Conversation
…lf-hosted runner compatibility
Changes /opt/gh-aw to ${{ runner.temp }}/gh-aw across the codebase so that
self-hosted runners without write access to /opt can run workflows.
Updates Go constants, setup action, golden files, lock files, and tests.
Co-authored-by: Mossaka <5447827+Mossaka@users.noreply.github.com>
Updates runtime JavaScript (.cjs) and shell (.sh) scripts to use process.env.RUNNER_TEMP and $RUNNER_TEMP instead of hardcoded /opt/gh-aw. Also adds write access validation for RUNNER_TEMP in setup.sh. Co-authored-by: Mossaka <5447827+Mossaka@users.noreply.github.com>
|
Hey
If you'd like to address the validation gap, you can assign this prompt to your coding agent:
|
|
@copilot can you fix this broken CI? https://github.com/github/gh-aw/actions/runs/23216102295/job/67480338381?pr=21443 |
…}} in with/env fields
Fixes CI failure caused by smoke-claude.md exceeding GitHub Actions'
21KB expression size limit. The longer ${{ runner.temp }} expression
(23 chars vs /opt/gh-aw's 10) pushed run: blocks over the limit.
Solution: use ${RUNNER_TEMP} (shell env var, 16 chars) in run: blocks
where shell resolves the variable, and keep ${{ runner.temp }} only
in with:/env: fields where GitHub Actions template resolution is needed.
Also adds GhAwRootDirShell constant and SetupActionDestinationShell
for the two path forms.
Co-authored-by: Mossaka <5447827+Mossaka@users.noreply.github.com>
Fixed in b92e3ba. The CI failure was caused by The fix uses Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
|
@copilot please fix this CI failure: https://github.com/github/gh-aw/actions/runs/23217782629/job/67483556967?pr=21443 |
|
@copilot please fix please fix this CI failure: https://github.com/github/gh-aw/actions/runs/23217782629/job/67483556967?pr=21443 |
…ntime
Tests were using regular double-quoted strings like
"...${process.env.RUNNER_TEMP}/gh-aw..." which compared against the
literal text "${process.env.RUNNER_TEMP}" instead of the resolved path.
Changed to backtick template literals so the env var is evaluated.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
Smoke Test Results — Run §23220647777
Overall: PR author:
|
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Smoke test review ✅ — This PR correctly migrates hardcoded /opt/gh-aw paths to ${{ runner.temp }}/gh-aw for self-hosted runner compatibility. Changes look consistent across workflow files. Two inline notes added.
📰 BREAKING: Report filed by Smoke Copilot
| uses: ./actions/setup | ||
| with: | ||
| destination: /opt/gh-aw/actions | ||
| destination: ${{ runner.temp }}/gh-aw/actions |
There was a problem hiding this comment.
The $\{\{ runner.temp }}/gh-aw/actions destination looks correct. Note that runner.temp is ephemeral — cleaned between jobs in some runner configurations. This should be fine since actions/setup runs in the same job context.
| "gh-aw": patch | ||
| --- | ||
|
|
||
| Replaced hardcoded `/opt/gh-aw` paths with `${{ runner.temp }}/gh-aw` (and `${RUNNER_TEMP}/gh-aw` in shell contexts) so compiled workflows and setup scripts run correctly on self-hosted runners without `/opt` write access. |
There was a problem hiding this comment.
Good changeset description — clearly explains the motivation (self-hosted runners without /opt write access). Consider also mentioning that the runner.temp directory is cleaned up after each job, so any persistent state needs to be handled accordingly.
|
📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤 |
This comment has been minimized.
This comment has been minimized.
|
@Mossaka ensure that the agent container does not have rw access to the folder where the actions javascript is copied |
The agent sandbox (AWF) has $HOME mounted :rw in chroot mode, and
$RUNNER_TEMP is under $HOME on GitHub-hosted runners. This meant the
agent could directly write to ${RUNNER_TEMP}/gh-aw/safeoutputs/outputs.jsonl,
bypassing the safe-outputs MCP server validation and injecting arbitrary
safe outputs.
Add two --mount flags to every AWF invocation:
"${RUNNER_TEMP}/gh-aw:${RUNNER_TEMP}/gh-aw:ro"
"${RUNNER_TEMP}/gh-aw:/host${RUNNER_TEMP}/gh-aw:ro"
The more-specific :ro mount overrides the broader $HOME:rw mount for
this subdirectory (same Docker mechanism used for credential file hiding).
The /host-prefixed entry covers chroot mode. The MCP server runs on the
host outside AWF and retains full write access.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟 |
|
✅ All tools validated successfully! Agent Container Smoke Test confirms agent container is ready. |
|
🎬 THE END — Smoke Claude MISSION: ACCOMPLISHED! The hero saves the day! ✨ |
|
📰 BREAKING: Smoke Copilot is now investigating this pull request. Sources say the story is developing... |
Agent Container Tool Check
Result: 12/12 tools available ✅ Overall Status: PASS
|
Smoke Test (Codex)
Warning
|
Smoke Test Results - Run §23222225140
Overall: PR Author:
|
There was a problem hiding this comment.
This PR correctly migrates hardcoded /opt/gh-aw paths to ${{ runner.temp }}/gh-aw for self-hosted runner compatibility. The changes are consistent across all workflow lock files. No functional issues found — smoke test review complete.
📰 BREAKING: Report filed by Smoke Copilot
| "gh-aw": patch | ||
| --- | ||
|
|
||
| Replaced hardcoded `/opt/gh-aw` paths with `${{ runner.temp }}/gh-aw` (and `${RUNNER_TEMP}/gh-aw` in shell contexts) so compiled workflows and setup scripts run correctly on self-hosted runners without `/opt` write access. |
There was a problem hiding this comment.
Good changeset description! Clearly explains the motivation (self-hosted runner compatibility) and both path formats used in the PR.
| uses: ./actions/setup | ||
| with: | ||
| destination: /opt/gh-aw/actions | ||
| destination: ${{ runner.temp }}/gh-aw/actions |
There was a problem hiding this comment.
The \$\{RUNNER_TEMP}/gh-aw approach is a great fix for self-hosted runner compatibility. Consider adding a note in the docs about this requirement for self-hosted runner setups.
|
📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤 |
Smoke Test Results — Run §23222225233Status: PARTIAL (2 skipped, all others ✅)
|
There was a problem hiding this comment.
💥 Automated smoke test review - all systems nominal!
💥 [THE END] — Illustrated by Smoke Claude
| "gh-aw": patch | ||
| --- | ||
|
|
||
| Replaced hardcoded `/opt/gh-aw` paths with `${{ runner.temp }}/gh-aw` (and `${RUNNER_TEMP}/gh-aw` in shell contexts) so compiled workflows and setup scripts run correctly on self-hosted runners without `/opt` write access. |
There was a problem hiding this comment.
Good description of the change! Consider also mentioning the benefit for cloud-hosted runners to make it clear this is backward-compatible.
| @@ -0,0 +1,5 @@ | |||
| --- | |||
| "gh-aw": patch | |||
There was a problem hiding this comment.
Correct patch-level bump for this compatibility improvement — no breaking API changes here.
Add two new terms identified from recent commits: - GH_HOST: gh CLI env var for GHES/GHEC enterprise hostname routing, auto-configured by configure_gh_for_ghe.sh and propagated to custom frontmatter jobs and safe-outputs (PRs #21523, #21525) - RUNNER_TEMP / runner.temp: GitHub Actions temp dir used for storing gh-aw runtime artifacts, replacing /opt/gh-aw for self-hosted runner compatibility (PR #21443) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
The
actions/setupaction and compiled workflows hardcode/opt/gh-aw/as the destination for scripts, binaries, and runtime files. Self-hosted runners typically don't grant write access to/opt, breaking all workflow execution on those environments.Replaces
/opt/gh-aw/with$RUNNER_TEMP/gh-aw/across the entire compilation pipeline.RUNNER_TEMPis guaranteed writable by GitHub Actions on all runner types. Uses the appropriate expression form depending on the resolution context to avoid exceeding GitHub Actions' 21KB expression size limit.Core constants
GhAwRootDirinpkg/constants/constants.gofor YAMLwith:/env:fields:"${{ runner.temp }}/gh-aw"GhAwRootDirShellfor shellrun:blocks and Docker mounts:"${RUNNER_TEMP}/gh-aw"setup_action_paths.go:SetupActionDestination,SetupActionDestinationShell,SafeOutputsDir,SafeOutputsDirShell,GhAwMCPScriptsDir,GhAwBinaryPath,SafeJobsDownloadDirDefaultGhAwMountto useGhAwRootDirShellfor both source and targetSetup action (
actions/setup/)setup.sh: defaults to${RUNNER_TEMP}/gh-aw, adds write-access validation before proceedingaction.yml: default input changed to${{ runner.temp }}/gh-aw/actionssh/*.sh): use${RUNNER_TEMP}/gh-awinstead of/opt/gh-awJavaScript runtime files (
actions/setup/js/).cjsfiles updated to use`${process.env.RUNNER_TEMP}/gh-aw/...`template literalsprocess.env.GH_AW_X || "/opt/gh-aw/..."updated accordinglyCompiled output
.lock.ymlfiles recompiled successfullyPath resolution by context
with:/env:fields${{ runner.temp }}/gh-awrun:blocks (shell)${RUNNER_TEMP}/gh-awrequire()inscript:blocks${{ runner.temp }}/gh-aw*.sh)${RUNNER_TEMP}/gh-aw*.cjs)process.env.RUNNER_TEMP${RUNNER_TEMP}/gh-awThe two-form approach (
${{ runner.temp }}vs${RUNNER_TEMP}) is necessary becauserun:blocks can contain GitHub Actions template expressions that count toward the 21KB YAML value size limit. Using the shorter shell env var form (${RUNNER_TEMP}, 16 chars) instead of the Actions expression (${{ runner.temp }}, 23 chars) inrun:blocks keeps large workflows likesmoke-claude.mdunder the limit.✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.
✨ PR Review Safe Output Test - Run 23220215251
✨ PR Review Safe Output Test - Run 23220647804
✨ PR Review Safe Output Test - Run 23222225233