feat(compile): add --actions-repo flag to override external actions repository by Copilot · Pull Request #22437 · github/gh-aw

Copilot · 2026-03-23T13:47:17Z

Summary

Adds a new --actions-repo flag to the compile command that allows users to specify a custom external actions repository instead of the hardcoded default github/gh-aw-actions.

Motivation

When running gh aw compile in action mode, all action references in the compiled .lock.yml files point to github/gh-aw-actions. This new flag allows users to override that repository, for example to use a fork or a custom deployment of the actions.

Changes

pkg/workflow/compiler_types.go: Added actionsRepo string field to Compiler struct with SetActionsRepo/GetActionsRepo public methods and an effectiveActionsRepo() internal helper that returns the override if set, otherwise falls back to the GitHubActionsOrgRepo constant.
pkg/workflow/action_reference.go: Extracted internal resolveSetupActionRef function that accepts an actionsOrgRepo override parameter. Kept the existing public ResolveSetupActionReference as a no-arg-change wrapper (backward compatible). Updated the compiler's resolveActionReference and convertToExternalActionsRef methods to use c.effectiveActionsRepo().
pkg/cli/compile_config.go: Added ActionsRepo string field to CompileConfig.
pkg/cli/compile_compiler_setup.go: Calls compiler.SetActionsRepo(config.ActionsRepo) in createAndConfigureCompiler when an override is provided. Also fixed setupActionMode so that explicitly specifying --action-mode action alongside --action-tag respects the action mode instead of always forcing release mode.
cmd/gh-aw/main.go: Registered the --actions-repo flag, reads its value, and passes it to CompileConfig.
pkg/cli/workflows/test-actions-repo.md: Added a canonical fixture workflow used by the new integration tests.
pkg/cli/compile_integration_test.go: Added two integration tests (TestCompileWithActionsRepoFlag and TestCompileWithActionsRepoDefaultFallback) that compile the fixture workflow and verify the custom repository — or the default github/gh-aw-actions — is correctly baked into the generated lock file.

Usage

# Use a custom fork of gh-aw-actions
gh aw compile --action-mode action --actions-repo myorg/my-aw-actions

# Use in combination with action-tag
gh aw compile --action-mode action --actions-repo myorg/my-aw-actions --action-tag v1.2.3

Security Summary

No security vulnerabilities were introduced. The flag accepts a repository slug string that is used as-is to construct action references in the compiled YAML. No code execution or privilege escalation is possible from this value.

⚡ Quickly spin up Copilot coding agent tasks from anywhere on your macOS or Windows machine with Raycast.

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> Agent-Logs-Url: https://github.com/github/gh-aw/sessions/7527c09a-4314-4fb2-b7cb-7880d6142096

…epository Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> Agent-Logs-Url: https://github.com/github/gh-aw/sessions/7527c09a-4314-4fb2-b7cb-7880d6142096

pelikhan · 2026-03-23T14:03:24Z

@copilot add integrations tests in pkg/cli/workflows that ensure the args custom action id is baked into the lockfiles.

johnwilliams-12 · 2026-03-23T14:12:30Z

@pelikhan Should we also add a parameter for specifying a specific branch?

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> Agent-Logs-Url: https://github.com/github/gh-aw/sessions/1e3c241a-3103-4eeb-a668-afdb683e4c59

Copilot · 2026-03-23T14:14:40Z

@copilot add integrations tests in pkg/cli/workflows that ensure the args custom action id is baked into the lockfiles.

Added two integration tests in commit 99e168a:

TestCompileWithActionsRepoFlag — compiles the fixture workflow with --action-mode action --actions-repo myorg/custom-aw-actions --action-tag v9.9.9 and asserts the custom repo is baked into the lock file (and the default github/gh-aw-actions is absent)
TestCompileWithActionsRepoDefaultFallback — compiles the same fixture with only --action-mode action --action-tag v9.9.9 (no --actions-repo) and asserts the default github/gh-aw-actions is still used

The fixture workflow lives at pkg/cli/workflows/test-actions-repo.md. Also fixed setupActionMode so that explicitly specifying --action-mode action alongside --action-tag correctly keeps action mode (instead of always forcing release mode).

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

https://api.github.com/repos/actions/github-script/git/ref/tags/v8
- Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha pkg/workflow/data/action_pins.json; \ echo "�� Action pins synced successfully"; \ else \ echo "�� Warning: .github/aw/actions-lock.json does not exist yet"; \ fi (http block)
https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.0.0
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq .object.sha .json..." (http block)
https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.2.3
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq .object.sha (http block)
https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v9.9.9
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v9.9.9 --jq .object.sha (http block)
https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.0.0
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq .object.sha (http block)
https://api.github.com/repos/github/gh-aw/git/ref/tags/v9.9.9
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v9.9.9 --jq .object.sha (http block)
https://api.github.com/repos/myorg/custom-aw-actions/git/ref/tags/v9.9.9
- Triggering command: /usr/bin/gh gh api /repos/myorg/custom-aw-actions/git/ref/tags/v9.9.9 --jq .object.sha (http block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

pelikhan · 2026-03-23T14:19:59Z

@pelikhan Should we also add a parameter for specifying a specific branch?

You can use --action-tag <branch>

Copilot

Pull request overview

Adds a new --actions-repo flag to gh aw compile so users can override the default external actions repository (github/gh-aw-actions) when compiling workflows in action mode (e.g., to point at a fork).

Changes:

Introduces an actions repo override on the workflow Compiler and threads it through action reference resolution.
Adds --actions-repo to the CLI, wiring it into CompileConfig and compiler setup.
Adds an integration-test fixture and tests to validate override behavior and default fallback.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
pkg/workflow/compiler_types.go	Adds `actionsRepo` state + getter/setter and a defaulting helper for the compiler.
pkg/workflow/action_reference.go	Refactors setup action resolution to accept an actions repo override; uses compiler’s effective repo in action-mode references.
pkg/cli/compile_config.go	Adds `ActionsRepo` to compile configuration.
pkg/cli/compile_compiler_setup.go	Applies `ActionsRepo` override to the compiler and adjusts `--action-tag` / `--action-mode action` precedence.
cmd/gh-aw/main.go	Registers `--actions-repo` flag and passes it through to `CompileConfig`.
pkg/cli/workflows/test-actions-repo.md	Adds a canonical workflow fixture for actions-repo integration tests.
pkg/cli/compile_integration_test.go	Adds integration tests for `--actions-repo` override and default fallback behavior.

Comments suppressed due to low confidence (2)

cmd/gh-aw/main.go:651

--actions-repo is accepted as an arbitrary string and then used to construct "uses:" references and resolver lookups. Consider validating it early (e.g., in validateCompileConfig) to ensure it is a plain "owner/repo" slug (no whitespace, no '@', exactly one '/'), and return a clear error if invalid to avoid generating broken workflows.

	compileCmd.Flags().String("actions-repo", "", "Override the external actions repository used in action mode (default: github/gh-aw-actions). Example: --actions-repo myorg/my-aw-actions")

cmd/gh-aw/main.go:649

The --action-mode flag help text lists only "inline, dev, release", but validateActionModeConfig (pkg/cli/compile_validation.go:231-234) accepts "dev", "release", "script", and "action". Update the help string to include the full set of supported modes so users can discover "script"/"action" via --help.

	compileCmd.Flags().String("action-mode", "", "Action script inlining mode (inline, dev, release). Auto-detected if not specified")

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-03-23T14:31:14Z

cmd/gh-aw/main.go

@@ -646,6 +648,7 @@ Use "` + string(constants.CLIExtensionPrefix) + ` help all" to show help for all
 	compileCmd.Flags().StringP("engine", "e", "", "Override AI engine (claude, codex, copilot, custom)")
 	compileCmd.Flags().String("action-mode", "", "Action script inlining mode (inline, dev, release). Auto-detected if not specified")
 	compileCmd.Flags().String("action-tag", "", "Override action SHA or tag for actions/setup (overrides action-mode to release). Accepts full SHA or tag name")


The --action-tag flag help text says it always overrides --action-mode to release, but setupActionMode now keeps action mode when the user explicitly sets --action-mode action. Please update this help text (and any related docs/comments) to reflect the new precedence so the CLI help matches actual behavior.

This issue also appears in the following locations of the same file:

line 651

line 649

Suggested change

compileCmd.Flags().String("action-tag", "", "Override action SHA or tag for actions/setup (overrides action-mode to release). Accepts full SHA or tag name")

compileCmd.Flags().String("action-tag", "", "Override action SHA or tag for actions/setup. When set without --action-mode, defaults action-mode to release. Accepts full SHA or tag name")

Copilot · 2026-03-23T14:31:15Z

pkg/cli/compile_config.go

@@ -32,6 +32,7 @@ type CompileConfig struct {
 	JSONOutput             bool     // Output validation results as JSON
 	ActionMode             string   // Action script inlining mode: inline, dev, or release
 	ActionTag              string   // Override action SHA or tag for actions/setup (overrides action-mode to release)


CompileConfig.ActionTag is documented as always overriding action-mode to release, but setupActionMode now keeps action mode when --action-mode action is explicitly set. Update this field comment to match the current precedence rules so callers don’t rely on outdated semantics.

Suggested change

ActionTag string // Override action SHA or tag for actions/setup (overrides action-mode to release)

ActionTag string // Override action SHA or tag for actions/setup (forces release mode unless action-mode is explicitly set to 'action')

Copilot · 2026-03-23T14:31:15Z

pkg/workflow/compiler_types.go

@@ -81,6 +81,7 @@ type Compiler struct {
 	markdownPath            string              // Path to the markdown file being compiled (for context in dynamic tool generation)
 	actionMode              ActionMode          // Mode for generating JavaScript steps (inline vs custom actions)
 	actionTag               string              // Override action SHA or tag for actions/setup (when set, overrides actionMode to release)


Compiler.actionTag is commented as overriding actionMode to release, but setupActionMode now preserves ActionModeAction when explicitly requested alongside an action tag. Please update this struct field comment to reflect the current precedence (action-tag pins the version; it only forces release when action-mode isn’t explicitly set to action).

Suggested change

actionTag string // Override action SHA or tag for actions/setup (when set, overrides actionMode to release)

actionTag string // Override action SHA or tag for actions/setup; pins the version and only forces release when actionMode is not explicitly set to action

Copilot AI and others added 2 commits March 23, 2026 13:38

chore: outline plan for --actions-repo flag

7130a7d

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> Agent-Logs-Url: https://github.com/github/gh-aw/sessions/7527c09a-4314-4fb2-b7cb-7880d6142096

feat(compile): add --actions-repo flag to override external actions r…

cf38b01

…epository Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> Agent-Logs-Url: https://github.com/github/gh-aw/sessions/7527c09a-4314-4fb2-b7cb-7880d6142096

Copilot AI assigned Copilot and pelikhan Mar 23, 2026

Copilot created this pull request from a session on behalf of pelikhan March 23, 2026 13:48 View session

Copilot AI requested a review from pelikhan March 23, 2026 13:48

Copilot finished work on behalf of pelikhan March 23, 2026 13:48

Copilot started work on behalf of pelikhan March 23, 2026 14:03 View session

test(compile): add integration tests for --actions-repo flag

99e168a

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> Agent-Logs-Url: https://github.com/github/gh-aw/sessions/1e3c241a-3103-4eeb-a668-afdb683e4c59

Copilot finished work on behalf of pelikhan March 23, 2026 14:15

Merge branch 'main' into copilot/update-compile-command-args

6d04b63

github-actions bot added the ai-inspected label Mar 23, 2026

pelikhan marked this pull request as ready for review March 23, 2026 14:26

Copilot AI review requested due to automatic review settings March 23, 2026 14:26

Copilot started reviewing on behalf of pelikhan March 23, 2026 14:26 View session

pelikhan merged commit 175fad8 into main Mar 23, 2026
111 checks passed

pelikhan deleted the copilot/update-compile-command-args branch March 23, 2026 14:27

Copilot AI reviewed Mar 23, 2026

View reviewed changes

This was referenced Mar 23, 2026

Smoke Test: Copilot - 23445475694 #22447

Closed

Update APM (Agent Package Manager) to v0.8.4 #22444

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(compile): add --actions-repo flag to override external actions repository#22437

feat(compile): add --actions-repo flag to override external actions repository#22437
pelikhan merged 4 commits intomainfrom
copilot/update-compile-command-args

Copilot AI commented Mar 23, 2026 •

edited

Loading

Uh oh!

pelikhan commented Mar 23, 2026

Uh oh!

johnwilliams-12 commented Mar 23, 2026

Uh oh!

Copilot AI commented Mar 23, 2026 •

edited

Loading

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

pelikhan commented Mar 23, 2026

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Mar 23, 2026

Uh oh!

Copilot AI Mar 23, 2026

Uh oh!

Copilot AI Mar 23, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

	compileCmd.Flags().String("action-tag", "", "Override action SHA or tag for actions/setup (overrides action-mode to release). Accepts full SHA or tag name")
	compileCmd.Flags().String("action-tag", "", "Override action SHA or tag for actions/setup. When set without --action-mode, defaults action-mode to release. Accepts full SHA or tag name")

	ActionTag string // Override action SHA or tag for actions/setup (overrides action-mode to release)
	ActionTag string // Override action SHA or tag for actions/setup (forces release mode unless action-mode is explicitly set to 'action')

Conversation

Copilot AI commented Mar 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Motivation

Changes

Usage

Security Summary

Uh oh!

pelikhan commented Mar 23, 2026

Uh oh!

johnwilliams-12 commented Mar 23, 2026

Uh oh!

Copilot AI commented Mar 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

pelikhan commented Mar 23, 2026

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Copilot AI commented Mar 23, 2026 •

edited

Loading

Copilot AI commented Mar 23, 2026 •

edited

Loading