Skip to content

Store default GitHub lockdown value as a named constant #21303

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
pelikhan merged 2 commits into from
Mar 16, 2026
Merged

Store default GitHub lockdown value as a named constant #21303

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
39ac4eb
Initial plan
Copilot Mar 16, 2026
784df4c
Store default GitHub lockdown value as a constant (false)
Copilot Mar 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions pkg/constants/constants.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -343,6 +343,11 @@ const DefaultGeminiVersion Version = "latest"
// DefaultGitHubMCPServerVersion is the default version of the GitHub MCP server Docker image
const DefaultGitHubMCPServerVersion Version = "v0.32.0"

// DefaultGitHubLockdown is the default value for the GitHub MCP server lockdown setting.
// Lockdown mode restricts the GitHub MCP server to the triggering repository only.
// Defaults to false (lockdown disabled).
const DefaultGitHubLockdown = false

// DefaultFirewallVersion is the default version of the gh-aw-firewall (AWF) binary
const DefaultFirewallVersion Version = "v0.24.2"

Expand Down
4 changes: 2 additions & 2 deletions pkg/workflow/mcp_github_config.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -120,7 +120,7 @@ func getGitHubReadOnly(_ any) bool {
}

// getGitHubLockdown checks if lockdown mode is enabled for GitHub tool
// Defaults to false (lockdown disabled)
// Defaults to constants.DefaultGitHubLockdown (false)
func getGitHubLockdown(githubTool any) bool {
if toolConfig, ok := githubTool.(map[string]any); ok {
if lockdownSetting, exists := toolConfig["lockdown"]; exists {
Expand All @@ -129,7 +129,7 @@ func getGitHubLockdown(githubTool any) bool {
}
}
}
return false // default to lockdown disabled
return constants.DefaultGitHubLockdown
}

// hasGitHubLockdownExplicitlySet checks if lockdown field is explicitly set in GitHub tool config
Expand Down
Loading