From f0cb32f562b8db0923d2c30f7f8a63db216a2632 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Sun, 8 Mar 2026 19:43:27 +0000 Subject: [PATCH 01/10] Initial plan From 42f4b1949c7b0cfabe9c8b65dd840c451b712be0 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Sun, 8 Mar 2026 20:17:24 +0000 Subject: [PATCH 02/10] Rename safe-inputs to mcp-scripts with migration codemod Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> --- ...log-mcp-startup-and-smoke-claude-status.md | 2 +- .changeset/patch-safe-inputs-runner.md | 2 +- .../copilot-pr-merged-report.lock.yml | 78 ++++----- .github/workflows/copilot-pr-merged-report.md | 4 +- .../workflows/daily-cli-performance.lock.yml | 90 +++++----- .github/workflows/daily-cli-performance.md | 2 +- .../daily-performance-summary.lock.yml | 98 +++++------ .../workflows/daily-performance-summary.md | 24 +-- .github/workflows/daily-regulatory.lock.yml | 94 +++++----- .github/workflows/daily-regulatory.md | 6 +- .github/workflows/go-logger.lock.yml | 90 +++++----- .github/workflows/security-review.md | 2 +- .github/workflows/shared/gh.md | 26 +-- ...-input.md => github-queries-mcp-script.md} | 6 +- .github/workflows/shared/go-make.md | 56 +++--- ...ta-safe-input.md => pr-data-mcp-script.md} | 6 +- .github/workflows/smoke-claude.lock.yml | 162 +++++++++--------- .github/workflows/smoke-claude.md | 4 +- .github/workflows/smoke-codex.lock.yml | 96 +++++------ .github/workflows/smoke-copilot-arm.lock.yml | 114 ++++++------ .github/workflows/smoke-copilot-arm.md | 4 +- .github/workflows/smoke-copilot.lock.yml | 114 ++++++------ .github/workflows/smoke-copilot.md | 4 +- .github/workflows/smoke-gemini.lock.yml | 78 ++++----- ...ig.cjs => generate_mcp_scripts_config.cjs} | 8 +- ...s => generate_mcp_scripts_config.test.cjs} | 30 ++-- actions/setup/js/log_parser_shared.cjs | 4 +- actions/setup/js/log_parser_shared.test.cjs | 4 +- ...puts-runner.cjs => mcp-scripts-runner.cjs} | 10 +- ...r.test.cjs => mcp-scripts-runner.test.cjs} | 18 +- actions/setup/js/mcp_handler_go.cjs | 2 +- actions/setup/js/mcp_handler_javascript.cjs | 2 +- actions/setup/js/mcp_handler_python.cjs | 2 +- actions/setup/js/mcp_handler_shell.cjs | 2 +- ...ootstrap.cjs => mcp_scripts_bootstrap.cjs} | 16 +- ...est.cjs => mcp_scripts_bootstrap.test.cjs} | 24 +-- ...ader.cjs => mcp_scripts_config_loader.cjs} | 14 +- ...cjs => mcp_scripts_config_loader.test.cjs} | 16 +- ..._server.cjs => mcp_scripts_mcp_server.cjs} | 40 ++--- ...st.cjs => mcp_scripts_mcp_server.test.cjs} | 118 ++++++------- ...tp.cjs => mcp_scripts_mcp_server_http.cjs} | 26 +-- ...s => mcp_scripts_mcp_server_http.test.cjs} | 4 +- ...ctory.cjs => mcp_scripts_tool_factory.cjs} | 4 +- ....cjs => mcp_scripts_tool_factory.test.cjs} | 12 +- ...idation.cjs => mcp_scripts_validation.cjs} | 2 +- ...st.cjs => mcp_scripts_validation.test.cjs} | 22 +-- actions/setup/js/mcp_server_core.cjs | 2 +- ...ts_logs.cjs => parse_mcp_scripts_logs.cjs} | 46 ++--- ...st.cjs => parse_mcp_scripts_logs.test.cjs} | 146 ++++++++-------- .../safe_outputs_mcp_error_messages.test.cjs | 2 +- actions/setup/js/setup_sh_file_lists.test.cjs | 12 +- actions/setup/js/shim.cjs | 2 +- actions/setup/setup.sh | 56 +++--- actions/setup/sh/check_mcp_servers_test.sh | 4 +- ..._server.sh => start_mcp_scripts_server.sh} | 56 +++--- .../sh/validate_gatewayed_server_test.sh | 2 +- docs/copilot-cli-checksum-verification.md | 4 +- docs/public/editor/autocomplete-data.json | 4 +- .../schemas/mcp-gateway-config.schema.json | 4 +- ...ma.json => mcp-scripts-config.schema.json} | 8 +- .../content/docs/guides/editing-workflows.md | 2 +- docs/src/content/docs/guides/mcps.md | 2 +- docs/src/content/docs/guides/upgrading.md | 6 +- .../docs/introduction/how-they-work.mdx | 2 +- .../docs/reference/environment-variables.md | 6 +- docs/src/content/docs/reference/faq.md | 2 +- .../docs/reference/frontmatter-full.md | 2 +- .../frontmatter-hash-specification.md | 6 +- .../src/content/docs/reference/frontmatter.md | 4 +- .../docs/reference/gh-aw-as-mcp-server.md | 2 +- docs/src/content/docs/reference/glossary.md | 4 +- docs/src/content/docs/reference/imports.md | 2 +- .../src/content/docs/reference/mcp-gateway.md | 4 +- ...cation.md => mcp-scripts-specification.md} | 36 ++-- .../{safe-inputs.md => mcp-scripts.md} | 30 ++-- docs/src/content/docs/reference/tools.md | 2 +- docs/src/content/docs/setup/cli.md | 2 +- pkg/cli/codemod_mcp_scripts.go | 43 +++++ ...ts_test.go => codemod_mcp_scripts_test.go} | 56 +++--- pkg/cli/codemod_safe_inputs.go | 43 ----- pkg/cli/codemod_safe_inputs_to_mcp_scripts.go | 48 ++++++ ...codemod_safe_inputs_to_mcp_scripts_test.go | 153 +++++++++++++++++ pkg/cli/fix_codemods.go | 3 +- pkg/cli/fix_codemods_test.go | 8 +- pkg/cli/fix_command_test.go | 22 +-- pkg/cli/mcp_inspect.go | 36 ++-- ...es.go => mcp_inspect_mcp_scripts_files.go} | 26 +-- ...r.go => mcp_inspect_mcp_scripts_server.go} | 56 +++--- pkg/cli/mcp_tools_management.go | 2 +- pkg/constants/constants.go | 14 +- pkg/constants/constants_test.go | 8 +- pkg/parser/import_field_extractor.go | 14 +- pkg/parser/import_processor.go | 2 +- pkg/parser/include_processor.go | 2 +- pkg/parser/mcp.go | 16 +- pkg/parser/schemas/main_workflow_schema.json | 2 +- pkg/workflow/claude_engine.go | 16 +- pkg/workflow/claude_mcp.go | 4 +- pkg/workflow/codex_engine.go | 16 +- pkg/workflow/codex_engine_test.go | 14 +- pkg/workflow/codex_mcp.go | 14 +- pkg/workflow/compiler.go | 6 +- pkg/workflow/compiler_orchestrator_test.go | 2 +- .../compiler_orchestrator_workflow.go | 16 +- .../compiler_orchestrator_workflow_test.go | 4 +- pkg/workflow/compiler_types.go | 2 +- pkg/workflow/compiler_yaml_ai_execution.go | 10 +- pkg/workflow/compiler_yaml_main_job.go | 12 +- pkg/workflow/copilot_engine.go | 12 +- pkg/workflow/copilot_engine_execution.go | 12 +- pkg/workflow/copilot_engine_tools.go | 16 +- pkg/workflow/copilot_mcp.go | 4 +- pkg/workflow/engine_helpers_secrets_test.go | 6 +- pkg/workflow/expression_safety_test.go | 2 +- pkg/workflow/features_import_test.go | 8 +- pkg/workflow/frontmatter_types.go | 8 +- pkg/workflow/frontmatter_types_test.go | 10 +- pkg/workflow/gemini_engine.go | 12 +- pkg/workflow/gemini_mcp.go | 4 +- pkg/workflow/js.go | 6 +- pkg/workflow/mcp_api_key_masking_test.go | 18 +- pkg/workflow/mcp_config_builtin.go | 4 +- pkg/workflow/mcp_config_utils.go | 2 +- pkg/workflow/mcp_detection.go | 4 +- pkg/workflow/mcp_detection_test.go | 14 +- pkg/workflow/mcp_environment.go | 24 +-- pkg/workflow/mcp_renderer.go | 34 ++-- ...est.go => mcp_scripts_conditional_test.go} | 60 +++---- ... mcp_scripts_experimental_warning_test.go} | 28 +-- ...l_test.go => mcp_scripts_firewall_test.go} | 18 +- ..._generator.go => mcp_scripts_generator.go} | 124 +++++++------- ..._test.go => mcp_scripts_generator_test.go} | 118 ++++++------- ...test.go => mcp_scripts_http_codex_test.go} | 36 ++-- ..._mode_test.go => mcp_scripts_mode_test.go} | 18 +- ...inputs_parser.go => mcp_scripts_parser.go} | 94 +++++----- ...ser_test.go => mcp_scripts_parser_test.go} | 44 ++--- ...ts_renderer.go => mcp_scripts_renderer.go} | 36 ++-- ...r_test.go => mcp_scripts_renderer_test.go} | 24 +-- ...ut_test.go => mcp_scripts_timeout_test.go} | 50 +++--- pkg/workflow/mcp_setup_generator.go | 124 +++++++------- pkg/workflow/mcp_setup_generator_test.go | 14 +- pkg/workflow/strict_mode_validation.go | 4 +- pkg/workflow/strings_test.go | 6 +- .../smoke-copilot.golden | 6 +- .../wasm_golden/fixtures/shared/gh.md | 26 +-- ...-input.md => github-queries-mcp-script.md} | 6 +- .../wasm_golden/fixtures/shared/go-make.md | 56 +++--- .../wasm_golden/fixtures/smoke-copilot.md | 6 +- 148 files changed, 1988 insertions(+), 1784 deletions(-) rename .github/workflows/shared/{github-queries-safe-input.md => github-queries-mcp-script.md} (99%) rename .github/workflows/shared/{pr-data-safe-input.md => pr-data-mcp-script.md} (96%) rename actions/setup/js/{generate_safe_inputs_config.cjs => generate_mcp_scripts_config.cjs} (85%) rename actions/setup/js/{generate_safe_inputs_config.test.cjs => generate_mcp_scripts_config.test.cjs} (65%) rename actions/setup/js/{safe-inputs-runner.cjs => mcp-scripts-runner.cjs} (84%) rename actions/setup/js/{safe-inputs-runner.test.cjs => mcp-scripts-runner.test.cjs} (89%) rename actions/setup/js/{safe_inputs_bootstrap.cjs => mcp_scripts_bootstrap.cjs} (83%) rename actions/setup/js/{safe_inputs_bootstrap.test.cjs => mcp_scripts_bootstrap.test.cjs} (84%) rename actions/setup/js/{safe_inputs_config_loader.cjs => mcp_scripts_config_loader.cjs} (76%) rename actions/setup/js/{safe_inputs_config_loader.test.cjs => mcp_scripts_config_loader.test.cjs} (88%) rename actions/setup/js/{safe_inputs_mcp_server.cjs => mcp_scripts_mcp_server.cjs} (68%) rename actions/setup/js/{safe_inputs_mcp_server.test.cjs => mcp_scripts_mcp_server.test.cjs} (89%) rename actions/setup/js/{safe_inputs_mcp_server_http.cjs => mcp_scripts_mcp_server_http.cjs} (93%) rename actions/setup/js/{safe_inputs_mcp_server_http.test.cjs => mcp_scripts_mcp_server_http.test.cjs} (98%) rename actions/setup/js/{safe_inputs_tool_factory.cjs => mcp_scripts_tool_factory.cjs} (89%) rename actions/setup/js/{safe_inputs_tool_factory.test.cjs => mcp_scripts_tool_factory.test.cjs} (87%) rename actions/setup/js/{safe_inputs_validation.cjs => mcp_scripts_validation.cjs} (92%) rename actions/setup/js/{safe_inputs_validation.test.cjs => mcp_scripts_validation.test.cjs} (79%) rename actions/setup/js/{parse_safe_inputs_logs.cjs => parse_mcp_scripts_logs.cjs} (87%) rename actions/setup/js/{parse_safe_inputs_logs.test.cjs => parse_mcp_scripts_logs.test.cjs} (69%) rename actions/setup/sh/{start_safe_inputs_server.sh => start_mcp_scripts_server.sh} (64%) rename docs/public/schemas/{safe-inputs-config.schema.json => mcp-scripts-config.schema.json} (97%) rename docs/src/content/docs/reference/{safe-inputs-specification.md => mcp-scripts-specification.md} (98%) rename docs/src/content/docs/reference/{safe-inputs.md => mcp-scripts.md} (97%) create mode 100644 pkg/cli/codemod_mcp_scripts.go rename pkg/cli/{codemod_safe_inputs_test.go => codemod_mcp_scripts_test.go} (69%) delete mode 100644 pkg/cli/codemod_safe_inputs.go create mode 100644 pkg/cli/codemod_safe_inputs_to_mcp_scripts.go create mode 100644 pkg/cli/codemod_safe_inputs_to_mcp_scripts_test.go rename pkg/cli/{mcp_inspect_safe_inputs_files.go => mcp_inspect_mcp_scripts_files.go} (78%) rename pkg/cli/{mcp_inspect_safe_inputs_server.go => mcp_inspect_mcp_scripts_server.go} (76%) rename pkg/workflow/{mcp_safe_inputs_conditional_test.go => mcp_scripts_conditional_test.go} (66%) rename pkg/workflow/{safe_inputs_experimental_warning_test.go => mcp_scripts_experimental_warning_test.go} (80%) rename pkg/workflow/{safe_inputs_firewall_test.go => mcp_scripts_firewall_test.go} (84%) rename pkg/workflow/{safe_inputs_generator.go => mcp_scripts_generator.go} (73%) rename pkg/workflow/{safe_inputs_generator_test.go => mcp_scripts_generator_test.go} (83%) rename pkg/workflow/{safe_inputs_http_codex_test.go => mcp_scripts_http_codex_test.go} (84%) rename pkg/workflow/{safe_inputs_mode_test.go => mcp_scripts_mode_test.go} (90%) rename pkg/workflow/{safe_inputs_parser.go => mcp_scripts_parser.go} (76%) rename pkg/workflow/{safe_inputs_parser_test.go => mcp_scripts_parser_test.go} (69%) rename pkg/workflow/{safe_inputs_renderer.go => mcp_scripts_renderer.go} (71%) rename pkg/workflow/{safe_inputs_renderer_test.go => mcp_scripts_renderer_test.go} (70%) rename pkg/workflow/{safe_inputs_timeout_test.go => mcp_scripts_timeout_test.go} (80%) rename pkg/workflow/testdata/wasm_golden/fixtures/shared/{github-queries-safe-input.md => github-queries-mcp-script.md} (99%) diff --git a/.changeset/patch-log-mcp-startup-and-smoke-claude-status.md b/.changeset/patch-log-mcp-startup-and-smoke-claude-status.md index 6f5990e0081..1a291d67b1d 100644 --- a/.changeset/patch-log-mcp-startup-and-smoke-claude-status.md +++ b/.changeset/patch-log-mcp-startup-and-smoke-claude-status.md @@ -2,4 +2,4 @@ "gh-aw": patch --- -Broadcast MCP server startup logs (safe-inputs, safe-outputs, Serena) with `DEBUG="*"` and GitHub Actions notices so failures expose detailed diagnostics, and extend the smoke-claude workflow with the agentic-workflows `status` query while persisting its summary. +Broadcast MCP server startup logs (mcp-scripts, safe-outputs, Serena) with `DEBUG="*"` and GitHub Actions notices so failures expose detailed diagnostics, and extend the smoke-claude workflow with the agentic-workflows `status` query while persisting its summary. diff --git a/.changeset/patch-safe-inputs-runner.md b/.changeset/patch-safe-inputs-runner.md index 5201991714e..ba79b8e304b 100644 --- a/.changeset/patch-safe-inputs-runner.md +++ b/.changeset/patch-safe-inputs-runner.md @@ -2,4 +2,4 @@ "gh-aw": patch --- -Ensure script-based safe-inputs delegate execution to the shared runner so subprocess stdout/stderr are returned. +Ensure script-based mcp-scripts delegate execution to the shared runner so subprocess stdout/stderr are returned. diff --git a/.github/workflows/copilot-pr-merged-report.lock.yml b/.github/workflows/copilot-pr-merged-report.lock.yml index d2f99b3d32c..2b3af5450d1 100644 --- a/.github/workflows/copilot-pr-merged-report.lock.yml +++ b/.github/workflows/copilot-pr-merged-report.lock.yml @@ -31,7 +31,7 @@ # - shared/reporting.md # - shared/copilot-pr-analysis-base.md # -# gh-aw-metadata: {"schema_version":"v2","frontmatter_hash":"d2ca13ea191854985bb6baeeb127f65bc6983ef11c13a367ba002c289a97042a"} +# gh-aw-metadata: {"schema_version":"v2","frontmatter_hash":"476bd0bfa5dd66057d8a5211101da6d6bf861f660f6733e9a678f12075cb93b9"} name: "Daily Copilot PR Merged Report" "on": @@ -628,16 +628,16 @@ jobs: - name: Setup Safe Inputs Config run: | - mkdir -p /opt/gh-aw/safe-inputs/logs - cat > /opt/gh-aw/safe-inputs/tools.json << 'GH_AW_SAFE_INPUTS_TOOLS_EOF' + mkdir -p /opt/gh-aw/mcp-scripts/logs + cat > /opt/gh-aw/mcp-scripts/tools.json << 'GH_AW_MCP_SCRIPTS_TOOLS_EOF' { - "serverName": "safeinputs", + "serverName": "mcpscripts", "version": "1.0.0", - "logDir": "/opt/gh-aw/safe-inputs/logs", + "logDir": "/opt/gh-aw/mcp-scripts/logs", "tools": [ { "name": "gh", - "description": "Execute any gh CLI command. This tool is accessible as 'safeinputs-gh'. Provide the full command after 'gh' (e.g., args: 'pr list --limit 5'). The tool will run: gh \u003cargs\u003e. Use single quotes ' for complex args to avoid shell interpretation issues.", + "description": "Execute any gh CLI command. This tool is accessible as 'mcpscripts-gh'. Provide the full command after 'gh' (e.g., args: 'pr list --limit 5'). The tool will run: gh \u003cargs\u003e. Use single quotes ' for complex args to avoid shell interpretation issues.", "inputSchema": { "properties": { "args": { @@ -659,30 +659,30 @@ jobs: } ] } - GH_AW_SAFE_INPUTS_TOOLS_EOF - cat > /opt/gh-aw/safe-inputs/mcp-server.cjs << 'GH_AW_SAFE_INPUTS_SERVER_EOF' + GH_AW_MCP_SCRIPTS_TOOLS_EOF + cat > /opt/gh-aw/mcp-scripts/mcp-server.cjs << 'GH_AW_MCP_SCRIPTS_SERVER_EOF' const path = require("path"); - const { startHttpServer } = require("./safe_inputs_mcp_server_http.cjs"); + const { startHttpServer } = require("./mcp_scripts_mcp_server_http.cjs"); const configPath = path.join(__dirname, "tools.json"); - const port = parseInt(process.env.GH_AW_SAFE_INPUTS_PORT || "3000", 10); - const apiKey = process.env.GH_AW_SAFE_INPUTS_API_KEY || ""; + const port = parseInt(process.env.GH_AW_MCP_SCRIPTS_PORT || "3000", 10); + const apiKey = process.env.GH_AW_MCP_SCRIPTS_API_KEY || ""; startHttpServer(configPath, { port: port, stateless: true, - logDir: "/opt/gh-aw/safe-inputs/logs" + logDir: "/opt/gh-aw/mcp-scripts/logs" }).catch(error => { - console.error("Failed to start safe-inputs HTTP server:", error); + console.error("Failed to start mcp-scripts HTTP server:", error); process.exit(1); }); - GH_AW_SAFE_INPUTS_SERVER_EOF - chmod +x /opt/gh-aw/safe-inputs/mcp-server.cjs + GH_AW_MCP_SCRIPTS_SERVER_EOF + chmod +x /opt/gh-aw/mcp-scripts/mcp-server.cjs - name: Setup Safe Inputs Tool Files run: | - cat > /opt/gh-aw/safe-inputs/gh.sh << 'GH_AW_SAFE_INPUTS_SH_GH_EOF' + cat > /opt/gh-aw/mcp-scripts/gh.sh << 'GH_AW_MCP_SCRIPTS_SH_GH_EOF' #!/bin/bash - # Auto-generated safe-input tool: gh - # Execute any gh CLI command. This tool is accessible as 'safeinputs-gh'. Provide the full command after 'gh' (e.g., args: 'pr list --limit 5'). The tool will run: gh . Use single quotes ' for complex args to avoid shell interpretation issues. + # Auto-generated mcp-script tool: gh + # Execute any gh CLI command. This tool is accessible as 'mcpscripts-gh'. Provide the full command after 'gh' (e.g., args: 'pr list --limit 5'). The tool will run: gh . Use single quotes ' for complex args to avoid shell interpretation issues. set -euo pipefail @@ -690,11 +690,11 @@ jobs: echo " token: ${GH_AW_GH_TOKEN:0:6}..." GH_TOKEN="$GH_AW_GH_TOKEN" gh $INPUT_ARGS - GH_AW_SAFE_INPUTS_SH_GH_EOF - chmod +x /opt/gh-aw/safe-inputs/gh.sh + GH_AW_MCP_SCRIPTS_SH_GH_EOF + chmod +x /opt/gh-aw/mcp-scripts/gh.sh - - name: Generate Safe Inputs MCP Server Config - id: safe-inputs-config + - name: Generate MCP Scripts Server Config + id: mcp-scripts-config run: | # Generate a secure random API key (360 bits of entropy, 40+ chars) # Mask immediately to prevent timing vulnerabilities @@ -705,34 +705,34 @@ jobs: # Set outputs for next steps { - echo "safe_inputs_api_key=${API_KEY}" - echo "safe_inputs_port=${PORT}" + echo "mcp_scripts_api_key=${API_KEY}" + echo "mcp_scripts_port=${PORT}" } >> "$GITHUB_OUTPUT" echo "Safe Inputs MCP server will run on port ${PORT}" - - name: Start Safe Inputs MCP HTTP Server - id: safe-inputs-start + - name: Start MCP Scripts HTTP Server + id: mcp-scripts-start env: DEBUG: '*' - GH_AW_SAFE_INPUTS_PORT: ${{ steps.safe-inputs-config.outputs.safe_inputs_port }} - GH_AW_SAFE_INPUTS_API_KEY: ${{ steps.safe-inputs-config.outputs.safe_inputs_api_key }} + GH_AW_MCP_SCRIPTS_PORT: ${{ steps.mcp-scripts-config.outputs.mcp_scripts_port }} + GH_AW_MCP_SCRIPTS_API_KEY: ${{ steps.mcp-scripts-config.outputs.mcp_scripts_api_key }} GH_AW_GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} GH_DEBUG: 1 run: | # Environment variables are set above to prevent template injection export DEBUG - export GH_AW_SAFE_INPUTS_PORT - export GH_AW_SAFE_INPUTS_API_KEY + export GH_AW_MCP_SCRIPTS_PORT + export GH_AW_MCP_SCRIPTS_API_KEY - bash /opt/gh-aw/actions/start_safe_inputs_server.sh + bash /opt/gh-aw/actions/start_mcp_scripts_server.sh - name: Start MCP Gateway id: start-mcp-gateway env: GH_AW_GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - GH_AW_SAFE_INPUTS_API_KEY: ${{ steps.safe-inputs-start.outputs.api_key }} - GH_AW_SAFE_INPUTS_PORT: ${{ steps.safe-inputs-start.outputs.port }} + GH_AW_MCP_SCRIPTS_API_KEY: ${{ steps.mcp-scripts-start.outputs.api_key }} + GH_AW_MCP_SCRIPTS_PORT: ${{ steps.mcp-scripts-start.outputs.port }} GH_AW_SAFE_OUTPUTS: ${{ env.GH_AW_SAFE_OUTPUTS }} GH_AW_SAFE_OUTPUTS_API_KEY: ${{ steps.safe-outputs-start.outputs.api_key }} GH_AW_SAFE_OUTPUTS_PORT: ${{ steps.safe-outputs-start.outputs.port }} @@ -755,7 +755,7 @@ jobs: export DEBUG="*" export GH_AW_ENGINE="copilot" - export MCP_GATEWAY_DOCKER_COMMAND='docker run -i --rm --network host -v /var/run/docker.sock:/var/run/docker.sock -e MCP_GATEWAY_PORT -e MCP_GATEWAY_DOMAIN -e MCP_GATEWAY_API_KEY -e MCP_GATEWAY_PAYLOAD_DIR -e MCP_GATEWAY_PAYLOAD_SIZE_THRESHOLD -e DEBUG -e MCP_GATEWAY_LOG_DIR -e GH_AW_MCP_LOG_DIR -e GH_AW_SAFE_OUTPUTS -e GH_AW_SAFE_OUTPUTS_CONFIG_PATH -e GH_AW_SAFE_OUTPUTS_TOOLS_PATH -e GH_AW_ASSETS_BRANCH -e GH_AW_ASSETS_MAX_SIZE_KB -e GH_AW_ASSETS_ALLOWED_EXTS -e DEFAULT_BRANCH -e GITHUB_MCP_SERVER_TOKEN -e GITHUB_MCP_LOCKDOWN -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e GITHUB_SHA -e GITHUB_WORKSPACE -e GITHUB_TOKEN -e GITHUB_RUN_ID -e GITHUB_RUN_NUMBER -e GITHUB_RUN_ATTEMPT -e GITHUB_JOB -e GITHUB_ACTION -e GITHUB_EVENT_NAME -e GITHUB_EVENT_PATH -e GITHUB_ACTOR -e GITHUB_ACTOR_ID -e GITHUB_TRIGGERING_ACTOR -e GITHUB_WORKFLOW -e GITHUB_WORKFLOW_REF -e GITHUB_WORKFLOW_SHA -e GITHUB_REF -e GITHUB_REF_NAME -e GITHUB_REF_TYPE -e GITHUB_HEAD_REF -e GITHUB_BASE_REF -e GH_AW_SAFE_INPUTS_PORT -e GH_AW_SAFE_INPUTS_API_KEY -e GH_AW_SAFE_OUTPUTS_PORT -e GH_AW_SAFE_OUTPUTS_API_KEY -e GH_AW_GH_TOKEN -e GH_DEBUG -v /tmp/gh-aw/mcp-payloads:/tmp/gh-aw/mcp-payloads:rw -v /opt:/opt:ro -v /tmp:/tmp:rw -v '"${GITHUB_WORKSPACE}"':'"${GITHUB_WORKSPACE}"':rw ghcr.io/github/gh-aw-mcpg:v0.1.8' + export MCP_GATEWAY_DOCKER_COMMAND='docker run -i --rm --network host -v /var/run/docker.sock:/var/run/docker.sock -e MCP_GATEWAY_PORT -e MCP_GATEWAY_DOMAIN -e MCP_GATEWAY_API_KEY -e MCP_GATEWAY_PAYLOAD_DIR -e MCP_GATEWAY_PAYLOAD_SIZE_THRESHOLD -e DEBUG -e MCP_GATEWAY_LOG_DIR -e GH_AW_MCP_LOG_DIR -e GH_AW_SAFE_OUTPUTS -e GH_AW_SAFE_OUTPUTS_CONFIG_PATH -e GH_AW_SAFE_OUTPUTS_TOOLS_PATH -e GH_AW_ASSETS_BRANCH -e GH_AW_ASSETS_MAX_SIZE_KB -e GH_AW_ASSETS_ALLOWED_EXTS -e DEFAULT_BRANCH -e GITHUB_MCP_SERVER_TOKEN -e GITHUB_MCP_LOCKDOWN -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e GITHUB_SHA -e GITHUB_WORKSPACE -e GITHUB_TOKEN -e GITHUB_RUN_ID -e GITHUB_RUN_NUMBER -e GITHUB_RUN_ATTEMPT -e GITHUB_JOB -e GITHUB_ACTION -e GITHUB_EVENT_NAME -e GITHUB_EVENT_PATH -e GITHUB_ACTOR -e GITHUB_ACTOR_ID -e GITHUB_TRIGGERING_ACTOR -e GITHUB_WORKFLOW -e GITHUB_WORKFLOW_REF -e GITHUB_WORKFLOW_SHA -e GITHUB_REF -e GITHUB_REF_NAME -e GITHUB_REF_TYPE -e GITHUB_HEAD_REF -e GITHUB_BASE_REF -e GH_AW_MCP_SCRIPTS_PORT -e GH_AW_MCP_SCRIPTS_API_KEY -e GH_AW_SAFE_OUTPUTS_PORT -e GH_AW_SAFE_OUTPUTS_API_KEY -e GH_AW_GH_TOKEN -e GH_DEBUG -v /tmp/gh-aw/mcp-payloads:/tmp/gh-aw/mcp-payloads:rw -v /opt:/opt:ro -v /tmp:/tmp:rw -v '"${GITHUB_WORKSPACE}"':'"${GITHUB_WORKSPACE}"':rw ghcr.io/github/gh-aw-mcpg:v0.1.8' mkdir -p /home/runner/.copilot cat << GH_AW_MCP_CONFIG_EOF | bash /opt/gh-aw/actions/start_mcp_gateway.sh @@ -771,11 +771,11 @@ jobs: "GITHUB_TOOLSETS": "context,repos,issues,pull_requests" } }, - "safeinputs": { + "mcpscripts": { "type": "http", - "url": "http://host.docker.internal:$GH_AW_SAFE_INPUTS_PORT", + "url": "http://host.docker.internal:$GH_AW_MCP_SCRIPTS_PORT", "headers": { - "Authorization": "\${GH_AW_SAFE_INPUTS_API_KEY}" + "Authorization": "\${GH_AW_MCP_SCRIPTS_API_KEY}" } }, "safeoutputs": { @@ -948,7 +948,7 @@ jobs: script: | const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs'); setupGlobals(core, github, context, exec, io); - const { main } = require('/opt/gh-aw/actions/parse_safe_inputs_logs.cjs'); + const { main } = require('/opt/gh-aw/actions/parse_mcp_scripts_logs.cjs'); await main(); - name: Parse MCP Gateway logs for step summary if: always() @@ -989,7 +989,7 @@ jobs: path: | /tmp/gh-aw/aw-prompts/prompt.txt /tmp/gh-aw/mcp-logs/ - /tmp/gh-aw/safe-inputs/logs/ + /tmp/gh-aw/mcp-scripts/logs/ /tmp/gh-aw/sandbox/firewall/logs/ /tmp/gh-aw/agent-stdio.log /tmp/gh-aw/agent/ diff --git a/.github/workflows/copilot-pr-merged-report.md b/.github/workflows/copilot-pr-merged-report.md index 2f7b07b356e..6f0406f86a3 100644 --- a/.github/workflows/copilot-pr-merged-report.md +++ b/.github/workflows/copilot-pr-merged-report.md @@ -75,7 +75,7 @@ echo "Looking for PRs merged since: $DATE_24H_AGO" **Step 1.2: Search for Merged Copilot PRs** -Use the `safeinputs-gh` safe-input tool to search for merged PRs from Copilot: +Use the `safeinputs-gh` mcp-script tool to search for merged PRs from Copilot: ``` safeinputs-gh with args: "pr list --repo ${{ github.repository }} --search \"head:copilot/ is:merged merged:>=$DATE_24H_AGO\" --state merged --limit 100 --json number,title,mergedAt,additions,deletions,files,url" ``` @@ -263,7 +263,7 @@ A successful report: - ✅ Creates discussion in "audits" category - ✅ Completes within 10-minute timeout -Begin your analysis now. Use the `gh` safe-input tool for all GitHub CLI operations. +Begin your analysis now. Use the `gh` mcp-script tool for all GitHub CLI operations. **Important**: If no action is needed after completing your analysis, you **MUST** call the `noop` safe-output tool with a brief explanation. Failing to call any safe-output tool is the most common cause of safe-output workflow failures. diff --git a/.github/workflows/daily-cli-performance.lock.yml b/.github/workflows/daily-cli-performance.lock.yml index 086eb138db1..9bd2e8de9fe 100644 --- a/.github/workflows/daily-cli-performance.lock.yml +++ b/.github/workflows/daily-cli-performance.lock.yml @@ -28,7 +28,7 @@ # - shared/go-make.md # - shared/reporting.md # -# gh-aw-metadata: {"schema_version":"v2","frontmatter_hash":"a573baa1f4c6a22b57c781ccbf0dce23b1dd16f5ab2609d3a27782be2705a95a","strict":true} +# gh-aw-metadata: {"schema_version":"v2","frontmatter_hash":"51987ab5257e9b3550645f687dc7466a89ae9cadf175e1661c673806228f207b","strict":true} name: "Daily CLI Performance Agent" "on": @@ -710,16 +710,16 @@ jobs: - name: Setup Safe Inputs Config run: | - mkdir -p /opt/gh-aw/safe-inputs/logs - cat > /opt/gh-aw/safe-inputs/tools.json << 'GH_AW_SAFE_INPUTS_TOOLS_EOF' + mkdir -p /opt/gh-aw/mcp-scripts/logs + cat > /opt/gh-aw/mcp-scripts/tools.json << 'GH_AW_MCP_SCRIPTS_TOOLS_EOF' { - "serverName": "safeinputs", + "serverName": "mcpscripts", "version": "1.0.0", - "logDir": "/opt/gh-aw/safe-inputs/logs", + "logDir": "/opt/gh-aw/mcp-scripts/logs", "tools": [ { "name": "go", - "description": "Execute any Go command. This tool is accessible as 'safeinputs-go'. Provide the full command after 'go' (e.g., args: 'test ./...'). The tool will run: go \u003cargs\u003e. Use single quotes ' for complex args to avoid shell interpretation issues.", + "description": "Execute any Go command. This tool is accessible as 'mcpscripts-go'. Provide the full command after 'go' (e.g., args: 'test ./...'). The tool will run: go \u003cargs\u003e. Use single quotes ' for complex args to avoid shell interpretation issues.", "inputSchema": { "properties": { "args": { @@ -737,7 +737,7 @@ jobs: }, { "name": "make", - "description": "Execute any Make target. This tool is accessible as 'safeinputs-make'. Provide the target name(s) (e.g., args: 'build'). The tool will run: make \u003cargs\u003e. Use single quotes ' for complex args to avoid shell interpretation issues.", + "description": "Execute any Make target. This tool is accessible as 'mcpscripts-make'. Provide the target name(s) (e.g., args: 'build'). The tool will run: make \u003cargs\u003e. Use single quotes ' for complex args to avoid shell interpretation issues.", "inputSchema": { "properties": { "args": { @@ -755,30 +755,30 @@ jobs: } ] } - GH_AW_SAFE_INPUTS_TOOLS_EOF - cat > /opt/gh-aw/safe-inputs/mcp-server.cjs << 'GH_AW_SAFE_INPUTS_SERVER_EOF' + GH_AW_MCP_SCRIPTS_TOOLS_EOF + cat > /opt/gh-aw/mcp-scripts/mcp-server.cjs << 'GH_AW_MCP_SCRIPTS_SERVER_EOF' const path = require("path"); - const { startHttpServer } = require("./safe_inputs_mcp_server_http.cjs"); + const { startHttpServer } = require("./mcp_scripts_mcp_server_http.cjs"); const configPath = path.join(__dirname, "tools.json"); - const port = parseInt(process.env.GH_AW_SAFE_INPUTS_PORT || "3000", 10); - const apiKey = process.env.GH_AW_SAFE_INPUTS_API_KEY || ""; + const port = parseInt(process.env.GH_AW_MCP_SCRIPTS_PORT || "3000", 10); + const apiKey = process.env.GH_AW_MCP_SCRIPTS_API_KEY || ""; startHttpServer(configPath, { port: port, stateless: true, - logDir: "/opt/gh-aw/safe-inputs/logs" + logDir: "/opt/gh-aw/mcp-scripts/logs" }).catch(error => { - console.error("Failed to start safe-inputs HTTP server:", error); + console.error("Failed to start mcp-scripts HTTP server:", error); process.exit(1); }); - GH_AW_SAFE_INPUTS_SERVER_EOF - chmod +x /opt/gh-aw/safe-inputs/mcp-server.cjs + GH_AW_MCP_SCRIPTS_SERVER_EOF + chmod +x /opt/gh-aw/mcp-scripts/mcp-server.cjs - name: Setup Safe Inputs Tool Files run: | - cat > /opt/gh-aw/safe-inputs/go.sh << 'GH_AW_SAFE_INPUTS_SH_GO_EOF' + cat > /opt/gh-aw/mcp-scripts/go.sh << 'GH_AW_MCP_SCRIPTS_SH_GO_EOF' #!/bin/bash - # Auto-generated safe-input tool: go - # Execute any Go command. This tool is accessible as 'safeinputs-go'. Provide the full command after 'go' (e.g., args: 'test ./...'). The tool will run: go . Use single quotes ' for complex args to avoid shell interpretation issues. + # Auto-generated mcp-script tool: go + # Execute any Go command. This tool is accessible as 'mcpscripts-go'. Provide the full command after 'go' (e.g., args: 'test ./...'). The tool will run: go . Use single quotes ' for complex args to avoid shell interpretation issues. set -euo pipefail @@ -786,23 +786,23 @@ jobs: go $INPUT_ARGS - GH_AW_SAFE_INPUTS_SH_GO_EOF - chmod +x /opt/gh-aw/safe-inputs/go.sh - cat > /opt/gh-aw/safe-inputs/make.sh << 'GH_AW_SAFE_INPUTS_SH_MAKE_EOF' + GH_AW_MCP_SCRIPTS_SH_GO_EOF + chmod +x /opt/gh-aw/mcp-scripts/go.sh + cat > /opt/gh-aw/mcp-scripts/make.sh << 'GH_AW_MCP_SCRIPTS_SH_MAKE_EOF' #!/bin/bash - # Auto-generated safe-input tool: make - # Execute any Make target. This tool is accessible as 'safeinputs-make'. Provide the target name(s) (e.g., args: 'build'). The tool will run: make . Use single quotes ' for complex args to avoid shell interpretation issues. + # Auto-generated mcp-script tool: make + # Execute any Make target. This tool is accessible as 'mcpscripts-make'. Provide the target name(s) (e.g., args: 'build'). The tool will run: make . Use single quotes ' for complex args to avoid shell interpretation issues. set -euo pipefail echo "make $INPUT_ARGS" make $INPUT_ARGS - GH_AW_SAFE_INPUTS_SH_MAKE_EOF - chmod +x /opt/gh-aw/safe-inputs/make.sh + GH_AW_MCP_SCRIPTS_SH_MAKE_EOF + chmod +x /opt/gh-aw/mcp-scripts/make.sh - - name: Generate Safe Inputs MCP Server Config - id: safe-inputs-config + - name: Generate MCP Scripts Server Config + id: mcp-scripts-config run: | # Generate a secure random API key (360 bits of entropy, 40+ chars) # Mask immediately to prevent timing vulnerabilities @@ -813,31 +813,31 @@ jobs: # Set outputs for next steps { - echo "safe_inputs_api_key=${API_KEY}" - echo "safe_inputs_port=${PORT}" + echo "mcp_scripts_api_key=${API_KEY}" + echo "mcp_scripts_port=${PORT}" } >> "$GITHUB_OUTPUT" echo "Safe Inputs MCP server will run on port ${PORT}" - - name: Start Safe Inputs MCP HTTP Server - id: safe-inputs-start + - name: Start MCP Scripts HTTP Server + id: mcp-scripts-start env: DEBUG: '*' - GH_AW_SAFE_INPUTS_PORT: ${{ steps.safe-inputs-config.outputs.safe_inputs_port }} - GH_AW_SAFE_INPUTS_API_KEY: ${{ steps.safe-inputs-config.outputs.safe_inputs_api_key }} + GH_AW_MCP_SCRIPTS_PORT: ${{ steps.mcp-scripts-config.outputs.mcp_scripts_port }} + GH_AW_MCP_SCRIPTS_API_KEY: ${{ steps.mcp-scripts-config.outputs.mcp_scripts_api_key }} run: | # Environment variables are set above to prevent template injection export DEBUG - export GH_AW_SAFE_INPUTS_PORT - export GH_AW_SAFE_INPUTS_API_KEY + export GH_AW_MCP_SCRIPTS_PORT + export GH_AW_MCP_SCRIPTS_API_KEY - bash /opt/gh-aw/actions/start_safe_inputs_server.sh + bash /opt/gh-aw/actions/start_mcp_scripts_server.sh - name: Start MCP Gateway id: start-mcp-gateway env: - GH_AW_SAFE_INPUTS_API_KEY: ${{ steps.safe-inputs-start.outputs.api_key }} - GH_AW_SAFE_INPUTS_PORT: ${{ steps.safe-inputs-start.outputs.port }} + GH_AW_MCP_SCRIPTS_API_KEY: ${{ steps.mcp-scripts-start.outputs.api_key }} + GH_AW_MCP_SCRIPTS_PORT: ${{ steps.mcp-scripts-start.outputs.port }} GH_AW_SAFE_OUTPUTS: ${{ env.GH_AW_SAFE_OUTPUTS }} GH_AW_SAFE_OUTPUTS_API_KEY: ${{ steps.safe-outputs-start.outputs.api_key }} GH_AW_SAFE_OUTPUTS_PORT: ${{ steps.safe-outputs-start.outputs.port }} @@ -859,7 +859,7 @@ jobs: export DEBUG="*" export GH_AW_ENGINE="copilot" - export MCP_GATEWAY_DOCKER_COMMAND='docker run -i --rm --network host -v /var/run/docker.sock:/var/run/docker.sock -e MCP_GATEWAY_PORT -e MCP_GATEWAY_DOMAIN -e MCP_GATEWAY_API_KEY -e MCP_GATEWAY_PAYLOAD_DIR -e MCP_GATEWAY_PAYLOAD_SIZE_THRESHOLD -e DEBUG -e MCP_GATEWAY_LOG_DIR -e GH_AW_MCP_LOG_DIR -e GH_AW_SAFE_OUTPUTS -e GH_AW_SAFE_OUTPUTS_CONFIG_PATH -e GH_AW_SAFE_OUTPUTS_TOOLS_PATH -e GH_AW_ASSETS_BRANCH -e GH_AW_ASSETS_MAX_SIZE_KB -e GH_AW_ASSETS_ALLOWED_EXTS -e DEFAULT_BRANCH -e GITHUB_MCP_SERVER_TOKEN -e GITHUB_MCP_LOCKDOWN -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e GITHUB_SHA -e GITHUB_WORKSPACE -e GITHUB_TOKEN -e GITHUB_RUN_ID -e GITHUB_RUN_NUMBER -e GITHUB_RUN_ATTEMPT -e GITHUB_JOB -e GITHUB_ACTION -e GITHUB_EVENT_NAME -e GITHUB_EVENT_PATH -e GITHUB_ACTOR -e GITHUB_ACTOR_ID -e GITHUB_TRIGGERING_ACTOR -e GITHUB_WORKFLOW -e GITHUB_WORKFLOW_REF -e GITHUB_WORKFLOW_SHA -e GITHUB_REF -e GITHUB_REF_NAME -e GITHUB_REF_TYPE -e GITHUB_HEAD_REF -e GITHUB_BASE_REF -e GH_AW_SAFE_INPUTS_PORT -e GH_AW_SAFE_INPUTS_API_KEY -e GH_AW_SAFE_OUTPUTS_PORT -e GH_AW_SAFE_OUTPUTS_API_KEY -v /tmp/gh-aw/mcp-payloads:/tmp/gh-aw/mcp-payloads:rw -v /opt:/opt:ro -v /tmp:/tmp:rw -v '"${GITHUB_WORKSPACE}"':'"${GITHUB_WORKSPACE}"':rw ghcr.io/github/gh-aw-mcpg:v0.1.8' + export MCP_GATEWAY_DOCKER_COMMAND='docker run -i --rm --network host -v /var/run/docker.sock:/var/run/docker.sock -e MCP_GATEWAY_PORT -e MCP_GATEWAY_DOMAIN -e MCP_GATEWAY_API_KEY -e MCP_GATEWAY_PAYLOAD_DIR -e MCP_GATEWAY_PAYLOAD_SIZE_THRESHOLD -e DEBUG -e MCP_GATEWAY_LOG_DIR -e GH_AW_MCP_LOG_DIR -e GH_AW_SAFE_OUTPUTS -e GH_AW_SAFE_OUTPUTS_CONFIG_PATH -e GH_AW_SAFE_OUTPUTS_TOOLS_PATH -e GH_AW_ASSETS_BRANCH -e GH_AW_ASSETS_MAX_SIZE_KB -e GH_AW_ASSETS_ALLOWED_EXTS -e DEFAULT_BRANCH -e GITHUB_MCP_SERVER_TOKEN -e GITHUB_MCP_LOCKDOWN -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e GITHUB_SHA -e GITHUB_WORKSPACE -e GITHUB_TOKEN -e GITHUB_RUN_ID -e GITHUB_RUN_NUMBER -e GITHUB_RUN_ATTEMPT -e GITHUB_JOB -e GITHUB_ACTION -e GITHUB_EVENT_NAME -e GITHUB_EVENT_PATH -e GITHUB_ACTOR -e GITHUB_ACTOR_ID -e GITHUB_TRIGGERING_ACTOR -e GITHUB_WORKFLOW -e GITHUB_WORKFLOW_REF -e GITHUB_WORKFLOW_SHA -e GITHUB_REF -e GITHUB_REF_NAME -e GITHUB_REF_TYPE -e GITHUB_HEAD_REF -e GITHUB_BASE_REF -e GH_AW_MCP_SCRIPTS_PORT -e GH_AW_MCP_SCRIPTS_API_KEY -e GH_AW_SAFE_OUTPUTS_PORT -e GH_AW_SAFE_OUTPUTS_API_KEY -v /tmp/gh-aw/mcp-payloads:/tmp/gh-aw/mcp-payloads:rw -v /opt:/opt:ro -v /tmp:/tmp:rw -v '"${GITHUB_WORKSPACE}"':'"${GITHUB_WORKSPACE}"':rw ghcr.io/github/gh-aw-mcpg:v0.1.8' mkdir -p /home/runner/.copilot cat << GH_AW_MCP_CONFIG_EOF | bash /opt/gh-aw/actions/start_mcp_gateway.sh @@ -875,11 +875,11 @@ jobs: "GITHUB_TOOLSETS": "context,repos,issues,pull_requests" } }, - "safeinputs": { + "mcpscripts": { "type": "http", - "url": "http://host.docker.internal:$GH_AW_SAFE_INPUTS_PORT", + "url": "http://host.docker.internal:$GH_AW_MCP_SCRIPTS_PORT", "headers": { - "Authorization": "\${GH_AW_SAFE_INPUTS_API_KEY}" + "Authorization": "\${GH_AW_MCP_SCRIPTS_API_KEY}" } }, "safeoutputs": { @@ -1050,7 +1050,7 @@ jobs: script: | const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs'); setupGlobals(core, github, context, exec, io); - const { main } = require('/opt/gh-aw/actions/parse_safe_inputs_logs.cjs'); + const { main } = require('/opt/gh-aw/actions/parse_mcp_scripts_logs.cjs'); await main(); - name: Parse MCP Gateway logs for step summary if: always() @@ -1094,7 +1094,7 @@ jobs: path: | /tmp/gh-aw/aw-prompts/prompt.txt /tmp/gh-aw/mcp-logs/ - /tmp/gh-aw/safe-inputs/logs/ + /tmp/gh-aw/mcp-scripts/logs/ /tmp/gh-aw/sandbox/firewall/logs/ /tmp/gh-aw/agent-stdio.log /tmp/gh-aw/agent/ diff --git a/.github/workflows/daily-cli-performance.md b/.github/workflows/daily-cli-performance.md index 318417879f6..b0f0dbb8f7a 100644 --- a/.github/workflows/daily-cli-performance.md +++ b/.github/workflows/daily-cli-performance.md @@ -57,7 +57,7 @@ This workflow imports `shared/go-make.md` which provides: - **safeinputs-go** - Execute Go commands (e.g., args: "test ./...", "build ./cmd/gh-aw") - **safeinputs-make** - Execute Make targets (e.g., args: "build", "test-unit", "bench") -**IMPORTANT**: Always use these safe-input tools for Go and Make commands instead of running them directly via bash. +**IMPORTANT**: Always use these mcp-script tools for Go and Make commands instead of running them directly via bash. ## Phase 1: Run Performance Benchmarks diff --git a/.github/workflows/daily-performance-summary.lock.yml b/.github/workflows/daily-performance-summary.lock.yml index bf229b33e57..4a5a657370b 100644 --- a/.github/workflows/daily-performance-summary.lock.yml +++ b/.github/workflows/daily-performance-summary.lock.yml @@ -21,15 +21,15 @@ # # For more information: https://github.github.com/gh-aw/introduction/overview/ # -# Daily project performance summary (90-day window) with trend charts using safe-inputs +# Daily project performance summary (90-day window) with trend charts using mcp-scripts # # Resolved workflow manifest: # Imports: -# - shared/github-queries-safe-input.md +# - shared/github-queries-mcp-script.md # - shared/reporting.md # - shared/trending-charts-simple.md # -# gh-aw-metadata: {"schema_version":"v2","frontmatter_hash":"e122dc205e62037c58443024bb7827fc2c4474c74536e2043be657fe4d9c79a2","strict":true} +# gh-aw-metadata: {"schema_version":"v2","frontmatter_hash":"c18fdbf83211c18b0c1841b7350de90b0a4b88a7a5a0a0c2026345fc6054c691","strict":true} name: "Daily Project Performance Summary Generator (Using Safe Inputs)" "on": @@ -175,7 +175,7 @@ jobs: GH_AW_PROMPT_EOF cat << 'GH_AW_PROMPT_EOF' - {{#runtime-import .github/workflows/shared/github-queries-safe-input.md}} + {{#runtime-import .github/workflows/shared/github-queries-mcp-script.md}} GH_AW_PROMPT_EOF cat << 'GH_AW_PROMPT_EOF' {{#runtime-import .github/workflows/shared/trending-charts-simple.md}} @@ -747,12 +747,12 @@ jobs: - name: Setup Safe Inputs Config run: | - mkdir -p /opt/gh-aw/safe-inputs/logs - cat > /opt/gh-aw/safe-inputs/tools.json << 'GH_AW_SAFE_INPUTS_TOOLS_EOF' + mkdir -p /opt/gh-aw/mcp-scripts/logs + cat > /opt/gh-aw/mcp-scripts/tools.json << 'GH_AW_MCP_SCRIPTS_TOOLS_EOF' { - "serverName": "safeinputs", + "serverName": "mcpscripts", "version": "1.0.0", - "logDir": "/opt/gh-aw/safe-inputs/logs", + "logDir": "/opt/gh-aw/mcp-scripts/logs", "tools": [ { "name": "github-discussion-query", @@ -842,29 +842,29 @@ jobs: } ] } - GH_AW_SAFE_INPUTS_TOOLS_EOF - cat > /opt/gh-aw/safe-inputs/mcp-server.cjs << 'GH_AW_SAFE_INPUTS_SERVER_EOF' + GH_AW_MCP_SCRIPTS_TOOLS_EOF + cat > /opt/gh-aw/mcp-scripts/mcp-server.cjs << 'GH_AW_MCP_SCRIPTS_SERVER_EOF' const path = require("path"); - const { startHttpServer } = require("./safe_inputs_mcp_server_http.cjs"); + const { startHttpServer } = require("./mcp_scripts_mcp_server_http.cjs"); const configPath = path.join(__dirname, "tools.json"); - const port = parseInt(process.env.GH_AW_SAFE_INPUTS_PORT || "3000", 10); - const apiKey = process.env.GH_AW_SAFE_INPUTS_API_KEY || ""; + const port = parseInt(process.env.GH_AW_MCP_SCRIPTS_PORT || "3000", 10); + const apiKey = process.env.GH_AW_MCP_SCRIPTS_API_KEY || ""; startHttpServer(configPath, { port: port, stateless: true, - logDir: "/opt/gh-aw/safe-inputs/logs" + logDir: "/opt/gh-aw/mcp-scripts/logs" }).catch(error => { - console.error("Failed to start safe-inputs HTTP server:", error); + console.error("Failed to start mcp-scripts HTTP server:", error); process.exit(1); }); - GH_AW_SAFE_INPUTS_SERVER_EOF - chmod +x /opt/gh-aw/safe-inputs/mcp-server.cjs + GH_AW_MCP_SCRIPTS_SERVER_EOF + chmod +x /opt/gh-aw/mcp-scripts/mcp-server.cjs - name: Setup Safe Inputs Tool Files run: | - cat > /opt/gh-aw/safe-inputs/github-discussion-query.sh << 'GH_AW_SAFE_INPUTS_SH_GITHUB-DISCUSSION-QUERY_EOF' + cat > /opt/gh-aw/mcp-scripts/github-discussion-query.sh << 'GH_AW_MCP_SCRIPTS_SH_GITHUB-DISCUSSION-QUERY_EOF' #!/bin/bash - # Auto-generated safe-input tool: github-discussion-query + # Auto-generated mcp-script tool: github-discussion-query # Query GitHub discussions with jq filtering support. Without --jq, returns schema and data size info. Use --jq '.' to get all data, or specific jq expressions to filter. set -euo pipefail @@ -997,11 +997,11 @@ jobs: EOF fi - GH_AW_SAFE_INPUTS_SH_GITHUB-DISCUSSION-QUERY_EOF - chmod +x /opt/gh-aw/safe-inputs/github-discussion-query.sh - cat > /opt/gh-aw/safe-inputs/github-issue-query.sh << 'GH_AW_SAFE_INPUTS_SH_GITHUB-ISSUE-QUERY_EOF' + GH_AW_MCP_SCRIPTS_SH_GITHUB-DISCUSSION-QUERY_EOF + chmod +x /opt/gh-aw/mcp-scripts/github-discussion-query.sh + cat > /opt/gh-aw/mcp-scripts/github-issue-query.sh << 'GH_AW_MCP_SCRIPTS_SH_GITHUB-ISSUE-QUERY_EOF' #!/bin/bash - # Auto-generated safe-input tool: github-issue-query + # Auto-generated mcp-script tool: github-issue-query # Query GitHub issues with jq filtering support. Without --jq, returns schema and data size info. Use --jq '.' to get all data, or specific jq expressions to filter. set -euo pipefail @@ -1078,11 +1078,11 @@ jobs: fi - GH_AW_SAFE_INPUTS_SH_GITHUB-ISSUE-QUERY_EOF - chmod +x /opt/gh-aw/safe-inputs/github-issue-query.sh - cat > /opt/gh-aw/safe-inputs/github-pr-query.sh << 'GH_AW_SAFE_INPUTS_SH_GITHUB-PR-QUERY_EOF' + GH_AW_MCP_SCRIPTS_SH_GITHUB-ISSUE-QUERY_EOF + chmod +x /opt/gh-aw/mcp-scripts/github-issue-query.sh + cat > /opt/gh-aw/mcp-scripts/github-pr-query.sh << 'GH_AW_MCP_SCRIPTS_SH_GITHUB-PR-QUERY_EOF' #!/bin/bash - # Auto-generated safe-input tool: github-pr-query + # Auto-generated mcp-script tool: github-pr-query # Query GitHub pull requests with jq filtering support. Without --jq, returns schema and data size info. Use --jq '.' to get all data, or specific jq expressions to filter. set -euo pipefail @@ -1165,11 +1165,11 @@ jobs: fi - GH_AW_SAFE_INPUTS_SH_GITHUB-PR-QUERY_EOF - chmod +x /opt/gh-aw/safe-inputs/github-pr-query.sh + GH_AW_MCP_SCRIPTS_SH_GITHUB-PR-QUERY_EOF + chmod +x /opt/gh-aw/mcp-scripts/github-pr-query.sh - - name: Generate Safe Inputs MCP Server Config - id: safe-inputs-config + - name: Generate MCP Scripts Server Config + id: mcp-scripts-config run: | # Generate a secure random API key (360 bits of entropy, 40+ chars) # Mask immediately to prevent timing vulnerabilities @@ -1180,26 +1180,26 @@ jobs: # Set outputs for next steps { - echo "safe_inputs_api_key=${API_KEY}" - echo "safe_inputs_port=${PORT}" + echo "mcp_scripts_api_key=${API_KEY}" + echo "mcp_scripts_port=${PORT}" } >> "$GITHUB_OUTPUT" echo "Safe Inputs MCP server will run on port ${PORT}" - - name: Start Safe Inputs MCP HTTP Server - id: safe-inputs-start + - name: Start MCP Scripts HTTP Server + id: mcp-scripts-start env: DEBUG: '*' - GH_AW_SAFE_INPUTS_PORT: ${{ steps.safe-inputs-config.outputs.safe_inputs_port }} - GH_AW_SAFE_INPUTS_API_KEY: ${{ steps.safe-inputs-config.outputs.safe_inputs_api_key }} + GH_AW_MCP_SCRIPTS_PORT: ${{ steps.mcp-scripts-config.outputs.mcp_scripts_port }} + GH_AW_MCP_SCRIPTS_API_KEY: ${{ steps.mcp-scripts-config.outputs.mcp_scripts_api_key }} GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} run: | # Environment variables are set above to prevent template injection export DEBUG - export GH_AW_SAFE_INPUTS_PORT - export GH_AW_SAFE_INPUTS_API_KEY + export GH_AW_MCP_SCRIPTS_PORT + export GH_AW_MCP_SCRIPTS_API_KEY - bash /opt/gh-aw/actions/start_safe_inputs_server.sh + bash /opt/gh-aw/actions/start_mcp_scripts_server.sh - name: Start MCP Gateway id: start-mcp-gateway @@ -1207,8 +1207,8 @@ jobs: GH_AW_ASSETS_ALLOWED_EXTS: ${{ env.GH_AW_ASSETS_ALLOWED_EXTS }} GH_AW_ASSETS_BRANCH: ${{ env.GH_AW_ASSETS_BRANCH }} GH_AW_ASSETS_MAX_SIZE_KB: ${{ env.GH_AW_ASSETS_MAX_SIZE_KB }} - GH_AW_SAFE_INPUTS_API_KEY: ${{ steps.safe-inputs-start.outputs.api_key }} - GH_AW_SAFE_INPUTS_PORT: ${{ steps.safe-inputs-start.outputs.port }} + GH_AW_MCP_SCRIPTS_API_KEY: ${{ steps.mcp-scripts-start.outputs.api_key }} + GH_AW_MCP_SCRIPTS_PORT: ${{ steps.mcp-scripts-start.outputs.port }} GH_AW_SAFE_OUTPUTS: ${{ env.GH_AW_SAFE_OUTPUTS }} GH_AW_SAFE_OUTPUTS_API_KEY: ${{ steps.safe-outputs-start.outputs.api_key }} GH_AW_SAFE_OUTPUTS_PORT: ${{ steps.safe-outputs-start.outputs.port }} @@ -1231,7 +1231,7 @@ jobs: export DEBUG="*" export GH_AW_ENGINE="copilot" - export MCP_GATEWAY_DOCKER_COMMAND='docker run -i --rm --network host -v /var/run/docker.sock:/var/run/docker.sock -e MCP_GATEWAY_PORT -e MCP_GATEWAY_DOMAIN -e MCP_GATEWAY_API_KEY -e MCP_GATEWAY_PAYLOAD_DIR -e MCP_GATEWAY_PAYLOAD_SIZE_THRESHOLD -e DEBUG -e MCP_GATEWAY_LOG_DIR -e GH_AW_MCP_LOG_DIR -e GH_AW_SAFE_OUTPUTS -e GH_AW_SAFE_OUTPUTS_CONFIG_PATH -e GH_AW_SAFE_OUTPUTS_TOOLS_PATH -e GH_AW_ASSETS_BRANCH -e GH_AW_ASSETS_MAX_SIZE_KB -e GH_AW_ASSETS_ALLOWED_EXTS -e DEFAULT_BRANCH -e GITHUB_MCP_SERVER_TOKEN -e GITHUB_MCP_LOCKDOWN -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e GITHUB_SHA -e GITHUB_WORKSPACE -e GITHUB_TOKEN -e GITHUB_RUN_ID -e GITHUB_RUN_NUMBER -e GITHUB_RUN_ATTEMPT -e GITHUB_JOB -e GITHUB_ACTION -e GITHUB_EVENT_NAME -e GITHUB_EVENT_PATH -e GITHUB_ACTOR -e GITHUB_ACTOR_ID -e GITHUB_TRIGGERING_ACTOR -e GITHUB_WORKFLOW -e GITHUB_WORKFLOW_REF -e GITHUB_WORKFLOW_SHA -e GITHUB_REF -e GITHUB_REF_NAME -e GITHUB_REF_TYPE -e GITHUB_HEAD_REF -e GITHUB_BASE_REF -e GH_AW_SAFE_INPUTS_PORT -e GH_AW_SAFE_INPUTS_API_KEY -e GH_AW_SAFE_OUTPUTS_PORT -e GH_AW_SAFE_OUTPUTS_API_KEY -e GH_TOKEN -v /tmp/gh-aw/mcp-payloads:/tmp/gh-aw/mcp-payloads:rw -v /opt:/opt:ro -v /tmp:/tmp:rw -v '"${GITHUB_WORKSPACE}"':'"${GITHUB_WORKSPACE}"':rw ghcr.io/github/gh-aw-mcpg:v0.1.8' + export MCP_GATEWAY_DOCKER_COMMAND='docker run -i --rm --network host -v /var/run/docker.sock:/var/run/docker.sock -e MCP_GATEWAY_PORT -e MCP_GATEWAY_DOMAIN -e MCP_GATEWAY_API_KEY -e MCP_GATEWAY_PAYLOAD_DIR -e MCP_GATEWAY_PAYLOAD_SIZE_THRESHOLD -e DEBUG -e MCP_GATEWAY_LOG_DIR -e GH_AW_MCP_LOG_DIR -e GH_AW_SAFE_OUTPUTS -e GH_AW_SAFE_OUTPUTS_CONFIG_PATH -e GH_AW_SAFE_OUTPUTS_TOOLS_PATH -e GH_AW_ASSETS_BRANCH -e GH_AW_ASSETS_MAX_SIZE_KB -e GH_AW_ASSETS_ALLOWED_EXTS -e DEFAULT_BRANCH -e GITHUB_MCP_SERVER_TOKEN -e GITHUB_MCP_LOCKDOWN -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e GITHUB_SHA -e GITHUB_WORKSPACE -e GITHUB_TOKEN -e GITHUB_RUN_ID -e GITHUB_RUN_NUMBER -e GITHUB_RUN_ATTEMPT -e GITHUB_JOB -e GITHUB_ACTION -e GITHUB_EVENT_NAME -e GITHUB_EVENT_PATH -e GITHUB_ACTOR -e GITHUB_ACTOR_ID -e GITHUB_TRIGGERING_ACTOR -e GITHUB_WORKFLOW -e GITHUB_WORKFLOW_REF -e GITHUB_WORKFLOW_SHA -e GITHUB_REF -e GITHUB_REF_NAME -e GITHUB_REF_TYPE -e GITHUB_HEAD_REF -e GITHUB_BASE_REF -e GH_AW_MCP_SCRIPTS_PORT -e GH_AW_MCP_SCRIPTS_API_KEY -e GH_AW_SAFE_OUTPUTS_PORT -e GH_AW_SAFE_OUTPUTS_API_KEY -e GH_TOKEN -v /tmp/gh-aw/mcp-payloads:/tmp/gh-aw/mcp-payloads:rw -v /opt:/opt:ro -v /tmp:/tmp:rw -v '"${GITHUB_WORKSPACE}"':'"${GITHUB_WORKSPACE}"':rw ghcr.io/github/gh-aw-mcpg:v0.1.8' mkdir -p /home/runner/.copilot cat << GH_AW_MCP_CONFIG_EOF | bash /opt/gh-aw/actions/start_mcp_gateway.sh @@ -1247,11 +1247,11 @@ jobs: "GITHUB_TOOLSETS": "context,repos,issues,pull_requests,discussions" } }, - "safeinputs": { + "mcpscripts": { "type": "http", - "url": "http://host.docker.internal:$GH_AW_SAFE_INPUTS_PORT", + "url": "http://host.docker.internal:$GH_AW_MCP_SCRIPTS_PORT", "headers": { - "Authorization": "\${GH_AW_SAFE_INPUTS_API_KEY}" + "Authorization": "\${GH_AW_MCP_SCRIPTS_API_KEY}" } }, "safeoutputs": { @@ -1426,7 +1426,7 @@ jobs: script: | const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs'); setupGlobals(core, github, context, exec, io); - const { main } = require('/opt/gh-aw/actions/parse_safe_inputs_logs.cjs'); + const { main } = require('/opt/gh-aw/actions/parse_mcp_scripts_logs.cjs'); await main(); - name: Parse MCP Gateway logs for step summary if: always() @@ -1476,7 +1476,7 @@ jobs: path: | /tmp/gh-aw/aw-prompts/prompt.txt /tmp/gh-aw/mcp-logs/ - /tmp/gh-aw/safe-inputs/logs/ + /tmp/gh-aw/mcp-scripts/logs/ /tmp/gh-aw/sandbox/firewall/logs/ /tmp/gh-aw/agent-stdio.log /tmp/gh-aw/agent/ @@ -1518,7 +1518,7 @@ jobs: uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8 env: WORKFLOW_NAME: "Daily Project Performance Summary Generator (Using Safe Inputs)" - WORKFLOW_DESCRIPTION: "Daily project performance summary (90-day window) with trend charts using safe-inputs" + WORKFLOW_DESCRIPTION: "Daily project performance summary (90-day window) with trend charts using mcp-scripts" HAS_PATCH: ${{ steps.collect_output.outputs.has_patch }} with: script: | diff --git a/.github/workflows/daily-performance-summary.md b/.github/workflows/daily-performance-summary.md index f62133677ad..40edf560885 100644 --- a/.github/workflows/daily-performance-summary.md +++ b/.github/workflows/daily-performance-summary.md @@ -1,5 +1,5 @@ --- -description: Daily project performance summary (90-day window) with trend charts using safe-inputs +description: Daily project performance summary (90-day window) with trend charts using mcp-scripts on: schedule: daily workflow_dispatch: @@ -27,7 +27,7 @@ safe-outputs: max: 10 timeout-minutes: 30 imports: - - shared/github-queries-safe-input.md + - shared/github-queries-mcp-script.md - shared/trending-charts-simple.md - shared/reporting.md --- @@ -36,14 +36,14 @@ imports: # Daily Project Performance Summary Generator (Using Safe Inputs) -You are an expert analyst that generates comprehensive daily performance summaries using **safe-input tools** to query GitHub data (PRs, issues, discussions) and creates trend visualizations. +You are an expert analyst that generates comprehensive daily performance summaries using **mcp-script tools** to query GitHub data (PRs, issues, discussions) and creates trend visualizations. -**IMPORTANT**: This workflow uses safe-input tools imported from `shared/github-queries-safe-input.md`. All data gathering MUST be done through these tools. +**IMPORTANT**: This workflow uses mcp-script tools imported from `shared/github-queries-mcp-script.md`. All data gathering MUST be done through these tools. ## Mission Generate a daily performance summary analyzing the last 90 days of project activity: -1. **Use safe-input tools** to query PRs, issues, and discussions +1. **Use mcp-script tools** to query PRs, issues, and discussions 2. Calculate key performance metrics (velocity, resolution times, activity levels) 3. Generate trend charts showing project activity and performance 4. Create a discussion with the comprehensive performance report @@ -57,7 +57,7 @@ Generate a daily performance summary analyzing the last 90 days of project activ ## Phase 1: Gather Data Using Safe-Input Tools -**CRITICAL**: Use the safe-input tools to query GitHub data. These tools are imported from `shared/github-queries-safe-input.md` and provide the same functionality as the previous Skillz-based approach. +**CRITICAL**: Use the mcp-script tools to query GitHub data. These tools are imported from `shared/github-queries-mcp-script.md` and provide the same functionality as the previous Skillz-based approach. ### Available Safe-Input Tools @@ -68,7 +68,7 @@ The following tools are available for querying GitHub data: ### 1.1 Query Pull Requests -**Use the `github-pr-query` safe-input tool** to get PR data: +**Use the `github-pr-query` mcp-script tool** to get PR data: ``` github-pr-query with state: "all", limit: 1000, jq: "." @@ -82,7 +82,7 @@ The tool provides: ### 1.2 Query Issues -**Use the `github-issue-query` safe-input tool** to get issue data: +**Use the `github-issue-query` mcp-script tool** to get issue data: ``` github-issue-query with state: "all", limit: 1000, jq: "." @@ -96,7 +96,7 @@ The tool provides: ### 1.3 Query Discussions -**Use the `github-discussion-query` safe-input tool** to get discussion data: +**Use the `github-discussion-query` mcp-script tool** to get discussion data: ``` github-discussion-query with limit: 1000, jq: "." @@ -477,7 +477,7 @@ Create a new discussion with the comprehensive performance report. ## Success Criteria A successful run will: -- ✅ **Query data using safe-input tools** (github-pr-query, github-issue-query, github-discussion-query) +- ✅ **Query data using mcp-script tools** (github-pr-query, github-issue-query, github-discussion-query) - ✅ Calculate comprehensive performance metrics from tool output - ✅ Generate 3 high-quality trend charts - ✅ Upload charts as assets @@ -486,13 +486,13 @@ A successful run will: ## Safe-Input Tools Usage Reminder -This workflow uses safe-input tools imported from `shared/github-queries-safe-input.md`: +This workflow uses mcp-script tools imported from `shared/github-queries-mcp-script.md`: 1. Tools are defined in the shared workflow with shell script implementations 2. Each tool supports jq-based filtering for efficient data querying 3. Tools are authenticated with `GITHUB_TOKEN` for GitHub API access 4. Call tools with parameters like: `github-pr-query with state: "all", limit: 1000, jq: "."` -Begin your analysis now. **Use the safe-input tools** to gather data, run Python analysis, generate charts, and create the discussion report. +Begin your analysis now. **Use the mcp-script tools** to gather data, run Python analysis, generate charts, and create the discussion report. **Important**: If no action is needed after completing your analysis, you **MUST** call the `noop` safe-output tool with a brief explanation. Failing to call any safe-output tool is the most common cause of safe-output workflow failures. diff --git a/.github/workflows/daily-regulatory.lock.yml b/.github/workflows/daily-regulatory.lock.yml index 6f865278a18..1d6cd8f8e0c 100644 --- a/.github/workflows/daily-regulatory.lock.yml +++ b/.github/workflows/daily-regulatory.lock.yml @@ -25,10 +25,10 @@ # # Resolved workflow manifest: # Imports: -# - shared/github-queries-safe-input.md +# - shared/github-queries-mcp-script.md # - shared/reporting.md # -# gh-aw-metadata: {"schema_version":"v2","frontmatter_hash":"4981509a6079c94c5b8fd172d8812c9c5bab1f192cba2eae4352305af61e06c0","strict":true} +# gh-aw-metadata: {"schema_version":"v2","frontmatter_hash":"238c3282ef64bdb6800bd48877c082702a91b29214ffb81ce63903042421d706","strict":true} name: "Daily Regulatory Report Generator" "on": @@ -171,7 +171,7 @@ jobs: GH_AW_PROMPT_EOF cat << 'GH_AW_PROMPT_EOF' - {{#runtime-import .github/workflows/shared/github-queries-safe-input.md}} + {{#runtime-import .github/workflows/shared/github-queries-mcp-script.md}} GH_AW_PROMPT_EOF cat << 'GH_AW_PROMPT_EOF' {{#runtime-import .github/workflows/shared/reporting.md}} @@ -667,12 +667,12 @@ jobs: - name: Setup Safe Inputs Config run: | - mkdir -p /opt/gh-aw/safe-inputs/logs - cat > /opt/gh-aw/safe-inputs/tools.json << 'GH_AW_SAFE_INPUTS_TOOLS_EOF' + mkdir -p /opt/gh-aw/mcp-scripts/logs + cat > /opt/gh-aw/mcp-scripts/tools.json << 'GH_AW_MCP_SCRIPTS_TOOLS_EOF' { - "serverName": "safeinputs", + "serverName": "mcpscripts", "version": "1.0.0", - "logDir": "/opt/gh-aw/safe-inputs/logs", + "logDir": "/opt/gh-aw/mcp-scripts/logs", "tools": [ { "name": "github-discussion-query", @@ -762,29 +762,29 @@ jobs: } ] } - GH_AW_SAFE_INPUTS_TOOLS_EOF - cat > /opt/gh-aw/safe-inputs/mcp-server.cjs << 'GH_AW_SAFE_INPUTS_SERVER_EOF' + GH_AW_MCP_SCRIPTS_TOOLS_EOF + cat > /opt/gh-aw/mcp-scripts/mcp-server.cjs << 'GH_AW_MCP_SCRIPTS_SERVER_EOF' const path = require("path"); - const { startHttpServer } = require("./safe_inputs_mcp_server_http.cjs"); + const { startHttpServer } = require("./mcp_scripts_mcp_server_http.cjs"); const configPath = path.join(__dirname, "tools.json"); - const port = parseInt(process.env.GH_AW_SAFE_INPUTS_PORT || "3000", 10); - const apiKey = process.env.GH_AW_SAFE_INPUTS_API_KEY || ""; + const port = parseInt(process.env.GH_AW_MCP_SCRIPTS_PORT || "3000", 10); + const apiKey = process.env.GH_AW_MCP_SCRIPTS_API_KEY || ""; startHttpServer(configPath, { port: port, stateless: true, - logDir: "/opt/gh-aw/safe-inputs/logs" + logDir: "/opt/gh-aw/mcp-scripts/logs" }).catch(error => { - console.error("Failed to start safe-inputs HTTP server:", error); + console.error("Failed to start mcp-scripts HTTP server:", error); process.exit(1); }); - GH_AW_SAFE_INPUTS_SERVER_EOF - chmod +x /opt/gh-aw/safe-inputs/mcp-server.cjs + GH_AW_MCP_SCRIPTS_SERVER_EOF + chmod +x /opt/gh-aw/mcp-scripts/mcp-server.cjs - name: Setup Safe Inputs Tool Files run: | - cat > /opt/gh-aw/safe-inputs/github-discussion-query.sh << 'GH_AW_SAFE_INPUTS_SH_GITHUB-DISCUSSION-QUERY_EOF' + cat > /opt/gh-aw/mcp-scripts/github-discussion-query.sh << 'GH_AW_MCP_SCRIPTS_SH_GITHUB-DISCUSSION-QUERY_EOF' #!/bin/bash - # Auto-generated safe-input tool: github-discussion-query + # Auto-generated mcp-script tool: github-discussion-query # Query GitHub discussions with jq filtering support. Without --jq, returns schema and data size info. Use --jq '.' to get all data, or specific jq expressions to filter. set -euo pipefail @@ -917,11 +917,11 @@ jobs: EOF fi - GH_AW_SAFE_INPUTS_SH_GITHUB-DISCUSSION-QUERY_EOF - chmod +x /opt/gh-aw/safe-inputs/github-discussion-query.sh - cat > /opt/gh-aw/safe-inputs/github-issue-query.sh << 'GH_AW_SAFE_INPUTS_SH_GITHUB-ISSUE-QUERY_EOF' + GH_AW_MCP_SCRIPTS_SH_GITHUB-DISCUSSION-QUERY_EOF + chmod +x /opt/gh-aw/mcp-scripts/github-discussion-query.sh + cat > /opt/gh-aw/mcp-scripts/github-issue-query.sh << 'GH_AW_MCP_SCRIPTS_SH_GITHUB-ISSUE-QUERY_EOF' #!/bin/bash - # Auto-generated safe-input tool: github-issue-query + # Auto-generated mcp-script tool: github-issue-query # Query GitHub issues with jq filtering support. Without --jq, returns schema and data size info. Use --jq '.' to get all data, or specific jq expressions to filter. set -euo pipefail @@ -998,11 +998,11 @@ jobs: fi - GH_AW_SAFE_INPUTS_SH_GITHUB-ISSUE-QUERY_EOF - chmod +x /opt/gh-aw/safe-inputs/github-issue-query.sh - cat > /opt/gh-aw/safe-inputs/github-pr-query.sh << 'GH_AW_SAFE_INPUTS_SH_GITHUB-PR-QUERY_EOF' + GH_AW_MCP_SCRIPTS_SH_GITHUB-ISSUE-QUERY_EOF + chmod +x /opt/gh-aw/mcp-scripts/github-issue-query.sh + cat > /opt/gh-aw/mcp-scripts/github-pr-query.sh << 'GH_AW_MCP_SCRIPTS_SH_GITHUB-PR-QUERY_EOF' #!/bin/bash - # Auto-generated safe-input tool: github-pr-query + # Auto-generated mcp-script tool: github-pr-query # Query GitHub pull requests with jq filtering support. Without --jq, returns schema and data size info. Use --jq '.' to get all data, or specific jq expressions to filter. set -euo pipefail @@ -1085,11 +1085,11 @@ jobs: fi - GH_AW_SAFE_INPUTS_SH_GITHUB-PR-QUERY_EOF - chmod +x /opt/gh-aw/safe-inputs/github-pr-query.sh + GH_AW_MCP_SCRIPTS_SH_GITHUB-PR-QUERY_EOF + chmod +x /opt/gh-aw/mcp-scripts/github-pr-query.sh - - name: Generate Safe Inputs MCP Server Config - id: safe-inputs-config + - name: Generate MCP Scripts Server Config + id: mcp-scripts-config run: | # Generate a secure random API key (360 bits of entropy, 40+ chars) # Mask immediately to prevent timing vulnerabilities @@ -1100,32 +1100,32 @@ jobs: # Set outputs for next steps { - echo "safe_inputs_api_key=${API_KEY}" - echo "safe_inputs_port=${PORT}" + echo "mcp_scripts_api_key=${API_KEY}" + echo "mcp_scripts_port=${PORT}" } >> "$GITHUB_OUTPUT" echo "Safe Inputs MCP server will run on port ${PORT}" - - name: Start Safe Inputs MCP HTTP Server - id: safe-inputs-start + - name: Start MCP Scripts HTTP Server + id: mcp-scripts-start env: DEBUG: '*' - GH_AW_SAFE_INPUTS_PORT: ${{ steps.safe-inputs-config.outputs.safe_inputs_port }} - GH_AW_SAFE_INPUTS_API_KEY: ${{ steps.safe-inputs-config.outputs.safe_inputs_api_key }} + GH_AW_MCP_SCRIPTS_PORT: ${{ steps.mcp-scripts-config.outputs.mcp_scripts_port }} + GH_AW_MCP_SCRIPTS_API_KEY: ${{ steps.mcp-scripts-config.outputs.mcp_scripts_api_key }} GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} run: | # Environment variables are set above to prevent template injection export DEBUG - export GH_AW_SAFE_INPUTS_PORT - export GH_AW_SAFE_INPUTS_API_KEY + export GH_AW_MCP_SCRIPTS_PORT + export GH_AW_MCP_SCRIPTS_API_KEY - bash /opt/gh-aw/actions/start_safe_inputs_server.sh + bash /opt/gh-aw/actions/start_mcp_scripts_server.sh - name: Start MCP Gateway id: start-mcp-gateway env: - GH_AW_SAFE_INPUTS_API_KEY: ${{ steps.safe-inputs-start.outputs.api_key }} - GH_AW_SAFE_INPUTS_PORT: ${{ steps.safe-inputs-start.outputs.port }} + GH_AW_MCP_SCRIPTS_API_KEY: ${{ steps.mcp-scripts-start.outputs.api_key }} + GH_AW_MCP_SCRIPTS_PORT: ${{ steps.mcp-scripts-start.outputs.port }} GH_AW_SAFE_OUTPUTS: ${{ env.GH_AW_SAFE_OUTPUTS }} GH_AW_SAFE_OUTPUTS_API_KEY: ${{ steps.safe-outputs-start.outputs.api_key }} GH_AW_SAFE_OUTPUTS_PORT: ${{ steps.safe-outputs-start.outputs.port }} @@ -1148,7 +1148,7 @@ jobs: export DEBUG="*" export GH_AW_ENGINE="copilot" - export MCP_GATEWAY_DOCKER_COMMAND='docker run -i --rm --network host -v /var/run/docker.sock:/var/run/docker.sock -e MCP_GATEWAY_PORT -e MCP_GATEWAY_DOMAIN -e MCP_GATEWAY_API_KEY -e MCP_GATEWAY_PAYLOAD_DIR -e MCP_GATEWAY_PAYLOAD_SIZE_THRESHOLD -e DEBUG -e MCP_GATEWAY_LOG_DIR -e GH_AW_MCP_LOG_DIR -e GH_AW_SAFE_OUTPUTS -e GH_AW_SAFE_OUTPUTS_CONFIG_PATH -e GH_AW_SAFE_OUTPUTS_TOOLS_PATH -e GH_AW_ASSETS_BRANCH -e GH_AW_ASSETS_MAX_SIZE_KB -e GH_AW_ASSETS_ALLOWED_EXTS -e DEFAULT_BRANCH -e GITHUB_MCP_SERVER_TOKEN -e GITHUB_MCP_LOCKDOWN -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e GITHUB_SHA -e GITHUB_WORKSPACE -e GITHUB_TOKEN -e GITHUB_RUN_ID -e GITHUB_RUN_NUMBER -e GITHUB_RUN_ATTEMPT -e GITHUB_JOB -e GITHUB_ACTION -e GITHUB_EVENT_NAME -e GITHUB_EVENT_PATH -e GITHUB_ACTOR -e GITHUB_ACTOR_ID -e GITHUB_TRIGGERING_ACTOR -e GITHUB_WORKFLOW -e GITHUB_WORKFLOW_REF -e GITHUB_WORKFLOW_SHA -e GITHUB_REF -e GITHUB_REF_NAME -e GITHUB_REF_TYPE -e GITHUB_HEAD_REF -e GITHUB_BASE_REF -e GH_AW_SAFE_INPUTS_PORT -e GH_AW_SAFE_INPUTS_API_KEY -e GH_AW_SAFE_OUTPUTS_PORT -e GH_AW_SAFE_OUTPUTS_API_KEY -e GH_TOKEN -v /tmp/gh-aw/mcp-payloads:/tmp/gh-aw/mcp-payloads:rw -v /opt:/opt:ro -v /tmp:/tmp:rw -v '"${GITHUB_WORKSPACE}"':'"${GITHUB_WORKSPACE}"':rw ghcr.io/github/gh-aw-mcpg:v0.1.8' + export MCP_GATEWAY_DOCKER_COMMAND='docker run -i --rm --network host -v /var/run/docker.sock:/var/run/docker.sock -e MCP_GATEWAY_PORT -e MCP_GATEWAY_DOMAIN -e MCP_GATEWAY_API_KEY -e MCP_GATEWAY_PAYLOAD_DIR -e MCP_GATEWAY_PAYLOAD_SIZE_THRESHOLD -e DEBUG -e MCP_GATEWAY_LOG_DIR -e GH_AW_MCP_LOG_DIR -e GH_AW_SAFE_OUTPUTS -e GH_AW_SAFE_OUTPUTS_CONFIG_PATH -e GH_AW_SAFE_OUTPUTS_TOOLS_PATH -e GH_AW_ASSETS_BRANCH -e GH_AW_ASSETS_MAX_SIZE_KB -e GH_AW_ASSETS_ALLOWED_EXTS -e DEFAULT_BRANCH -e GITHUB_MCP_SERVER_TOKEN -e GITHUB_MCP_LOCKDOWN -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e GITHUB_SHA -e GITHUB_WORKSPACE -e GITHUB_TOKEN -e GITHUB_RUN_ID -e GITHUB_RUN_NUMBER -e GITHUB_RUN_ATTEMPT -e GITHUB_JOB -e GITHUB_ACTION -e GITHUB_EVENT_NAME -e GITHUB_EVENT_PATH -e GITHUB_ACTOR -e GITHUB_ACTOR_ID -e GITHUB_TRIGGERING_ACTOR -e GITHUB_WORKFLOW -e GITHUB_WORKFLOW_REF -e GITHUB_WORKFLOW_SHA -e GITHUB_REF -e GITHUB_REF_NAME -e GITHUB_REF_TYPE -e GITHUB_HEAD_REF -e GITHUB_BASE_REF -e GH_AW_MCP_SCRIPTS_PORT -e GH_AW_MCP_SCRIPTS_API_KEY -e GH_AW_SAFE_OUTPUTS_PORT -e GH_AW_SAFE_OUTPUTS_API_KEY -e GH_TOKEN -v /tmp/gh-aw/mcp-payloads:/tmp/gh-aw/mcp-payloads:rw -v /opt:/opt:ro -v /tmp:/tmp:rw -v '"${GITHUB_WORKSPACE}"':'"${GITHUB_WORKSPACE}"':rw ghcr.io/github/gh-aw-mcpg:v0.1.8' mkdir -p /home/runner/.copilot cat << GH_AW_MCP_CONFIG_EOF | bash /opt/gh-aw/actions/start_mcp_gateway.sh @@ -1164,11 +1164,11 @@ jobs: "GITHUB_TOOLSETS": "context,repos,issues,pull_requests,discussions" } }, - "safeinputs": { + "mcpscripts": { "type": "http", - "url": "http://host.docker.internal:$GH_AW_SAFE_INPUTS_PORT", + "url": "http://host.docker.internal:$GH_AW_MCP_SCRIPTS_PORT", "headers": { - "Authorization": "\${GH_AW_SAFE_INPUTS_API_KEY}" + "Authorization": "\${GH_AW_MCP_SCRIPTS_API_KEY}" } }, "safeoutputs": { @@ -1340,7 +1340,7 @@ jobs: script: | const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs'); setupGlobals(core, github, context, exec, io); - const { main } = require('/opt/gh-aw/actions/parse_safe_inputs_logs.cjs'); + const { main } = require('/opt/gh-aw/actions/parse_mcp_scripts_logs.cjs'); await main(); - name: Parse MCP Gateway logs for step summary if: always() @@ -1375,7 +1375,7 @@ jobs: path: | /tmp/gh-aw/aw-prompts/prompt.txt /tmp/gh-aw/mcp-logs/ - /tmp/gh-aw/safe-inputs/logs/ + /tmp/gh-aw/mcp-scripts/logs/ /tmp/gh-aw/sandbox/firewall/logs/ /tmp/gh-aw/agent-stdio.log /tmp/gh-aw/agent/ diff --git a/.github/workflows/daily-regulatory.md b/.github/workflows/daily-regulatory.md index c76a0c9a721..f1f3055de35 100644 --- a/.github/workflows/daily-regulatory.md +++ b/.github/workflows/daily-regulatory.md @@ -28,7 +28,7 @@ safe-outputs: max: 10 timeout-minutes: 30 imports: - - shared/github-queries-safe-input.md + - shared/github-queries-mcp-script.md - shared/reporting.md --- @@ -60,7 +60,7 @@ Review all daily report discussions from the last 24 hours and: ### Step 0.1: Verify GitHub Discussions Access -1. Test the `github-discussion-query` safe-input tool by running a simple query: +1. Test the `github-discussion-query` mcp-script tool by running a simple query: ``` github-discussion-query with limit: 1, jq: "." ``` @@ -102,7 +102,7 @@ Review all daily report discussions from the last 24 hours and: ### Step 1.1: Query Recent Discussions -Use the `github-discussion-query` safe-input tool to find all daily report discussions created in the last 24-48 hours. Call the tool with appropriate parameters: +Use the `github-discussion-query` mcp-script tool to find all daily report discussions created in the last 24-48 hours. Call the tool with appropriate parameters: ``` github-discussion-query with limit: 100, jq: "." diff --git a/.github/workflows/go-logger.lock.yml b/.github/workflows/go-logger.lock.yml index 14a5cba2879..87536e2c75d 100644 --- a/.github/workflows/go-logger.lock.yml +++ b/.github/workflows/go-logger.lock.yml @@ -27,7 +27,7 @@ # Imports: # - shared/go-make.md # -# gh-aw-metadata: {"schema_version":"v2","frontmatter_hash":"f25ce343847e9c88cf0b683033fae1614998f81e330da7bf355bcf7a2e50e199","strict":true} +# gh-aw-metadata: {"schema_version":"v2","frontmatter_hash":"9fc05dd97be30e5cf9eb349f0b5b33b6d3369786898cfab02a90664683961943","strict":true} name: "Go Logger Enhancement" "on": @@ -655,16 +655,16 @@ jobs: - name: Setup Safe Inputs Config run: | - mkdir -p /opt/gh-aw/safe-inputs/logs - cat > /opt/gh-aw/safe-inputs/tools.json << 'GH_AW_SAFE_INPUTS_TOOLS_EOF' + mkdir -p /opt/gh-aw/mcp-scripts/logs + cat > /opt/gh-aw/mcp-scripts/tools.json << 'GH_AW_MCP_SCRIPTS_TOOLS_EOF' { - "serverName": "safeinputs", + "serverName": "mcpscripts", "version": "1.0.0", - "logDir": "/opt/gh-aw/safe-inputs/logs", + "logDir": "/opt/gh-aw/mcp-scripts/logs", "tools": [ { "name": "go", - "description": "Execute any Go command. This tool is accessible as 'safeinputs-go'. Provide the full command after 'go' (e.g., args: 'test ./...'). The tool will run: go \u003cargs\u003e. Use single quotes ' for complex args to avoid shell interpretation issues.", + "description": "Execute any Go command. This tool is accessible as 'mcpscripts-go'. Provide the full command after 'go' (e.g., args: 'test ./...'). The tool will run: go \u003cargs\u003e. Use single quotes ' for complex args to avoid shell interpretation issues.", "inputSchema": { "properties": { "args": { @@ -682,7 +682,7 @@ jobs: }, { "name": "make", - "description": "Execute any Make target. This tool is accessible as 'safeinputs-make'. Provide the target name(s) (e.g., args: 'build'). The tool will run: make \u003cargs\u003e. Use single quotes ' for complex args to avoid shell interpretation issues.", + "description": "Execute any Make target. This tool is accessible as 'mcpscripts-make'. Provide the target name(s) (e.g., args: 'build'). The tool will run: make \u003cargs\u003e. Use single quotes ' for complex args to avoid shell interpretation issues.", "inputSchema": { "properties": { "args": { @@ -700,30 +700,30 @@ jobs: } ] } - GH_AW_SAFE_INPUTS_TOOLS_EOF - cat > /opt/gh-aw/safe-inputs/mcp-server.cjs << 'GH_AW_SAFE_INPUTS_SERVER_EOF' + GH_AW_MCP_SCRIPTS_TOOLS_EOF + cat > /opt/gh-aw/mcp-scripts/mcp-server.cjs << 'GH_AW_MCP_SCRIPTS_SERVER_EOF' const path = require("path"); - const { startHttpServer } = require("./safe_inputs_mcp_server_http.cjs"); + const { startHttpServer } = require("./mcp_scripts_mcp_server_http.cjs"); const configPath = path.join(__dirname, "tools.json"); - const port = parseInt(process.env.GH_AW_SAFE_INPUTS_PORT || "3000", 10); - const apiKey = process.env.GH_AW_SAFE_INPUTS_API_KEY || ""; + const port = parseInt(process.env.GH_AW_MCP_SCRIPTS_PORT || "3000", 10); + const apiKey = process.env.GH_AW_MCP_SCRIPTS_API_KEY || ""; startHttpServer(configPath, { port: port, stateless: true, - logDir: "/opt/gh-aw/safe-inputs/logs" + logDir: "/opt/gh-aw/mcp-scripts/logs" }).catch(error => { - console.error("Failed to start safe-inputs HTTP server:", error); + console.error("Failed to start mcp-scripts HTTP server:", error); process.exit(1); }); - GH_AW_SAFE_INPUTS_SERVER_EOF - chmod +x /opt/gh-aw/safe-inputs/mcp-server.cjs + GH_AW_MCP_SCRIPTS_SERVER_EOF + chmod +x /opt/gh-aw/mcp-scripts/mcp-server.cjs - name: Setup Safe Inputs Tool Files run: | - cat > /opt/gh-aw/safe-inputs/go.sh << 'GH_AW_SAFE_INPUTS_SH_GO_EOF' + cat > /opt/gh-aw/mcp-scripts/go.sh << 'GH_AW_MCP_SCRIPTS_SH_GO_EOF' #!/bin/bash - # Auto-generated safe-input tool: go - # Execute any Go command. This tool is accessible as 'safeinputs-go'. Provide the full command after 'go' (e.g., args: 'test ./...'). The tool will run: go . Use single quotes ' for complex args to avoid shell interpretation issues. + # Auto-generated mcp-script tool: go + # Execute any Go command. This tool is accessible as 'mcpscripts-go'. Provide the full command after 'go' (e.g., args: 'test ./...'). The tool will run: go . Use single quotes ' for complex args to avoid shell interpretation issues. set -euo pipefail @@ -731,23 +731,23 @@ jobs: go $INPUT_ARGS - GH_AW_SAFE_INPUTS_SH_GO_EOF - chmod +x /opt/gh-aw/safe-inputs/go.sh - cat > /opt/gh-aw/safe-inputs/make.sh << 'GH_AW_SAFE_INPUTS_SH_MAKE_EOF' + GH_AW_MCP_SCRIPTS_SH_GO_EOF + chmod +x /opt/gh-aw/mcp-scripts/go.sh + cat > /opt/gh-aw/mcp-scripts/make.sh << 'GH_AW_MCP_SCRIPTS_SH_MAKE_EOF' #!/bin/bash - # Auto-generated safe-input tool: make - # Execute any Make target. This tool is accessible as 'safeinputs-make'. Provide the target name(s) (e.g., args: 'build'). The tool will run: make . Use single quotes ' for complex args to avoid shell interpretation issues. + # Auto-generated mcp-script tool: make + # Execute any Make target. This tool is accessible as 'mcpscripts-make'. Provide the target name(s) (e.g., args: 'build'). The tool will run: make . Use single quotes ' for complex args to avoid shell interpretation issues. set -euo pipefail echo "make $INPUT_ARGS" make $INPUT_ARGS - GH_AW_SAFE_INPUTS_SH_MAKE_EOF - chmod +x /opt/gh-aw/safe-inputs/make.sh + GH_AW_MCP_SCRIPTS_SH_MAKE_EOF + chmod +x /opt/gh-aw/mcp-scripts/make.sh - - name: Generate Safe Inputs MCP Server Config - id: safe-inputs-config + - name: Generate MCP Scripts Server Config + id: mcp-scripts-config run: | # Generate a secure random API key (360 bits of entropy, 40+ chars) # Mask immediately to prevent timing vulnerabilities @@ -758,31 +758,31 @@ jobs: # Set outputs for next steps { - echo "safe_inputs_api_key=${API_KEY}" - echo "safe_inputs_port=${PORT}" + echo "mcp_scripts_api_key=${API_KEY}" + echo "mcp_scripts_port=${PORT}" } >> "$GITHUB_OUTPUT" echo "Safe Inputs MCP server will run on port ${PORT}" - - name: Start Safe Inputs MCP HTTP Server - id: safe-inputs-start + - name: Start MCP Scripts HTTP Server + id: mcp-scripts-start env: DEBUG: '*' - GH_AW_SAFE_INPUTS_PORT: ${{ steps.safe-inputs-config.outputs.safe_inputs_port }} - GH_AW_SAFE_INPUTS_API_KEY: ${{ steps.safe-inputs-config.outputs.safe_inputs_api_key }} + GH_AW_MCP_SCRIPTS_PORT: ${{ steps.mcp-scripts-config.outputs.mcp_scripts_port }} + GH_AW_MCP_SCRIPTS_API_KEY: ${{ steps.mcp-scripts-config.outputs.mcp_scripts_api_key }} run: | # Environment variables are set above to prevent template injection export DEBUG - export GH_AW_SAFE_INPUTS_PORT - export GH_AW_SAFE_INPUTS_API_KEY + export GH_AW_MCP_SCRIPTS_PORT + export GH_AW_MCP_SCRIPTS_API_KEY - bash /opt/gh-aw/actions/start_safe_inputs_server.sh + bash /opt/gh-aw/actions/start_mcp_scripts_server.sh - name: Start MCP Gateway id: start-mcp-gateway env: - GH_AW_SAFE_INPUTS_API_KEY: ${{ steps.safe-inputs-start.outputs.api_key }} - GH_AW_SAFE_INPUTS_PORT: ${{ steps.safe-inputs-start.outputs.port }} + GH_AW_MCP_SCRIPTS_API_KEY: ${{ steps.mcp-scripts-start.outputs.api_key }} + GH_AW_MCP_SCRIPTS_PORT: ${{ steps.mcp-scripts-start.outputs.port }} GH_AW_SAFE_OUTPUTS: ${{ env.GH_AW_SAFE_OUTPUTS }} GH_AW_SAFE_OUTPUTS_API_KEY: ${{ steps.safe-outputs-start.outputs.api_key }} GH_AW_SAFE_OUTPUTS_PORT: ${{ steps.safe-outputs-start.outputs.port }} @@ -804,7 +804,7 @@ jobs: export DEBUG="*" export GH_AW_ENGINE="claude" - export MCP_GATEWAY_DOCKER_COMMAND='docker run -i --rm --network host -v /var/run/docker.sock:/var/run/docker.sock -e MCP_GATEWAY_PORT -e MCP_GATEWAY_DOMAIN -e MCP_GATEWAY_API_KEY -e MCP_GATEWAY_PAYLOAD_DIR -e MCP_GATEWAY_PAYLOAD_SIZE_THRESHOLD -e DEBUG -e MCP_GATEWAY_LOG_DIR -e GH_AW_MCP_LOG_DIR -e GH_AW_SAFE_OUTPUTS -e GH_AW_SAFE_OUTPUTS_CONFIG_PATH -e GH_AW_SAFE_OUTPUTS_TOOLS_PATH -e GH_AW_ASSETS_BRANCH -e GH_AW_ASSETS_MAX_SIZE_KB -e GH_AW_ASSETS_ALLOWED_EXTS -e DEFAULT_BRANCH -e GITHUB_MCP_SERVER_TOKEN -e GITHUB_MCP_LOCKDOWN -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e GITHUB_SHA -e GITHUB_WORKSPACE -e GITHUB_TOKEN -e GITHUB_RUN_ID -e GITHUB_RUN_NUMBER -e GITHUB_RUN_ATTEMPT -e GITHUB_JOB -e GITHUB_ACTION -e GITHUB_EVENT_NAME -e GITHUB_EVENT_PATH -e GITHUB_ACTOR -e GITHUB_ACTOR_ID -e GITHUB_TRIGGERING_ACTOR -e GITHUB_WORKFLOW -e GITHUB_WORKFLOW_REF -e GITHUB_WORKFLOW_SHA -e GITHUB_REF -e GITHUB_REF_NAME -e GITHUB_REF_TYPE -e GITHUB_HEAD_REF -e GITHUB_BASE_REF -e GH_AW_SAFE_INPUTS_PORT -e GH_AW_SAFE_INPUTS_API_KEY -e GH_AW_SAFE_OUTPUTS_PORT -e GH_AW_SAFE_OUTPUTS_API_KEY -v /tmp/gh-aw/mcp-payloads:/tmp/gh-aw/mcp-payloads:rw -v /opt:/opt:ro -v /tmp:/tmp:rw -v '"${GITHUB_WORKSPACE}"':'"${GITHUB_WORKSPACE}"':rw ghcr.io/github/gh-aw-mcpg:v0.1.8' + export MCP_GATEWAY_DOCKER_COMMAND='docker run -i --rm --network host -v /var/run/docker.sock:/var/run/docker.sock -e MCP_GATEWAY_PORT -e MCP_GATEWAY_DOMAIN -e MCP_GATEWAY_API_KEY -e MCP_GATEWAY_PAYLOAD_DIR -e MCP_GATEWAY_PAYLOAD_SIZE_THRESHOLD -e DEBUG -e MCP_GATEWAY_LOG_DIR -e GH_AW_MCP_LOG_DIR -e GH_AW_SAFE_OUTPUTS -e GH_AW_SAFE_OUTPUTS_CONFIG_PATH -e GH_AW_SAFE_OUTPUTS_TOOLS_PATH -e GH_AW_ASSETS_BRANCH -e GH_AW_ASSETS_MAX_SIZE_KB -e GH_AW_ASSETS_ALLOWED_EXTS -e DEFAULT_BRANCH -e GITHUB_MCP_SERVER_TOKEN -e GITHUB_MCP_LOCKDOWN -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e GITHUB_SHA -e GITHUB_WORKSPACE -e GITHUB_TOKEN -e GITHUB_RUN_ID -e GITHUB_RUN_NUMBER -e GITHUB_RUN_ATTEMPT -e GITHUB_JOB -e GITHUB_ACTION -e GITHUB_EVENT_NAME -e GITHUB_EVENT_PATH -e GITHUB_ACTOR -e GITHUB_ACTOR_ID -e GITHUB_TRIGGERING_ACTOR -e GITHUB_WORKFLOW -e GITHUB_WORKFLOW_REF -e GITHUB_WORKFLOW_SHA -e GITHUB_REF -e GITHUB_REF_NAME -e GITHUB_REF_TYPE -e GITHUB_HEAD_REF -e GITHUB_BASE_REF -e GH_AW_MCP_SCRIPTS_PORT -e GH_AW_MCP_SCRIPTS_API_KEY -e GH_AW_SAFE_OUTPUTS_PORT -e GH_AW_SAFE_OUTPUTS_API_KEY -v /tmp/gh-aw/mcp-payloads:/tmp/gh-aw/mcp-payloads:rw -v /opt:/opt:ro -v /tmp:/tmp:rw -v '"${GITHUB_WORKSPACE}"':'"${GITHUB_WORKSPACE}"':rw ghcr.io/github/gh-aw-mcpg:v0.1.8' cat << GH_AW_MCP_CONFIG_EOF | bash /opt/gh-aw/actions/start_mcp_gateway.sh { @@ -818,11 +818,11 @@ jobs: "GITHUB_TOOLSETS": "context,repos,issues,pull_requests" } }, - "safeinputs": { + "mcpscripts": { "type": "http", - "url": "http://host.docker.internal:$GH_AW_SAFE_INPUTS_PORT", + "url": "http://host.docker.internal:$GH_AW_MCP_SCRIPTS_PORT", "headers": { - "Authorization": "$GH_AW_SAFE_INPUTS_API_KEY" + "Authorization": "$GH_AW_MCP_SCRIPTS_API_KEY" } }, "safeoutputs": { @@ -1062,7 +1062,7 @@ jobs: script: | const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs'); setupGlobals(core, github, context, exec, io); - const { main } = require('/opt/gh-aw/actions/parse_safe_inputs_logs.cjs'); + const { main } = require('/opt/gh-aw/actions/parse_mcp_scripts_logs.cjs'); await main(); - name: Parse MCP Gateway logs for step summary if: always() @@ -1103,7 +1103,7 @@ jobs: path: | /tmp/gh-aw/aw-prompts/prompt.txt /tmp/gh-aw/mcp-logs/ - /tmp/gh-aw/safe-inputs/logs/ + /tmp/gh-aw/mcp-scripts/logs/ /tmp/gh-aw/sandbox/firewall/logs/ /tmp/gh-aw/agent-stdio.log /tmp/gh-aw/agent/ diff --git a/.github/workflows/security-review.md b/.github/workflows/security-review.md index e8e7261f264..85ebf8e128a 100644 --- a/.github/workflows/security-review.md +++ b/.github/workflows/security-review.md @@ -97,7 +97,7 @@ The AWF controls network access, sandboxing, and command execution. Look for: - Target repositories being expanded (`target-repo:`) - Label or permission restrictions being removed -**Safe Inputs (`safe-inputs:` field)** +**Safe Inputs (`mcp-scripts:` field)** - New scripts being added with secret access - Environment variables exposing sensitive data - External command execution in scripts diff --git a/.github/workflows/shared/gh.md b/.github/workflows/shared/gh.md index 72d81ebe624..126c0c39cdc 100644 --- a/.github/workflows/shared/gh.md +++ b/.github/workflows/shared/gh.md @@ -1,7 +1,7 @@ --- -safe-inputs: +mcp-scripts: gh: - description: "Execute any gh CLI command. This tool is accessible as 'safeinputs-gh'. Provide the full command after 'gh' (e.g., args: 'pr list --limit 5'). The tool will run: gh . Use single quotes ' for complex args to avoid shell interpretation issues." + description: "Execute any gh CLI command. This tool is accessible as 'mcpscripts-gh'. Provide the full command after 'gh' (e.g., args: 'pr list --limit 5'). The tool will run: gh . Use single quotes ' for complex args to avoid shell interpretation issues." inputs: args: type: string @@ -16,25 +16,25 @@ safe-inputs: GH_TOKEN="$GH_AW_GH_TOKEN" gh $INPUT_ARGS --- -**IMPORTANT**: Always use the `safeinputs-gh` tool for GitHub CLI commands instead of running `gh` directly via bash. The `safeinputs-gh` tool has proper authentication configured with `GITHUB_TOKEN`, while bash commands do not have GitHub CLI authentication by default. +**IMPORTANT**: Always use the `mcpscripts-gh` tool for GitHub CLI commands instead of running `gh` directly via bash. The `mcpscripts-gh` tool has proper authentication configured with `GITHUB_TOKEN`, while bash commands do not have GitHub CLI authentication by default. **Correct**: ``` -Use the safeinputs-gh tool with args: "pr list --limit 5" -Use the safeinputs-gh tool with args: "issue view 123" +Use the mcpscripts-gh tool with args: "pr list --limit 5" +Use the mcpscripts-gh tool with args: "issue view 123" ``` **Incorrect**: ``` -Use the gh safe-input tool with args: "pr list --limit 5" ❌ (Wrong tool name - use safeinputs-gh) +Use the gh mcp-script tool with args: "pr list --limit 5" ❌ (Wrong tool name - use mcpscripts-gh) Run: gh pr list --limit 5 ❌ (No authentication in bash) Execute bash: gh issue view 123 ❌ (No authentication in bash) ```