Problem
GOROOT is not present in the agent container environment even when actions/setup-go runs before the agent step and awf is invoked with --env-all. This breaks Go toolchain version selection inside the container.
Context
Original report: github/gh-aw#25946
GOTOOLCHAIN (set via $GITHUB_ENV) is forwarded correctly, but GOROOT (set directly in the runner's process environment by actions/setup-go) is not. The spec (§8.5) explicitly requires GOROOT to be captured.
Root Cause
In src/docker-manager.ts, the function readGitHubEnvEntries() (around line 262) reads from $GITHUB_ENV to capture env vars set by previous steps. However, actions/setup-go sets GOROOT directly in the runner's process environment (via core.exportVariable which also writes to $GITHUB_ENV), while GOTOOLCHAIN=auto is re-set by the user via echo "GOTOOLCHAIN=auto" >> $GITHUB_ENV.
The likely issue: GOROOT is being filtered out by the PROXY_ENV_VARS exclusion list or another filter in buildAgentEnv() (around line 626), OR it is in $GITHUB_ENV but the parsing of multiline/complex values in parseGitHubEnvFile() (around line 858) drops it. A secondary possibility: GOROOT is set in the process env but not in $GITHUB_ENV, and --env-all only picks up $GITHUB_ENV entries, not all process env vars.
Proposed Solution
- Audit
buildAgentEnv() in src/docker-manager.ts: Confirm whether GOROOT appears in the collected env and, if it is being filtered, add an explicit allow-list exception for GOROOT, GOPATH, GOMODCACHE, GOCACHE.
- Check
parseGitHubEnvFile() in src/docker-manager.ts: Ensure the file parser handles all GitHub Actions env encoding formats (heredoc delimiters like <<EOF) correctly.
- Explicit toolchain var capture: In
readGitHubEnvEntries(), if GOROOT is missing from $GITHUB_ENV entries, fall back to reading it from process.env directly when --env-all is active (similar to how JAVA_HOME, CARGO_HOME, etc. are recovered from $GITHUB_ENV per the existing readGitHubEnvEntries logic at src/docker-manager.ts:262-358).
- Add a test in
src/docker-manager.test.ts covering GOROOT propagation with a mock $GITHUB_ENV file.
Generated by Firewall Issue Dispatcher · ● 2.1M · ◷
Problem
GOROOTis not present in the agent container environment even whenactions/setup-goruns before the agent step andawfis invoked with--env-all. This breaks Go toolchain version selection inside the container.Context
Original report: github/gh-aw#25946
GOTOOLCHAIN(set via$GITHUB_ENV) is forwarded correctly, butGOROOT(set directly in the runner's process environment byactions/setup-go) is not. The spec (§8.5) explicitly requires GOROOT to be captured.Root Cause
In
src/docker-manager.ts, the functionreadGitHubEnvEntries()(around line 262) reads from$GITHUB_ENVto capture env vars set by previous steps. However,actions/setup-gosetsGOROOTdirectly in the runner's process environment (viacore.exportVariablewhich also writes to$GITHUB_ENV), whileGOTOOLCHAIN=autois re-set by the user viaecho "GOTOOLCHAIN=auto" >> $GITHUB_ENV.The likely issue:
GOROOTis being filtered out by thePROXY_ENV_VARSexclusion list or another filter inbuildAgentEnv()(around line 626), OR it is in$GITHUB_ENVbut the parsing of multiline/complex values inparseGitHubEnvFile()(around line 858) drops it. A secondary possibility:GOROOTis set in the process env but not in$GITHUB_ENV, and--env-allonly picks up$GITHUB_ENVentries, not all process env vars.Proposed Solution
buildAgentEnv()insrc/docker-manager.ts: Confirm whetherGOROOTappears in the collected env and, if it is being filtered, add an explicit allow-list exception forGOROOT,GOPATH,GOMODCACHE,GOCACHE.parseGitHubEnvFile()insrc/docker-manager.ts: Ensure the file parser handles all GitHub Actions env encoding formats (heredoc delimiters like<<EOF) correctly.readGitHubEnvEntries(), ifGOROOTis missing from$GITHUB_ENVentries, fall back to reading it fromprocess.envdirectly when--env-allis active (similar to howJAVA_HOME,CARGO_HOME, etc. are recovered from$GITHUB_ENVper the existingreadGitHubEnvEntrieslogic atsrc/docker-manager.ts:262-358).src/docker-manager.test.tscovering GOROOT propagation with a mock$GITHUB_ENVfile.