python-data-charts.lock.yml

#
#    ___                   _   _      
#   / _ \                 | | (_)     
#  | |_| | __ _  ___ _ __ | |_ _  ___ 
#  |  _  |/ _` |/ _ \ '_ \| __| |/ __|
#  | | | | (_| |  __/ | | | |_| | (__ 
#  \_| |_/\__, |\___|_| |_|\__|_|\___|
#          __/ |
#  _    _ |___/ 
# | |  | |                / _| |
# | |  | | ___ _ __ _  __| |_| | _____      ____
# | |/\| |/ _ \ '__| |/ /|  _| |/ _ \ \ /\ / / ___|
# \  /\  / (_) | | | | ( | | | | (_) \ V  V /\__ \
#  \/  \/ \___/|_| |_|\_\|_| |_|\___/ \_/\_/ |___/
#
# This file was automatically generated by gh-aw. DO NOT EDIT.
#
# To update this file, edit the corresponding .md file and run:
#   gh aw compile
# For more information: https://github.com/github/gh-aw/blob/main/.github/aw/github-agentic-workflows.md
#
# Generates high-quality data visualizations and trend charts using Python scientific computing libraries
#
# Resolved workflow manifest:
#   Imports:
#     - shared/python-dataviz.md
#     - shared/trends.md
#     - shared/charts-with-trending.md
#
# frontmatter-hash: b027e9362860b49b84156824c068e8d5ca32806b8edab27a9df20566b6090429

name: "Python Data Visualization Generator"
"on":
  workflow_dispatch:

permissions: {}

concurrency:
  group: "gh-aw-${{ github.workflow }}"

run-name: "Python Data Visualization Generator"

jobs:
  activation:
    runs-on: ubuntu-slim
    permissions:
      contents: read
    outputs:
      comment_id: ""
      comment_repo: ""
    steps:
      - name: Checkout actions folder
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
        with:
          sparse-checkout: |
            actions
          persist-credentials: false
      - name: Setup Scripts
        uses: ./actions/setup
        with:
          destination: /opt/gh-aw/actions
      - name: Check workflow file timestamps
        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
        env:
          GH_AW_WORKFLOW_FILE: "python-data-charts.lock.yml"
        with:
          script: |
            const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
            setupGlobals(core, github, context, exec, io);
            const { main } = require('/opt/gh-aw/actions/check_workflow_timestamp_api.cjs');
            await main();

  agent:
    needs: activation
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      issues: read
      pull-requests: read
    concurrency:
      group: "gh-aw-copilot-${{ github.workflow }}"
    env:
      DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
      GH_AW_ASSETS_ALLOWED_EXTS: ".png,.jpg,.jpeg"
      GH_AW_ASSETS_BRANCH: "assets/${{ github.workflow }}"
      GH_AW_ASSETS_MAX_SIZE_KB: 10240
      GH_AW_MCP_LOG_DIR: /tmp/gh-aw/mcp-logs/safeoutputs
      GH_AW_SAFE_OUTPUTS: /opt/gh-aw/safeoutputs/outputs.jsonl
      GH_AW_SAFE_OUTPUTS_CONFIG_PATH: /opt/gh-aw/safeoutputs/config.json
      GH_AW_SAFE_OUTPUTS_TOOLS_PATH: /opt/gh-aw/safeoutputs/tools.json
    outputs:
      checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
      has_patch: ${{ steps.collect_output.outputs.has_patch }}
      model: ${{ steps.generate_aw_info.outputs.model }}
      output: ${{ steps.collect_output.outputs.output }}
      output_types: ${{ steps.collect_output.outputs.output_types }}
      secret_verification_result: ${{ steps.validate-secret.outputs.verification_result }}
    steps:
      - name: Checkout actions folder
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
        with:
          sparse-checkout: |
            actions
          persist-credentials: false
      - name: Setup Scripts
        uses: ./actions/setup
        with:
          destination: /opt/gh-aw/actions
      - name: Checkout repository
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
        with:
          persist-credentials: false
      - name: Setup Go for CLI build
        uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
        with:
          go-version-file: go.mod
          cache: true
      - name: Build gh-aw CLI
        run: |
          echo "Building gh-aw CLI for linux/amd64..."
          mkdir -p dist
          VERSION=$(git describe --tags --always --dirty)
          CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build \
            -ldflags "-s -w -X main.version=${VERSION}" \
            -o dist/gh-aw-linux-amd64 \
            ./cmd/gh-aw
          # Copy binary to root for direct execution in user-defined steps
          cp dist/gh-aw-linux-amd64 ./gh-aw
          chmod +x ./gh-aw
          echo "✓ Built gh-aw CLI successfully"
      - name: Setup Docker Buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
      - name: Build gh-aw Docker image
        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6
        with:
          context: .
          platforms: linux/amd64
          push: false
          load: true
          tags: localhost/gh-aw:dev
          build-args: |
            BINARY=dist/gh-aw-linux-amd64
      - name: Create gh-aw temp directory
        run: bash /opt/gh-aw/actions/create_gh_aw_tmp_dir.sh
      - name: Setup Python environment
        run: "# Create working directory for Python scripts\nmkdir -p /tmp/gh-aw/python\nmkdir -p /tmp/gh-aw/python/data\nmkdir -p /tmp/gh-aw/python/charts\nmkdir -p /tmp/gh-aw/python/artifacts\n\necho \"Python environment setup complete\"\necho \"Working directory: /tmp/gh-aw/python\"\necho \"Data directory: /tmp/gh-aw/python/data\"\necho \"Charts directory: /tmp/gh-aw/python/charts\"\necho \"Artifacts directory: /tmp/gh-aw/python/artifacts\"\n"
      - name: Install Python scientific libraries
        run: "pip install --user --quiet numpy pandas matplotlib seaborn scipy\n\n# Verify installations\npython3 -c \"import numpy; print(f'NumPy {numpy.__version__} installed')\"\npython3 -c \"import pandas; print(f'Pandas {pandas.__version__} installed')\"\npython3 -c \"import matplotlib; print(f'Matplotlib {matplotlib.__version__} installed')\"\npython3 -c \"import seaborn; print(f'Seaborn {seaborn.__version__} installed')\"\npython3 -c \"import scipy; print(f'SciPy {scipy.__version__} installed')\"\n\necho \"All scientific libraries installed successfully\"\n"
      - if: always()
        name: Upload generated charts
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
        with:
          if-no-files-found: warn
          name: data-charts
          path: /tmp/gh-aw/python/charts/*.png
          retention-days: 30
      - if: always()
        name: Upload source files and data
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
        with:
          if-no-files-found: warn
          name: python-source-and-data
          path: |
            /tmp/gh-aw/python/*.py
            /tmp/gh-aw/python/data/*
          retention-days: 30

      # Cache memory file share configuration from frontmatter processed below
      - name: Create cache-memory directory
        run: bash /opt/gh-aw/actions/create_cache_memory_dir.sh
      - name: Restore cache-memory file share data
        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
        with:
          key: memory-${{ github.workflow }}-${{ github.run_id }}
          path: /tmp/gh-aw/cache-memory
          restore-keys: |
            memory-${{ github.workflow }}-
            memory-
      - name: Configure Git credentials
        env:
          REPO_NAME: ${{ github.repository }}
          SERVER_URL: ${{ github.server_url }}
        run: |
          git config --global user.email "github-actions[bot]@users.noreply.github.com"
          git config --global user.name "github-actions[bot]"
          # Re-authenticate git with GitHub token
          SERVER_URL_STRIPPED="${SERVER_URL#https://}"
          git remote set-url origin "https://x-access-token:${{ github.token }}@${SERVER_URL_STRIPPED}/${REPO_NAME}.git"
          echo "Git configured with standard GitHub Actions identity"
      - name: Checkout PR branch
        id: checkout-pr
        if: |
          github.event.pull_request
        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
        env:
          GH_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
        with:
          github-token: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
          script: |
            const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
            setupGlobals(core, github, context, exec, io);
            const { main } = require('/opt/gh-aw/actions/checkout_pr_branch.cjs');
            await main();
      - name: Validate COPILOT_GITHUB_TOKEN secret
        id: validate-secret
        run: /opt/gh-aw/actions/validate_multi_secret.sh COPILOT_GITHUB_TOKEN 'GitHub Copilot CLI' https://github.github.com/gh-aw/reference/engines/#github-copilot-default
        env:
          COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
      - name: Install GitHub Copilot CLI
        run: /opt/gh-aw/actions/install_copilot_cli.sh 0.0.405
      - name: Install awf binary
        run: bash /opt/gh-aw/actions/install_awf_binary.sh v0.13.7
      - name: Determine automatic lockdown mode for GitHub MCP server
        id: determine-automatic-lockdown
        env:
          TOKEN_CHECK: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN }}
        if: env.TOKEN_CHECK != ''
        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
        with:
          script: |
            const determineAutomaticLockdown = require('/opt/gh-aw/actions/determine_automatic_lockdown.cjs');
            await determineAutomaticLockdown(github, context, core);
      - name: Download container images
        run: bash /opt/gh-aw/actions/download_docker_images.sh ghcr.io/github/gh-aw-firewall/agent:0.13.7 ghcr.io/github/gh-aw-firewall/squid:0.13.7 ghcr.io/github/gh-aw-mcpg:v0.0.103 ghcr.io/github/github-mcp-server:v0.30.3 node:lts-alpine
      - name: Install gh-aw extension
        env:
          GH_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
        run: |
          # Check if gh-aw extension is already installed
          if gh extension list | grep -q "github/gh-aw"; then
            echo "gh-aw extension already installed, upgrading..."
            gh extension upgrade gh-aw || true
          else
            echo "Installing gh-aw extension..."
            gh extension install github/gh-aw
          fi
          gh aw --version
          # Copy the gh-aw binary to /opt/gh-aw for MCP server containerization
          mkdir -p /opt/gh-aw
          GH_AW_BIN=$(which gh-aw 2>/dev/null || find ~/.local/share/gh/extensions/gh-aw -name 'gh-aw' -type f 2>/dev/null | head -1)
          if [ -n "$GH_AW_BIN" ] && [ -f "$GH_AW_BIN" ]; then
            cp "$GH_AW_BIN" /opt/gh-aw/gh-aw
            chmod +x /opt/gh-aw/gh-aw
            echo "Copied gh-aw binary to /opt/gh-aw/gh-aw"
          else
            echo "::error::Failed to find gh-aw binary for MCP server"
            exit 1
          fi
      - name: Write Safe Outputs Config
        run: |
          mkdir -p /opt/gh-aw/safeoutputs
          mkdir -p /tmp/gh-aw/safeoutputs
          mkdir -p /tmp/gh-aw/mcp-logs/safeoutputs
          cat > /opt/gh-aw/safeoutputs/config.json << 'EOF'
          {"create_discussion":{"expires":168,"max":1},"missing_data":{},"missing_tool":{},"noop":{"max":1},"upload_asset":{"max":0}}
          EOF
          cat > /opt/gh-aw/safeoutputs/tools.json << 'EOF'
          [
            {
              "description": "Create a GitHub discussion for announcements, Q\u0026A, reports, status updates, or community conversations. Use this for content that benefits from threaded replies, doesn't require task tracking, or serves as documentation. For actionable work items that need assignment and status tracking, use create_issue instead. CONSTRAINTS: Maximum 1 discussion(s) can be created. Discussions will be created in category \"artifacts\".",
              "inputSchema": {
                "additionalProperties": false,
                "properties": {
                  "body": {
                    "description": "Discussion content in Markdown. Do NOT repeat the title as a heading since it already appears as the discussion's h1. Include all relevant context, findings, or questions.",
                    "type": "string"
                  },
                  "category": {
                    "description": "Discussion category by name (e.g., 'General'), slug (e.g., 'general'), or ID. If omitted, uses the first available category. Category must exist in the repository.",
                    "type": "string"
                  },
                  "title": {
                    "description": "Concise discussion title summarizing the topic. The title appears as the main heading, so keep it brief and descriptive.",
                    "type": "string"
                  }
                },
                "required": [
                  "title",
                  "body"
                ],
                "type": "object"
              },
              "name": "create_discussion"
            },
            {
              "description": "Upload a file as a URL-addressable asset that can be referenced in issues, PRs, or comments. The file is stored on an orphaned git branch and returns a permanent URL. Use this for images, diagrams, or other files that need to be embedded in GitHub content. CONSTRAINTS: Maximum file size: 10240KB. Allowed file extensions: [.png .jpg .jpeg].",
              "inputSchema": {
                "additionalProperties": false,
                "properties": {
                  "path": {
                    "description": "Absolute file path to upload (e.g., '/tmp/chart.png'). Must be under the workspace or /tmp directory. By default, only image files (.png, .jpg, .jpeg) are allowed; other file types require workflow configuration.",
                    "type": "string"
                  }
                },
                "required": [
                  "path"
                ],
                "type": "object"
              },
              "name": "upload_asset"
            },
            {
              "description": "Report that a tool or capability needed to complete the task is not available, or share any information you deem important about missing functionality or limitations. Use this when you cannot accomplish what was requested because the required functionality is missing or access is restricted.",
              "inputSchema": {
                "additionalProperties": false,
                "properties": {
                  "alternatives": {
                    "description": "Any workarounds, manual steps, or alternative approaches the user could take (max 256 characters).",
                    "type": "string"
                  },
                  "reason": {
                    "description": "Explanation of why this tool is needed or what information you want to share about the limitation (max 256 characters).",
                    "type": "string"
                  },
                  "tool": {
                    "description": "Optional: Name or description of the missing tool or capability (max 128 characters). Be specific about what functionality is needed.",
                    "type": "string"
                  }
                },
                "required": [
                  "reason"
                ],
                "type": "object"
              },
              "name": "missing_tool"
            },
            {
              "description": "Log a transparency message when no significant actions are needed. Use this to confirm workflow completion and provide visibility when analysis is complete but no changes or outputs are required (e.g., 'No issues found', 'All checks passed'). This ensures the workflow produces human-visible output even when no other actions are taken.",
              "inputSchema": {
                "additionalProperties": false,
                "properties": {
                  "message": {
                    "description": "Status or completion message to log. Should explain what was analyzed and the outcome (e.g., 'Code review complete - no issues found', 'Analysis complete - all tests passing').",
                    "type": "string"
                  }
                },
                "required": [
                  "message"
                ],
                "type": "object"
              },
              "name": "noop"
            },
            {
              "description": "Report that data or information needed to complete the task is not available. Use this when you cannot accomplish what was requested because required data, context, or information is missing.",
              "inputSchema": {
                "additionalProperties": false,
                "properties": {
                  "alternatives": {
                    "description": "Any workarounds, manual steps, or alternative approaches the user could take (max 256 characters).",
                    "type": "string"
                  },
                  "context": {
                    "description": "Additional context about the missing data or where it should come from (max 256 characters).",
                    "type": "string"
                  },
                  "data_type": {
                    "description": "Type or description of the missing data or information (max 128 characters). Be specific about what data is needed.",
                    "type": "string"
                  },
                  "reason": {
                    "description": "Explanation of why this data is needed to complete the task (max 256 characters).",
                    "type": "string"
                  }
                },
                "required": [],
                "type": "object"
              },
              "name": "missing_data"
            }
          ]
          EOF
          cat > /opt/gh-aw/safeoutputs/validation.json << 'EOF'
          {
            "create_discussion": {
              "defaultMax": 1,
              "fields": {
                "body": {
                  "required": true,
                  "type": "string",
                  "sanitize": true,
                  "maxLength": 65000
                },
                "category": {
                  "type": "string",
                  "sanitize": true,
                  "maxLength": 128
                },
                "repo": {
                  "type": "string",
                  "maxLength": 256
                },
                "title": {
                  "required": true,
                  "type": "string",
                  "sanitize": true,
                  "maxLength": 128
                }
              }
            },
            "missing_tool": {
              "defaultMax": 20,
              "fields": {
                "alternatives": {
                  "type": "string",
                  "sanitize": true,
                  "maxLength": 512
                },
                "reason": {
                  "required": true,
                  "type": "string",
                  "sanitize": true,
                  "maxLength": 256
                },
                "tool": {
                  "type": "string",
                  "sanitize": true,
                  "maxLength": 128
                }
              }
            },
            "noop": {
              "defaultMax": 1,
              "fields": {
                "message": {
                  "required": true,
                  "type": "string",
                  "sanitize": true,
                  "maxLength": 65000
                }
              }
            },
            "upload_asset": {
              "defaultMax": 10,
              "fields": {
                "path": {
                  "required": true,
                  "type": "string"
                }
              }
            }
          }
          EOF
      - name: Generate Safe Outputs MCP Server Config
        id: safe-outputs-config
        run: |
          # Generate a secure random API key (360 bits of entropy, 40+ chars)
          API_KEY=""
          API_KEY=$(openssl rand -base64 45 | tr -d '/+=')
          PORT=3001
          
          # Register API key as secret to mask it from logs
          echo "::add-mask::${API_KEY}"
          
          # Set outputs for next steps
          {
            echo "safe_outputs_api_key=${API_KEY}"
            echo "safe_outputs_port=${PORT}"
          } >> "$GITHUB_OUTPUT"
          
          echo "Safe Outputs MCP server will run on port ${PORT}"
          
      - name: Start Safe Outputs MCP HTTP Server
        id: safe-outputs-start
        env:
          DEBUG: '*'
          GH_AW_SAFE_OUTPUTS_PORT: ${{ steps.safe-outputs-config.outputs.safe_outputs_port }}
          GH_AW_SAFE_OUTPUTS_API_KEY: ${{ steps.safe-outputs-config.outputs.safe_outputs_api_key }}
          GH_AW_SAFE_OUTPUTS_TOOLS_PATH: /opt/gh-aw/safeoutputs/tools.json
          GH_AW_SAFE_OUTPUTS_CONFIG_PATH: /opt/gh-aw/safeoutputs/config.json
          GH_AW_MCP_LOG_DIR: /tmp/gh-aw/mcp-logs/safeoutputs
        run: |
          # Environment variables are set above to prevent template injection
          export DEBUG
          export GH_AW_SAFE_OUTPUTS_PORT
          export GH_AW_SAFE_OUTPUTS_API_KEY
          export GH_AW_SAFE_OUTPUTS_TOOLS_PATH
          export GH_AW_SAFE_OUTPUTS_CONFIG_PATH
          export GH_AW_MCP_LOG_DIR
          
          bash /opt/gh-aw/actions/start_safe_outputs_server.sh
          
      - name: Start MCP gateway
        id: start-mcp-gateway
        env:
          GH_AW_ASSETS_ALLOWED_EXTS: ${{ env.GH_AW_ASSETS_ALLOWED_EXTS }}
          GH_AW_ASSETS_BRANCH: ${{ env.GH_AW_ASSETS_BRANCH }}
          GH_AW_ASSETS_MAX_SIZE_KB: ${{ env.GH_AW_ASSETS_MAX_SIZE_KB }}
          GH_AW_SAFE_OUTPUTS: ${{ env.GH_AW_SAFE_OUTPUTS }}
          GH_AW_SAFE_OUTPUTS_API_KEY: ${{ steps.safe-outputs-start.outputs.api_key }}
          GH_AW_SAFE_OUTPUTS_PORT: ${{ steps.safe-outputs-start.outputs.port }}
          GITHUB_MCP_LOCKDOWN: ${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}
          GITHUB_MCP_SERVER_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -eo pipefail
          mkdir -p /tmp/gh-aw/mcp-config
          
          # Export gateway environment variables for MCP config and gateway script
          export MCP_GATEWAY_PORT="80"
          export MCP_GATEWAY_DOMAIN="host.docker.internal"
          MCP_GATEWAY_API_KEY=""
          MCP_GATEWAY_API_KEY=$(openssl rand -base64 45 | tr -d '/+=')
          export MCP_GATEWAY_API_KEY
          export MCP_GATEWAY_PAYLOAD_DIR="/tmp/gh-aw/mcp-payloads"
          mkdir -p "${MCP_GATEWAY_PAYLOAD_DIR}"
          export DEBUG="*"
          
          # Register API key as secret to mask it from logs
          echo "::add-mask::${MCP_GATEWAY_API_KEY}"
          export GH_AW_ENGINE="copilot"
          export MCP_GATEWAY_DOCKER_COMMAND='docker run -i --rm --network host -v /var/run/docker.sock:/var/run/docker.sock -e MCP_GATEWAY_PORT -e MCP_GATEWAY_DOMAIN -e MCP_GATEWAY_API_KEY -e MCP_GATEWAY_PAYLOAD_DIR -e DEBUG -e MCP_GATEWAY_LOG_DIR -e GH_AW_MCP_LOG_DIR -e GH_AW_SAFE_OUTPUTS -e GH_AW_SAFE_OUTPUTS_CONFIG_PATH -e GH_AW_SAFE_OUTPUTS_TOOLS_PATH -e GH_AW_ASSETS_BRANCH -e GH_AW_ASSETS_MAX_SIZE_KB -e GH_AW_ASSETS_ALLOWED_EXTS -e DEFAULT_BRANCH -e GITHUB_MCP_SERVER_TOKEN -e GITHUB_MCP_LOCKDOWN -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e GITHUB_SHA -e GITHUB_WORKSPACE -e GITHUB_TOKEN -e GITHUB_RUN_ID -e GITHUB_RUN_NUMBER -e GITHUB_RUN_ATTEMPT -e GITHUB_JOB -e GITHUB_ACTION -e GITHUB_EVENT_NAME -e GITHUB_EVENT_PATH -e GITHUB_ACTOR -e GITHUB_ACTOR_ID -e GITHUB_TRIGGERING_ACTOR -e GITHUB_WORKFLOW -e GITHUB_WORKFLOW_REF -e GITHUB_WORKFLOW_SHA -e GITHUB_REF -e GITHUB_REF_NAME -e GITHUB_REF_TYPE -e GITHUB_HEAD_REF -e GITHUB_BASE_REF -e GH_AW_SAFE_OUTPUTS_PORT -e GH_AW_SAFE_OUTPUTS_API_KEY -v /tmp/gh-aw/mcp-payloads:/tmp/gh-aw/mcp-payloads:rw -v /opt:/opt:ro -v /tmp:/tmp:rw -v '"${GITHUB_WORKSPACE}"':'"${GITHUB_WORKSPACE}"':rw ghcr.io/github/gh-aw-mcpg:v0.0.103'
          
          mkdir -p /home/runner/.copilot
          cat << MCPCONFIG_EOF | bash /opt/gh-aw/actions/start_mcp_gateway.sh
          {
            "mcpServers": {
              "agenticworkflows": {
                "type": "stdio",
                "container": "localhost/gh-aw:dev",
                "mounts": ["${{ github.workspace }}:${{ github.workspace }}:rw", "/tmp/gh-aw:/tmp/gh-aw:rw"],
                "args": ["-w", "${{ github.workspace }}"],
                "env": {
                  "DEBUG": "*",
                  "GITHUB_TOKEN": "\${GITHUB_TOKEN}"
                }
              },
              "github": {
                "type": "stdio",
                "container": "ghcr.io/github/github-mcp-server:v0.30.3",
                "env": {
                  "GITHUB_LOCKDOWN_MODE": "$GITHUB_MCP_LOCKDOWN",
                  "GITHUB_PERSONAL_ACCESS_TOKEN": "\${GITHUB_MCP_SERVER_TOKEN}",
                  "GITHUB_READ_ONLY": "1",
                  "GITHUB_TOOLSETS": "context,repos,issues,pull_requests"
                }
              },
              "safeoutputs": {
                "type": "http",
                "url": "http://host.docker.internal:$GH_AW_SAFE_OUTPUTS_PORT",
                "headers": {
                  "Authorization": "\${GH_AW_SAFE_OUTPUTS_API_KEY}"
                }
              }
            },
            "gateway": {
              "port": $MCP_GATEWAY_PORT,
              "domain": "${MCP_GATEWAY_DOMAIN}",
              "apiKey": "${MCP_GATEWAY_API_KEY}",
              "payloadDir": "${MCP_GATEWAY_PAYLOAD_DIR}"
            }
          }
          MCPCONFIG_EOF
      - name: Generate agentic run info
        id: generate_aw_info
        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
        with:
          script: |
            const fs = require('fs');
            
            const awInfo = {
              engine_id: "copilot",
              engine_name: "GitHub Copilot CLI",
              model: process.env.GH_AW_MODEL_AGENT_COPILOT || "",
              version: "",
              agent_version: "0.0.405",
              workflow_name: "Python Data Visualization Generator",
              experimental: false,
              supports_tools_allowlist: true,
              supports_http_transport: true,
              run_id: context.runId,
              run_number: context.runNumber,
              run_attempt: process.env.GITHUB_RUN_ATTEMPT,
              repository: context.repo.owner + '/' + context.repo.repo,
              ref: context.ref,
              sha: context.sha,
              actor: context.actor,
              event_name: context.eventName,
              staged: false,
              allowed_domains: ["defaults","python"],
              firewall_enabled: true,
              awf_version: "v0.13.7",
              awmg_version: "v0.0.103",
              steps: {
                firewall: "squid"
              },
              created_at: new Date().toISOString()
            };
            
            // Write to /tmp/gh-aw directory to avoid inclusion in PR
            const tmpPath = '/tmp/gh-aw/aw_info.json';
            fs.writeFileSync(tmpPath, JSON.stringify(awInfo, null, 2));
            console.log('Generated aw_info.json at:', tmpPath);
            console.log(JSON.stringify(awInfo, null, 2));
            
            // Set model as output for reuse in other steps/jobs
            core.setOutput('model', awInfo.model);
      - name: Generate workflow overview
        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
        with:
          script: |
            const { generateWorkflowOverview } = require('/opt/gh-aw/actions/generate_workflow_overview.cjs');
            await generateWorkflowOverview(core);
      - name: Create prompt with built-in context
        env:
          GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
          GH_AW_SAFE_OUTPUTS: ${{ env.GH_AW_SAFE_OUTPUTS }}
          GH_AW_GITHUB_ACTOR: ${{ github.actor }}
          GH_AW_GITHUB_EVENT_COMMENT_ID: ${{ github.event.comment.id }}
          GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER: ${{ github.event.discussion.number }}
          GH_AW_GITHUB_EVENT_ISSUE_NUMBER: ${{ github.event.issue.number }}
          GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER: ${{ github.event.pull_request.number }}
          GH_AW_GITHUB_REPOSITORY: ${{ github.repository }}
          GH_AW_GITHUB_RUN_ID: ${{ github.run_id }}
          GH_AW_GITHUB_WORKSPACE: ${{ github.workspace }}
        run: |
          bash /opt/gh-aw/actions/create_prompt_first.sh
          cat << 'PROMPT_EOF' > "$GH_AW_PROMPT"
          <system>
          PROMPT_EOF
          cat "/opt/gh-aw/prompts/temp_folder_prompt.md" >> "$GH_AW_PROMPT"
          cat "/opt/gh-aw/prompts/markdown.md" >> "$GH_AW_PROMPT"
          cat "/opt/gh-aw/prompts/cache_memory_prompt.md" >> "$GH_AW_PROMPT"
          cat << 'PROMPT_EOF' >> "$GH_AW_PROMPT"
          <safe-outputs>
          <description>GitHub API Access Instructions</description>
          <important>
          The gh CLI is NOT authenticated. Do NOT use gh commands for GitHub operations.
          </important>
          <instructions>
          To create or modify GitHub resources (issues, discussions, pull requests, etc.), you MUST call the appropriate safe output tool. Simply writing content will NOT work - the workflow requires actual tool calls.
          
          Discover available tools from the safeoutputs MCP server.
          
          **Critical**: Tool calls write structured data that downstream jobs process. Without tool calls, follow-up actions will be skipped.
          
          **Note**: If you made no other safe output tool calls during this workflow execution, call the "noop" tool to provide a status message indicating completion or that no actions were needed.
          </instructions>
          </safe-outputs>
          <github-context>
          The following GitHub context information is available for this workflow:
          {{#if __GH_AW_GITHUB_ACTOR__ }}
          - **actor**: __GH_AW_GITHUB_ACTOR__
          {{/if}}
          {{#if __GH_AW_GITHUB_REPOSITORY__ }}
          - **repository**: __GH_AW_GITHUB_REPOSITORY__
          {{/if}}
          {{#if __GH_AW_GITHUB_WORKSPACE__ }}
          - **workspace**: __GH_AW_GITHUB_WORKSPACE__
          {{/if}}
          {{#if __GH_AW_GITHUB_EVENT_ISSUE_NUMBER__ }}
          - **issue-number**: #__GH_AW_GITHUB_EVENT_ISSUE_NUMBER__
          {{/if}}
          {{#if __GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER__ }}
          - **discussion-number**: #__GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER__
          {{/if}}
          {{#if __GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER__ }}
          - **pull-request-number**: #__GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER__
          {{/if}}
          {{#if __GH_AW_GITHUB_EVENT_COMMENT_ID__ }}
          - **comment-id**: __GH_AW_GITHUB_EVENT_COMMENT_ID__
          {{/if}}
          {{#if __GH_AW_GITHUB_RUN_ID__ }}
          - **workflow-run-id**: __GH_AW_GITHUB_RUN_ID__
          {{/if}}
          </github-context>
          
          PROMPT_EOF
          cat << 'PROMPT_EOF' >> "$GH_AW_PROMPT"
          </system>
          PROMPT_EOF
          cat << 'PROMPT_EOF' >> "$GH_AW_PROMPT"
          # Charts with Trending - Complete Guide
          
          This shared workflow provides everything you need to create compelling trend visualizations with persistent data storage.
          
          > [!TIP]
          > **Quick Start Alternative**
          >
          > Looking for a simpler setup? Use `shared/trending-charts-simple.md` for:
          > - No nested imports (standalone configuration)
          > - No network restrictions (strict mode compatible)
          > - Quick start examples for common trending patterns
          > - Minimal configuration overhead
          >
          > The simplified version is perfect for basic trending needs while this comprehensive version offers advanced patterns and best practices.
          
          ## Cache-Memory for Trending Data
          
          You have access to persistent cache-memory at `/tmp/gh-aw/cache-memory/` that survives across workflow runs. Use it to store historical trending data.
          
          ### Trending Data Organization
          
          Organize your trending data in cache-memory:
          
          ```
          /tmp/gh-aw/cache-memory/
          ├── trending/
          │   ├── <metric-name>/
          │   │   ├── history.jsonl      # Time-series data (JSON Lines format)
          │   │   ├── metadata.json      # Data schema and descriptions
          │   │   └── last_updated.txt   # Timestamp of last update
          │   └── index.json             # Index of all tracked metrics
          ```
          
          ### Helper Functions for Trending Data
          
          **Load Historical Data:**
          ```bash
          # Check if historical data exists
          if [ -f /tmp/gh-aw/cache-memory/trending/issues/history.jsonl ]; then
            echo "Loading historical issue trending data..."
            cp /tmp/gh-aw/cache-memory/trending/issues/history.jsonl /tmp/gh-aw/python/data/
          else
            echo "No historical data found. Starting fresh."
            mkdir -p /tmp/gh-aw/cache-memory/trending/issues
          fi
          ```
          
          **Append New Data:**
          ```python
          import json
          from datetime import datetime
          
          # New data point
          data_point = {
              "timestamp": datetime.now().isoformat(),
              "metric": "issue_count",
              "value": 42,
              "metadata": {"source": "github_api"}
          }
          
          # Append to history (JSON Lines format)
          with open('/tmp/gh-aw/cache-memory/trending/issues/history.jsonl', 'a') as f:
              f.write(json.dumps(data_point) + '\n')
          ```
          
          **Load All Historical Data for Analysis:**
          ```python
          import pandas as pd
          import json
          
          # Load all historical data
          data_points = []
          history_file = '/tmp/gh-aw/cache-memory/trending/issues/history.jsonl'
          
          if os.path.exists(history_file):
              with open(history_file, 'r') as f:
                  for line in f:
                      data_points.append(json.loads(line))
              
              # Convert to DataFrame for analysis
              df = pd.DataFrame(data_points)
              df['timestamp'] = pd.to_datetime(df['timestamp'])
              df = df.sort_values('timestamp')
          else:
              df = pd.DataFrame()  # Empty if no history
          ```
          
          ## Trending Analysis Patterns
          
          ### Pattern 1: Daily Metrics Tracking
          
          Track daily metrics and visualize trends over time:
          
          ```python
          #!/usr/bin/env python3
          """
          Daily metrics trending example
          """
          import pandas as pd
          import matplotlib.pyplot as plt
          import seaborn as sns
          import json
          import os
          from datetime import datetime
          
          # Set style
          sns.set_style("whitegrid")
          sns.set_palette("husl")
          
          # Load historical data
          history_file = '/tmp/gh-aw/cache-memory/trending/daily_metrics/history.jsonl'
          if os.path.exists(history_file):
              data = pd.read_json(history_file, lines=True)
              data['date'] = pd.to_datetime(data['timestamp']).dt.date
          else:
              data = pd.DataFrame()
          
          # Add today's data
          today_data = {
              "timestamp": datetime.now().isoformat(),
              "issues_opened": 5,
              "issues_closed": 3,
              "prs_merged": 2
          }
          
          # Append to history
          os.makedirs(os.path.dirname(history_file), exist_ok=True)
          with open(history_file, 'a') as f:
              f.write(json.dumps(today_data) + '\n')
          
          # Reload with today's data
          data = pd.read_json(history_file, lines=True)
          data['date'] = pd.to_datetime(data['timestamp']).dt.date
          daily_stats = data.groupby('date').sum()
          
          # Create trend chart
          fig, ax = plt.subplots(figsize=(12, 7), dpi=300)
          daily_stats.plot(ax=ax, marker='o', linewidth=2)
          ax.set_title('Daily Metrics Trends', fontsize=16, fontweight='bold')
          ax.set_xlabel('Date', fontsize=12)
          ax.set_ylabel('Count', fontsize=12)
          ax.legend(loc='best')
          ax.grid(True, alpha=0.3)
          plt.xticks(rotation=45)
          plt.tight_layout()
          
          plt.savefig('/tmp/gh-aw/python/charts/daily_metrics_trend.png',
                      dpi=300, bbox_inches='tight', facecolor='white')
          
          print(f"Chart saved. Total data points: {len(data)}")
          ```
          
          ### Pattern 2: Moving Averages and Smoothing
          
          ```python
          # Calculate 7-day moving average
          df['rolling_avg'] = df['value'].rolling(window=7, min_periods=1).mean()
          
          # Plot with trend line
          fig, ax = plt.subplots(figsize=(12, 7), dpi=300)
          ax.plot(df['date'], df['value'], label='Actual', alpha=0.5, marker='o')
          ax.plot(df['date'], df['rolling_avg'], label='7-day Average', linewidth=2.5)
          ax.fill_between(df['date'], df['value'], df['rolling_avg'], alpha=0.2)
          ```
          
          ### Pattern 3: Comparative Trends
          
          ```python
          # Compare multiple metrics over time
          fig, ax = plt.subplots(figsize=(14, 8), dpi=300)
          
          for metric in ['metric_a', 'metric_b', 'metric_c']:
              metric_data = df[df['metric'] == metric]
              ax.plot(metric_data['timestamp'], metric_data['value'], 
                      marker='o', label=metric, linewidth=2)
          
          ax.set_title('Comparative Metrics Trends', fontsize=16, fontweight='bold')
          ax.legend(loc='best', fontsize=12)
          ax.grid(True, alpha=0.3)
          plt.xticks(rotation=45)
          ```
          
          ## Best Practices for Cache-Memory Trending
          
          ### 1. Use JSON Lines Format
          
          JSON Lines (`.jsonl`) is ideal for append-only trending data:
          - One JSON object per line
          - Easy to append new data
          - Efficient for time-series data
          - Simple to load with pandas: `pd.read_json(file, lines=True)`
          
          ### 2. Include Metadata
          
          Store metadata alongside data:
          ```json
          {
            "metric_name": "issue_resolution_time",
            "unit": "hours",
            "description": "Average time to close issues",
            "started_tracking": "2024-01-01",
            "updated": "2024-03-15"
          }
          ```
          
          ### 3. Maintain Index
          
          Keep an index of all tracked metrics:
          ```json
          {
            "metrics": [
              "issue_count",
              "pr_count",
              "commit_count",
              "test_coverage"
            ],
            "last_updated": "2024-03-15T10:30:00Z"
          }
          ```
          
          ### 4. Data Retention Strategy
          
          Implement retention policies to prevent unbounded growth:
          ```python
          # Keep only last 90 days
          cutoff_date = datetime.now() - timedelta(days=90)
          df = df[df['timestamp'] >= cutoff_date]
          
          # Save pruned data
          df.to_json('/tmp/gh-aw/cache-memory/trending/history.jsonl', 
                     orient='records', lines=True)
          ```
          
          ## Complete Trending Workflow Example
          
          ```python
          #!/usr/bin/env python3
          """
          Complete trending analysis workflow
          Collects data, updates history, generates trend charts
          """
          import pandas as pd
          import matplotlib.pyplot as plt
          import seaborn as sns
          import json
          import os
          from datetime import datetime, timedelta
          
          # Configuration
          CACHE_DIR = '/tmp/gh-aw/cache-memory/trending'
          METRIC_NAME = 'github_activity'
          HISTORY_FILE = f'{CACHE_DIR}/{METRIC_NAME}/history.jsonl'
          CHARTS_DIR = '/tmp/gh-aw/python/charts'
          
          # Ensure directories exist
          os.makedirs(f'{CACHE_DIR}/{METRIC_NAME}', exist_ok=True)
          os.makedirs(CHARTS_DIR, exist_ok=True)
          
          # Collect today's data (example)
          today_data = {
              "timestamp": datetime.now().isoformat(),
              "issues_opened": 8,
              "prs_merged": 12,
              "commits": 45,
              "contributors": 6
          }
          
          # Append to history
          with open(HISTORY_FILE, 'a') as f:
              f.write(json.dumps(today_data) + '\n')
          
          # Load all historical data
          df = pd.read_json(HISTORY_FILE, lines=True)
          df['date'] = pd.to_datetime(df['timestamp']).dt.date
          df = df.sort_values('timestamp')
          
          # Aggregate by date
          daily_stats = df.groupby('date').sum()
          
          # Generate trend chart
          sns.set_style("whitegrid")
          sns.set_palette("husl")
          
          fig, axes = plt.subplots(2, 2, figsize=(16, 12), dpi=300)
          fig.suptitle('GitHub Activity Trends', fontsize=18, fontweight='bold')
          
          # Chart 1: Issues Opened
          axes[0, 0].plot(daily_stats.index, daily_stats['issues_opened'], 
                          marker='o', linewidth=2, color='#FF6B6B')
          axes[0, 0].set_title('Issues Opened', fontsize=14)
          axes[0, 0].grid(True, alpha=0.3)
          
          # Chart 2: PRs Merged
          axes[0, 1].plot(daily_stats.index, daily_stats['prs_merged'], 
                          marker='s', linewidth=2, color='#4ECDC4')
          axes[0, 1].set_title('PRs Merged', fontsize=14)
          axes[0, 1].grid(True, alpha=0.3)
          
          # Chart 3: Commits
          axes[1, 0].plot(daily_stats.index, daily_stats['commits'], 
                          marker='^', linewidth=2, color='#45B7D1')
          axes[1, 0].set_title('Commits', fontsize=14)
          axes[1, 0].grid(True, alpha=0.3)
          
          # Chart 4: Contributors
          axes[1, 1].plot(daily_stats.index, daily_stats['contributors'], 
                          marker='D', linewidth=2, color='#FFA07A')
          axes[1, 1].set_title('Active Contributors', fontsize=14)
          axes[1, 1].grid(True, alpha=0.3)
          
          plt.tight_layout()
          plt.savefig(f'{CHARTS_DIR}/activity_trends.png',
                      dpi=300, bbox_inches='tight', facecolor='white')
          
          print(f"✅ Trend chart generated with {len(df)} data points")
          print(f"📊 Chart saved to: {CHARTS_DIR}/activity_trends.png")
          print(f"💾 Historical data: {HISTORY_FILE}")
          ```
          
          ## Integration with Asset Upload and Discussions
          
          After generating charts, use the safe-outputs tools to share them:
          
          ```markdown
          ## Example Discussion with Trending Charts
          
          Upload each chart using the `upload asset` tool, then create a discussion:
          
          **Title**: "📈 Weekly Trending Analysis - [Date]"
          
          **Content**:
          # 📈 Trending Analysis Report
          
          Generated on: {date}
          
          ## Activity Trends
          
          ![Activity Trends](URL_FROM_UPLOAD_ASSET)
          
          Analysis shows:
          - Issues opened: Up 15% from last week
          - PR velocity: Stable at 12 PRs/day
          - Commit activity: Peak on Tuesdays and Wednesdays
          - Active contributors: Growing trend (+20% this month)
          
          ## Data Summary
          
          - **Total data points**: {count}
          - **Date range**: {start} to {end}
          - **Tracking period**: {days} days
          
          ---
          
          *Generated using Charts with Trending shared workflow*
          *Historical data stored in cache-memory for continuous tracking*
          ```
          
          ## Tips for Success
          
          1. **Consistency**: Use same metric names across runs
          2. **Timestamps**: Always include ISO 8601 timestamps
          3. **Validation**: Check data quality before appending
          4. **Backup**: Keep metadata for data recovery
          5. **Documentation**: Comment your data schemas
          6. **Testing**: Validate charts before uploading
          7. **Cleanup**: Implement retention policies
          8. **Indexing**: Maintain metric index for discovery
          
          ## Common Use Cases
          
          ### Repository Activity Trends
          ```python
          # Track: commits, PRs, issues, contributors
          # Frequency: Daily
          # Retention: 90 days
          ```
          
          ### Performance Metrics Trends
          ```python
          # Track: build time, test coverage, bundle size
          # Frequency: Per commit/PR
          # Retention: 180 days
          ```
          
          ### Quality Metrics Trends
          ```python
          # Track: code complexity, test failures, security alerts
          # Frequency: Weekly
          # Retention: 1 year
          ```
          
          ### Workflow Efficiency Trends
          ```python
          # Track: workflow duration, token usage, success rate
          # Frequency: Per run
          # Retention: 30 days
          ```
          
          ---
          
          Remember: The power of trending comes from consistent data collection over time. Use cache-memory to build a rich historical dataset that reveals insights and patterns!
          
          # Python Data Visualization Guide
          
          Python scientific libraries have been installed and are ready for use. A temporary folder structure has been created at `/tmp/gh-aw/python/` for organizing scripts, data, and outputs.
          
          ## Installed Libraries
          
          - **NumPy**: Array processing and numerical operations
          - **Pandas**: Data manipulation and analysis
          - **Matplotlib**: Chart generation and plotting
          - **Seaborn**: Statistical data visualization
          - **SciPy**: Scientific computing utilities
          
          ## Directory Structure
          
          ```
          /tmp/gh-aw/python/
          ├── data/          # Store all data files here (CSV, JSON, etc.)
          ├── charts/        # Generated chart images (PNG)
          ├── artifacts/     # Additional output files
          └── *.py           # Python scripts
          ```
          
          ## Data Separation Requirement
          
          **CRITICAL**: Data must NEVER be inlined in Python code. Always store data in external files and load using pandas.
          
          ### ❌ PROHIBITED - Inline Data
          ```python
          # DO NOT do this
          data = [10, 20, 30, 40, 50]
          labels = ['A', 'B', 'C', 'D', 'E']
          ```
          
          ### ✅ REQUIRED - External Data Files
          ```python
          # Always load data from external files
          import pandas as pd
          
          # Load data from CSV
          data = pd.read_csv('/tmp/gh-aw/python/data/data.csv')
          
          # Or from JSON
          data = pd.read_json('/tmp/gh-aw/python/data/data.json')
          ```
          
          ## Chart Generation Best Practices
          
          ### High-Quality Chart Settings
          
          ```python
          import matplotlib.pyplot as plt
          import seaborn as sns
          
          # Set style for better aesthetics
          sns.set_style("whitegrid")
          sns.set_palette("husl")
          
          # Create figure with high DPI
          fig, ax = plt.subplots(figsize=(10, 6), dpi=300)
          
          # Your plotting code here
          # ...
          
          # Save with high quality
          plt.savefig('/tmp/gh-aw/python/charts/chart.png', 
                      dpi=300, 
                      bbox_inches='tight',
                      facecolor='white',
                      edgecolor='none')
          ```
          
          ### Chart Quality Guidelines
          
          - **DPI**: Use 300 or higher for publication quality
          - **Figure Size**: Standard is 10x6 inches (adjustable based on needs)
          - **Labels**: Always include clear axis labels and titles
          - **Legend**: Add legends when plotting multiple series
          - **Grid**: Enable grid lines for easier reading
          - **Colors**: Use colorblind-friendly palettes (seaborn defaults are good)
          
          ## Including Images in Reports
          
          When creating reports (issues, discussions, etc.), use the `upload asset` tool to make images URL-addressable and include them in markdown:
          
          ### Step 1: Generate and Upload Chart
          ```python
          # Generate your chart
          plt.savefig('/tmp/gh-aw/python/charts/my_chart.png', dpi=300, bbox_inches='tight')
          ```
          
          ### Step 2: Upload as Asset
          Use the `upload asset` tool to upload the chart file. The tool will return a GitHub raw content URL.
          
          ### Step 3: Include in Markdown Report
          When creating your discussion or issue, include the image using markdown:
          
          ```markdown
          ## Visualization Results
          
          ![Chart Description](https://raw.githubusercontent.com/owner/repo/assets/workflow-name/my_chart.png)
          
          The chart above shows...
          ```
          
          **Important**: Assets are published to an orphaned git branch and become URL-addressable after workflow completion.
          
          ## Cache Memory Integration
          
          The cache memory at `/tmp/gh-aw/cache-memory/` is available for storing reusable code:
          
          **Helper Functions to Cache:**
          - Data loading utilities: `data_loader.py`
          - Chart styling functions: `chart_utils.py`
          - Common data transformations: `transforms.py`
          
          **Check Cache Before Creating:**
          ```bash
          # Check if helper exists in cache
          if [ -f /tmp/gh-aw/cache-memory/data_loader.py ]; then
            cp /tmp/gh-aw/cache-memory/data_loader.py /tmp/gh-aw/python/
            echo "Using cached data_loader.py"
          fi
          ```
          
          **Save to Cache for Future Runs:**
          ```bash
          # Save useful helpers to cache
          cp /tmp/gh-aw/python/data_loader.py /tmp/gh-aw/cache-memory/
          echo "Saved data_loader.py to cache for future runs"
          ```
          
          ## Complete Example Workflow
          
          ```python
          #!/usr/bin/env python3
          """
          Example data visualization script
          Generates a bar chart from external data
          """
          import pandas as pd
          import matplotlib.pyplot as plt
          import seaborn as sns
          
          # Set style
          sns.set_style("whitegrid")
          sns.set_palette("husl")
          
          # Load data from external file (NEVER inline)
          data = pd.read_csv('/tmp/gh-aw/python/data/data.csv')
          
          # Process data
          summary = data.groupby('category')['value'].sum()
          
          # Create chart
          fig, ax = plt.subplots(figsize=(10, 6), dpi=300)
          PROMPT_EOF
          cat << 'PROMPT_EOF' >> "$GH_AW_PROMPT"
          summary.plot(kind='bar', ax=ax)
          
          # Customize
          ax.set_title('Data Summary by Category', fontsize=16, fontweight='bold')
          ax.set_xlabel('Category', fontsize=12)
          ax.set_ylabel('Value', fontsize=12)
          ax.grid(True, alpha=0.3)
          
          # Save chart
          plt.savefig('/tmp/gh-aw/python/charts/chart.png',
                      dpi=300,
                      bbox_inches='tight',
                      facecolor='white')
          
          print("Chart saved to /tmp/gh-aw/python/charts/chart.png")
          ```
          
          ## Error Handling
          
          **Check File Existence:**
          ```python
          import os
          
          data_file = '/tmp/gh-aw/python/data/data.csv'
          if not os.path.exists(data_file):
              raise FileNotFoundError(f"Data file not found: {data_file}")
          ```
          
          **Validate Data:**
          ```python
          # Check for required columns
          required_cols = ['category', 'value']
          missing = set(required_cols) - set(data.columns)
          if missing:
              raise ValueError(f"Missing columns: {missing}")
          ```
          
          ## Artifact Upload
          
          Charts and source files are automatically uploaded as artifacts:
          
          **Charts Artifact:**
          - Name: `data-charts`
          - Contents: PNG files from `/tmp/gh-aw/python/charts/`
          - Retention: 30 days
          
          **Source and Data Artifact:**
          - Name: `python-source-and-data`
          - Contents: Python scripts and data files
          - Retention: 30 days
          
          Both artifacts are uploaded with `if: always()` condition, ensuring they're available even if the workflow fails.
          
          ## Tips for Success
          
          1. **Always Separate Data**: Store data in files, never inline in code
          2. **Use Cache Memory**: Store reusable helpers for faster execution
          3. **High Quality Charts**: Use DPI 300+ and proper sizing
          4. **Clear Documentation**: Add docstrings and comments
          5. **Error Handling**: Validate data and check file existence
          6. **Type Hints**: Use type annotations for better code quality
          7. **Seaborn Defaults**: Leverage seaborn for better aesthetics
          8. **Reproducibility**: Set random seeds when needed
          
          ## Common Data Sources
          
          Based on common use cases:
          
          **Repository Statistics:**
          ```python
          # Collect via GitHub API, save to data.csv
          # Then load and visualize
          data = pd.read_csv('/tmp/gh-aw/python/data/repo_stats.csv')
          ```
          
          **Workflow Metrics:**
          ```python
          # Collect via GitHub Actions API, save to data.json
          data = pd.read_json('/tmp/gh-aw/python/data/workflow_metrics.json')
          ```
          
          **Sample Data Generation:**
          ```python
          # Generate with NumPy, save to file first
          import numpy as np
          data = np.random.randn(100, 2)
          df = pd.DataFrame(data, columns=['x', 'y'])
          df.to_csv('/tmp/gh-aw/python/data/sample_data.csv', index=False)
          
          # Then load it back (demonstrating the pattern)
          data = pd.read_csv('/tmp/gh-aw/python/data/sample_data.csv')
          ```
          
          # Trends Visualization Guide
          
          You are an expert at creating compelling trend visualizations that reveal insights from data over time.
          
          ## Trending Chart Best Practices
          
          When generating trending charts, focus on:
          
          ### 1. **Time Series Excellence**
          - Use line charts for continuous trends over time
          - Add trend lines or moving averages to highlight patterns
          - Include clear date/time labels on the x-axis
          - Show confidence intervals or error bands when relevant
          
          ### 2. **Comparative Trends**
          - Use multi-line charts to compare multiple trends
          - Apply distinct colors for each series with a clear legend
          - Consider using area charts for stacked trends
          - Highlight key inflection points or anomalies
          
          ### 3. **Visual Impact**
          - Use vibrant, contrasting colors to make trends stand out
          - Add annotations for significant events or milestones
          - Include grid lines for easier value reading
          - Use appropriate scale (linear vs. logarithmic)
          
          ### 4. **Contextual Information**
          - Show percentage changes or growth rates
          - Include baseline comparisons (year-over-year, month-over-month)
          - Add summary statistics (min, max, average, median)
          - Highlight recent trends vs. historical patterns
          
          ## Example Trend Chart Types
          
          ### Temporal Trends
          ```python
          # Line chart with multiple trends
          fig, ax = plt.subplots(figsize=(12, 7), dpi=300)
          for column in data.columns:
              ax.plot(data.index, data[column], marker='o', label=column, linewidth=2)
          ax.set_title('Trends Over Time', fontsize=16, fontweight='bold')
          ax.set_xlabel('Date', fontsize=12)
          ax.set_ylabel('Value', fontsize=12)
          ax.legend(loc='best')
          ax.grid(True, alpha=0.3)
          plt.xticks(rotation=45)
          ```
          
          ### Growth Rates
          ```python
          # Bar chart showing period-over-period growth
          fig, ax = plt.subplots(figsize=(10, 6), dpi=300)
          growth_data.plot(kind='bar', ax=ax, color=sns.color_palette("husl"))
          ax.set_title('Growth Rates by Period', fontsize=16, fontweight='bold')
          ax.axhline(y=0, color='black', linestyle='-', linewidth=0.8)
          ax.set_ylabel('Growth %', fontsize=12)
          ```
          
          ### Moving Averages
          ```python
          # Trend with moving average overlay
          fig, ax = plt.subplots(figsize=(12, 7), dpi=300)
          ax.plot(dates, values, label='Actual', alpha=0.5, linewidth=1)
          ax.plot(dates, moving_avg, label='7-day Moving Average', linewidth=2.5)
          ax.fill_between(dates, values, moving_avg, alpha=0.2)
          ```
          
          ## Data Preparation for Trends
          
          ### Time-Based Indexing
          ```python
          # Convert to datetime and set as index
          data['date'] = pd.to_datetime(data['date'])
          data.set_index('date', inplace=True)
          data = data.sort_index()
          ```
          
          ### Resampling and Aggregation
          ```python
          # Resample daily data to weekly
          weekly_data = data.resample('W').mean()
          
          # Calculate rolling statistics
          data['rolling_mean'] = data['value'].rolling(window=7).mean()
          data['rolling_std'] = data['value'].rolling(window=7).std()
          ```
          
          ### Growth Calculations
          ```python
          # Calculate percentage change
          data['pct_change'] = data['value'].pct_change() * 100
          
          # Calculate year-over-year growth
          data['yoy_growth'] = data['value'].pct_change(periods=365) * 100
          ```
          
          ## Color Palettes for Trends
          
          Use these palettes for impactful trend visualizations:
          
          - **Sequential trends**: `sns.color_palette("viridis", n_colors=5)`
          - **Diverging trends**: `sns.color_palette("RdYlGn", n_colors=7)`
          - **Multiple series**: `sns.color_palette("husl", n_colors=8)`
          - **Categorical**: `sns.color_palette("Set2", n_colors=6)`
          
          ## Annotation Best Practices
          
          ```python
          # Annotate key points
          max_idx = data['value'].idxmax()
          max_val = data['value'].max()
          ax.annotate(f'Peak: {max_val:.2f}',
                      xy=(max_idx, max_val),
                      xytext=(10, 20),
                      textcoords='offset points',
                      arrowprops=dict(arrowstyle='->', color='red'),
                      fontsize=10,
                      fontweight='bold')
          ```
          
          ## Styling for Awesome Charts
          
          ```python
          import matplotlib.pyplot as plt
          import seaborn as sns
          
          # Set professional style
          sns.set_style("whitegrid")
          sns.set_context("notebook", font_scale=1.2)
          
          # Custom color palette
          custom_colors = ["#FF6B6B", "#4ECDC4", "#45B7D1", "#FFA07A", "#98D8C8"]
          sns.set_palette(custom_colors)
          
          # Figure with optimal dimensions
          fig, ax = plt.subplots(figsize=(14, 8), dpi=300)
          
          # ... your plotting code ...
          
          # Tight layout for clean appearance
          plt.tight_layout()
          
          # Save with high quality
          plt.savefig('/tmp/gh-aw/python/charts/trend_chart.png',
                      dpi=300,
                      bbox_inches='tight',
                      facecolor='white',
                      edgecolor='none')
          ```
          
          ## Tips for Trending Charts
          
          1. **Start with the story**: What trend are you trying to show?
          2. **Choose the right timeframe**: Match granularity to the pattern
          3. **Smooth noise**: Use moving averages for volatile data
          4. **Show context**: Include historical baselines or benchmarks
          5. **Highlight insights**: Use annotations to draw attention
          6. **Test readability**: Ensure labels and legends are clear
          7. **Optimize colors**: Use colorblind-friendly palettes
          8. **Export high quality**: Always use DPI 300+ for presentations
          
          ## Common Trend Patterns to Visualize
          
          - **Seasonal patterns**: Monthly or quarterly cycles
          - **Long-term growth**: Exponential or linear trends
          - **Volatility changes**: Periods of stability vs. fluctuation
          - **Correlations**: How multiple trends relate
          - **Anomalies**: Outliers or unusual events
          - **Forecasts**: Projected future trends with uncertainty
          
          Remember: The best trending charts tell a clear story, make patterns obvious, and inspire action based on the insights revealed.
          
          
          PROMPT_EOF
          cat << 'PROMPT_EOF' >> "$GH_AW_PROMPT"
          {{#runtime-import .github/workflows/python-data-charts.md}}
          PROMPT_EOF
      - name: Substitute placeholders
        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
        env:
          GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
          GH_AW_CACHE_DESCRIPTION: ${{ '' }}
          GH_AW_CACHE_DIR: ${{ '/tmp/gh-aw/cache-memory/' }}
          GH_AW_GITHUB_ACTOR: ${{ github.actor }}
          GH_AW_GITHUB_EVENT_COMMENT_ID: ${{ github.event.comment.id }}
          GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER: ${{ github.event.discussion.number }}
          GH_AW_GITHUB_EVENT_ISSUE_NUMBER: ${{ github.event.issue.number }}
          GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER: ${{ github.event.pull_request.number }}
          GH_AW_GITHUB_REPOSITORY: ${{ github.repository }}
          GH_AW_GITHUB_RUN_ID: ${{ github.run_id }}
          GH_AW_GITHUB_WORKSPACE: ${{ github.workspace }}
        with:
          script: |
            const substitutePlaceholders = require('/opt/gh-aw/actions/substitute_placeholders.cjs');
            
            // Call the substitution function
            return await substitutePlaceholders({
              file: process.env.GH_AW_PROMPT,
              substitutions: {
                GH_AW_CACHE_DESCRIPTION: process.env.GH_AW_CACHE_DESCRIPTION,
                GH_AW_CACHE_DIR: process.env.GH_AW_CACHE_DIR,
                GH_AW_GITHUB_ACTOR: process.env.GH_AW_GITHUB_ACTOR,
                GH_AW_GITHUB_EVENT_COMMENT_ID: process.env.GH_AW_GITHUB_EVENT_COMMENT_ID,
                GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER: process.env.GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER,
                GH_AW_GITHUB_EVENT_ISSUE_NUMBER: process.env.GH_AW_GITHUB_EVENT_ISSUE_NUMBER,
                GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER: process.env.GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER,
                GH_AW_GITHUB_REPOSITORY: process.env.GH_AW_GITHUB_REPOSITORY,
                GH_AW_GITHUB_RUN_ID: process.env.GH_AW_GITHUB_RUN_ID,
                GH_AW_GITHUB_WORKSPACE: process.env.GH_AW_GITHUB_WORKSPACE
              }
            });
      - name: Interpolate variables and render templates
        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
        env:
          GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
        with:
          script: |
            const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
            setupGlobals(core, github, context, exec, io);
            const { main } = require('/opt/gh-aw/actions/interpolate_prompt.cjs');
            await main();
      - name: Validate prompt placeholders
        env:
          GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
        run: bash /opt/gh-aw/actions/validate_prompt_placeholders.sh
      - name: Print prompt
        env:
          GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
        run: bash /opt/gh-aw/actions/print_prompt_summary.sh
      - name: Execute GitHub Copilot CLI
        id: agentic_execution
        # Copilot CLI tool arguments (sorted):
        timeout-minutes: 15
        run: |
          set -o pipefail
          sudo -E awf --enable-chroot --env-all --container-workdir "${GITHUB_WORKSPACE}" --allow-domains '*.pythonhosted.org,anaconda.org,api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,binstar.org,bootstrap.pypa.io,conda.anaconda.org,conda.binstar.org,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,files.pythonhosted.org,github.com,host.docker.internal,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,pip.pypa.io,ppa.launchpad.net,pypi.org,pypi.python.org,raw.githubusercontent.com,registry.npmjs.org,repo.anaconda.com,repo.continuum.io,s.symcb.com,s.symcd.com,security.ubuntu.com,telemetry.enterprise.githubcopilot.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com' --log-level info --proxy-logs-dir /tmp/gh-aw/sandbox/firewall/logs --enable-host-access --image-tag 0.13.7 --skip-pull \
            -- '/usr/local/bin/copilot --add-dir /tmp/gh-aw/ --log-level all --log-dir /tmp/gh-aw/sandbox/agent/logs/ --add-dir "${GITHUB_WORKSPACE}" --disable-builtin-mcps --allow-all-tools --add-dir /tmp/gh-aw/cache-memory/ --allow-all-paths --share /tmp/gh-aw/sandbox/agent/logs/conversation.md --prompt "$(cat /tmp/gh-aw/aw-prompts/prompt.txt)"${GH_AW_MODEL_AGENT_COPILOT:+ --model "$GH_AW_MODEL_AGENT_COPILOT"}' \
            2>&1 | tee /tmp/gh-aw/agent-stdio.log
        env:
          COPILOT_AGENT_RUNNER_TYPE: STANDALONE
          COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
          GH_AW_ASSETS_ALLOWED_EXTS: ".png,.jpg,.jpeg"
          GH_AW_ASSETS_BRANCH: "assets/${{ github.workflow }}"
          GH_AW_ASSETS_MAX_SIZE_KB: 10240
          GH_AW_MCP_CONFIG: /home/runner/.copilot/mcp-config.json
          GH_AW_MODEL_AGENT_COPILOT: ${{ vars.GH_AW_MODEL_AGENT_COPILOT || '' }}
          GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
          GH_AW_SAFE_OUTPUTS: ${{ env.GH_AW_SAFE_OUTPUTS }}
          GITHUB_HEAD_REF: ${{ github.head_ref }}
          GITHUB_REF_NAME: ${{ github.ref_name }}
          GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }}
          GITHUB_WORKSPACE: ${{ github.workspace }}
          XDG_CONFIG_HOME: /home/runner
      - name: Copy Copilot session state files to logs
        if: always()
        continue-on-error: true
        run: |
          # Copy Copilot session state files to logs folder for artifact collection
          # This ensures they are in /tmp/gh-aw/ where secret redaction can scan them
          SESSION_STATE_DIR="$HOME/.copilot/session-state"
          LOGS_DIR="/tmp/gh-aw/sandbox/agent/logs"
          
          if [ -d "$SESSION_STATE_DIR" ]; then
            echo "Copying Copilot session state files from $SESSION_STATE_DIR to $LOGS_DIR"
            mkdir -p "$LOGS_DIR"
            cp -v "$SESSION_STATE_DIR"/*.jsonl "$LOGS_DIR/" 2>/dev/null || true
            echo "Session state files copied successfully"
          else
            echo "No session-state directory found at $SESSION_STATE_DIR"
          fi
      - name: Stop MCP gateway
        if: always()
        continue-on-error: true
        env:
          MCP_GATEWAY_PORT: ${{ steps.start-mcp-gateway.outputs.gateway-port }}
          MCP_GATEWAY_API_KEY: ${{ steps.start-mcp-gateway.outputs.gateway-api-key }}
          GATEWAY_PID: ${{ steps.start-mcp-gateway.outputs.gateway-pid }}
        run: |
          bash /opt/gh-aw/actions/stop_mcp_gateway.sh "$GATEWAY_PID"
      - name: Redact secrets in logs
        if: always()
        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
        with:
          script: |
            const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
            setupGlobals(core, github, context, exec, io);
            const { main } = require('/opt/gh-aw/actions/redact_secrets.cjs');
            await main();
        env:
          GH_AW_SECRET_NAMES: 'COPILOT_GITHUB_TOKEN,GH_AW_GITHUB_MCP_SERVER_TOKEN,GH_AW_GITHUB_TOKEN,GITHUB_TOKEN'
          SECRET_COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
          SECRET_GH_AW_GITHUB_MCP_SERVER_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN }}
          SECRET_GH_AW_GITHUB_TOKEN: ${{ secrets.GH_AW_GITHUB_TOKEN }}
          SECRET_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: Upload Safe Outputs
        if: always()
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: safe-output
          path: ${{ env.GH_AW_SAFE_OUTPUTS }}
          if-no-files-found: warn
      - name: Ingest agent output
        id: collect_output
        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
        env:
          GH_AW_SAFE_OUTPUTS: ${{ env.GH_AW_SAFE_OUTPUTS }}
          GH_AW_ALLOWED_DOMAINS: "*.pythonhosted.org,anaconda.org,api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,binstar.org,bootstrap.pypa.io,conda.anaconda.org,conda.binstar.org,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,files.pythonhosted.org,github.com,host.docker.internal,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,pip.pypa.io,ppa.launchpad.net,pypi.org,pypi.python.org,raw.githubusercontent.com,registry.npmjs.org,repo.anaconda.com,repo.continuum.io,s.symcb.com,s.symcd.com,security.ubuntu.com,telemetry.enterprise.githubcopilot.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com"
          GITHUB_SERVER_URL: ${{ github.server_url }}
          GITHUB_API_URL: ${{ github.api_url }}
        with:
          script: |
            const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
            setupGlobals(core, github, context, exec, io);
            const { main } = require('/opt/gh-aw/actions/collect_ndjson_output.cjs');
            await main();
      - name: Upload sanitized agent output
        if: always() && env.GH_AW_AGENT_OUTPUT
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: agent-output
          path: ${{ env.GH_AW_AGENT_OUTPUT }}
          if-no-files-found: warn
      - name: Upload engine output files
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: agent_outputs
          path: |
            /tmp/gh-aw/sandbox/agent/logs/
            /tmp/gh-aw/redacted-urls.log
          if-no-files-found: ignore
      - name: Parse agent logs for step summary
        if: always()
        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
        env:
          GH_AW_AGENT_OUTPUT: /tmp/gh-aw/sandbox/agent/logs/
        with:
          script: |
            const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
            setupGlobals(core, github, context, exec, io);
            const { main } = require('/opt/gh-aw/actions/parse_copilot_log.cjs');
            await main();
      - name: Parse MCP gateway logs for step summary
        if: always()
        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
        with:
          script: |
            const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
            setupGlobals(core, github, context, exec, io);
            const { main } = require('/opt/gh-aw/actions/parse_mcp_gateway_log.cjs');
            await main();
      - name: Print firewall logs
        if: always()
        continue-on-error: true
        env:
          AWF_LOGS_DIR: /tmp/gh-aw/sandbox/firewall/logs
        run: |
          # Fix permissions on firewall logs so they can be uploaded as artifacts
          # AWF runs with sudo, creating files owned by root
          sudo chmod -R a+r /tmp/gh-aw/sandbox/firewall/logs 2>/dev/null || true
          awf logs summary | tee -a "$GITHUB_STEP_SUMMARY"
      - name: Upload cache-memory data as artifact
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        if: always()
        with:
          name: cache-memory
          path: /tmp/gh-aw/cache-memory
      # Upload safe-outputs assets for upload_assets job
      - name: Upload safe-outputs assets
        if: always()
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: safe-outputs-assets
          path: /tmp/gh-aw/safeoutputs/assets/
          retention-days: 1
          if-no-files-found: ignore
      - name: Upload agent artifacts
        if: always()
        continue-on-error: true
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: agent-artifacts
          path: |
            /tmp/gh-aw/aw-prompts/prompt.txt
            /tmp/gh-aw/aw_info.json
            /tmp/gh-aw/mcp-logs/
            /tmp/gh-aw/sandbox/firewall/logs/
            /tmp/gh-aw/agent-stdio.log
            /tmp/gh-aw/agent/
          if-no-files-found: ignore

  conclusion:
    needs:
      - activation
      - agent
      - detection
      - safe_outputs
      - update_cache_memory
      - upload_assets
    if: (always()) && (needs.agent.result != 'skipped')
    runs-on: ubuntu-slim
    permissions:
      contents: read
      discussions: write
      issues: write
      pull-requests: write
    outputs:
      noop_message: ${{ steps.noop.outputs.noop_message }}
      tools_reported: ${{ steps.missing_tool.outputs.tools_reported }}
      total_count: ${{ steps.missing_tool.outputs.total_count }}
    steps:
      - name: Checkout actions folder
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
        with:
          sparse-checkout: |
            actions
          persist-credentials: false
      - name: Setup Scripts
        uses: ./actions/setup
        with:
          destination: /opt/gh-aw/actions
      - name: Debug job inputs
        env:
          COMMENT_ID: ${{ needs.activation.outputs.comment_id }}
          COMMENT_REPO: ${{ needs.activation.outputs.comment_repo }}
          AGENT_OUTPUT_TYPES: ${{ needs.agent.outputs.output_types }}
          AGENT_CONCLUSION: ${{ needs.agent.result }}
        run: |
          echo "Comment ID: $COMMENT_ID"
          echo "Comment Repo: $COMMENT_REPO"
          echo "Agent Output Types: $AGENT_OUTPUT_TYPES"
          echo "Agent Conclusion: $AGENT_CONCLUSION"
      - name: Download agent output artifact
        continue-on-error: true
        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
        with:
          name: agent-output
          path: /tmp/gh-aw/safeoutputs/
      - name: Setup agent output environment variable
        run: |
          mkdir -p /tmp/gh-aw/safeoutputs/
          find "/tmp/gh-aw/safeoutputs/" -type f -print
          echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/safeoutputs/agent_output.json" >> "$GITHUB_ENV"
      - name: Process No-Op Messages
        id: noop
        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
        env:
          GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
          GH_AW_NOOP_MAX: 1
          GH_AW_WORKFLOW_NAME: "Python Data Visualization Generator"
        with:
          github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
          script: |
            const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
            setupGlobals(core, github, context, exec, io);
            const { main } = require('/opt/gh-aw/actions/noop.cjs');
            await main();
      - name: Record Missing Tool
        id: missing_tool
        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
        env:
          GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
          GH_AW_WORKFLOW_NAME: "Python Data Visualization Generator"
        with:
          github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
          script: |
            const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
            setupGlobals(core, github, context, exec, io);
            const { main } = require('/opt/gh-aw/actions/missing_tool.cjs');
            await main();
      - name: Handle Agent Failure
        id: handle_agent_failure
        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
        env:
          GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
          GH_AW_WORKFLOW_NAME: "Python Data Visualization Generator"
          GH_AW_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
          GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }}
          GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.agent.outputs.secret_verification_result }}
          GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
          GH_AW_CREATE_DISCUSSION_ERRORS: ${{ needs.safe_outputs.outputs.create_discussion_errors }}
          GH_AW_CREATE_DISCUSSION_ERROR_COUNT: ${{ needs.safe_outputs.outputs.create_discussion_error_count }}
        with:
          github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
          script: |
            const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
            setupGlobals(core, github, context, exec, io);
            const { main } = require('/opt/gh-aw/actions/handle_agent_failure.cjs');
            await main();
      - name: Update reaction comment with completion status
        id: conclusion
        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
        env:
          GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
          GH_AW_COMMENT_ID: ${{ needs.activation.outputs.comment_id }}
          GH_AW_COMMENT_REPO: ${{ needs.activation.outputs.comment_repo }}
          GH_AW_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
          GH_AW_WORKFLOW_NAME: "Python Data Visualization Generator"
          GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }}
          GH_AW_DETECTION_CONCLUSION: ${{ needs.detection.result }}
        with:
          github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
          script: |
            const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
            setupGlobals(core, github, context, exec, io);
            const { main } = require('/opt/gh-aw/actions/notify_comment_error.cjs');
            await main();

  detection:
    needs: agent
    if: needs.agent.outputs.output_types != '' || needs.agent.outputs.has_patch == 'true'
    runs-on: ubuntu-latest
    permissions: {}
    concurrency:
      group: "gh-aw-copilot-${{ github.workflow }}"
    timeout-minutes: 10
    outputs:
      success: ${{ steps.parse_results.outputs.success }}
    steps:
      - name: Checkout actions folder
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
        with:
          sparse-checkout: |
            actions
          persist-credentials: false
      - name: Setup Scripts
        uses: ./actions/setup
        with:
          destination: /opt/gh-aw/actions
      - name: Download agent artifacts
        continue-on-error: true
        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
        with:
          name: agent-artifacts
          path: /tmp/gh-aw/threat-detection/
      - name: Download agent output artifact
        continue-on-error: true
        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
        with:
          name: agent-output
          path: /tmp/gh-aw/threat-detection/
      - name: Echo agent output types
        env:
          AGENT_OUTPUT_TYPES: ${{ needs.agent.outputs.output_types }}
        run: |
          echo "Agent output-types: $AGENT_OUTPUT_TYPES"
      - name: Setup threat detection
        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
        env:
          WORKFLOW_NAME: "Python Data Visualization Generator"
          WORKFLOW_DESCRIPTION: "Generates high-quality data visualizations and trend charts using Python scientific computing libraries"
          HAS_PATCH: ${{ needs.agent.outputs.has_patch }}
        with:
          script: |
            const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
            setupGlobals(core, github, context, exec, io);
            const { main } = require('/opt/gh-aw/actions/setup_threat_detection.cjs');
            await main();
      - name: Ensure threat-detection directory and log
        run: |
          mkdir -p /tmp/gh-aw/threat-detection
          touch /tmp/gh-aw/threat-detection/detection.log
      - name: Validate COPILOT_GITHUB_TOKEN secret
        id: validate-secret
        run: /opt/gh-aw/actions/validate_multi_secret.sh COPILOT_GITHUB_TOKEN 'GitHub Copilot CLI' https://github.github.com/gh-aw/reference/engines/#github-copilot-default
        env:
          COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
      - name: Install GitHub Copilot CLI
        run: /opt/gh-aw/actions/install_copilot_cli.sh 0.0.405
      - name: Execute GitHub Copilot CLI
        id: agentic_execution
        # Copilot CLI tool arguments (sorted):
        # --allow-tool shell(cat)
        # --allow-tool shell(grep)
        # --allow-tool shell(head)
        # --allow-tool shell(jq)
        # --allow-tool shell(ls)
        # --allow-tool shell(tail)
        # --allow-tool shell(wc)
        timeout-minutes: 20
        run: |
          set -o pipefail
          COPILOT_CLI_INSTRUCTION="$(cat /tmp/gh-aw/aw-prompts/prompt.txt)"
          mkdir -p /tmp/
          mkdir -p /tmp/gh-aw/
          mkdir -p /tmp/gh-aw/agent/
          mkdir -p /tmp/gh-aw/sandbox/agent/logs/
          copilot --add-dir /tmp/ --add-dir /tmp/gh-aw/ --add-dir /tmp/gh-aw/agent/ --log-level all --log-dir /tmp/gh-aw/sandbox/agent/logs/ --disable-builtin-mcps --allow-tool 'shell(cat)' --allow-tool 'shell(grep)' --allow-tool 'shell(head)' --allow-tool 'shell(jq)' --allow-tool 'shell(ls)' --allow-tool 'shell(tail)' --allow-tool 'shell(wc)' --share /tmp/gh-aw/sandbox/agent/logs/conversation.md --prompt "$COPILOT_CLI_INSTRUCTION"${GH_AW_MODEL_DETECTION_COPILOT:+ --model "$GH_AW_MODEL_DETECTION_COPILOT"} 2>&1 | tee /tmp/gh-aw/threat-detection/detection.log
        env:
          COPILOT_AGENT_RUNNER_TYPE: STANDALONE
          COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
          GH_AW_MODEL_DETECTION_COPILOT: ${{ vars.GH_AW_MODEL_DETECTION_COPILOT || '' }}
          GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
          GITHUB_HEAD_REF: ${{ github.head_ref }}
          GITHUB_REF_NAME: ${{ github.ref_name }}
          GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }}
          GITHUB_WORKSPACE: ${{ github.workspace }}
          XDG_CONFIG_HOME: /home/runner
      - name: Parse threat detection results
        id: parse_results
        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
        with:
          script: |
            const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
            setupGlobals(core, github, context, exec, io);
            const { main } = require('/opt/gh-aw/actions/parse_threat_detection_results.cjs');
            await main();
      - name: Upload threat detection log
        if: always()
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: threat-detection.log
          path: /tmp/gh-aw/threat-detection/detection.log
          if-no-files-found: ignore

  safe_outputs:
    needs:
      - agent
      - detection
    if: ((!cancelled()) && (needs.agent.result != 'skipped')) && (needs.detection.outputs.success == 'true')
    runs-on: ubuntu-slim
    permissions:
      contents: read
      discussions: write
      issues: write
    timeout-minutes: 15
    env:
      GH_AW_ENGINE_ID: "copilot"
      GH_AW_WORKFLOW_ID: "python-data-charts"
      GH_AW_WORKFLOW_NAME: "Python Data Visualization Generator"
    outputs:
      create_discussion_error_count: ${{ steps.process_safe_outputs.outputs.create_discussion_error_count }}
      create_discussion_errors: ${{ steps.process_safe_outputs.outputs.create_discussion_errors }}
      process_safe_outputs_processed_count: ${{ steps.process_safe_outputs.outputs.processed_count }}
      process_safe_outputs_temporary_id_map: ${{ steps.process_safe_outputs.outputs.temporary_id_map }}
    steps:
      - name: Checkout actions folder
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
        with:
          sparse-checkout: |
            actions
          persist-credentials: false
      - name: Setup Scripts
        uses: ./actions/setup
        with:
          destination: /opt/gh-aw/actions
      - name: Download agent output artifact
        continue-on-error: true
        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
        with:
          name: agent-output
          path: /tmp/gh-aw/safeoutputs/
      - name: Setup agent output environment variable
        run: |
          mkdir -p /tmp/gh-aw/safeoutputs/
          find "/tmp/gh-aw/safeoutputs/" -type f -print
          echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/safeoutputs/agent_output.json" >> "$GITHUB_ENV"
      - name: Process Safe Outputs
        id: process_safe_outputs
        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
        env:
          GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
          GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"create_discussion\":{\"category\":\"artifacts\",\"expires\":168,\"fallback_to_issue\":true,\"max\":1},\"missing_data\":{},\"missing_tool\":{}}"
        with:
          github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
          script: |
            const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
            setupGlobals(core, github, context, exec, io);
            const { main } = require('/opt/gh-aw/actions/safe_output_handler_manager.cjs');
            await main();

  update_cache_memory:
    needs:
      - agent
      - detection
    if: always() && needs.detection.outputs.success == 'true'
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Checkout actions folder
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
        with:
          sparse-checkout: |
            actions
          persist-credentials: false
      - name: Setup Scripts
        uses: ./actions/setup
        with:
          destination: /opt/gh-aw/actions
      - name: Download cache-memory artifact (default)
        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
        continue-on-error: true
        with:
          name: cache-memory
          path: /tmp/gh-aw/cache-memory
      - name: Save cache-memory to cache (default)
        uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
        with:
          key: memory-${{ github.workflow }}-${{ github.run_id }}
          path: /tmp/gh-aw/cache-memory

  upload_assets:
    needs:
      - agent
      - detection
    if: ((!cancelled()) && (needs.agent.result != 'skipped')) && (contains(needs.agent.outputs.output_types, 'upload_asset'))
    runs-on: ubuntu-slim
    permissions:
      contents: write
    timeout-minutes: 10
    outputs:
      branch_name: ${{ steps.upload_assets.outputs.branch_name }}
      published_count: ${{ steps.upload_assets.outputs.published_count }}
    steps:
      - name: Checkout actions folder
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
        with:
          sparse-checkout: |
            actions
          persist-credentials: false
      - name: Setup Scripts
        uses: ./actions/setup
        with:
          destination: /opt/gh-aw/actions
      - name: Checkout repository
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
        with:
          persist-credentials: false
          fetch-depth: 0
      - name: Configure Git credentials
        env:
          REPO_NAME: ${{ github.repository }}
          SERVER_URL: ${{ github.server_url }}
        run: |
          git config --global user.email "github-actions[bot]@users.noreply.github.com"
          git config --global user.name "github-actions[bot]"
          # Re-authenticate git with GitHub token
          SERVER_URL_STRIPPED="${SERVER_URL#https://}"
          git remote set-url origin "https://x-access-token:${{ github.token }}@${SERVER_URL_STRIPPED}/${REPO_NAME}.git"
          echo "Git configured with standard GitHub Actions identity"
      - name: Download assets
        continue-on-error: true
        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
        with:
          name: safe-outputs-assets
          path: /tmp/gh-aw/safeoutputs/assets/
      - name: List downloaded asset files
        continue-on-error: true
        run: |
          echo "Downloaded asset files:"
          find /tmp/gh-aw/safeoutputs/assets/ -maxdepth 1 -ls
      - name: Download agent output artifact
        continue-on-error: true
        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
        with:
          name: agent-output
          path: /tmp/gh-aw/safeoutputs/
      - name: Setup agent output environment variable
        run: |
          mkdir -p /tmp/gh-aw/safeoutputs/
          find "/tmp/gh-aw/safeoutputs/" -type f -print
          echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/safeoutputs/agent_output.json" >> "$GITHUB_ENV"
      - name: Upload Assets to Orphaned Branch
        id: upload_assets
        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
        env:
          GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
          GH_AW_ASSETS_BRANCH: "assets/${{ github.workflow }}"
          GH_AW_ASSETS_MAX_SIZE_KB: 10240
          GH_AW_ASSETS_ALLOWED_EXTS: ".png,.jpg,.jpeg"
          GH_AW_WORKFLOW_NAME: "Python Data Visualization Generator"
          GH_AW_ENGINE_ID: "copilot"
        with:
          github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
          script: |
            const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
            setupGlobals(core, github, context, exec, io);
            const { main } = require('/opt/gh-aw/actions/upload_assets.cjs');
            await main();