feat: repo-level config via .github/workflows/aw.json by Copilot · Pull Request #25227 · github/gh-aw

Copilot · 2026-04-08T01:39:19Z

Adds an optional .github/workflows/aw.json file for repository-level agentic workflow settings, starting with control over the agentics-maintenance.yml runner.

Schema & Loading

New JSON schema at pkg/parser/schemas/repo_config_schema.json (embedded, validated on load)
Schema enforces a safe pattern on runs_on values, blocking control characters and newlines
pkg/workflow/repo_config.go — loads, validates against schema, and deserialises into typed structs using JSON struct tags and json.Unmarshal
RunsOnValue implements json.Unmarshaler, accepting either a JSON string or array of strings
File is optional; absence returns safe defaults

Supported Configuration

Custom runner (string or array):

{
  "maintenance": {
    "runs_on": "my-custom-runner"
  }
}

{
  "maintenance": {
    "runs_on": ["self-hosted", "linux"]
  }
}

Disable maintenance entirely (workflows using expires will emit a warning):

{
  "maintenance": false
}

Wiring

All hardcoded runs-on: ubuntu-slim in maintenance_workflow.go replaced with the configured value (defaulting to ubuntu-slim)
Multi-label runs-on values are serialised using json.Marshal to prevent YAML injection from special characters in runner labels
GenerateMaintenanceWorkflow accepts a new *RepoConfig parameter; nil preserves existing behaviour
Config loaded in compile_post_processing.go and init.go before maintenance workflow generation
maintenance: false deletes any existing agentics-maintenance.yml and skips generation; any workflow that uses expires while maintenance is disabled receives a console warning

…ble support Agent-Logs-Url: https://github.com/github/gh-aw/sessions/e335a457-98e7-4995-9f16-5dc33e8cf528 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

…lation Agent-Logs-Url: https://github.com/github/gh-aw/sessions/e335a457-98e7-4995-9f16-5dc33e8cf528 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

pelikhan · 2026-04-08T02:06:46Z

pkg/workflow/repo_config.go

+const RepoConfigFileName = ".github/workflows/aw.json"
+
+// MaintenanceConfig holds maintenance-workflow-specific settings from aw.json.
+type MaintenanceConfig struct {


@copilot use json annotation and automatic deserilization

Done in 01a7982. The manual map[string]any parsing has been replaced with:

RunsOnValue []string — implements json.Unmarshaler, accepting either a JSON string ("ubuntu-latest") or array (["self-hosted", "linux"]) and normalising to []string

MaintenanceConfig — uses json:"runs_on,omitempty" struct tag for automatic deserialization

RepoConfig.UnmarshalJSON — handles the polymorphic maintenance field (boolean false vs object) using json.RawMessage then standard json.Unmarshal

The old parseRepoConfig and normaliseRunsOn helper functions have been removed.

… config Agent-Logs-Url: https://github.com/github/gh-aw/sessions/5655385a-f073-4c0b-bc78-3712627ebc18 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-04-08T02:16:33Z

Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

https://api.github.com/repos/github/gh-aw/git/ref/tags/v0.47.4
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v0.47.4 --jq .object.sha (http block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Copilot

Pull request overview

Adds optional repository-level configuration via .github/workflows/aw.json, enabling customization (or disabling) of the generated agentics-maintenance.yml workflow—primarily controlling the runs-on runner labels.

Changes:

Introduces a repo config loader (LoadRepoConfig) with JSON Schema validation and typed parsing (including polymorphic maintenance handling and runs_on as string-or-array).
Wires repo config into maintenance workflow generation to support custom runs-on values and an explicit maintenance: false opt-out (deletes existing maintenance workflow and skips generation).
Adds schema embedding/compilation support and updates CLI compile/init paths to load and apply the config; expands tests accordingly.

Show a summary per file

File	Description
pkg/workflow/repo_config.go	Implements loading/validation/parsing of `.github/workflows/aw.json`, plus `runs_on` formatting helper.
pkg/workflow/repo_config_test.go	Adds unit tests for repo config loading, schema enforcement, and runs-on formatting.
pkg/workflow/maintenance_workflow.go	Applies repo config to maintenance workflow generation (custom runner / disable behavior).
pkg/workflow/maintenance_workflow_test.go	Updates existing tests for new function signature and adds repo-config-specific coverage.
pkg/parser/schemas/repo_config_schema.json	Defines JSON Schema for `aw.json` with strict properties and polymorphic `maintenance`.
pkg/parser/schema_compiler.go	Embeds and caches compiled repo config schema.
pkg/cli/init.go	Loads repo config during init and passes it into maintenance workflow generation.
pkg/cli/compile_post_processing.go	Loads repo config during compile post-processing (strict/non-strict behavior) and passes it through.
pkg/cli/compile_pipeline.go	Updates post-processing call to provide `gitRoot` for config loading.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 9/9 changed files
Comments generated: 2

Copilot · 2026-04-08T02:38:49Z

pkg/workflow/repo_config.go

+func FormatRunsOn(runsOn RunsOnValue, defaultRunsOn string) string {
+	if len(runsOn) == 0 {
+		return defaultRunsOn
+	}
+	if len(runsOn) == 1 {
+		if runsOn[0] == "" {
+			return defaultRunsOn
+		}
+		return runsOn[0]
+	}
+	// Multiple labels → inline YAML sequence notation: ["a", "b", "c"]
+	var sb strings.Builder
+	sb.WriteString("[")
+	for i, s := range runsOn {
+		if i > 0 {
+			sb.WriteString(", ")
+		}
+		sb.WriteString(`"`)
+		sb.WriteString(s)
+		sb.WriteString(`"`)
+	}
+	sb.WriteString("]")
+	return sb.String()


FormatRunsOn builds an inline YAML value via string concatenation without escaping. Because runner labels come from aw.json and the schema currently allows arbitrary strings, a value containing quotes, backslashes, or newlines can produce invalid YAML (and in the worst case allow YAML injection into the generated workflow). Consider generating the scalar/sequence using a proper encoder (e.g., json.Marshal for a YAML-compatible JSON inline scalar/array) and/or tightening the schema with a safe pattern that disallows control characters/newlines.

Copilot · 2026-04-08T02:38:49Z

pkg/workflow/maintenance_workflow.go

+	// Respect explicit opt-out from aw.json: maintenance: false
+	if repoConfig != nil && repoConfig.MaintenanceDisabled {
+		maintenanceLog.Print("Maintenance disabled via repo config, skipping generation")
+		maintenanceFile := filepath.Join(workflowDir, "agentics-maintenance.yml")
+		if _, err := os.Stat(maintenanceFile); err == nil {
+			maintenanceLog.Printf("Deleting existing maintenance workflow: %s", maintenanceFile)
+			if err := os.Remove(maintenanceFile); err != nil {
+				return fmt.Errorf("failed to delete maintenance workflow: %w", err)
+			}
+		}
+		return nil
+	}


When repoConfig.MaintenanceDisabled is true, the function returns early even if workflows contain expires configs. That means expires will silently stop working (no maintenance workflow will run) which conflicts with the PR description’s claim that dependent features are “suppressed/refused”. Either update the behavior to emit an error/warning (especially in strict mode) when expires is present while maintenance is disabled, or adjust the description/docs to reflect that expires becomes a no-op.

pelikhan · 2026-04-08T04:26:14Z

@copilot review coments

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/6d73cb81-4867-4f96-9f5b-01658cdd70b2 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-04-08T04:35:50Z

@copilot review coments

Addressed both review comments in b3b9f36:

YAML injection in FormatRunsOn — For multi-label arrays, now uses json.Marshal([]string{...}) which properly escapes quotes, backslashes, and other special characters. The schema also gained a pattern constraint on runs_on string/array items that blocks control characters and newlines at input time, providing defence-in-depth.
Silent expires no-op when maintenance disabled — Before returning early when maintenance: false, the function now iterates workflows and emits a console.FormatWarningMessage for any workflow that has expires configured, making the behaviour explicit rather than silent.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

https://api.github.com/repos/github/gh-aw/git/ref/tags/v0.47.4
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v0.47.4 --jq .object.sha (http block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Copilot AI and others added 2 commits April 8, 2026 00:48

feat: add aw.json repo-level config with maintenance runs_on and disa…

e374c30

…ble support Agent-Logs-Url: https://github.com/github/gh-aw/sessions/e335a457-98e7-4995-9f16-5dc33e8cf528 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

refactor: address code review - fix typo and improve test fixture iso…

e965c00

…lation Agent-Logs-Url: https://github.com/github/gh-aw/sessions/e335a457-98e7-4995-9f16-5dc33e8cf528 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI assigned Copilot and pelikhan Apr 8, 2026

Copilot created this pull request from a session on behalf of pelikhan April 8, 2026 01:39 View session

Merge branch 'main' into copilot/add-support-for-aw-json-config

81218f5

pelikhan reviewed Apr 8, 2026

View reviewed changes

Copilot started work on behalf of pelikhan April 8, 2026 02:06 View session

refactor: use JSON struct tags and automatic deserialization for repo…

01a7982

… config Agent-Logs-Url: https://github.com/github/gh-aw/sessions/5655385a-f073-4c0b-bc78-3712627ebc18 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan April 8, 2026 02:16

Copilot AI requested a review from pelikhan April 8, 2026 02:16

pelikhan marked this pull request as ready for review April 8, 2026 02:34

Copilot AI review requested due to automatic review settings April 8, 2026 02:34

Copilot started reviewing on behalf of pelikhan April 8, 2026 02:34 View session

Copilot AI reviewed Apr 8, 2026

View reviewed changes

g66b166-hub mentioned this pull request Apr 8, 2026

Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details. #25229

Closed

Copilot started work on behalf of pelikhan April 8, 2026 04:26 View session

fix: YAML injection safety and expires warning when maintenance disabled

b3b9f36

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/6d73cb81-4867-4f96-9f5b-01658cdd70b2 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan April 8, 2026 04:36

pelikhan merged commit be553e3 into main Apr 8, 2026
85 checks passed

pelikhan deleted the copilot/add-support-for-aw-json-config branch April 8, 2026 04:46

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: repo-level config via .github/workflows/aw.json#25227

feat: repo-level config via .github/workflows/aw.json#25227
pelikhan merged 5 commits intomainfrom
copilot/add-support-for-aw-json-config

Copilot AI commented Apr 8, 2026 •

edited

Loading

Uh oh!

pelikhan Apr 8, 2026

Uh oh!

Copilot AI Apr 8, 2026

Uh oh!

Copilot AI commented Apr 8, 2026

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Apr 8, 2026

Uh oh!

Copilot AI Apr 8, 2026

Uh oh!

pelikhan commented Apr 8, 2026

Uh oh!

Copilot AI commented Apr 8, 2026 •

edited

Loading

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

Copilot AI commented Apr 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Schema & Loading

Supported Configuration

Wiring

Uh oh!

pelikhan Apr 8, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 8, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI commented Apr 8, 2026

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Copilot's findings

Uh oh!

Copilot AI Apr 8, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 8, 2026

Choose a reason for hiding this comment

Uh oh!

pelikhan commented Apr 8, 2026

Uh oh!

Copilot AI commented Apr 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Apr 8, 2026 •

edited

Loading

Copilot AI commented Apr 8, 2026 •

edited

Loading