fix: always emit CLI_PROXY_POLICY env var for CLI proxy#25419
Conversation
…policy configured
The DIFC proxy requires a --policy flag to forward requests. Without it,
all API calls return HTTP 503 with body "proxy enforcement not configured".
When no guard policy is explicitly configured in the workflow frontmatter,
the CLI proxy step now emits a default permissive policy:
{"allow-only":{"repos":"all","min-integrity":"none"}}
This ensures the CLI proxy always has a policy to forward requests,
matching the behavior expected by the DIFC proxy (mcpg in proxy mode).
Fixes #25373
Agent-Logs-Url: https://github.com/github/gh-aw/sessions/2a1ff7ff-3323-425d-beb4-ab745e5fe0d1
Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
There was a problem hiding this comment.
Pull request overview
Ensures the CLI proxy always receives a --policy (via CLI_PROXY_POLICY) so DIFC proxy forwarding doesn’t fail with silent HTTP 503s when no guard policy is configured.
Changes:
- Added a default permissive CLI proxy policy fallback and always emit
CLI_PROXY_POLICYin the generated step env. - Added unit tests for
buildStartCliProxyStepYAMLcovering default fallback, nil github tool, explicit policy, and step structure.
Show a summary per file
| File | Description |
|---|---|
| pkg/workflow/compiler_difc_proxy.go | Adds a default CLI proxy policy and unconditionally emits CLI_PROXY_POLICY. |
| pkg/workflow/compiler_difc_proxy_test.go | Adds coverage for CLI proxy step YAML generation and policy emission. |
Copilot's findings
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comments suppressed due to low confidence (2)
pkg/workflow/compiler_difc_proxy_test.go:727
- This subtest also asserts for escaped JSON content (
\"min-integrity\":\"none\"). If the default policy is corrected to valid JSON, update these assertions to match unescaped JSON so the test validates the real--policyinput the proxy will parse.
result := c.buildStartCliProxyStepYAML(data)
require.NotEmpty(t, result, "should emit CLI proxy step even without github tool")
assert.Contains(t, result, "CLI_PROXY_POLICY", "should always emit CLI_PROXY_POLICY")
assert.Contains(t, result, `"min-integrity":"none"`, "should use default min-integrity")
})
pkg/workflow/compiler_difc_proxy_test.go:744
- These assertions check for escaped JSON fragments (e.g.
\"repos\":\"owner/*\"). The configured-policy path usesjson.Marshaloutput fromgetDIFCProxyPolicyJSON, which should be unescaped JSON. Adjust the expected substrings to reflect the actual JSON that will be passed to--policy(no extra backslashes).
result := c.buildStartCliProxyStepYAML(data)
require.NotEmpty(t, result, "should emit CLI proxy step")
assert.Contains(t, result, "CLI_PROXY_POLICY", "should emit CLI_PROXY_POLICY")
assert.Contains(t, result, `"min-integrity":"approved"`, "should use configured min-integrity")
assert.Contains(t, result, `"repos":"owner/*"`, "should use configured repos")
})
- Files reviewed: 2/2 changed files
- Comments generated: 2
| // defaultCliProxyPolicyJSON is the fallback guard policy for the CLI proxy when no | ||
| // guard policy is explicitly configured in the workflow frontmatter. | ||
| // The DIFC proxy requires a --policy flag to forward requests; without it, all API | ||
| // calls return HTTP 503 with body "proxy enforcement not configured". | ||
| // This default allows all repos with no integrity filtering — the most permissive | ||
| // policy that still satisfies the proxy's requirement. | ||
| const defaultCliProxyPolicyJSON = `{"allow-only":{"repos":"all","min-integrity":"none"}}` |
There was a problem hiding this comment.
defaultCliProxyPolicyJSON is defined with backslash-escaped quotes inside a raw string literal, producing {\"allow-only\":...} at runtime. That string is not valid JSON and will be passed verbatim to start_cli_proxy.sh → --policy, likely causing the proxy to reject the policy. Define the constant as actual JSON (no backslashes) or build it via json.Marshal to match the format returned by getDIFCProxyPolicyJSON and the PR description example.
| result := c.buildStartCliProxyStepYAML(data) | ||
| require.NotEmpty(t, result, "should emit CLI proxy step even without guard policy") | ||
| assert.Contains(t, result, "CLI_PROXY_POLICY", "should always emit CLI_PROXY_POLICY") | ||
| assert.Contains(t, result, `"allow-only"`, "default policy should contain allow-only") | ||
| assert.Contains(t, result, `"repos":"all"`, "default policy should allow all repos") | ||
| assert.Contains(t, result, `"min-integrity":"none"`, "default policy should have min-integrity none") | ||
| }) |
There was a problem hiding this comment.
These assertions expect the default policy to contain backslash-escaped quotes (e.g. \"allow-only\"). If defaultCliProxyPolicyJSON is corrected to valid JSON (no extra backslashes), this test should be updated to assert for normal JSON fragments (e.g. "allow-only", "repos":"all", "min-integrity":"none"). As written, the test will keep passing even if the emitted policy is not valid JSON for the proxy.
This issue also appears in the following locations of the same file:
- line 723
- line 739
|
@copilot apply changes based on the comments in this thread |
The reviewer's comments are a false positive — the constant Verified by parsing the constant with |
The DIFC proxy requires a
--policyflag to forward requests. Without it, all API calls silently return HTTP 503 ("proxy enforcement not configured"). The compiler was only emittingCLI_PROXY_POLICYwhen guard policies were explicitly configured in frontmatter, leaving it absent otherwise.Changes
compiler_difc_proxy.go: When no guard policy is configured, fall back to a default permissive policy ({"allow-only":{"repos":"all","min-integrity":"none"}}).CLI_PROXY_POLICYis now always emitted in the step env block.compiler_difc_proxy_test.go: AddedTestBuildStartCliProxyStepYAMLcovering default fallback, nil tool, explicit policy, and step structure.Before/After
Warning
Firewall rules blocked me from connecting to one or more addresses (expand for details)
I tried to connect to the following addresses, but was blocked by firewall rules:
https://api.github.com/graphql/usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw -trimpath(http block)/usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw gh /usr/bin/git go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)/usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw /opt/hostedtoolc-c /usr/bin/git go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)https://api.github.com/orgs/test-owner/actions/secrets/usr/bin/gh gh api /orgs/test-owner/actions/secrets --jq .secrets[].name /tmp/go-build192-p -trimpath 64/bin/go -p github.com/githu-o -lang=go1.25 go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)https://api.github.com/repos/actions/ai-inference/git/ref/tags/v1/usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq .object.sha --show-toplevel 64/pkg/tool/linuTest User /usr/bin/git 3869105354 bBouUBHdz ache/go/1.25.8/x--show-toplevel git rev-�� --show-toplevel ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile /usr/bin/git ortcfg DK7hiKCNC ache/go/1.25.8/x--show-toplevel git(http block)https://api.github.com/repos/actions/checkout/git/ref/tags/v3/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq .object.sha /tmp/gh-aw-test-runs/20260409-034956-32363/test-959812306/.github/workflows config om/myorg/myrepo.git remote.origin.urgit GO111MODULE 64/bin/go git remo�� GOMODCACHE go ache/node/24.14.1/x64/bin/node -json GO111MODULE x_amd64/asm /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/vet(http block)https://api.github.com/repos/actions/checkout/git/ref/tags/v5/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha efaultBranchFromLsRemoteWithRealGitmaster_branchremote.origin.url efaultBranchFromLsRemoteWithRealGitmaster_branch4187807580/001' x_amd64/compile GOINSECURE ntio/asm/internaremote GOMODCACHE x_amd64/compile env Onlymin-integrity_with_repos=public_4103483966/0remote.origin.url GO111MODULE ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet GOINSECURE contextprotocol/rev-parse GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet(http block)/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha --show-toplevel ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile /usr/bin/git 3795379/b050/_pkgit om/modelcontextprev-parse ache/go/1.25.8/x--show-toplevel git rev-�� --show-toplevel ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile /usr/bin/git 3795379/b231/_pkgit qrnP/bIu9B-2Kyy2rev-parse ser.test git(http block)/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha --show-toplevel ipts.test /usr/bin/git --get l /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git GOMODCACHE go ache/node/24.14.--show-toplevel git(http block)https://api.github.com/repos/actions/checkout/git/ref/tags/v6/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha --show-toplevel 64/pkg/tool/linux_amd64/compile /usr/bin/git g_.a rotocol/go-sdk@vrev-parse 64/pkg/tool/linu--show-toplevel /usr/bin/git conf�� --get-regexp ^remote\..*\.gh-resolved$ /usr/bin/git g_.a i0dFibft1 At,event,headBra--show-toplevel git(http block)/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha --show-toplevel x_amd64/compile /usr/bin/git -json GO111MODULE 64/pkg/tool/linu--show-toplevel git rev-�� --show-toplevel 64/pkg/tool/linux_amd64/compile /usr/bin/git g_.a GO111MODULE 64/pkg/tool/linu--show-toplevel git(http block)/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha --show-toplevel git /usr/bin/git /tmp/gh-aw-test-git remote ache/node/24.14.--show-toplevel git rev-�� --show-toplevel git /usr/bin/git sistency_KeyOrdegit t /usr/bin/git git(http block)https://api.github.com/repos/actions/github-script/git/ref/tags/v8/usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha go1.25.8 -c=4 -nolocalimports -importcfg /tmp/go-build3553795379/b253/importcfg -pack /home/REDACTED/work/gh-aw/gh-aw/pkg/semverutil/semverutil.go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)/usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile(http block)/usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha latted/flatted.go GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile(http block)https://api.github.com/repos/actions/setup-go/git/ref/tags/v4/usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq .object.sha --show-toplevel 64/pkg/tool/linux_amd64/compile /usr/bin/gh LsRemoteWithRealgit LsRemoteWithRealrev-parse 64/pkg/tool/linu--show-toplevel gh secr�� list --json /usr/bin/git y_with_repos_arrgit GO111MODULE 64/pkg/tool/linu--show-toplevel git(http block)https://api.github.com/repos/actions/setup-node/git/ref/tags/v4/usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq .object.sha GOMODCACHE 64/pkg/tool/linux_amd64/compile /usr/bin/git itcustom_branch2git itcustom_branch2rev-parse 64/pkg/tool/linu--show-toplevel /usr/bin/git conf�� --get-regexp ^remote\..*\.gh-resolved$ /usr/bin/git y_with_repos_arrgit LvhFNvMoO 64/pkg/tool/linu--show-toplevel git(http block)https://api.github.com/repos/actions/upload-artifact/git/ref/tags/v4/usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq .object.sha /tmp/go-build1982712670/b425/_pkg_.a l 1/x64/bin/node -p github.com/githurev-parse -lang=go1.25 1/x64/bin/node -C /tmp/TestGuardPolicyMinIntegrityOnlymin-integrity_with_repos=public_4103483966/001 rev-parse /usr/bin/git -c=4 -nolocalimports -importcfg git(http block)https://api.github.com/repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b/usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq .object.sha ath ../../../.pr**/*.json GO111MODULE $name) { hasDiscussionsEnabled } } GOINSECURE GOMOD GOMODCACHE go env re GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)/usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq .object.sha ath ../../../.pr**/*.json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env re GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)https://api.github.com/repos/github/gh-aw/usr/bin/gh gh api /repos/github/gh-aw --jq .visibility -json GO111MODULE tions/setup/js/n-f GOINSECURE GOMOD GOMODCACHE go env iew.lock.yml GO111MODULE r: $owner, name: $name) { hasDiscussionsEnabled } } GOINSECURE GOMOD GOMODCACHE go(http block)https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v0.1.2/usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0.1.2 --jq .object.sha --show-toplevel 64/pkg/tool/linuremote /usr/bin/git g_.a t.go 64/pkg/tool/linu--show-toplevel /usr/bin/git conf�� --get-regexp ^remote\..*\.gh-resolved$ /usr/bin/git g_.a 4GDF0MOYT 64/pkg/tool/linu--show-toplevel git(http block)https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.0.0/usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq .object.sha git-upload-pack '/tmp/TestParseDefaultBranchFromLsRemoteWithRealGitcustom_branch2634493738/001' git-upload-pack '/tmp/TestParseDefaultBranchFromLsRemoteWithRealGitcustom_branch2634493738/001' /usr/bin/git /tmp/go-build192git -trimpath 64/bin/go git rev-�� --show-toplevel cB-MrgPZhxrn clusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle -json 90 64/bin/go git(http block)https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.2.3/usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq .object.sha run l 1/x64/bin/node --detach -c=4 -nolocalimports 1/x64/bin/node -C /tmp/TestGuardPolicyBlockedUsersApprovalLabelsCompiledOutput3683948796/001 remote /usr/bin/git -json GO111MODULE 64/bin/go git(http block)https://api.github.com/repos/github/gh-aw/actions/runs/1/artifacts/usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/1/artifacts --jq .artifacts[].name 5.0/internal/doc.go 64/pkg/tool/linux_amd64/compile GOINSECURE 64 abis 64/pkg/tool/linux_amd64/compile env 1482495041 ortcfg ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile(http block)/usr/bin/gh gh run download 1 --dir test-logs/run-1 NgK5Xenpy ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env ortcfg vohS5K4mu ache/go/1.25.8/x64/pkg/tool/linu-buildmode=exe GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linu-trimpath(http block)https://api.github.com/repos/github/gh-aw/actions/runs/12345/artifacts/usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12345/artifacts --jq .artifacts[].name ZW5eqtFbR 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile env g_.a k1Ubnk-ff ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile GOINSECURE til GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile(http block)/usr/bin/gh gh run download 12345 --dir test-logs/run-12345 GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD abis 64/pkg/tool/linutest@example.com env g_.a sYAOo28ie ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile GOINSECURE g GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linu-test.v=true(http block)https://api.github.com/repos/github/gh-aw/actions/runs/12346/artifacts/usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12346/artifacts --jq .artifacts[].name l.go 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile env g_.a 34i--fWCy x_amd64/link GOINSECURE GOMOD GOMODCACHE x_amd64/link(http block)/usr/bin/gh gh run download 12346 --dir test-logs/run-12346 0/internal/number/common.go 64/pkg/tool/linux_amd64/compile GOINSECURE mic_wasm.o 64/src/internal/--show-toplevel 64/pkg/tool/linux_amd64/compile env g_.a cuiX4cYAj ache/go/1.25.8/x64/pkg/tool/linux_amd64/asm GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linu-importcfg(http block)https://api.github.com/repos/github/gh-aw/actions/runs/2/artifacts/usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/2/artifacts --jq .artifacts[].name 4LOc7tzcC 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linuTest User env g_.a 64jHUho52 ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linurev-parse(http block)/usr/bin/gh gh run download 2 --dir test-logs/run-2 kVjpTbR-V 64/pkg/tool/linux_amd64/cgo GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linu/tmp/go-build1982712670/b115/vet.cfg env gk88dzu3u GO111MODULE ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linu--jq(http block)https://api.github.com/repos/github/gh-aw/actions/runs/3/artifacts/usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/3/artifacts --jq .artifacts[].name 5.0/deviceauth.go 64/pkg/tool/linux_amd64/compile GOINSECURE(http block)/usr/bin/gh gh run download 3 --dir test-logs/run-3 S1XHWmzm6 64/pkg/tool/linux_amd64/compile GOINSECURE(http block)https://api.github.com/repos/github/gh-aw/actions/runs/4/artifacts/usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/4/artifacts --jq .artifacts[].name GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE tants abis 64/pkg/tool/linux_amd64/compile env 1482495041 GO111MODULE ck GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linuremote(http block)/usr/bin/gh gh run download 4 --dir test-logs/run-4 sYYP-7R33 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet env bDdQ2fq9m GO111MODULE ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linu-test.v=true(http block)https://api.github.com/repos/github/gh-aw/actions/runs/5/artifacts/usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/5/artifacts --jq .artifacts[].name rotocol/go-sdk@v1.5.0/oauthex/auth_meta.go x_amd64/link GOINSECURE GOMOD GOMODCACHE x_amd64/link env g_.a GO111MODULE ache/go/1.25.8/x64/pkg/tool/linu-nilfunc GOINSECURE go-sdk/auth GOMODCACHE CD/h9neZu1_uB1iv8Yv17kB/LeWZmHFF/tmp/file-tracker-test2663463120/test2.lock.yml(http block)/usr/bin/gh gh run download 5 --dir test-logs/run-5 h1Ee82J5b 64/pkg/tool/linu-importcfg GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linuTest User env IIAr-WTp5 GO111MODULE ache/go/1.25.8/x64/pkg/tool/linu-nilfunc GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linu-tests(http block)https://api.github.com/repos/github/gh-aw/actions/workflows/usr/bin/gh gh workflow list --json name,state,path -c=4 -nolocalimports -importcfg /tmp/go-build1982712670/b414/importcfg -pack /home/REDACTED/work/gh-aw/gh-aw/pkg/gitutil/gitutil.go /home/REDACTED/work/gh-aw/gh-aw/pkg/gitutil/gitutil_test.go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)/usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 100 GOMOD GOMODCACHE x_amd64/compile env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile(http block)/usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 6 GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile env rity3742639165/001 hOYFQ3cxW sole.test GOINSECURE rm GOMODCACHE sole.test(http block)https://api.github.com/repos/github/gh-aw/git/ref/tags/v0.47.4/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v0.47.4 --jq .object.sha --show-toplevel ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile /usr/bin/git 3795379/b255/_pkgit zBGz/yhMlvprrXT_rev-parse ache/go/1.25.8/x--show-toplevel git rev-�� --show-toplevel ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile /usr/bin/git 2712670/b417/_pkgit -trimpath 2712670/b417=> git(http block)https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.0.0/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq .object.sha b/workflows xpQFH7LFx /opt/hostedtoolcache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env ortcfg EocudEgAi ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x^remote\..*\.gh-resolved$(http block)https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.2.3/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq .object.sha -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json x86.go x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile(http block)https://api.github.com/repos/github/gh-aw/git/ref/tags/v2.0.0/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq .object.sha -json GO111MODULE x_amd64/asm GOINSECURE GOMOD GOMODCACHE x_amd64/asm env -json cii.go x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile(http block)/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq .object.sha sm-opt -Oz (size optimization)..."; \ BEFORE=$(wc -c < gh-aw.wasm); \ wasm-opt -Oz --enable-bugit GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env 187807580/001 187807580/002/work x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile(http block)/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq .object.sha -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile(http block)https://api.github.com/repos/github/gh-aw/git/ref/tags/v3.0.0/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq .object.sha -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env Gitmain_branch25--repo Gitmain_branch25owner/repo x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile(http block)https://api.github.com/repos/githubnext/agentics/git/ref/tags/-/usr/bin/gh gh api /repos/githubnext/agentics/git/ref/tags/- --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)https://api.github.com/repos/nonexistent/action/git/ref/tags/v999.999.999/usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq .object.sha g_.a kLZAPaMu6 /opt/hostedtoolcache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env ortcfg gmGb0FnMM ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile GOINSECURE %H %ct %D(http block)https://api.github.com/repos/nonexistent/repo/actions/runs/12345/usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion GOINSECURE _wasm.o 64/src/runtime/s--show-toplevel 64/pkg/tool/linux_amd64/vet env -json Q8gElMZ6A ache/go/1.25.8/x64/pkg/tool/linux_amd64/asm GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linuTest User(http block)https://api.github.com/repos/owner/repo/actions/workflows/usr/bin/gh gh workflow list --json name,state,path --repo owner/repo 64/bin/go -p main -lang=go1.25 go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)/usr/bin/gh gh workflow list --json name,state,path --repo owner/repo 64/bin/go npx prettier --w/opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/compile x_amd64/vet 64/bin/go go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)https://api.github.com/repos/owner/repo/contents/file.md/tmp/go-build1982712670/b397/cli.test /tmp/go-build1982712670/b397/cli.test -test.testlogfile=/tmp/go-build1982712670/b397/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true -nolocalimports -importcfg /tmp/go-build3553795379/b212/importcfg -pack -o /tmp/go-build192-p -trimpath 64/bin/go -p main -lang=go1.25 go(http block)https://api.github.com/repos/test-owner/test-repo/actions/secrets/usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name /tmp/go-build192-p -trimpath 64/bin/go -p main -lang=go1.25 go env -json d.go 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)If you need me to access, download, or install something from one of these locations, you can either: