Schema Feature Coverage Checker #15

Workflow file for this run

.github/workflows/schema-feature-coverage.lock.yml at 3e87b27

	# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"e8c41f1228d8e7e5ea9053b7b44607ee0504ac4d27de1b69102ffc3908cb32f5","body_hash":"82b73994b299251d57f612a5a648562a9f0c3433105480a22942e21f9b760368","strict":true,"agent_id":"codex","engine_versions":{"codex":"0.142.3"}}
	# gh-aw-manifest: {"version":1,"secrets":["CODEX_API_KEY","GH_AW_CI_TRIGGER_TOKEN","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GH_AW_OTEL_GRAFANA_AUTHORIZATION","GH_AW_OTEL_GRAFANA_ENDPOINT","GH_AW_OTEL_SENTRY_AUTHORIZATION","GH_AW_OTEL_SENTRY_ENDPOINT","GITHUB_TOKEN","OPENAI_API_KEY"],"actions":[{"repo":"actions/cache/restore","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/cache/save","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/checkout","sha":"9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0","version":"v7.0.0"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e","version":"v6.4.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.27.13","digest":"sha256:691a06b64961b5b35aac117eaace202fa721e91da19d1d2e22dcdd6663cd571b","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.27.13@sha256:691a06b64961b5b35aac117eaace202fa721e91da19d1d2e22dcdd6663cd571b"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.13","digest":"sha256:c57febf4aeeefbb4fd96f5b12c07f4279ca55edca6a700032debf9dd0787286e","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.13@sha256:c57febf4aeeefbb4fd96f5b12c07f4279ca55edca6a700032debf9dd0787286e"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.27.13","digest":"sha256:700b1b5a73098373b04fb684f291e95d9be0124ab559717b04f27acaf8b41bed","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.27.13@sha256:700b1b5a73098373b04fb684f291e95d9be0124ab559717b04f27acaf8b41bed"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.3.32","digest":"sha256:63e46b56dfd70895a701b6fc6dd0189e11e2d875f327f1781e81b31848735477","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.3.32@sha256:63e46b56dfd70895a701b6fc6dd0189e11e2d875f327f1781e81b31848735477"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b","pinned_image":"ghcr.io/github/gh-aw-node@sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b"}]}
	# This file was automatically generated by gh-aw. DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md
	#
	# ___ _ _
	# / _ \ \| \| (_)
	# \| \|_\| \| __ _ ___ _ __ \| \|_ _ ___
	# \| _ \|/ _` \|/ _ \ '_ \\| __\| \|/ __\|
	# \| \| \| \| (_\| \| __/ \| \| \| \|_\| \| (__
	# \_\| \|_/\__, \|\___\|_\| \|_\|\__\|_\|\___\|
	# __/ \|
	# _ _ \|___/
	# \| \| \| \| / _\| \|
	# \| \| \| \| ___ _ __ _ __\| \|_\| \| _____ ____
	# \| \|/\\| \|/ _ \ '__\| \|/ /\| _\| \|/ _ \ \ /\ / / ___\|
	# \ /\ / (_) \| \| \| \| ( \| \| \| \| (_) \ V V /\__ \
	# \/ \/ \___/\|_\| \|_\|\_\\|_\| \|_\|\___/ \_/\_/ \|___/
	#
	#
	# To update this file, edit the corresponding .md file and run:
	# gh aw compile
	# Not all edits will cause changes to this file.
	#
	# For more information: https://github.github.com/gh-aw/introduction/overview/
	#
	# Ensures 100% schema feature coverage across existing agentic workflows by creating PRs for any uncovered fields
	#
	# Resolved workflow manifest:
	# Imports:
	# - shared/otlp.md
	#
	# Secrets used:
	# - CODEX_API_KEY
	# - GH_AW_CI_TRIGGER_TOKEN
	# - GH_AW_GITHUB_MCP_SERVER_TOKEN
	# - GH_AW_GITHUB_TOKEN
	# - GH_AW_OTEL_GRAFANA_AUTHORIZATION
	# - GH_AW_OTEL_GRAFANA_ENDPOINT
	# - GH_AW_OTEL_SENTRY_AUTHORIZATION
	# - GH_AW_OTEL_SENTRY_ENDPOINT
	# - GITHUB_TOKEN
	# - OPENAI_API_KEY
	#
	# Custom actions used:
	# - actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
	# - actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
	# - actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
	# - actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
	# - actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
	# - actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 (source v9)
	# - actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
	# - actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
	#
	# Container images used:
	# - ghcr.io/github/gh-aw-firewall/agent:0.27.13@sha256:691a06b64961b5b35aac117eaace202fa721e91da19d1d2e22dcdd6663cd571b
	# - ghcr.io/github/gh-aw-firewall/api-proxy:0.27.13@sha256:c57febf4aeeefbb4fd96f5b12c07f4279ca55edca6a700032debf9dd0787286e
	# - ghcr.io/github/gh-aw-firewall/squid:0.27.13@sha256:700b1b5a73098373b04fb684f291e95d9be0124ab559717b04f27acaf8b41bed
	# - ghcr.io/github/gh-aw-mcpg:v0.3.32@sha256:63e46b56dfd70895a701b6fc6dd0189e11e2d875f327f1781e81b31848735477
	# - ghcr.io/github/gh-aw-node@sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b

	name: "Schema Feature Coverage Checker"
	on:
	schedule:
	- cron: "24 6 * * 1"
	# Friendly format: weekly on monday around 07:00 (scattered)
	workflow_dispatch:
	inputs:
	aw_context:
	default: ""
	description: "Agent caller context (used internally by Agentic Workflows)."
	required: false
	type: string

	permissions: {}

	concurrency:
	group: "gh-aw-${{ github.workflow }}"

	run-name: "Schema Feature Coverage Checker"

	env:
	OTEL_EXPORTER_OTLP_ENDPOINT: ${{ secrets.GH_AW_OTEL_SENTRY_ENDPOINT }}
	OTEL_SERVICE_NAME: gh-aw.schema-feature-coverage
	OTEL_RESOURCE_ATTRIBUTES: 'gh-aw.workflow.name=Schema%20Feature%20Coverage%20Checker,gh-aw.repository=${{ github.repository }},gh-aw.run.id=${{ github.run_id }},github.run_id=${{ github.run_id }},gh-aw.engine.id=codex'
	OTEL_EXPORTER_OTLP_HEADERS: x-sentry-auth=${{ secrets.GH_AW_OTEL_SENTRY_AUTHORIZATION }}
	GH_AW_OTLP_ALL_HEADERS: x-sentry-auth=${{ secrets.GH_AW_OTEL_SENTRY_AUTHORIZATION }},Authorization=${{ secrets.GH_AW_OTEL_GRAFANA_AUTHORIZATION }}
	GH_AW_OTLP_ENDPOINTS: '[{"url":"${{ secrets.GH_AW_OTEL_SENTRY_ENDPOINT }}","headers":"x-sentry-auth=${{ secrets.GH_AW_OTEL_SENTRY_AUTHORIZATION }}"},{"url":"${{ secrets.GH_AW_OTEL_GRAFANA_ENDPOINT }}","headers":"Authorization=${{ secrets.GH_AW_OTEL_GRAFANA_AUTHORIZATION }}"}]'

	jobs:
	activation:
	runs-on: ubuntu-slim
	permissions:
	actions: read
	contents: read
	env:
	GH_AW_MAX_DAILY_AI_CREDITS: ${{ vars.GH_AW_DEFAULT_MAX_DAILY_AI_CREDITS \|\| '5000' }}
	GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }}
	outputs:
	comment_id: ""
	comment_repo: ""
	daily_ai_credits_exceeded: ${{ steps.daily-effective-workflow-guardrail.outputs.daily_ai_credits_exceeded == 'true' }}
	daily_ai_credits_threshold: ${{ steps.daily-effective-workflow-guardrail.outputs.daily_ai_credits_threshold \|\| '' }}
	daily_ai_credits_total_effective_tokens: ${{ steps.daily-effective-workflow-guardrail.outputs.daily_ai_credits_total_effective_tokens \|\| '' }}
	engine_id: ${{ steps.generate_aw_info.outputs.engine_id }}
	lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }}
	model: ${{ steps.generate_aw_info.outputs.model }}
	secret_verification_result: ${{ steps.validate-secret.outputs.verification_result }}
	setup-parent-span-id: ${{ steps.setup.outputs.parent-span-id \|\| steps.setup.outputs.span-id }}
	setup-span-id: ${{ steps.setup.outputs.span-id }}
	setup-trace-id: ${{ steps.setup.outputs.trace-id }}
	stale_lock_file_failed: ${{ steps.check-lock-file.outputs.stale_lock_file_failed == 'true' }}
	steps:
	- name: Checkout actions folder
	uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
	with:
	repository: github/gh-aw
	sparse-checkout: \|
	actions
	persist-credentials: false
	- name: Setup Scripts
	id: setup
	uses: ./actions/setup
	with:
	destination: ${{ runner.temp }}/gh-aw/actions
	job-name: ${{ github.job }}
	safe-output-artifact-client: ${{ env.GH_AW_MAX_DAILY_AI_CREDITS != '' }}
	env:
	GH_AW_SETUP_WORKFLOW_NAME: "Schema Feature Coverage Checker"
	GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/schema-feature-coverage.lock.yml@${{ github.ref }}
	GH_AW_INFO_VERSION: "0.142.3"
	GH_AW_INFO_AWF_VERSION: "v0.27.13"
	GH_AW_INFO_ENGINE_ID: "codex"
	- name: Mask OTLP telemetry headers
	run: bash "${RUNNER_TEMP}/gh-aw/actions/mask_otlp_headers.sh"
	- name: Generate agentic run info
	id: generate_aw_info
	env:
	GH_AW_INFO_ENGINE_ID: "codex"
	GH_AW_INFO_ENGINE_NAME: "Codex"
	GH_AW_INFO_MODEL: ${{ vars.GH_AW_MODEL_AGENT_CODEX \|\| vars.GH_AW_DEFAULT_MODEL_CODEX \|\| 'gpt-5.4' }}
	GH_AW_INFO_VERSION: "0.142.3"
	GH_AW_INFO_AGENT_VERSION: "0.142.3"
	GH_AW_INFO_WORKFLOW_NAME: "Schema Feature Coverage Checker"
	GH_AW_INFO_EXPERIMENTAL: "false"
	GH_AW_INFO_SUPPORTS_TOOLS_ALLOWLIST: "true"
	GH_AW_INFO_STAGED: "false"
	GH_AW_INFO_ALLOWED_DOMAINS: '[".grafana.net",".sentry.io","defaults","github"]'
	GH_AW_INFO_FIREWALL_ENABLED: "true"
	GH_AW_INFO_AWF_VERSION: "v0.27.13"
	GH_AW_INFO_AWMG_VERSION: ""
	GH_AW_INFO_FIREWALL_TYPE: "squid"
	GH_AW_INFO_FRONTMATTER_EMOJI: "📊"
	GH_AW_COMPILED_STRICT: "true"
	uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
	with:
	script: \|
	const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
	setupGlobals(core, github, context, exec, io, getOctokit);
	const { main } = require('${{ runner.temp }}/gh-aw/actions/generate_aw_info.cjs');
	await main(core, context);
	- name: Restore daily AIC usage cache
	id: restore-daily-aic-cache
	if: ${{ env.GH_AW_MAX_DAILY_AI_CREDITS != '' }}
	continue-on-error: true
	uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
	with:
	key: agentic-workflow-usage-schemafeaturecoverage-${{ github.run_id }}
	restore-keys: agentic-workflow-usage-schemafeaturecoverage-
	path: /tmp/gh-aw/agentic-workflow-usage-cache.jsonl
	- name: Restore daily AIC usage cache (artifact fallback)
	id: restore-daily-aic-cache-fallback
	if: ${{ env.GH_AW_MAX_DAILY_AI_CREDITS != '' }}
	continue-on-error: true
	uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
	env:
	GH_AW_RESTORE_DAILY_AIC_CACHE_HIT: ${{ steps.restore-daily-aic-cache.outputs.cache-hit }}
	GH_AW_RESTORE_DAILY_AIC_CACHE_MATCHED_KEY: ${{ steps.restore-daily-aic-cache.outputs.cache-matched-key }}
	with:
	github-token: ${{ secrets.GITHUB_TOKEN }}
	script: \|
	const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
	setupGlobals(core, github, context, exec, io, getOctokit);
	const { main } = require('${{ runner.temp }}/gh-aw/actions/restore_aic_usage_cache_fallback.cjs');
	await main();
	- name: Check daily workflow token guardrail
	id: daily-effective-workflow-guardrail
	if: ${{ env.GH_AW_MAX_DAILY_AI_CREDITS != '' }}
	uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
	env:
	GH_AW_WORKFLOW_NAME: "Schema Feature Coverage Checker"
	GH_AW_WORKFLOW_ID: "schema-feature-coverage"
	GH_AW_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
	GH_AW_WORKFLOW_DISPATCH_AW_CONTEXT: ${{ github.event.inputs.aw_context \|\| '' }}
	GH_AW_HAS_SLASH_COMMAND: "false"
	GH_AW_HAS_LABEL_COMMAND: "false"
	GH_AW_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
	GH_AW_MAX_DAILY_AI_CREDITS: ${{ vars.GH_AW_DEFAULT_MAX_DAILY_AI_CREDITS \|\| '5000' }}
	with:
	github-token: ${{ secrets.GITHUB_TOKEN }}
	script: \|
	const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
	setupGlobals(core, github, context, exec, io, getOctokit);
	const { main } = require('${{ runner.temp }}/gh-aw/actions/check_daily_aic_workflow_guardrail.cjs');
	await main();
	- name: Validate CODEX_API_KEY or OPENAI_API_KEY secret
	id: validate-secret
	run: bash "${RUNNER_TEMP}/gh-aw/actions/validate_multi_secret.sh" CODEX_API_KEY OPENAI_API_KEY Codex https://github.github.com/gh-aw/reference/engines/#openai-codex
	env:
	CODEX_API_KEY: ${{ secrets.CODEX_API_KEY }}
	OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
	- name: Checkout .github and .agents folders
	uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
	with:
	persist-credentials: false
	sparse-checkout: \|
	.github
	.agents
	actions/setup
	.antigravity
	.claude
	.codex
	.crush
	.gemini
	.opencode
	.pi
	sparse-checkout-cone-mode: true
	fetch-depth: 1
	- name: Save agent config folders for base branch restoration
	env:
	GH_AW_AGENT_FOLDERS: ".agents .antigravity .claude .codex .crush .gemini .github .opencode .pi"
	GH_AW_AGENT_FILES: ".crush.json AGENTS.md ANTIGRAVITY.md CLAUDE.md GEMINI.md PI.md opencode.jsonc"
	# poutine:ignore untrusted_checkout_exec
	run: bash "${RUNNER_TEMP}/gh-aw/actions/save_base_github_folders.sh"
	- name: Check workflow lock file
	id: check-lock-file
	uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
	env:
	GH_AW_WORKFLOW_FILE: "schema-feature-coverage.lock.yml"
	GH_AW_CONTEXT_WORKFLOW_REF: "${{ github.workflow_ref }}"
	with:
	script: \|
	const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
	setupGlobals(core, github, context, exec, io, getOctokit);
	const { main } = require('${{ runner.temp }}/gh-aw/actions/check_workflow_timestamp_api.cjs');
	await main();
	- name: Log runtime features
	if: ${{ contains(toJSON(vars), '"GH_AW_RUNTIME_FEATURES":') }}
	run: bash "${RUNNER_TEMP}/gh-aw/actions/log_runtime_features_summary.sh"
	- name: Create prompt with built-in context
	env:
	GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
	GH_AW_SAFE_OUTPUTS: ${{ runner.temp }}/gh-aw/safeoutputs/outputs.jsonl
	GH_AW_EXPR_1A3A194A: ${{ github.event.discussion.number \|\| (fromJSON(github.event.inputs.aw_context \|\| github.event.client_payload.aw_context \|\| '{}').item_type == 'discussion' && fromJSON(github.event.inputs.aw_context \|\| github.event.client_payload.aw_context \|\| '{}').item_number) }}
	GH_AW_EXPR_463A214A: ${{ github.event.pull_request.number \|\| (fromJSON(github.event.inputs.aw_context \|\| github.event.client_payload.aw_context \|\| '{}').item_type == 'pull_request' && fromJSON(github.event.inputs.aw_context \|\| github.event.client_payload.aw_context \|\| '{}').item_number) }}
	GH_AW_EXPR_802A9F6A: ${{ github.event.issue.number \|\| (fromJSON(github.event.inputs.aw_context \|\| github.event.client_payload.aw_context \|\| '{}').item_type == 'issue' && fromJSON(github.event.inputs.aw_context \|\| github.event.client_payload.aw_context \|\| '{}').item_number) }}
	GH_AW_EXPR_FF1D34CE: ${{ github.event.comment.id \|\| fromJSON(github.event.inputs.aw_context \|\| github.event.client_payload.aw_context \|\| '{}').comment_id }}
	GH_AW_GITHUB_ACTOR: ${{ github.actor }}
	GH_AW_GITHUB_REPOSITORY: ${{ github.repository }}
	GH_AW_GITHUB_RUN_ID: ${{ github.run_id }}
	GH_AW_GITHUB_RUN_NUMBER: ${{ github.run_number }}
	GH_AW_GITHUB_WORKSPACE: ${{ github.workspace }}
	# poutine:ignore untrusted_checkout_exec
	run: \|
	bash "${RUNNER_TEMP}/gh-aw/actions/create_prompt_first.sh"
	{
	cat << 'GH_AW_PROMPT_7a09c237282e717b_EOF'
	<system>
	GH_AW_PROMPT_7a09c237282e717b_EOF
	cat "${RUNNER_TEMP}/gh-aw/prompts/xpia.md"
	cat "${RUNNER_TEMP}/gh-aw/prompts/temp_folder_prompt.md"
	cat "${RUNNER_TEMP}/gh-aw/prompts/markdown.md"
	cat "${RUNNER_TEMP}/gh-aw/prompts/safe_outputs_prompt.md"
	cat << 'GH_AW_PROMPT_7a09c237282e717b_EOF'
	<safe-output-tools>
	Tools: create_pull_request(max:10), missing_tool, missing_data, noop
	GH_AW_PROMPT_7a09c237282e717b_EOF
	cat "${RUNNER_TEMP}/gh-aw/prompts/safe_outputs_create_pull_request.md"
	cat << 'GH_AW_PROMPT_7a09c237282e717b_EOF'
	</safe-output-tools>
	GH_AW_PROMPT_7a09c237282e717b_EOF
	cat "${RUNNER_TEMP}/gh-aw/prompts/mcp_cli_tools_prompt.md"
	cat << 'GH_AW_PROMPT_7a09c237282e717b_EOF'
	<github-context>
	The following GitHub context information is available for this workflow:
	{{#if github.actor}}
	- actor: __GH_AW_GITHUB_ACTOR__
	{{/if}}
	{{#if github.repository}}
	- repository: __GH_AW_GITHUB_REPOSITORY__
	{{/if}}
	{{#if github.workspace}}
	- workspace: __GH_AW_GITHUB_WORKSPACE__
	{{/if}}
	{{#if github.event.issue.number \|\| (github.aw.context.item_type == 'issue' && github.aw.context.item_number)}}
	- issue-number: #__GH_AW_EXPR_802A9F6A__
	{{/if}}
	{{#if github.event.discussion.number \|\| (github.aw.context.item_type == 'discussion' && github.aw.context.item_number)}}
	- discussion-number: #__GH_AW_EXPR_1A3A194A__
	{{/if}}
	{{#if github.event.pull_request.number \|\| (github.aw.context.item_type == 'pull_request' && github.aw.context.item_number)}}
	- pull-request-number: #__GH_AW_EXPR_463A214A__
	{{/if}}
	{{#if github.event.comment.id \|\| github.aw.context.comment_id}}
	- comment-id: __GH_AW_EXPR_FF1D34CE__
	{{/if}}
	{{#if github.run_id}}
	- workflow-run-id: __GH_AW_GITHUB_RUN_ID__
	{{/if}}
	- checkouts: The following repositories have been checked out and are available in the workspace:
	- repo `__GH_AW_GITHUB_REPOSITORY__` → `$GITHUB_WORKSPACE` (cwd) (current - this is the repository you are working on; use this as the target for all GitHub operations unless otherwise specified) [shallow clone, fetch-depth=1]
	- Note: If a branch you need is not in the list above and is not listed as an additional fetched ref, it has NOT been checked out. For private repositories you cannot fetch it. If the branch is required and not available, exit with an error and ask the user to add it to the `fetch:` option of the `checkout:` configuration (e.g., `fetch: ["refs/pulls/open/*"]` for all open PR refs, or `fetch: ["main", "feature/my-branch"]` for specific branches).
	- Warning: No git credentials are available to the agent. Credentials are
	intentionally removed after the checkout step for security. This means any git
	operation that needs to authenticate to the remote will fail. In private repositories, that includes:
	- `git fetch`, `git pull`, `git clone`, and `git push` (direct push, not via safe-output tools)
	- Checking out or switching to a remote branch that is not already fetched
	- Deepening a shallow clone (`git fetch --unshallow`)
	- On-demand blob fetches in partial/blobless clones (operations on files not in the initial checkout)
	Do NOT attempt to configure credentials, run `git credential fill`, or modify `.gitconfig` —
	authentication will not succeed. If you encounter credential prompts or authentication errors,
	stop immediately and report the limitation rather than spending turns trying to work around it.
	</github-context>

	GH_AW_PROMPT_7a09c237282e717b_EOF
	cat "${RUNNER_TEMP}/gh-aw/prompts/github_mcp_tools_with_safeoutputs_prompt.md"
	cat << 'GH_AW_PROMPT_7a09c237282e717b_EOF'
	</system>
	{{#runtime-import .github/workflows/shared/otlp.md}}
	{{#runtime-import .github/workflows/schema-feature-coverage.md}}
	GH_AW_PROMPT_7a09c237282e717b_EOF
	} > "$GH_AW_PROMPT"
	- name: Interpolate variables and render templates
	uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
	env:
	GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
	GH_AW_ENGINE_ID: "codex"
	GH_AW_GITHUB_RUN_NUMBER: ${{ github.run_number }}
	with:
	script: \|
	const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
	setupGlobals(core, github, context, exec, io, getOctokit);
	const { main } = require('${{ runner.temp }}/gh-aw/actions/interpolate_prompt.cjs');
	await main();
	- name: Substitute placeholders
	uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
	env:
	GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
	GH_AW_EXPR_1A3A194A: ${{ github.event.discussion.number \|\| (fromJSON(github.event.inputs.aw_context \|\| github.event.client_payload.aw_context \|\| '{}').item_type == 'discussion' && fromJSON(github.event.inputs.aw_context \|\| github.event.client_payload.aw_context \|\| '{}').item_number) }}
	GH_AW_EXPR_463A214A: ${{ github.event.pull_request.number \|\| (fromJSON(github.event.inputs.aw_context \|\| github.event.client_payload.aw_context \|\| '{}').item_type == 'pull_request' && fromJSON(github.event.inputs.aw_context \|\| github.event.client_payload.aw_context \|\| '{}').item_number) }}
	GH_AW_EXPR_802A9F6A: ${{ github.event.issue.number \|\| (fromJSON(github.event.inputs.aw_context \|\| github.event.client_payload.aw_context \|\| '{}').item_type == 'issue' && fromJSON(github.event.inputs.aw_context \|\| github.event.client_payload.aw_context \|\| '{}').item_number) }}
	GH_AW_EXPR_FF1D34CE: ${{ github.event.comment.id \|\| fromJSON(github.event.inputs.aw_context \|\| github.event.client_payload.aw_context \|\| '{}').comment_id }}
	GH_AW_GITHUB_ACTOR: ${{ github.actor }}
	GH_AW_GITHUB_REPOSITORY: ${{ github.repository }}
	GH_AW_GITHUB_RUN_ID: ${{ github.run_id }}
	GH_AW_GITHUB_RUN_NUMBER: ${{ github.run_number }}
	GH_AW_GITHUB_WORKSPACE: ${{ github.workspace }}
	GH_AW_MCP_CLI_SERVERS_LIST: '- `safeoutputs` — run `safeoutputs --help` to see available tools'
	with:
	script: \|
	const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
	setupGlobals(core, github, context, exec, io, getOctokit);

	const substitutePlaceholders = require('${{ runner.temp }}/gh-aw/actions/substitute_placeholders.cjs');

	// Call the substitution function
	return await substitutePlaceholders({
	file: process.env.GH_AW_PROMPT,
	substitutions: {
	GH_AW_EXPR_1A3A194A: process.env.GH_AW_EXPR_1A3A194A,
	GH_AW_EXPR_463A214A: process.env.GH_AW_EXPR_463A214A,
	GH_AW_EXPR_802A9F6A: process.env.GH_AW_EXPR_802A9F6A,
	GH_AW_EXPR_FF1D34CE: process.env.GH_AW_EXPR_FF1D34CE,
	GH_AW_GITHUB_ACTOR: process.env.GH_AW_GITHUB_ACTOR,
	GH_AW_GITHUB_REPOSITORY: process.env.GH_AW_GITHUB_REPOSITORY,
	GH_AW_GITHUB_RUN_ID: process.env.GH_AW_GITHUB_RUN_ID,
	GH_AW_GITHUB_RUN_NUMBER: process.env.GH_AW_GITHUB_RUN_NUMBER,
	GH_AW_GITHUB_WORKSPACE: process.env.GH_AW_GITHUB_WORKSPACE,
	GH_AW_MCP_CLI_SERVERS_LIST: process.env.GH_AW_MCP_CLI_SERVERS_LIST
	}
	});
	- name: Validate prompt placeholders
	env:
	GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
	# poutine:ignore untrusted_checkout_exec
	run: bash "${RUNNER_TEMP}/gh-aw/actions/validate_prompt_placeholders.sh"
	- name: Print prompt
	env:
	GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
	# poutine:ignore untrusted_checkout_exec
	run: bash "${RUNNER_TEMP}/gh-aw/actions/print_prompt_summary.sh"
	- name: Upload activation artifact
	if: success()
	uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
	with:
	name: activation
	include-hidden-files: true
	path: \|
	/tmp/gh-aw/aw_info.json
	/tmp/gh-aw/models.json
	/tmp/gh-aw/aw-prompts/prompt.txt
	/tmp/gh-aw/aw-prompts/prompt-template.txt
	/tmp/gh-aw/aw-prompts/prompt-import-tree.json
	/tmp/gh-aw/github_rate_limits.jsonl
	/tmp/gh-aw/base
	/tmp/gh-aw/.codex/agents
	/tmp/gh-aw/.codex/skills
	if-no-files-found: ignore
	retention-days: 1

	agent:
	needs: activation
	if: needs.activation.outputs.daily_ai_credits_exceeded != 'true'
	runs-on: ubuntu-latest
	permissions:
	contents: read
	issues: read
	pull-requests: read
	concurrency:
	group: "gh-aw-codex-${{ github.workflow }}"
	queue: max
	env:
	DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
	GH_AW_ASSETS_ALLOWED_EXTS: ""
	GH_AW_ASSETS_BRANCH: ""
	GH_AW_ASSETS_MAX_SIZE_KB: 0
	GH_AW_MCP_LOG_DIR: /tmp/gh-aw/mcp-logs/safeoutputs
	GH_AW_PROJECT_UTC: "-08:00"
	GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }}
	GH_AW_WORKFLOW_ID_SANITIZED: schemafeaturecoverage
	outputs:
	agentic_engine_timeout: ${{ steps.detect-agent-errors.outputs.agentic_engine_timeout \|\| 'false' }}
	ai_credits_rate_limit_error: ${{ steps.parse-mcp-gateway.outputs.ai_credits_rate_limit_error \|\| 'false' }}
	aic: ${{ steps.parse-mcp-gateway.outputs.aic }}
	ambient_context: ${{ steps.parse-mcp-gateway.outputs.ambient_context }}
	checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success \|\| 'true' }}
	effective_tokens: ${{ steps.parse-mcp-gateway.outputs.effective_tokens }}
	has_patch: ${{ steps.collect_output.outputs.has_patch }}
	inference_access_error: ${{ steps.detect-agent-errors.outputs.inference_access_error \|\| 'false' }}
	mcp_policy_error: ${{ steps.detect-agent-errors.outputs.mcp_policy_error \|\| 'false' }}
	model: ${{ needs.activation.outputs.model }}
	model_not_supported_error: ${{ steps.detect-agent-errors.outputs.model_not_supported_error \|\| 'false' }}
	output: ${{ steps.collect_output.outputs.output }}
	output_types: ${{ steps.collect_output.outputs.output_types }}
	setup-parent-span-id: ${{ steps.setup.outputs.parent-span-id \|\| steps.setup.outputs.span-id }}
	setup-span-id: ${{ steps.setup.outputs.span-id }}
	setup-trace-id: ${{ steps.setup.outputs.trace-id }}
	unknown_model_ai_credits: ${{ steps.parse-mcp-gateway.outputs.unknown_model_ai_credits \|\| 'false' }}
	steps:
	- name: Checkout actions folder
	uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
	with:
	repository: github/gh-aw
	sparse-checkout: \|
	actions
	persist-credentials: false
	- name: Setup Scripts
	id: setup
	uses: ./actions/setup
	with:
	destination: ${{ runner.temp }}/gh-aw/actions
	job-name: ${{ github.job }}
	trace-id: ${{ needs.activation.outputs.setup-trace-id }}
	parent-span-id: ${{ needs.activation.outputs.setup-parent-span-id \|\| needs.activation.outputs.setup-span-id }}
	env:
	GH_AW_SETUP_WORKFLOW_NAME: "Schema Feature Coverage Checker"
	GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/schema-feature-coverage.lock.yml@${{ github.ref }}
	GH_AW_INFO_VERSION: "0.142.3"
	GH_AW_INFO_AWF_VERSION: "v0.27.13"
	GH_AW_INFO_ENGINE_ID: "codex"
	- name: Set runtime paths
	id: set-runtime-paths
	run: \|
	{
	echo "GH_AW_SAFE_OUTPUTS=${RUNNER_TEMP}/gh-aw/safeoutputs/outputs.jsonl"
	echo "GH_AW_SAFE_OUTPUTS_CONFIG_PATH=${RUNNER_TEMP}/gh-aw/safeoutputs/config.json"
	echo "GH_AW_SAFE_OUTPUTS_TOOLS_PATH=${RUNNER_TEMP}/gh-aw/safeoutputs/tools.json"
	} >> "$GITHUB_OUTPUT"
	- name: Mask OTLP telemetry headers
	run: bash "${RUNNER_TEMP}/gh-aw/actions/mask_otlp_headers.sh"
	- name: Checkout repository
	uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
	with:
	persist-credentials: false
	fetch-depth: 1
	- name: Create gh-aw temp directory
	run: bash "${RUNNER_TEMP}/gh-aw/actions/create_gh_aw_tmp_dir.sh"
	- name: Configure gh CLI for GitHub Enterprise
	run: bash "${RUNNER_TEMP}/gh-aw/actions/configure_gh_for_ghe.sh"
	env:
	GH_TOKEN: ${{ github.token }}
	- name: Configure Git credentials
	env:
	GITHUB_REPOSITORY: ${{ github.repository }}
	GITHUB_SERVER_URL: ${{ github.server_url }}
	GITHUB_TOKEN: ${{ github.token }}
	run: bash "${RUNNER_TEMP}/gh-aw/actions/configure_git_credentials.sh"
	- name: Checkout PR branch
	id: checkout-pr
	if: \|
	github.event.pull_request \|\| github.event.issue.pull_request \|\| github.event_name == 'workflow_dispatch' && fromJSON(github.event.inputs.aw_context \|\| '{}').item_type == 'pull_request'
	uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
	env:
	GH_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN \|\| secrets.GH_AW_GITHUB_TOKEN \|\| secrets.GITHUB_TOKEN }}
	with:
	github-token: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN \|\| secrets.GH_AW_GITHUB_TOKEN \|\| secrets.GITHUB_TOKEN }}
	script: \|
	const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
	setupGlobals(core, github, context, exec, io, getOctokit);
	const { main } = require('${{ runner.temp }}/gh-aw/actions/checkout_pr_branch.cjs');
	await main();
	- name: Setup Node.js
	uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
	with:
	node-version: '24'
	package-manager-cache: false
	- name: Install Codex CLI
	run: npm install --ignore-scripts -g @openai/codex@0.142.3
	- name: Install AWF binary
	run: bash "${RUNNER_TEMP}/gh-aw/actions/install_awf_binary.sh" v0.27.13 --rootless
	- name: Determine automatic lockdown mode for GitHub MCP Server
	id: determine-automatic-lockdown
	uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 (source v9)
	env:
	GH_AW_GITHUB_TOKEN: ${{ secrets.GH_AW_GITHUB_TOKEN }}
	GH_AW_GITHUB_MCP_SERVER_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN }}
	with:
	script: \|
	const determineAutomaticLockdown = require('${{ runner.temp }}/gh-aw/actions/determine_automatic_lockdown.cjs');
	await determineAutomaticLockdown(github, context, core);
	- name: Download activation artifact
	uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
	with:
	name: activation
	path: /tmp/gh-aw
	- name: Restore agent config folders from base branch
	if: steps.checkout-pr.outcome == 'success'
	env:
	GH_AW_AGENT_FOLDERS: ".agents .antigravity .claude .codex .crush .gemini .github .opencode .pi"
	GH_AW_AGENT_FILES: ".crush.json AGENTS.md ANTIGRAVITY.md CLAUDE.md GEMINI.md PI.md opencode.jsonc"
	run: bash "${RUNNER_TEMP}/gh-aw/actions/restore_base_github_folders.sh"
	- name: Restore inline sub-agents from activation artifact
	env:
	GH_AW_SUB_AGENT_DIR: ".codex/agents"
	GH_AW_SUB_AGENT_EXT: ".md"
	run: bash "${RUNNER_TEMP}/gh-aw/actions/restore_inline_sub_agents.sh"
	- name: Restore inline skills from activation artifact
	env:
	GH_AW_SKILL_DIR: ".codex/skills"
	run: bash "${RUNNER_TEMP}/gh-aw/actions/restore_inline_skills.sh"
	- name: Download container images
	run: bash "${RUNNER_TEMP}/gh-aw/actions/download_docker_images.sh" ghcr.io/github/gh-aw-firewall/agent:0.27.13@sha256:691a06b64961b5b35aac117eaace202fa721e91da19d1d2e22dcdd6663cd571b ghcr.io/github/gh-aw-firewall/api-proxy:0.27.13@sha256:c57febf4aeeefbb4fd96f5b12c07f4279ca55edca6a700032debf9dd0787286e ghcr.io/github/gh-aw-firewall/squid:0.27.13@sha256:700b1b5a73098373b04fb684f291e95d9be0124ab559717b04f27acaf8b41bed ghcr.io/github/gh-aw-mcpg:v0.3.32@sha256:63e46b56dfd70895a701b6fc6dd0189e11e2d875f327f1781e81b31848735477 ghcr.io/github/gh-aw-node@sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b
	- name: Generate Safe Outputs Config
	run: \|
	mkdir -p "${RUNNER_TEMP}/gh-aw/safeoutputs"
	mkdir -p /tmp/gh-aw/safeoutputs
	mkdir -p /tmp/gh-aw/mcp-logs/safeoutputs
	cat > "${RUNNER_TEMP}/gh-aw/safeoutputs/config.json" << 'GH_AW_SAFE_OUTPUTS_CONFIG_767240d1ae61390e_EOF'
	{"create_pull_request":{"expires":168,"labels":["automation","schema-coverage"],"max":10,"max_patch_files":100,"max_patch_size":4096,"protect_top_level_dot_folders":true,"protected_files":["package.json","bun.lockb","bunfig.toml","deno.json","deno.jsonc","deno.lock","global.json","NuGet.Config","Directory.Packages.props","mix.exs","mix.lock","go.mod","go.sum","stack.yaml","stack.yaml.lock","pom.xml","build.gradle","build.gradle.kts","settings.gradle","settings.gradle.kts","gradle.properties","package-lock.json","yarn.lock","pnpm-lock.yaml","npm-shrinkwrap.json","requirements.txt","Pipfile","Pipfile.lock","pyproject.toml","setup.py","setup.cfg","Gemfile","Gemfile.lock","uv.lock","CODEOWNERS","DESIGN.md","README.md","CONTRIBUTING.md","CHANGELOG.md","SECURITY.md","CODE_OF_CONDUCT.md","AGENTS.md","CLAUDE.md","GEMINI.md"],"protected_files_policy":"request_review","title_prefix":"[schema-coverage] "},"create_report_incomplete_issue":{},"missing_data":{},"missing_tool":{},"noop":{"max":1,"report-as-issue":"true"},"report_incomplete":{}}
	GH_AW_SAFE_OUTPUTS_CONFIG_767240d1ae61390e_EOF
	- name: Generate Safe Outputs Tools
	env:
	GH_AW_TOOLS_META_JSON: \|
	{
	"description_suffixes": {
	"create_pull_request": " CONSTRAINTS: Maximum 10 pull request(s) can be created. Title will be prefixed with \"[schema-coverage] \". Labels [\"automation\" \"schema-coverage\"] will be automatically added."
	},
	"repo_params": {},
	"dynamic_tools": []
	}
	GH_AW_VALIDATION_JSON: \|
	{
	"create_pull_request": {
	"defaultMax": 1,
	"fields": {
	"base": {
	"type": "string",
	"sanitize": true,
	"maxLength": 128
	},
	"body": {
	"required": true,
	"type": "string",
	"sanitize": true,
	"maxLength": 65000
	},
	"branch": {
	"required": true,
	"type": "string",
	"sanitize": true,
	"maxLength": 256
	},
	"draft": {
	"type": "boolean"
	},
	"labels": {
	"type": "array",
	"itemType": "string",
	"itemSanitize": true,
	"itemMaxLength": 128
	},
	"repo": {
	"type": "string",
	"maxLength": 256
	},
	"title": {
	"required": true,
	"type": "string",
	"sanitize": true,
	"maxLength": 128
	}
	}
	},
	"missing_data": {
	"defaultMax": 20,
	"fields": {
	"alternatives": {
	"type": "string",
	"sanitize": true,
	"maxLength": 256
	},
	"context": {
	"type": "string",
	"sanitize": true,
	"maxLength": 256
	},
	"data_type": {
	"type": "string",
	"sanitize": true,
	"maxLength": 128
	},
	"reason": {
	"type": "string",
	"sanitize": true,
	"maxLength": 256
	}
	}
	},
	"missing_tool": {
	"defaultMax": 20,
	"fields": {
	"alternatives": {
	"type": "string",
	"sanitize": true,
	"maxLength": 512
	},
	"reason": {
	"required": true,
	"type": "string",
	"sanitize": true,
	"maxLength": 256
	},
	"tool": {
	"type": "string",
	"sanitize": true,
	"maxLength": 128
	}
	}
	},
	"noop": {
	"defaultMax": 1,
	"fields": {
	"message": {
	"required": true,
	"type": "string",
	"sanitize": true,
	"maxLength": 65000
	}
	}
	},
	"report_incomplete": {
	"defaultMax": 5,
	"fields": {
	"details": {
	"type": "string",
	"sanitize": true,
	"maxLength": 65000
	},
	"reason": {
	"required": true,
	"type": "string",
	"sanitize": true,
	"maxLength": 1024
	}
	}
	}
	}
	uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
	with:
	script: \|
	const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
	setupGlobals(core, github, context, exec, io, getOctokit);
	const { main } = require('${{ runner.temp }}/gh-aw/actions/generate_safe_outputs_tools.cjs');
	await main();
	- name: Start MCP Gateway
	id: start-mcp-gateway
	env:
	CODEX_HOME: /tmp/gh-aw/mcp-config
	GH_AW_POLICY_ALLOW_CREATE_PULL_REQUEST: ${{ vars.GH_AW_POLICY_ALLOW_CREATE_PULL_REQUEST \|\| 'true' }}
	GH_AW_SAFE_OUTPUTS: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS }}
	GH_AW_SAFE_OUTPUTS_CONFIG_PATH: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS_CONFIG_PATH }}
	GH_AW_SAFE_OUTPUTS_TOOLS_PATH: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS_TOOLS_PATH }}
	GITHUB_MCP_GUARD_MIN_INTEGRITY: ${{ steps.determine-automatic-lockdown.outputs.min_integrity }}
	GITHUB_MCP_GUARD_REPOS: ${{ steps.determine-automatic-lockdown.outputs.repos }}
	GITHUB_MCP_SERVER_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN \|\| secrets.GH_AW_GITHUB_TOKEN \|\| secrets.GITHUB_TOKEN }}
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
	run: \|
	set -eo pipefail
	mkdir -p "${RUNNER_TEMP}/gh-aw/mcp-config"

	# Export gateway environment variables for MCP config and gateway script
	export MCP_GATEWAY_PORT="8080"
	export MCP_GATEWAY_DOMAIN="awmg-mcpg"
	export MCP_GATEWAY_HOST_DOMAIN="localhost"
	MCP_GATEWAY_API_KEY=$(openssl rand -base64 45 \| tr -d '/+=')
	echo "::add-mask::${MCP_GATEWAY_API_KEY}"
	export MCP_GATEWAY_API_KEY
	export MCP_GATEWAY_PAYLOAD_DIR="/tmp/gh-aw/mcp-payloads"
	mkdir -p "${MCP_GATEWAY_PAYLOAD_DIR}"
	export MCP_GATEWAY_PAYLOAD_SIZE_THRESHOLD="524288"
	export DEBUG="*"

	export GH_AW_ENGINE="codex"
	export GH_AW_MCP_CLI_SERVERS='["safeoutputs"]'
	MCP_GATEWAY_UID=$(id -u 2>/dev/null \|\| echo '0')
	MCP_GATEWAY_GID=$(id -g 2>/dev/null \|\| echo '0')
	case "${DOCKER_HOST:-}" in
	unix://* ) DOCKER_SOCK_PATH="${DOCKER_HOST#unix://}" ;;
	/* ) DOCKER_SOCK_PATH="$DOCKER_HOST" ;;
	* ) DOCKER_SOCK_PATH=/var/run/docker.sock ;;
	esac
	DOCKER_SOCK_GID=$(stat -c '%g' "$DOCKER_SOCK_PATH" 2>/dev/null \|\| echo '0')
	export MCP_GATEWAY_DOCKER_COMMAND='docker run -i --rm --network bridge -p 127.0.0.1:'"${MCP_GATEWAY_PORT}"':'"${MCP_GATEWAY_PORT}"' --name awmg-mcpg --user '"${MCP_GATEWAY_UID}"':'"${MCP_GATEWAY_GID}"' --group-add '"${DOCKER_SOCK_GID}"' -v '"${DOCKER_SOCK_PATH}"':/var/run/docker.sock -e MCP_GATEWAY_PORT -e MCP_GATEWAY_DOMAIN -e MCP_GATEWAY_API_KEY -e MCP_GATEWAY_PAYLOAD_DIR -e MCP_GATEWAY_PAYLOAD_SIZE_THRESHOLD -e DOCKER_HOST=unix:///var/run/docker.sock -e DEBUG -e MCP_GATEWAY_LOG_DIR -e GH_AW_MCP_LOG_DIR -e GH_AW_SAFE_OUTPUTS -e GH_AW_SAFE_OUTPUTS_CONFIG_PATH -e GH_AW_SAFE_OUTPUTS_TOOLS_PATH -e GH_AW_POLICY_ALLOW_CREATE_PULL_REQUEST -e GH_AW_ASSETS_BRANCH -e GH_AW_ASSETS_MAX_SIZE_KB -e GH_AW_ASSETS_ALLOWED_EXTS -e DEFAULT_BRANCH -e GITHUB_MCP_SERVER_TOKEN -e GITHUB_MCP_GUARD_MIN_INTEGRITY -e GITHUB_MCP_GUARD_REPOS -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e GITHUB_SHA -e GITHUB_WORKSPACE -e GITHUB_TOKEN -e GITHUB_RUN_ID -e GITHUB_RUN_NUMBER -e GITHUB_RUN_ATTEMPT -e GITHUB_JOB -e GITHUB_ACTION -e GITHUB_EVENT_NAME -e GITHUB_EVENT_PATH -e GITHUB_ACTOR -e GITHUB_ACTOR_ID -e GITHUB_TRIGGERING_ACTOR -e GITHUB_WORKFLOW -e GITHUB_WORKFLOW_REF -e GITHUB_WORKFLOW_SHA -e GITHUB_REF -e GITHUB_REF_NAME -e GITHUB_REF_TYPE -e GITHUB_HEAD_REF -e GITHUB_BASE_REF -e RUNNER_TEMP -e GITHUB_AW_OTEL_TRACE_ID -e GITHUB_AW_OTEL_PARENT_SPAN_ID -e OTEL_EXPORTER_OTLP_HEADERS -e CODEX_HOME -v /tmp/gh-aw/mcp-payloads:/tmp/gh-aw/mcp-payloads:rw -v /opt:/opt:ro -v /tmp:/tmp:rw -v '"${GITHUB_WORKSPACE}"':'"${GITHUB_WORKSPACE}"':rw -v '"${RUNNER_TEMP}"'/gh-aw/safeoutputs:'"${RUNNER_TEMP}"'/gh-aw/safeoutputs:rw ghcr.io/github/gh-aw-mcpg:v0.3.32'

	cat > "${RUNNER_TEMP}/gh-aw/mcp-config/config.toml" << GH_AW_MCP_CONFIG_e72db90f59787040_EOF
	[history]
	persistence = "none"

	[shell_environment_policy]
	inherit = "core"
	include_only = ["^CODEX_API_KEY$", "^GH_AW_ASSETS_ALLOWED_EXTS$", "^GH_AW_ASSETS_BRANCH$", "^GH_AW_ASSETS_MAX_SIZE_KB$", "^GH_AW_SAFE_OUTPUTS$", "^GITHUB_PERSONAL_ACCESS_TOKEN$", "^GITHUB_REPOSITORY$", "^GITHUB_SERVER_URL$", "^HOME$", "^OPENAI_API_KEY$", "^PATH$"]

	[mcp_servers.github]
	user_agent = "schema-feature-coverage-checker"
	startup_timeout_sec = 120
	tool_timeout_sec = 60
	url = "https://api.githubcopilot.com/mcp-readonly/"
	bearer_token_env_var = "GH_AW_GITHUB_TOKEN"

	[mcp_servers.safeoutputs]
	container = "ghcr.io/github/gh-aw-node"
	mounts = ["\${GITHUB_WORKSPACE}:\${GITHUB_WORKSPACE}:rw", "${RUNNER_TEMP}/gh-aw/safeoutputs:${RUNNER_TEMP}/gh-aw/safeoutputs:rw", "/tmp/gh-aw:/tmp/gh-aw:rw"]
	args = ["-w", "$GITHUB_WORKSPACE"]
	entrypoint = "sh"
	entrypointArgs = ["-c", "sh ${RUNNER_TEMP}/gh-aw/safeoutputs/start_safe_outputs_mcp.sh"]
	env_vars = ["DEBUG", "DEFAULT_BRANCH", "GH_AW_ASSETS_ALLOWED_EXTS", "GH_AW_ASSETS_BRANCH", "GH_AW_ASSETS_MAX_SIZE_KB", "GH_AW_MCP_LOG_DIR", "GH_AW_SAFE_OUTPUTS", "GH_AW_SAFE_OUTPUTS_CONFIG_PATH", "GH_AW_SAFE_OUTPUTS_TOOLS_PATH", "GH_AW_POLICY_ALLOW_CREATE_PULL_REQUEST", "GITHUB_REPOSITORY", "GITHUB_TOKEN", "GITHUB_WORKSPACE", "RUNNER_TEMP"]

	[mcp_servers.safeoutputs."guard-policies"]

	[mcp_servers.safeoutputs."guard-policies".write-sink]
	accept = ["*"]
	GH_AW_MCP_CONFIG_e72db90f59787040_EOF

	# Generate JSON config for MCP gateway
	GH_AW_NODE=$(which node 2>/dev/null \|\| command -v node 2>/dev/null \|\| echo node)
	cat << GH_AW_MCP_CONFIG_e7542607ce3c66e2_EOF \| "$GH_AW_NODE" "${RUNNER_TEMP}/gh-aw/actions/start_mcp_gateway.cjs"
	{
	"mcpServers": {
	"github": {
	"type": "http",
	"url": "https://api.githubcopilot.com/mcp/",
	"headers": {
	"Authorization": "Bearer $GITHUB_MCP_SERVER_TOKEN",
	"X-MCP-Readonly": "true",
	"X-MCP-Toolsets": "context,repos,issues,pull_requests"
	},
	"guard-policies": {
	"allow-only": {
	"min-integrity": "$GITHUB_MCP_GUARD_MIN_INTEGRITY",
	"repos": "$GITHUB_MCP_GUARD_REPOS"
	}
	}
	},
	"safeoutputs": {
	"container": "ghcr.io/github/gh-aw-node",
	"mounts": ["\${GITHUB_WORKSPACE}:\${GITHUB_WORKSPACE}:rw", "${RUNNER_TEMP}/gh-aw/safeoutputs:${RUNNER_TEMP}/gh-aw/safeoutputs:rw", "/tmp/gh-aw:/tmp/gh-aw:rw"],
	"args": ["-w", "\${GITHUB_WORKSPACE}"],
	"entrypoint": "sh",
	"entrypointArgs": ["-c", "sh ${RUNNER_TEMP}/gh-aw/safeoutputs/start_safe_outputs_mcp.sh"],
	"env": {
	"DEBUG": "*",
	"DEFAULT_BRANCH": "\${DEFAULT_BRANCH}",
	"GH_AW_ASSETS_ALLOWED_EXTS": "\${GH_AW_ASSETS_ALLOWED_EXTS}",
	"GH_AW_ASSETS_BRANCH": "\${GH_AW_ASSETS_BRANCH}",
	"GH_AW_ASSETS_MAX_SIZE_KB": "\${GH_AW_ASSETS_MAX_SIZE_KB}",
	"GH_AW_MCP_LOG_DIR": "\${GH_AW_MCP_LOG_DIR}",
	"GH_AW_SAFE_OUTPUTS": "\${GH_AW_SAFE_OUTPUTS}",
	"GH_AW_SAFE_OUTPUTS_CONFIG_PATH": "\${GH_AW_SAFE_OUTPUTS_CONFIG_PATH}",
	"GH_AW_SAFE_OUTPUTS_TOOLS_PATH": "\${GH_AW_SAFE_OUTPUTS_TOOLS_PATH}",
	"GH_AW_POLICY_ALLOW_CREATE_PULL_REQUEST": "\${GH_AW_POLICY_ALLOW_CREATE_PULL_REQUEST}",
	"GITHUB_REPOSITORY": "\${GITHUB_REPOSITORY}",
	"GITHUB_TOKEN": "\${GITHUB_TOKEN}",
	"GITHUB_WORKSPACE": "\${GITHUB_WORKSPACE}",
	"RUNNER_TEMP": "\${RUNNER_TEMP}"
	},
	"guard-policies": {
	"write-sink": {
	"accept": [
	"*"
	]
	}
	}
	}
	},
	"gateway": {
	"port": $MCP_GATEWAY_PORT,
	"domain": "${MCP_GATEWAY_DOMAIN}",
	"apiKey": "${MCP_GATEWAY_API_KEY}",
	"payloadDir": "${MCP_GATEWAY_PAYLOAD_DIR}",
	"opentelemetry": {
	"endpoint": "${OTEL_EXPORTER_OTLP_ENDPOINT}",
	"traceId": "${GITHUB_AW_OTEL_TRACE_ID}",
	"spanId": "${GITHUB_AW_OTEL_PARENT_SPAN_ID}"
	}
	}
	}
	GH_AW_MCP_CONFIG_e7542607ce3c66e2_EOF

	# Sync converter output to writable CODEX_HOME for Codex
	mkdir -p /tmp/gh-aw/mcp-config
	cat > "/tmp/gh-aw/mcp-config/config.toml" << GH_AW_CODEX_SHELL_POLICY_47d4538748fe3213_EOF

	model_provider = "openai-proxy"

	[model_providers.openai-proxy]
	name = "OpenAI AWF proxy"
	base_url = "http://172.30.0.30:10000"
	env_key = "OPENAI_API_KEY"
	supports_websockets = false
	[shell_environment_policy]
	inherit = "core"
	include_only = ["^CODEX_API_KEY$", "^GH_AW_ASSETS_ALLOWED_EXTS$", "^GH_AW_ASSETS_BRANCH$", "^GH_AW_ASSETS_MAX_SIZE_KB$", "^GH_AW_SAFE_OUTPUTS$", "^GITHUB_PERSONAL_ACCESS_TOKEN$", "^GITHUB_REPOSITORY$", "^GITHUB_SERVER_URL$", "^HOME$", "^OPENAI_API_KEY$", "^PATH$"]
	GH_AW_CODEX_SHELL_POLICY_47d4538748fe3213_EOF
	awk '
	BEGIN { skip_openai_proxy = 0 }
	/^[[:space:]]model_provider[[:space:]]=/ { next }
	/^\[model_providers\.openai-proxy\][[:space:]]*$/ { skip_openai_proxy = 1; next }
	/^\[/ { skip_openai_proxy = 0 }
	!skip_openai_proxy { print }
	' "${RUNNER_TEMP}/gh-aw/mcp-config/config.toml" >> "/tmp/gh-aw/mcp-config/config.toml"
	chmod 600 "/tmp/gh-aw/mcp-config/config.toml"
	mkdir -p "${CODEX_HOME}"
	if [ "/tmp/gh-aw/mcp-config/config.toml" != "${CODEX_HOME}/config.toml" ]; then cp "/tmp/gh-aw/mcp-config/config.toml" "${CODEX_HOME}/config.toml"; fi
	chmod 600 "${CODEX_HOME}/config.toml"
	- name: Mount MCP servers as CLIs
	id: mount-mcp-clis
	continue-on-error: true
	env:
	MCP_GATEWAY_API_KEY: ${{ steps.start-mcp-gateway.outputs.gateway-api-key }}
	MCP_GATEWAY_DOMAIN: ${{ steps.start-mcp-gateway.outputs.gateway-domain }}
	MCP_GATEWAY_PORT: ${{ steps.start-mcp-gateway.outputs.gateway-port }}
	uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
	with:
	script: \|
	const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
	setupGlobals(core, github, context, exec, io);
	const { main } = require('${{ runner.temp }}/gh-aw/actions/mount_mcp_as_cli.cjs');
	await main();
	- name: Clean credentials
	continue-on-error: true
	run: bash "${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh"
	- name: Audit pre-agent workspace
	id: pre_agent_audit
	continue-on-error: true
	run: bash "${RUNNER_TEMP}/gh-aw/actions/audit_pre_agent_workspace.sh"
	- name: Execute Codex CLI
	id: agentic_execution
	run: \|
	set -o pipefail
	printf '%s' "$(date +%s%3N)" > /tmp/gh-aw/agent_cli_start_ms.txt
	mkdir -p "$CODEX_HOME/logs" && touch /tmp/gh-aw/agent-step-summary.md
	(umask 177 && touch /tmp/gh-aw/agent-stdio.log)
	GH_AW_MAX_AI_CREDITS="${{ vars.GH_AW_DEFAULT_MAX_AI_CREDITS \|\| '1000' }}"
	printf '%s\n' "{\"\$schema\":\"https://github.com/github/gh-aw-firewall/releases/download/v0.27.13/awf-config.schema.json\",\"network\":{\"allowDomains\":[\".githubusercontent.com\",\".grafana.net\",\".sentry.io\",\"172.30.0.1\",\"api.github.com\",\"api.githubcopilot.com\",\"api.openai.com\",\"api.snapcraft.io\",\"archive.ubuntu.com\",\"azure.archive.ubuntu.com\",\"chatgpt.com\",\"codeload.github.com\",\"crl.geotrust.com\",\"crl.globalsign.com\",\"crl.identrust.com\",\"crl.sectigo.com\",\"crl.thawte.com\",\"crl.usertrust.com\",\"crl.verisign.com\",\"crl3.digicert.com\",\"crl4.digicert.com\",\"crls.ssl.com\",\"docs.github.com\",\"github-cloud.githubusercontent.com\",\"github-cloud.s3.amazonaws.com\",\"github.blog\",\"github.com\",\"github.githubassets.com\",\"host.docker.internal\",\"json-schema.org\",\"json.schemastore.org\",\"keyserver.ubuntu.com\",\"lfs.github.com\",\"objects.githubusercontent.com\",\"ocsp.digicert.com\",\"ocsp.geotrust.com\",\"ocsp.globalsign.com\",\"ocsp.identrust.com\",\"ocsp.sectigo.com\",\"ocsp.ssl.com\",\"ocsp.thawte.com\",\"ocsp.usertrust.com\",\"ocsp.verisign.com\",\"openai.com\",\"packagecloud.io\",\"packages.cloud.google.com\",\"packages.microsoft.com\",\"patch-diff.githubusercontent.com\",\"patchdiff.githubusercontent.com\",\"ppa.launchpad.net\",\"raw.githubusercontent.com\",\"s.symcb.com\",\"s.symcd.com\",\"security.ubuntu.com\",\"ts-crl.ws.symantec.com\",\"ts-ocsp.ws.symantec.com\",\"www.googleapis.com\"],\"isolation\":true,\"topologyAttach\":[\"awmg-mcpg\"]},\"apiProxy\":{\"enabled\":true,\"enableTokenSteering\":true,\"maxRuns\":500,\"maxAiCredits\":${GH_AW_MAX_AI_CREDITS},\"maxCacheMisses\":5,\"models\":{\"agent\":[\"sonnet-6x\",\"gpt-5.5\",\"gpt-5.4\",\"gpt-5.3\",\"gemini-pro\",\"any\"],\"antigravity\":[\"copilot/antigravity\",\"google/antigravity\",\"gemini/antigravity\"],\"any\":[\"copilot/\",\"anthropic/\",\"openai/\",\"google/\",\"gemini/\"],\"claude\":[\"agent\"],\"codex\":[\"agent\"],\"coding\":[\"copilot/gpt-5codex\",\"openai/gpt-5codex\",\"gpt-5-codex\"],\"computer-use\":[\"copilot/computer-use\",\"google/computer-use\",\"gemini/computer-use\",\"openai/computer-use\"],\"copilot\":[\"agent\"],\"deep-research\":[\"copilot/deep-research\",\"copilot/o3-deep-research\",\"copilot/o4-mini-deep-research\",\"google/deep-research\",\"gemini/deep-research\",\"openai/o3-deep-research\",\"openai/o4-mini-deep-research\"],\"gemini\":[\"agent\"],\"gemini-3-flash\":[\"copilot/gemini-3flash\",\"google/gemini-3flash\",\"gemini/gemini-3flash\"],\"gemini-3-pro\":[\"copilot/gemini-3pro\",\"google/gemini-3pro\",\"google/nano-banana\",\"gemini/gemini-3pro\"],\"gemini-3.1-flash\":[\"copilot/gemini-3.1flash\",\"google/gemini-3.1flash\",\"gemini/gemini-3.1flash\"],\"gemini-3.1-pro\":[\"copilot/gemini-3.1pro\",\"google/gemini-3.1pro\",\"gemini/gemini-3.1pro\"],\"gemini-3.5-flash\":[\"copilot/gemini-3.5flash\",\"google/gemini-3.5flash\",\"gemini/gemini-3.5flash\"],\"gemini-flash\":[\"copilot/gemini-flash\",\"google/gemini-flash\",\"gemini/gemini-flash\"],\"gemini-flash-lite\":[\"copilot/gemini-flashlite\",\"google/gemini-flashlite\",\"gemini/gemini-flashlite\"],\"gemini-pro\":[\"copilot/gemini-pro\",\"google/gemini-pro\",\"gemini/gemini-pro\"],\"gemma\":[\"copilot/gemma\",\"google/gemma\",\"gemini/gemma\"],\"gpt-5\":[\"copilot/gpt-5\",\"openai/gpt-5\"],\"gpt-5-codex\":[\"copilot/gpt-5codex\",\"openai/gpt-5codex\"],\"gpt-5-mini\":[\"copilot/gpt-5mini\",\"openai/gpt-5mini\"],\"gpt-5-nano\":[\"copilot/gpt-5nano\",\"openai/gpt-5nano\"],\"gpt-5-pro\":[\"copilot/gpt-5pro\",\"openai/gpt-5pro\"],\"gpt-5.1\":[\"copilot/gpt-5.1\",\"openai/gpt-5.1\"],\"gpt-5.2\":[\"copilot/gpt-5.2\",\"openai/gpt-5.2\"],\"gpt-5.3\":[\"copilot/gpt-5.3\",\"openai/gpt-5.3\"],\"gpt-5.4\":[\"copilot/gpt-5.4\",\"openai/gpt-5.4\"],\"gpt-5.5\":[\"copilot/gpt-5.5\",\"openai/gpt-5.5\"],\"haiku\":[\"copilot/haiku\",\"anthropic/haiku\"],\"image-generation\":[\"copilot/gpt-image\",\"openai/gpt-image\",\"openai/chatgpt-image\",\"copilot/gemini-image\",\"google/gemini-image\",\"gemini/gemini-image\",\"google/imagen\"],\"large\":[\"sonnet\",\"gpt-5-pro\",\"gpt-5\",\"gemini-pro\"],\"mai-code\":[\"copilot/MAI-Code\",\"copilot/mai-code\",\"openai/MAI-Code\"],\"mini\":[\"haiku\",\"gpt-5-mini\",\"gpt-5-nano\",\"gemini-flash-lite\"],\"nano-banana\":[\"copilot/nano-banana\",\"google/nano-banana\",\"gemini/nano-banana\"],\"opus\":[\"copilot/opus\",\"anthropic/opus\"],\"opusplan\":[\"opus?effort=high\"],\"reasoning\":[\"copilot/o1\",\"copilot/o3\",\"copilot/o4\",\"openai/o1\",\"openai/o3\",\"openai/o4\"],\"robotics\":[\"copilot/robotics\",\"google/robotics\",\"gemini/robotics\"],\"small\":[\"mini\"],\"small-agent\":[\"haiku\",\"gpt-5-mini\",\"gemini-flash\"],\"sonnet\":[\"copilot/sonnet\",\"anthropic/sonnet\"],\"sonnet-6x\":[\"copilot/sonnet-4.5\",\"copilot/sonnet-4.6\",\"copilot/sonnet-4-5-\",\"anthropic/sonnet-4-5-\",\"copilot/sonnet-4-6\",\"anthropic/sonnet-4-6\"],\"summarization\":[\"haiku\",\"gpt-5-mini\",\"gemini-flash-lite\",\"mini\"],\"vision\":[\"copilot/gemini-image\",\"google/gemini-image\",\"gemini/gemini-image\",\"copilot/gemini-flash\",\"google/gemini-flash\",\"gemini/gemini-flash*\"]}},\"container\":{\"imageTag\":\"0.27.13,squid=sha256:700b1b5a73098373b04fb684f291e95d9be0124ab559717b04f27acaf8b41bed,agent=sha256:691a06b64961b5b35aac117eaace202fa721e91da19d1d2e22dcdd6663cd571b,agent-act=sha256:676de58a0abad8054cd9d4fc45b861715856819f083a268372d60bca0090018c,api-proxy=sha256:c57febf4aeeefbb4fd96f5b12c07f4279ca55edca6a700032debf9dd0787286e,cli-proxy=sha256:79dfd3a5d139bd1956ba6d7d1782b831a07175cf5afa29c45cb20bb0140f23c5\"}}" > "${RUNNER_TEMP}/gh-aw/awf-config.json"
	cp "${RUNNER_TEMP}/gh-aw/awf-config.json" /tmp/gh-aw/awf-config.json
	export GH_AW_MODELS_JSON_PATH="/tmp/gh-aw/models.json"
	GH_AW_DOCKER_HOST=""
	if [[ "${DOCKER_HOST:-}" =~ ^tcp:// ]]; then
	GH_AW_DOCKER_HOST="${DOCKER_HOST}"
	fi
	GH_AW_DOCKER_HOST_PATH_PREFIX_ARGS=""
	if [[ "${DOCKER_HOST:-}" =~ ^tcp:// ]]; then
	GH_AW_DOCKER_HOST_PATH_PREFIX_ARGS="--docker-host-path-prefix /tmp/gh-aw"
	GH_AW_CHROOT_BINARIES_SOURCE_PATH=/tmp/gh-aw GH_AW_CHROOT_IDENTITY_HOME=/tmp/gh-aw/home node "${RUNNER_TEMP}/gh-aw/actions/patch_awf_chroot_config.cjs"
	fi
	GH_AW_TOOL_CACHE_MOUNT=""
	GH_AW_TOOL_CACHE="${RUNNER_TOOL_CACHE:?RUNNER_TOOL_CACHE must be set}"
	if [ -d "$GH_AW_TOOL_CACHE" ]; then
	if [[ "$GH_AW_TOOL_CACHE" != /opt/* ]]; then
	GH_AW_TOOL_CACHE_MOUNT="$GH_AW_TOOL_CACHE:$GH_AW_TOOL_CACHE:ro"
	fi
	fi
	# shellcheck disable=SC1003,SC2086
	awf --config "${RUNNER_TEMP}/gh-aw/awf-config.json" --container-workdir "${GITHUB_WORKSPACE}" --mount "${RUNNER_TEMP}/gh-aw:${RUNNER_TEMP}/gh-aw:ro" --mount "${RUNNER_TEMP}/gh-aw:/host${RUNNER_TEMP}/gh-aw:ro" ${GH_AW_TOOL_CACHE_MOUNT:+--mount "$GH_AW_TOOL_CACHE_MOUNT"} ${GH_AW_DOCKER_HOST:+--docker-host "$GH_AW_DOCKER_HOST"} ${GH_AW_DOCKER_HOST_PATH_PREFIX_ARGS} --env-all --exclude-env CODEX_API_KEY --exclude-env GITHUB_MCP_SERVER_TOKEN --exclude-env MCP_GATEWAY_API_KEY --exclude-env OPENAI_API_KEY --log-level info --proxy-logs-dir /tmp/gh-aw/sandbox/firewall/logs --audit-dir /tmp/gh-aw/sandbox/firewall/audit --skip-pull \
	-- /bin/bash -c 'set +o histexpand; export PATH="${RUNNER_TEMP}/gh-aw/mcp-cli/bin:$PATH" && : "${RUNNER_TOOL_CACHE:?RUNNER_TOOL_CACHE must be set}"; GH_AW_TOOL_CACHE="$RUNNER_TOOL_CACHE"; export PATH="$(find "$GH_AW_TOOL_CACHE" -maxdepth 5 -type d -name bin 2>/dev/null \| tr '\''\n'\'' '\'':'\'')$PATH"; [ -n "$GOROOT" ] && export PATH="$GOROOT/bin:$PATH" \|\| true && GH_AW_NODE_EXEC="${GH_AW_NODE_BIN:-}"; if [ -z "$GH_AW_NODE_EXEC" ] \|\| [ ! -x "$GH_AW_NODE_EXEC" ]; then GH_AW_NODE_EXEC="$(command -v node 2>/dev/null \|\| true)"; fi; if [ -z "$GH_AW_NODE_EXEC" ]; then echo "node runtime missing on this runner — check runtimes.node in workflow YAML" >&2; exit 127; fi; GH_AW_NPM_GLOBAL_ROOT="$(npm root -g 2>/dev/null \|\| true)"; if [ -n "$GH_AW_NPM_GLOBAL_ROOT" ]; then export NODE_PATH="${GH_AW_NPM_GLOBAL_ROOT}${NODE_PATH:+:${NODE_PATH}}"; fi; "$GH_AW_NODE_EXEC" ${RUNNER_TEMP}/gh-aw/actions/codex_harness.cjs codex exec${GH_AW_MODEL_AGENT_CODEX:+ --model "$GH_AW_MODEL_AGENT_CODEX"} -c web_search="disabled" -c fetch="disabled" --dangerously-bypass-approvals-and-sandbox --skip-git-repo-check --prompt-file /tmp/gh-aw/aw-prompts/prompt.txt' 2>&1 \| tee -a /tmp/gh-aw/agent-stdio.log
	env:
	CODEX_API_KEY: ${{ secrets.CODEX_API_KEY \|\| secrets.OPENAI_API_KEY }}
	CODEX_HOME: /tmp/gh-aw/mcp-config
	GH_AW_MAX_TURNS: ${{ vars.GH_AW_DEFAULT_MAX_TURNS \|\| '' }}
	GH_AW_MCP_CONFIG: ${{ runner.temp }}/gh-aw/mcp-config/config.toml
	GH_AW_MODEL_AGENT_CODEX: ${{ vars.GH_AW_MODEL_AGENT_CODEX \|\| vars.GH_AW_DEFAULT_MODEL_CODEX \|\| 'gpt-5.4' }}
	GH_AW_PHASE: agent
	GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
	GH_AW_SAFE_OUTPUTS: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS }}
	GH_AW_VERSION: dev
	GITHUB_AW: true
	GITHUB_STEP_SUMMARY: /tmp/gh-aw/agent-step-summary.md
	GIT_AUTHOR_EMAIL: github-actions[bot]@users.noreply.github.com
	GIT_AUTHOR_NAME: github-actions[bot]
	GIT_COMMITTER_EMAIL: github-actions[bot]@users.noreply.github.com
	GIT_COMMITTER_NAME: github-actions[bot]
	OPENAI_API_KEY: ${{ secrets.CODEX_API_KEY \|\| secrets.OPENAI_API_KEY }}
	RUNNER_TEMP: ${{ runner.temp }}
	RUST_LOG: ${{ runner.debug == 1 && 'trace,hyper_util=info,mio=info,reqwest=info,os_info=info,codex_otel=warn,codex_core=debug,ocodex_exec=debug' \|\| 'warn' }}
	TRACEPARENT: ${{ env.GITHUB_AW_OTEL_TRACE_ID != '' && env.GITHUB_AW_OTEL_PARENT_SPAN_ID != '' && format('00-{0}-{1}-01', env.GITHUB_AW_OTEL_TRACE_ID, env.GITHUB_AW_OTEL_PARENT_SPAN_ID) \|\| '' }}
	- name: Detect agent errors
	if: always()
	id: detect-agent-errors
	continue-on-error: true
	run: node "${RUNNER_TEMP}/gh-aw/actions/detect_agent_errors.cjs"
	- name: Configure Git credentials
	env:
	GITHUB_REPOSITORY: ${{ github.repository }}
	GITHUB_SERVER_URL: ${{ github.server_url }}
	GITHUB_TOKEN: ${{ github.token }}
	run: bash "${RUNNER_TEMP}/gh-aw/actions/configure_git_credentials.sh"
	- name: Stop MCP Gateway
	if: always()
	continue-on-error: true
	env:
	MCP_GATEWAY_PORT: ${{ steps.start-mcp-gateway.outputs.gateway-port }}
	MCP_GATEWAY_API_KEY: ${{ steps.start-mcp-gateway.outputs.gateway-api-key }}
	GATEWAY_PID: ${{ steps.start-mcp-gateway.outputs.gateway-pid }}
	run: \|
	bash "${RUNNER_TEMP}/gh-aw/actions/stop_mcp_gateway.sh" "$GATEWAY_PID"
	- name: Redact secrets in logs
	if: always()
	uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
	with:
	script: \|
	const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
	setupGlobals(core, github, context, exec, io, getOctokit);
	const { main } = require('${{ runner.temp }}/gh-aw/actions/redact_secrets.cjs');
	await main();
	env:
	GH_AW_SECRET_NAMES: 'CODEX_API_KEY,GH_AW_GITHUB_MCP_SERVER_TOKEN,GH_AW_GITHUB_TOKEN,GITHUB_TOKEN,OPENAI_API_KEY'
	SECRET_CODEX_API_KEY: ${{ secrets.CODEX_API_KEY }}
	SECRET_GH_AW_GITHUB_MCP_SERVER_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN }}
	SECRET_GH_AW_GITHUB_TOKEN: ${{ secrets.GH_AW_GITHUB_TOKEN }}
	SECRET_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
	SECRET_OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
	- name: Append agent step summary
	if: always()
	run: bash "${RUNNER_TEMP}/gh-aw/actions/append_agent_step_summary.sh"
	- name: Copy Safe Outputs
	if: always()
	env:
	GH_AW_SAFE_OUTPUTS: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS }}
	run: \|
	mkdir -p /tmp/gh-aw
	cp "$GH_AW_SAFE_OUTPUTS" /tmp/gh-aw/safeoutputs.jsonl 2>/dev/null \|\| true
	- name: Ingest agent output
	id: collect_output
	if: always()
	uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
	env:
	GH_AW_SAFE_OUTPUTS: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS }}
	GH_AW_ALLOWED_DOMAINS: ".githubusercontent.com,.grafana.net,*.sentry.io,172.30.0.1,api.github.com,api.githubcopilot.com,api.openai.com,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,chatgpt.com,codeload.github.com,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,docs.github.com,github-cloud.githubusercontent.com,github-cloud.s3.amazonaws.com,github.blog,github.com,github.githubassets.com,host.docker.internal,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,lfs.github.com,objects.githubusercontent.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,openai.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,patch-diff.githubusercontent.com,patchdiff.githubusercontent.com,ppa.launchpad.net,raw.githubusercontent.com,s.symcb.com,s.symcd.com,security.ubuntu.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com,www.googleapis.com"
	GITHUB_SERVER_URL: ${{ github.server_url }}
	GITHUB_API_URL: ${{ github.api_url }}
	with:
	script: \|
	const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
	setupGlobals(core, github, context, exec, io, getOctokit);
	const { main } = require('${{ runner.temp }}/gh-aw/actions/collect_ndjson_output.cjs');
	await main();
	- name: Parse agent logs for step summary
	if: always()
	uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
	env:
	GH_AW_AGENT_OUTPUT: /tmp/gh-aw/agent-stdio.log
	with:
	script: \|
	const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
	setupGlobals(core, github, context, exec, io, getOctokit);
	const { main } = require('${{ runner.temp }}/gh-aw/actions/parse_codex_log.cjs');
	await main();
	- name: Parse MCP Gateway logs for step summary
	if: always()
	id: parse-mcp-gateway
	uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
	with:
	script: \|
	const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
	setupGlobals(core, github, context, exec, io, getOctokit);
	const { main } = require('${{ runner.temp }}/gh-aw/actions/parse_mcp_gateway_log.cjs');
	await main();
	- name: Print firewall logs
	if: always()
	continue-on-error: true
	env:
	AWF_LOGS_DIR: /tmp/gh-aw/sandbox/firewall/logs
	run: \|
	# Only run awf logs summary if awf command exists (it may not be installed if workflow failed before install step)
	if command -v awf &> /dev/null; then
	awf logs summary \| tee -a "$GITHUB_STEP_SUMMARY"
	else
	echo 'AWF binary not installed, skipping firewall log summary'
	fi
	- name: Parse token usage for step summary
	if: always()
	continue-on-error: true
	uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
	with:
	script: \|
	const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
	setupGlobals(core, github, context, exec, io, getOctokit);
	const { main } = require('${{ runner.temp }}/gh-aw/actions/parse_token_usage.cjs');
	await main();
	- name: Print AWF reflect summary
	if: always()
	continue-on-error: true
	uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
	with:
	script: \|
	const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
	setupGlobals(core, github, context, exec, io, getOctokit);
	const { main } = require('${{ runner.temp }}/gh-aw/actions/awf_reflect_summary.cjs');
	await main();
	- name: Generate observability summary
	if: always()
	uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
	with:
	script: \|
	const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
	setupGlobals(core, github, context, exec, io, getOctokit);
	const { main } = require('${{ runner.temp }}/gh-aw/actions/generate_observability_summary.cjs');
	await main(core);
	- name: Write agent output placeholder if missing
	if: always()
	run: \|
	if [ ! -f /tmp/gh-aw/agent_output.json ]; then
	echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
	fi
	- name: Upload agent artifacts
	if: always()
	continue-on-error: true
	uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
	with:
	name: agent
	path: \|
	/tmp/gh-aw/aw-prompts/prompt.txt
	/tmp/gh-aw/mcp-config/logs/
	/tmp/gh-aw/redacted-urls.log
	/tmp/gh-aw/mcp-logs/
	/tmp/gh-aw/agent_usage.json
	/tmp/gh-aw/agent-stdio.log
	/tmp/gh-aw/pre-agent-audit.txt
	/tmp/gh-aw/agent/
	/tmp/gh-aw/github_rate_limits.jsonl
	/tmp/gh-aw/otel.jsonl
	/tmp/gh-aw/otlp-export-errors.jsonl
	/tmp/gh-aw/safeoutputs.jsonl
	/tmp/gh-aw/agent_output.json
	/tmp/gh-aw/aw-*.patch
	/tmp/gh-aw/aw-*.bundle
	/tmp/gh-aw/awf-config.json
	/tmp/gh-aw/sandbox/firewall/logs/
	/tmp/gh-aw/sandbox/firewall/audit/
	/tmp/gh-aw/sandbox/firewall/awf-reflect.json
	if-no-files-found: ignore

	conclusion:
	needs:
	- activation
	- agent
	- detection
	- safe_outputs
	if: >
	always() && (needs.agent.result != 'skipped' \|\| needs.activation.outputs.lockdown_check_failed == 'true' \|\|
	needs.activation.outputs.stale_lock_file_failed == 'true' \|\| needs.activation.outputs.daily_ai_credits_exceeded == 'true')
	runs-on: ubuntu-slim
	permissions:
	contents: write
	issues: write
	pull-requests: write
	concurrency:
	group: "gh-aw-conclusion-schema-feature-coverage"
	cancel-in-progress: false
	queue: max
	env:
	GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }}
	outputs:
	incomplete_count: ${{ steps.report_incomplete.outputs.incomplete_count }}
	noop_message: ${{ steps.noop.outputs.noop_message }}
	tools_reported: ${{ steps.missing_tool.outputs.tools_reported }}
	total_count: ${{ steps.missing_tool.outputs.total_count }}
	steps:
	- name: Checkout actions folder
	uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
	with:
	repository: github/gh-aw
	sparse-checkout: \|
	actions
	persist-credentials: false
	- name: Setup Scripts
	id: setup
	uses: ./actions/setup
	with:
	destination: ${{ runner.temp }}/gh-aw/actions
	job-name: ${{ github.job }}
	trace-id: ${{ needs.activation.outputs.setup-trace-id }}
	parent-span-id: ${{ needs.activation.outputs.setup-parent-span-id \|\| needs.activation.outputs.setup-span-id }}
	env:
	GH_AW_SETUP_WORKFLOW_NAME: "Schema Feature Coverage Checker"
	GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/schema-feature-coverage.lock.yml@${{ github.ref }}
	GH_AW_INFO_VERSION: "0.142.3"
	GH_AW_INFO_AWF_VERSION: "v0.27.13"
	GH_AW_INFO_ENGINE_ID: "codex"
	- name: Download agent output artifact
	id: download-agent-output
	continue-on-error: true
	uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
	with:
	name: agent
	path: /tmp/gh-aw/
	- name: Setup agent output environment variable
	id: setup-agent-output-env
	if: steps.download-agent-output.outcome == 'success'
	run: \|
	mkdir -p /tmp/gh-aw/
	find "/tmp/gh-aw/" -type f -print
	echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT"
	- name: Collect usage artifact files
	if: always()
	continue-on-error: true
	run: \|
	mkdir -p /tmp/gh-aw/usage/agent /tmp/gh-aw/usage/detection
	echo "Usage artifact source file status:"
	for file in /tmp/gh-aw/aw_info.json /tmp/gh-aw/aw-info.jsonl /tmp/gh-aw/agent_usage.json /tmp/gh-aw/agent_usage.jsonl /tmp/gh-aw/detection_usage.jsonl /tmp/gh-aw/github_rate_limits.jsonl /tmp/gh-aw/sandbox/firewall-audit-logs/api-proxy-logs/token-usage.jsonl /tmp/gh-aw/sandbox/firewall/logs/api-proxy-logs/token-usage.jsonl /tmp/gh-aw/sandbox/firewall/audit/api-proxy-logs/token-usage.jsonl /tmp/gh-aw/threat-detection/sandbox/firewall-audit-logs/api-proxy-logs/token-usage.jsonl /tmp/gh-aw/threat-detection/sandbox/firewall/logs/api-proxy-logs/token-usage.jsonl /tmp/gh-aw/threat-detection/sandbox/firewall/audit/api-proxy-logs/token-usage.jsonl; do
	[ -f "$file" ] && echo "FOUND: $file" \|\| echo "MISSING: $file"
	done
	[ -f /tmp/gh-aw/aw_info.json ] && cp /tmp/gh-aw/aw_info.json /tmp/gh-aw/usage/aw_info.json \|\| true
	[ -f /tmp/gh-aw/aw-info.jsonl ] && cp /tmp/gh-aw/aw-info.jsonl /tmp/gh-aw/usage/aw-info.jsonl \|\| true
	[ -f /tmp/gh-aw/agent_usage.json ] && cp /tmp/gh-aw/agent_usage.json /tmp/gh-aw/usage/agent_usage.json \|\| true
	[ -f /tmp/gh-aw/agent_usage.jsonl ] && cp /tmp/gh-aw/agent_usage.jsonl /tmp/gh-aw/usage/agent_usage.jsonl \|\| true
	[ -f /tmp/gh-aw/detection_usage.jsonl ] && cp /tmp/gh-aw/detection_usage.jsonl /tmp/gh-aw/usage/detection_usage.jsonl \|\| true
	[ -f /tmp/gh-aw/github_rate_limits.jsonl ] && cp /tmp/gh-aw/github_rate_limits.jsonl /tmp/gh-aw/usage/github_rate_limits.jsonl \|\| true
	[ -s /tmp/gh-aw/sandbox/firewall-audit-logs/api-proxy-logs/token-usage.jsonl ] && cp /tmp/gh-aw/sandbox/firewall-audit-logs/api-proxy-logs/token-usage.jsonl /tmp/gh-aw/usage/agent/token_usage.jsonl \|\| true
	[ -s /tmp/gh-aw/sandbox/firewall/audit/api-proxy-logs/token-usage.jsonl ] && cp /tmp/gh-aw/sandbox/firewall/audit/api-proxy-logs/token-usage.jsonl /tmp/gh-aw/usage/agent/token_usage.jsonl \|\| true
	[ -s /tmp/gh-aw/sandbox/firewall/logs/api-proxy-logs/token-usage.jsonl ] && cp /tmp/gh-aw/sandbox/firewall/logs/api-proxy-logs/token-usage.jsonl /tmp/gh-aw/usage/agent/token_usage.jsonl \|\| true
	[ -s /tmp/gh-aw/threat-detection/sandbox/firewall-audit-logs/api-proxy-logs/token-usage.jsonl ] && cp /tmp/gh-aw/threat-detection/sandbox/firewall-audit-logs/api-proxy-logs/token-usage.jsonl /tmp/gh-aw/usage/detection/token_usage.jsonl \|\| true
	[ -s /tmp/gh-aw/threat-detection/sandbox/firewall/audit/api-proxy-logs/token-usage.jsonl ] && cp /tmp/gh-aw/threat-detection/sandbox/firewall/audit/api-proxy-logs/token-usage.jsonl /tmp/gh-aw/usage/detection/token_usage.jsonl \|\| true
	[ -s /tmp/gh-aw/threat-detection/sandbox/firewall/logs/api-proxy-logs/token-usage.jsonl ] && cp /tmp/gh-aw/threat-detection/sandbox/firewall/logs/api-proxy-logs/token-usage.jsonl /tmp/gh-aw/usage/detection/token_usage.jsonl \|\| true
	[ -f /tmp/gh-aw/usage/agent/token_usage.jsonl ] \|\| : > /tmp/gh-aw/usage/agent/token_usage.jsonl
	[ -f /tmp/gh-aw/usage/detection/token_usage.jsonl ] \|\| : > /tmp/gh-aw/usage/detection/token_usage.jsonl
	mkdir -p /tmp/gh-aw/usage/activity
	node ${RUNNER_TEMP}/gh-aw/actions/generate_usage_activity_summary.cjs
	find /tmp/gh-aw/usage -type f -print \| sort
	- name: Upload usage artifact
	if: always()
	continue-on-error: true
	uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
	with:
	name: usage
	path: \|
	/tmp/gh-aw/usage/aw_info.json
	/tmp/gh-aw/usage/aw-info.jsonl
	/tmp/gh-aw/usage/agent_usage.json
	/tmp/gh-aw/usage/agent_usage.jsonl
	/tmp/gh-aw/usage/detection_usage.jsonl
	/tmp/gh-aw/usage/github_rate_limits.jsonl
	/tmp/gh-aw/usage/agent/token_usage.jsonl
	/tmp/gh-aw/usage/detection/token_usage.jsonl
	/tmp/gh-aw/usage/activity/summary.json
	if-no-files-found: ignore
	- name: Restore daily AIC usage cache
	id: restore-daily-aic-cache-conclusion
	if: always()
	continue-on-error: true
	uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
	with:
	key: agentic-workflow-usage-schemafeaturecoverage-${{ github.run_id }}
	restore-keys: agentic-workflow-usage-schemafeaturecoverage-
	path: /tmp/gh-aw/agentic-workflow-usage-cache.jsonl
	- name: Write daily AIC usage cache entry
	id: write-daily-aic-cache
	if: always()
	continue-on-error: true
	uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
	with:
	github-token: ${{ github.token }}
	script: \|
	const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
	setupGlobals(core, github, context);
	const { main } = require('${{ runner.temp }}/gh-aw/actions/write_daily_aic_usage_cache.cjs');
	await main();
	- name: Save daily AIC usage cache
	id: save-daily-aic-cache
	if: always()
	continue-on-error: true
	uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
	with:
	key: agentic-workflow-usage-schemafeaturecoverage-${{ github.run_id }}
	path: /tmp/gh-aw/agentic-workflow-usage-cache.jsonl
	- name: Upload daily AIC usage cache artifact
	id: upload-daily-aic-cache
	if: always()
	continue-on-error: true
	uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
	with:
	name: aic-usage-cache
	path: /tmp/gh-aw/agentic-workflow-usage-cache.jsonl
	if-no-files-found: ignore
	retention-days: 7
	- name: Process no-op messages
	id: noop
	uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
	env:
	GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }}
	GH_AW_NOOP_MAX: "1"
	GH_AW_WORKFLOW_NAME: "Schema Feature Coverage Checker"
	GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/${{ github.repository }}/blob/${{ github.ref_name }}/.github/workflows/schema-feature-coverage.md"
	GH_AW_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
	GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }}
	GH_AW_NOOP_REPORT_AS_ISSUE: "true"
	GH_AW_AIC: ${{ needs.agent.outputs.aic }}
	GH_AW_THREAT_DETECTION_AIC: ${{ needs.detection.outputs.aic }}
	GH_AW_AMBIENT_CONTEXT: ${{ needs.agent.outputs.ambient_context }}
	GH_AW_WORKFLOW_ID: "schema-feature-coverage"
	with:
	github-token: ${{ secrets.GH_AW_GITHUB_TOKEN \|\| secrets.GITHUB_TOKEN }}
	script: \|
	const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
	setupGlobals(core, github, context, exec, io, getOctokit);
	const { main } = require('${{ runner.temp }}/gh-aw/actions/handle_noop_message.cjs');
	await main();
	- name: Log detection run
	id: detection_runs
	uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
	env:
	GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }}
	GH_AW_WORKFLOW_NAME: "Schema Feature Coverage Checker"
	GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/${{ github.repository }}/blob/${{ github.ref_name }}/.github/workflows/schema-feature-coverage.md"
	GH_AW_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
	GH_AW_DETECTION_CONCLUSION: ${{ needs.detection.outputs.detection_conclusion }}
	GH_AW_DETECTION_REASON: ${{ needs.detection.outputs.detection_reason }}
	with:
	github-token: ${{ secrets.GH_AW_GITHUB_TOKEN \|\| secrets.GITHUB_TOKEN }}
	script: \|
	const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
	setupGlobals(core, github, context, exec, io, getOctokit);
	const { main } = require('${{ runner.temp }}/gh-aw/actions/handle_detection_runs.cjs');
	await main();
	- name: Record missing tool
	id: missing_tool
	uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
	env:
	GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }}
	GH_AW_MISSING_TOOL_CREATE_ISSUE: "true"
	GH_AW_WORKFLOW_NAME: "Schema Feature Coverage Checker"
	GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/${{ github.repository }}/blob/${{ github.ref_name }}/.github/workflows/schema-feature-coverage.md"
	with:
	github-token: ${{ secrets.GH_AW_GITHUB_TOKEN \|\| secrets.GITHUB_TOKEN }}
	script: \|
	const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
	setupGlobals(core, github, context, exec, io, getOctokit);
	const { main } = require('${{ runner.temp }}/gh-aw/actions/missing_tool.cjs');
	await main();
	- name: Record incomplete
	id: report_incomplete
	uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
	env:
	GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }}
	GH_AW_REPORT_INCOMPLETE_CREATE_ISSUE: "true"
	GH_AW_WORKFLOW_NAME: "Schema Feature Coverage Checker"
	GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/${{ github.repository }}/blob/${{ github.ref_name }}/.github/workflows/schema-feature-coverage.md"
	with:
	github-token: ${{ secrets.GH_AW_GITHUB_TOKEN \|\| secrets.GITHUB_TOKEN }}
	script: \|
	const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
	setupGlobals(core, github, context, exec, io, getOctokit);
	const { main } = require('${{ runner.temp }}/gh-aw/actions/report_incomplete_handler.cjs');
	await main();
	- name: Handle agent failure
	id: handle_agent_failure
	if: always()
	uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
	env:
	GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }}
	GH_AW_WORKFLOW_NAME: "Schema Feature Coverage Checker"
	GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/${{ github.repository }}/blob/${{ github.ref_name }}/.github/workflows/schema-feature-coverage.md"
	GH_AW_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
	GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }}
	GH_AW_WORKFLOW_ID: "schema-feature-coverage"
	GH_AW_ACTION_FAILURE_ISSUE_EXPIRES_HOURS: "12"
	GH_AW_ENGINE_ID: "codex"
	GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
	GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
	GH_AW_EFFECTIVE_TOKENS: ${{ needs.agent.outputs.effective_tokens \|\| '' }}
	GH_AW_AI_CREDITS_RATE_LIMIT_ERROR: ${{ needs.agent.outputs.ai_credits_rate_limit_error \|\| 'false' }}
	GH_AW_UNKNOWN_MODEL_AI_CREDITS: ${{ needs.agent.outputs.unknown_model_ai_credits \|\| 'false' }}
	GH_AW_AIC: ${{ needs.agent.outputs.aic }}
	GH_AW_THREAT_DETECTION_AIC: ${{ needs.detection.outputs.aic }}
	GH_AW_MAX_AI_CREDITS: ${{ vars.GH_AW_DEFAULT_MAX_AI_CREDITS \|\| '1000' }}
	GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
	GH_AW_MCP_POLICY_ERROR: ${{ needs.agent.outputs.mcp_policy_error }}
	GH_AW_AGENTIC_ENGINE_TIMEOUT: ${{ needs.agent.outputs.agentic_engine_timeout }}
	GH_AW_MODEL_NOT_SUPPORTED_ERROR: ${{ needs.agent.outputs.model_not_supported_error }}
	GH_AW_ENGINE_API_HOSTS: "api.openai.com"
	GH_AW_CODE_PUSH_FAILURE_ERRORS: ${{ needs.safe_outputs.outputs.code_push_failure_errors }}
	GH_AW_CODE_PUSH_FAILURE_COUNT: ${{ needs.safe_outputs.outputs.code_push_failure_count }}
	GH_AW_LOCKDOWN_CHECK_FAILED: ${{ needs.activation.outputs.lockdown_check_failed }}
	GH_AW_STALE_LOCK_FILE_FAILED: ${{ needs.activation.outputs.stale_lock_file_failed }}
	GH_AW_DAILY_AI_CREDITS_EXCEEDED: ${{ needs.activation.outputs.daily_ai_credits_exceeded }}
	GH_AW_DAILY_AI_CREDITS_TOTAL_EFFECTIVE_TOKENS: ${{ needs.activation.outputs.daily_ai_credits_total_effective_tokens }}
	GH_AW_DAILY_AI_CREDITS_THRESHOLD: ${{ needs.activation.outputs.daily_ai_credits_threshold }}
	GH_AW_GROUP_REPORTS: "false"
	GH_AW_FAILURE_REPORT_AS_ISSUE: "true"
	GH_AW_MISSING_TOOL_REPORT_AS_FAILURE: "true"
	GH_AW_MISSING_DATA_REPORT_AS_FAILURE: "true"
	GH_AW_TIMEOUT_MINUTES: "30"
	with:
	github-token: ${{ secrets.GH_AW_GITHUB_TOKEN \|\| secrets.GITHUB_TOKEN }}
	script: \|
	const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
	setupGlobals(core, github, context, exec, io, getOctokit);
	const { main } = require('${{ runner.temp }}/gh-aw/actions/handle_agent_failure.cjs');
	await main();

	detection:
	needs:
	- activation
	- agent
	if: always() && needs.agent.result != 'skipped'
	runs-on: ubuntu-latest
	permissions:
	contents: read
	env:
	GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }}
	outputs:
	aic: ${{ steps.parse_detection_token_usage.outputs.aic }}
	detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
	detection_reason: ${{ steps.detection_conclusion.outputs.reason }}
	detection_success: ${{ steps.detection_conclusion.outputs.success }}
	steps:
	- name: Checkout actions folder
	uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
	with:
	repository: github/gh-aw
	sparse-checkout: \|
	actions
	persist-credentials: false
	- name: Setup Scripts
	id: setup
	uses: ./actions/setup
	with:
	destination: ${{ runner.temp }}/gh-aw/actions
	job-name: ${{ github.job }}
	trace-id: ${{ needs.activation.outputs.setup-trace-id }}
	parent-span-id: ${{ needs.activation.outputs.setup-parent-span-id \|\| needs.activation.outputs.setup-span-id }}
	env:
	GH_AW_SETUP_WORKFLOW_NAME: "Schema Feature Coverage Checker"
	GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/schema-feature-coverage.lock.yml@${{ github.ref }}
	GH_AW_INFO_VERSION: "0.142.3"
	GH_AW_INFO_AWF_VERSION: "v0.27.13"
	GH_AW_INFO_ENGINE_ID: "codex"
	- name: Download agent output artifact
	id: download-agent-output
	continue-on-error: true
	uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
	with:
	name: agent
	path: /tmp/gh-aw/
	- name: Setup agent output environment variable
	id: setup-agent-output-env
	if: steps.download-agent-output.outcome == 'success'
	run: \|
	mkdir -p /tmp/gh-aw/
	find "/tmp/gh-aw/" -type f -print
	echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT"
	- name: Checkout repository for patch context
	if: needs.agent.outputs.has_patch == 'true'
	uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
	with:
	persist-credentials: false
	# --- Threat Detection ---
	- name: Clean stale firewall files from agent artifact
	run: \|
	rm -rf /tmp/gh-aw/sandbox/firewall/logs
	rm -rf /tmp/gh-aw/sandbox/firewall/audit
	- name: Check if detection needed
	id: detection_guard
	if: always()
	env:
	OUTPUT_TYPES: ${{ needs.agent.outputs.output_types }}
	HAS_PATCH: ${{ needs.agent.outputs.has_patch }}
	run: \|
	if [[ -n "$OUTPUT_TYPES" \|\| "$HAS_PATCH" == "true" ]]; then
	echo "run_detection=true" >> "$GITHUB_OUTPUT"
	echo "Detection will run: output_types=$OUTPUT_TYPES, has_patch=$HAS_PATCH"
	else
	echo "run_detection=false" >> "$GITHUB_OUTPUT"
	echo "Detection skipped: no agent outputs or patches to analyze"
	fi
	- name: Clear MCP Config for detection
	if: always() && steps.detection_guard.outputs.run_detection == 'true'
	run: \|
	rm -f "${RUNNER_TEMP}/gh-aw/mcp-config/mcp-servers.json"
	rm -f "$HOME/.copilot/mcp-config.json"
	rm -f "$GITHUB_WORKSPACE/.gemini/settings.json"
	- name: Prepare threat detection files
	if: always() && steps.detection_guard.outputs.run_detection == 'true'
	run: \|
	mkdir -p /tmp/gh-aw/threat-detection/aw-prompts
	rm -f /tmp/gh-aw/agent_usage.json
	cp /tmp/gh-aw/aw-prompts/prompt.txt /tmp/gh-aw/threat-detection/aw-prompts/prompt.txt 2>/dev/null \|\| true
	if [ ! -s /tmp/gh-aw/threat-detection/aw-prompts/prompt.txt ]; then
	echo "::warning::ERR_VALIDATION: Missing or empty detection context prompt at /tmp/gh-aw/threat-detection/aw-prompts/prompt.txt. Ensure the agent artifact includes /tmp/gh-aw/aw-prompts/prompt.txt. Detection will continue with fallback workflow context."
	fi
	cp /tmp/gh-aw/agent_output.json /tmp/gh-aw/threat-detection/agent_output.json 2>/dev/null \|\| true
	for f in /tmp/gh-aw/aw-*.patch; do
	[ -f "$f" ] && cp "$f" /tmp/gh-aw/threat-detection/ 2>/dev/null \|\| true
	done
	for f in /tmp/gh-aw/aw-*.bundle; do
	[ -f "$f" ] && cp "$f" /tmp/gh-aw/threat-detection/ 2>/dev/null \|\| true
	done
	echo "Prepared threat detection files:"
	ls -la /tmp/gh-aw/threat-detection/ 2>/dev/null \|\| true
	- name: Setup threat detection
	if: always() && steps.detection_guard.outputs.run_detection == 'true'
	uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
	env:
	WORKFLOW_NAME: "Schema Feature Coverage Checker"
	WORKFLOW_DESCRIPTION: "Ensures 100% schema feature coverage across existing agentic workflows by creating PRs for any uncovered fields"
	HAS_PATCH: ${{ needs.agent.outputs.has_patch }}
	with:
	script: \|
	const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
	setupGlobals(core, github, context, exec, io, getOctokit);
	const { main } = require('${{ runner.temp }}/gh-aw/actions/setup_threat_detection.cjs');
	await main();
	- name: Ensure threat-detection directory and log
	if: always() && steps.detection_guard.outputs.run_detection == 'true'
	run: \|
	mkdir -p /tmp/gh-aw/threat-detection
	touch /tmp/gh-aw/threat-detection/detection.log
	- name: Setup Node.js
	uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
	with:
	node-version: '24'
	package-manager-cache: false
	- name: Install Codex CLI
	run: npm install --ignore-scripts -g @openai/codex@0.142.3
	- name: Install AWF binary
	run: bash "${RUNNER_TEMP}/gh-aw/actions/install_awf_binary.sh" v0.27.13
	- name: Download container images
	run: bash "${RUNNER_TEMP}/gh-aw/actions/download_docker_images.sh" ghcr.io/github/gh-aw-firewall/agent:0.27.13@sha256:691a06b64961b5b35aac117eaace202fa721e91da19d1d2e22dcdd6663cd571b ghcr.io/github/gh-aw-firewall/api-proxy:0.27.13@sha256:c57febf4aeeefbb4fd96f5b12c07f4279ca55edca6a700032debf9dd0787286e ghcr.io/github/gh-aw-firewall/squid:0.27.13@sha256:700b1b5a73098373b04fb684f291e95d9be0124ab559717b04f27acaf8b41bed ghcr.io/github/gh-aw-mcpg:v0.3.32@sha256:63e46b56dfd70895a701b6fc6dd0189e11e2d875f327f1781e81b31848735477
	- name: Start MCP Gateway
	id: start-mcp-gateway
	env:
	CODEX_HOME: /tmp/gh-aw/mcp-config
	run: \|
	set -eo pipefail
	mkdir -p "${RUNNER_TEMP}/gh-aw/mcp-config"

	# Export gateway environment variables for MCP config and gateway script
	export MCP_GATEWAY_PORT="8080"
	export MCP_GATEWAY_DOMAIN="host.docker.internal"
	export MCP_GATEWAY_HOST_DOMAIN="localhost"
	MCP_GATEWAY_API_KEY=$(openssl rand -base64 45 \| tr -d '/+=')
	echo "::add-mask::${MCP_GATEWAY_API_KEY}"
	export MCP_GATEWAY_API_KEY
	export MCP_GATEWAY_PAYLOAD_DIR="/tmp/gh-aw/mcp-payloads"
	mkdir -p "${MCP_GATEWAY_PAYLOAD_DIR}"
	export MCP_GATEWAY_PAYLOAD_SIZE_THRESHOLD="524288"
	export DEBUG="*"

	export GH_AW_ENGINE="codex"
	MCP_GATEWAY_UID=$(id -u 2>/dev/null \|\| echo '0')
	MCP_GATEWAY_GID=$(id -g 2>/dev/null \|\| echo '0')
	case "${DOCKER_HOST:-}" in
	unix://* ) DOCKER_SOCK_PATH="${DOCKER_HOST#unix://}" ;;
	/* ) DOCKER_SOCK_PATH="$DOCKER_HOST" ;;
	* ) DOCKER_SOCK_PATH=/var/run/docker.sock ;;
	esac
	DOCKER_SOCK_GID=$(stat -c '%g' "$DOCKER_SOCK_PATH" 2>/dev/null \|\| echo '0')
	export MCP_GATEWAY_DOCKER_COMMAND='docker run -i --rm --network host --name awmg-mcpg --add-host host.docker.internal:127.0.0.1 --user '"${MCP_GATEWAY_UID}"':'"${MCP_GATEWAY_GID}"' --group-add '"${DOCKER_SOCK_GID}"' -v '"${DOCKER_SOCK_PATH}"':/var/run/docker.sock -e MCP_GATEWAY_PORT -e MCP_GATEWAY_DOMAIN -e MCP_GATEWAY_API_KEY -e MCP_GATEWAY_PAYLOAD_DIR -e MCP_GATEWAY_PAYLOAD_SIZE_THRESHOLD -e DOCKER_HOST=unix:///var/run/docker.sock -e DEBUG -e MCP_GATEWAY_LOG_DIR -e GH_AW_MCP_LOG_DIR -e GH_AW_SAFE_OUTPUTS -e GH_AW_SAFE_OUTPUTS_CONFIG_PATH -e GH_AW_SAFE_OUTPUTS_TOOLS_PATH -e GH_AW_POLICY_ALLOW_CREATE_PULL_REQUEST -e GH_AW_ASSETS_BRANCH -e GH_AW_ASSETS_MAX_SIZE_KB -e GH_AW_ASSETS_ALLOWED_EXTS -e DEFAULT_BRANCH -e GITHUB_MCP_SERVER_TOKEN -e GITHUB_MCP_GUARD_MIN_INTEGRITY -e GITHUB_MCP_GUARD_REPOS -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e GITHUB_SHA -e GITHUB_WORKSPACE -e GITHUB_TOKEN -e GITHUB_RUN_ID -e GITHUB_RUN_NUMBER -e GITHUB_RUN_ATTEMPT -e GITHUB_JOB -e GITHUB_ACTION -e GITHUB_EVENT_NAME -e GITHUB_EVENT_PATH -e GITHUB_ACTOR -e GITHUB_ACTOR_ID -e GITHUB_TRIGGERING_ACTOR -e GITHUB_WORKFLOW -e GITHUB_WORKFLOW_REF -e GITHUB_WORKFLOW_SHA -e GITHUB_REF -e GITHUB_REF_NAME -e GITHUB_REF_TYPE -e GITHUB_HEAD_REF -e GITHUB_BASE_REF -e RUNNER_TEMP -e CODEX_HOME -v /tmp/gh-aw/mcp-payloads:/tmp/gh-aw/mcp-payloads:rw -v /opt:/opt:ro -v /tmp:/tmp:rw -v '"${GITHUB_WORKSPACE}"':'"${GITHUB_WORKSPACE}"':rw -v '"${RUNNER_TEMP}"'/gh-aw/safeoutputs:'"${RUNNER_TEMP}"'/gh-aw/safeoutputs:rw ghcr.io/github/gh-aw-mcpg:v0.3.32'

	cat > "${RUNNER_TEMP}/gh-aw/mcp-config/config.toml" << GH_AW_MCP_CONFIG_2f5d9885311152cf_EOF
	[history]
	persistence = "none"

	[shell_environment_policy]
	inherit = "core"
	include_only = ["^CODEX_API_KEY$", "^HOME$", "^OPENAI_API_KEY$", "^PATH$"]
	GH_AW_MCP_CONFIG_2f5d9885311152cf_EOF

	# Generate JSON config for MCP gateway
	GH_AW_NODE=$(which node 2>/dev/null \|\| command -v node 2>/dev/null \|\| echo node)
	cat << GH_AW_MCP_CONFIG_b9b3d113c1a9458e_EOF \| "$GH_AW_NODE" "${RUNNER_TEMP}/gh-aw/actions/start_mcp_gateway.cjs"
	{
	"mcpServers": {
	},
	"gateway": {
	"port": $MCP_GATEWAY_PORT,
	"domain": "${MCP_GATEWAY_DOMAIN}",
	"apiKey": "${MCP_GATEWAY_API_KEY}",
	"payloadDir": "${MCP_GATEWAY_PAYLOAD_DIR}"
	}
	}
	GH_AW_MCP_CONFIG_b9b3d113c1a9458e_EOF

	# Sync converter output to writable CODEX_HOME for Codex
	mkdir -p /tmp/gh-aw/mcp-config
	cat > "/tmp/gh-aw/mcp-config/config.toml" << GH_AW_CODEX_SHELL_POLICY_f48e0018706875a8_EOF
	model_provider = "openai-proxy"
	[model_providers.openai-proxy]
	name = "OpenAI AWF proxy"
	base_url = "http://172.30.0.30:10000"
	env_key = "OPENAI_API_KEY"
	supports_websockets = false
	[shell_environment_policy]
	inherit = "core"
	include_only = ["^CODEX_API_KEY$", "^HOME$", "^OPENAI_API_KEY$", "^PATH$"]
	GH_AW_CODEX_SHELL_POLICY_f48e0018706875a8_EOF
	awk '
	BEGIN { skip_openai_proxy = 0 }
	/^[[:space:]]model_provider[[:space:]]=/ { next }
	/^\[model_providers\.openai-proxy\][[:space:]]*$/ { skip_openai_proxy = 1; next }
	/^\[/ { skip_openai_proxy = 0 }
	!skip_openai_proxy { print }
	' "${RUNNER_TEMP}/gh-aw/mcp-config/config.toml" >> "/tmp/gh-aw/mcp-config/config.toml"
	chmod 600 "/tmp/gh-aw/mcp-config/config.toml"
	mkdir -p "${CODEX_HOME}"
	if [ "/tmp/gh-aw/mcp-config/config.toml" != "${CODEX_HOME}/config.toml" ]; then cp "/tmp/gh-aw/mcp-config/config.toml" "${CODEX_HOME}/config.toml"; fi
	chmod 600 "${CODEX_HOME}/config.toml"
	- name: Execute Codex CLI
	if: always() && steps.detection_guard.outputs.run_detection == 'true'
	continue-on-error: true
	id: detection_agentic_execution
	run: \|
	set -o pipefail
	printf '%s' "$(date +%s%3N)" > /tmp/gh-aw/agent_cli_start_ms.txt
	mkdir -p "$CODEX_HOME/logs" && touch /tmp/gh-aw/agent-step-summary.md && mkdir -p /tmp/gh-aw/threat-detection && printf '%s' '{"type":"object","properties":{"prompt_injection":{"type":"boolean"},"secret_leak":{"type":"boolean"},"malicious_patch":{"type":"boolean"},"reasons":{"type":"array","items":{"type":"string"}}},"required":["prompt_injection","secret_leak","malicious_patch","reasons"],"additionalProperties":false}' > /tmp/gh-aw/threat-detection/detection_schema.json
	(umask 177 && touch /tmp/gh-aw/threat-detection/detection.log)
	GH_AW_MAX_AI_CREDITS="${{ vars.GH_AW_DEFAULT_DETECTION_MAX_AI_CREDITS \|\| '400' }}"
	printf '%s\n' "{\"\$schema\":\"https://github.com/github/gh-aw-firewall/releases/download/v0.27.13/awf-config.schema.json\",\"network\":{\"allowDomains\":[\"172.30.0.1\",\"api.github.com\",\"api.openai.com\",\"chatgpt.com\",\"github.com\",\"host.docker.internal\",\"openai.com\"]},\"apiProxy\":{\"enabled\":true,\"enableTokenSteering\":true,\"maxRuns\":500,\"maxAiCredits\":${GH_AW_MAX_AI_CREDITS},\"maxCacheMisses\":5},\"container\":{\"imageTag\":\"0.27.13,squid=sha256:700b1b5a73098373b04fb684f291e95d9be0124ab559717b04f27acaf8b41bed,agent=sha256:691a06b64961b5b35aac117eaace202fa721e91da19d1d2e22dcdd6663cd571b,agent-act=sha256:676de58a0abad8054cd9d4fc45b861715856819f083a268372d60bca0090018c,api-proxy=sha256:c57febf4aeeefbb4fd96f5b12c07f4279ca55edca6a700032debf9dd0787286e,cli-proxy=sha256:79dfd3a5d139bd1956ba6d7d1782b831a07175cf5afa29c45cb20bb0140f23c5\"}}" > "${RUNNER_TEMP}/gh-aw/awf-config.json"
	cp "${RUNNER_TEMP}/gh-aw/awf-config.json" /tmp/gh-aw/awf-config.json
	export GH_AW_MODELS_JSON_PATH="/tmp/gh-aw/models.json"
	GH_AW_DOCKER_HOST=""
	if [[ "${DOCKER_HOST:-}" =~ ^tcp:// ]]; then
	GH_AW_DOCKER_HOST="${DOCKER_HOST}"
	fi
	GH_AW_DOCKER_HOST_PATH_PREFIX_ARGS=""
	if [[ "${DOCKER_HOST:-}" =~ ^tcp:// ]]; then
	GH_AW_DOCKER_HOST_PATH_PREFIX_ARGS="--docker-host-path-prefix /tmp/gh-aw"
	_GH_AW_CHROOT_JSON=$(jq -c --arg src /tmp/gh-aw --arg user "$(id -un)" --argjson uid "$(id -u)" --argjson gid "$(id -g)" --arg home /tmp/gh-aw/home '.chroot={"binariesSourcePath":$src,"identity":{"user":$user,"uid":$uid,"gid":$gid,"home":$home}}' "${RUNNER_TEMP}/gh-aw/awf-config.json") \|\| { echo "chroot config patch failed" >&2; exit 1; }
	printf '%s\n' "$_GH_AW_CHROOT_JSON" > "${RUNNER_TEMP}/gh-aw/awf-config.json"
	printf '%s\n' "$_GH_AW_CHROOT_JSON" > "/tmp/gh-aw/awf-config.json"
	fi
	GH_AW_TOOL_CACHE_MOUNT=""
	GH_AW_TOOL_CACHE="${RUNNER_TOOL_CACHE:?RUNNER_TOOL_CACHE must be set}"
	if [ -d "$GH_AW_TOOL_CACHE" ]; then
	if [[ "$GH_AW_TOOL_CACHE" != /opt/* ]]; then
	GH_AW_TOOL_CACHE_MOUNT="$GH_AW_TOOL_CACHE:$GH_AW_TOOL_CACHE:ro"
	fi
	fi
	# shellcheck disable=SC1003,SC2086
	sudo -E awf --config "${RUNNER_TEMP}/gh-aw/awf-config.json" --container-workdir "${GITHUB_WORKSPACE}" --mount "${RUNNER_TEMP}/gh-aw:${RUNNER_TEMP}/gh-aw:ro" --mount "${RUNNER_TEMP}/gh-aw:/host${RUNNER_TEMP}/gh-aw:ro" ${GH_AW_TOOL_CACHE_MOUNT:+--mount "$GH_AW_TOOL_CACHE_MOUNT"} ${GH_AW_DOCKER_HOST:+--docker-host "$GH_AW_DOCKER_HOST"} ${GH_AW_DOCKER_HOST_PATH_PREFIX_ARGS} --env-all --exclude-env CODEX_API_KEY --exclude-env OPENAI_API_KEY --log-level info --proxy-logs-dir /tmp/gh-aw/sandbox/firewall/logs --audit-dir /tmp/gh-aw/sandbox/firewall/audit --enable-host-access --allow-host-ports 80,443,8080 --skip-pull \
	-- /bin/bash -c 'set +o histexpand; : "${RUNNER_TOOL_CACHE:?RUNNER_TOOL_CACHE must be set}"; GH_AW_TOOL_CACHE="$RUNNER_TOOL_CACHE"; export PATH="$(find "$GH_AW_TOOL_CACHE" -maxdepth 5 -type d -name bin 2>/dev/null \| tr '\''\n'\'' '\'':'\'')$PATH"; [ -n "$GOROOT" ] && export PATH="$GOROOT/bin:$PATH" \|\| true && GH_AW_NODE_EXEC="${GH_AW_NODE_BIN:-}"; if [ -z "$GH_AW_NODE_EXEC" ] \|\| [ ! -x "$GH_AW_NODE_EXEC" ]; then GH_AW_NODE_EXEC="$(command -v node 2>/dev/null \|\| true)"; fi; if [ -z "$GH_AW_NODE_EXEC" ]; then echo "node runtime missing on this runner — check runtimes.node in workflow YAML" >&2; exit 127; fi; GH_AW_NPM_GLOBAL_ROOT="$(npm root -g 2>/dev/null \|\| true)"; if [ -n "$GH_AW_NPM_GLOBAL_ROOT" ]; then export NODE_PATH="${GH_AW_NPM_GLOBAL_ROOT}${NODE_PATH:+:${NODE_PATH}}"; fi; "$GH_AW_NODE_EXEC" ${RUNNER_TEMP}/gh-aw/actions/codex_harness.cjs codex exec${GH_AW_MODEL_DETECTION_CODEX:+ --model "$GH_AW_MODEL_DETECTION_CODEX"} -c web_search="disabled" -c fetch="disabled" --dangerously-bypass-approvals-and-sandbox --skip-git-repo-check --output-schema /tmp/gh-aw/threat-detection/detection_schema.json -o /tmp/gh-aw/threat-detection/detection_result.json --prompt-file /tmp/gh-aw/aw-prompts/prompt.txt' 2>&1 \| tee -a /tmp/gh-aw/threat-detection/detection.log
	env:
	CODEX_API_KEY: ${{ secrets.CODEX_API_KEY \|\| secrets.OPENAI_API_KEY }}
	CODEX_HOME: /tmp/gh-aw/mcp-config
	GH_AW_MAX_TURNS: ${{ vars.GH_AW_DEFAULT_MAX_TURNS \|\| '' }}
	GH_AW_MCP_CONFIG: ${{ runner.temp }}/gh-aw/mcp-config/config.toml
	GH_AW_MODEL_DETECTION_CODEX: ${{ vars.GH_AW_MODEL_DETECTION_CODEX \|\| vars.GH_AW_DEFAULT_MODEL_CODEX \|\| 'gpt-5.4' }}
	GH_AW_PHASE: detection
	GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
	GH_AW_VERSION: dev
	GITHUB_AW: true
	GITHUB_STEP_SUMMARY: /tmp/gh-aw/agent-step-summary.md
	GIT_AUTHOR_EMAIL: github-actions[bot]@users.noreply.github.com
	GIT_AUTHOR_NAME: github-actions[bot]
	GIT_COMMITTER_EMAIL: github-actions[bot]@users.noreply.github.com
	GIT_COMMITTER_NAME: github-actions[bot]
	OPENAI_API_KEY: ${{ secrets.CODEX_API_KEY \|\| secrets.OPENAI_API_KEY }}
	RUNNER_TEMP: ${{ runner.temp }}
	RUST_LOG: ${{ runner.debug == 1 && 'trace,hyper_util=info,mio=info,reqwest=info,os_info=info,codex_otel=warn,codex_core=debug,ocodex_exec=debug' \|\| 'warn' }}
	TRACEPARENT: ${{ env.GITHUB_AW_OTEL_TRACE_ID != '' && env.GITHUB_AW_OTEL_PARENT_SPAN_ID != '' && format('00-{0}-{1}-01', env.GITHUB_AW_OTEL_TRACE_ID, env.GITHUB_AW_OTEL_PARENT_SPAN_ID) \|\| '' }}
	- name: Parse threat detection token usage for step summary
	id: parse_detection_token_usage
	if: always()
	continue-on-error: true
	uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
	env:
	GH_AW_TOKEN_USAGE_SUMMARY_TITLE: Threat Detection Token Usage
	with:
	script: \|
	const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
	setupGlobals(core, github, context, exec, io, getOctokit);
	const { main } = require('${{ runner.temp }}/gh-aw/actions/parse_token_usage.cjs');
	await main();
	- name: Upload threat detection log
	if: always() && steps.detection_guard.outputs.run_detection == 'true'
	uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
	with:
	name: detection
	path: /tmp/gh-aw/threat-detection/detection.log
	if-no-files-found: ignore
	- name: Parse and conclude threat detection
	id: detection_conclusion
	if: always()
	continue-on-error: true
	uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
	env:
	RUN_DETECTION: ${{ steps.detection_guard.outputs.run_detection }}
	DETECTION_AGENTIC_EXECUTION_OUTCOME: ${{ steps.detection_agentic_execution.outcome }}
	GH_AW_DETECTION_CONTINUE_ON_ERROR: "true"
	with:
	script: \|
	try {
	const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
	setupGlobals(core, github, context, exec, io, getOctokit);
	const { main } = require('${{ runner.temp }}/gh-aw/actions/parse_threat_detection_results.cjs');
	await main();
	} catch (loadErr) {
	const continueOnError = process.env.GH_AW_DETECTION_CONTINUE_ON_ERROR !== 'false';
	const detectionExecutionFailed = process.env.DETECTION_AGENTIC_EXECUTION_OUTCOME === 'failure';
	const msg = 'ERR_SYSTEM: \u274C Unexpected error loading threat detection module: ' + (loadErr && loadErr.message ? loadErr.message : String(loadErr));
	core.error(msg);
	core.setOutput('reason', 'parse_error');
	if (continueOnError && !detectionExecutionFailed) {
	core.warning('\u26A0\uFE0F ' + msg);
	core.setOutput('conclusion', 'warning');
	core.setOutput('success', 'false');
	} else {
	core.setOutput('conclusion', 'failure');
	core.setOutput('success', 'false');
	core.setFailed(msg);
	}
	}

	safe_outputs:
	needs:
	- activation
	- agent
	- detection
	if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
	runs-on: ubuntu-slim
	permissions:
	contents: write
	issues: write
	pull-requests: write
	timeout-minutes: 45
	env:
	GH_AW_AGENT_AIC: ${{ needs.agent.outputs.aic }}
	GH_AW_AIC: ${{ needs.agent.outputs.aic }}
	GH_AW_AMBIENT_CONTEXT: ${{ needs.agent.outputs.ambient_context }}
	GH_AW_CALLER_WORKFLOW_ID: "${{ github.repository }}/schema-feature-coverage"
	GH_AW_DETECTION_CONCLUSION: ${{ needs.detection.outputs.detection_conclusion }}
	GH_AW_DETECTION_REASON: ${{ needs.detection.outputs.detection_reason }}
	GH_AW_EFFECTIVE_TOKENS: ${{ needs.agent.outputs.effective_tokens }}
	GH_AW_ENGINE_ID: "codex"
	GH_AW_ENGINE_MODEL: ${{ needs.agent.outputs.model }}
	GH_AW_PROJECT_UTC: "-08:00"
	GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }}
	GH_AW_THREAT_DETECTION_AIC: ${{ needs.detection.outputs.aic }}
	GH_AW_WORKFLOW_EMOJI: "📊"
	GH_AW_WORKFLOW_ID: "schema-feature-coverage"
	GH_AW_WORKFLOW_NAME: "Schema Feature Coverage Checker"
	GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/${{ github.repository }}/blob/${{ github.ref_name }}/.github/workflows/schema-feature-coverage.md"
	outputs:
	code_push_failure_count: ${{ steps.process_safe_outputs.outputs.code_push_failure_count }}
	code_push_failure_errors: ${{ steps.process_safe_outputs.outputs.code_push_failure_errors }}
	create_discussion_error_count: ${{ steps.process_safe_outputs.outputs.create_discussion_error_count }}
	create_discussion_errors: ${{ steps.process_safe_outputs.outputs.create_discussion_errors }}
	created_pr_number: ${{ steps.process_safe_outputs.outputs.created_pr_number }}
	created_pr_url: ${{ steps.process_safe_outputs.outputs.created_pr_url }}
	process_safe_outputs_processed_count: ${{ steps.process_safe_outputs.outputs.processed_count }}
	process_safe_outputs_temporary_id_map: ${{ steps.process_safe_outputs.outputs.temporary_id_map }}
	steps:
	- name: Checkout actions folder
	uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
	with:
	repository: github/gh-aw
	sparse-checkout: \|
	actions
	persist-credentials: false
	- name: Setup Scripts
	id: setup
	uses: ./actions/setup
	with:
	destination: ${{ runner.temp }}/gh-aw/actions
	job-name: ${{ github.job }}
	trace-id: ${{ needs.activation.outputs.setup-trace-id }}
	parent-span-id: ${{ needs.activation.outputs.setup-parent-span-id \|\| needs.activation.outputs.setup-span-id }}
	env:
	GH_AW_SETUP_WORKFLOW_NAME: "Schema Feature Coverage Checker"
	GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/schema-feature-coverage.lock.yml@${{ github.ref }}
	GH_AW_INFO_VERSION: "0.142.3"
	GH_AW_INFO_AWF_VERSION: "v0.27.13"
	GH_AW_INFO_ENGINE_ID: "codex"
	- name: Mask OTLP telemetry headers
	run: bash "${RUNNER_TEMP}/gh-aw/actions/mask_otlp_headers.sh"
	- name: Download agent output artifact
	id: download-agent-output
	continue-on-error: true
	uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
	with:
	name: agent
	path: /tmp/gh-aw/
	- name: Setup agent output environment variable
	id: setup-agent-output-env
	if: steps.download-agent-output.outcome == 'success'
	run: \|
	mkdir -p /tmp/gh-aw/
	find "/tmp/gh-aw/" -type f -print
	echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT"
	- name: Download patch artifact
	continue-on-error: true
	uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
	with:
	name: agent
	path: /tmp/gh-aw/
	- name: Checkout repository
	if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
	uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
	with:
	persist-credentials: true
	fetch-depth: 1
	token: ${{ secrets.GH_AW_GITHUB_TOKEN \|\| secrets.GITHUB_TOKEN }}
	- name: Configure Git credentials
	if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
	env:
	GITHUB_REPOSITORY: ${{ github.repository }}
	GITHUB_SERVER_URL: ${{ github.server_url }}
	GIT_TOKEN: ${{ secrets.GH_AW_GITHUB_TOKEN \|\| secrets.GITHUB_TOKEN }}
	run: bash "${RUNNER_TEMP}/gh-aw/actions/configure_git_credentials.sh"
	- name: Configure GH_HOST for enterprise compatibility
	id: ghes-host-config
	shell: bash
	run: \| # zizmor: ignore[github-env] - GITHUB_SERVER_URL is set by GitHub Actions, not user input.
	# Derive GH_HOST from GITHUB_SERVER_URL so the gh CLI targets the correct
	# GitHub instance (GHES/GHEC). On github.com this is a harmless no-op.
	GH_HOST="${GITHUB_SERVER_URL#https://}"
	GH_HOST="${GH_HOST#http://}"
	echo "GH_HOST=${GH_HOST}" >> "$GITHUB_ENV"
	- name: Process Safe Outputs
	id: process_safe_outputs
	uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
	env:
	GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }}
	GH_AW_COMMENT_ID: ${{ needs.activation.outputs.comment_id }}
	GH_AW_ALLOWED_DOMAINS: ".githubusercontent.com,.grafana.net,*.sentry.io,172.30.0.1,api.github.com,api.githubcopilot.com,api.openai.com,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,chatgpt.com,codeload.github.com,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,docs.github.com,github-cloud.githubusercontent.com,github-cloud.s3.amazonaws.com,github.blog,github.com,github.githubassets.com,host.docker.internal,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,lfs.github.com,objects.githubusercontent.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,openai.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,patch-diff.githubusercontent.com,patchdiff.githubusercontent.com,ppa.launchpad.net,raw.githubusercontent.com,s.symcb.com,s.symcd.com,security.ubuntu.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com,www.googleapis.com"
	GITHUB_SERVER_URL: ${{ github.server_url }}
	GITHUB_API_URL: ${{ github.api_url }}
	GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"create_pull_request\":{\"expires\":168,\"labels\":[\"automation\",\"schema-coverage\"],\"max\":10,\"max_patch_files\":100,\"max_patch_size\":4096,\"protect_top_level_dot_folders\":true,\"protected_files\":[\"package.json\",\"bun.lockb\",\"bunfig.toml\",\"deno.json\",\"deno.jsonc\",\"deno.lock\",\"global.json\",\"NuGet.Config\",\"Directory.Packages.props\",\"mix.exs\",\"mix.lock\",\"go.mod\",\"go.sum\",\"stack.yaml\",\"stack.yaml.lock\",\"pom.xml\",\"build.gradle\",\"build.gradle.kts\",\"settings.gradle\",\"settings.gradle.kts\",\"gradle.properties\",\"package-lock.json\",\"yarn.lock\",\"pnpm-lock.yaml\",\"npm-shrinkwrap.json\",\"requirements.txt\",\"Pipfile\",\"Pipfile.lock\",\"pyproject.toml\",\"setup.py\",\"setup.cfg\",\"Gemfile\",\"Gemfile.lock\",\"uv.lock\",\"CODEOWNERS\",\"DESIGN.md\",\"README.md\",\"CONTRIBUTING.md\",\"CHANGELOG.md\",\"SECURITY.md\",\"CODE_OF_CONDUCT.md\",\"AGENTS.md\",\"CLAUDE.md\",\"GEMINI.md\"],\"protected_files_policy\":\"request_review\",\"title_prefix\":\"[schema-coverage] \"},\"create_report_incomplete_issue\":{},\"missing_data\":{},\"missing_tool\":{},\"noop\":{\"max\":1,\"report-as-issue\":\"true\"},\"report_incomplete\":{}}"
	GH_AW_CI_TRIGGER_TOKEN: ${{ secrets.GH_AW_CI_TRIGGER_TOKEN }}
	with:
	github-token: ${{ secrets.GH_AW_GITHUB_TOKEN \|\| secrets.GITHUB_TOKEN }}
	script: \|
	const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
	setupGlobals(core, github, context, exec, io, getOctokit);
	const { main } = require('${{ runner.temp }}/gh-aw/actions/safe_output_handler_manager.cjs');
	await main();
	- name: Upload Safe Outputs Items
	if: always()
	uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
	with:
	name: safe-outputs-items
	path: \|
	/tmp/gh-aw/safe-output-items.jsonl
	/tmp/gh-aw/temporary-id-map.json
	if-no-files-found: ignore
	- name: Restore actions folder
	if: always()
	uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
	with:
	repository: github/gh-aw
	sparse-checkout: \|
	actions/setup
	sparse-checkout-cone-mode: true
	persist-credentials: false

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Schema Feature Coverage Checker #15

Workflow file

Schema Feature Coverage Checker #15

Uh oh!

Workflow file for this run