feat: DIFC proxy uses step-scoped env instead of mutating GITHUB_ENV by Copilot · Pull Request #26322 · github/gh-aw

Copilot · 2026-04-14T23:09:19Z

start_difc_proxy.sh was writing GH_HOST=localhost:18443 and related vars to $GITHUB_ENV, permanently overwriting GHE host values set by configure_gh_for_ghe.sh. This required fragile save/restore logic, a standalone Set GH_REPO workaround step, and successive per-command patches for every new gh CLI usage in proxied steps.

Approach

Instead of global env mutation, the compiler now injects proxy routing vars as step-level env: blocks on each custom step. Step-level env overrides $GITHUB_ENV without mutating it, so non-proxied steps (including post-stop steps) continue to see the correct GHE host.

Before

- name: Start DIFC proxy       # writes GH_HOST=localhost:18443 to $GITHUB_ENV (global)
- name: Set GH_REPO for proxied steps   # workaround step
- name: Custom user step
  run: gh pr list              # sees proxy via $GITHUB_ENV
- name: Stop DIFC proxy        # tries to restore GH_HOST; loses GHE value on GHES runners

After

- name: Start DIFC proxy       # starts container only, no $GITHUB_ENV writes
- env:
    GH_HOST: localhost:18443
    GH_REPO: ${{ github.repository }}
    GITHUB_API_URL: https://localhost:18443/api/v3
    GITHUB_GRAPHQL_URL: https://localhost:18443/api/graphql
    NODE_EXTRA_CA_CERTS: /tmp/gh-aw/proxy-logs/proxy-tls/ca.crt
  name: Custom user step
  run: gh pr list              # sees proxy via step-level env only
- name: Stop DIFC proxy        # stops container; no env restore needed

Changes

start_difc_proxy.sh: Removed all $GITHUB_ENV writes (GH_HOST, GH_AW_ORIGINAL_*, GITHUB_API_URL, GITHUB_GRAPHQL_URL, NODE_EXTRA_CA_CERTS). Kept container start, health check, CA cert install, and git remote add proxy.
stop_difc_proxy.sh: Removed all $GITHUB_ENV restore/clear logic. Kept container stop and CA cert removal.
compiler_difc_proxy.go: Added proxyEnvVars() and injectProxyEnvIntoCustomSteps() — uses YAML parse + reserialize to merge proxy vars into each step's env: block, preserving existing vars (e.g. GH_TOKEN). Removed buildSetGHRepoStepYAML() and generateSetGHRepoAfterDIFCProxyStep().
compiler_yaml_main_job.go: Removed the Set GH_REPO standalone step; calls injectProxyEnvIntoCustomSteps before emitting custom steps when hasDIFCProxyNeeded is true.
Tests: Replaced TestBuildSetGHRepoStepYAML/TestGenerateSetGHRepoAfterDIFCProxyStep with TestProxyEnvVars and TestInjectProxyEnvIntoCustomSteps; updated TestDIFCProxyStepOrderInCompiledWorkflow for the new behaviour.
4 workflow lock files recompiled (contribution-check, daily-issues-report, issue-arborist, stale-repo-identifier).

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

https://api.github.com/graphql
- Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw (http block)
- Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw oAfterDIFCProxyS/home/REDACTED/work/gh-aw/gh-aw/actions/setup/js/node_modules/.bin/pre�� k/gh-aw/gh-aw x_amd64/vet conf�� w/js/**/*.json' --ignore-path pull.rebase x_amd64/vet (http block)
- Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw /home/REDACTED/wor-C (http block)
https://api.github.com/orgs/test-owner/actions/secrets
- Triggering command: /usr/bin/gh gh api /orgs/test-owner/actions/secrets --jq .secrets[].name --tags --always tor.lock.yml nore (http block)
- Triggering command: /usr/bin/gh gh api /orgs/test-owner/actions/secrets --jq .secrets[].name --show-toplevel git /usr/bin/git --show-toplevel git /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel git /usr/bin/git git (http block)
- Triggering command: /usr/bin/gh gh api /orgs/test-owner/actions/secrets --jq .secrets[].name --show-toplevel git /usr/bin/git /usr/bin/git /usr/bin/runc.orjs/fuzz_sanitize_incoming_text_harness.cjs /usr/bin/git git rev-�� --show-toplevel git (http block)
https://api.github.com/repos/actions/ai-inference/git/ref/tags/v1
- Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq .object.sha --show-toplevel x_amd64/link /opt/hostedtoolcache/node/24.14.1/x64/bin/node k/gh-aw/gh-aw/.ggit git /usr/bin/git /opt/hostedtoolcache/node/24.14.1/x64/bin/node /tmp�� No expressions here xT/i166jLdf-_TPs-extld=gcc /usr/bin/git ithub/workflows config ache/node/24.14.--show-toplevel git (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq .object.sha --show-toplevel git /usr/local/bin/systemctl --show-toplevel bash /usr/bin/git systemctl show�� azure-vmextensions-Microsoft.CPlat.Core.RunCommandLinux.slice --property /usr/bin/git --show-toplevel git /usr/bin/git git (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq .object.sha user.name Test User ache/node/24.14.1/x64/bin/node --show-toplevel git 1/x64/bin/node ache/node/24.14.1/x64/bin/node 6086�� --show-toplevel git ache/node/24.14.1/x64/bin/node --show-toplevel git 1/x64/bin/node ache/node/24.14.1/x64/bin/node (http block)
https://api.github.com/repos/actions/checkout/git/ref/tags/v3
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq .object.sha /tmp/TestGuardPolicyMinIntegrityOnlymin-integrit-errorsas (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq .object.sha --show-toplevel git /usr/bin/git --show-toplevel test /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel 64/pkg/tool/linurev-parse /usr/bin/git git (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq .object.sha /tmp/TestHashConsistency_GoAndJavaScript2132338269/001/test-frontmatter-with-arrays.md git /usr/bin/git --show-toplevel git e git conf�� --get remote.origin.url ache/node/24.14.1/x64/bin/node /repos/actions/ggit --jq /usr/bin/git ache/node/24.14.1/x64/bin/node (http block)
https://api.github.com/repos/actions/checkout/git/ref/tags/v5
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha k/gh-aw/gh-aw rev-parse (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha --show-toplevel git /usr/bin/git l.go l_test.go 64/pkg/tool/linu--show-toplevel git rev-�� --show-toplevel 64/pkg/tool/linux_amd64/compile /usr/bin/git _.a config er: String!, $na--show-toplevel git (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha --show-toplevel git /usr/bin/git licyMinIntegritygit s /opt/hostedtoolc--show-toplevel git rev-�� --show-toplevel 383068/b425/importcfg /usr/bin/git k/gh-aw/gh-aw/pkgit k/gh-aw/gh-aw/pkrev-parse ache/node/24.14.--show-toplevel git (http block)
https://api.github.com/repos/actions/github-script/git/ref/tags/v8
- Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha --show-toplevel git /usr/bin/git k/gh-aw/gh-aw show kflows/smoke-age/tmp/gh-aw/aw-master.patch git rev-�� --show-toplevel git /usr/bin/git 2949-16486/test-git rev-parse x_amd64/vet git (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha --show-toplevel git /usr/bin/git --show-toplevel git /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel git /usr/bin/git git (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha --show-toplevel git /usr/bin/git --show-toplevel git ache/node/24.14./tmp/gh-aw/aw-master.patch git rev-�� pload-artifact/git/ref/tags/v7 git /usr/bin/gh --show-toplevel git ache/node/24.14.--show-toplevel gh (http block)
https://api.github.com/repos/actions/github-script/git/ref/tags/v9
- Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq .object.sha se 8205312/b232/vet.cfg repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } son (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq .object.sha te '**/*.cjs' '**/*.ts' '**/*.json' --ignore-patremote.origin.url /tmp/go-build4198205312/b004/vet.cfg ache/node/24.14.1/x64/lib/node_modules/npm/node_modules/@npmcli/run-script/lib/node-gyp-bin/sh (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq .object.sha te '**/*.cjs' '**/*.ts' '**/*.json' --ignore-pat-f /tmp/go-build4198205312/b117/vet.cfg tnet/tools/sh (http block)
https://api.github.com/repos/actions/setup-go/git/ref/tags/v4
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq .object.sha it/copilot-hooks-lang=go1.25 node /usr/bin/git 179329/001 **/*.cjs x_amd64/vet git conf�� user.email test@example.com /opt/hostedtoolcache/node/24.14.1/x64/bin/node ithub/workflows (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq .object.sha --show-toplevel git /usr/bin/git --show-toplevel e/git /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel 383068/b385/imporev-parse /usr/bin/git git (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq .object.sha --show-toplevel (http block)
https://api.github.com/repos/actions/setup-node/git/ref/tags/v4
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq .object.sha t0 upstream (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq .object.sha --show-toplevel git /usr/bin/git --show-toplevel 64/pkg/tool/linurev-parse /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel git /usr/bin/git git (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq .object.sha --show-toplevel git om/testorg/testrepo.git repo3930846173/0git Branch commit /usr/bin/git git remo�� remove origin /usr/bin/git --show-toplevel git 1/x64/bin/node git (http block)
https://api.github.com/repos/actions/upload-artifact/git/ref/tags/-
- Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/- --jq .object.sha w/js/**/*.json' --ignore-path pull.rebase x_amd64/vet (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/- --jq .object.sha --noprofile (http block)
https://api.github.com/repos/actions/upload-artifact/git/ref/tags/v4
- Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq .object.sha sistency_GoAndJavaScript777821860/001/test-empty-frontmatter.md -test.v=true /usr/bin/gh -test.timeout=10git -test.run=^Test -test.short=true--show-toplevel gh api ons-test2291041202 --jq /usr/bin/git --tags --always tor.lock.yml git (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq .object.sha ^From [0-9a-f]\{40\} /tmp/gh-aw/aw-master.patch /usr/bin/git --get-regexp ^remote\..*\.gh-rev-parse /usr/bin/git git rev-�� --show-toplevel git /usr/bin/gh --show-toplevel git /usr/bin/git gh (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq .object.sha /usr/bin/git git ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet --show-toplevel nly /usr/bin/git ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet -tes�� -test.paniconexit0 -test.timeout=10m0s /usr/bin/git --show-toplevel git /usr/bin/git git (http block)
https://api.github.com/repos/actions/upload-artifact/git/ref/tags/v7
- Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v7 --jq .object.sha --local --get x_amd64/vet (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v7 --jq .object.sha get --local x_amd64/vet credential.helpesh (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v7 --jq .object.sha get --local /sh credential.usernsh (http block)
https://api.github.com/repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b
- Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq .object.sha h ../../../.prettierignore --local x_amd64/vet core.hooksPath (http block)
- Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq .object.sha h ../../../.prettierignore --local x_amd64/vet copilot.originalbash (http block)
https://api.github.com/repos/docker/build-push-action/git/ref/tags/v7
- Triggering command: /usr/bin/gh gh api /repos/docker/build-push-action/git/ref/tags/v7 --jq .object.sha ion_sha_validati-f .cfg 64/pkg/tool/linu-f (http block)
- Triggering command: /usr/bin/gh gh api /repos/docker/build-push-action/git/ref/tags/v7 --jq .object.sha HEAD .cfg $name) { hasDiscussionsEnabled } } (http block)
https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v0.1.2
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0.1.2 --jq .object.sha add remote2 /usr/bin/git ay_c403978305/00git om/owner/repo.girev-parse lone-11515414 git conf�� user.name Test User /usr/bin/git k/gh-aw/gh-aw (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0.1.2 --jq .object.sha --show-toplevel git /usr/bin/git --show-toplevel infocmp /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel git /usr/bin/git git (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0.1.2 --jq .object.sha user.email test@example.com /usr/bin/git ub/workflows bash /usr/bin/git git remo�� /usr/bin/git git /usr/bin/git ub/workflows git 1/x64/bin/node git (http block)
https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.0.0
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq .object.sha sistency_GoAndJavaScript777821860/001/test-simple-frontmatter.md -buildtags 1/x64/bin/node -errorsas -ifaceassert -nilfunc git t-ha�� ithub/workflows/agent-persona-explorer.md -tests /usr/bin/git (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq .object.sha HEAD gh /usr/bin/git view 12345 /usr/bin/git git rev-�� --show-toplevel git (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq .object.sha /tmp/gh-aw-add-gitattributes-test421074309 show /usr/bin/git --show-toplevel git /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel git /usr/bin/git git (http block)
https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.2.3
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq .object.sha /tmp/go-build564383068/b415/gitutil.test -importcfg /usr/bin/git -s -w -buildmode=exe git rev-�� ons-test2291041202 -extld=gcc 1/x64/bin/node se 8205312/b360/vetrev-parse k/_temp/ghcca-no--show-toplevel 1/x64/bin/node (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq .object.sha run --auto /usr/bin/git --detach infocmp /usr/bin/git git rev-�� --show-toplevel git 86_64/bash --show-toplevel infocmp /usr/bin/git git (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq .object.sha /tmp/go-build4276574426/b408/logger.test -importcfg /opt/hostedtoolcache/node/24.14.1/x64/bin/node -s -w -buildmode=exe node /tmp�� /tmp/TestHashConsistency_GoAndJavaScript2132338269/001/test-complex-frontmatter-with-tools.md -extld=gcc /usr/bin/git --show-toplevel git /usr/bin/git git (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/1/artifacts
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/1/artifacts --jq .artifacts[].name rev-parse /usr/bin/git l --local ed } } git -C 3719643269 k.yml 64/pkg/tool/linux_amd64/compile explorer.lock.ymgit ability-kit.lockrev-parse ock.yml 64/pkg/tool/linux_amd64/compile (http block)
- Triggering command: /usr/bin/gh gh run download 1 --dir test-logs/run-1 -f ter.lock.yml -f owner=github -f git -C 302012426 show k --local credential.usernrev-parse /sh infocmp (http block)
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/1/artifacts --jq .artifacts[].name stmain.go ache/go/1.25.8/x64/pkg/tool/linux_amd64/link --show-toplevel git 1/x64/bin/npm ache/go/1.25.8/x64/pkg/tool/linux_amd64/link rev-�� 6574426/b405/gitutil.test 1/x64/bin/npm 1/x64/bin/node --show-toplevel git /usr/bin/git ache/go/1.25.8/x--json (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/12345/artifacts
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12345/artifacts --jq .artifacts[].name git me: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } l --local x_amd64/vet infocmp -1 xterm-color x_amd64/vet test h ../../../.pretgit --local ed } } test (http block)
- Triggering command: /usr/bin/gh gh run download 12345 --dir test-logs/run-12345 :latest er: String!, $na-nolocalimports get --local modules/@npmcli/--show-toplevel gh api /repos/actions/upload-artifact/git/ref/tags/v7 erena-mcp-server:latest /usr/bin/git h ../../../.pretgit --local ed } } git (http block)
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12345/artifacts --jq .artifacts[].name git sh --show-toplevel git /usr/bin/git git rev-�� 3339-27472/test-1679961355/.github/workflows git e/git --show-toplevel git /usr/bin/git e/git (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/12346/artifacts
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12346/artifacts --jq .artifacts[].name git kflows/dev-hawk.lock.yml get --local modules/@npmcli/--show-toplevel sp/45mdmEzBnpu2SUpQRbjo/-LfbKy3Tlp9CVGJ11VEe -C k/gh-aw/gh-aw/.github/workflows rev-parse x_amd64/compile h ../../../.pretgit --local x_amd64/vet x_amd64/compile (http block)
- Triggering command: /usr/bin/gh gh run download 12346 --dir test-logs/run-12346 erena-mcp-server:latest actor.lock.yml get c x_amd64/vet infocmp -1 xterm-color rver (http block)
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12346/artifacts --jq .artifacts[].name git rgo/bin/bash --show-toplevel git /usr/bin/git git rev-�� 3339-27472/test-1679961355 git res.lock.yml s-in-body.md git /usr/bin/git node (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/2/artifacts
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/2/artifacts --jq .artifacts[].name x_amd64/link me: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } get --local x_amd64/vet infocmp -1 3719643269 x_amd64/vet 64/pkg/tool/linux_amd64/vet h ../../../.pretgit --local DiscussionsEnabl--show-toplevel 64/pkg/tool/linux_amd64/vet (http block)
- Triggering command: /usr/bin/gh gh run download 2 --dir test-logs/run-2 rev-parse 86_64/bash l --local ed } } git -C k/gh-aw/gh-aw/.github/workflows config /usr/bin/git remote.origin.urgit credential.usernrev-parse x_amd64/vet git (http block)
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/2/artifacts --jq .artifacts[].name git g_.a --show-toplevel git 64/bin/node ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet rev-�� --show-toplevel git ache/node/24.14.1/x64/bin/node --show-toplevel git /usr/bin/git node (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/3/artifacts
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/3/artifacts --jq .artifacts[].name show er: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabl--show-toplevel get --local x_amd64/vet infocmp -1 xterm-color x_amd64/vet 64/pkg/tool/linux_amd64/vet h ../../../.pretnode --local $name) { has/home/REDACTED/work/gh-aw/gh-aw/.github/workflows/ace-editor.md 64/pkg/tool/linux_amd64/vet (http block)
- Triggering command: /usr/bin/gh gh run download 3 --dir test-logs/run-3 config x_amd64/compile remote.origin.urgit --local x_amd64/vet x_amd64/compile -C k/gh-aw/gh-aw/.github/workflows show /usr/bin/git l credential.usernrev-parse DiscussionsEnabl--show-toplevel git (http block)
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/3/artifacts --jq .artifacts[].name git /usr/bin/git --show-toplevel git /usr/bin/git git rev-�� --show-toplevel git ache/node/24.14.1/x64/bin/node --show-toplevel tr /usr/bin/git node (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/4/artifacts
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/4/artifacts --jq .artifacts[].name -f o-identifier.lock.yml -f owner=github -f gh api 3719643269 --jq 64/pkg/tool/linux_amd64/link h ../../../.pretgit --local x_amd64/vet 64/pkg/tool/linux_amd64/link (http block)
- Triggering command: /usr/bin/gh gh run download 4 --dir test-logs/run-4 show er: String!, $name: String!) { repository(owne-f get --local DiscussionsEnabl--show-toplevel git -C 302012426/.github/workflows config /usr/bin/gh remote.origin.urnode credential.usern/tmp/js-hash-test-1226791680/test-hash.js modules/@npmcli//home/REDACTED/work/gh-aw/gh-aw/.github/workflows/agent-performance-analyzer.md gh (http block)
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/4/artifacts --jq .artifacts[].name git ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile --show-toplevel git n-dir/node ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile rev-�� 2732512449 git 6574426/b408=> --show-toplevel git /usr/bin/git node (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/5/artifacts
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/5/artifacts --jq .artifacts[].name config n-dir/bash remote.origin.urgit --local x_amd64/vet git -C k/gh-aw/gh-aw go (http block)
- Triggering command: /usr/bin/gh gh run download 5 --dir test-logs/run-5 x_amd64/asm n-dir/bash get --local de git -C /home/REDACTED/work/gh-aw/gh-aw/.github/workflows rev-parse /usr/bin/git --local credential.usernrev-parse (http block)
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/5/artifacts --jq .artifacts[].name stmain.go /usr/bin/git --show-toplevel git 86_64/node git rev-�� 2732512449 git ache/node/24.14.1/x64/bin/node --show-toplevel git /usr/bin/git node (http block)
https://api.github.com/repos/github/gh-aw/actions/workflows
- Triggering command: /usr/bin/gh gh workflow list --json name,state,path -c=4 -nolocalimports -importcfg /tmp/go-build564383068/b414/importcfg -pack /home/REDACTED/work/gh-aw/gh-aw/pkg/gitutil/gitutil.go /home/REDACTED/work/gh-aw/gh-aw/pkg/gitutil/gitutil_test.go -uns�� ithub/workflows /tmp/go-build4198205312/b106/vet.cfg rgo/bin/sh (http block)
- Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 100 (http block)
- Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 6 owner=github -f infocmp -1 erate-action-metadata/main.go x_amd64/vet 64/pkg/tool/linux_amd64/compile ath ../../../.prgit --local ed } } 64/pkg/tool/linutest@example.com (http block)
https://api.github.com/repos/github/gh-aw/git/ref/tags/v0.47.4
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v0.47.4 --jq .object.sha --show-toplevel 64/pkg/tool/linux_amd64/vet /usr/bin/git 1149570411/001 -f /usr/bin/infocmp--show-toplevel git rev-�� --show-toplevel infocmp /usr/bin/git sRemoteWithRealG/bin/sh sRemoteWithRealG-c cfg git (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v0.47.4 --jq .object.sha --show-toplevel -tests /usr/bin/git --show-toplevel git /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel git /usr/bin/git git (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v0.47.4 --jq .object.sha --show-toplevel git /usr/bin/git --show-toplevel git ache/node/24.14.--show-toplevel git rev-�� --show-toplevel git /opt/hostedtoolcache/node/24.14.1/x64/bin/node --show-toplevel om/owner/repo.gi-c lone-2043661200 /opt/hostedtoolcgit-upload-pack 'origin' (http block)
https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.0.0
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq .object.sha rity2466489948/001 x_amd64/vet 64/pkg/tool/linux_amd64/vet get --local x_amd64/vet 64/pkg/tool/linux_amd64/vet -C /home/REDACTED/work/gh-aw/gh-aw/.github/workflows rev-parse x_amd64/compile --local user.name x_amd64/vet x_amd64/compile (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq .object.sha --show-toplevel /usr/lib/git-core/git /usr/bin/git r-test2166363359git r-test2166363359rev-parse /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git /tmp/compile-insgit s/test.md /tmp/go-build564--show-toplevel git (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq .object.sha --show-toplevel git /usr/bin/git --show-toplevel git /usr/bin/ls git form�� ub/workflows --stdout /usr/bin/git _.a git /usr/bin/git git (http block)
https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.2.3
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq .object.sha -unreachable=fal-errorsas /tmp/go-build419-ifaceassert l (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq .object.sha install --package-lock-omain /usr/bin/git --show-toplevel infocmp /usr/bin/git git s --show-toplevel git /usr/bin/du --show-toplevel git /usr/bin/sort du (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq .object.sha (http block)
https://api.github.com/repos/github/gh-aw/git/ref/tags/v2.0.0
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq .object.sha ithub/workflows /tmp/go-build419github.com/github/gh-aw/pkg/constants .yml (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq .object.sha ithub/workflows /tmp/go-build419main l (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq .object.sha rite '../../../*-errorsas /tmp/go-build419-ifaceassert repository(owne-nilfunc (http block)
https://api.github.com/repos/github/gh-aw/git/ref/tags/v3.0.0
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq .object.sha rite '../../../*-errorsas /tmp/go-build419-ifaceassert k.yml (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq .object.sha --show-toplevel git (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq .object.sha xterm-color git /usr/bin/git test.txt git /opt/hostedtoolc/tmp/TestParseDefaultBranchFromLsRemoteWithRealGitbranch_with_hyphen3783270175/001 git rev-�� --show-toplevel /opt/hostedtoolcache/node/24.14.1/x64/bin/node /usr/bin/git REDACTED.os git /usr/bin/infocmp 2-LpR0S/OGbnfhqdytx9NgENMDEW (http block)
https://api.github.com/repos/github/stale-repos/git/ref/tags/
- Triggering command: /usr/bin/gh gh api /repos/github/stale-repos/git/ref/tags/# --jq .object.sha --noprofile (http block)
https://api.github.com/repos/githubnext/agentics/git/ref/tags/-
- Triggering command: /usr/bin/gh gh api /repos/githubnext/agentics/git/ref/tags/- --jq .object.sha ify@v1.11.1/require/doc.go ify@v1.11.1/require/forward_requirements.go 64/pkg/tool/linux_amd64/vet (http block)
https://api.github.com/repos/nonexistent/action/git/ref/tags/v999.999.999
- Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq .object.sha ithub/workflows config tdrain.test remote.origin.urgit --local x_amd64/vet tdrain.test 6438�� verutil.go verutil_test.go /usr/bin/git --local pull.rebase x_amd64/vet git (http block)
- Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq .object.sha --show-toplevel /usr/lib/git-core/git /usr/bin/git run --auto /usr/bin/gh git rev-�� --show-toplevel 6f3bfcfd /usr/bin/git s/test.md --jq /tmp/go-build564--show-toplevel git (http block)
- Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq .object.sha Gitmaster_branch2636336507/001' Gitmaster_branch2636336507/001' /usr/bin/cut --show-toplevel git /usr/bin/tail cut -f1 /usr/bin/git tail /usr/bin/git 1 git /usr/bin/git git (http block)
https://api.github.com/repos/nonexistent/repo/actions/runs/12345
- Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion remote.origin.urgit -j DROP 64/pkg/tool/linux_amd64/compile -C _.a config kflows/pr-triage-agent.lock.yml remote.origin.urgit setup/js/node_morev-parse /prettier git (http block)
- Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion /repos/actions/ugit --jq /usr/bin/git ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet js/f�� /usr/bin/git git ache/node/24.14.1/x64/bin/node --show-toplevel git /usr/bin/git node (http block)
- Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion --show-toplevel git /usr/bin/git git rev-�� y_with_repos=public_2846901703/001 git 1/x64/bin/node --show-toplevel git /usr/bin/infocmp git (http block)
https://api.github.com/repos/owner/repo/actions/workflows
- Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo in/sh nore (http block)
- Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } nore (http block)
- Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo /usr/bin/git --show-toplevel git /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel git /usr/bin/git git (http block)
https://api.github.com/repos/owner/repo/contents/file.md
- Triggering command: /tmp/go-build564383068/b397/cli.test /tmp/go-build564383068/b397/cli.test -test.testlogfile=/tmp/go-build564383068/b397/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true (http block)
- Triggering command: /tmp/go-build4276574426/b224/cli.test /tmp/go-build4276574426/b224/cli.test -test.testlogfile=/tmp/go-build4276574426/b224/testlog.txt -test.paniconexit0 -test.timeout=10m0s rev-�� --show-toplevel git /usr/bin/git --show-toplevel git /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel git /usr/bin/git git (http block)
- Triggering command: /tmp/go-build3272366080/b370/cli.test /tmp/go-build3272366080/b370/cli.test -test.testlogfile=/tmp/go-build3272366080/b370/testlog.txt -test.paniconexit0 -test.timeout=10m0s rev-�� --show-toplevel ache/node/24.14.1/x64/bin/node /usr/bin/git /repos/actions/gnode --jq /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git user.email test@example.comjs/fuzz_sanitize_label_harness.cjs /usr/bin/git git (http block)
https://api.github.com/repos/test-owner/test-repo/actions/secrets
- Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name 32616630/001' 32616630/001' es/.bin/sh nore (http block)
- Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name tmp/TestGetNpmBinPathSetup_GorootOrdering8577423/001/go/1.25.0/x64"; export PATH="$(find "/tmp/Tnode git /usr/bin/git --show-toplevel git /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel git /usr/bin/git git (http block)
- Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name --show-toplevel git /usr/bin/git --show-toplevel bash /usr/bin/git git rev-�� --show-toplevel rop.prop.prop.prop.prop.prop.prop.prop.prop.pro /usr/bin/git --show-toplevel git /opt/hostedtoolc--noprofile git (http block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

- Remove GH_HOST, GITHUB_API_URL, GITHUB_GRAPHQL_URL, NODE_EXTRA_CA_CERTS, GH_AW_ORIGINAL_* writes from start_difc_proxy.sh - Remove all GITHUB_ENV restore/clear logic from stop_difc_proxy.sh - Add injectProxyEnvIntoCustomSteps() in compiler_difc_proxy.go that uses YAML parse+reserialize to add proxy env vars as step-level env on each custom step (preserving existing env vars like GH_TOKEN) - Remove generateSetGHRepoAfterDIFCProxyStep() standalone step; GH_REPO is now included in the per-step env block - Inject proxy env into custom steps in compiler_yaml_main_job.go when hasDIFCProxyNeeded returns true - Update tests: replace TestBuildSetGHRepoStepYAML/TestGenerateSetGHRepo with TestProxyEnvVars/TestInjectProxyEnvIntoCustomSteps; update TestDIFCProxyStepOrderInCompiledWorkflow for new behavior - Recompile 4 affected workflow lock files Agent-Logs-Url: https://github.com/github/gh-aw/sessions/c3114091-8d7b-4283-8647-91185fd5eb60 Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

github-actions · 2026-04-15T01:25:30Z

🧪 Test Quality Sentinel Report

Test Quality Score: 100/100

✅ Excellent test quality

Metric	Value
New/modified tests analyzed	2 new functions (+ 1 modified integration test)
✅ Design tests (behavioral contracts)	2 (100%)
⚠️ Implementation tests (low value)	0 (0%)
Tests with error/edge cases	2 (100%)
Duplicate test clusters	0
Test inflation detected	No (test:prod ratio = 1.83:1, threshold 2:1)
🚨 Coding-guideline violations	None

Test Classification Details

Test	File	Classification	Issues Detected
`TestProxyEnvVars`	`pkg/workflow/compiler_difc_proxy_test.go`	✅ Design	None — verifies all 5 proxy routing env vars by key and value; `assert.Len` guards against accidental additions
`TestInjectProxyEnvIntoCustomSteps`	`pkg/workflow/compiler_difc_proxy_test.go`	✅ Design	None — table-driven with 5 scenarios covering empty input, env-less step, env-merging, multiple steps, `uses:` steps, and multiline `run` blocks

Modified Existing Tests

The existing integration test (DIFC proxy injected by default with min-integrity) was updated correctly:

Old assertions checking for the now-removed Set GH_REPO for proxied steps step were replaced with assert.NotContains (confirming the step is gone) and assert.Contains for each step-level env var (GH_HOST, GH_REPO, GITHUB_API_URL, GITHUB_GRAPHQL_URL, NODE_EXTRA_CA_CERTS).
Step-ordering assertion updated: setRepoIdx ordering checks removed; replaced with customStepIdx < stopIdx — correctly reflecting the new contract.

Language Support

Tests analyzed:

🐹 Go (*_test.go): 2 new tests — unit (//go:build !integration)
🟨 JavaScript (*.test.cjs, *.test.js): 0 tests changed

Verdict

✅ Check passed. 0% of new tests are implementation tests (threshold: 30%). Both new tests verify observable, user-facing behavioral contracts: the correct set of proxy routing env vars and the correct YAML output after env injection into custom steps. No guideline violations detected.

📖 Understanding Test Classifications

Design Tests (High Value) verify what the system does:

Assert on observable outputs, return values, or state changes
Cover error paths and boundary conditions
Would catch a behavioral regression if deleted
Remain valid even after internal refactoring

Implementation Tests (Low Value) verify how the system does it:

Assert on internal function calls (mocking internals)
Only test the happy path with typical inputs
Break during legitimate refactoring even when behavior is correct
Give false assurance: they pass even when the system is wrong

Goal: Shift toward tests that describe the system's behavioral contract — the promises it makes to its users and collaborators.

🧪 Test quality analysis by Test Quality Sentinel · ● 465.1K · ◷

github-actions

✅ Test Quality Sentinel: 100/100. Test quality is excellent — 0% of new tests are implementation tests (threshold: 30%). Both new tests (TestProxyEnvVars, TestInjectProxyEnvIntoCustomSteps) verify behavioral contracts with good edge case coverage, descriptive assertion messages, and no guideline violations.

Copilot

Pull request overview

Updates DIFC proxy integration so proxy routing variables are applied via step-level env: on custom steps rather than mutating $GITHUB_ENV, preventing permanent overrides of GitHub Enterprise host configuration.

Changes:

Removed $GITHUB_ENV mutation/restore behavior from start_difc_proxy.sh and stop_difc_proxy.sh.
Added compiler logic to inject DIFC proxy routing vars into each custom step’s env: block and removed the standalone “Set GH_REPO” step.
Updated DIFC proxy tests and recompiled affected workflow lock files.

Show a summary per file

File	Description
pkg/workflow/compiler_yaml_main_job.go	Injects proxy env into emitted custom steps when DIFC proxy is needed; removes standalone GH_REPO step emission.
pkg/workflow/compiler_difc_proxy.go	Implements `proxyEnvVars()` + `injectProxyEnvIntoCustomSteps()` using YAML parse/merge/reserialize.
pkg/workflow/compiler_difc_proxy_test.go	Replaces GH_REPO-step tests with injection-focused tests and updates workflow compilation expectations.
actions/setup/sh/start_difc_proxy.sh	Stops writing GH_* and GitHub API routing vars to `$GITHUB_ENV`; keeps container lifecycle + CA install.
actions/setup/sh/stop_difc_proxy.sh	Removes `$GITHUB_ENV` restore/clear logic; keeps container stop + CA cleanup.
.github/workflows/contribution-check.lock.yml	Recompiled lock file reflecting step-level proxy env injection.
.github/workflows/daily-issues-report.lock.yml	Recompiled lock file reflecting step-level proxy env injection.
.github/workflows/issue-arborist.lock.yml	Recompiled lock file reflecting step-level proxy env injection.
.github/workflows/stale-repo-identifier.lock.yml	Recompiled lock file reflecting step-level proxy env injection.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 9/9 changed files
Comments generated: 3

Copilot · 2026-04-15T01:26:22Z

pkg/workflow/compiler_difc_proxy.go

+	resultBytes, err := yaml.MarshalWithOptions(
+		map[string]any{"steps": parsed.Steps},
+		yaml.Indent(2),
+		yaml.UseLiteralStyleIfMultiline(true),
+	)


injectProxyEnvIntoCustomSteps re-marshals custom steps via yaml.MarshalWithOptions(map{"steps": ...}). This drops inline YAML comments (e.g. uses: actions/foo@<sha> # vX) and forces alphabetical key ordering, which in turn causes compiled lock files to lose # vX annotations and makes gh-aw-manifest actions[].version fall back to the SHA (see parseActionRefs in pkg/workflow/safe_update_manifest.go:122-140). Consider preserving and re-applying uses version comments the same way DeduplicateRuntimeSetupStepsFromCustomSteps does (pkg/workflow/runtime_deduplication.go:24-233), and order step fields with OrderMapFields(constants.PriorityStepFields) so name/uses stay ahead of env for stable diffs.

Copilot · 2026-04-15T01:26:22Z

.github/workflows/stale-repo-identifier.lock.yml

@@ -1,5 +1,5 @@
 # gh-aw-metadata: {"schema_version":"v3","frontmatter_hash":"5e48f7d5dba2241f2c017d613dda4c6455a91439c75a526d4350c90d299f6b54","strict":true,"agent_id":"copilot"}
-# gh-aw-manifest: {"version":1,"secrets":["COPILOT_GITHUB_TOKEN","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/cache/restore","sha":"27d5ce7f107fe9357f9df03efb73ab90386fccae","version":"v5.0.5"},{"repo":"actions/cache/save","sha":"27d5ce7f107fe9357f9df03efb73ab90386fccae","version":"v5.0.5"},{"repo":"actions/checkout","sha":"de0fac2e4500dabe0009e67214ff5f5447ce83dd","version":"v6.0.2"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"373c709c69115d41ff229c7e5df9f8788daa9553","version":"v9"},{"repo":"actions/setup-python","sha":"a309ff8b426b58ec0e2a45f0f869d46889d02405","version":"v6.2.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7"},{"repo":"github/stale-repos","sha":"5f2e18fc5432823f96c1feb69327f665c2acab59","version":"v9.0.8"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.25.20","digest":"sha256:9161f2415a3306a344aca34dd671ee69f122317e0a512e66dc64c94b9c508682","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.25.20@sha256:9161f2415a3306a344aca34dd671ee69f122317e0a512e66dc64c94b9c508682"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.25.20","digest":"sha256:6971639e381e82e45134bcd333181f456df3a52cd6f818a3e3d6de068ff91519","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.25.20@sha256:6971639e381e82e45134bcd333181f456df3a52cd6f818a3e3d6de068ff91519"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.25.20","digest":"sha256:5411d903f73ee597e6a084971c2adef3eb0bd405910df3ed7bf5e3d6bd58a236","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.25.20@sha256:5411d903f73ee597e6a084971c2adef3eb0bd405910df3ed7bf5e3d6bd58a236"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.2.19","digest":"sha256:44d4d8de7e6c37aaea484eba489940c52df6a0b54078ddcbc9327592d5b3c3dd","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.2.19@sha256:44d4d8de7e6c37aaea484eba489940c52df6a0b54078ddcbc9327592d5b3c3dd"},{"image":"ghcr.io/github/github-mcp-server:v0.32.0","digest":"sha256:2763823c63bcca718ce53850a1d7fcf2f501ec84028394f1b63ce7e9f4f9be28","pinned_image":"ghcr.io/github/github-mcp-server:v0.32.0@sha256:2763823c63bcca718ce53850a1d7fcf2f501ec84028394f1b63ce7e9f4f9be28"},{"image":"node:lts-alpine","digest":"sha256:01743339035a5c3c11a373cd7c83aeab6ed1457b55da6a69e014a95ac4e4700b","pinned_image":"node:lts-alpine@sha256:01743339035a5c3c11a373cd7c83aeab6ed1457b55da6a69e014a95ac4e4700b"}]}
+# gh-aw-manifest: {"version":1,"secrets":["COPILOT_GITHUB_TOKEN","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/cache/restore","sha":"27d5ce7f107fe9357f9df03efb73ab90386fccae","version":"v5.0.5"},{"repo":"actions/cache/save","sha":"27d5ce7f107fe9357f9df03efb73ab90386fccae","version":"v5.0.5"},{"repo":"actions/checkout","sha":"de0fac2e4500dabe0009e67214ff5f5447ce83dd","version":"v6.0.2"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"373c709c69115d41ff229c7e5df9f8788daa9553","version":"v9"},{"repo":"actions/setup-python","sha":"a309ff8b426b58ec0e2a45f0f869d46889d02405","version":"v6.2.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a"},{"repo":"github/stale-repos","sha":"5f2e18fc5432823f96c1feb69327f665c2acab59","version":"5f2e18fc5432823f96c1feb69327f665c2acab59"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.25.20","digest":"sha256:9161f2415a3306a344aca34dd671ee69f122317e0a512e66dc64c94b9c508682","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.25.20@sha256:9161f2415a3306a344aca34dd671ee69f122317e0a512e66dc64c94b9c508682"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.25.20","digest":"sha256:6971639e381e82e45134bcd333181f456df3a52cd6f818a3e3d6de068ff91519","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.25.20@sha256:6971639e381e82e45134bcd333181f456df3a52cd6f818a3e3d6de068ff91519"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.25.20","digest":"sha256:5411d903f73ee597e6a084971c2adef3eb0bd405910df3ed7bf5e3d6bd58a236","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.25.20@sha256:5411d903f73ee597e6a084971c2adef3eb0bd405910df3ed7bf5e3d6bd58a236"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.2.19","digest":"sha256:44d4d8de7e6c37aaea484eba489940c52df6a0b54078ddcbc9327592d5b3c3dd","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.2.19@sha256:44d4d8de7e6c37aaea484eba489940c52df6a0b54078ddcbc9327592d5b3c3dd"},{"image":"ghcr.io/github/github-mcp-server:v0.32.0","digest":"sha256:2763823c63bcca718ce53850a1d7fcf2f501ec84028394f1b63ce7e9f4f9be28","pinned_image":"ghcr.io/github/github-mcp-server:v0.32.0@sha256:2763823c63bcca718ce53850a1d7fcf2f501ec84028394f1b63ce7e9f4f9be28"},{"image":"node:lts-alpine","digest":"sha256:01743339035a5c3c11a373cd7c83aeab6ed1457b55da6a69e014a95ac4e4700b","pinned_image":"node:lts-alpine@sha256:01743339035a5c3c11a373cd7c83aeab6ed1457b55da6a69e014a95ac4e4700b"}]}


The gh-aw-manifest header now records action version as the pinned SHA for actions/upload-artifact and github/stale-repos, which indicates the corresponding uses: ... # vX version comments were lost during compilation. This reduces auditability and makes manifests noisier; after fixing the compiler to preserve inline version comments, please recompile this lock file so actions[].version reflects the human-readable tag (e.g. v7 / v9.0.8) again.

Suggested change

# gh-aw-manifest: {"version":1,"secrets":["COPILOT_GITHUB_TOKEN","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/cache/restore","sha":"27d5ce7f107fe9357f9df03efb73ab90386fccae","version":"v5.0.5"},{"repo":"actions/cache/save","sha":"27d5ce7f107fe9357f9df03efb73ab90386fccae","version":"v5.0.5"},{"repo":"actions/checkout","sha":"de0fac2e4500dabe0009e67214ff5f5447ce83dd","version":"v6.0.2"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"373c709c69115d41ff229c7e5df9f8788daa9553","version":"v9"},{"repo":"actions/setup-python","sha":"a309ff8b426b58ec0e2a45f0f869d46889d02405","version":"v6.2.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a"},{"repo":"github/stale-repos","sha":"5f2e18fc5432823f96c1feb69327f665c2acab59","version":"5f2e18fc5432823f96c1feb69327f665c2acab59"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.25.20","digest":"sha256:9161f2415a3306a344aca34dd671ee69f122317e0a512e66dc64c94b9c508682","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.25.20@sha256:9161f2415a3306a344aca34dd671ee69f122317e0a512e66dc64c94b9c508682"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.25.20","digest":"sha256:6971639e381e82e45134bcd333181f456df3a52cd6f818a3e3d6de068ff91519","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.25.20@sha256:6971639e381e82e45134bcd333181f456df3a52cd6f818a3e3d6de068ff91519"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.25.20","digest":"sha256:5411d903f73ee597e6a084971c2adef3eb0bd405910df3ed7bf5e3d6bd58a236","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.25.20@sha256:5411d903f73ee597e6a084971c2adef3eb0bd405910df3ed7bf5e3d6bd58a236"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.2.19","digest":"sha256:44d4d8de7e6c37aaea484eba489940c52df6a0b54078ddcbc9327592d5b3c3dd","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.2.19@sha256:44d4d8de7e6c37aaea484eba489940c52df6a0b54078ddcbc9327592d5b3c3dd"},{"image":"ghcr.io/github/github-mcp-server:v0.32.0","digest":"sha256:2763823c63bcca718ce53850a1d7fcf2f501ec84028394f1b63ce7e9f4f9be28","pinned_image":"ghcr.io/github/github-mcp-server:v0.32.0@sha256:2763823c63bcca718ce53850a1d7fcf2f501ec84028394f1b63ce7e9f4f9be28"},{"image":"node:lts-alpine","digest":"sha256:01743339035a5c3c11a373cd7c83aeab6ed1457b55da6a69e014a95ac4e4700b","pinned_image":"node:lts-alpine@sha256:01743339035a5c3c11a373cd7c83aeab6ed1457b55da6a69e014a95ac4e4700b"}]}

# gh-aw-manifest: {"version":1,"secrets":["COPILOT_GITHUB_TOKEN","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/cache/restore","sha":"27d5ce7f107fe9357f9df03efb73ab90386fccae","version":"v5.0.5"},{"repo":"actions/cache/save","sha":"27d5ce7f107fe9357f9df03efb73ab90386fccae","version":"v5.0.5"},{"repo":"actions/checkout","sha":"de0fac2e4500dabe0009e67214ff5f5447ce83dd","version":"v6.0.2"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"373c709c69115d41ff229c7e5df9f8788daa9553","version":"v9"},{"repo":"actions/setup-python","sha":"a309ff8b426b58ec0e2a45f0f869d46889d02405","version":"v6.2.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7"},{"repo":"github/stale-repos","sha":"5f2e18fc5432823f96c1feb69327f665c2acab59","version":"v9.0.8"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.25.20","digest":"sha256:9161f2415a3306a344aca34dd671ee69f122317e0a512e66dc64c94b9c508682","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.25.20@sha256:9161f2415a3306a344aca34dd671ee69f122317e0a512e66dc64c94b9c508682"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.25.20","digest":"sha256:6971639e381e82e45134bcd333181f456df3a52cd6f818a3e3d6de068ff91519","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.25.20@sha256:6971639e381e82e45134bcd333181f456df3a52cd6f818a3e3d6de068ff91519"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.25.20","digest":"sha256:5411d903f73ee597e6a084971c2adef3eb0bd405910df3ed7bf5e3d6bd58a236","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.25.20@sha256:5411d903f73ee597e6a084971c2adef3eb0bd405910df3ed7bf5e3d6bd58a236"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.2.19","digest":"sha256:44d4d8de7e6c37aaea484eba489940c52df6a0b54078ddcbc9327592d5b3c3dd","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.2.19@sha256:44d4d8de7e6c37aaea484eba489940c52df6a0b54078ddcbc9327592d5b3c3dd"},{"image":"ghcr.io/github/github-mcp-server:v0.32.0","digest":"sha256:2763823c63bcca718ce53850a1d7fcf2f501ec84028394f1b63ce7e9f4f9be28","pinned_image":"ghcr.io/github/github-mcp-server:v0.32.0@sha256:2763823c63bcca718ce53850a1d7fcf2f501ec84028394f1b63ce7e9f4f9be28"},{"image":"node:lts-alpine","digest":"sha256:01743339035a5c3c11a373cd7c83aeab6ed1457b55da6a69e014a95ac4e4700b","pinned_image":"node:lts-alpine@sha256:01743339035a5c3c11a373cd7c83aeab6ed1457b55da6a69e014a95ac4e4700b"}]}

Copilot · 2026-04-15T01:26:23Z

pkg/workflow/compiler_difc_proxy_test.go

+	tests := []struct {
+		name             string
+		customSteps      string
+		expectedContains []string
+		expectedAbsent   []string
+		desc             string


TestInjectProxyEnvIntoCustomSteps doesn’t cover steps with pinned actions that include an inline version comment (e.g. uses: actions/checkout@<sha> # v4). Because injectProxyEnvIntoCustomSteps re-parses and re-marshals YAML, this is the main regression vector for losing # vX comments (and causing gh-aw-manifest versions to fall back to SHAs). Adding a test case for preserving uses version comments (and ensuring they remain unquoted) would help prevent repeated lockfile churn.

… proxy Generated by the Design Decision Gate workflow (run #24431428234). The PR makes >100 new lines of changes to pkg/workflow/ without a linked ADR. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

github-actions · 2026-04-15T01:27:18Z

Commit pushed: 69048cd

🏗️ ADR gate enforced by Design Decision Gate 🏗️

github-actions · 2026-04-15T01:27:19Z

🏗️ Design Decision Gate — ADR Required

This PR makes significant changes to core business logic (199 new lines in pkg/workflow/) but does not have a linked Architecture Decision Record (ADR).

AI has analyzed the PR diff and generated a draft ADR to help you get started:

📄 Draft ADR: docs/adr/26322-step-scoped-env-injection-for-difc-proxy.md

The draft captures the key design decision: injecting DIFC proxy routing env vars as step-level env: blocks on each custom step, rather than writing them to $GITHUB_ENV. It includes:

Context explaining the GHE host conflict that motivated the change
The decision and primary rationale
Three alternatives considered (save/restore $GITHUB_ENV, standalone env-override steps, per-invocation shell wrapper)
Positive, negative, and neutral consequences
RFC 2119 normative requirements for conformance checking

What to do next

Review the draft ADR committed to your branch — it was generated from the PR diff
Complete missing sections — add context the AI couldn't infer, refine the decision rationale, and verify the alternatives reflect your actual design process
Commit the finalized ADR to docs/adr/ on your branch
Reference the ADR in this PR body by adding a line such as:

ADR: ADR-26322: Step-Scoped Env Injection for DIFC Proxy

Once an ADR is linked in the PR body, this gate will re-run and verify the implementation matches the decision.

Why ADRs Matter

"AI made me procrastinate on key design decisions. Because refactoring was cheap, I could always say 'I'll deal with this later.' Deferring decisions corroded my ability to think clearly."

ADRs create a searchable, permanent record of why the codebase looks the way it does. Future contributors (and your future self) will thank you.

📋 Michael Nygard ADR Format Reference

An ADR must contain these four sections to be considered complete:

Context — What is the problem? What forces are at play?
Decision — What did you decide? Why?
Alternatives Considered — What else could have been done?
Consequences — What are the trade-offs (positive and negative)?

All ADRs are stored in docs/adr/ as Markdown files numbered by PR number (e.g., 26322-step-scoped-env-injection-for-difc-proxy.md for PR #26322).

🔒 This PR cannot merge until an ADR is linked in the PR body.

Note

🔒 Integrity filter blocked 1 item

The following item were blocked because they don't meet the GitHub integrity level.

feat: DIFC proxy uses step-scoped env instead of mutating GITHUB_ENV #26322 pull_request_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".

To allow these resources, lower min-integrity in your GitHub frontmatter:

tools:
  github:
    min-integrity: approved  # merged | approved | unapproved | none

🏗️ ADR gate enforced by Design Decision Gate 🏗️ · ● 214.9K · ◷

Initial plan

ffa93cd

Copilot AI assigned Copilot and lpcox Apr 14, 2026

Copilot started work on behalf of lpcox April 14, 2026 23:09 View session

Copilot AI linked an issue Apr 14, 2026 that may be closed by this pull request

DIFC proxy should use step-scoped env for GH_HOST instead of mutating GITHUB_ENV #26314

Closed

github-actions bot mentioned this pull request Apr 14, 2026

Smoke Test: Claude - 24427887182 #26325

Closed

Copilot AI changed the title ~~[WIP] Fix DIFC proxy step-scoped env for GH_HOST~~ feat: DIFC proxy uses step-scoped env instead of mutating GITHUB_ENV Apr 14, 2026

Copilot AI requested a review from lpcox April 14, 2026 23:45

Copilot finished work on behalf of lpcox April 14, 2026 23:45

lpcox marked this pull request as ready for review April 15, 2026 01:20

Copilot AI review requested due to automatic review settings April 15, 2026 01:21

Copilot started reviewing on behalf of lpcox April 15, 2026 01:21 View session

github-actions bot approved these changes Apr 15, 2026

View reviewed changes

Copilot AI reviewed Apr 15, 2026

View reviewed changes

docs(adr): add draft ADR-26322 for step-scoped env injection for DIFC…

d3485c2

… proxy Generated by the Design Decision Gate workflow (run #24431428234). The PR makes >100 new lines of changes to pkg/workflow/ without a linked ADR. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Copilot AI mentioned this pull request Apr 15, 2026

fix: preserve uses version comments and ordered step fields in injectProxyEnvIntoCustomSteps #26357

Merged

lpcox merged commit d7d785e into main Apr 15, 2026

lpcox deleted the copilot/fix-difc-proxy-env-issue branch April 15, 2026 04:13

github-actions bot mentioned this pull request Apr 15, 2026

[docs] Update documentation for features merged April 15, 2026 #26399

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: DIFC proxy uses step-scoped env instead of mutating GITHUB_ENV#26322

feat: DIFC proxy uses step-scoped env instead of mutating GITHUB_ENV#26322
lpcox merged 3 commits intomainfrom
copilot/fix-difc-proxy-env-issue

Copilot AI commented Apr 14, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Apr 15, 2026

Uh oh!

github-actions bot left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Apr 15, 2026

Uh oh!

Copilot AI Apr 15, 2026

Uh oh!

Copilot AI Apr 15, 2026

Uh oh!

github-actions bot commented Apr 15, 2026

Uh oh!

github-actions bot commented Apr 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

Copilot AI commented Apr 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Approach

Before

After

Changes

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

github-actions bot commented Apr 15, 2026

🧪 Test Quality Sentinel Report

Test Quality Score: 100/100

Test Classification Details

Modified Existing Tests

Language Support

Verdict

Uh oh!

github-actions bot left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Copilot's findings

Uh oh!

Copilot AI Apr 15, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 15, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 15, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Apr 15, 2026

Uh oh!

github-actions bot commented Apr 15, 2026

🏗️ Design Decision Gate — ADR Required

What to do next

Why ADRs Matter

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Apr 14, 2026 •

edited

Loading