[plan] Reproduce and confirm: timeout-minutes not enforced on AWF agent steps

[github-actions]

Objective

Reproduce and confirm the bug reported in #23965: timeout-minutes on agent steps is not enforced when the agent runs inside the AWF Docker container.

Context

Issue #23965 reports that when timeout-minutes is set on the GitHub Actions step that runs the Copilot CLI agent inside the AWF firewall container, the step continues past the timeout until the job-level or workflow-level timeout. This may be caused by signal delivery (SIGTERM/SIGKILL) not reaching processes inside the container.

Approach

1. Create a test workflow that has an agent step with a short timeout-minutes (e.g., 5 minutes) and a task that is designed to run longer (e.g., an agent instructed to sleep or loop for 30 minutes).
2. Trigger the workflow and observe whether the step terminates at 5 minutes or continues running.
3. Collect evidence: Capture the step log to confirm whether the runner emits "##[error]The operation was cancelled because the step exceeded the configured timeout." vs. the step running indefinitely.
4. Document the process tree at the time of timeout: use ps auxf or similar inside the runner to show the process hierarchy (runner shell → sudo awf → docker container → agent).

Files of Interest

• pkg/workflow/awf_helpers.go — BuildAWFCommand() at lines ~70-142 (builds the sudo -E awf ... | tee command)
• Compiled .lock.yml files — check that timeout-minutes appears on the agent step YAML
• actions/setup/sh/ — shell scripts managing AWF lifecycle

Acceptance Criteria

• A workflow run exists (successful or failed) demonstrating the issue
• Clear evidence documented: does the step respect timeout-minutes or not?
• Process tree captured at timeout moment
• Findings posted as a comment on issue timeout-minutes on agent step not enforced inside AWF container #23965
  Related to timeout-minutes on agent step not enforced inside AWF container #23965

Generated by Plan Command for issue #23965 · ◷

• expires on Apr 3, 2026, 11:47 PM UTC

[github-actions]

🍪 Issue Monster has assigned this to Copilot!

I've identified this issue as a good candidate for automated resolution and assigned it to the Copilot coding agent.

The Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

🍪 Om nom nom by Issue Monster · ◷

[github-actions]

This issue was automatically closed because it expired on 2026-04-03T23:47:18.881Z.

Closed by Workflow