fix: skip COPILOT_API_KEY and /reflect when sandbox.agent is disabled by Copilot · Pull Request #30687 · github/gh-aw

Copilot · 2026-05-06T20:57:24Z

Since v0.68.4, engine: copilot workflows with sandbox: agent: false silently fail: the Copilot CLI exits code 1 with 0 bytes of output because COPILOT_API_KEY (the BYOK dummy key) was unconditionally injected even when no AWF sandbox—and therefore no api-proxy—is running. The harness also made two fetchAWFReflect calls against http://api-proxy:10000/reflect, adding failed requests and 5 s timeouts per run.

Changes

pkg/workflow/copilot_engine_execution.go — gate COPILOT_API_KEY injection and the new AWF_REFLECT_ENABLED=1 signal on sandboxEnabled; neither is emitted when sandbox.agent: false

// Before: unconditional
env["COPILOT_API_KEY"] = constants.CopilotBYOKDummyAPIKey

// After: only when AWF sandbox is active
if sandboxEnabled {
    env["COPILOT_API_KEY"] = constants.CopilotBYOKDummyAPIKey
    env["AWF_REFLECT_ENABLED"] = "1"
}

actions/setup/js/copilot_harness.cjs — both pre-run and post-run fetchAWFReflect calls are guarded by process.env.AWF_REFLECT_ENABLED === "1"; no-op when api-proxy is absent
Tests — TestCopilotEngineSetsDummyAPIKey updated to assert key is present with sandbox and absent without; TestSandboxAgentFalse gains assertions for absent COPILOT_API_KEY and AWF_REFLECT_ENABLED
Golden files & lock files regenerated with AWF_REFLECT_ENABLED: 1 appearing in sandbox-enabled workflows

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

https://api.github.com/graphql
- Triggering command: /usr/bin/gh gh repo view --json owner,name --jq .owner.login + "/" + .name ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile --ignore-path ../../../.pretticonfig 1/x64/bin/git ache/go/1.25.8/[email protected] -uns�� 3594254704 /tmp/go-build1876256361/b059/vet.cfg cfg (http block)
- Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw ../../../.prettirev-parse (http block)
- Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw (http block)
https://api.github.com/orgs/test-owner/actions/secrets
- Triggering command: /usr/bin/gh gh api /orgs/test-owner/actions/secrets --jq .secrets[].name g/workflow/action_sha_validation-errorsas est.go x_amd64/vet (http block)
- Triggering command: /usr/bin/gh gh api /orgs/test-owner/actions/secrets --jq .secrets[].name -b feature-branch (http block)
- Triggering command: /usr/bin/gh gh api /orgs/test-owner/actions/secrets --jq .secrets[].name h ../../../.pret.prettierignore gh /node ithub-script/gitiptables --jq ptables gh api ithub-script/gitOUTPUT --jq x_amd64/vet /repos/actions/ggit --jq /usr/bin/git x_amd64/vet (http block)
https://api.github.com/repos/actions/ai-inference/git/ref/tags/v1
- Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq [.object.sha, .object.type] | @tsv --show-toplevel /opt/hostedtoolcache/go/1.25.8/xrepos/{owner}/{repo}/actions/runs/1/artifacts /usr/bin/git -bool -buildtags /opt/hostedtoolc--show-toplevel git rev-�� --show-toplevel /opt/hostedtoolc--jq /usr/bin/git runs/20260506-21gh -buildtags /usr/bin/git git (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq [.object.sha, .object.type] | @tsv --show-toplevel infocmp /usr/bin/git '/tmp/TestParseDgit '/tmp/TestParseDrev-parse /usr/bin/gh git rev-�� --show-toplevel gh /usr/bin/git /repos/actions/ggh --jq /usr/bin/infocmp/repos/actions/github-script/git/ref/tags/v9 git (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq [.object.sha, .object.type] | @tsv --show-toplevel node /usr/bin/git run format:pkg-json /bin/sh git rev-�� --show-toplevel /bin/sh /usr/bin/git licyBlockedUsersgit infocmp /usr/bin/git git (http block)
https://api.github.com/repos/actions/checkout/git/ref/tags/v3
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq [.object.sha, .object.type] | @tsv ode-gyp-bin/node/tmp/go-build479479588/b473/_pkg_.a l /usr/bin/git g_.a (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq [.object.sha, .object.type] | @tsv 159/001 origin /usr/bin/gh xterm-color git $name) { has/repos/actions/github-script/git/ref/tags/v9 gh api /repos/actions/github-script/git/ref/tags/v9 --jq /usr/bin/gh /repos/actions/ggit --jq /usr/bin/git gh (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq [.object.sha, .object.type] | @tsv add remote2 /usr/bin/git lic_964452574/00gh git (http block)
https://api.github.com/repos/actions/checkout/git/ref/tags/v5
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq [.object.sha, .object.type] | @tsv 0957-15473/test-3256485864 -trimpath e/git -p github.com/githurev-parse -lang=go1.25 e/git --no�� --noprofile -goversion ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile -c=4 -nolocalimports -importcfg ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq [.object.sha, .object.type] | @tsv ithub-script/git/ref/tags/v9 git bject.type] | @tsv --show-toplevel /tmp/go-build479rev-parse /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git /tmp/TestGuardPogit remote /usr/bin/git git (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq [.object.sha, .object.type] | @tsv --show-toplevel infocmp /usr/bin/git xterm-color /opt/hostedtoolcrev-parse /usr/bin/git git rev-�� /ref/tags/v9 git sv --show-toplevel bash /usr/bin/infocmp--show-toplevel gh (http block)
https://api.github.com/repos/actions/checkout/git/ref/tags/v6
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv 0957-15473/test-2097939466 -trimpath ache/node/24.14.1/x64/bin/node -p main -lang=go1.25 /usr/lib/git-cor--jq t-11�� k/gh-aw/gh-aw/.github/workflows/agent-performance-analyzer.md -q /usr/bin/git go1.25.8 -c=4 -nolocalimports git (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv --show-toplevel l /usr/bin/git */*.ts' '**/*.jsgit --local x_amd64/vet git rev-�� --show-toplevel x_amd64/vet /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/vet 01 committer.email 64/pkg/tool/linu--show-toplevel /opt/hostedtoolcache/go/1.25.8/x--jq (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv ansitiveImports2333627543/001 -importcfg /usr/bin/git -s -w -buildmode=exe git rev-�� /ref/tags/v9 -extld=gcc sv --noprofile .cfg At,event,headBra--show-toplevel git (http block)
https://api.github.com/repos/actions/download-artifact/git/ref/tags/v8
- Triggering command: /usr/bin/gh gh api /repos/actions/download-artifact/git/ref/tags/v8 --jq [.object.sha, .object.type] | @tsv /ref/tags/v9 git $name) { hasDiscussionsEnabled } } ithub-script/gitgit infocmp (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/download-artifact/git/ref/tags/v8 --jq [.object.sha, .object.type] | @tsv --show-toplevel git yzer.lock.yml --show-toplevel /usr/bin/git /usr/bin/git git rev-�� ithub/workflows git /usr/bin/git ithub-script/git/usr/bin/gh git ache/node/24.14.graphql git (http block)
https://api.github.com/repos/actions/github-script/git/ref/tags/v8
- Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq [.object.sha, .object.type] | @tsv --show-toplevel /opt/hostedtoolcache/node/24.14.1/x64/bin/node /usr/bin/git github.repositorgh x_amd64/compile /usr/lib/git-cor/repos/actions/github-script/git/ref/tags/v9 git rev-�� ithub-script/git/ref/tags/v9 /usr/lib/git-cor--jq bject.type] | @tsv run --auto /usr/bin/git git (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/git --show-toplevel gh /usr/bin/infocmp/repos/actions/github-script/git/ref/tags/v9 git rev-�� --show-toplevel infocmp /usr/bin/git xterm-color git /usr/bin/git git (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq [.object.sha, .object.type] | @tsv xterm-color git /usr/bin/git sv k2NLfJz/fOL6azElapi (http block)
https://api.github.com/repos/actions/github-script/git/ref/tags/v9
- Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv js/**/*.json' ---p (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv js/**/*.json' --ignore-path ../../../.prettierignore irements.go it/copilot-hooks (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv (http block)
https://api.github.com/repos/actions/github-script/git/ref/tags/v9.0.0
- Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9.0.0 --jq [.object.sha, .object.type] | @tsv get --global x_amd64/vet http.https://gitgit (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9.0.0 --jq [.object.sha, .object.type] | @tsv ../pkg/workflow/js/**/*.json' --- --global x_amd64/vet (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9.0.0 --jq [.object.sha, .object.type] | @tsv ../pkg/workflow/js/**/*.json' --ignore-path ../../../.prettierignore --local x_amd64/compile (http block)
https://api.github.com/repos/actions/setup-go/git/ref/tags/v4
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --show-toplevel bash /usr/bin/gh 9R6S/LibFNih3wtfgh (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv xterm-color git /usr/bin/git --show-toplevel infocmp ache/go/1.25.8/xxterm-color git rev-�� --show-toplevel ache/go/1.25.8/x64/pkg/tool/linuTest User /usr/bin/git /repos/actions/ggit --jq e/git-upload-pac--show-toplevel git (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --show-toplevel bash /usr/bin/gh 3853090852 git /opt/hostedtoolc/repos/actions/github-script/git/ref/tags/v9 gh api /repos/actions/github-script/git/ref/tags/v9 --jq /usr/bin/git --write (http block)
https://api.github.com/repos/actions/setup-node/git/ref/tags/v4
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --show-toplevel -tests /usr/bin/git te '**/*.cjs' '*git (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --show-toplevel 64/pkg/tool/[email protected] /usr/bin/infocmp _.a (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/git ons-test30741813git config ps git rev-�� /ref/tags/v9 ps sv git rev-parse /usr/bin/gh gh (http block)
https://api.github.com/repos/actions/setup-node/git/ref/tags/v6
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv --show-toplevel l ache/node/24.14.1/x64/bin/node ../pkg/workflow/git --local x_amd64/vet /usr/lib/git-core/git t-27�� k/gh-aw/gh-aw/.github/workflows/agent-persona-explorer.md --format=%(objectname) ache/node/24.14.1/x64/bin/node get --local x_amd64/vet ache/node/24.14.1/x64/bin/node (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv /tmp/gh-aw-test-runs/20260506-21-f l /usr/bin/git */*.ts' '**/*.jsgit --local x_amd64/vet git -C /tmp/compile-all-instructions-test-3879099606/.github/workflows config /opt/hostedtoolcache/node/24.14.1/x64/bin/node remote.origin.urgit committer.email 64/pkg/tool/linu--show-toplevel node (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv ansitiveImports2333627543/001 x_amd64/vet /usr/bin/git celain --ignore-git main 64/pkg/tool/linu--show-toplevel git conf�� --get remote.origin.url /usr/bin/git --noprofile .cfg 64/pkg/tool/linu--show-toplevel git (http block)
https://api.github.com/repos/actions/upload-artifact/git/ref/tags/v4
- Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv xterm-color 64/pkg/tool/linu--json /usr/bin/git e formatted" (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --show-toplevel infocmp (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv /home/REDACTED/work/gh-aw/gh-aw/.github/workflows rev-parse /usr/bin/docker --show-toplevel laywright-cli-morev-parse odules/npm/node_--show-toplevel docker pull�� test/concurrent-image:v1.0.0 git /usr/bin/git --show-toplevel gh 64/pkg/tool/linu--show-toplevel git (http block)
https://api.github.com/repos/aws-actions/configure-aws-credentials/git/ref/tags/v4
- Triggering command: /usr/bin/gh gh api /repos/aws-actions/configure-aws-credentials/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --show-toplevel ache/node/24.14.1/x64/bin/node /usr/bin/git orce_all)' config /opt/hostedtoolc--show-toplevel git rev-�� --show-toplevel /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/compile /usr/bin/git /tmp/go-build479gh -trimpath om/other/repo.gistatus git (http block)
- Triggering command: /usr/bin/gh gh api /repos/aws-actions/configure-aws-credentials/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --show-toplevel ache/node/24.14.1/x64/bin/node /usr/bin/git ets.TOKEN }} config clusion,workflow/repos/actions/github-script/git/ref/tags/v9 git rev-�� /ref/tags/v9 git sv --get remote.origin.urrev-parse om/upstream/repo--show-toplevel infocmp (http block)
- Triggering command: /usr/bin/gh gh api /repos/aws-actions/configure-aws-credentials/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --show-toplevel /usr/lib/git-core/git /usr/bin/git --pack_header=2,git -q /usr/bin/infocmp--show-toplevel git rev-�� --show-toplevel infocmp /usr/bin/infocmp xterm-color git om/testowner/tesstatus infocmp (http block)
https://api.github.com/repos/azure/login/git/ref/tags/v2
- Triggering command: /usr/bin/gh gh api /repos/azure/login/git/ref/tags/v2 --jq [.object.sha, .object.type] | @tsv --show-toplevel ache/node/24.14.1/x64/bin/node /usr/bin/git ub.actor x_amd64/vet /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git mpleWorkflow2790infocmp l /usr/bin/git git (http block)
- Triggering command: /usr/bin/gh gh api /repos/azure/login/git/ref/tags/v2 --jq [.object.sha, .object.type] | @tsv --show-toplevel infocmp /usr/bin/git xterm-color /usr/lib/git-correv-parse /usr/bin/git git rev-�� --show-toplevel git /usr/bin/infocmp /tmp/TestGuardPoinfocmp l /usr/bin/git infocmp (http block)
- Triggering command: /usr/bin/gh gh api /repos/azure/login/git/ref/tags/v2 --jq [.object.sha, .object.type] | @tsv ithub-script/git/ref/tags/v9 node bject.type] | @tsv ithub-script/gitgit git bject.type] | @t--show-toplevel git rev-�� --show-toplevel git /usr/bin/git --show-toplevel git om/myorg/repo.gixterm-color git (http block)
https://api.github.com/repos/docker/login-action/git/ref/tags/v3
- Triggering command: /usr/bin/gh gh api /repos/docker/login-action/git/ref/tags/v3 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/git /tmp/TestGuardPogit remote /usr/bin/git git rev-�� --show-toplevel git /usr/bin/infocmp /tmp/gh-aw-test-infocmp remote /usr/bin/git infocmp (http block)
- Triggering command: /usr/bin/gh gh api /repos/docker/login-action/git/ref/tags/v3 --jq [.object.sha, .object.type] | @tsv --show-toplevel infocmp /usr/bin/git xterm-color git /usr/bin/gh git rev-�� --show-toplevel gh /usr/bin/gh /repos/actions/ginfocmp --jq /usr/bin/git gh (http block)
- Triggering command: /usr/bin/gh gh api /repos/docker/login-action/git/ref/tags/v3 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/git ons-test88502695git config /opt/hostedtoolc--show-toplevel git rev-�� --show-toplevel /opt/hostedtoolcache/node/24.14.1/x64/bin/node /usr/bin/git REDACTED.os l /usr/bin/git git (http block)
https://api.github.com/repos/docker/metadata-action/git/ref/tags/v6
- Triggering command: /usr/bin/gh gh api /repos/docker/metadata-action/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/git --show-toplevel git /usr/bin/git git rev-�� /ref/tags/v9 git sv ithub-script/gitgh /usr/bin/git bject.type] | @t/repos/actions/github-script/git/ref/tags/v9 git (http block)
- Triggering command: /usr/bin/gh gh api /repos/docker/metadata-action/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv /repos/actions/github-script/git/ref/tags/v9 --jq /usr/bin/git ithub-script/git/usr/bin/gh git (http block)
https://api.github.com/repos/docker/setup-buildx-action/git/ref/tags/v4
- Triggering command: /usr/bin/gh gh api /repos/docker/setup-buildx-action/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv /ref/tags/v9 git repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } --show-toplevel git /usr/bin/git git rev-�� --show-toplevel git down-spellcheck.lock.yml --show-toplevel gh (http block)
- Triggering command: /usr/bin/gh gh api /repos/docker/setup-buildx-action/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/git --show-toplevel git /usr/bin/git git rev-�� /ref/tags/v9 git sv --show-toplevel git (http block)
https://api.github.com/repos/github/gh-aw
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw --jq .default_branch ithub/workflows infocmp ock.yml xterm-color git /usr/bin/git gh api /repos/actions/github-script/git-f --jq repository(owner: $owner, name:-f --show-toplevel git ed } } git (http block)
https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v0.1.2
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0.1.2 --jq [.object.sha, .object.type] | @tsv /repos/actions/github-script/git/ref/tags/v9 --jq /usr/bin/gh ithub-script/gitgit -buildtags 64/pkg/tool/linu--show-toplevel gh api /repos/actions/github-script/git/ref/tags/v9 --jq /usr/bin/git mplied cfg (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0.1.2 --jq [.object.sha, .object.type] | @tsv xterm-color git /usr/bin/git 1104-27878/test-git bin 2>/dev/nullrev-parse /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel git /usr/bin/git git (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0.1.2 --jq [.object.sha, .object.type] | @tsv /repos/actions/github-script/git/ref/tags/v9 --jq /usr/bin/gh Onlymin-integritgh on (http block)
https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.0.0
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq [.object.sha, .object.type] | @tsv --show-toplevel (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq [.object.sha, .object.type] | @tsv --show-toplevel infocmp /usr/bin/infocmp xterm-color git /usr/bin/gh infocmp -1 xterm-color l /usr/bin/git /ref/tags/v9 --jq sv git (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq [.object.sha, .object.type] | @tsv /ref/tags/v9 flow.test sv tmatter-with-nesgit git odules/npm/node_--show-toplevel ache/go/1.25.8/x64/pkg/tool/linux_amd64/link -C 362471/b470/workflow.test config 362471/b470/importcfg.link remote.origin.urgit m0s _modules/.bin/no--show-toplevel HTleN4Sz1AAfR/PGhFU8IWVJSlKjnkVIAM/8ei28BqxjFMlRCI0fa84/Zq1eBiPHTleN4Sz1AAfR (http block)
https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.2.3
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq [.object.sha, .object.type] | @tsv /home/REDACTED/work/gh-aw/gh-aw/.github/workflows/archie.md aZfPHtRi8CIm /opt/hostedtoolcache/node/24.14.1/x64/bin/node 622799340/001 622799340/002/worev-parse x_amd64/asm /opt/hostedtoolcache/node/24.14.1/x64/bin/node ent.�� .md md /usr/bin/git --noprofile .cfg x_amd64/link git (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq [.object.sha, .object.type] | @tsv ons-test534102703 git /usr/bin/infocmp l git /usr/bin/infocmp--show-toplevel infocmp -1 xterm-color infocmp /usr/bin/git xterm-color git /usr/bin/git git (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq [.object.sha, .object.type] | @tsv /ref/tags/v9 64/pkg/tool/linu-tests sv iant-676393848/.git --jq nch,headSha,disp--show-toplevel git rev-�� --show-toplevel ache/go/1.25.8/xremote /usr/bin/git lGitcustom_brancgit lGitcustom_brancrev-parse ache/node/24.14.--show-toplevel git (http block)
https://api.github.com/repos/github/gh-aw/actions/runs
- Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --limit 100 --created >=2026-04-29 bagabas/go-udiffconfig ACCEPT ache/go/1.25.8/[email protected] itcu�� ode_modules/flatted/golang/pkg/flatted/flatted.go (http block)
- Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --limit 100 --created >=2026-04-06 bracelet/x/exp/gconfig (http block)
- Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --limit 100 --created >=2026-02-05 (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/1/artifacts
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/1/artifacts --jq .artifacts[].name 6256361/b268/vet.cfg 64/pkg/tool/linux_amd64/vet (http block)
- Triggering command: /usr/bin/gh gh run download 1 --dir test-logs/run-1 --write 64/pkg/tool/linux_amd64/vet !../../../pkg/wogit --ignore-path ../../../.pretti--show-toplevel 64/pkg/tool/linux_amd64/vet -uns�� 2444616514 /tmp/go-build1876256361/b029/vetnonexistent-workflow-12345 cfg ignore-path ../.git (http block)
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/1/artifacts --jq .artifacts[].name git sv --show-toplevel git /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel git /usr/bin/git git (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/12345/artifacts
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12345/artifacts --jq .artifacts[].name format:pkg-json k/_temp/uv-python-dir/bash (http block)
- Triggering command: /usr/bin/gh gh run download 12345 --dir test-logs/run-12345 6256361/b243/vet.cfg x_amd64/compile (http block)
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12345/artifacts --jq .artifacts[].name gh /usr/bin/git ithub-script/gitgit --jq bject.type] | @t--show-toplevel git rev-�� /ref/tags/v9 git sv --show-toplevel git /usr/bin/gh gh (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/1234567890
- Triggering command: /usr/bin/gh gh api repos/{owner}/{repo}/actions/runs/1234567890 --jq {databaseId: .id, number: .run_number, url: .html_url, status: .status, conclusion: .conclusion, workflowName: .name, workflowPath: .path, createdAt: .created_at, startedAt: .run_started_at, updatedAt: .updated_at, event: .event, headBranch: .head_branch, '**/*.ts' '**/*.json' --ignore-path ../../../.pr**/*.json --local x_amd64/vet gpg.program (http block)
- Triggering command: /usr/bin/gh gh api repos/{owner}/{repo}/actions/runs/1234567890 --jq {databaseId: .id, number: .run_number, url: .html_url, status: .status, conclusion: .conclusion, workflowName: .name, workflowPath: .path, createdAt: .created_at, startedAt: .run_started_at, updatedAt: .updated_at, event: .event, headBranch: .head_branch, 06981475/001' 06981475/001' (http block)
- Triggering command: /usr/bin/gh gh api repos/{owner}/{repo}/actions/runs/1234567890 --jq {databaseId: .id, number: .run_number, url: .html_url, status: .status, conclusion: .conclusion, workflowName: .name, workflowPath: .path, createdAt: .created_at, startedAt: .run_started_at, updatedAt: .updated_at, event: .event, headBranch: .head_branch, --show-toplevel git 64/bin/bash ithub-script/git/opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/cgo git bject.type] | @tsv git rev-�� --show-toplevel git /usr/bin/git --show-toplevel git /usr/bin/gh git (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/12346/artifacts
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12346/artifacts --jq .artifacts[].name 6256361/b238/vet.cfg x_amd64/vet (http block)
- Triggering command: /usr/bin/gh gh run download 12346 --dir test-logs/run-12346 (http block)
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12346/artifacts --jq .artifacts[].name git bject.type] | @tsv --show-toplevel git /usr/bin/git gh api ApprovalLabelsCompiledOutput4004168924/001 --jq /usr/bin/infocmp ithub-script/gitgit git bject.type] | @t--show-toplevel infocmp (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/2/artifacts
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/2/artifacts --jq .artifacts[].name (http block)
- Triggering command: /usr/bin/gh gh run download 2 --dir test-logs/run-2 pkg/mod/github.com/stretchr/[email protected]/assert/assertion_for-ifaceassert (http block)
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/2/artifacts --jq .artifacts[].name gh ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile /repos/actions/ggit --jq /usr/bin/git ache/go/1.25.8/x64/pkg/tool/linu--jq rev-�� RequiresMinIntegrity3624988965/001 git (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/3/artifacts
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/3/artifacts --jq .artifacts[].name (http block)
- Triggering command: /usr/bin/gh gh run download 3 --dir test-logs/run-3 --write 6256361/b149/vet.cfg !../../../pkg/wogit --ignore-path ../../../.prettierignore /opt/hostedtoolcache/go/1.25.8/x/tmp/go-build479479588/b114/vet.cfg -uns�� 2444616514 /tmp/go-build1876256361/b024/vet.cfg cfg ignore-path ../.git (http block)
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/3/artifacts --jq .artifacts[].name gh ache/go/1.25.8/x64/pkg/tool/linux_amd64/asm /repos/actions/ggit --jq /usr/bin/git ache/go/1.25.8/x64/pkg/tool/linu--jq rev-�� RequiresMinIntegrity3624988965/001 git .cfg --show-toplevel git /usr/bin/git git (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/4/artifacts
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/4/artifacts --jq .artifacts[].name ache/go/1.25.8/x64/src/testing/imain er.test (http block)
- Triggering command: /usr/bin/gh gh run download 4 --dir test-logs/run-4 --write x_amd64/vet !../../../pkg/wogit --ignore-path ../../../.pretti--show-toplevel x_amd64/vet -uns�� ithub-script/git/ref/tags/v9 /tmp/go-build1876256361/b021/vet.cfg cfg ignore-path ../.git (http block)
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/4/artifacts --jq .artifacts[].name gh ache/go/1.25.8/x64/pkg/tool/linux_amd64/cgo /repos/actions/ggit --jq /usr/bin/git ache/go/1.25.8/x64/pkg/tool/linux_amd64/cgo rev-�� RequiresMinIntegrity3624988965/001 git (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/5/artifacts
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/5/artifacts --jq .artifacts[].name (http block)
- Triggering command: /usr/bin/gh gh run download 5 --dir test-logs/run-5 --write x_amd64/compile !../../../pkg/wogit --ignore-path ../../../.prettiuser.name x_amd64/compile ortc�� jpFyaNCwe stmain.go 64/pkg/tool/linux_amd64/compile (http block)
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/5/artifacts --jq .artifacts[].name gh ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet /ref/tags/v9 --jq sv ache/go/1.25.8/xremote.origin.url rev-�� --show-toplevel git /usr/bin/infocmp --show-toplevel git /usr/bin/gh infocmp (http block)
https://api.github.com/repos/github/gh-aw/actions/workflows
- Triggering command: /usr/bin/gh gh workflow list --json name,state,path get --local x_amd64/vet committer.email (http block)
- Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 100 (http block)
- Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 6 --log-level=erroremote logs/command.sh ache/go/1.25.8/xupstream (http block)
https://api.github.com/repos/github/gh-aw/contents/.github/workflows/shared/reporting.md
- Triggering command: /tmp/go-build479479588/b404/cli.test /tmp/go-build479479588/b404/cli.test -test.testlogfile=/tmp/go-build479479588/b404/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true (http block)
- Triggering command: /tmp/go-build3888666347/b404/cli.test /tmp/go-build3888666347/b404/cli.test -test.testlogfile=/tmp/go-build3888666347/b404/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true /ref/tags/v9 1/x64/bin/node sv git rev-�� --show-toplevel git /usr/bin/gh --show-toplevel gh /usr/bin/git gh (http block)
- Triggering command: /tmp/go-build686362471/b404/cli.test /tmp/go-build686362471/b404/cli.test -test.testlogfile=/tmp/go-build686362471/b404/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true ithub-script/gitnode git bject.type] | @t--write git rev-�� ath ../../../.pr**/*.json git x86_64/bash --show-toplevel gh /usr/bin/git git (http block)
https://api.github.com/repos/github/gh-aw/git/ref/tags/v0.47.4
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v0.47.4 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/git runs/20260506-21du rev-parse /usr/bin/git git rev-�� --show-toplevel git /usr/bin/infocmp /home/REDACTED/worgit /home/REDACTED/worrev-parse /usr/bin/git infocmp (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v0.47.4 --jq [.object.sha, .object.type] | @tsv --show-toplevel gh /usr/bin/git /repos/nonexistedu --jq clusion,workflow/tmp/gh-aw/aw-feature-branch.patch git rev-�� --show-toplevel git /usr/bin/gh --show-toplevel git /usr/bin/git gh (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v0.47.4 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/git s/test.md git /usr/bin/git git rev-�� --show-toplevel git /usr/bin/gh --get remote.origin.urrev-parse /usr/bin/git gh (http block)
https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.0.0
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq [.object.sha, .object.type] | @tsv -unreachable=false /tmp/go-build1876256361/b050/vet.cfg k/_temp/uv-python-dir/bash (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq [.object.sha, .object.type] | @tsv yphen3961092314/001' yphen3961092314/001' /usr/bin/infocmp --show-toplevel git /usr/bin/git infocmp -1 ithub-script/git/ref/tags/v9 git bject.type] | @tsv --show-toplevel git /usr/bin/git git (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq [.object.sha, .object.type] | @tsv ithout_min-integrity4082222618/001 git son ignore gh sv git rev-�� 2215164907 git k --show-toplevel git (http block)
https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.2.3
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq [.object.sha, .object.type] | @tsv 380598/b001/_pkg--exclude-hidden=receive (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/git --show-toplevel node /usr/bin/infocmp/tmp/TestGuardPolicyTrustedUsersExpressionCompiledOutput4233289720/001 git rev-�� ub/workflows infocmp /usr/bin/gh xterm-color /opt/hostedtoolcrev-parse /usr/bin/git gh (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq [.object.sha, .object.type] | @tsv json' --ignore-path ../../../.pr**/*.json git sh /ref/tags/v9 gh sv git rev-�� th .prettierignore --log-level=error git node /ref/tags/v9 infocmp sv git (http block)
https://api.github.com/repos/github/gh-aw/git/ref/tags/v2.0.0
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq [.object.sha, .object.type] | @tsv HEAD .cfg 64/pkg/tool/linux_amd64/vet (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq [.object.sha, .object.type] | @tsv /js && npm run format:cjs --silent >/dev/null 2>-errorsas (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq [.object.sha, .object.type] | @tsv HEAD .cfg x_amd64/link (http block)
https://api.github.com/repos/github/gh-aw/git/ref/tags/v3.0.0
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq [.object.sha, .object.type] | @tsv k/gh-aw/gh-aw/pkg/workflow/action_sha_validation-errorsas ckout_disabled_test.go x_amd64/compile ckout_manager.gogit ckout_manager_te-C ckout_optimizati/tmp/TestGuardPolicyMinIntegrityOnlymin-integrity_with_repos=public_2746211859/001 x_amd64/compile ache�� ckout_step_generator.go .cfg x_amd64/vet ude_engine_netwogit ude_engine_test.-C r x_amd64/vet (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq [.object.sha, .object.type] | @tsv --show-toplevel infocmp /usr/bin/infocmp xterm-color infocmp /usr/bin/infocmp--get infocmp -1 ub/workflows infocmp x_amd64/vet xterm-color gh /usr/bin/git x_amd64/vet (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq [.object.sha, .object.type] | @tsv iant-1287274662/.github/workflows git tnet/tools/bash --show-toplevel infocmp /usr/bin/git git phen�� th .prettierignore --log-level=error git /usr/bin/gh --show-toplevel sh /usr/bin/infocmp/tmp/gh-aw-test-runs/20260506-211627-40452/test-3172328083 gh (http block)
https://api.github.com/repos/google-github-actions/auth/git/ref/tags/v2
- Triggering command: /usr/bin/gh gh api /repos/google-github-actions/auth/git/ref/tags/v2 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/git /tmp/TestGuardPogit remote /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --get remote.origin.urrev-parse /usr/bin/git git (http block)
- Triggering command: /usr/bin/gh gh api /repos/google-github-actions/auth/git/ref/tags/v2 --jq [.object.sha, .object.type] | @tsv --show-toplevel /bin/sh /usr/bin/git git-upload-pack git git-upload-pack rev-parse o.git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel infocmp /usr/bin/git git (http block)
- Triggering command: /usr/bin/gh gh api /repos/google-github-actions/auth/git/ref/tags/v2 --jq [.object.sha, .object.type] | @tsv --show-toplevel node /usr/bin/git /home/REDACTED/worgit git /opt/hostedtoolc--show-toplevel git rev-�� /ref/tags/v9 /opt/hostedtoolcache/node/24.14.1/x64/bin/node sv github.event.inpgit git /usr/bin/git infocmp (http block)
https://api.github.com/repos/nonexistent/action/git/ref/tags/v999.999.999
- Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq [.object.sha, .object.type] | @tsv sRemoteWithRealGitmain_branch368-c=4 sRemoteWithRealGitmain_branch368-nolocalimports cal/bin/bash (http block)
- Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq [.object.sha, .object.type] | @tsv /repos/actions/github-script/git/ref/tags/v9 --jq /usr/bin/git ithub-script/gitgit git bject.type] | @t/tmp/gh-aw-test-runs/20260506-211104-27878/test-source-field-variant-3853149395 git rev-�� --show-toplevel git /usr/bin/git ithub-script/gitgit git bject.type] | @t/tmp/TestParseDefaultBranchFromLsRemoteWithRealGitcustom_branch442496716/001 git (http block)
- Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq [.object.sha, .object.type] | @tsv ut3098966147/001 gh /usr/bin/git /ref/tags/v9 infocmp sv git rev-�� epository gh ache/uv/0.11.11/x86_64/node /repos/actions/sgh --jq (http block)
https://api.github.com/repos/nonexistent/repo/actions/runs/12345
- Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion (http block)
- Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion --show-toplevel infocmp /usr/bin/git git rev-�� 1104-27878/test-1252140560 git e/git-upload-pack --show-toplevel git /opt/hostedtoolcxterm-color git (http block)
- Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion user.email [email protected] (http block)
https://api.github.com/repos/owner/repo/actions/workflows
- Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo x_amd64/vet committer.email (http block)
- Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo x_amd64/vet committer.email X_DISABLED\|AGEN-o k/gh-aw/gh-aw/ac/tmp/go-build479479588/b070/gh-aw.test x_amd64/vet conf�� .js' --ignore-pa-s user.email x_amd64/vet (http block)
- Triggering command: /usr/bin/gh gh workflow list --repo owner/repo --json name,path,state cfg ignore-path ../.git (http block)
https://api.github.com/repos/test-owner/test-repo/actions/secrets
- Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name get --local x_amd64/vet committer.email (http block)
- Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name run --auto /usr/bin/gh --detach ache/go/1.25.8/xapi (http block)
- Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name h ../../../.pret.prettierignore infocmp (http block)
https://api.github.com/repos/test/repo
- Triggering command: /usr/bin/gh gh api /repos/test/repo --jq .default_branch /php.ini /tmp/go-build1876256361/b074/vet.cfg '~E_ALL' tions-lock.json infocmp all("session") a-1 de /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linurev-parse -ato�� -bool -buildtags 1/x64/bin/node -errorsas -ifaceassert -nilfunc bash (http block)
- Triggering command: /usr/bin/gh gh api /repos/test/repo --jq .default_branch ithub-script/git/ref/tags/v9 gh bject.type] | @tsv ithub-script/gitgh --jq bject.type] | @tsv git rev-�� --show-toplevel l /usr/bin/git /ref/tags/v9 git sv git (http block)
- Triggering command: /usr/bin/gh gh api /repos/test/repo --jq .default_branch ithub/workflows/diagnostic noise should not be returned Nccv6e6yGnni ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet rkflow/js/**/*.jgh docker erignore ache/go/1.25.8/x--jq --no�� --noprofile CI0fa84/2X4B7dr5Nccv6e6yGnni e/git /repos/actions/ggh --jq /usr/bin/infocmp/repos/actions/github-script/git/ref/tags/v9 e/git (http block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

When sandbox.agent: false, no AWF sandbox or api-proxy is running. The COPILOT_API_KEY (BYOK dummy key) was unconditionally injected, causing the Copilot CLI to exit silently with code 1 since it couldn't authenticate. The harness also connected to http://api-proxy:10000/reflect which always failed, adding log noise and 5s timeouts. Changes: - copilot_engine_execution.go: only inject COPILOT_API_KEY and set AWF_REFLECT_ENABLED=1 when the AWF sandbox is active (sandboxEnabled) - copilot_harness.cjs: skip fetchAWFReflect calls when AWF_REFLECT_ENABLED is not "1" (i.e. no api-proxy sidecar available) - Update tests to assert the new conditional behavior - Regenerate golden files and lock files with AWF_REFLECT_ENABLED=1 Agent-Logs-Url: https://github.com/github/gh-aw/sessions/bb9e78de-8df9-4baa-a122-b26ff462d6d5 Co-authored-by: pelikhan <[email protected]>

github-actions · 2026-05-06T21:20:36Z

Hey @app/copilot-swe-agent 👋 — thanks for opening this WIP to track the sandbox-disabled fix for the Copilot engine! The intent is clear and the checklist is a great start. A few things to address before this is ready for review:

No code changes yet — the diff is currently empty (0 additions, 0 deletions). The PR needs the actual implementation in copilot_engine_execution.go and copilot_harness.cjs before it can be reviewed.
Tests are missing — the checklist mentions adding/updating tests, but none are present yet. Make sure test files are included in the final diff to cover the new skip-injection and skip-reflect behavior.
No labels — consider adding appropriate labels (e.g. bug, relevant area label) to help maintainers triage.

Once the implementation lands, here's a prompt you can assign to your coding agent to complete this:

Fix the Copilot engine when sandbox is disabled:
1. In `copilot_engine_execution.go`: skip injection of `COPILOT_API_KEY` when the sandbox agent is disabled.
2. In `copilot_harness.cjs`: skip `fetchAWFReflect` calls when no api-proxy is present (sandbox disabled).
3. Add or update tests covering both the sandbox-enabled and sandbox-disabled paths for each change.
4. Run `make build && make fmt` and ensure everything passes before pushing.

Generated by Contribution Check · ● 7.6M · ◷

Copilot

Pull request overview

Fixes Copilot engine runs where sandbox.agent: false caused silent failures by preventing AWF-only environment/proxy behavior from being enabled when the AWF sandbox (and api-proxy) is not running.

Changes:

Gate injection of COPILOT_API_KEY (BYOK dummy key) and new AWF_REFLECT_ENABLED=1 on AWF firewall/sandbox enablement.
Guard fetchAWFReflect() pre/post calls in copilot_harness.cjs behind AWF_REFLECT_ENABLED === "1" to avoid failed requests/timeouts when api-proxy is absent.
Update integration/unit tests and regenerate golden/lock workflow fixtures to reflect the new env behavior.

Show a summary per file

File	Description
pkg/workflow/copilot_engine_execution.go	Only injects AWF-specific env (`COPILOT_API_KEY`, `AWF_REFLECT_ENABLED`) when the AWF firewall/sandbox is enabled.
actions/setup/js/copilot_harness.cjs	Skips `/reflect` pre/post fetch unless explicitly enabled via `AWF_REFLECT_ENABLED=1`.
pkg/workflow/copilot_engine_test.go	Updates assertions to require dummy key + reflect flag in AWF mode and absence when `sandbox.agent: false`.
pkg/workflow/sandbox_agent_disabled_test.go	Adds assertions that AWF-only env vars are not present when agent sandbox is disabled.
pkg/workflow/testdata/TestWasmGolden_CompileFixtures/basic-copilot.golden	Golden update to include `AWF_REFLECT_ENABLED: 1` for sandbox-enabled Copilot workflows.
pkg/workflow/testdata/TestWasmGolden_CompileFixtures/playwright-cli-mode.golden	Golden update to include `AWF_REFLECT_ENABLED: 1` for sandbox-enabled Copilot workflows.
pkg/workflow/testdata/TestWasmGolden_CompileFixtures/smoke-copilot.golden	Golden update to include `AWF_REFLECT_ENABLED: 1` for sandbox-enabled Copilot workflows.
pkg/workflow/testdata/TestWasmGolden_CompileFixtures/with-imports.golden	Golden update to include `AWF_REFLECT_ENABLED: 1` for sandbox-enabled Copilot workflows.
.github/workflows/ace-editor.lock.yml	Regenerated lock workflow to include `AWF_REFLECT_ENABLED: 1` where applicable.
.github/workflows/agent-performance-analyzer.lock.yml	Regenerated lock workflow to include `AWF_REFLECT_ENABLED: 1` where applicable.
.github/workflows/agent-persona-explorer.lock.yml	Regenerated lock workflow to include `AWF_REFLECT_ENABLED: 1` where applicable.
.github/workflows/archie.lock.yml	Regenerated lock workflow to include `AWF_REFLECT_ENABLED: 1` where applicable.
.github/workflows/artifacts-summary.lock.yml	Regenerated lock workflow to include `AWF_REFLECT_ENABLED: 1` where applicable.
.github/workflows/bot-detection.lock.yml	Regenerated lock workflow to include `AWF_REFLECT_ENABLED: 1` where applicable.
.github/workflows/brave.lock.yml	Regenerated lock workflow to include `AWF_REFLECT_ENABLED: 1` where applicable.
.github/workflows/ci-coach.lock.yml	Regenerated lock workflow to include `AWF_REFLECT_ENABLED: 1` where applicable.
.github/workflows/cli-consistency-checker.lock.yml	Regenerated lock workflow to include `AWF_REFLECT_ENABLED: 1` where applicable.
.github/workflows/code-simplifier.lock.yml	Regenerated lock workflow to include `AWF_REFLECT_ENABLED: 1` where applicable.
.github/workflows/contribution-check.lock.yml	Regenerated lock workflow to include `AWF_REFLECT_ENABLED: 1` where applicable.
.github/workflows/copilot-pr-merged-report.lock.yml	Regenerated lock workflow to include `AWF_REFLECT_ENABLED: 1` where applicable.
.github/workflows/copilot-pr-nlp-analysis.lock.yml	Regenerated lock workflow to include `AWF_REFLECT_ENABLED: 1` where applicable.
.github/workflows/copilot-pr-prompt-analysis.lock.yml	Regenerated lock workflow to include `AWF_REFLECT_ENABLED: 1` where applicable.
.github/workflows/copilot-token-audit.lock.yml	Regenerated lock workflow to include `AWF_REFLECT_ENABLED: 1` where applicable.
.github/workflows/copilot-token-optimizer.lock.yml	Regenerated lock workflow to include `AWF_REFLECT_ENABLED: 1` where applicable.
.github/workflows/constraint-solving-potd.lock.yml	Regenerated lock workflow to include `AWF_REFLECT_ENABLED: 1` where applicable.
.github/workflows/craft.lock.yml	Regenerated lock workflow to include `AWF_REFLECT_ENABLED: 1` where applicable.
.github/workflows/daily-architecture-diagram.lock.yml	Regenerated lock workflow to include `AWF_REFLECT_ENABLED: 1` where applicable.
.github/workflows/daily-cli-performance.lock.yml	Regenerated lock workflow to include `AWF_REFLECT_ENABLED: 1` where applicable.
.github/workflows/daily-cli-tools-tester.lock.yml	Regenerated lock workflow to include `AWF_REFLECT_ENABLED: 1` where applicable.
.github/workflows/daily-experiment-report.lock.yml	Regenerated lock workflow to include `AWF_REFLECT_ENABLED: 1` where applicable.
.github/workflows/daily-firewall-report.lock.yml	Regenerated lock workflow to include `AWF_REFLECT_ENABLED: 1` where applicable.
.github/workflows/daily-malicious-code-scan.lock.yml	Regenerated lock workflow to include `AWF_REFLECT_ENABLED: 1` where applicable.
.github/workflows/daily-news.lock.yml	Regenerated lock workflow to include `AWF_REFLECT_ENABLED: 1` where applicable.
.github/workflows/daily-regulatory.lock.yml	Regenerated lock workflow to include `AWF_REFLECT_ENABLED: 1` where applicable.
.github/workflows/daily-semgrep-scan.lock.yml	Regenerated lock workflow to include `AWF_REFLECT_ENABLED: 1` where applicable.
.github/workflows/daily-secrets-analysis.lock.yml	Regenerated lock workflow to include `AWF_REFLECT_ENABLED: 1` where applicable.
.github/workflows/daily-sentrux-report.lock.yml	Regenerated lock workflow to include `AWF_REFLECT_ENABLED: 1` where applicable.
.github/workflows/daily-skill-optimizer.lock.yml	Regenerated lock workflow to include `AWF_REFLECT_ENABLED: 1` where applicable.
.github/workflows/daily-team-status.lock.yml	Regenerated lock workflow to include `AWF_REFLECT_ENABLED: 1` where applicable.
.github/workflows/daily-workflow-updater.lock.yml	Regenerated lock workflow to include `AWF_REFLECT_ENABLED: 1` where applicable.
.github/workflows/dependabot-burner.lock.yml	Regenerated lock workflow to include `AWF_REFLECT_ENABLED: 1` where applicable.
.github/workflows/dependabot-go-checker.lock.yml	Regenerated lock workflow to include `AWF_REFLECT_ENABLED: 1` where applicable.
.github/workflows/dependabot-repair.lock.yml	Regenerated lock workflow to include `AWF_REFLECT_ENABLED: 1` where applicable.
.github/workflows/dictation-prompt.lock.yml	Regenerated lock workflow to include `AWF_REFLECT_ENABLED: 1` where applicable.
.github/workflows/docs-noob-tester.lock.yml	Regenerated lock workflow to include `AWF_REFLECT_ENABLED: 1` where applicable.
.github/workflows/example-permissions-warning.lock.yml	Regenerated lock workflow to include `AWF_REFLECT_ENABLED: 1` where applicable.
.github/workflows/firewall-escape.lock.yml	Regenerated lock workflow to include `AWF_REFLECT_ENABLED: 1` where applicable.
.github/workflows/firewall.lock.yml	Regenerated lock workflow to include `AWF_REFLECT_ENABLED: 1` where applicable.
.github/workflows/functional-pragmatist.lock.yml	Regenerated lock workflow to include `AWF_REFLECT_ENABLED: 1` where applicable.
.github/workflows/github-remote-mcp-auth-test.lock.yml	Regenerated lock workflow to include `AWF_REFLECT_ENABLED: 1` where applicable.
.github/workflows/gpclean.lock.yml	Regenerated lock workflow to include `AWF_REFLECT_ENABLED: 1` where applicable.
.github/workflows/hippo-embed.lock.yml	Regenerated lock workflow to include `AWF_REFLECT_ENABLED: 1` where applicable.
.github/workflows/issue-triage-agent.lock.yml	Regenerated lock workflow to include `AWF_REFLECT_ENABLED: 1` where applicable.
.github/workflows/jsweep.lock.yml	Regenerated lock workflow to include `AWF_REFLECT_ENABLED: 1` where applicable.
.github/workflows/mattpocock-skills-reviewer.lock.yml	Regenerated lock workflow to include `AWF_REFLECT_ENABLED: 1` where applicable.
.github/workflows/mcp-inspector.lock.yml	Regenerated lock workflow to include `AWF_REFLECT_ENABLED: 1` where applicable.
.github/workflows/metrics-collector.lock.yml	Regenerated lock workflow to include `AWF_REFLECT_ENABLED: 1` where applicable.
.github/workflows/notion-issue-summary.lock.yml	Regenerated lock workflow to include `AWF_REFLECT_ENABLED: 1` where applicable.
.github/workflows/pdf-summary.lock.yml	Regenerated lock workflow to include `AWF_REFLECT_ENABLED: 1` where applicable.
.github/workflows/plan.lock.yml	Regenerated lock workflow to include `AWF_REFLECT_ENABLED: 1` where applicable.
.github/workflows/pr-nitpick-reviewer.lock.yml	Regenerated lock workflow to include `AWF_REFLECT_ENABLED: 1` where applicable.
.github/workflows/python-data-charts.lock.yml	Regenerated lock workflow to include `AWF_REFLECT_ENABLED: 1` where applicable.
.github/workflows/refactoring-cadence.lock.yml	Regenerated lock workflow to include `AWF_REFLECT_ENABLED: 1` where applicable.
.github/workflows/refiner.lock.yml	Regenerated lock workflow to include `AWF_REFLECT_ENABLED: 1` where applicable.
.github/workflows/release.lock.yml	Regenerated lock workflow to include `AWF_REFLECT_ENABLED: 1` where applicable.
.github/workflows/repo-audit-analyzer.lock.yml	Regenerated lock workflow to include `AWF_REFLECT_ENABLED: 1` where applicable.
.github/workflows/repo-tree-map.lock.yml	Regenerated lock workflow to include `AWF_REFLECT_ENABLED: 1` where applicable.
.github/workflows/research.lock.yml	Regenerated lock workflow to include `AWF_REFLECT_ENABLED: 1` where applicable.
.github/workflows/security-compliance.lock.yml	Regenerated lock workflow to include `AWF_REFLECT_ENABLED: 1` where applicable.
.github/workflows/security-review.lock.yml	Regenerated lock workflow to include `AWF_REFLECT_ENABLED: 1` where applicable.
.github/workflows/smoke-ci.lock.yml	Regenerated lock workflow to include `AWF_REFLECT_ENABLED: 1` where applicable.
.github/workflows/smoke-create-cross-repo-pr.lock.yml	Regenerated lock workflow to include `AWF_REFLECT_ENABLED: 1` where applicable.
.github/workflows/smoke-project.lock.yml	Regenerated lock workflow to include `AWF_REFLECT_ENABLED: 1` where applicable.
.github/workflows/smoke-service-ports.lock.yml	Regenerated lock workflow to include `AWF_REFLECT_ENABLED: 1` where applicable.
.github/workflows/smoke-temporary-id.lock.yml	Regenerated lock workflow to include `AWF_REFLECT_ENABLED: 1` where applicable.
.github/workflows/smoke-test-tools.lock.yml	Regenerated lock workflow to include `AWF_REFLECT_ENABLED: 1` where applicable.
.github/workflows/smoke-update-cross-repo-pr.lock.yml	Regenerated lock workflow to include `AWF_REFLECT_ENABLED: 1` where applicable.
.github/workflows/super-linter.lock.yml	Regenerated lock workflow to include `AWF_REFLECT_ENABLED: 1` where applicable.
.github/workflows/test-dispatcher.lock.yml	Regenerated lock workflow to include `AWF_REFLECT_ENABLED: 1` where applicable.
.github/workflows/test-project-url-default.lock.yml	Regenerated lock workflow to include `AWF_REFLECT_ENABLED: 1` where applicable.
.github/workflows/test-workflow.lock.yml	Regenerated lock workflow to include `AWF_REFLECT_ENABLED: 1` where applicable.
.github/workflows/update-astro.lock.yml	Regenerated lock workflow to include `AWF_REFLECT_ENABLED: 1` where applicable.
.github/workflows/video-analyzer.lock.yml	Regenerated lock workflow to include `AWF_REFLECT_ENABLED: 1` where applicable.
.github/workflows/workflow-generator.lock.yml	Regenerated lock workflow to include `AWF_REFLECT_ENABLED: 1` where applicable.
.github/workflows/workflow-health-manager.lock.yml	Regenerated lock workflow to include `AWF_REFLECT_ENABLED: 1` where applicable.
.github/workflows/workflow-normalizer.lock.yml	Regenerated lock workflow to include `AWF_REFLECT_ENABLED: 1` where applicable.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 146/146 changed files
Comments generated: 0

Initial plan

b7c789e

Copilot AI assigned Copilot and pelikhan May 6, 2026

Copilot started work on behalf of pelikhan May 6, 2026 20:57 View session

Copilot AI linked an issue May 6, 2026 that may be closed by this pull request

From v0.68.4 copilot engine broken when sandbox: agent: false with strict: false #30632

Closed

github-actions Bot mentioned this pull request May 6, 2026

[Contribution Check Report] Contribution Check — 2026-05-06 #30667

Closed

Copilot AI changed the title ~~[WIP] Fix copilot engine broken when sandbox agent is false~~ fix: skip COPILOT_API_KEY and /reflect when sandbox.agent is disabled May 6, 2026

Copilot finished work on behalf of pelikhan May 6, 2026 21:26

Copilot AI requested a review from pelikhan May 6, 2026 21:26

pelikhan marked this pull request as ready for review May 6, 2026 22:40

Copilot AI review requested due to automatic review settings May 6, 2026 22:40

Copilot started reviewing on behalf of pelikhan May 6, 2026 22:42 View session

Copilot AI reviewed May 6, 2026

View reviewed changes

Merge branch 'main' into copilot/fix-copilot-engine-regression

026d541

pelikhan merged commit c7a53e9 into main May 6, 2026
24 checks passed

pelikhan deleted the copilot/fix-copilot-engine-regression branch May 6, 2026 23:17

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: skip COPILOT_API_KEY and /reflect when sandbox.agent is disabled#30687

fix: skip COPILOT_API_KEY and /reflect when sandbox.agent is disabled#30687
pelikhan merged 3 commits into
mainfrom
copilot/fix-copilot-engine-regression

Copilot AI commented May 6, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented May 6, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

Copilot AI commented May 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

github-actions Bot commented May 6, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Copilot's findings

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented May 6, 2026 •

edited

Loading