Skip to content

Commit d42a3d5

Browse files
lpcoxlpcox
authored
feat: add proxy+github-script smoke test, recompile workflows for gh-aw v0.63.0 (#2412)
## Summary Adds a new manually-triggered smoke test that validates DIFC proxy filtering works with `actions/github-script` (octokit), and recompiles all workflows for gh-aw v0.63.0. ## New Workflow: `smoke-proxy-github-script` Tests whether setting `GITHUB_API_URL` to the MCP Gateway proxy applies integrity filtering to octokit REST/GraphQL calls — proving that any `actions/github-script` step can be DIFC-filtered. **Policy**: `{"allow-only":{"repos":["github/gh-aw-mcpg"],"min-integrity":"approved"}}` | # | Test | Type | Expected | |---|------|------|----------| | 1 | In-scope: list issues (github/gh-aw-mcpg) | REST | Returns data | | 2 | Out-of-scope: list issues (octocat/Hello-World) | REST | Empty/blocked | | 3 | In-scope: GraphQL issues (github/gh-aw-mcpg) | GraphQL | Returns data | | 4 | Out-of-scope: GraphQL issues (octocat/Hello-World) | GraphQL | Empty/blocked | | 5 | In-scope: search code (github/gh-aw-mcpg) | REST | Returns data | | 6 | Bot-authored issues visible (trusted bot) | REST | Passes filter | The agent phase reads JSON result files and creates a summary issue. ## Other Changes - **Auto-fixed** `tools.github.repos` → `tools.github.allowed-repos` across 21 workflows (deprecated field) - **Fixed** `large-payload-tester` strict mode error (`sandbox.mcp.container` not allowed in strict mode) - **Recompiled** all 24 workflows with gh-aw v0.63.0
2 parents bc4b892 + 66ce689 commit d42a3d5

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

48 files changed

+3481
-1312
lines changed

‎.github/agents/agentic-workflows.agent.md‎

Lines changed: 11 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ Workflows may optionally include:
3030
- Workflow files: `.github/workflows/*.md` and `.github/workflows/**/*.md`
3131
- Workflow lock files: `.github/workflows/*.lock.yml`
3232
- Shared components: `.github/workflows/shared/*.md`
33-
- Configuration: https://github.com/github/gh-aw/blob/v0.62.0/.github/aw/github-agentic-workflows.md
33+
- Configuration: https://github.com/github/gh-aw/blob/v0.63.0/.github/aw/github-agentic-workflows.md
3434

3535
## Problems This Solves
3636

@@ -52,7 +52,7 @@ When you interact with this agent, it will:
5252
### Create New Workflow
5353
**Load when**: User wants to create a new workflow from scratch, add automation, or design a workflow that doesn't exist yet
5454

55-
**Prompt file**: https://github.com/github/gh-aw/blob/v0.62.0/.github/aw/create-agentic-workflow.md
55+
**Prompt file**: https://github.com/github/gh-aw/blob/v0.63.0/.github/aw/create-agentic-workflow.md
5656

5757
**Use cases**:
5858
- "Create a workflow that triages issues"
@@ -62,7 +62,7 @@ When you interact with this agent, it will:
6262
### Update Existing Workflow
6363
**Load when**: User wants to modify, improve, or refactor an existing workflow
6464

65-
**Prompt file**: https://github.com/github/gh-aw/blob/v0.62.0/.github/aw/update-agentic-workflow.md
65+
**Prompt file**: https://github.com/github/gh-aw/blob/v0.63.0/.github/aw/update-agentic-workflow.md
6666

6767
**Use cases**:
6868
- "Add web-fetch tool to the issue-classifier workflow"
@@ -72,7 +72,7 @@ When you interact with this agent, it will:
7272
### Debug Workflow
7373
**Load when**: User needs to investigate, audit, debug, or understand a workflow, troubleshoot issues, analyze logs, or fix errors
7474

75-
**Prompt file**: https://github.com/github/gh-aw/blob/v0.62.0/.github/aw/debug-agentic-workflow.md
75+
**Prompt file**: https://github.com/github/gh-aw/blob/v0.63.0/.github/aw/debug-agentic-workflow.md
7676

7777
**Use cases**:
7878
- "Why is this workflow failing?"
@@ -82,7 +82,7 @@ When you interact with this agent, it will:
8282
### Upgrade Agentic Workflows
8383
**Load when**: User wants to upgrade workflows to a new gh-aw version or fix deprecations
8484

85-
**Prompt file**: https://github.com/github/gh-aw/blob/v0.62.0/.github/aw/upgrade-agentic-workflows.md
85+
**Prompt file**: https://github.com/github/gh-aw/blob/v0.63.0/.github/aw/upgrade-agentic-workflows.md
8686

8787
**Use cases**:
8888
- "Upgrade all workflows to the latest version"
@@ -92,7 +92,7 @@ When you interact with this agent, it will:
9292
### Create a Report-Generating Workflow
9393
**Load when**: The workflow being created or updated produces reports — recurring status updates, audit summaries, analyses, or any structured output posted as a GitHub issue, discussion, or comment
9494

95-
**Prompt file**: https://github.com/github/gh-aw/blob/v0.62.0/.github/aw/report.md
95+
**Prompt file**: https://github.com/github/gh-aw/blob/v0.63.0/.github/aw/report.md
9696

9797
**Use cases**:
9898
- "Create a weekly CI health report"
@@ -102,7 +102,7 @@ When you interact with this agent, it will:
102102
### Create Shared Agentic Workflow
103103
**Load when**: User wants to create a reusable workflow component or wrap an MCP server
104104

105-
**Prompt file**: https://github.com/github/gh-aw/blob/v0.62.0/.github/aw/create-shared-agentic-workflow.md
105+
**Prompt file**: https://github.com/github/gh-aw/blob/v0.63.0/.github/aw/create-shared-agentic-workflow.md
106106

107107
**Use cases**:
108108
- "Create a shared component for Notion integration"
@@ -112,7 +112,7 @@ When you interact with this agent, it will:
112112
### Fix Dependabot PRs
113113
**Load when**: User needs to close or fix open Dependabot PRs that update dependencies in generated manifest files (`.github/workflows/package.json`, `.github/workflows/requirements.txt`, `.github/workflows/go.mod`)
114114

115-
**Prompt file**: https://github.com/github/gh-aw/blob/v0.62.0/.github/aw/dependabot.md
115+
**Prompt file**: https://github.com/github/gh-aw/blob/v0.63.0/.github/aw/dependabot.md
116116

117117
**Use cases**:
118118
- "Fix the open Dependabot PRs for npm dependencies"
@@ -122,7 +122,7 @@ When you interact with this agent, it will:
122122
### Analyze Test Coverage
123123
**Load when**: The workflow reads, analyzes, or reports test coverage — whether triggered by a PR, a schedule, or a slash command. Always consult this prompt before designing the coverage data strategy.
124124

125-
**Prompt file**: https://github.com/github/gh-aw/blob/v0.62.0/.github/aw/test-coverage.md
125+
**Prompt file**: https://github.com/github/gh-aw/blob/v0.63.0/.github/aw/test-coverage.md
126126

127127
**Use cases**:
128128
- "Create a workflow that comments coverage on PRs"
@@ -169,9 +169,10 @@ gh aw compile --validate
169169

170170
## Important Notes
171171

172-
- Always reference the instructions file at https://github.com/github/gh-aw/blob/v0.62.0/.github/aw/github-agentic-workflows.md for complete documentation
172+
- Always reference the instructions file at https://github.com/github/gh-aw/blob/v0.63.0/.github/aw/github-agentic-workflows.md for complete documentation
173173
- Use the MCP tool `agentic-workflows` when running in GitHub Copilot Cloud
174174
- Workflows must be compiled to `.lock.yml` files before running in GitHub Actions
175175
- **Bash tools are enabled by default** - Don't restrict bash commands unnecessarily since workflows are sandboxed by the AWF
176176
- Follow security best practices: minimal permissions, explicit network access, no template injection
177+
- **Network configuration**: Use ecosystem identifiers (`node`, `python`, `go`, etc.) or explicit FQDNs in `network.allowed`. Bare shorthands like `npm` or `pypi` are **not** valid. See https://github.com/github/gh-aw/blob/v0.63.0/.github/aw/network.md for the full list of valid ecosystem identifiers and domain patterns.
177178
- **Single-file output**: When creating a workflow, produce exactly **one** workflow `.md` file. Do not create separate documentation files (architecture docs, runbooks, usage guides, etc.). If documentation is needed, add a brief `## Usage` section inside the workflow file itself.

‎.github/aw/actions-lock.json‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -185,6 +185,11 @@
185185
"version": "v0.62.0",
186186
"sha": "b2c35f34e1013dd9ed2a84c559e2b2fec9ad38e6"
187187
},
188+
"github/gh-aw-actions/setup@v0.63.0": {
189+
"repo": "github/gh-aw-actions/setup",
190+
"version": "v0.63.0",
191+
"sha": "9128d2542bbf1bdfec94dabeaf3e1d3c0d402577"
192+
},
188193
"github/gh-aw/actions/setup@v0.62.0": {
189194
"repo": "github/gh-aw/actions/setup",
190195
"version": "v0.62.0",

‎.github/workflows/agentics-maintenance.yml‎

Lines changed: 17 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,3 @@
1-
#
21
# ___ _ _
32
# / _ \ | | (_)
43
# | |_| | __ _ ___ _ __ | |_ _ ___
@@ -13,7 +12,7 @@
1312
# \ /\ / (_) | | | | ( | | | | (_) \ V V /\__ \
1413
# \/ \/ \___/|_| |_|\_\|_| |_|\___/ \_/\_/ |___/
1514
#
16-
# This file was automatically generated by pkg/workflow/maintenance_workflow.go (v0.58.2). DO NOT EDIT.
15+
# This file was automatically generated by pkg/workflow/maintenance_workflow.go (v0.63.0). DO NOT EDIT.
1716
#
1817
# To regenerate this workflow, run:
1918
# gh aw compile
@@ -62,35 +61,35 @@ jobs:
6261
pull-requests: write
6362
steps:
6463
- name: Setup Scripts
65-
uses: github/gh-aw/actions/setup@0a5055ad41cc8658cb3ca7fd5b545a9b6956d5ff # v0.58.2
64+
uses: github/gh-aw-actions/setup@9128d2542bbf1bdfec94dabeaf3e1d3c0d402577 # v0.63.0
6665
with:
67-
destination: /opt/gh-aw/actions
66+
destination: ${{ runner.temp }}/gh-aw/actions
6867

6968
- name: Close expired discussions
7069
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
7170
with:
7271
script: |
73-
const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
72+
const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
7473
setupGlobals(core, github, context, exec, io);
75-
const { main } = require('/opt/gh-aw/actions/close_expired_discussions.cjs');
74+
const { main } = require('${{ runner.temp }}/gh-aw/actions/close_expired_discussions.cjs');
7675
await main();
7776
7877
- name: Close expired issues
7978
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
8079
with:
8180
script: |
82-
const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
81+
const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
8382
setupGlobals(core, github, context, exec, io);
84-
const { main } = require('/opt/gh-aw/actions/close_expired_issues.cjs');
83+
const { main } = require('${{ runner.temp }}/gh-aw/actions/close_expired_issues.cjs');
8584
await main();
8685
8786
- name: Close expired pull requests
8887
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
8988
with:
9089
script: |
91-
const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
90+
const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
9291
setupGlobals(core, github, context, exec, io);
93-
const { main } = require('/opt/gh-aw/actions/close_expired_pull_requests.cjs');
92+
const { main } = require('${{ runner.temp }}/gh-aw/actions/close_expired_pull_requests.cjs');
9493
await main();
9594
9695
run_operation:
@@ -107,24 +106,24 @@ jobs:
107106
persist-credentials: false
108107

109108
- name: Setup Scripts
110-
uses: github/gh-aw/actions/setup@0a5055ad41cc8658cb3ca7fd5b545a9b6956d5ff # v0.58.2
109+
uses: github/gh-aw-actions/setup@9128d2542bbf1bdfec94dabeaf3e1d3c0d402577 # v0.63.0
111110
with:
112-
destination: /opt/gh-aw/actions
111+
destination: ${{ runner.temp }}/gh-aw/actions
113112

114113
- name: Check admin/maintainer permissions
115114
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
116115
with:
117116
github-token: ${{ secrets.GITHUB_TOKEN }}
118117
script: |
119-
const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
118+
const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
120119
setupGlobals(core, github, context, exec, io);
121-
const { main } = require('/opt/gh-aw/actions/check_team_member.cjs');
120+
const { main } = require('${{ runner.temp }}/gh-aw/actions/check_team_member.cjs');
122121
await main();
123122
124123
- name: Install gh-aw
125-
uses: github/gh-aw/actions/setup-cli@v0.58.2
124+
uses: github/gh-aw-actions/setup-cli@v0.63.0
126125
with:
127-
version: v0.58.2
126+
version: v0.63.0
128127

129128
- name: Run operation
130129
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
@@ -135,7 +134,7 @@ jobs:
135134
with:
136135
github-token: ${{ secrets.GITHUB_TOKEN }}
137136
script: |
138-
const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
137+
const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
139138
setupGlobals(core, github, context, exec, io);
140-
const { main } = require('/opt/gh-aw/actions/run_operation_update_upgrade.cjs');
139+
const { main } = require('${{ runner.temp }}/gh-aw/actions/run_operation_update_upgrade.cjs');
141140
await main();

0 commit comments

Comments
 (0)