-
Notifications
You must be signed in to change notification settings - Fork 308
[docs] docs: remove redundant content from templating.md #21876
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -98,17 +98,7 @@ The template system supports only basic conditionals - no nesting, `else` clause | |
|
|
||
| ## Runtime Imports | ||
|
|
||
| Runtime imports allow you to include content from files and URLs directly within your workflow prompts **at runtime** during GitHub Actions execution. This differs from [frontmatter imports](/gh-aw/reference/imports/) which are processed at compile-time. | ||
|
|
||
| **Security Note:** File imports are **restricted to the `.github` folder** in your repository. This ensures workflow configurations cannot access arbitrary files in your codebase. | ||
|
|
||
| Runtime imports use the macro syntax: `{{#runtime-import filepath}}` | ||
|
|
||
| The macro supports: | ||
| - Line range extraction (e.g., `:10-20` for lines 10-20) | ||
| - URL fetching with automatic caching | ||
| - Content sanitization (front matter removal, macro detection) | ||
| - Automatic `.github/` prefix handling | ||
| Runtime imports include content from files and URLs in workflow prompts **at runtime** (unlike [compile-time imports](/gh-aw/reference/imports/)). File paths are restricted to the `.github` folder. Use `{{#runtime-import filepath}}` or `{{#runtime-import? filepath}}` for optional imports. | ||
|
|
||
| ### Macro Syntax | ||
|
|
||
|
|
@@ -169,18 +159,11 @@ All runtime imports include automatic security protections. | |
|
|
||
| **Content Sanitization:** YAML front matter and HTML/XML comments are automatically stripped. GitHub Actions expressions (`${{ ... }}`) are **rejected with error** to prevent template injection and unintended variable expansion. | ||
|
|
||
| **Path Validation:** | ||
|
|
||
| File paths are **restricted to the `.github` folder** to prevent access to arbitrary repository files: | ||
| **Path Validation:** File paths are restricted to the `.github` folder to prevent access to arbitrary repository files. Path traversal and absolute paths are rejected: | ||
|
|
||
| ```aw wrap | ||
| # ✅ Valid - Files in .github folder | ||
| {{#runtime-import shared-instructions.md}} # Loads .github/shared-instructions.md | ||
| {{#runtime-import .github/shared-instructions.md}} # Same - .github/ prefix is trimmed | ||
|
|
||
| # ❌ Invalid - Security violations | ||
| {{#runtime-import ../src/config.go}} # Error: Relative traversal outside .github | ||
| {{#runtime-import /etc/passwd}} # Error: Absolute path not allowed | ||
| {{#runtime-import ../src/config.go}} # Error: Relative traversal outside .github | ||
| {{#runtime-import /etc/passwd}} # Error: Absolute path not allowed | ||
|
Comment on lines
+165
to
+166
|
||
| ``` | ||
|
|
||
| ### Caching | ||
|
|
@@ -195,32 +178,6 @@ Runtime imports are processed before other substitutions: | |
| 2. `${GH_AW_EXPR_*}` variable interpolation | ||
| 3. `{{#if}}` template conditionals rendered | ||
|
|
||
| ### Common Use Cases | ||
|
|
||
| **Shared instructions from a file:** | ||
|
|
||
| ```aw wrap | ||
| # Code Review Agent | ||
|
|
||
| {{#runtime-import workflows/shared/review-standards.md}} | ||
| <!-- Loads .github/workflows/shared/review-standards.md --> | ||
|
|
||
| Review the pull request changes. | ||
| ``` | ||
|
|
||
| **External content from a URL, with line range:** | ||
|
|
||
| ```aw wrap | ||
| # Security Audit | ||
|
|
||
| Follow this checklist: | ||
|
|
||
| {{#runtime-import https://company.com/security/api-checklist.md}} | ||
|
|
||
| Reference implementation (lines 100-150): | ||
| {{#runtime-import docs/engine.go:100-150}} | ||
| ``` | ||
|
|
||
| ### Limitations | ||
|
|
||
| - **`.github` folder only:** File paths are restricted to `.github` folder for security | ||
|
|
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The intro states that runtime-import file paths are restricted to the
.githubfolder, but the runtime implementation also supports importing from the top-level.agents/directory and (for paths without an explicit prefix) resolves relative to.github/workflowsrather than.github/. Consider updating this sentence to reflect the actual resolution rules (e.g.,.github/workflowsdefault + explicit.github/...and.agents/...support) so readers don’t form incorrect expectations.See below for a potential fix: