URL: ${{ github.server_url }}\n GITHUB_TOKEN: ${{ github.token }}\n run: |\n git config --global user.email \"github-actions[bot]@users.noreply.github.com\"\n git config --global user.name \"github-actions[bot]\"\n git config --global am.keepcr true\n # Re-authenticate git with GitHub token\n SERVER_URL_STRIPPED=\"${SERVER_URL#https://}\"\n git remote set-url origin \"https://x-access-token:${GITHUB_TOKEN}@${SERVER_URL_STRIPPED}/${REPO_NAME}.git\"\n echo \"Git configured with standard GitHub Actions identity\"\n - name: Stop MCP Gateway\n if: always()\n continue-on-error: true\n env:\n MCP_GATEWAY_PORT: ${{ steps.start-mcp-gateway.outputs.gateway-port }}\n MCP_GATEWAY_API_KEY: ${{ steps.start-mcp-gateway.outputs.gateway-api-key }}\n GATEWAY_PID: ${{ steps.start-mcp-gateway.outputs.gateway-pid }}\n run: |\n bash \"${RUNNER_TEMP}/gh-aw/actions/stop_mcp_gateway.sh\" \"$GATEWAY_PID\"\n - name: Redact secrets in logs\n if: always()\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n with:\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/redact_secrets.cjs');\n await main();\n env:\n GH_AW_SECRET_NAMES: 'CODEX_API_KEY,GH_AW_GITHUB_MCP_SERVER_TOKEN,GH_AW_GITHUB_TOKEN,GITHUB_TOKEN,OPENAI_API_KEY,PIXEL_API_KEY'\n SECRET_CODEX_API_KEY: ${{ secrets.CODEX_API_KEY }}\n SECRET_GH_AW_GITHUB_MCP_SERVER_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN }}\n SECRET_GH_AW_GITHUB_TOKEN: ${{ secrets.GH_AW_GITHUB_TOKEN }}\n SECRET_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}\n SECRET_OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}\n SECRET_PIXEL_API_KEY: ${{ secrets.PIXEL_API_KEY }}\n - name: Append agent step summary\n if: always()\n run: bash \"${RUNNER_TEMP}/gh-aw/actions/append_agent_step_summary.sh\"\n - name: Copy Safe Outputs\n if: always()\n env:\n GH_AW_SAFE_OUTPUTS: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS }}\n run: |\n mkdir -p /tmp/gh-aw\n cp \"$GH_AW_SAFE_OUTPUTS\" /tmp/gh-aw/safeoutputs.jsonl 2>/dev/null || true\n - name: Ingest agent output\n id: collect_output\n if: always()\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n env:\n GH_AW_SAFE_OUTPUTS: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS }}\n GH_AW_ALLOWED_DOMAINS: \"172.30.0.1,ai-pixel.online,api-inference.modelscope.cn,api.commandcode.ai,api.deepseek.com,api.minimaxi.com,api.openai.com,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,chatgpt.com,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,host.docker.internal,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,open.bigmodel.cn,openai.com,opencode.ai,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,ppa.launchpad.net,s.symcb.com,s.symcd.com,security.ubuntu.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com,www.googleapis.com\"\n GITHUB_SERVER_URL: ${{ github.server_url }}\n GITHUB_API_URL: ${{ github.api_url }}\n with:\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/collect_ndjson_output.cjs');\n await main();\n - name: Parse agent logs for step summary\n if: always()\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n env:\n GH_AW_AGENT_OUTPUT: /tmp/gh-aw/agent-stdio.log\n with:\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/parse_codex_log.cjs');\n await main();\n - name: Parse MCP Gateway logs for step summary\n if: always()\n id: parse-mcp-gateway\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n with:\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/parse_mcp_gateway_log.cjs');\n await main();\n - name: Print firewall logs\n if: always()\n continue-on-error: true\n env:\n AWF_LOGS_DIR: /tmp/gh-aw/sandbox/firewall/logs\n run: |\n # Fix permissions on firewall logs/audit dirs so they can be uploaded as artifacts\n # AWF runs with sudo, creating files owned by root\n sudo chmod -R a+rX /tmp/gh-aw/sandbox/firewall 2>/dev/null || true\n # Only run awf logs summary if awf command exists (it may not be installed if workflow failed before install step)\n if command -v awf &> /dev/null; then\n awf logs summary | tee -a \"$GITHUB_STEP_SUMMARY\"\n else\n echo 'AWF binary not installed, skipping firewall log summary'\n fi\n - name: Parse token usage for step summary\n if: always()\n continue-on-error: true\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n with:\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/parse_token_usage.cjs');\n await main();\n - name: Print AWF reflect summary\n if: always()\n continue-on-error: true\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n with:\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/awf_reflect_summary.cjs');\n await main();\n - name: Write agent output placeholder if missing\n if: always()\n run: |\n if [ ! -f /tmp/gh-aw/agent_output.json ]; then\n echo '{\"items\":[]}' > /tmp/gh-aw/agent_output.json\n fi\n - name: Upload agent artifacts\n if: always()\n continue-on-error: true\n uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1\n with:\n name: agent\n path: |\n /tmp/gh-aw/aw-prompts/prompt.txt\n /tmp/gh-aw/mcp-config/logs/\n /tmp/gh-aw/redacted-urls.log\n /tmp/gh-aw/mcp-logs/\n /tmp/gh-aw/proxy-logs/\n !/tmp/gh-aw/proxy-logs/proxy-tls/\n /tmp/gh-aw/agent_usage.json\n /tmp/gh-aw/agent-stdio.log\n /tmp/gh-aw/pre-agent-audit.txt\n /tmp/gh-aw/agent/\n /tmp/gh-aw/github_rate_limits.jsonl\n /tmp/gh-aw/safeoutputs.jsonl\n /tmp/gh-aw/agent_output.json\n /tmp/gh-aw/aw-*.patch\n /tmp/gh-aw/aw-*.bundle\n /tmp/gh-aw/awf-config.json\n /tmp/gh-aw/sandbox/firewall/logs/\n /tmp/gh-aw/sandbox/firewall/audit/\n /tmp/gh-aw/sandbox/firewall/awf-reflect.json\n if-no-files-found: ignore\n\n call-issue-handle-bug:\n needs: safe_outputs\n if: needs.safe_outputs.outputs.call_workflow_name == 'issue-handle-bug'\n permissions:\n actions: read\n checks: read\n contents: read\n discussions: write\n issues: write\n pull-requests: write\n statuses: read\n uses: ./.github/workflows/issue-handle-bug.lock.yml\n with:\n aw_context: ${{ fromJSON(needs.safe_outputs.outputs.call_workflow_payload).aw_context }}\n issue_number: ${{ fromJSON(needs.safe_outputs.outputs.call_workflow_payload).issue_number }}\n payload: ${{ needs.safe_outputs.outputs.call_workflow_payload }}\n secrets:\n CODEX_API_KEY: ${{ secrets.CODEX_API_KEY }}\n GH_AW_GITHUB_MCP_SERVER_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN }}\n GH_AW_GITHUB_TOKEN: ${{ secrets.GH_AW_GITHUB_TOKEN }}\n OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}\n PIXEL_API_KEY: ${{ secrets.PIXEL_API_KEY }}\n\n call-issue-handle-enhancement:\n needs: safe_outputs\n if: needs.safe_outputs.outputs.call_workflow_name == 'issue-handle-enhancement'\n permissions:\n actions: read\n checks: read\n contents: read\n discussions: write\n issues: write\n pull-requests: write\n statuses: read\n uses: ./.github/workflows/issue-handle-enhancement.lock.yml\n with:\n aw_context: ${{ fromJSON(needs.safe_outputs.outputs.call_workflow_payload).aw_context }}\n issue_number: ${{ fromJSON(needs.safe_outputs.outputs.call_workflow_payload).issue_number }}\n payload: ${{ needs.safe_outputs.outputs.call_workflow_payload }}\n secrets:\n CODEX_API_KEY: ${{ secrets.CODEX_API_KEY }}\n GH_AW_GITHUB_MCP_SERVER_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN }}\n GH_AW_GITHUB_TOKEN: ${{ secrets.GH_AW_GITHUB_TOKEN }}\n OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}\n PIXEL_API_KEY: ${{ secrets.PIXEL_API_KEY }}\n\n call-issue-handle-other:\n needs: safe_outputs\n if: needs.safe_outputs.outputs.call_workflow_name == 'issue-handle-other'\n permissions:\n actions: read\n checks: read\n contents: read\n discussions: write\n issues: write\n pull-requests: write\n statuses: read\n uses: ./.github/workflows/issue-handle-other.lock.yml\n with:\n aw_context: ${{ fromJSON(needs.safe_outputs.outputs.call_workflow_payload).aw_context }}\n issue_number: ${{ fromJSON(needs.safe_outputs.outputs.call_workflow_payload).issue_number }}\n payload: ${{ needs.safe_outputs.outputs.call_workflow_payload }}\n secrets:\n CODEX_API_KEY: ${{ secrets.CODEX_API_KEY }}\n GH_AW_GITHUB_MCP_SERVER_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN }}\n GH_AW_GITHUB_TOKEN: ${{ secrets.GH_AW_GITHUB_TOKEN }}\n OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}\n PIXEL_API_KEY: ${{ secrets.PIXEL_API_KEY }}\n\n call-issue-handle-question:\n needs: safe_outputs\n if: needs.safe_outputs.outputs.call_workflow_name == 'issue-handle-question'\n permissions:\n actions: read\n checks: read\n contents: read\n discussions: write\n issues: write\n pull-requests: write\n statuses: read\n uses: ./.github/workflows/issue-handle-question.lock.yml\n with:\n aw_context: ${{ fromJSON(needs.safe_outputs.outputs.call_workflow_payload).aw_context }}\n issue_number: ${{ fromJSON(needs.safe_outputs.outputs.call_workflow_payload).issue_number }}\n payload: ${{ needs.safe_outputs.outputs.call_workflow_payload }}\n secrets:\n CODEX_API_KEY: ${{ secrets.CODEX_API_KEY }}\n GH_AW_GITHUB_MCP_SERVER_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN }}\n GH_AW_GITHUB_TOKEN: ${{ secrets.GH_AW_GITHUB_TOKEN }}\n OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}\n PIXEL_API_KEY: ${{ secrets.PIXEL_API_KEY }}\n\n conclusion:\n needs:\n - activation\n - agent\n - call-issue-handle-bug\n - call-issue-handle-enhancement\n - call-issue-handle-other\n - call-issue-handle-question\n - detection\n - safe_outputs\n if: >\n always() && (needs.agent.result != 'skipped' || needs.activation.outputs.lockdown_check_failed == 'true' ||\n needs.activation.outputs.stale_lock_file_failed == 'true' || needs.activation.outputs.daily_effective_workflow_exceeded == 'true')\n runs-on: ubuntu-slim\n permissions:\n contents: read\n discussions: write\n issues: write\n pull-requests: write\n concurrency:\n group: \"gh-aw-conclusion-issue-triage\"\n cancel-in-progress: false\n queue: max\n outputs:\n incomplete_count: ${{ steps.report_incomplete.outputs.incomplete_count }}\n noop_message: ${{ steps.noop.outputs.noop_message }}\n tools_reported: ${{ steps.missing_tool.outputs.tools_reported }}\n total_count: ${{ steps.missing_tool.outputs.total_count }}\n steps:\n - name: Setup Scripts\n id: setup\n uses: github/gh-aw-actions/setup@7cfd95b59ca996b7e2bebd6222e21ddd187a4e91 # v0.79.4\n with:\n destination: ${{ runner.temp }}/gh-aw/actions\n job-name: ${{ github.job }}\n trace-id: ${{ needs.activation.outputs.setup-trace-id }}\n parent-span-id: ${{ needs.activation.outputs.setup-parent-span-id || needs.activation.outputs.setup-span-id }}\n env:\n GH_AW_SETUP_WORKFLOW_NAME: \"Issue Triage\"\n GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/issue-triage.lock.yml@${{ github.ref }}\n GH_AW_INFO_VERSION: \"0.137.0\"\n GH_AW_INFO_AWF_VERSION: \"v0.27.0\"\n GH_AW_INFO_ENGINE_ID: \"codex\"\n - name: Download agent output artifact\n id: download-agent-output\n continue-on-error: true\n uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1\n with:\n name: agent\n path: /tmp/gh-aw/\n - name: Setup agent output environment variable\n id: setup-agent-output-env\n if: steps.download-agent-output.outcome == 'success'\n run: |\n mkdir -p /tmp/gh-aw/\n find \"/tmp/gh-aw/\" -type f -print\n echo \"GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json\" >> \"$GITHUB_OUTPUT\"\n - name: Collect usage artifact files\n if: always()\n continue-on-error: true\n run: |\n mkdir -p /tmp/gh-aw/usage/agent /tmp/gh-aw/usage/detection\n echo \"Usage artifact source file status:\"\n for file in /tmp/gh-aw/aw-info.jsonl /tmp/gh-aw/agent_usage.jsonl /tmp/gh-aw/detection_usage.jsonl /tmp/gh-aw/sandbox/firewall-audit-logs/api-proxy-logs/token-usage.jsonl /tmp/gh-aw/sandbox/firewall/logs/api-proxy-logs/token-usage.jsonl /tmp/gh-aw/sandbox/firewall/audit/api-proxy-logs/token-usage.jsonl /tmp/gh-aw/threat-detection/sandbox/firewall-audit-logs/api-proxy-logs/token-usage.jsonl /tmp/gh-aw/threat-detection/sandbox/firewall/logs/api-proxy-logs/token-usage.jsonl /tmp/gh-aw/threat-detection/sandbox/firewall/audit/api-proxy-logs/token-usage.jsonl; do\n [ -f \"$file\" ] && echo \"FOUND: $file\" || echo \"MISSING: $file\"\n done\n [ -f /tmp/gh-aw/aw-info.jsonl ] && cp /tmp/gh-aw/aw-info.jsonl /tmp/gh-aw/usage/aw-info.jsonl || true\n [ -f /tmp/gh-aw/agent_usage.jsonl ] && cp /tmp/gh-aw/agent_usage.jsonl /tmp/gh-aw/usage/agent_usage.jsonl || true\n [ -f /tmp/gh-aw/detection_usage.jsonl ] && cp /tmp/gh-aw/detection_usage.jsonl /tmp/gh-aw/usage/detection_usage.jsonl || true\n [ -f /tmp/gh-aw/sandbox/firewall-audit-logs/api-proxy-logs/token-usage.jsonl ] && cp /tmp/gh-aw/sandbox/firewall-audit-logs/api-proxy-logs/token-usage.jsonl /tmp/gh-aw/usage/agent/token_usage.jsonl || true\n [ -f /tmp/gh-aw/sandbox/firewall/logs/api-proxy-logs/token-usage.jsonl ] && cp /tmp/gh-aw/sandbox/firewall/logs/api-proxy-logs/token-usage.jsonl /tmp/gh-aw/usage/agent/token_usage.jsonl || true\n [ -f /tmp/gh-aw/sandbox/firewall/audit/api-proxy-logs/token-usage.jsonl ] && cp /tmp/gh-aw/sandbox/firewall/audit/api-proxy-logs/token-usage.jsonl /tmp/gh-aw/usage/agent/token_usage.jsonl || true\n [ -f /tmp/gh-aw/threat-detection/sandbox/firewall-audit-logs/api-proxy-logs/token-usage.jsonl ] && cp /tmp/gh-aw/threat-detection/sandbox/firewall-audit-logs/api-proxy-logs/token-usage.jsonl /tmp/gh-aw/usage/detection/token_usage.jsonl || true\n [ -f /tmp/gh-aw/threat-detection/sandbox/firewall/logs/api-proxy-logs/token-usage.jsonl ] && cp /tmp/gh-aw/threat-detection/sandbox/firewall/logs/api-proxy-logs/token-usage.jsonl /tmp/gh-aw/usage/detection/token_usage.jsonl || true\n [ -f /tmp/gh-aw/threat-detection/sandbox/firewall/audit/api-proxy-logs/token-usage.jsonl ] && cp /tmp/gh-aw/threat-detection/sandbox/firewall/audit/api-proxy-logs/token-usage.jsonl /tmp/gh-aw/usage/detection/token_usage.jsonl || true\n [ -f /tmp/gh-aw/usage/agent/token_usage.jsonl ] || : > /tmp/gh-aw/usage/agent/token_usage.jsonl\n [ -f /tmp/gh-aw/usage/detection/token_usage.jsonl ] || : > /tmp/gh-aw/usage/detection/token_usage.jsonl\n find /tmp/gh-aw/usage -type f -print | sort\n - name: Upload usage artifact\n if: always()\n continue-on-error: true\n uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1\n with:\n name: usage\n path: |\n /tmp/gh-aw/usage/aw-info.jsonl\n /tmp/gh-aw/usage/agent_usage.jsonl\n /tmp/gh-aw/usage/detection_usage.jsonl\n /tmp/gh-aw/usage/agent/token_usage.jsonl\n /tmp/gh-aw/usage/detection/token_usage.jsonl\n if-no-files-found: ignore\n - name: Process no-op messages\n id: noop\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n env:\n GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }}\n GH_AW_NOOP_MAX: \"1\"\n GH_AW_WORKFLOW_NAME: \"Issue Triage\"\n GH_AW_WORKFLOW_SOURCE_URL: \"${{ github.server_url }}/${{ github.repository }}/blob/${{ github.ref_name }}/.github/workflows/issue-triage.md\"\n GH_AW_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}\n GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }}\n GH_AW_NOOP_REPORT_AS_ISSUE: \"true\"\n GH_AW_AIC: ${{ needs.agent.outputs.aic }}\n GH_AW_THREAT_DETECTION_AIC: ${{ needs.detection.outputs.aic }}\n GH_AW_AMBIENT_CONTEXT: ${{ needs.agent.outputs.ambient_context }}\n GH_AW_WORKFLOW_ID: \"issue-triage\"\n with:\n github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/handle_noop_message.cjs');\n await main();\n - name: Log detection run\n id: detection_runs\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n env:\n GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }}\n GH_AW_WORKFLOW_NAME: \"Issue Triage\"\n GH_AW_WORKFLOW_SOURCE_URL: \"${{ github.server_url }}/${{ github.repository }}/blob/${{ github.ref_name }}/.github/workflows/issue-triage.md\"\n GH_AW_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}\n GH_AW_DETECTION_CONCLUSION: ${{ needs.detection.outputs.detection_conclusion }}\n GH_AW_DETECTION_REASON: ${{ needs.detection.outputs.detection_reason }}\n with:\n github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/handle_detection_runs.cjs');\n await main();\n - name: Record missing tool\n id: missing_tool\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n env:\n GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }}\n GH_AW_MISSING_TOOL_CREATE_ISSUE: \"true\"\n GH_AW_WORKFLOW_NAME: \"Issue Triage\"\n GH_AW_WORKFLOW_SOURCE_URL: \"${{ github.server_url }}/${{ github.repository }}/blob/${{ github.ref_name }}/.github/workflows/issue-triage.md\"\n with:\n github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/missing_tool.cjs');\n await main();\n - name: Record incomplete\n id: report_incomplete\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n env:\n GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }}\n GH_AW_REPORT_INCOMPLETE_CREATE_ISSUE: \"true\"\n GH_AW_WORKFLOW_NAME: \"Issue Triage\"\n GH_AW_WORKFLOW_SOURCE_URL: \"${{ github.server_url }}/${{ github.repository }}/blob/${{ github.ref_name }}/.github/workflows/issue-triage.md\"\n with:\n github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/report_incomplete_handler.cjs');\n await main();\n - name: Handle agent failure\n id: handle_agent_failure\n if: always()\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n env:\n GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }}\n GH_AW_WORKFLOW_NAME: \"Issue Triage\"\n GH_AW_WORKFLOW_SOURCE_URL: \"${{ github.server_url }}/${{ github.repository }}/blob/${{ github.ref_name }}/.github/workflows/issue-triage.md\"\n GH_AW_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}\n GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }}\n GH_AW_WORKFLOW_ID: \"issue-triage\"\n GH_AW_ACTION_FAILURE_ISSUE_EXPIRES_HOURS: \"168\"\n GH_AW_ENGINE_ID: \"codex\"\n GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}\n GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}\n GH_AW_EFFECTIVE_TOKENS: ${{ needs.agent.outputs.effective_tokens || '' }}\n GH_AW_AI_CREDITS_RATE_LIMIT_ERROR: ${{ needs.agent.outputs.ai_credits_rate_limit_error || 'false' }}\n GH_AW_AIC: ${{ needs.agent.outputs.aic }}\n GH_AW_MAX_AI_CREDITS: ${{ vars.GH_AW_DEFAULT_MAX_AI_CREDITS || '1000' }}\n GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}\n GH_AW_MCP_POLICY_ERROR: ${{ needs.agent.outputs.mcp_policy_error }}\n GH_AW_AGENTIC_ENGINE_TIMEOUT: ${{ needs.agent.outputs.agentic_engine_timeout }}\n GH_AW_MODEL_NOT_SUPPORTED_ERROR: ${{ needs.agent.outputs.model_not_supported_error }}\n GH_AW_ENGINE_API_HOSTS: \"api.openai.com\"\n GH_AW_LOCKDOWN_CHECK_FAILED: ${{ needs.activation.outputs.lockdown_check_failed }}\n GH_AW_STALE_LOCK_FILE_FAILED: ${{ needs.activation.outputs.stale_lock_file_failed }}\n GH_AW_DAILY_EFFECTIVE_WORKFLOW_EXCEEDED: ${{ needs.activation.outputs.daily_effective_workflow_exceeded }}\n GH_AW_DAILY_EFFECTIVE_WORKFLOW_TOTAL_EFFECTIVE_TOKENS: ${{ needs.activation.outputs.daily_effective_workflow_total_effective_tokens }}\n GH_AW_DAILY_EFFECTIVE_WORKFLOW_THRESHOLD: ${{ needs.activation.outputs.daily_effective_workflow_threshold }}\n GH_AW_GROUP_REPORTS: \"false\"\n GH_AW_FAILURE_REPORT_AS_ISSUE: \"true\"\n GH_AW_MISSING_TOOL_REPORT_AS_FAILURE: \"true\"\n GH_AW_MISSING_DATA_REPORT_AS_FAILURE: \"true\"\n GH_AW_TIMEOUT_MINUTES: \"5\"\n with:\n github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/handle_agent_failure.cjs');\n await main();\n\n detection:\n needs:\n - activation\n - agent\n if: >\n always() && needs.agent.result != 'skipped' && (needs.agent.outputs.output_types != '' || needs.agent.outputs.has_patch == 'true')\n runs-on: ubuntu-latest\n permissions:\n contents: read\n outputs:\n aic: ${{ steps.parse_detection_token_usage.outputs.aic }}\n detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}\n detection_reason: ${{ steps.detection_conclusion.outputs.reason }}\n detection_success: ${{ steps.detection_conclusion.outputs.success }}\n steps:\n - name: Setup Scripts\n id: setup\n uses: github/gh-aw-actions/setup@7cfd95b59ca996b7e2bebd6222e21ddd187a4e91 # v0.79.4\n with:\n destination: ${{ runner.temp }}/gh-aw/actions\n job-name: ${{ github.job }}\n trace-id: ${{ needs.activation.outputs.setup-trace-id }}\n parent-span-id: ${{ needs.activation.outputs.setup-parent-span-id || needs.activation.outputs.setup-span-id }}\n env:\n GH_AW_SETUP_WORKFLOW_NAME: \"Issue Triage\"\n GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/issue-triage.lock.yml@${{ github.ref }}\n GH_AW_INFO_VERSION: \"0.137.0\"\n GH_AW_INFO_AWF_VERSION: \"v0.27.0\"\n GH_AW_INFO_ENGINE_ID: \"codex\"\n - name: Download agent output artifact\n id: download-agent-output\n continue-on-error: true\n uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1\n with:\n name: agent\n path: /tmp/gh-aw/\n - name: Setup agent output environment variable\n id: setup-agent-output-env\n if: steps.download-agent-output.outcome == 'success'\n run: |\n mkdir -p /tmp/gh-aw/\n find \"/tmp/gh-aw/\" -type f -print\n echo \"GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json\" >> \"$GITHUB_OUTPUT\"\n - name: Checkout repository for patch context\n if: needs.agent.outputs.has_patch == 'true'\n uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3\n with:\n persist-credentials: false\n # --- Threat Detection ---\n - name: Clean stale firewall files from agent artifact\n run: |\n rm -rf /tmp/gh-aw/sandbox/firewall/logs\n rm -rf /tmp/gh-aw/sandbox/firewall/audit\n - name: Check if detection needed\n id: detection_guard\n if: always()\n env:\n OUTPUT_TYPES: ${{ needs.agent.outputs.output_types }}\n HAS_PATCH: ${{ needs.agent.outputs.has_patch }}\n run: |\n if [[ -n \"$OUTPUT_TYPES\" || \"$HAS_PATCH\" == \"true\" ]]; then\n echo \"run_detection=true\" >> \"$GITHUB_OUTPUT\"\n echo \"Detection will run: output_types=$OUTPUT_TYPES, has_patch=$HAS_PATCH\"\n else\n echo \"run_detection=false\" >> \"$GITHUB_OUTPUT\"\n echo \"Detection skipped: no agent outputs or patches to analyze\"\n fi\n - name: Clear MCP Config for detection\n if: always() && steps.detection_guard.outputs.run_detection == 'true'\n run: |\n rm -f \"${RUNNER_TEMP}/gh-aw/mcp-config/mcp-servers.json\"\n rm -f /home/runner/.copilot/mcp-config.json\n rm -f \"$GITHUB_WORKSPACE/.gemini/settings.json\"\n - name: Prepare threat detection files\n if: always() && steps.detection_guard.outputs.run_detection == 'true'\n run: |\n mkdir -p /tmp/gh-aw/threat-detection/aw-prompts\n rm -f /tmp/gh-aw/agent_usage.json\n cp /tmp/gh-aw/aw-prompts/prompt.txt /tmp/gh-aw/threat-detection/aw-prompts/prompt.txt 2>/dev/null || true\n if [ ! -s /tmp/gh-aw/threat-detection/aw-prompts/prompt.txt ]; then\n echo \"::warning::ERR_VALIDATION: Missing or empty detection context prompt at /tmp/gh-aw/threat-detection/aw-prompts/prompt.txt. Ensure the agent artifact includes /tmp/gh-aw/aw-prompts/prompt.txt. Detection will continue with fallback workflow context.\"\n fi\n cp /tmp/gh-aw/agent_output.json /tmp/gh-aw/threat-detection/agent_output.json 2>/dev/null || true\n for f in /tmp/gh-aw/aw-*.patch; do\n [ -f \"$f\" ] && cp \"$f\" /tmp/gh-aw/threat-detection/ 2>/dev/null || true\n done\n for f in /tmp/gh-aw/aw-*.bundle; do\n [ -f \"$f\" ] && cp \"$f\" /tmp/gh-aw/threat-detection/ 2>/dev/null || true\n done\n echo \"Prepared threat detection files:\"\n ls -la /tmp/gh-aw/threat-detection/ 2>/dev/null || true\n - name: Setup threat detection\n if: always() && steps.detection_guard.outputs.run_detection == 'true'\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n env:\n WORKFLOW_NAME: \"Issue Triage\"\n WORKFLOW_DESCRIPTION: \"对新打开的 issue 进行分类、打标签，并路由到对应的处理工作流\"\n HAS_PATCH: ${{ needs.agent.outputs.has_patch }}\n with:\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/setup_threat_detection.cjs');\n await main();\n - name: Ensure threat-detection directory and log\n if: always() && steps.detection_guard.outputs.run_detection == 'true'\n run: |\n mkdir -p /tmp/gh-aw/threat-detection\n touch /tmp/gh-aw/threat-detection/detection.log\n - name: Setup Node.js\n uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0\n with:\n node-version: '24'\n package-manager-cache: false\n - name: Install Codex CLI\n run: npm install --ignore-scripts -g @openai/codex@0.137.0\n - name: Install AWF binary\n run: bash \"${RUNNER_TEMP}/gh-aw/actions/install_awf_binary.sh\" v0.27.0\n - name: Download container images\n run: bash \"${RUNNER_TEMP}/gh-aw/actions/download_docker_images.sh\" ghcr.io/github/gh-aw-firewall/agent:0.27.0 ghcr.io/github/gh-aw-firewall/api-proxy:0.27.0 ghcr.io/github/gh-aw-firewall/squid:0.27.0 ghcr.io/github/gh-aw-mcpg:v0.3.25@sha256:c10331ad17668ef89f38f5e356678788a40b0cd5fef96e8f92e1d9c1de47cbaa\n - name: Start MCP Gateway\n id: start-mcp-gateway\n env:\n CODEX_HOME: /tmp/gh-aw/mcp-config\n run: |\n set -eo pipefail\n mkdir -p \"${RUNNER_TEMP}/gh-aw/mcp-config\"\n \n # Export gateway environment variables for MCP config and gateway script\n export MCP_GATEWAY_PORT=\"8080\"\n export MCP_GATEWAY_DOMAIN=\"host.docker.internal\"\n export MCP_GATEWAY_HOST_DOMAIN=\"localhost\"\n MCP_GATEWAY_API_KEY=$(openssl rand -base64 45 | tr -d '/+=')\n echo \"::add-mask::${MCP_GATEWAY_API_KEY}\"\n export MCP_GATEWAY_API_KEY\n export MCP_GATEWAY_PAYLOAD_DIR=\"/tmp/gh-aw/mcp-payloads\"\n mkdir -p \"${MCP_GATEWAY_PAYLOAD_DIR}\"\n export MCP_GATEWAY_PAYLOAD_SIZE_THRESHOLD=\"524288\"\n export DEBUG=\"*\"\n \n export GH_AW_ENGINE=\"codex\"\n MCP_GATEWAY_UID=$(id -u 2>/dev/null || echo '0')\n MCP_GATEWAY_GID=$(id -g 2>/dev/null || echo '0')\n case \"${DOCKER_HOST:-}\" in\n unix://* ) DOCKER_SOCK_PATH=\"${DOCKER_HOST#unix://}\" ;;\n /* ) DOCKER_SOCK_PATH=\"$DOCKER_HOST\" ;;\n * ) DOCKER_SOCK_PATH=/var/run/docker.sock ;;\n esac\n DOCKER_SOCK_GID=$(stat -c '%g' \"$DOCKER_SOCK_PATH\" 2>/dev/null || echo '0')\n export MCP_GATEWAY_DOCKER_COMMAND='docker run -i --rm --network host --add-host host.docker.internal:127.0.0.1 --user '\"${MCP_GATEWAY_UID}\"':'\"${MCP_GATEWAY_GID}\"' --group-add '\"${DOCKER_SOCK_GID}\"' -v '\"${DOCKER_SOCK_PATH}\"':/var/run/docker.sock -e MCP_GATEWAY_PORT -e MCP_GATEWAY_DOMAIN -e MCP_GATEWAY_API_KEY -e MCP_GATEWAY_PAYLOAD_DIR -e MCP_GATEWAY_PAYLOAD_SIZE_THRESHOLD -e DOCKER_HOST=unix:///var/run/docker.sock -e DEBUG -e MCP_GATEWAY_LOG_DIR -e GH_AW_MCP_LOG_DIR -e GH_AW_SAFE_OUTPUTS -e GH_AW_SAFE_OUTPUTS_CONFIG_PATH -e GH_AW_SAFE_OUTPUTS_TOOLS_PATH -e GH_AW_ASSETS_BRANCH -e GH_AW_ASSETS_MAX_SIZE_KB -e GH_AW_ASSETS_ALLOWED_EXTS -e DEFAULT_BRANCH -e GITHUB_MCP_SERVER_TOKEN -e GITHUB_MCP_GUARD_MIN_INTEGRITY -e GITHUB_MCP_GUARD_REPOS -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e GITHUB_SHA -e GITHUB_WORKSPACE -e GITHUB_TOKEN -e GITHUB_RUN_ID -e GITHUB_RUN_NUMBER -e GITHUB_RUN_ATTEMPT -e GITHUB_JOB -e GITHUB_ACTION -e GITHUB_EVENT_NAME -e GITHUB_EVENT_PATH -e GITHUB_ACTOR -e GITHUB_ACTOR_ID -e GITHUB_TRIGGERING_ACTOR -e GITHUB_WORKFLOW -e GITHUB_WORKFLOW_REF -e GITHUB_WORKFLOW_SHA -e GITHUB_REF -e GITHUB_REF_NAME -e GITHUB_REF_TYPE -e GITHUB_HEAD_REF -e GITHUB_BASE_REF -e CODEX_HOME -v /tmp/gh-aw/mcp-payloads:/tmp/gh-aw/mcp-payloads:rw -v /opt:/opt:ro -v /tmp:/tmp:rw -v '\"${GITHUB_WORKSPACE}\"':'\"${GITHUB_WORKSPACE}\"':rw ghcr.io/github/gh-aw-mcpg:v0.3.25'\n \n cat > \"${RUNNER_TEMP}/gh-aw/mcp-config/config.toml\" << GH_AW_MCP_CONFIG_9dc1744e356f5fbe_EOF\n [history]\n persistence = \"none\"\n \n [shell_environment_policy]\n inherit = \"core\"\n include_only = [\"^CODEX_API_KEY$\", \"^HOME$\", \"^OPENAI_API_KEY$\", \"^PATH$\"]\n GH_AW_MCP_CONFIG_9dc1744e356f5fbe_EOF\n \n # Generate JSON config for MCP gateway\n GH_AW_NODE=$(which node 2>/dev/null || command -v node 2>/dev/null || echo node)\n cat << GH_AW_MCP_CONFIG_37834a58b4c29838_EOF | \"$GH_AW_NODE\" \"${RUNNER_TEMP}/gh-aw/actions/start_mcp_gateway.cjs\"\n {\n \"mcpServers\": {\n },\n \"gateway\": {\n \"port\": $MCP_GATEWAY_PORT,\n \"domain\": \"${MCP_GATEWAY_DOMAIN}\",\n \"apiKey\": \"${MCP_GATEWAY_API_KEY}\",\n \"payloadDir\": \"${MCP_GATEWAY_PAYLOAD_DIR}\"\n }\n }\n GH_AW_MCP_CONFIG_37834a58b4c29838_EOF\n \n # Sync converter output to writable CODEX_HOME for Codex\n mkdir -p /tmp/gh-aw/mcp-config\n cat > \"/tmp/gh-aw/mcp-config/config.toml\" << GH_AW_CODEX_SHELL_POLICY_cb4a4f0f8e96eaf4_EOF\n model_provider = \"openai-proxy\"\n [model_providers.openai-proxy]\n name = \"OpenAI AWF proxy\"\n base_url = \"http://172.30.0.30:10000\"\n env_key = \"OPENAI_API_KEY\"\n supports_websockets = false\n [shell_environment_policy]\n inherit = \"core\"\n include_only = [\"^CODEX_API_KEY$\", \"^HOME$\", \"^OPENAI_API_KEY$\", \"^PATH$\"]\n GH_AW_CODEX_SHELL_POLICY_cb4a4f0f8e96eaf4_EOF\n awk '\n BEGIN { skip_openai_proxy = 0 }\n /^[[:space:]]*model_provider[[:space:]]*=/ { next }\n /^\\[model_providers\\.openai-proxy\\][[:space:]]*$/ { skip_openai_proxy = 1; next }\n /^\\[/ { skip_openai_proxy = 0 }\n !skip_openai_proxy { print }\n ' \"${RUNNER_TEMP}/gh-aw/mcp-config/config.toml\" >> \"/tmp/gh-aw/mcp-config/config.toml\"\n chmod 600 \"/tmp/gh-aw/mcp-config/config.toml\"\n mkdir -p \"${CODEX_HOME}\"\n if [ \"/tmp/gh-aw/mcp-config/config.toml\" != \"${CODEX_HOME}/config.toml\" ]; then cp \"/tmp/gh-aw/mcp-config/config.toml\" \"${CODEX_HOME}/config.toml\"; fi\n chmod 600 \"${CODEX_HOME}/config.toml\"\n - name: Execute Codex CLI\n if: always() && steps.detection_guard.outputs.run_detection == 'true'\n continue-on-error: true\n id: detection_agentic_execution\n run: |\n set -o pipefail\n printf '%s' \"$(date +%s%3N)\" > /tmp/gh-aw/agent_cli_start_ms.txt\n mkdir -p \"$CODEX_HOME/logs\" && touch /tmp/gh-aw/agent-step-summary.md && mkdir -p /tmp/gh-aw/threat-detection && printf '%s' '{\"type\":\"object\",\"properties\":{\"prompt_injection\":{\"type\":\"boolean\"},\"secret_leak\":{\"type\":\"boolean\"},\"malicious_patch\":{\"type\":\"boolean\"},\"reasons\":{\"type\":\"array\",\"items\":{\"type\":\"string\"}}},\"required\":[\"prompt_injection\",\"secret_leak\",\"malicious_patch\",\"reasons\"],\"additionalProperties\":false}' > /tmp/gh-aw/threat-detection/detection_schema.json\n (umask 177 && touch /tmp/gh-aw/threat-detection/detection.log)\n GH_AW_MAX_AI_CREDITS=\"${{ vars.GH_AW_DEFAULT_MAX_AI_CREDITS || '1000' }}\"\n printf '%s\\n' \"{\\\"\\$schema\\\":\\\"https://github.com/github/gh-aw-firewall/releases/download/v0.27.0/awf-config.schema.json\\\",\\\"network\\\":{\\\"allowDomains\\\":[\\\"172.30.0.1\\\",\\\"api.openai.com\\\",\\\"chatgpt.com\\\",\\\"host.docker.internal\\\",\\\"openai.com\\\"]},\\\"apiProxy\\\":{\\\"enabled\\\":true,\\\"enableTokenSteering\\\":true,\\\"maxRuns\\\":500,\\\"maxAiCredits\\\":${GH_AW_MAX_AI_CREDITS},\\\"targets\\\":{\\\"openai\\\":{\\\"host\\\":\\\"ai-pixel.online\\\"}}},\\\"container\\\":{\\\"imageTag\\\":\\\"0.27.0\\\"}}\" > \"${RUNNER_TEMP}/gh-aw/awf-config.json\"\n GH_AW_MODEL_MULTIPLIERS_PATH=\"/tmp/gh-aw/model_multipliers.json\" node \"${RUNNER_TEMP}/gh-aw/actions/merge_awf_model_multipliers.cjs\"\n cp \"${RUNNER_TEMP}/gh-aw/awf-config.json\" /tmp/gh-aw/awf-config.json\n export GH_AW_MODELS_JSON_PATH=\"/tmp/gh-aw/models.json\"\n GH_AW_DOCKER_HOST_PATH_PREFIX_ARGS=\"\"\n if [[ \"${DOCKER_HOST:-}\" =~ ^tcp:// ]]; then\n GH_AW_DOCKER_HOST_PATH_PREFIX_ARGS=\"--docker-host-path-prefix /tmp/gh-aw\"\n fi\n GH_AW_TOOL_CACHE_MOUNT=\"\"\n GH_AW_TOOL_CACHE=\"${RUNNER_TOOL_CACHE:-/opt/hostedtoolcache}\"\n if [ -d \"$GH_AW_TOOL_CACHE\" ]; then\n if [[ \"$GH_AW_TOOL_CACHE\" != /opt/* ]]; then\n GH_AW_TOOL_CACHE_MOUNT=\"$GH_AW_TOOL_CACHE:$GH_AW_TOOL_CACHE:ro\"\n fi\n elif [ -d \"/home/runner/work/_tool\" ]; then\n GH_AW_TOOL_CACHE_MOUNT=\"/home/runner/work/_tool:/home/runner/work/_tool:ro\"\n fi\n # shellcheck disable=SC1003\n sudo -E awf --config \"${RUNNER_TEMP}/gh-aw/awf-config.json\" --container-workdir \"${GITHUB_WORKSPACE}\" --mount \"${RUNNER_TEMP}/gh-aw:${RUNNER_TEMP}/gh-aw:ro\" --mount \"${RUNNER_TEMP}/gh-aw:/host${RUNNER_TEMP}/gh-aw:ro\" ${GH_AW_TOOL_CACHE_MOUNT:+--mount \"$GH_AW_TOOL_CACHE_MOUNT\"} ${GH_AW_DOCKER_HOST_PATH_PREFIX_ARGS} --env-all --exclude-env CODEX_API_KEY --exclude-env OPENAI_API_KEY --log-level info --proxy-logs-dir /tmp/gh-aw/sandbox/firewall/logs --audit-dir /tmp/gh-aw/sandbox/firewall/audit --enable-host-access --allow-host-ports 80,443,8080 --skip-pull \\\n -- /bin/bash -c 'set +o histexpand; GH_AW_TOOL_CACHE=\"${RUNNER_TOOL_CACHE:-/opt/hostedtoolcache}\"; export PATH=\"$(find \"$GH_AW_TOOL_CACHE\" /opt/hostedtoolcache /home/runner/work/_tool -maxdepth 5 -type d -name bin 2>/dev/null | tr '\\''\\n'\\'' '\\'':'\\'')$PATH\"; [ -n \"$GOROOT\" ] && export PATH=\"$GOROOT/bin:$PATH\" || true && GH_AW_NODE_EXEC=\"${GH_AW_NODE_BIN:-}\"; if [ -z \"$GH_AW_NODE_EXEC\" ] || [ ! -x \"$GH_AW_NODE_EXEC\" ]; then GH_AW_NODE_EXEC=\"$(command -v node 2>/dev/null || true)\"; fi; if [ -z \"$GH_AW_NODE_EXEC\" ]; then echo \"node runtime missing on this runner — check runtimes.node in workflow YAML\" >&2; exit 127; fi; GH_AW_NPM_GLOBAL_ROOT=\"$(npm root -g 2>/dev/null || true)\"; if [ -n \"$GH_AW_NPM_GLOBAL_ROOT\" ]; then export NODE_PATH=\"${GH_AW_NPM_GLOBAL_ROOT}${NODE_PATH:+:${NODE_PATH}}\"; fi; \"$GH_AW_NODE_EXEC\" ${RUNNER_TEMP}/gh-aw/actions/codex_harness.cjs codex exec${GH_AW_MODEL_DETECTION_CODEX:+ --model \"$GH_AW_MODEL_DETECTION_CODEX\"} -c web_search=\"disabled\" -c fetch=\"disabled\" --dangerously-bypass-approvals-and-sandbox --skip-git-repo-check --output-schema /tmp/gh-aw/threat-detection/detection_schema.json -o /tmp/gh-aw/threat-detection/detection_result.json --prompt-file /tmp/gh-aw/aw-prompts/prompt.txt' 2>&1 | tee -a /tmp/gh-aw/threat-detection/detection.log\n env:\n CODEX_API_KEY: ${{ secrets.CODEX_API_KEY || secrets.OPENAI_API_KEY }}\n CODEX_HOME: /tmp/gh-aw/mcp-config\n GH_AW_MAX_TURNS: ${{ vars.GH_AW_DEFAULT_MAX_TURNS || '' }}\n GH_AW_MCP_CONFIG: ${{ runner.temp }}/gh-aw/mcp-config/config.toml\n GH_AW_MODEL_DETECTION_CODEX: gpt-5.4\n GH_AW_PHASE: detection\n GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt\n GH_AW_VERSION: v0.79.4\n GITHUB_AW: true\n GITHUB_STEP_SUMMARY: /tmp/gh-aw/agent-step-summary.md\n GIT_AUTHOR_EMAIL: github-actions[bot]@users.noreply.github.com\n GIT_AUTHOR_NAME: github-actions[bot]\n GIT_COMMITTER_EMAIL: github-actions[bot]@users.noreply.github.com\n GIT_COMMITTER_NAME: github-actions[bot]\n OPENAI_API_KEY: ${{ secrets.PIXEL_API_KEY }}\n OPENAI_BASE_URL: https://ai-pixel.online\n RUNNER_TEMP: ${{ runner.temp }}\n RUST_LOG: ${{ runner.debug == 1 && 'trace,hyper_util=info,mio=info,reqwest=info,os_info=info,codex_otel=warn,codex_core=debug,ocodex_exec=debug' || 'warn' }}\n - name: Parse threat detection token usage for step summary\n id: parse_detection_token_usage\n if: always()\n continue-on-error: true\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n env:\n GH_AW_TOKEN_USAGE_SUMMARY_TITLE: Threat Detection Token Usage\n with:\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/parse_token_usage.cjs');\n await main();\n - name: Upload threat detection log\n if: always() && steps.detection_guard.outputs.run_detection == 'true'\n uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1\n with:\n name: detection\n path: /tmp/gh-aw/threat-detection/detection.log\n if-no-files-found: ignore\n - name: Parse and conclude threat detection\n id: detection_conclusion\n if: always()\n continue-on-error: true\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n env:\n RUN_DETECTION: ${{ steps.detection_guard.outputs.run_detection }}\n DETECTION_AGENTIC_EXECUTION_OUTCOME: ${{ steps.detection_agentic_execution.outcome }}\n GH_AW_DETECTION_CONTINUE_ON_ERROR: \"true\"\n with:\n script: |\n try {\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/parse_threat_detection_results.cjs');\n await main();\n } catch (loadErr) {\n const continueOnError = process.env.GH_AW_DETECTION_CONTINUE_ON_ERROR !== 'false';\n const detectionExecutionFailed = process.env.DETECTION_AGENTIC_EXECUTION_OUTCOME === 'failure';\n const msg = 'ERR_SYSTEM: \\u274C Unexpected error loading threat detection module: ' + (loadErr && loadErr.message ? loadErr.message : String(loadErr));\n core.error(msg);\n core.setOutput('reason', 'parse_error');\n if (continueOnError && !detectionExecutionFailed) {\n core.warning('\\u26A0\\uFE0F ' + msg);\n core.setOutput('conclusion', 'warning');\n core.setOutput('success', 'false');\n } else {\n core.setOutput('conclusion', 'failure');\n core.setOutput('success', 'false');\n core.setFailed(msg);\n }\n }\n\n safe_outputs:\n needs:\n - activation\n - agent\n - detection\n if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'\n runs-on: ubuntu-slim\n permissions:\n contents: read\n discussions: write\n issues: write\n pull-requests: write\n timeout-minutes: 45\n env:\n GH_AW_AGENT_AIC: ${{ needs.agent.outputs.aic }}\n GH_AW_AIC: ${{ needs.agent.outputs.aic }}\n GH_AW_AMBIENT_CONTEXT: ${{ needs.agent.outputs.ambient_context }}\n GH_AW_CALLER_WORKFLOW_ID: \"${{ github.repository }}/issue-triage\"\n GH_AW_DETECTION_CONCLUSION: ${{ needs.detection.outputs.detection_conclusion }}\n GH_AW_DETECTION_REASON: ${{ needs.detection.outputs.detection_reason }}\n GH_AW_EFFECTIVE_TOKENS: ${{ needs.agent.outputs.effective_tokens }}\n GH_AW_ENGINE_ID: \"codex\"\n GH_AW_ENGINE_MODEL: \"gpt-5.4\"\n GH_AW_THREAT_DETECTION_AIC: ${{ needs.detection.outputs.aic }}\n GH_AW_WORKFLOW_ID: \"issue-triage\"\n GH_AW_WORKFLOW_NAME: \"Issue Triage\"\n GH_AW_WORKFLOW_SOURCE_URL: \"${{ github.server_url }}/${{ github.repository }}/blob/${{ github.ref_name }}/.github/workflows/issue-triage.md\"\n outputs:\n call_workflow_name: ${{ steps.process_safe_outputs.outputs.call_workflow_name }}\n call_workflow_payload: ${{ steps.process_safe_outputs.outputs.call_workflow_payload }}\n code_push_failure_count: ${{ steps.process_safe_outputs.outputs.code_push_failure_count }}\n code_push_failure_errors: ${{ steps.process_safe_outputs.outputs.code_push_failure_errors }}\n comment_id: ${{ steps.process_safe_outputs.outputs.comment_id }}\n comment_url: ${{ steps.process_safe_outputs.outputs.comment_url }}\n create_discussion_error_count: ${{ steps.process_safe_outputs.outputs.create_discussion_error_count }}\n create_discussion_errors: ${{ steps.process_safe_outputs.outputs.create_discussion_errors }}\n process_safe_outputs_processed_count: ${{ steps.process_safe_outputs.outputs.processed_count }}\n process_safe_outputs_temporary_id_map: ${{ steps.process_safe_outputs.outputs.temporary_id_map }}\n steps:\n - name: Setup Scripts\n id: setup\n uses: github/gh-aw-actions/setup@7cfd95b59ca996b7e2bebd6222e21ddd187a4e91 # v0.79.4\n with:\n destination: ${{ runner.temp }}/gh-aw/actions\n job-name: ${{ github.job }}\n trace-id: ${{ needs.activation.outputs.setup-trace-id }}\n parent-span-id: ${{ needs.activation.outputs.setup-parent-span-id || needs.activation.outputs.setup-span-id }}\n env:\n GH_AW_SETUP_WORKFLOW_NAME: \"Issue Triage\"\n GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/issue-triage.lock.yml@${{ github.ref }}\n GH_AW_INFO_VERSION: \"0.137.0\"\n GH_AW_INFO_AWF_VERSION: \"v0.27.0\"\n GH_AW_INFO_ENGINE_ID: \"codex\"\n - name: Download agent output artifact\n id: download-agent-output\n continue-on-error: true\n uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1\n with:\n name: agent\n path: /tmp/gh-aw/\n - name: Setup agent output environment variable\n id: setup-agent-output-env\n if: steps.download-agent-output.outcome == 'success'\n run: |\n mkdir -p /tmp/gh-aw/\n find \"/tmp/gh-aw/\" -type f -print\n echo \"GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json\" >> \"$GITHUB_OUTPUT\"\n - name: Configure GH_HOST for enterprise compatibility\n id: ghes-host-config\n shell: bash\n # zizmor: ignore[github-env] - GITHUB_SERVER_URL is set by GitHub Actions, not user input.\n run: |\n # Derive GH_HOST from GITHUB_SERVER_URL so the gh CLI targets the correct\n # GitHub instance (GHES/GHEC). On github.com this is a harmless no-op.\n GH_HOST=\"${GITHUB_SERVER_URL#https://}\"\n GH_HOST=\"${GH_HOST#http://}\"\n echo \"GH_HOST=${GH_HOST}\" >> \"$GITHUB_ENV\"\n - name: Process Safe Outputs\n id: process_safe_outputs\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n env:\n GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }}\n GH_AW_COMMENT_ID: ${{ needs.activation.outputs.comment_id }}\n GH_AW_ALLOWED_DOMAINS: \"172.30.0.1,ai-pixel.online,api-inference.modelscope.cn,api.commandcode.ai,api.deepseek.com,api.minimaxi.com,api.openai.com,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,chatgpt.com,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,host.docker.internal,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,open.bigmodel.cn,openai.com,opencode.ai,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,ppa.launchpad.net,s.symcb.com,s.symcd.com,security.ubuntu.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com,www.googleapis.com\"\n GITHUB_SERVER_URL: ${{ github.server_url }}\n GITHUB_API_URL: ${{ github.api_url }}\n GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: \"{\\\"add_comment\\\":{\\\"max\\\":1,\\\"target\\\":\\\"triggering\\\"},\\\"add_labels\\\":{\\\"allowed\\\":[\\\"bug\\\",\\\"enhancement\\\",\\\"question\\\",\\\"other\\\"],\\\"max\\\":2,\\\"target\\\":\\\"triggering\\\"},\\\"call_workflow\\\":{\\\"max\\\":1,\\\"workflow_files\\\":{\\\"issue-handle-bug\\\":\\\"./.github/workflows/issue-handle-bug.lock.yml\\\",\\\"issue-handle-enhancement\\\":\\\"./.github/workflows/issue-handle-enhancement.lock.yml\\\",\\\"issue-handle-other\\\":\\\"./.github/workflows/issue-handle-other.lock.yml\\\",\\\"issue-handle-question\\\":\\\"./.github/workflows/issue-handle-question.lock.yml\\\"},\\\"workflows\\\":[\\\"issue-handle-bug\\\",\\\"issue-handle-enhancement\\\",\\\"issue-handle-question\\\",\\\"issue-handle-other\\\"]},\\\"create_report_incomplete_issue\\\":{},\\\"missing_data\\\":{},\\\"missing_tool\\\":{},\\\"noop\\\":{\\\"max\\\":1,\\\"report-as-issue\\\":\\\"true\\\"},\\\"report_incomplete\\\":{}}\"\n with:\n github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/safe_output_handler_manager.cjs');\n await main();\n - name: Upload Safe Outputs Items\n if: always()\n uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1\n with:\n name: safe-outputs-items\n path: |\n /tmp/gh-aw/safe-output-items.jsonl\n /tmp/gh-aw/temporary-id-map.json\n if-no-files-found: ignore\n\n"}}, ".github/workflows/pr-review-checklist.lock.yml": {"e2cebed0e1db5b318580a02ad700fd2aa28b8a23": {"t": 1786068429.1716392, "n": 102510, "h": "8940e660dfc47665", "c": "# gh-aw-metadata: {\"schema_version\":\"v4\",\"frontmatter_hash\":\"153199052cf0123f8c1028d2753f2cbb3023d79bb752650c4700fba89b439dd4\",\"body_hash\":\"0973a3b57949d176ceee1e75ea6df27c74ccd06f71728a55800d0f1dd9dee742\",\"compiler_version\":\"v0.79.4\",\"strict\":true,\"agent_id\":\"codex\",\"agent_model\":\"gpt-5.4\",\"engine_versions\":{\"codex\":\"0.137.0\"}}\n# gh-aw-manifest: {\"version\":1,\"secrets\":[\"CODEX_API_KEY\",\"GH_AW_GITHUB_MCP_SERVER_TOKEN\",\"GH_AW_GITHUB_TOKEN\",\"GITHUB_TOKEN\",\"OPENAI_API_KEY\",\"PIXEL_API_KEY\"],\"actions\":[{\"repo\":\"actions/checkout\",\"sha\":\"df4cb1c069e1874edd31b4311f1884172cec0e10\",\"version\":\"v6.0.3\"},{\"repo\":\"actions/download-artifact\",\"sha\":\"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c\",\"version\":\"v8.0.1\"},{\"repo\":\"actions/github-script\",\"sha\":\"3a2844b7e9c422d3c10d287c895573f7108da1b3\",\"version\":\"v9.0.0\"},{\"repo\":\"actions/setup-node\",\"sha\":\"48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e\",\"version\":\"v6.4.0\"},{\"repo\":\"actions/upload-artifact\",\"sha\":\"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a\",\"version\":\"v7.0.1\"},{\"repo\":\"github/gh-aw-actions/setup\",\"sha\":\"7cfd95b59ca996b7e2bebd6222e21ddd187a4e91\",\"version\":\"v0.79.4\"}],\"containers\":[{\"image\":\"ghcr.io/github/gh-aw-firewall/agent:0.27.0\"},{\"image\":\"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.0\"},{\"image\":\"ghcr.io/github/gh-aw-firewall/squid:0.27.0\"},{\"image\":\"ghcr.io/github/gh-aw-mcpg:v0.3.25\",\"digest\":\"sha256:c10331ad17668ef89f38f5e356678788a40b0cd5fef96e8f92e1d9c1de47cbaa\",\"pinned_image\":\"ghcr.io/github/gh-aw-mcpg:v0.3.25@sha256:c10331ad17668ef89f38f5e356678788a40b0cd5fef96e8f92e1d9c1de47cbaa\"},{\"image\":\"ghcr.io/github/github-mcp-server:v1.1.2\",\"digest\":\"sha256:30197479d8036c7811892bc07e06f9a05c9ef3cdd79bc59f256d50647f95788c\",\"pinned_image\":\"ghcr.io/github/github-mcp-server:v1.1.2@sha256:30197479d8036c7811892bc07e06f9a05c9ef3cdd79bc59f256d50647f95788c\"},{\"image\":\"node:lts-alpine\",\"digest\":\"sha256:2bdb65ed1dab192432bc31c95f94155ca5ad7fc1392fb7eb7526ab682fa5bf14\",\"pinned_image\":\"node:lts-alpine@sha256:2bdb65ed1dab192432bc31c95f94155ca5ad7fc1392fb7eb7526ab682fa5bf14\"}]}\n# ___ _ _ \n# / _ \\ | | (_) \n# | |_| | __ _ ___ _ __ | |_ _ ___ \n# | _ |/ _` |/ _ \\ '_ \\| __| |/ __|\n# | | | | (_| | __/ | | | |_| | (__ \n# \\_| |_/\\__, |\\___|_| |_|\\__|_|\\___|\n# __/ |\n# _ _ |___/ \n# | | | | / _| |\n# | | | | ___ _ __ _ __| |_| | _____ ____\n# | |/\\| |/ _ \\ '__| |/ /| _| |/ _ \\ \\ /\\ / / ___|\n# \\ /\\ / (_) | | | | ( | | | | (_) \\ V V /\\__ \\\n# \\/ \\/ \\___/|_| |_|\\_\\|_| |_|\\___/ \\_/\\_/ |___/\n#\n# This file was automatically generated by gh-aw (v0.79.4). DO NOT EDIT.\n#\n# To update this file, edit the corresponding .md file and run:\n# gh aw compile\n# Not all edits will cause changes to this file.\n#\n# For more information: https://github.github.com/gh-aw/introduction/overview/\n#\n# 自动按外部 checklist 逐条审查 Pull Request，并只输出未通过项及修改建议\n#\n# Resolved workflow manifest:\n# Imports:\n# - shared/engine.md\n# - shared/network.md\n#\n# Secrets used:\n# - CODEX_API_KEY\n# - GH_AW_GITHUB_MCP_SERVER_TOKEN\n# - GH_AW_GITHUB_TOKEN\n# - GITHUB_TOKEN\n# - OPENAI_API_KEY\n# - PIXEL_API_KEY\n#\n# Custom actions used:\n# - actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3\n# - actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1\n# - actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n# - actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0\n# - actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1\n# - github/gh-aw-actions/setup@7cfd95b59ca996b7e2bebd6222e21ddd187a4e91 # v0.79.4\n#\n# Container images used:\n# - ghcr.io/github/gh-aw-firewall/agent:0.27.0\n# - ghcr.io/github/gh-aw-firewall/api-proxy:0.27.0\n# - ghcr.io/github/gh-aw-firewall/squid:0.27.0\n# - ghcr.io/github/gh-aw-mcpg:v0.3.25@sha256:c10331ad17668ef89f38f5e356678788a40b0cd5fef96e8f92e1d9c1de47cbaa\n# - ghcr.io/github/github-mcp-server:v1.1.2@sha256:30197479d8036c7811892bc07e06f9a05c9ef3cdd79bc59f256d50647f95788c\n# - node:lts-alpine@sha256:2bdb65ed1dab192432bc31c95f94155ca5ad7fc1392fb7eb7526ab682fa5bf14\n\nname: \"PR Review Checklist\"\non:\n pull_request_target:\n branches:\n - dev\n types:\n - opened\n - reopened\n # roles: all # Roles processed as role check in pre-activation job\n\npermissions: {}\n\nconcurrency:\n group: \"gh-aw-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref || github.run_id }}\"\n cancel-in-progress: true\n\nrun-name: \"PR Review Checklist\"\n\njobs:\n activation:\n runs-on: ubuntu-slim\n permissions:\n actions: read\n contents: read\n env:\n GH_AW_MAX_DAILY_AI_CREDITS: ${{ vars.GH_AW_DEFAULT_MAX_DAILY_AI_CREDITS || '5000' }}\n outputs:\n body: ${{ steps.sanitized.outputs.body }}\n comment_id: \"\"\n comment_repo: \"\"\n daily_effective_workflow_exceeded: ${{ steps.daily-effective-workflow-guardrail.outputs.daily_effective_workflow_exceeded == 'true' }}\n daily_effective_workflow_threshold: ${{ steps.daily-effective-workflow-guardrail.outputs.daily_effective_workflow_threshold || '' }}\n daily_effective_workflow_total_effective_tokens: ${{ steps.daily-effective-workflow-guardrail.outputs.daily_effective_workflow_total_effective_tokens || '' }}\n engine_id: ${{ steps.generate_aw_info.outputs.engine_id }}\n lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }}\n model: ${{ steps.generate_aw_info.outputs.model }}\n secret_verification_result: ${{ steps.validate-secret.outputs.verification_result }}\n setup-parent-span-id: ${{ steps.setup.outputs.parent-span-id || steps.setup.outputs.span-id }}\n setup-span-id: ${{ steps.setup.outputs.span-id }}\n setup-trace-id: ${{ steps.setup.outputs.trace-id }}\n stale_lock_file_failed: ${{ steps.check-lock-file.outputs.stale_lock_file_failed == 'true' }}\n text: ${{ steps.sanitized.outputs.text }}\n title: ${{ steps.sanitized.outputs.title }}\n steps:\n - name: Setup Scripts\n id: setup\n uses: github/gh-aw-actions/setup@7cfd95b59ca996b7e2bebd6222e21ddd187a4e91 # v0.79.4\n with:\n destination: ${{ runner.temp }}/gh-aw/actions\n job-name: ${{ github.job }}\n safe-output-artifact-client: ${{ env.GH_AW_MAX_DAILY_AI_CREDITS != '' }}\n env:\n GH_AW_SETUP_WORKFLOW_NAME: \"PR Review Checklist\"\n GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/pr-review-checklist.lock.yml@${{ github.ref }}\n GH_AW_INFO_VERSION: \"0.137.0\"\n GH_AW_INFO_AWF_VERSION: \"v0.27.0\"\n GH_AW_INFO_ENGINE_ID: \"codex\"\n - name: Generate agentic run info\n id: generate_aw_info\n env:\n GH_AW_INFO_ENGINE_ID: \"codex\"\n GH_AW_INFO_ENGINE_NAME: \"Codex\"\n GH_AW_INFO_MODEL: \"gpt-5.4\"\n GH_AW_INFO_VERSION: \"0.137.0\"\n GH_AW_INFO_AGENT_VERSION: \"0.137.0\"\n GH_AW_INFO_CLI_VERSION: \"v0.79.4\"\n GH_AW_INFO_WORKFLOW_NAME: \"PR Review Checklist\"\n GH_AW_INFO_EXPERIMENTAL: \"false\"\n GH_AW_INFO_SUPPORTS_TOOLS_ALLOWLIST: \"true\"\n GH_AW_INFO_STAGED: \"false\"\n GH_AW_INFO_ALLOWED_DOMAINS: '[\"ai-pixel.online\",\"api-inference.modelscope.cn\",\"api.commandcode.ai\",\"api.deepseek.com\",\"api.minimaxi.com\",\"defaults\",\"open.bigmodel.cn\",\"opencode.ai\"]'\n GH_AW_INFO_FIREWALL_ENABLED: \"true\"\n GH_AW_INFO_AWF_VERSION: \"v0.27.0\"\n GH_AW_INFO_AWMG_VERSION: \"\"\n GH_AW_INFO_FIREWALL_TYPE: \"squid\"\n GH_AW_COMPILED_STRICT: \"true\"\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n with:\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/generate_aw_info.cjs');\n await main(core, context);\n - name: Check daily workflow token guardrail\n id: daily-effective-workflow-guardrail\n if: ${{ env.GH_AW_MAX_DAILY_AI_CREDITS != '' }}\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n env:\n GH_AW_WORKFLOW_NAME: \"PR Review Checklist\"\n GH_AW_WORKFLOW_ID: \"pr-review-checklist\"\n GH_AW_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}\n GH_AW_WORKFLOW_DISPATCH_AW_CONTEXT: ${{ github.event.inputs.aw_context || '' }}\n GH_AW_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}\n GH_AW_MAX_DAILY_AI_CREDITS: ${{ vars.GH_AW_DEFAULT_MAX_DAILY_AI_CREDITS || '5000' }}\n with:\n github-token: ${{ secrets.GITHUB_TOKEN }}\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/check_daily_aic_workflow_guardrail.cjs');\n await main();\n - name: Validate CODEX_API_KEY or OPENAI_API_KEY secret\n id: validate-secret\n run: bash \"${RUNNER_TEMP}/gh-aw/actions/validate_multi_secret.sh\" CODEX_API_KEY OPENAI_API_KEY Codex https://github.github.com/gh-aw/reference/engines/#openai-codex\n env:\n CODEX_API_KEY: ${{ secrets.CODEX_API_KEY }}\n OPENAI_API_KEY: ${{ secrets.PIXEL_API_KEY }}\n - name: Checkout .github and .agents folders\n uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3\n with:\n persist-credentials: false\n sparse-checkout: |\n .github\n .agents\n .antigravity\n .claude\n .codex\n .crush\n .gemini\n .opencode\n .pi\n sparse-checkout-cone-mode: true\n fetch-depth: 1\n - name: Save agent config folders for base branch restoration\n env:\n GH_AW_AGENT_FOLDERS: \".agents .antigravity .claude .codex .crush .gemini .github .opencode .pi\"\n GH_AW_AGENT_FILES: \".crush.json AGENTS.md ANTIGRAVITY.md CLAUDE.md GEMINI.md PI.md opencode.jsonc\"\n # poutine:ignore untrusted_checkout_exec\n run: bash \"${RUNNER_TEMP}/gh-aw/actions/save_base_github_folders.sh\"\n - name: Check workflow lock file\n id: check-lock-file\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n env:\n GH_AW_WORKFLOW_FILE: \"pr-review-checklist.lock.yml\"\n GH_AW_CONTEXT_WORKFLOW_REF: \"${{ github.workflow_ref }}\"\n with:\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/check_workflow_timestamp_api.cjs');\n await main();\n - name: Check compile-agentic version\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n env:\n GH_AW_COMPILED_VERSION: \"v0.79.4\"\n with:\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/check_version_updates.cjs');\n await main();\n - name: Compute current body text\n id: sanitized\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n env:\n GH_AW_ALLOWED_DOMAINS: \"172.30.0.1,ai-pixel.online,api-inference.modelscope.cn,api.commandcode.ai,api.deepseek.com,api.minimaxi.com,api.openai.com,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,chatgpt.com,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,host.docker.internal,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,open.bigmodel.cn,openai.com,opencode.ai,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,ppa.launchpad.net,s.symcb.com,s.symcd.com,security.ubuntu.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com,www.googleapis.com\"\n with:\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/compute_text.cjs');\n await main();\n - name: Create prompt with built-in context\n env:\n GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt\n GH_AW_SAFE_OUTPUTS: ${{ runner.temp }}/gh-aw/safeoutputs/outputs.jsonl\n GH_AW_EXPR_1A3A194A: ${{ github.event.discussion.number || (fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_type == 'discussion' && fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_number) }}\n GH_AW_EXPR_463A214A: ${{ github.event.pull_request.number || (fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_type == 'pull_request' && fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_number) }}\n GH_AW_EXPR_802A9F6A: ${{ github.event.issue.number || (fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_type == 'issue' && fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_number) }}\n GH_AW_EXPR_FF1D34CE: ${{ github.event.comment.id || fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').comment_id }}\n GH_AW_GITHUB_ACTOR: ${{ github.actor }}\n GH_AW_GITHUB_EVENT_PULL_REQUEST_BASE_SHA: ${{ github.event.pull_request.base.sha }}\n GH_AW_GITHUB_EVENT_PULL_REQUEST_HEAD_SHA: ${{ github.event.pull_request.head.sha }}\n GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER: ${{ github.event.pull_request.number }}\n GH_AW_GITHUB_EVENT_PULL_REQUEST_TITLE: ${{ github.event.pull_request.title }}\n GH_AW_GITHUB_REPOSITORY: ${{ github.repository }}\n GH_AW_GITHUB_RUN_ID: ${{ github.run_id }}\n GH_AW_GITHUB_WORKSPACE: ${{ github.workspace }}\n # poutine:ignore untrusted_checkout_exec\n run: |\n bash \"${RUNNER_TEMP}/gh-aw/actions/create_prompt_first.sh\"\n {\n cat << 'GH_AW_PROMPT_db167d35be010236_EOF'\n <system>\n GH_AW_PROMPT_db167d35be010236_EOF\n cat \"${RUNNER_TEMP}/gh-aw/prompts/xpia.md\"\n cat \"${RUNNER_TEMP}/gh-aw/prompts/temp_folder_prompt.md\"\n cat \"${RUNNER_TEMP}/gh-aw/prompts/markdown.md\"\n cat \"${RUNNER_TEMP}/gh-aw/prompts/safe_outputs_prompt.md\"\n cat << 'GH_AW_PROMPT_db167d35be010236_EOF'\n <safe-output-tools>\n Tools: add_comment, missing_tool, missing_data, noop\n </safe-output-tools>\n GH_AW_PROMPT_db167d35be010236_EOF\n cat \"${RUNNER_TEMP}/gh-aw/prompts/mcp_cli_tools_prompt.md\"\n cat << 'GH_AW_PROMPT_db167d35be010236_EOF'\n <github-context>\n The following GitHub context information is available for this workflow:\n {{#if github.actor}}\n - **actor**: __GH_AW_GITHUB_ACTOR__\n {{/if}}\n {{#if github.repository}}\n - **repository**: __GH_AW_GITHUB_REPOSITORY__\n {{/if}}\n {{#if github.workspace}}\n - **workspace**: __GH_AW_GITHUB_WORKSPACE__\n {{/if}}\n {{#if github.event.issue.number || (github.aw.context.item_type == 'issue' && github.aw.context.item_number)}}\n - **issue-number**: #__GH_AW_EXPR_802A9F6A__\n {{/if}}\n {{#if github.event.discussion.number || (github.aw.context.item_type == 'discussion' && github.aw.context.item_number)}}\n - **discussion-number**: #__GH_AW_EXPR_1A3A194A__\n {{/if}}\n {{#if github.event.pull_request.number || (github.aw.context.item_type == 'pull_request' && github.aw.context.item_number)}}\n - **pull-request-number**: #__GH_AW_EXPR_463A214A__\n {{/if}}\n {{#if github.event.comment.id || github.aw.context.comment_id}}\n - **comment-id**: __GH_AW_EXPR_FF1D34CE__\n {{/if}}\n {{#if github.run_id}}\n - **workflow-run-id**: __GH_AW_GITHUB_RUN_ID__\n {{/if}}\n </github-context>\n \n GH_AW_PROMPT_db167d35be010236_EOF\n cat \"${RUNNER_TEMP}/gh-aw/prompts/github_mcp_tools_with_safeoutputs_prompt.md\"\n cat << 'GH_AW_PROMPT_db167d35be010236_EOF'\n </system>\n {{#runtime-import .github/workflows/shared/engine.md}}\n {{#runtime-import .github/workflows/shared/network.md}}\n {{#runtime-import .github/workflows/pr-review-checklist.md}}\n GH_AW_PROMPT_db167d35be010236_EOF\n } > \"$GH_AW_PROMPT\"\n - name: Interpolate variables and render templates\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n env:\n GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt\n GH_AW_ENGINE_ID: \"codex\"\n GH_AW_GITHUB_ACTOR: ${{ github.actor }}\n GH_AW_GITHUB_EVENT_PULL_REQUEST_BASE_SHA: ${{ github.event.pull_request.base.sha }}\n GH_AW_GITHUB_EVENT_PULL_REQUEST_HEAD_SHA: ${{ github.event.pull_request.head.sha }}\n GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER: ${{ github.event.pull_request.number }}\n GH_AW_GITHUB_EVENT_PULL_REQUEST_TITLE: ${{ github.event.pull_request.title }}\n GH_AW_GITHUB_REPOSITORY: ${{ github.repository }}\n with:\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/interpolate_prompt.cjs');\n await main();\n - name: Substitute placeholders\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n env:\n GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt\n GH_AW_EXPR_1A3A194A: ${{ github.event.discussion.number || (fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_type == 'discussion' && fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_number) }}\n GH_AW_EXPR_463A214A: ${{ github.event.pull_request.number || (fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_type == 'pull_request' && fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_number) }}\n GH_AW_EXPR_802A9F6A: ${{ github.event.issue.number || (fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_type == 'issue' && fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_number) }}\n GH_AW_EXPR_FF1D34CE: ${{ github.event.comment.id || fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').comment_id }}\n GH_AW_GITHUB_ACTOR: ${{ github.actor }}\n GH_AW_GITHUB_EVENT_PULL_REQUEST_BASE_SHA: ${{ github.event.pull_request.base.sha }}\n GH_AW_GITHUB_EVENT_PULL_REQUEST_HEAD_SHA: ${{ github.event.pull_request.head.sha }}\n GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER: ${{ github.event.pull_request.number }}\n GH_AW_GITHUB_EVENT_PULL_REQUEST_TITLE: ${{ github.event.pull_request.title }}\n GH_AW_GITHUB_REPOSITORY: ${{ github.repository }}\n GH_AW_GITHUB_RUN_ID: ${{ github.run_id }}\n GH_AW_GITHUB_WORKSPACE: ${{ github.workspace }}\n GH_AW_MCP_CLI_SERVERS_LIST: '- `safeoutputs` — run `safeoutputs --help` to see available tools'\n with:\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n \n const substitutePlaceholders = require('${{ runner.temp }}/gh-aw/actions/substitute_placeholders.cjs');\n \n // Call the substitution function\n return await substitutePlaceholders({\n file: process.env.GH_AW_PROMPT,\n substitutions: {\n GH_AW_EXPR_1A3A194A: process.env.GH_AW_EXPR_1A3A194A,\n GH_AW_EXPR_463A214A: process.env.GH_AW_EXPR_463A214A,\n GH_AW_EXPR_802A9F6A: process.env.GH_AW_EXPR_802A9F6A,\n GH_AW_EXPR_FF1D34CE: process.env.GH_AW_EXPR_FF1D34CE,\n GH_AW_GITHUB_ACTOR: process.env.GH_AW_GITHUB_ACTOR,\n GH_AW_GITHUB_EVENT_PULL_REQUEST_BASE_SHA: process.env.GH_AW_GITHUB_EVENT_PULL_REQUEST_BASE_SHA,\n GH_AW_GITHUB_EVENT_PULL_REQUEST_HEAD_SHA: process.env.GH_AW_GITHUB_EVENT_PULL_REQUEST_HEAD_SHA,\n GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER: process.env.GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER,\n GH_AW_GITHUB_EVENT_PULL_REQUEST_TITLE: process.env.GH_AW_GITHUB_EVENT_PULL_REQUEST_TITLE,\n GH_AW_GITHUB_REPOSITORY: process.env.GH_AW_GITHUB_REPOSITORY,\n GH_AW_GITHUB_RUN_ID: process.env.GH_AW_GITHUB_RUN_ID,\n GH_AW_GITHUB_WORKSPACE: process.env.GH_AW_GITHUB_WORKSPACE,\n GH_AW_MCP_CLI_SERVERS_LIST: process.env.GH_AW_MCP_CLI_SERVERS_LIST\n }\n });\n - name: Validate prompt placeholders\n env:\n GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt\n # poutine:ignore untrusted_checkout_exec\n run: bash \"${RUNNER_TEMP}/gh-aw/actions/validate_prompt_placeholders.sh\"\n - name: Print prompt\n env:\n GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt\n # poutine:ignore untrusted_checkout_exec\n run: bash \"${RUNNER_TEMP}/gh-aw/actions/print_prompt_summary.sh\"\n - name: Upload activation artifact\n if: success()\n uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1\n with:\n name: activation\n include-hidden-files: true\n path: |\n /tmp/gh-aw/aw_info.json\n /tmp/gh-aw/model_multipliers.json\n /tmp/gh-aw/models.json\n /tmp/gh-aw/aw-prompts/prompt.txt\n /tmp/gh-aw/aw-prompts/prompt-template.txt\n /tmp/gh-aw/aw-prompts/prompt-import-tree.json\n /tmp/gh-aw/github_rate_limits.jsonl\n /tmp/gh-aw/base\n /tmp/gh-aw/.codex/agents\n /tmp/gh-aw/.codex/skills\n if-no-files-found: ignore\n retention-days: 1\n\n agent:\n needs: activation\n if: needs.activation.outputs.daily_effective_workflow_exceeded != 'true'\n runs-on: ubuntu-latest\n permissions:\n checks: read\n contents: read\n issues: read\n pull-requests: read\n statuses: read\n env:\n DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}\n GH_AW_ASSETS_ALLOWED_EXTS: \"\"\n GH_AW_ASSETS_BRANCH: \"\"\n GH_AW_ASSETS_MAX_SIZE_KB: 0\n GH_AW_MCP_LOG_DIR: /tmp/gh-aw/mcp-logs/safeoutputs\n GH_AW_WORKFLOW_ID_SANITIZED: prreviewchecklist\n outputs:\n agentic_engine_timeout: ${{ steps.detect-agent-errors.outputs.agentic_engine_timeout || 'false' }}\n ai_credits_rate_limit_error: ${{ steps.parse-mcp-gateway.outputs.ai_credits_rate_limit_error || 'false' }}\n aic: ${{ steps.parse-mcp-gateway.outputs.aic }}\n ambient_context: ${{ steps.parse-mcp-gateway.outputs.ambient_context }}\n checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}\n effective_tokens: ${{ steps.parse-mcp-gateway.outputs.effective_tokens }}\n has_patch: ${{ steps.collect_output.outputs.has_patch }}\n inference_access_error: ${{ steps.detect-agent-errors.outputs.inference_access_error || 'false' }}\n mcp_policy_error: ${{ steps.detect-agent-errors.outputs.mcp_policy_error || 'false' }}\n model: ${{ needs.activation.outputs.model }}\n model_not_supported_error: ${{ steps.detect-agent-errors.outputs.model_not_supported_error || 'false' }}\n output: ${{ steps.collect_output.outputs.output }}\n output_types: ${{ steps.collect_output.outputs.output_types }}\n setup-parent-span-id: ${{ steps.setup.outputs.parent-span-id || steps.setup.outputs.span-id }}\n setup-span-id: ${{ steps.setup.outputs.span-id }}\n setup-trace-id: ${{ steps.setup.outputs.trace-id }}\n steps:\n - name: Setup Scripts\n id: setup\n uses: github/gh-aw-actions/setup@7cfd95b59ca996b7e2bebd6222e21ddd187a4e91 # v0.79.4\n with:\n destination: ${{ runner.temp }}/gh-aw/actions\n job-name: ${{ github.job }}\n trace-id: ${{ needs.activation.outputs.setup-trace-id }}\n parent-span-id: ${{ needs.activation.outputs.setup-parent-span-id || needs.activation.outputs.setup-span-id }}\n env:\n GH_AW_SETUP_WORKFLOW_NAME: \"PR Review Checklist\"\n GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/pr-review-checklist.lock.yml@${{ github.ref }}\n GH_AW_INFO_VERSION: \"0.137.0\"\n GH_AW_INFO_AWF_VERSION: \"v0.27.0\"\n GH_AW_INFO_ENGINE_ID: \"codex\"\n - name: Set runtime paths\n id: set-runtime-paths\n run: |\n {\n echo \"GH_AW_SAFE_OUTPUTS=${RUNNER_TEMP}/gh-aw/safeoutputs/outputs.jsonl\"\n echo \"GH_AW_SAFE_OUTPUTS_CONFIG_PATH=${RUNNER_TEMP}/gh-aw/safeoutputs/config.json\"\n echo \"GH_AW_SAFE_OUTPUTS_TOOLS_PATH=${RUNNER_TEMP}/gh-aw/safeoutputs/tools.json\"\n } >> \"$GITHUB_OUTPUT\"\n - name: Checkout repository\n uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3\n with:\n persist-credentials: false\n - name: Create gh-aw temp directory\n run: bash \"${RUNNER_TEMP}/gh-aw/actions/create_gh_aw_tmp_dir.sh\"\n - name: Configure gh CLI for GitHub Enterprise\n run: bash \"${RUNNER_TEMP}/gh-aw/actions/configure_gh_for_ghe.sh\"\n env:\n GH_TOKEN: ${{ github.token }}\n - name: Configure Git credentials\n env:\n REPO_NAME: ${{ github.repository }}\n SERVER_URL: ${{ github.server_url }}\n GITHUB_TOKEN: ${{ github.token }}\n run: |\n git config --global user.email \"github-actions[bot]@users.noreply.github.com\"\n git config --global user.name \"github-actions[bot]\"\n git config --global am.keepcr true\n # Re-authenticate git with GitHub token\n SERVER_URL_STRIPPED=\"${SERVER_URL#https://}\"\n git remote set-url origin \"https://x-access-token:${GITHUB_TOKEN}@${SERVER_URL_STRIPPED}/${REPO_NAME}.git\"\n echo \"Git configured with standard GitHub Actions identity\"\n - name: Checkout PR branch\n id: checkout-pr\n if: |\n github.event.pull_request || github.event.issue.pull_request || github.event_name == 'workflow_dispatch' && fromJSON(github.event.inputs.aw_context || '{}').item_type == 'pull_request'\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n env:\n GH_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}\n with:\n github-token: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/checkout_pr_branch.cjs');\n await main();\n - name: Setup Node.js\n uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0\n with:\n node-version: '24'\n package-manager-cache: false\n - name: Install Codex CLI\n run: npm install --ignore-scripts -g @openai/codex@0.137.0\n - name: Install AWF binary\n run: bash \"${RUNNER_TEMP}/gh-aw/actions/install_awf_binary.sh\" v0.27.0\n - name: Parse integrity filter lists\n id: parse-guard-vars\n env:\n GH_AW_BLOCKED_USERS_VAR: ${{ vars.GH_AW_GITHUB_BLOCKED_USERS || '' }}\n GH_AW_TRUSTED_USERS_VAR: ${{ vars.GH_AW_GITHUB_TRUSTED_USERS || '' }}\n GH_AW_APPROVAL_LABELS_VAR: ${{ vars.GH_AW_GITHUB_APPROVAL_LABELS || '' }}\n run: bash \"${RUNNER_TEMP}/gh-aw/actions/parse_guard_list.sh\"\n - name: Download activation artifact\n uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1\n with:\n name: activation\n path: /tmp/gh-aw\n - name: Restore agent config folders from base branch\n if: steps.checkout-pr.outcome == 'success'\n env:\n GH_AW_AGENT_FOLDERS: \".agents .antigravity .claude .codex .crush .gemini .github .opencode .pi\"\n GH_AW_AGENT_FILES: \".crush.json AGENTS.md ANTIGRAVITY.md CLAUDE.md GEMINI.md PI.md opencode.jsonc\"\n run: bash \"${RUNNER_TEMP}/gh-aw/actions/restore_base_github_folders.sh\"\n - name: Restore inline sub-agents from activation artifact\n env:\n GH_AW_SUB_AGENT_DIR: \".codex/agents\"\n GH_AW_SUB_AGENT_EXT: \".md\"\n run: bash \"${RUNNER_TEMP}/gh-aw/actions/restore_inline_sub_agents.sh\"\n - name: Restore inline skills from activation artifact\n env:\n GH_AW_SKILL_DIR: \".codex/skills\"\n run: bash \"${RUNNER_TEMP}/gh-aw/actions/restore_inline_skills.sh\"\n - name: Download container images\n run: bash \"${RUNNER_TEMP}/gh-aw/actions/download_docker_images.sh\" ghcr.io/github/gh-aw-firewall/agent:0.27.0 ghcr.io/github/gh-aw-firewall/api-proxy:0.27.0 ghcr.io/github/gh-aw-firewall/squid:0.27.0 ghcr.io/github/gh-aw-mcpg:v0.3.25@sha256:c10331ad17668ef89f38f5e356678788a40b0cd5fef96e8f92e1d9c1de47cbaa ghcr.io/github/github-mcp-server:v1.1.2@sha256:30197479d8036c7811892bc07e06f9a05c9ef3cdd79bc59f256d50647f95788c node:lts-alpine@sha256:2bdb65ed1dab192432bc31c95f94155ca5ad7fc1392fb7eb7526ab682fa5bf14\n - name: Generate Safe Outputs Config\n run: |\n mkdir -p \"${RUNNER_TEMP}/gh-aw/safeoutputs\"\n mkdir -p /tmp/gh-aw/safeoutputs\n mkdir -p /tmp/gh-aw/mcp-logs/safeoutputs\n cat > \"${RUNNER_TEMP}/gh-aw/safeoutputs/config.json\" << 'GH_AW_SAFE_OUTPUTS_CONFIG_7c6d636483f3c924_EOF'\n {\"add_comment\":{\"max\":1,\"target\":\"triggering\"},\"create_report_incomplete_issue\":{},\"missing_data\":{},\"missing_tool\":{},\"noop\":{\"max\":1,\"report-as-issue\":\"true\"},\"report_incomplete\":{}}\n GH_AW_SAFE_OUTPUTS_CONFIG_7c6d636483f3c924_EOF\n - name: Generate Safe Outputs Tools\n env:\n GH_AW_TOOLS_META_JSON: |\n {\n \"description_suffixes\": {\n \"add_comment\": \" CONSTRAINTS: Maximum 1 comment(s) can be added. Target: triggering. Supports reply_to_id for discussion threading.\"\n },\n \"repo_params\": {},\n \"dynamic_tools\": []\n }\n GH_AW_VALIDATION_JSON: |\n {\n \"add_comment\": {\n \"defaultMax\": 1,\n \"fields\": {\n \"body\": {\n \"required\": true,\n \"type\": \"string\",\n \"sanitize\": true,\n \"maxLength\": 65000\n },\n \"item_number\": {\n \"issueOrPRNumber\": true\n },\n \"reply_to_id\": {\n \"type\": \"string\",\n \"maxLength\": 256\n },\n \"repo\": {\n \"type\": \"string\",\n \"maxLength\": 256\n }\n }\n },\n \"missing_data\": {\n \"defaultMax\": 20,\n \"fields\": {\n \"alternatives\": {\n \"type\": \"string\",\n \"sanitize\": true,\n \"maxLength\": 256\n },\n \"context\": {\n \"type\": \"string\",\n \"sanitize\": true,\n \"maxLength\": 256\n },\n \"data_type\": {\n \"type\": \"string\",\n \"sanitize\": true,\n \"maxLength\": 128\n },\n \"reason\": {\n \"type\": \"string\",\n \"sanitize\": true,\n \"maxLength\": 256\n }\n }\n },\n \"missing_tool\": {\n \"defaultMax\": 20,\n \"fields\": {\n \"alternatives\": {\n \"type\": \"string\",\n \"sanitize\": true,\n \"maxLength\": 512\n },\n \"reason\": {\n \"required\": true,\n \"type\": \"string\",\n \"sanitize\": true,\n \"maxLength\": 256\n },\n \"tool\": {\n \"type\": \"string\",\n \"sanitize\": true,\n \"maxLength\": 128\n }\n }\n },\n \"noop\": {\n \"defaultMax\": 1,\n \"fields\": {\n \"message\": {\n \"required\": true,\n \"type\": \"string\",\n \"sanitize\": true,\n \"maxLength\": 65000\n }\n }\n },\n \"report_incomplete\": {\n \"defaultMax\": 5,\n \"fields\": {\n \"details\": {\n \"type\": \"string\",\n \"sanitize\": true,\n \"maxLength\": 65000\n },\n \"reason\": {\n \"required\": true,\n \"type\": \"string\",\n \"sanitize\": true,\n \"maxLength\": 1024\n }\n }\n }\n }\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n with:\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/generate_safe_outputs_tools.cjs');\n await main();\n - name: Generate Safe Outputs MCP Server Config\n id: safe-outputs-config\n run: |\n # Generate a secure random API key (360 bits of entropy, 40+ chars)\n # Mask immediately to prevent timing vulnerabilities\n API_KEY=$(openssl rand -base64 45 | tr -d '/+=')\n echo \"::add-mask::${API_KEY}\"\n \n PORT=3001\n \n # Set outputs for next steps\n {\n echo \"safe_outputs_api_key=${API_KEY}\"\n echo \"safe_outputs_port=${PORT}\"\n } >> \"$GITHUB_OUTPUT\"\n \n echo \"Safe Outputs MCP server will run on port ${PORT}\"\n \n - name: Start Safe Outputs MCP HTTP Server\n id: safe-outputs-start\n env:\n DEBUG: '*'\n GH_AW_SAFE_OUTPUTS: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS }}\n GH_AW_SAFE_OUTPUTS_PORT: ${{ steps.safe-outputs-config.outputs.safe_outputs_port }}\n GH_AW_SAFE_OUTPUTS_API_KEY: ${{ steps.safe-outputs-config.outputs.safe_outputs_api_key }}\n GH_AW_SAFE_OUTPUTS_TOOLS_PATH: ${{ runner.temp }}/gh-aw/safeoutputs/tools.json\n GH_AW_SAFE_OUTPUTS_CONFIG_PATH: ${{ runner.temp }}/gh-aw/safeoutputs/config.json\n GH_AW_MCP_LOG_DIR: /tmp/gh-aw/mcp-logs/safeoutputs\n run: |\n # Environment variables are set above to prevent template injection\n export DEBUG\n export GH_AW_SAFE_OUTPUTS\n export GH_AW_SAFE_OUTPUTS_PORT\n export GH_AW_SAFE_OUTPUTS_API_KEY\n export GH_AW_SAFE_OUTPUTS_TOOLS_PATH\n export GH_AW_SAFE_OUTPUTS_CONFIG_PATH\n export GH_AW_MCP_LOG_DIR\n \n bash \"${RUNNER_TEMP}/gh-aw/actions/start_safe_outputs_server.sh\"\n \n - name: Start MCP Gateway\n id: start-mcp-gateway\n env:\n CODEX_HOME: /tmp/gh-aw/mcp-config\n GH_AW_SAFE_OUTPUTS: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS }}\n GH_AW_SAFE_OUTPUTS_API_KEY: ${{ steps.safe-outputs-start.outputs.api_key }}\n GH_AW_SAFE_OUTPUTS_PORT: ${{ steps.safe-outputs-start.outputs.port }}\n GITHUB_MCP_SERVER_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}\n run: |\n set -eo pipefail\n mkdir -p \"${RUNNER_TEMP}/gh-aw/mcp-config\"\n \n # Export gateway environment variables for MCP config and gateway script\n export MCP_GATEWAY_PORT=\"8080\"\n export MCP_GATEWAY_DOMAIN=\"host.docker.internal\"\n export MCP_GATEWAY_HOST_DOMAIN=\"localhost\"\n MCP_GATEWAY_API_KEY=$(openssl rand -base64 45 | tr -d '/+=')\n echo \"::add-mask::${MCP_GATEWAY_API_KEY}\"\n export MCP_GATEWAY_API_KEY\n export MCP_GATEWAY_PAYLOAD_DIR=\"/tmp/gh-aw/mcp-payloads\"\n mkdir -p \"${MCP_GATEWAY_PAYLOAD_DIR}\"\n export MCP_GATEWAY_PAYLOAD_SIZE_THRESHOLD=\"524288\"\n export DEBUG=\"*\"\n \n export GH_AW_ENGINE=\"codex\"\n MCP_GATEWAY_UID=$(id -u 2>/dev/null || echo '0')\n MCP_GATEWAY_GID=$(id -g 2>/dev/null || echo '0')\n case \"${DOCKER_HOST:-}\" in\n unix://* ) DOCKER_SOCK_PATH=\"${DOCKER_HOST#unix://}\" ;;\n /* ) DOCKER_SOCK_PATH=\"$DOCKER_HOST\" ;;\n * ) DOCKER_SOCK_PATH=/var/run/docker.sock ;;\n esac\n DOCKER_SOCK_GID=$(stat -c '%g' \"$DOCKER_SOCK_PATH\" 2>/dev/null || echo '0')\n export MCP_GATEWAY_DOCKER_COMMAND='docker run -i --rm --network host --add-host host.docker.internal:127.0.0.1 --user '\"${MCP_GATEWAY_UID}\"':'\"${MCP_GATEWAY_GID}\"' --group-add '\"${DOCKER_SOCK_GID}\"' -v '\"${DOCKER_SOCK_PATH}\"':/var/run/docker.sock -e MCP_GATEWAY_PORT -e MCP_GATEWAY_DOMAIN -e MCP_GATEWAY_API_KEY -e MCP_GATEWAY_PAYLOAD_DIR -e MCP_GATEWAY_PAYLOAD_SIZE_THRESHOLD -e DOCKER_HOST=unix:///var/run/docker.sock -e DEBUG -e MCP_GATEWAY_LOG_DIR -e GH_AW_MCP_LOG_DIR -e GH_AW_SAFE_OUTPUTS -e GH_AW_SAFE_OUTPUTS_CONFIG_PATH -e GH_AW_SAFE_OUTPUTS_TOOLS_PATH -e GH_AW_ASSETS_BRANCH -e GH_AW_ASSETS_MAX_SIZE_KB -e GH_AW_ASSETS_ALLOWED_EXTS -e DEFAULT_BRANCH -e GITHUB_MCP_SERVER_TOKEN -e GITHUB_MCP_GUARD_MIN_INTEGRITY -e GITHUB_MCP_GUARD_REPOS -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e GITHUB_SHA -e GITHUB_WORKSPACE -e GITHUB_TOKEN -e GITHUB_RUN_ID -e GITHUB_RUN_NUMBER -e GITHUB_RUN_ATTEMPT -e GITHUB_JOB -e GITHUB_ACTION -e GITHUB_EVENT_NAME -e GITHUB_EVENT_PATH -e GITHUB_ACTOR -e GITHUB_ACTOR_ID -e GITHUB_TRIGGERING_ACTOR -e GITHUB_WORKFLOW -e GITHUB_WORKFLOW_REF -e GITHUB_WORKFLOW_SHA -e GITHUB_REF -e GITHUB_REF_NAME -e GITHUB_REF_TYPE -e GITHUB_HEAD_REF -e GITHUB_BASE_REF -e GH_AW_SAFE_OUTPUTS_PORT -e GH_AW_SAFE_OUTPUTS_API_KEY -e CODEX_HOME -v /tmp/gh-aw/mcp-payloads:/tmp/gh-aw/mcp-payloads:rw -v /opt:/opt:ro -v /tmp:/tmp:rw -v '\"${GITHUB_WORKSPACE}\"':'\"${GITHUB_WORKSPACE}\"':rw ghcr.io/github/gh-aw-mcpg:v0.3.25'\n \n cat > \"${RUNNER_TEMP}/gh-aw/mcp-config/config.toml\" << GH_AW_MCP_CONFIG_dec455f37fd613b2_EOF\n [history]\n persistence = \"none\"\n \n [shell_environment_policy]\n inherit = \"core\"\n include_only = [\"^CODEX_API_KEY$\", \"^GH_AW_ASSETS_ALLOWED_EXTS$\", \"^GH_AW_ASSETS_BRANCH$\", \"^GH_AW_ASSETS_MAX_SIZE_KB$\", \"^GH_AW_SAFE_OUTPUTS$\", \"^GITHUB_PERSONAL_ACCESS_TOKEN$\", \"^GITHUB_REPOSITORY$\", \"^GITHUB_SERVER_URL$\", \"^HOME$\", \"^OPENAI_API_KEY$\", \"^PATH$\"]\n \n [mcp_servers.github]\n user_agent = \"pr-review-checklist\"\n startup_timeout_sec = 120\n tool_timeout_sec = 60\n container = \"ghcr.io/github/github-mcp-server:v1.1.2\"\n env = { \"GITHUB_HOST\" = \"$GITHUB_SERVER_URL\", \"GITHUB_PERSONAL_ACCESS_TOKEN\" = \"$GH_AW_GITHUB_TOKEN\", \"GITHUB_READ_ONLY\" = \"1\", \"GITHUB_TOOLSETS\" = \"context,repos,issues,pull_requests\" }\n env_vars = [\"GITHUB_HOST\", \"GITHUB_PERSONAL_ACCESS_TOKEN\", \"GITHUB_READ_ONLY\", \"GITHUB_TOOLSETS\"]\n \n [mcp_servers.safeoutputs]\n type = \"http\"\n url = \"http://host.docker.internal:$GH_AW_SAFE_OUTPUTS_PORT\"\n \n [mcp_servers.safeoutputs.headers]\n Authorization = \"$GH_AW_SAFE_OUTPUTS_API_KEY\"\n \n [mcp_servers.safeoutputs.\"guard-policies\"]\n \n [mcp_servers.safeoutputs.\"guard-policies\".write-sink]\n accept = [\"*\"]\n GH_AW_MCP_CONFIG_dec455f37fd613b2_EOF\n \n # Generate JSON config for MCP gateway\n GH_AW_NODE=$(which node 2>/dev/null || command -v node 2>/dev/null || echo node)\n cat << GH_AW_MCP_CONFIG_ca772287f17ffc28_EOF | \"$GH_AW_NODE\" \"${RUNNER_TEMP}/gh-aw/actions/start_mcp_gateway.cjs\"\n {\n \"mcpServers\": {\n \"github\": {\n \"container\": \"ghcr.io/github/github-mcp-server:v1.1.2\",\n \"env\": {\n \"GITHUB_HOST\": \"$GITHUB_SERVER_URL\",\n \"GITHUB_PERSONAL_ACCESS_TOKEN\": \"$GITHUB_MCP_SERVER_TOKEN\",\n \"GITHUB_READ_ONLY\": \"1\",\n \"GITHUB_TOOLSETS\": \"context,repos,issues,pull_requests\"\n },\n \"guard-policies\": {\n \"allow-only\": {\n \"approval-labels\": ${{ steps.parse-guard-vars.outputs.approval_labels }},\n \"blocked-users\": ${{ steps.parse-guard-vars.outputs.blocked_users }},\n \"min-integrity\": \"none\",\n \"repos\": \"all\",\n \"trusted-users\": ${{ steps.parse-guard-vars.outputs.trusted_users }}\n }\n }\n },\n \"safeoutputs\": {\n \"type\": \"http\",\n \"url\": \"http://host.docker.internal:$GH_AW_SAFE_OUTPUTS_PORT\",\n \"headers\": {\n \"Authorization\": \"$GH_AW_SAFE_OUTPUTS_API_KEY\"\n },\n \"guard-policies\": {\n \"write-sink\": {\n \"accept\": [\n \"*\"\n ]\n }\n }\n }\n },\n \"gateway\": {\n \"port\": $MCP_GATEWAY_PORT,\n \"domain\": \"${MCP_GATEWAY_DOMAIN}\",\n \"apiKey\": \"${MCP_GATEWAY_API_KEY}\",\n \"payloadDir\": \"${MCP_GATEWAY_PAYLOAD_DIR}\"\n }\n }\n GH_AW_MCP_CONFIG_ca772287f17ffc28_EOF\n \n # Sync converter output to writable CODEX_HOME for Codex\n mkdir -p /tmp/gh-aw/mcp-config\n cat > \"/tmp/gh-aw/mcp-config/config.toml\" << GH_AW_CODEX_SHELL_POLICY_929fca99db4cd5ec_EOF\n\n model_provider = \"openai-proxy\"\n\n [model_providers.openai-proxy]\n name = \"OpenAI AWF proxy\"\n base_url = \"http://172.30.0.30:10000\"\n env_key = \"OPENAI_API_KEY\"\n supports_websockets = false\n [shell_environment_policy]\n inherit = \"core\"\n include_only = [\"^CODEX_API_KEY$\", \"^GH_AW_ASSETS_ALLOWED_EXTS$\", \"^GH_AW_ASSETS_BRANCH$\", \"^GH_AW_ASSETS_MAX_SIZE_KB$\", \"^GH_AW_SAFE_OUTPUTS$\", \"^GITHUB_PERSONAL_ACCESS_TOKEN$\", \"^GITHUB_REPOSITORY$\", \"^GITHUB_SERVER_URL$\", \"^HOME$\", \"^OPENAI_API_KEY$\", \"^PATH$\"]\n GH_AW_CODEX_SHELL_POLICY_929fca99db4cd5ec_EOF\n awk '\n BEGIN { skip_openai_proxy = 0 }\n /^[[:space:]]*model_provider[[:space:]]*=/ { next }\n /^\\[model_providers\\.openai-proxy\\][[:space:]]*$/ { skip_openai_proxy = 1; next }\n /^\\[/ { skip_openai_proxy = 0 }\n !skip_openai_proxy { print }\n ' \"${RUNNER_TEMP}/gh-aw/mcp-config/config.toml\" >> \"/tmp/gh-aw/mcp-config/config.toml\"\n chmod 600 \"/tmp/gh-aw/mcp-config/config.toml\"\n mkdir -p \"${CODEX_HOME}\"\n if [ \"/tmp/gh-aw/mcp-config/config.toml\" != \"${CODEX_HOME}/config.toml\" ]; then cp \"/tmp/gh-aw/mcp-config/config.toml\" \"${CODEX_HOME}/config.toml\"; fi\n chmod 600 \"${CODEX_HOME}/config.toml\"\n - name: Mount MCP servers as CLIs\n id: mount-mcp-clis\n continue-on-error: true\n env:\n MCP_GATEWAY_API_KEY: ${{ steps.start-mcp-gateway.outputs.gateway-api-key }}\n MCP_GATEWAY_DOMAIN: ${{ steps.start-mcp-gateway.outputs.gateway-domain }}\n MCP_GATEWAY_PORT: ${{ steps.start-mcp-gateway.outputs.gateway-port }}\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n with:\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/mount_mcp_as_cli.cjs');\n await main();\n - name: Clean credentials\n continue-on-error: true\n run: bash \"${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh\"\n - name: Audit pre-agent workspace\n id: pre_agent_audit\n continue-on-error: true\n run: bash \"${RUNNER_TEMP}/gh-aw/actions/audit_pre_agent_workspace.sh\"\n - name: Execute Codex CLI\n id: agentic_execution\n run: |\n set -o pipefail\n printf '%s' \"$(date +%s%3N)\" > /tmp/gh-aw/agent_cli_start_ms.txt\n mkdir -p \"$CODEX_HOME/logs\" && touch /tmp/gh-aw/agent-step-summary.md\n (umask 177 && touch /tmp/gh-aw/agent-stdio.log)\n GH_AW_MAX_AI_CREDITS=\"${{ vars.GH_AW_DEFAULT_MAX_AI_CREDITS || '1000' }}\"\n printf '%s\\n' \"{\\\"\\$schema\\\":\\\"https://github.com/github/gh-aw-firewall/releases/download/v0.27.0/awf-config.schema.json\\\",\\\"network\\\":{\\\"allowDomains\\\":[\\\"172.30.0.1\\\",\\\"ai-pixel.online\\\",\\\"api-inference.modelscope.cn\\\",\\\"api.commandcode.ai\\\",\\\"api.deepseek.com\\\",\\\"api.minimaxi.com\\\",\\\"api.openai.com\\\",\\\"api.snapcraft.io\\\",\\\"archive.ubuntu.com\\\",\\\"azure.archive.ubuntu.com\\\",\\\"chatgpt.com\\\",\\\"crl.geotrust.com\\\",\\\"crl.globalsign.com\\\",\\\"crl.identrust.com\\\",\\\"crl.sectigo.com\\\",\\\"crl.thawte.com\\\",\\\"crl.usertrust.com\\\",\\\"crl.verisign.com\\\",\\\"crl3.digicert.com\\\",\\\"crl4.digicert.com\\\",\\\"crls.ssl.com\\\",\\\"host.docker.internal\\\",\\\"json-schema.org\\\",\\\"json.schemastore.org\\\",\\\"keyserver.ubuntu.com\\\",\\\"ocsp.digicert.com\\\",\\\"ocsp.geotrust.com\\\",\\\"ocsp.globalsign.com\\\",\\\"ocsp.identrust.com\\\",\\\"ocsp.sectigo.com\\\",\\\"ocsp.ssl.com\\\",\\\"ocsp.thawte.com\\\",\\\"ocsp.usertrust.com\\\",\\\"ocsp.verisign.com\\\",\\\"open.bigmodel.cn\\\",\\\"openai.com\\\",\\\"opencode.ai\\\",\\\"packagecloud.io\\\",\\\"packages.cloud.google.com\\\",\\\"packages.microsoft.com\\\",\\\"ppa.launchpad.net\\\",\\\"s.symcb.com\\\",\\\"s.symcd.com\\\",\\\"security.ubuntu.com\\\",\\\"ts-crl.ws.symantec.com\\\",\\\"ts-ocsp.ws.symantec.com\\\",\\\"www.googleapis.com\\\"]},\\\"apiProxy\\\":{\\\"enabled\\\":true,\\\"enableTokenSteering\\\":true,\\\"maxRuns\\\":500,\\\"maxAiCredits\\\":${GH_AW_MAX_AI_CREDITS},\\\"targets\\\":{\\\"openai\\\":{\\\"host\\\":\\\"ai-pixel.online\\\"}},\\\"models\\\":{\\\"agent\\\":[\\\"sonnet-6x\\\",\\\"gpt-5.4\\\",\\\"gpt-5.3\\\",\\\"gemini-pro\\\",\\\"any\\\"],\\\"antigravity\\\":[\\\"copilot/antigravity*\\\",\\\"google/antigravity*\\\",\\\"gemini/antigravity*\\\"],\\\"any\\\":[\\\"copilot/*\\\",\\\"anthropic/*\\\",\\\"openai/*\\\",\\\"google/*\\\",\\\"gemini/*\\\"],\\\"claude\\\":[\\\"agent\\\"],\\\"codex\\\":[\\\"agent\\\"],\\\"coding\\\":[\\\"copilot/gpt-5*codex*\\\",\\\"openai/gpt-5*codex*\\\",\\\"gpt-5-codex\\\"],\\\"computer-use\\\":[\\\"copilot/*computer-use*\\\",\\\"google/*computer-use*\\\",\\\"gemini/*computer-use*\\\",\\\"openai/*computer-use*\\\"],\\\"copilot\\\":[\\\"agent\\\"],\\\"deep-research\\\":[\\\"copilot/deep-research*\\\",\\\"copilot/o3-deep-research*\\\",\\\"copilot/o4-mini-deep-research*\\\",\\\"google/deep-research*\\\",\\\"gemini/deep-research*\\\",\\\"openai/o3-deep-research*\\\",\\\"openai/o4-mini-deep-research*\\\"],\\\"gemini\\\":[\\\"agent\\\"],\\\"gemini-3-flash\\\":[\\\"copilot/gemini-3*flash*\\\",\\\"google/gemini-3*flash*\\\",\\\"gemini/gemini-3*flash*\\\"],\\\"gemini-3-pro\\\":[\\\"copilot/gemini-3*pro*\\\",\\\"google/gemini-3*pro*\\\",\\\"google/nano-banana*\\\",\\\"gemini/gemini-3*pro*\\\"],\\\"gemini-3.1-flash\\\":[\\\"copilot/gemini-3.1*flash*\\\",\\\"google/gemini-3.1*flash*\\\",\\\"gemini/gemini-3.1*flash*\\\"],\\\"gemini-3.1-pro\\\":[\\\"copilot/gemini-3.1*pro*\\\",\\\"google/gemini-3.1*pro*\\\",\\\"gemini/gemini-3.1*pro*\\\"],\\\"gemini-3.5-flash\\\":[\\\"copilot/gemini-3.5*flash*\\\",\\\"google/gemini-3.5*flash*\\\",\\\"gemini/gemini-3.5*flash*\\\"],\\\"gemini-flash\\\":[\\\"copilot/gemini-*flash*\\\",\\\"google/gemini-*flash*\\\",\\\"gemini/gemini-*flash*\\\"],\\\"gemini-flash-lite\\\":[\\\"copilot/gemini-*flash*lite*\\\",\\\"google/gemini-*flash*lite*\\\",\\\"gemini/gemini-*flash*lite*\\\"],\\\"gemini-pro\\\":[\\\"copilot/gemini-*pro*\\\",\\\"google/gemini-*pro*\\\",\\\"gemini/gemini-*pro*\\\"],\\\"gemma\\\":[\\\"copilot/gemma*\\\",\\\"google/gemma*\\\",\\\"gemini/gemma*\\\"],\\\"gpt-5\\\":[\\\"copilot/gpt-5*\\\",\\\"openai/gpt-5*\\\"],\\\"gpt-5-codex\\\":[\\\"copilot/gpt-5*codex*\\\",\\\"openai/gpt-5*codex*\\\"],\\\"gpt-5-mini\\\":[\\\"copilot/gpt-5*mini*\\\",\\\"openai/gpt-5*mini*\\\"],\\\"gpt-5-nano\\\":[\\\"copilot/gpt-5*nano*\\\",\\\"openai/gpt-5*nano*\\\"],\\\"gpt-5-pro\\\":[\\\"copilot/gpt-5*pro*\\\",\\\"openai/gpt-5*pro*\\\"],\\\"gpt-5.2\\\":[\\\"copilot/gpt-5.2*\\\",\\\"openai/gpt-5.2*\\\"],\\\"gpt-5.3\\\":[\\\"copilot/gpt-5.3*\\\",\\\"openai/gpt-5.3*\\\"],\\\"gpt-5.4\\\":[\\\"copilot/gpt-5.4*\\\",\\\"openai/gpt-5.4*\\\"],\\\"gpt-5.5\\\":[\\\"copilot/gpt-5.5*\\\",\\\"openai/gpt-5.5*\\\"],\\\"haiku\\\":[\\\"copilot/*haiku*\\\",\\\"anthropic/*haiku*\\\"],\\\"large\\\":[\\\"sonnet\\\",\\\"gpt-5-pro\\\",\\\"gpt-5\\\",\\\"gemini-pro\\\"],\\\"mai-code\\\":[\\\"copilot/MAI-Code*\\\",\\\"copilot/mai-code*\\\",\\\"openai/MAI-Code*\\\"],\\\"mini\\\":[\\\"haiku\\\",\\\"gpt-5-mini\\\",\\\"gpt-5-nano\\\",\\\"gemini-flash-lite\\\"],\\\"nano-banana\\\":[\\\"copilot/nano-banana*\\\",\\\"google/nano-banana*\\\",\\\"gemini/nano-banana*\\\"],\\\"opus\\\":[\\\"copilot/*opus*\\\",\\\"anthropic/*opus*\\\"],\\\"opusplan\\\":[\\\"opus?effort=high\\\"],\\\"reasoning\\\":[\\\"copilot/o1*\\\",\\\"copilot/o3*\\\",\\\"copilot/o4*\\\",\\\"openai/o1*\\\",\\\"openai/o3*\\\",\\\"openai/o4*\\\"],\\\"robotics\\\":[\\\"copilot/*robotics*\\\",\\\"google/*robotics*\\\",\\\"gemini/*robotics*\\\"],\\\"small\\\":[\\\"mini\\\"],\\\"small-agent\\\":[\\\"haiku\\\",\\\"gpt-5-mini\\\",\\\"gemini-flash\\\"],\\\"sonnet\\\":[\\\"copilot/*sonnet*\\\",\\\"anthropic/*sonnet*\\\"],\\\"sonnet-6x\\\":[\\\"copilot/*sonnet-4.5*\\\",\\\"copilot/*sonnet-4.6*\\\",\\\"copilot/*sonnet-4-5-*\\\",\\\"anthropic/*sonnet-4-5-*\\\",\\\"copilot/*sonnet-4-6*\\\",\\\"anthropic/*sonnet-4-6*\\\"],\\\"summarization\\\":[\\\"haiku\\\",\\\"gpt-5-mini\\\",\\\"gemini-flash-lite\\\",\\\"mini\\\"],\\\"vision\\\":[\\\"copilot/gemini-*image*\\\",\\\"gemini/gemini-*image*\\\",\\\"copilot/gemini-*flash*\\\",\\\"gemini/gemini-*flash*\\\"]}},\\\"container\\\":{\\\"imageTag\\\":\\\"0.27.0\\\"}}\" > \"${RUNNER_TEMP}/gh-aw/awf-config.json\"\n GH_AW_MODEL_MULTIPLIERS_PATH=\"/tmp/gh-aw/model_multipliers.json\" node \"${RUNNER_TEMP}/gh-aw/actions/merge_awf_model_multipliers.cjs\"\n cp \"${RUNNER_TEMP}/gh-aw/awf-config.json\" /tmp/gh-aw/awf-config.json\n export GH_AW_MODELS_JSON_PATH=\"/tmp/gh-aw/models.json\"\n GH_AW_DOCKER_HOST_PATH_PREFIX_ARGS=\"\"\n if [[ \"${DOCKER_HOST:-}\" =~ ^tcp:// ]]; then\n GH_AW_DOCKER_HOST_PATH_PREFIX_ARGS=\"--docker-host-path-prefix /tmp/gh-aw\"\n fi\n GH_AW_TOOL_CACHE_MOUNT=\"\"\n GH_AW_TOOL_CACHE=\"${RUNNER_TOOL_CACHE:-/opt/hostedtoolcache}\"\n if [ -d \"$GH_AW_TOOL_CACHE\" ]; then\n if [[ \"$GH_AW_TOOL_CACHE\" != /opt/* ]]; then\n GH_AW_TOOL_CACHE_MOUNT=\"$GH_AW_TOOL_CACHE:$GH_AW_TOOL_CACHE:ro\"\n fi\n elif [ -d \"/home/runner/work/_tool\" ]; then\n GH_AW_TOOL_CACHE_MOUNT=\"/home/runner/work/_tool:/home/runner/work/_tool:ro\"\n fi\n # shellcheck disable=SC1003\n sudo -E awf --config \"${RUNNER_TEMP}/gh-aw/awf-config.json\" --container-workdir \"${GITHUB_WORKSPACE}\" --mount \"${RUNNER_TEMP}/gh-aw:${RUNNER_TEMP}/gh-aw:ro\" --mount \"${RUNNER_TEMP}/gh-aw:/host${RUNNER_TEMP}/gh-aw:ro\" ${GH_AW_TOOL_CACHE_MOUNT:+--mount \"$GH_AW_TOOL_CACHE_MOUNT\"} ${GH_AW_DOCKER_HOST_PATH_PREFIX_ARGS} --env-all --exclude-env CODEX_API_KEY --exclude-env GITHUB_MCP_SERVER_TOKEN --exclude-env MCP_GATEWAY_API_KEY --exclude-env OPENAI_API_KEY --log-level info --proxy-logs-dir /tmp/gh-aw/sandbox/firewall/logs --audit-dir /tmp/gh-aw/sandbox/firewall/audit --enable-host-access --allow-host-ports 80,443,8080 --skip-pull \\\n -- /bin/bash -c 'set +o histexpand; export PATH=\"${RUNNER_TEMP}/gh-aw/mcp-cli/bin:$PATH\" && GH_AW_TOOL_CACHE=\"${RUNNER_TOOL_CACHE:-/opt/hostedtoolcache}\"; export PATH=\"$(find \"$GH_AW_TOOL_CACHE\" /opt/hostedtoolcache /home/runner/work/_tool -maxdepth 5 -type d -name bin 2>/dev/null | tr '\\''\\n'\\'' '\\'':'\\'')$PATH\"; [ -n \"$GOROOT\" ] && export PATH=\"$GOROOT/bin:$PATH\" || true && GH_AW_NODE_EXEC=\"${GH_AW_NODE_BIN:-}\"; if [ -z \"$GH_AW_NODE_EXEC\" ] || [ ! -x \"$GH_AW_NODE_EXEC\" ]; then GH_AW_NODE_EXEC=\"$(command -v node 2>/dev/null || true)\"; fi; if [ -z \"$GH_AW_NODE_EXEC\" ]; then echo \"node runtime missing on this runner — check runtimes.node in workflow YAML\" >&2; exit 127; fi; GH_AW_NPM_GLOBAL_ROOT=\"$(npm root -g 2>/dev/null || true)\"; if [ -n \"$GH_AW_NPM_GLOBAL_ROOT\" ]; then export NODE_PATH=\"${GH_AW_NPM_GLOBAL_ROOT}${NODE_PATH:+:${NODE_PATH}}\"; fi; \"$GH_AW_NODE_EXEC\" ${RUNNER_TEMP}/gh-aw/actions/codex_harness.cjs codex exec${GH_AW_MODEL_AGENT_CODEX:+ --model \"$GH_AW_MODEL_AGENT_CODEX\"} -c web_search=\"disabled\" -c fetch=\"disabled\" --dangerously-bypass-approvals-and-sandbox --skip-git-repo-check --prompt-file /tmp/gh-aw/aw-prompts/prompt.txt' 2>&1 | tee -a /tmp/gh-aw/agent-stdio.log\n env:\n CODEX_API_KEY: ${{ secrets.CODEX_API_KEY || secrets.OPENAI_API_KEY }}\n CODEX_HOME: /tmp/gh-aw/mcp-config\n GH_AW_MAX_TURNS: ${{ vars.GH_AW_DEFAULT_MAX_TURNS || '' }}\n GH_AW_MCP_CONFIG: ${{ runner.temp }}/gh-aw/mcp-config/config.toml\n GH_AW_MODEL_AGENT_CODEX: gpt-5.4\n GH_AW_PHASE: agent\n GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt\n GH_AW_SAFE_OUTPUTS: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS }}\n GH_AW_VERSION: v0.79.4\n GITHUB_AW: true\n GITHUB_STEP_SUMMARY: /tmp/gh-aw/agent-step-summary.md\n GIT_AUTHOR_EMAIL: github-actions[bot]@users.noreply.github.com\n GIT_AUTHOR_NAME: github-actions[bot]\n GIT_COMMITTER_EMAIL: github-actions[bot]@users.noreply.github.com\n GIT_COMMITTER_NAME: github-actions[bot]\n OPENAI_API_KEY: ${{ secrets.PIXEL_API_KEY }}\n OPENAI_BASE_URL: https://ai-pixel.online\n RUNNER_TEMP: ${{ runner.temp }}\n RUST_LOG: ${{ runner.debug == 1 && 'trace,hyper_util=info,mio=info,reqwest=info,os_info=info,codex_otel=warn,codex_core=debug,ocodex_exec=debug' || 'warn' }}\n - name: Detect agent errors\n if: always()\n id: detect-agent-errors\n continue-on-error: true\n run: node \"${RUNNER_TEMP}/gh-aw/actions/detect_agent_errors.cjs\"\n - name: Configure Git credentials\n env:\n REPO_NAME: ${{ github.repository }}\n SERVER_URL: ${{ github.server_url }}\n GITHUB_TOKEN: ${{ github.token }}\n run: |\n git config --global user.email \"github-actions[bot]@users.noreply.github.com\"\n git config --global user.name \"github-actions[bot]\"\n git config --global am.keepcr true\n # Re-authenticate git with GitHub token\n SERVER_URL_STRIPPED=\"${SERVER_URL#https://}\"\n git remote set-url origin \"https://x-access-token:${GITHUB_TOKEN}@${SERVER_URL_STRIPPED}/${REPO_NAME}.git\"\n echo \"Git configured with standard GitHub Actions identity\"\n - name: Stop MCP Gateway\n if: always()\n continue-on-error: true\n env:\n MCP_GATEWAY_PORT: ${{ steps.start-mcp-gateway.outputs.gateway-port }}\n MCP_GATEWAY_API_KEY: ${{ steps.start-mcp-gateway.outputs.gateway-api-key }}\n GATEWAY_PID: ${{ steps.start-mcp-gateway.outputs.gateway-pid }}\n run: |\n bash \"${RUNNER_TEMP}/gh-aw/actions/stop_mcp_gateway.sh\" \"$GATEWAY_PID\"\n - name: Redact secrets in logs\n if: always()\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n with:\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/redact_secrets.cjs');\n await main();\n env:\n GH_AW_SECRET_NAMES: 'CODEX_API_KEY,GH_AW_GITHUB_MCP_SERVER_TOKEN,GH_AW_GITHUB_TOKEN,GITHUB_TOKEN,OPENAI_API_KEY,PIXEL_API_KEY'\n SECRET_CODEX_API_KEY: ${{ secrets.CODEX_API_KEY }}\n SECRET_GH_AW_GITHUB_MCP_SERVER_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN }}\n SECRET_GH_AW_GITHUB_TOKEN: ${{ secrets.GH_AW_GITHUB_TOKEN }}\n SECRET_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}\n SECRET_OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}\n SECRET_PIXEL_API_KEY: ${{ secrets.PIXEL_API_KEY }}\n - name: Append agent step summary\n if: always()\n run: bash \"${RUNNER_TEMP}/gh-aw/actions/append_agent_step_summary.sh\"\n - name: Copy Safe Outputs\n if: always()\n env:\n GH_AW_SAFE_OUTPUTS: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS }}\n run: |\n mkdir -p /tmp/gh-aw\n cp \"$GH_AW_SAFE_OUTPUTS\" /tmp/gh-aw/safeoutputs.jsonl 2>/dev/null || true\n - name: Ingest agent output\n id: collect_output\n if: always()\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n env:\n GH_AW_SAFE_OUTPUTS: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS }}\n GH_AW_ALLOWED_DOMAINS: \"172.30.0.1,ai-pixel.online,api-inference.modelscope.cn,api.commandcode.ai,api.deepseek.com,api.minimaxi.com,api.openai.com,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,chatgpt.com,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,host.docker.internal,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,open.bigmodel.cn,openai.com,opencode.ai,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,ppa.launchpad.net,s.symcb.com,s.symcd.com,security.ubuntu.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com,www.googleapis.com\"\n GITHUB_SERVER_URL: ${{ github.server_url }}\n GITHUB_API_URL: ${{ github.api_url }}\n with:\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/collect_ndjson_output.cjs');\n await main();\n - name: Parse agent logs for step summary\n if: always()\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n env:\n GH_AW_AGENT_OUTPUT: /tmp/gh-aw/agent-stdio.log\n with:\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/parse_codex_log.cjs');\n await main();\n - name: Parse MCP Gateway logs for step summary\n if: always()\n id: parse-mcp-gateway\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n with:\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/parse_mcp_gateway_log.cjs');\n await main();\n - name: Print firewall logs\n if: always()\n continue-on-error: true\n env:\n AWF_LOGS_DIR: /tmp/gh-aw/sandbox/firewall/logs\n run: |\n # Fix permissions on firewall logs/audit dirs so they can be uploaded as artifacts\n # AWF runs with sudo, creating files owned by root\n sudo chmod -R a+rX /tmp/gh-aw/sandbox/firewall 2>/dev/null || true\n # Only run awf logs summary if awf command exists (it may not be installed if workflow failed before install step)\n if command -v awf &> /dev/null; then\n awf logs summary | tee -a \"$GITHUB_STEP_SUMMARY\"\n else\n echo 'AWF binary not installed, skipping firewall log summary'\n fi\n - name: Parse token usage for step summary\n if: always()\n continue-on-error: true\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n with:\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/parse_token_usage.cjs');\n await main();\n - name: Print AWF reflect summary\n if: always()\n continue-on-error: true\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n with:\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/awf_reflect_summary.cjs');\n await main();\n - name: Write agent output placeholder if missing\n if: always()\n run: |\n if [ ! -f /tmp/gh-aw/agent_output.json ]; then\n echo '{\"items\":[]}' > /tmp/gh-aw/agent_output.json\n fi\n - name: Upload agent artifacts\n if: always()\n continue-on-error: true\n uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1\n with:\n name: agent\n path: |\n /tmp/gh-aw/aw-prompts/prompt.txt\n /tmp/gh-aw/mcp-config/logs/\n /tmp/gh-aw/redacted-urls.log\n /tmp/gh-aw/mcp-logs/\n /tmp/gh-aw/proxy-logs/\n !/tmp/gh-aw/proxy-logs/proxy-tls/\n /tmp/gh-aw/agent_usage.json\n /tmp/gh-aw/agent-stdio.log\n /tmp/gh-aw/pre-agent-audit.txt\n /tmp/gh-aw/agent/\n /tmp/gh-aw/github_rate_limits.jsonl\n /tmp/gh-aw/safeoutputs.jsonl\n /tmp/gh-aw/agent_output.json\n /tmp/gh-aw/aw-*.patch\n /tmp/gh-aw/aw-*.bundle\n /tmp/gh-aw/awf-config.json\n /tmp/gh-aw/sandbox/firewall/logs/\n /tmp/gh-aw/sandbox/firewall/audit/\n /tmp/gh-aw/sandbox/firewall/awf-reflect.json\n if-no-files-found: ignore\n\n conclusion:\n needs:\n - activation\n - agent\n - detection\n - safe_outputs\n if: >\n always() && (needs.agent.result != 'skipped' || needs.activation.outputs.lockdown_check_failed == 'true' ||\n needs.activation.outputs.stale_lock_file_failed == 'true' || needs.activation.outputs.daily_effective_workflow_exceeded == 'true')\n runs-on: ubuntu-slim\n permissions:\n contents: read\n discussions: write\n issues: write\n pull-requests: write\n concurrency:\n group: \"gh-aw-conclusion-pr-review-checklist\"\n cancel-in-progress: false\n queue: max\n outputs:\n incomplete_count: ${{ steps.report_incomplete.outputs.incomplete_count }}\n noop_message: ${{ steps.noop.outputs.noop_message }}\n tools_reported: ${{ steps.missing_tool.outputs.tools_reported }}\n total_count: ${{ steps.missing_tool.outputs.total_count }}\n steps:\n - name: Setup Scripts\n id: setup\n uses: github/gh-aw-actions/setup@7cfd95b59ca996b7e2bebd6222e21ddd187a4e91 # v0.79.4\n with:\n destination: ${{ runner.temp }}/gh-aw/actions\n job-name: ${{ github.job }}\n trace-id: ${{ needs.activation.outputs.setup-trace-id }}\n parent-span-id: ${{ needs.activation.outputs.setup-parent-span-id || needs.activation.outputs.setup-span-id }}\n env:\n GH_AW_SETUP_WORKFLOW_NAME: \"PR Review Checklist\"\n GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/pr-review-checklist.lock.yml@${{ github.ref }}\n GH_AW_INFO_VERSION: \"0.137.0\"\n GH_AW_INFO_AWF_VERSION: \"v0.27.0\"\n GH_AW_INFO_ENGINE_ID: \"codex\"\n - name: Download agent output artifact\n id: download-agent-output\n continue-on-error: true\n uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1\n with:\n name: agent\n path: /tmp/gh-aw/\n - name: Setup agent output environment variable\n id: setup-agent-output-env\n if: steps.download-agent-output.outcome == 'success'\n run: |\n mkdir -p /tmp/gh-aw/\n find \"/tmp/gh-aw/\" -type f -print\n echo \"GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json\" >> \"$GITHUB_OUTPUT\"\n - name: Collect usage artifact files\n if: always()\n continue-on-error: true\n run: |\n mkdir -p /tmp/gh-aw/usage/agent /tmp/gh-aw/usage/detection\n echo \"Usage artifact source file status:\"\n for file in /tmp/gh-aw/aw-info.jsonl /tmp/gh-aw/agent_usage.jsonl /tmp/gh-aw/detection_usage.jsonl /tmp/gh-aw/sandbox/firewall-audit-logs/api-proxy-logs/token-usage.jsonl /tmp/gh-aw/sandbox/firewall/logs/api-proxy-logs/token-usage.jsonl /tmp/gh-aw/sandbox/firewall/audit/api-proxy-logs/token-usage.jsonl /tmp/gh-aw/threat-detection/sandbox/firewall-audit-logs/api-proxy-logs/token-usage.jsonl /tmp/gh-aw/threat-detection/sandbox/firewall/logs/api-proxy-logs/token-usage.jsonl /tmp/gh-aw/threat-detection/sandbox/firewall/audit/api-proxy-logs/token-usage.jsonl; do\n [ -f \"$file\" ] && echo \"FOUND: $file\" || echo \"MISSING: $file\"\n done\n [ -f /tmp/gh-aw/aw-info.jsonl ] && cp /tmp/gh-aw/aw-info.jsonl /tmp/gh-aw/usage/aw-info.jsonl || true\n [ -f /tmp/gh-aw/agent_usage.jsonl ] && cp /tmp/gh-aw/agent_usage.jsonl /tmp/gh-aw/usage/agent_usage.jsonl || true\n [ -f /tmp/gh-aw/detection_usage.jsonl ] && cp /tmp/gh-aw/detection_usage.jsonl /tmp/gh-aw/usage/detection_usage.jsonl || true\n [ -f /tmp/gh-aw/sandbox/firewall-audit-logs/api-proxy-logs/token-usage.jsonl ] && cp /tmp/gh-aw/sandbox/firewall-audit-logs/api-proxy-logs/token-usage.jsonl /tmp/gh-aw/usage/agent/token_usage.jsonl || true\n [ -f /tmp/gh-aw/sandbox/firewall/logs/api-proxy-logs/token-usage.jsonl ] && cp /tmp/gh-aw/sandbox/firewall/logs/api-proxy-logs/token-usage.jsonl /tmp/gh-aw/usage/agent/token_usage.jsonl || true\n [ -f /tmp/gh-aw/sandbox/firewall/audit/api-proxy-logs/token-usage.jsonl ] && cp /tmp/gh-aw/sandbox/firewall/audit/api-proxy-logs/token-usage.jsonl /tmp/gh-aw/usage/agent/token_usage.jsonl || true\n [ -f /tmp/gh-aw/threat-detection/sandbox/firewall-audit-logs/api-proxy-logs/token-usage.jsonl ] && cp /tmp/gh-aw/threat-detection/sandbox/firewall-audit-logs/api-proxy-logs/token-usage.jsonl /tmp/gh-aw/usage/detection/token_usage.jsonl || true\n [ -f /tmp/gh-aw/threat-detection/sandbox/firewall/logs/api-proxy-logs/token-usage.jsonl ] && cp /tmp/gh-aw/threat-detection/sandbox/firewall/logs/api-proxy-logs/token-usage.jsonl /tmp/gh-aw/usage/detection/token_usage.jsonl || true\n [ -f /tmp/gh-aw/threat-detection/sandbox/firewall/audit/api-proxy-logs/token-usage.jsonl ] && cp /tmp/gh-aw/threat-detection/sandbox/firewall/audit/api-proxy-logs/token-usage.jsonl /tmp/gh-aw/usage/detection/token_usage.jsonl || true\n [ -f /tmp/gh-aw/usage/agent/token_usage.jsonl ] || : > /tmp/gh-aw/usage/agent/token_usage.jsonl\n [ -f /tmp/gh-aw/usage/detection/token_usage.jsonl ] || : > /tmp/gh-aw/usage/detection/token_usage.jsonl\n find /tmp/gh-aw/usage -type f -print | sort\n - name: Upload usage artifact\n if: always()\n continue-on-error: true\n uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1\n with:\n name: usage\n path: |\n /tmp/gh-aw/usage/aw-info.jsonl\n /tmp/gh-aw/usage/agent_usage.jsonl\n /tmp/gh-aw/usage/detection_usage.jsonl\n /tmp/gh-aw/usage/agent/token_usage.jsonl\n /tmp/gh-aw/usage/detection/token_usage.jsonl\n if-no-files-found: ignore\n - name: Process no-op messages\n id: noop\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n env:\n GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }}\n GH_AW_NOOP_MAX: \"1\"\n GH_AW_WORKFLOW_NAME: \"PR Review Checklist\"\n GH_AW_WORKFLOW_SOURCE_URL: \"${{ github.server_url }}/${{ github.repository }}/blob/${{ github.ref_name }}/.github/workflows/pr-review-checklist.md\"\n GH_AW_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}\n GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }}\n GH_AW_NOOP_REPORT_AS_ISSUE: \"true\"\n GH_AW_AIC: ${{ needs.agent.outputs.aic }}\n GH_AW_THREAT_DETECTION_AIC: ${{ needs.detection.outputs.aic }}\n GH_AW_AMBIENT_CONTEXT: ${{ needs.agent.outputs.ambient_context }}\n GH_AW_WORKFLOW_ID: \"pr-review-checklist\"\n with:\n github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/handle_noop_message.cjs');\n await main();\n - name: Log detection run\n id: detection_runs\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n env:\n GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }}\n GH_AW_WORKFLOW_NAME: \"PR Review Checklist\"\n GH_AW_WORKFLOW_SOURCE_URL: \"${{ github.server_url }}/${{ github.repository }}/blob/${{ github.ref_name }}/.github/workflows/pr-review-checklist.md\"\n GH_AW_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}\n GH_AW_DETECTION_CONCLUSION: ${{ needs.detection.outputs.detection_conclusion }}\n GH_AW_DETECTION_REASON: ${{ needs.detection.outputs.detection_reason }}\n with:\n github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/handle_detection_runs.cjs');\n await main();\n - name: Record missing tool\n id: missing_tool\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n env:\n GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }}\n GH_AW_MISSING_TOOL_CREATE_ISSUE: \"true\"\n GH_AW_WORKFLOW_NAME: \"PR Review Checklist\"\n GH_AW_WORKFLOW_SOURCE_URL: \"${{ github.server_url }}/${{ github.repository }}/blob/${{ github.ref_name }}/.github/workflows/pr-review-checklist.md\"\n with:\n github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/missing_tool.cjs');\n await main();\n - name: Record incomplete\n id: report_incomplete\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n env:\n GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }}\n GH_AW_REPORT_INCOMPLETE_CREATE_ISSUE: \"true\"\n GH_AW_WORKFLOW_NAME: \"PR Review Checklist\"\n GH_AW_WORKFLOW_SOURCE_URL: \"${{ github.server_url }}/${{ github.repository }}/blob/${{ github.ref_name }}/.github/workflows/pr-review-checklist.md\"\n with:\n github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/report_incomplete_handler.cjs');\n await main();\n - name: Handle agent failure\n id: handle_agent_failure\n if: always()\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n env:\n GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }}\n GH_AW_WORKFLOW_NAME: \"PR Review Checklist\"\n GH_AW_WORKFLOW_SOURCE_URL: \"${{ github.server_url }}/${{ github.repository }}/blob/${{ github.ref_name }}/.github/workflows/pr-review-checklist.md\"\n GH_AW_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}\n GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }}\n GH_AW_WORKFLOW_ID: \"pr-review-checklist\"\n GH_AW_ACTION_FAILURE_ISSUE_EXPIRES_HOURS: \"168\"\n GH_AW_ENGINE_ID: \"codex\"\n GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}\n GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}\n GH_AW_EFFECTIVE_TOKENS: ${{ needs.agent.outputs.effective_tokens || '' }}\n GH_AW_AI_CREDITS_RATE_LIMIT_ERROR: ${{ needs.agent.outputs.ai_credits_rate_limit_error || 'false' }}\n GH_AW_AIC: ${{ needs.agent.outputs.aic }}\n GH_AW_MAX_AI_CREDITS: ${{ vars.GH_AW_DEFAULT_MAX_AI_CREDITS || '1000' }}\n GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}\n GH_AW_MCP_POLICY_ERROR: ${{ needs.agent.outputs.mcp_policy_error }}\n GH_AW_AGENTIC_ENGINE_TIMEOUT: ${{ needs.agent.outputs.agentic_engine_timeout }}\n GH_AW_MODEL_NOT_SUPPORTED_ERROR: ${{ needs.agent.outputs.model_not_supported_error }}\n GH_AW_ENGINE_API_HOSTS: \"api.openai.com\"\n GH_AW_LOCKDOWN_CHECK_FAILED: ${{ needs.activation.outputs.lockdown_check_failed }}\n GH_AW_STALE_LOCK_FILE_FAILED: ${{ needs.activation.outputs.stale_lock_file_failed }}\n GH_AW_DAILY_EFFECTIVE_WORKFLOW_EXCEEDED: ${{ needs.activation.outputs.daily_effective_workflow_exceeded }}\n GH_AW_DAILY_EFFECTIVE_WORKFLOW_TOTAL_EFFECTIVE_TOKENS: ${{ needs.activation.outputs.daily_effective_workflow_total_effective_tokens }}\n GH_AW_DAILY_EFFECTIVE_WORKFLOW_THRESHOLD: ${{ needs.activation.outputs.daily_effective_workflow_threshold }}\n GH_AW_GROUP_REPORTS: \"false\"\n GH_AW_FAILURE_REPORT_AS_ISSUE: \"true\"\n GH_AW_MISSING_TOOL_REPORT_AS_FAILURE: \"true\"\n GH_AW_MISSING_DATA_REPORT_AS_FAILURE: \"true\"\n GH_AW_TIMEOUT_MINUTES: \"25\"\n with:\n github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/handle_agent_failure.cjs');\n await main();\n\n detection:\n needs:\n - activation\n - agent\n if: >\n always() && needs.agent.result != 'skipped' && (needs.agent.outputs.output_types != '' || needs.agent.outputs.has_patch == 'true')\n runs-on: ubuntu-latest\n permissions:\n contents: read\n outputs:\n aic: ${{ steps.parse_detection_token_usage.outputs.aic }}\n detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}\n detection_reason: ${{ steps.detection_conclusion.outputs.reason }}\n detection_success: ${{ steps.detection_conclusion.outputs.success }}\n steps:\n - name: Setup Scripts\n id: setup\n uses: github/gh-aw-actions/setup@7cfd95b59ca996b7e2bebd6222e21ddd187a4e91 # v0.79.4\n with:\n destination: ${{ runner.temp }}/gh-aw/actions\n job-name: ${{ github.job }}\n trace-id: ${{ needs.activation.outputs.setup-trace-id }}\n parent-span-id: ${{ needs.activation.outputs.setup-parent-span-id || needs.activation.outputs.setup-span-id }}\n env:\n GH_AW_SETUP_WORKFLOW_NAME: \"PR Review Checklist\"\n GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/pr-review-checklist.lock.yml@${{ github.ref }}\n GH_AW_INFO_VERSION: \"0.137.0\"\n GH_AW_INFO_AWF_VERSION: \"v0.27.0\"\n GH_AW_INFO_ENGINE_ID: \"codex\"\n - name: Download agent output artifact\n id: download-agent-output\n continue-on-error: true\n uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1\n with:\n name: agent\n path: /tmp/gh-aw/\n - name: Setup agent output environment variable\n id: setup-agent-output-env\n if: steps.download-agent-output.outcome == 'success'\n run: |\n mkdir -p /tmp/gh-aw/\n find \"/tmp/gh-aw/\" -type f -print\n echo \"GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json\" >> \"$GITHUB_OUTPUT\"\n - name: Checkout repository for patch context\n if: needs.agent.outputs.has_patch == 'true'\n uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3\n with:\n persist-credentials: false\n # --- Threat Detection ---\n - name: Clean stale firewall files from agent artifact\n run: |\n rm -rf /tmp/gh-aw/sandbox/firewall/logs\n rm -rf /tmp/gh-aw/sandbox/firewall/audit\n - name: Check if detection needed\n id: detection_guard\n if: always()\n env:\n OUTPUT_TYPES: ${{ needs.agent.outputs.output_types }}\n HAS_PATCH: ${{ needs.agent.outputs.has_patch }}\n run: |\n if [[ -n \"$OUTPUT_TYPES\" || \"$HAS_PATCH\" == \"true\" ]]; then\n echo \"run_detection=true\" >> \"$GITHUB_OUTPUT\"\n echo \"Detection will run: output_types=$OUTPUT_TYPES, has_patch=$HAS_PATCH\"\n else\n echo \"run_detection=false\" >> \"$GITHUB_OUTPUT\"\n echo \"Detection skipped: no agent outputs or patches to analyze\"\n fi\n - name: Clear MCP Config for detection\n if: always() && steps.detection_guard.outputs.run_detection == 'true'\n run: |\n rm -f \"${RUNNER_TEMP}/gh-aw/mcp-config/mcp-servers.json\"\n rm -f /home/runner/.copilot/mcp-config.json\n rm -f \"$GITHUB_WORKSPACE/.gemini/settings.json\"\n - name: Prepare threat detection files\n if: always() && steps.detection_guard.outputs.run_detection == 'true'\n run: |\n mkdir -p /tmp/gh-aw/threat-detection/aw-prompts\n rm -f /tmp/gh-aw/agent_usage.json\n cp /tmp/gh-aw/aw-prompts/prompt.txt /tmp/gh-aw/threat-detection/aw-prompts/prompt.txt 2>/dev/null || true\n if [ ! -s /tmp/gh-aw/threat-detection/aw-prompts/prompt.txt ]; then\n echo \"::warning::ERR_VALIDATION: Missing or empty detection context prompt at /tmp/gh-aw/threat-detection/aw-prompts/prompt.txt. Ensure the agent artifact includes /tmp/gh-aw/aw-prompts/prompt.txt. Detection will continue with fallback workflow context.\"\n fi\n cp /tmp/gh-aw/agent_output.json /tmp/gh-aw/threat-detection/agent_output.json 2>/dev/null || true\n for f in /tmp/gh-aw/aw-*.patch; do\n [ -f \"$f\" ] && cp \"$f\" /tmp/gh-aw/threat-detection/ 2>/dev/null || true\n done\n for f in /tmp/gh-aw/aw-*.bundle; do\n [ -f \"$f\" ] && cp \"$f\" /tmp/gh-aw/threat-detection/ 2>/dev/null || true\n done\n echo \"Prepared threat detection files:\"\n ls -la /tmp/gh-aw/threat-detection/ 2>/dev/null || true\n - name: Setup threat detection\n if: always() && steps.detection_guard.outputs.run_detection == 'true'\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n env:\n WORKFLOW_NAME: \"PR Review Checklist\"\n WORKFLOW_DESCRIPTION: \"自动按外部 checklist 逐条审查 Pull Request，并只输出未通过项及修改建议\"\n HAS_PATCH: ${{ needs.agent.outputs.has_patch }}\n with:\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/setup_threat_detection.cjs');\n await main();\n - name: Ensure threat-detection directory and log\n if: always() && steps.detection_guard.outputs.run_detection == 'true'\n run: |\n mkdir -p /tmp/gh-aw/threat-detection\n touch /tmp/gh-aw/threat-detection/detection.log\n - name: Setup Node.js\n uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0\n with:\n node-version: '24'\n package-manager-cache: false\n - name: Install Codex CLI\n run: npm install --ignore-scripts -g @openai/codex@0.137.0\n - name: Install AWF binary\n run: bash \"${RUNNER_TEMP}/gh-aw/actions/install_awf_binary.sh\" v0.27.0\n - name: Download container images\n run: bash \"${RUNNER_TEMP}/gh-aw/actions/download_docker_images.sh\" ghcr.io/github/gh-aw-firewall/agent:0.27.0 ghcr.io/github/gh-aw-firewall/api-proxy:0.27.0 ghcr.io/github/gh-aw-firewall/squid:0.27.0 ghcr.io/github/gh-aw-mcpg:v0.3.25@sha256:c10331ad17668ef89f38f5e356678788a40b0cd5fef96e8f92e1d9c1de47cbaa\n - name: Start MCP Gateway\n id: start-mcp-gateway\n env:\n CODEX_HOME: /tmp/gh-aw/mcp-config\n run: |\n set -eo pipefail\n mkdir -p \"${RUNNER_TEMP}/gh-aw/mcp-config\"\n \n # Export gateway environment variables for MCP config and gateway script\n export MCP_GATEWAY_PORT=\"8080\"\n export MCP_GATEWAY_DOMAIN=\"host.docker.internal\"\n export MCP_GATEWAY_HOST_DOMAIN=\"localhost\"\n MCP_GATEWAY_API_KEY=$(openssl rand -base64 45 | tr -d '/+=')\n echo \"::add-mask::${MCP_GATEWAY_API_KEY}\"\n export MCP_GATEWAY_API_KEY\n export MCP_GATEWAY_PAYLOAD_DIR=\"/tmp/gh-aw/mcp-payloads\"\n mkdir -p \"${MCP_GATEWAY_PAYLOAD_DIR}\"\n export MCP_GATEWAY_PAYLOAD_SIZE_THRESHOLD=\"524288\"\n export DEBUG=\"*\"\n \n export GH_AW_ENGINE=\"codex\"\n MCP_GATEWAY_UID=$(id -u 2>/dev/null || echo '0')\n MCP_GATEWAY_GID=$(id -g 2>/dev/null || echo '0')\n case \"${DOCKER_HOST:-}\" in\n unix://* ) DOCKER_SOCK_PATH=\"${DOCKER_HOST#unix://}\" ;;\n /* ) DOCKER_SOCK_PATH=\"$DOCKER_HOST\" ;;\n * ) DOCKER_SOCK_PATH=/var/run/docker.sock ;;\n esac\n DOCKER_SOCK_GID=$(stat -c '%g' \"$DOCKER_SOCK_PATH\" 2>/dev/null || echo '0')\n export MCP_GATEWAY_DOCKER_COMMAND='docker run -i --rm --network host --add-host host.docker.internal:127.0.0.1 --user '\"${MCP_GATEWAY_UID}\"':'\"${MCP_GATEWAY_GID}\"' --group-add '\"${DOCKER_SOCK_GID}\"' -v '\"${DOCKER_SOCK_PATH}\"':/var/run/docker.sock -e MCP_GATEWAY_PORT -e MCP_GATEWAY_DOMAIN -e MCP_GATEWAY_API_KEY -e MCP_GATEWAY_PAYLOAD_DIR -e MCP_GATEWAY_PAYLOAD_SIZE_THRESHOLD -e DOCKER_HOST=unix:///var/run/docker.sock -e DEBUG -e MCP_GATEWAY_LOG_DIR -e GH_AW_MCP_LOG_DIR -e GH_AW_SAFE_OUTPUTS -e GH_AW_SAFE_OUTPUTS_CONFIG_PATH -e GH_AW_SAFE_OUTPUTS_TOOLS_PATH -e GH_AW_ASSETS_BRANCH -e GH_AW_ASSETS_MAX_SIZE_KB -e GH_AW_ASSETS_ALLOWED_EXTS -e DEFAULT_BRANCH -e GITHUB_MCP_SERVER_TOKEN -e GITHUB_MCP_GUARD_MIN_INTEGRITY -e GITHUB_MCP_GUARD_REPOS -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e GITHUB_SHA -e GITHUB_WORKSPACE -e GITHUB_TOKEN -e GITHUB_RUN_ID -e GITHUB_RUN_NUMBER -e GITHUB_RUN_ATTEMPT -e GITHUB_JOB -e GITHUB_ACTION -e GITHUB_EVENT_NAME -e GITHUB_EVENT_PATH -e GITHUB_ACTOR -e GITHUB_ACTOR_ID -e GITHUB_TRIGGERING_ACTOR -e GITHUB_WORKFLOW -e GITHUB_WORKFLOW_REF -e GITHUB_WORKFLOW_SHA -e GITHUB_REF -e GITHUB_REF_NAME -e GITHUB_REF_TYPE -e GITHUB_HEAD_REF -e GITHUB_BASE_REF -e CODEX_HOME -v /tmp/gh-aw/mcp-payloads:/tmp/gh-aw/mcp-payloads:rw -v /opt:/opt:ro -v /tmp:/tmp:rw -v '\"${GITHUB_WORKSPACE}\"':'\"${GITHUB_WORKSPACE}\"':rw ghcr.io/github/gh-aw-mcpg:v0.3.25'\n \n cat > \"${RUNNER_TEMP}/gh-aw/mcp-config/config.toml\" << GH_AW_MCP_CONFIG_9dc1744e356f5fbe_EOF\n [history]\n persistence = \"none\"\n \n [shell_environment_policy]\n inherit = \"core\"\n include_only = [\"^CODEX_API_KEY$\", \"^HOME$\", \"^OPENAI_API_KEY$\", \"^PATH$\"]\n GH_AW_MCP_CONFIG_9dc1744e356f5fbe_EOF\n \n # Generate JSON config for MCP gateway\n GH_AW_NODE=$(which node 2>/dev/null || command -v node 2>/dev/null || echo node)\n cat << GH_AW_MCP_CONFIG_37834a58b4c29838_EOF | \"$GH_AW_NODE\" \"${RUNNER_TEMP}/gh-aw/actions/start_mcp_gateway.cjs\"\n {\n \"mcpServers\": {\n },\n \"gateway\": {\n \"port\": $MCP_GATEWAY_PORT,\n \"domain\": \"${MCP_GATEWAY_DOMAIN}\",\n \"apiKey\": \"${MCP_GATEWAY_API_KEY}\",\n \"payloadDir\": \"${MCP_GATEWAY_PAYLOAD_DIR}\"\n }\n }\n GH_AW_MCP_CONFIG_37834a58b4c29838_EOF\n \n # Sync converter output to writable CODEX_HOME for Codex\n mkdir -p /tmp/gh-aw/mcp-config\n cat > \"/tmp/gh-aw/mcp-config/config.toml\" << GH_AW_CODEX_SHELL_POLICY_cb4a4f0f8e96eaf4_EOF\n model_provider = \"openai-proxy\"\n [model_providers.openai-proxy]\n name = \"OpenAI AWF proxy\"\n base_url = \"http://172.30.0.30:10000\"\n env_key = \"OPENAI_API_KEY\"\n supports_websockets = false\n [shell_environment_policy]\n inherit = \"core\"\n include_only = [\"^CODEX_API_KEY$\", \"^HOME$\", \"^OPENAI_API_KEY$\", \"^PATH$\"]\n GH_AW_CODEX_SHELL_POLICY_cb4a4f0f8e96eaf4_EOF\n awk '\n BEGIN { skip_openai_proxy = 0 }\n /^[[:space:]]*model_provider[[:space:]]*=/ { next }\n /^\\[model_providers\\.openai-proxy\\][[:space:]]*$/ { skip_openai_proxy = 1; next }\n /^\\[/ { skip_openai_proxy = 0 }\n !skip_openai_proxy { print }\n ' \"${RUNNER_TEMP}/gh-aw/mcp-config/config.toml\" >> \"/tmp/gh-aw/mcp-config/config.toml\"\n chmod 600 \"/tmp/gh-aw/mcp-config/config.toml\"\n mkdir -p \"${CODEX_HOME}\"\n if [ \"/tmp/gh-aw/mcp-config/config.toml\" != \"${CODEX_HOME}/config.toml\" ]; then cp \"/tmp/gh-aw/mcp-config/config.toml\" \"${CODEX_HOME}/config.toml\"; fi\n chmod 600 \"${CODEX_HOME}/config.toml\"\n - name: Execute Codex CLI\n if: always() && steps.detection_guard.outputs.run_detection == 'true'\n continue-on-error: true\n id: detection_agentic_execution\n run: |\n set -o pipefail\n printf '%s' \"$(date +%s%3N)\" > /tmp/gh-aw/agent_cli_start_ms.txt\n mkdir -p \"$CODEX_HOME/logs\" && touch /tmp/gh-aw/agent-step-summary.md && mkdir -p /tmp/gh-aw/threat-detection && printf '%s' '{\"type\":\"object\",\"properties\":{\"prompt_injection\":{\"type\":\"boolean\"},\"secret_leak\":{\"type\":\"boolean\"},\"malicious_patch\":{\"type\":\"boolean\"},\"reasons\":{\"type\":\"array\",\"items\":{\"type\":\"string\"}}},\"required\":[\"prompt_injection\",\"secret_leak\",\"malicious_patch\",\"reasons\"],\"additionalProperties\":false}' > /tmp/gh-aw/threat-detection/detection_schema.json\n (umask 177 && touch /tmp/gh-aw/threat-detection/detection.log)\n GH_AW_MAX_AI_CREDITS=\"${{ vars.GH_AW_DEFAULT_MAX_AI_CREDITS || '1000' }}\"\n printf '%s\\n' \"{\\\"\\$schema\\\":\\\"https://github.com/github/gh-aw-firewall/releases/download/v0.27.0/awf-config.schema.json\\\",\\\"network\\\":{\\\"allowDomains\\\":[\\\"172.30.0.1\\\",\\\"api.openai.com\\\",\\\"chatgpt.com\\\",\\\"host.docker.internal\\\",\\\"openai.com\\\"]},\\\"apiProxy\\\":{\\\"enabled\\\":true,\\\"enableTokenSteering\\\":true,\\\"maxRuns\\\":500,\\\"maxAiCredits\\\":${GH_AW_MAX_AI_CREDITS},\\\"targets\\\":{\\\"openai\\\":{\\\"host\\\":\\\"ai-pixel.online\\\"}}},\\\"container\\\":{\\\"imageTag\\\":\\\"0.27.0\\\"}}\" > \"${RUNNER_TEMP}/gh-aw/awf-config.json\"\n GH_AW_MODEL_MULTIPLIERS_PATH=\"/tmp/gh-aw/model_multipliers.json\" node \"${RUNNER_TEMP}/gh-aw/actions/merge_awf_model_multipliers.cjs\"\n cp \"${RUNNER_TEMP}/gh-aw/awf-config.json\" /tmp/gh-aw/awf-config.json\n export GH_AW_MODELS_JSON_PATH=\"/tmp/gh-aw/models.json\"\n GH_AW_DOCKER_HOST_PATH_PREFIX_ARGS=\"\"\n if [[ \"${DOCKER_HOST:-}\" =~ ^tcp:// ]]; then\n GH_AW_DOCKER_HOST_PATH_PREFIX_ARGS=\"--docker-host-path-prefix /tmp/gh-aw\"\n fi\n GH_AW_TOOL_CACHE_MOUNT=\"\"\n GH_AW_TOOL_CACHE=\"${RUNNER_TOOL_CACHE:-/opt/hostedtoolcache}\"\n if [ -d \"$GH_AW_TOOL_CACHE\" ]; then\n if [[ \"$GH_AW_TOOL_CACHE\" != /opt/* ]]; then\n GH_AW_TOOL_CACHE_MOUNT=\"$GH_AW_TOOL_CACHE:$GH_AW_TOOL_CACHE:ro\"\n fi\n elif [ -d \"/home/runner/work/_tool\" ]; then\n GH_AW_TOOL_CACHE_MOUNT=\"/home/runner/work/_tool:/home/runner/work/_tool:ro\"\n fi\n # shellcheck disable=SC1003\n sudo -E awf --config \"${RUNNER_TEMP}/gh-aw/awf-config.json\" --container-workdir \"${GITHUB_WORKSPACE}\" --mount \"${RUNNER_TEMP}/gh-aw:${RUNNER_TEMP}/gh-aw:ro\" --mount \"${RUNNER_TEMP}/gh-aw:/host${RUNNER_TEMP}/gh-aw:ro\" ${GH_AW_TOOL_CACHE_MOUNT:+--mount \"$GH_AW_TOOL_CACHE_MOUNT\"} ${GH_AW_DOCKER_HOST_PATH_PREFIX_ARGS} --env-all --exclude-env CODEX_API_KEY --exclude-env OPENAI_API_KEY --log-level info --proxy-logs-dir /tmp/gh-aw/sandbox/firewall/logs --audit-dir /tmp/gh-aw/sandbox/firewall/audit --enable-host-access --allow-host-ports 80,443,8080 --skip-pull \\\n -- /bin/bash -c 'set +o histexpand; GH_AW_TOOL_CACHE=\"${RUNNER_TOOL_CACHE:-/opt/hostedtoolcache}\"; export PATH=\"$(find \"$GH_AW_TOOL_CACHE\" /opt/hostedtoolcache /home/runner/work/_tool -maxdepth 5 -type d -name bin 2>/dev/null | tr '\\''\\n'\\'' '\\'':'\\'')$PATH\"; [ -n \"$GOROOT\" ] && export PATH=\"$GOROOT/bin:$PATH\" || true && GH_AW_NODE_EXEC=\"${GH_AW_NODE_BIN:-}\"; if [ -z \"$GH_AW_NODE_EXEC\" ] || [ ! -x \"$GH_AW_NODE_EXEC\" ]; then GH_AW_NODE_EXEC=\"$(command -v node 2>/dev/null || true)\"; fi; if [ -z \"$GH_AW_NODE_EXEC\" ]; then echo \"node runtime missing on this runner — check runtimes.node in workflow YAML\" >&2; exit 127; fi; GH_AW_NPM_GLOBAL_ROOT=\"$(npm root -g 2>/dev/null || true)\"; if [ -n \"$GH_AW_NPM_GLOBAL_ROOT\" ]; then export NODE_PATH=\"${GH_AW_NPM_GLOBAL_ROOT}${NODE_PATH:+:${NODE_PATH}}\"; fi; \"$GH_AW_NODE_EXEC\" ${RUNNER_TEMP}/gh-aw/actions/codex_harness.cjs codex exec${GH_AW_MODEL_DETECTION_CODEX:+ --model \"$GH_AW_MODEL_DETECTION_CODEX\"} -c web_search=\"disabled\" -c fetch=\"disabled\" --dangerously-bypass-approvals-and-sandbox --skip-git-repo-check --output-schema /tmp/gh-aw/threat-detection/detection_schema.json -o /tmp/gh-aw/threat-detection/detection_result.json --prompt-file /tmp/gh-aw/aw-prompts/prompt.txt' 2>&1 | tee -a /tmp/gh-aw/threat-detection/detection.log\n env:\n CODEX_API_KEY: ${{ secrets.CODEX_API_KEY || secrets.OPENAI_API_KEY }}\n CODEX_HOME: /tmp/gh-aw/mcp-config\n GH_AW_MAX_TURNS: ${{ vars.GH_AW_DEFAULT_MAX_TURNS || '' }}\n GH_AW_MCP_CONFIG: ${{ runner.temp }}/gh-aw/mcp-config/config.toml\n GH_AW_MODEL_DETECTION_CODEX: gpt-5.4\n GH_AW_PHASE: detection\n GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt\n GH_AW_VERSION: v0.79.4\n GITHUB_AW: true\n GITHUB_STEP_SUMMARY: /tmp/gh-aw/agent-step-summary.md\n GIT_AUTHOR_EMAIL: github-actions[bot]@users.noreply.github.com\n GIT_AUTHOR_NAME: github-actions[bot]\n GIT_COMMITTER_EMAIL: github-actions[bot]@users.noreply.github.com\n GIT_COMMITTER_NAME: github-actions[bot]\n OPENAI_API_KEY: ${{ secrets.PIXEL_API_KEY }}\n OPENAI_BASE_URL: https://ai-pixel.online\n RUNNER_TEMP: ${{ runner.temp }}\n RUST_LOG: ${{ runner.debug == 1 && 'trace,hyper_util=info,mio=info,reqwest=info,os_info=info,codex_otel=warn,codex_core=debug,ocodex_exec=debug' || 'warn' }}\n - name: Parse threat detection token usage for step summary\n id: parse_detection_token_usage\n if: always()\n continue-on-error: true\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n env:\n GH_AW_TOKEN_USAGE_SUMMARY_TITLE: Threat Detection Token Usage\n with:\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/parse_token_usage.cjs');\n await main();\n - name: Upload threat detection log\n if: always() && steps.detection_guard.outputs.run_detection == 'true'\n uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1\n with:\n name: detection\n path: /tmp/gh-aw/threat-detection/detection.log\n if-no-files-found: ignore\n - name: Parse and conclude threat detection\n id: detection_conclusion\n if: always()\n continue-on-error: true\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n env:\n RUN_DETECTION: ${{ steps.detection_guard.outputs.run_detection }}\n DETECTION_AGENTIC_EXECUTION_OUTCOME: ${{ steps.detection_agentic_execution.outcome }}\n GH_AW_DETECTION_CONTINUE_ON_ERROR: \"true\"\n with:\n script: |\n try {\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/parse_threat_detection_results.cjs');\n await main();\n } catch (loadErr) {\n const continueOnError = process.env.GH_AW_DETECTION_CONTINUE_ON_ERROR !== 'false';\n const detectionExecutionFailed = process.env.DETECTION_AGENTIC_EXECUTION_OUTCOME === 'failure';\n const msg = 'ERR_SYSTEM: \\u274C Unexpected error loading threat detection module: ' + (loadErr && loadErr.message ? loadErr.message : String(loadErr));\n core.error(msg);\n core.setOutput('reason', 'parse_error');\n if (continueOnError && !detectionExecutionFailed) {\n core.warning('\\u26A0\\uFE0F ' + msg);\n core.setOutput('conclusion', 'warning');\n core.setOutput('success', 'false');\n } else {\n core.setOutput('conclusion', 'failure');\n core.setOutput('success', 'false');\n core.setFailed(msg);\n }\n }\n\n safe_outputs:\n needs:\n - activation\n - agent\n - detection\n if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'\n runs-on: ubuntu-slim\n permissions:\n contents: read\n discussions: write\n issues: write\n pull-requests: write\n timeout-minutes: 45\n env:\n GH_AW_AGENT_AIC: ${{ needs.agent.outputs.aic }}\n GH_AW_AIC: ${{ needs.agent.outputs.aic }}\n GH_AW_AMBIENT_CONTEXT: ${{ needs.agent.outputs.ambient_context }}\n GH_AW_CALLER_WORKFLOW_ID: \"${{ github.repository }}/pr-review-checklist\"\n GH_AW_DETECTION_CONCLUSION: ${{ needs.detection.outputs.detection_conclusion }}\n GH_AW_DETECTION_REASON: ${{ needs.detection.outputs.detection_reason }}\n GH_AW_EFFECTIVE_TOKENS: ${{ needs.agent.outputs.effective_tokens }}\n GH_AW_ENGINE_ID: \"codex\"\n GH_AW_ENGINE_MODEL: \"gpt-5.4\"\n GH_AW_THREAT_DETECTION_AIC: ${{ needs.detection.outputs.aic }}\n GH_AW_WORKFLOW_ID: \"pr-review-checklist\"\n GH_AW_WORKFLOW_NAME: \"PR Review Checklist\"\n GH_AW_WORKFLOW_SOURCE_URL: \"${{ github.server_url }}/${{ github.repository }}/blob/${{ github.ref_name }}/.github/workflows/pr-review-checklist.md\"\n outputs:\n code_push_failure_count: ${{ steps.process_safe_outputs.outputs.code_push_failure_count }}\n code_push_failure_errors: ${{ steps.process_safe_outputs.outputs.code_push_failure_errors }}\n comment_id: ${{ steps.process_safe_outputs.outputs.comment_id }}\n comment_url: ${{ steps.process_safe_outputs.outputs.comment_url }}\n create_discussion_error_count: ${{ steps.process_safe_outputs.outputs.create_discussion_error_count }}\n create_discussion_errors: ${{ steps.process_safe_outputs.outputs.create_discussion_errors }}\n process_safe_outputs_processed_count: ${{ steps.process_safe_outputs.outputs.processed_count }}\n process_safe_outputs_temporary_id_map: ${{ steps.process_safe_outputs.outputs.temporary_id_map }}\n steps:\n - name: Setup Scripts\n id: setup\n uses: github/gh-aw-actions/setup@7cfd95b59ca996b7e2bebd6222e21ddd187a4e91 # v0.79.4\n with:\n destination: ${{ runner.temp }}/gh-aw/actions\n job-name: ${{ github.job }}\n trace-id: ${{ needs.activation.outputs.setup-trace-id }}\n parent-span-id: ${{ needs.activation.outputs.setup-parent-span-id || needs.activation.outputs.setup-span-id }}\n env:\n GH_AW_SETUP_WORKFLOW_NAME: \"PR Review Checklist\"\n GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/pr-review-checklist.lock.yml@${{ github.ref }}\n GH_AW_INFO_VERSION: \"0.137.0\"\n GH_AW_INFO_AWF_VERSION: \"v0.27.0\"\n GH_AW_INFO_ENGINE_ID: \"codex\"\n - name: Download agent output artifact\n id: download-agent-output\n continue-on-error: true\n uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1\n with:\n name: agent\n path: /tmp/gh-aw/\n - name: Setup agent output environment variable\n id: setup-agent-output-env\n if: steps.download-agent-output.outcome == 'success'\n run: |\n mkdir -p /tmp/gh-aw/\n find \"/tmp/gh-aw/\" -type f -print\n echo \"GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json\" >> \"$GITHUB_OUTPUT\"\n - name: Configure GH_HOST for enterprise compatibility\n id: ghes-host-config\n shell: bash\n # zizmor: ignore[github-env] - GITHUB_SERVER_URL is set by GitHub Actions, not user input.\n run: |\n # Derive GH_HOST from GITHUB_SERVER_URL so the gh CLI targets the correct\n # GitHub instance (GHES/GHEC). On github.com this is a harmless no-op.\n GH_HOST=\"${GITHUB_SERVER_URL#https://}\"\n GH_HOST=\"${GH_HOST#http://}\"\n echo \"GH_HOST=${GH_HOST}\" >> \"$GITHUB_ENV\"\n - name: Process Safe Outputs\n id: process_safe_outputs\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n env:\n GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }}\n GH_AW_COMMENT_ID: ${{ needs.activation.outputs.comment_id }}\n GH_AW_ALLOWED_DOMAINS: \"172.30.0.1,ai-pixel.online,api-inference.modelscope.cn,api.commandcode.ai,api.deepseek.com,api.minimaxi.com,api.openai.com,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,chatgpt.com,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,host.docker.internal,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,open.bigmodel.cn,openai.com,opencode.ai,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,ppa.launchpad.net,s.symcb.com,s.symcd.com,security.ubuntu.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com,www.googleapis.com\"\n GITHUB_SERVER_URL: ${{ github.server_url }}\n GITHUB_API_URL: ${{ github.api_url }}\n GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: \"{\\\"add_comment\\\":{\\\"max\\\":1,\\\"target\\\":\\\"triggering\\\"},\\\"create_report_incomplete_issue\\\":{},\\\"missing_data\\\":{},\\\"missing_tool\\\":{},\\\"noop\\\":{\\\"max\\\":1,\\\"report-as-issue\\\":\\\"true\\\"},\\\"report_incomplete\\\":{}}\"\n with:\n github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/safe_output_handler_manager.cjs');\n await main();\n - name: Upload Safe Outputs Items\n if: always()\n uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1\n with:\n name: safe-outputs-items\n path: |\n /tmp/gh-aw/safe-output-items.jsonl\n /tmp/gh-aw/temporary-id-map.json\n if-no-files-found: ignore\n\n"}}, ".github/workflows/shared/engine.md": {"e2cebed0e1db5b318580a02ad700fd2aa28b8a23": {"t": 1786068536.0175953, "n": 334, "h": "c1818e928395ecb5", "c": "---\n# engine:\n# id: claude\n# model: deepseek-v4-pro\n# env:\n# ANTHROPIC_BASE_URL: https://api.deepseek.com/anthropic\n# ANTHROPIC_API_KEY : ${{ secrets.DEEPSEEK_API_KEY }}\nengine:\n id: codex\n model: gpt-5.4\n env:\n OPENAI_BASE_URL: https://ai-pixel.online\n OPENAI_API_KEY : ${{ secrets.PIXEL_API_KEY }}\n---\n\n\n\n\n\n\n"}}}} |