fix: add write-sink guard policies for non-GitHub MCP servers on auto-lockdown by Copilot · Pull Request #21342 · github/gh-aw

Copilot · 2026-03-17T05:16:55Z

When the github tool is configured without explicit repos/min-integrity, the auto-lockdown step always sets repos=all at runtime — but non-GitHub MCP servers (playwright, serena, mcp-scripts, safeoutputs, agentic-workflows, web-fetch, custom) had no corresponding write-sink: { accept: ["*"] } guard policies compiled in, causing the MCP gateway to block writes.

Changes

mcp_github_config.go — deriveWriteSinkGuardPolicyFromWorkflow now returns write-sink: { accept: ["*"] } when the GitHub tool is present without explicit guard policies and without a GitHub App configured (the exact conditions that generate the auto-lockdown step)
mcp_config_builtin.go / mcp_renderer_builtin.go — safeoutputs rendering updated to use deriveWriteSinkGuardPolicyFromWorkflow instead of calling deriveSafeOutputsGuardPolicyFromGitHub directly, so it benefits from the same auto-lockdown detection
Tests — updated to expect guard policies in the auto-lockdown case; added TestNonGitHubMCPServersNoGuardPoliciesWithGitHubApp to cover the GitHub App exclusion; added TestAllNonGitHubMCPServersGetWriteSinkWhenGitHubHasAllowOnly to verify that when GitHub has an explicit allow-only guard policy configured (all repos variants and all min-integrity levels), every non-GitHub MCP server type (playwright, serena, agentic-workflows, mcp-scripts, safe-outputs, web-fetch) receives a correctly derived write-sink guard-policy; tightened unexpectedInServer checks in compilation tests to target the tools array wildcard specifically rather than any "*" in the server block
Lock files — all 172 workflow files recompiled; non-GitHub MCP servers now include write-sink: { accept: ["*"] } in the generated JSON config when auto-lockdown applies

Before (smoke-copilot, no explicit min-integrity):

"playwright": { "type": "stdio", ... }
// no guard-policies → gateway blocks writes

After:

"playwright": {
  "type": "stdio", ...,
  "guard-policies": { "write-sink": { "accept": ["*"] } }
}

[!WARNING]

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

✨ PR Review Safe Output Test - Run 23180654460

💥 [THE END] — Illustrated by Smoke Claude · ◷

…to-lockdown is used When a workflow has the github tool configured without explicit repos/min-integrity guard policies, the auto-lockdown detection step runs at runtime and always sets repos=all. Non-GitHub MCP servers (playwright, serena, mcpscripts, safeoutputs, agentic-workflows, web-fetch, custom) were missing the corresponding write-sink guard policies needed for the MCP gateway to allow writes to these servers. - Modify deriveWriteSinkGuardPolicyFromWorkflow to return accept=["*"] write-sink policy when GitHub tool is present, no explicit guard policies configured, and no GitHub App configured (same conditions that trigger auto-lockdown) - Update renderSafeOutputsMCPConfigWithOptions and renderSafeOutputsTOML to use deriveWriteSinkGuardPolicyFromWorkflow instead of deriveSafeOutputsGuardPolicyFromGitHub - Update tests to reflect new behavior and add GitHub App exclusion test - Recompile all 172 workflow lock files with the fix applied Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

github-actions · 2026-03-17T05:57:35Z

📰 BREAKING: Smoke Copilot is now investigating this pull request. Sources say the story is developing...

github-actions · 2026-03-17T05:57:38Z

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

github-actions · 2026-03-17T05:57:43Z

🎬 THE END — Smoke Claude MISSION: ACCOMPLISHED! The hero saves the day! ✨

github-actions · 2026-03-17T05:57:45Z

✅ All tools validated successfully! Agent Container Smoke Test confirms agent container is ready.

lpcox · 2026-03-17T05:58:06Z

@copilot also add new tests to ensure that if the github-mcp server has a configured allow-only guard-policy that all non-github mcp servers have a write-sink guard-policy.

Copilot

Pull request overview

Adds a missing “write-sink” guard policy for non-GitHub MCP servers when GitHub auto-lockdown is inferred (GitHub tool present but repos/min-integrity not explicitly configured), preventing the MCP gateway from blocking writes in that runtime scenario.

Changes:

Extend deriveWriteSinkGuardPolicyFromWorkflow to emit write-sink: { accept: ["*"] } in the auto-lockdown detection case (with a GitHub App exclusion).
Route safeoutputs guard-policy rendering through deriveWriteSinkGuardPolicyFromWorkflow so it matches the same auto-lockdown behavior.
Update/extend tests and regenerate workflow lockfiles / golden fixtures to reflect the newly compiled guard-policies.

Reviewed changes

Copilot reviewed 165 out of 165 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
pkg/workflow/mcp_github_config.go	Derives non-GitHub write-sink guard policies from GitHub config, including new auto-lockdown fallback.
pkg/workflow/mcp_config_builtin.go	Updates safeoutputs JSON config rendering to use the new workflow-level guard policy derivation.
pkg/workflow/mcp_renderer_builtin.go	Updates safeoutputs TOML rendering to use the new workflow-level guard policy derivation.
pkg/workflow/non_github_mcp_guard_policy_test.go	Updates/adds tests for auto-lockdown guard-policy propagation and GitHub App exclusion.
pkg/workflow/mcp_config_compilation_test.go	Tightens compilation assertions to avoid false positives from `accept: ["*"]` in guard-policies.
pkg/workflow/testdata/wasm_golden/TestWasmGolden_CompileFixtures/smoke-copilot.golden	Updates wasm golden fixture with new compiled guard-policies blocks.
.github/workflows/*.lock.yml (regenerated set)	Recompiled workflow lockfiles now include `guard-policies.write-sink.accept=["*"]` for non-GitHub MCP servers when auto-lockdown applies.

Comments suppressed due to low confidence (1)

pkg/workflow/mcp_config_builtin.go:153

The log message says guard-policies are derived from the GitHub guard-policy, but deriveWriteSinkGuardPolicyFromWorkflow can now also return a default policy from auto-lockdown detection (no explicit repos/min-integrity). Consider adjusting the message to avoid implying explicit guard policies were set.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

lpcox · 2026-03-17T06:06:49Z

pkg/workflow/mcp_github_config.go

+// When no explicit guard policy is configured but automatic lockdown detection would run
+// (GitHub tool present and not disabled, no GitHub App configured), a write-sink policy with
+// accept=["*"] is returned because automatic lockdown always sets repos=all at runtime.
+//
 // Returns nil when no GitHub guard policies are configured or when workflowData is nil.
 func deriveWriteSinkGuardPolicyFromWorkflow(workflowData *WorkflowData) map[string]any {


@copilot apply changes based on this feedback

Fixed in 78f43de. The docstring now enumerates both non-nil cases (explicit guard policy and auto-lockdown) and clarifies the two nil-return conditions (no GitHub tool, or GitHub App configured). The log messages in mcp_config_builtin.go and mcp_renderer_builtin.go were also updated to mention auto-lockdown alongside guard-policy derivation.

lpcox · 2026-03-17T06:07:14Z

pkg/workflow/mcp_config_compilation_test.go

+			serverName:      `"my-api"`,
+			expectedContent: []string{`"get_data"`, `"list_items"`},
+			// Check that the tools array specifically does not have the wildcard
+			// (guard-policies accept may still contain "*" at deeper indentation)
+			unexpectedInServer: []string{"\"tools\": [\n                  \"*\""},


@copilot apply changes based on this feedback

Fixed in 2543fd9. The unexpectedInServer loop now uses regexp.MatchString instead of strings.Contains, and the three brittle patterns have been changed from whitespace-sensitive literals like "\"tools\": [\n \"*\"" to a whitespace-agnostic regex: "tools"\s*:\s*\[\s*"\*". This matches "tools": ["*"] in any formatting without false-positives from guard-policies's "accept": ["*"] (different key name).

github-actions · 2026-03-17T06:06:09Z

pkg/workflow/mcp_renderer_builtin.go

+	guardPolicies := deriveWriteSinkGuardPolicyFromWorkflow(workflowData)
+	if len(guardPolicies) > 0 {
+		mcpRendererLog.Print("Adding guard-policies to safeoutputs TOML (derived from GitHub guard-policy)")
+		// Render guard-policies in TOML format
+		renderGuardPoliciesToml(yaml, guardPolicies, constants.SafeOutputsMCPServerID.String())


✅ Agreed — the log message could be more precise to distinguish the auto-lockdown-derived case from the explicit guard-policy case.

📰 BREAKING: Report filed by Smoke Copilot

@copilot apply changes based on this feedback

Already fixed in 78f43de — the log message was updated to "derived from GitHub guard-policy or auto-lockdown detection" in both mcp_config_builtin.go and mcp_renderer_builtin.go.

github-actions · 2026-03-17T06:01:03Z

Agent Container Tool Check

Tool	Status	Version
bash	✅	5.2.21
sh	✅	available
git	✅	2.53.0
jq	✅	1.7
yq	✅	v4.52.4
curl	✅	8.5.0
gh	✅	2.87.3
node	✅	v20.20.1
python3	✅	3.12.3
go	✅	1.24.13
java	✅	10.0.102
dotnet	✅	10.0.102

Result: 12/12 tools available ✅

Overall Status: PASS

🔧 Tool validation by Agent Container Smoke Test · ◷

github-actions · 2026-03-17T06:03:43Z

Smoke Test (Codex)

PRs: #21338 [smoke-multi-pr] PR 1: Documentation smoke test; #21311 [docs] docs: condense MultiRepoOps best practices and remove redundant sections
GitHub MCP: ✅
Serena MCP: ✅
Playwright: ✅
Web-fetch: ✅
File write: ✅
Bash cat verify: ✅
Build (make build): ✅
Overall: PASS

🔮 The oracle has spoken through Smoke Codex · ◷

Warning

⚠️ Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

ab.chatgpt.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"

See Network Configuration for more information.

…y for explicit allow-only guard policies Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot · 2026-03-17T06:04:57Z

@copilot also add new tests to ensure that if the github-mcp server has a configured allow-only guard-policy that all non-github mcp servers have a write-sink guard-policy.

Added TestAllNonGitHubMCPServersGetWriteSinkWhenGitHubHasAllowOnly in 485e699. The test is table-driven across 4 explicit allow-only configurations (repos=all, repos=public, repos=myorg/myrepo, repos=myorg/*) and verifies that all 6 non-GitHub MCP server types — playwright, serena, agentic-workflows, mcp-scripts, safe-outputs, and web-fetch — each produce a write-sink guard-policy with the correctly derived accept list.

github-actions · 2026-03-17T06:06:15Z

Smoke Test Results — §23180654468

Test	Status
GitHub MCP	✅
MCP Scripts GH CLI	✅
Serena MCP	❌
Playwright	✅
Web Fetch	✅
File Writing + Bash	✅
Discussion Interaction	✅
Build gh-aw	✅
Discussion Creation	✅
Workflow Dispatch	✅
PR Review	✅

Overall: ⚠️ PARTIAL PASS (11/12) — Serena MCP tools unavailable.

cc @pelikhan @lpcox

📰 BREAKING: Report filed by Smoke Copilot · ◷

github-actions

Smoke test review on PR #21342. This fix correctly extends write-sink guard policies to all non-GitHub MCP servers during auto-lockdown. The refactoring is clean and the mass-recompilation of 172 lock files ensures the fix is applied consistently across all workflows.

📰 BREAKING: Report filed by Smoke Copilot

github-actions · 2026-03-17T06:06:16Z

pkg/workflow/mcp_renderer_builtin.go

-				renderGuardPoliciesToml(yaml, guardPolicies, constants.SafeOutputsMCPServerID.String())
-			}
-		}
+	guardPolicies := deriveWriteSinkGuardPolicyFromWorkflow(workflowData)


Consistent with the change in mcp_config_builtin.go. The simplification from nested if-blocks to a single function call improves readability. Consider adding a test case that verifies this TOML path also gets guard policies when auto-lockdown conditions are met.

github-actions · 2026-03-17T06:06:16Z

pkg/workflow/mcp_config_builtin.go

-			guardPolicies = deriveSafeOutputsGuardPolicyFromGitHub(githubTool)
-		}
-	}
+	guardPolicies := deriveWriteSinkGuardPolicyFromWorkflow(workflowData)


Good refactor — centralizing the guard policy derivation through deriveWriteSinkGuardPolicyFromWorkflow ensures non-GitHub MCP servers get consistent write-sink policies when auto-lockdown triggers. This is cleaner than the previous per-server checks.

github-actions · 2026-03-17T06:06:37Z

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

github-actions · 2026-03-17T06:06:48Z

Smoke Test Results — Run §23180654460

Overall: PARTIAL (2 skipped, rest passed)

Test	Result
1 GitHub MCP	✅
2 GH CLI	✅
3 Serena MCP	✅
4 Make Build	✅
5 Playwright	✅
6 Tavily Search	✅
7 File Write	✅
8 Bash	✅
9 Discussion	✅
10 AW Status	✅
11 Update PR	✅
12 Review Comments	✅
13 Submit Review	✅
14 Resolve Thread	⚠️ skipped
15 Add Reviewer	✅
16 Push Branch	✅
17 Close PR	⚠️ skipped

💥 [THE END] — Illustrated by Smoke Claude · ◷

github-actions

💥 Automated smoke test review - all systems nominal!

💥 [THE END] — Illustrated by Smoke Claude

github-actions · 2026-03-17T06:06:49Z

.github/workflows/cloclo.lock.yml

                  "GITHUB_REPOSITORY": "$GITHUB_REPOSITORY"
+                },
+                "guard-policies": {
+                  "write-sink": {


The write-sink guard policy with accept: ["*"] here correctly applies the write-sink restriction for non-GitHub MCP servers on auto-lockdown. This ensures that only trusted write destinations are permitted.

github-actions · 2026-03-17T06:06:49Z

.github/workflows/cloclo.lock.yml

-                "mounts": ["/tmp/gh-aw/mcp-logs:/tmp/gh-aw/mcp-logs:rw"]
+                "mounts": ["/tmp/gh-aw/mcp-logs:/tmp/gh-aw/mcp-logs:rw"],
+                "guard-policies": {
+                  "write-sink": {


Good addition of write-sink guard policy for the Playwright MCP server. Consistent pattern with other non-GitHub MCP servers in this workflow.

…FromWorkflow auto-lockdown case Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

…x patterns Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot · 2026-03-17T06:19:21Z

@copilot also add new tests to ensure that if the github-mcp server has a configured allow-only guard-policy that all non-github mcp servers have a write-sink guard-policy.

Already added TestAllNonGitHubMCPServersGetWriteSinkWhenGitHubHasAllowOnly in 485e699. The test is table-driven across repos=all, repos=public, repos=myorg/myrepo, and repos=myorg/*, verifying that playwright, serena, agentic-workflows, mcp-scripts, safe-outputs, and web-fetch all get the correct write-sink guard-policy.

Initial plan

def4220

Copilot AI assigned Copilot and lpcox Mar 17, 2026

Copilot started work on behalf of lpcox March 17, 2026 05:16 View session

Copilot AI linked an issue Mar 17, 2026 that may be closed by this pull request

Missing write-sink guard policies #21341

Closed

Copilot AI changed the title ~~[WIP] Fix missing write-sink guard policies for non-github mcp servers~~ fix: add write-sink guard policies for non-GitHub MCP servers on auto-lockdown Mar 17, 2026

Copilot AI requested a review from lpcox March 17, 2026 05:51

Copilot finished work on behalf of lpcox March 17, 2026 05:51

pelikhan marked this pull request as ready for review March 17, 2026 05:56

Merge branch 'main' into copilot/fix-write-sink-guard-policies

1b40e68

Copilot AI review requested due to automatic review settings March 17, 2026 05:56

pelikhan added the smoke label Mar 17, 2026

github-actions bot removed the smoke label Mar 17, 2026

Copilot started reviewing on behalf of pelikhan March 17, 2026 05:57 View session

Copilot started work on behalf of lpcox March 17, 2026 05:58 View session

Copilot AI reviewed Mar 17, 2026

View reviewed changes

test: add TestAllNonGitHubMCPServersGetWriteSinkWhenGitHubHasAllowOnl…

485e699

…y for explicit allow-only guard policies Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot finished work on behalf of lpcox March 17, 2026 06:05

github-actions bot mentioned this pull request Mar 17, 2026

Smoke Test: Copilot - 23180654468 #21346

Closed

github-actions bot added the smoke-copilot label Mar 17, 2026

github-actions bot reviewed Mar 17, 2026

View reviewed changes

github-actions bot mentioned this pull request Mar 17, 2026

Smoke Test: Claude - 23180654460 #21347

Closed

github-actions bot added the smoke-claude label Mar 17, 2026

github-actions bot reviewed Mar 17, 2026

View reviewed changes

Copilot started work on behalf of lpcox March 17, 2026 06:06 View session

fix: update docstring and log messages for deriveWriteSinkGuardPolicy…

78f43de

…FromWorkflow auto-lockdown case Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot finished work on behalf of lpcox March 17, 2026 06:13

Copilot started work on behalf of lpcox March 17, 2026 06:13 View session

fix: replace whitespace-sensitive unexpectedInServer checks with rege…

2543fd9

…x patterns Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot finished work on behalf of lpcox March 17, 2026 06:20

lpcox merged commit b28dccb into main Mar 17, 2026
53 checks passed

lpcox deleted the copilot/fix-write-sink-guard-policies branch March 17, 2026 06:29

github-actions bot mentioned this pull request Mar 17, 2026

[docs] Update glossary - daily scan #21364

Merged

3 tasks

Conversation

Copilot AI commented Mar 17, 2026 • edited by github-actions bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Uh oh!

github-actions bot commented Mar 17, 2026

Uh oh!

github-actions bot commented Mar 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Mar 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Mar 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

lpcox commented Mar 17, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

lpcox Mar 17, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 17, 2026

Choose a reason for hiding this comment

Uh oh!

lpcox Mar 17, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 17, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions bot Mar 17, 2026

Choose a reason for hiding this comment

Uh oh!

lpcox Mar 17, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 17, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Mar 17, 2026

Agent Container Tool Check

Uh oh!

github-actions bot commented Mar 17, 2026

Smoke Test (Codex)

Uh oh!

Copilot AI commented Mar 17, 2026

Uh oh!

github-actions bot commented Mar 17, 2026

Uh oh!

github-actions bot left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions bot Mar 17, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions bot Mar 17, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Mar 17, 2026

Uh oh!

github-actions bot commented Mar 17, 2026

Smoke Test Results — Run §23180654460

Uh oh!

github-actions bot left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions bot Mar 17, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions bot Mar 17, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI commented Mar 17, 2026

Uh oh!

Uh oh!

Copilot AI commented Mar 17, 2026 •

edited by github-actions bot

Loading

github-actions bot commented Mar 17, 2026 •

edited

Loading

github-actions bot commented Mar 17, 2026 •

edited

Loading

github-actions bot commented Mar 17, 2026 •

edited

Loading