fix: harden AWF binary install against GitHub releases CDN 502s by Copilot · Pull Request #28533 · github/gh-aw

Copilot · 2026-04-26T01:27:01Z

Intermittent HTTP 502s from the GitHub releases CDN during gh-aw-firewall binary downloads were failing both agent and detection jobs with no recovery path. The current retry window (5×10s ≈ 60s) is shorter than observed CDN outages.

Changes

`install_awf_binary.sh` — resilience improvements

Increased retry budget: --retry 5 --retry-delay 10 --retry-max-time 180 → --retry 6 --retry-delay 15 --retry-max-time 300 on all curl calls
Cross-run binary cache via new AWF_CACHE_DIR/AWF_CACHE_HIT env vars:
- Exact cache hit → install from cache dir, zero CDN calls
- Download failure + stale binary in cache → warn and use stale version instead of failing
- Successful download → copy binary to cache dir for subsequent runs

Go compiler — emit cache steps around AWF install

generateAWFInstallationStep → generateAWFInstallationSteps now emits two steps:

- name: Restore AWF binary from cache
  id: awf-cache
  uses: actions/cache@...
  with:
    key: awf-binary-${{ runner.os }}-${{ runner.arch }}-v0.25.28
    path: /tmp/gh-aw/awf-binary-cache
    restore-keys: |
      awf-binary-${{ runner.os }}-${{ runner.arch }}-   # stale-version fallback

- name: Install AWF binary
  env:
    AWF_CACHE_DIR: /tmp/gh-aw/awf-binary-cache
    AWF_CACHE_HIT: ${{ steps.awf-cache.outputs.cache-hit }}
  run: bash "${RUNNER_TEMP}/gh-aw/actions/install_awf_binary.sh" v0.25.28

The restore-keys prefix match allows actions/cache to restore any previously cached AWF version as a stale fallback, which the shell script then uses if a live download fails.

All 202 compiled lock files regenerated. Tests and Wasm golden files updated to reflect the new 2-step pattern.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

https://api.github.com/graphql
- Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw GOMOD GOMODCACHE node /opt�� prettier --check 64/bin/go **/*.ts **/*.json --ignore-path git (http block)
- Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw GOMOD GOMODCACHE sh -c "prettier" --cheGOINSECURE GOPROXY 64/bin/go GOSUMDB GOWORK 64/bin/go /opt/hostedtoolcGO111MODULE (http block)
- Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw GOMOD GOMODCACHE 1757413/b389/impGO111MODULE -c 1757413/b389/embGOINSECURE GOPROXY 64/bin/go GOSUMDB GOWORK 64/bin/go /opt/hostedtoolcGO111MODULE (http block)
https://api.github.com/orgs/test-owner/actions/secrets
- Triggering command: /usr/bin/gh gh api /orgs/test-owner/actions/secrets --jq .secrets[].name -json GO111MODULE repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } GOINSECURE GOMOD GOMODCACHE go env k/gh-aw/gh-aw/.github/workflows GO111MODULE me: String!) { repository(owner: $owner, name:-f l GOMOD GOMODCACHE go (http block)
https://api.github.com/repos/actions/ai-inference/git/ref/tags/v1
- Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq [.object.sha, .object.type] | @tsv /tmp/TestCollectWorkflowFiles_SimpleWorkflow3278534175/001 rev-parse /usr/bin/git plorer.md rev-parse eutil.test git rev-�� --show-toplevel eutil.test /usr/bin/git /home/REDACTED/wornode rev-parse 2475421/b001/worinstall git (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/git --show-toplevel git /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel /opt/hostedtoolc/opt/hostedtoolcache/node/24.14.1/x64/bin/npm /usr/bin/git git (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq [.object.sha, .object.type] | @tsv /usr/bin/git git /usr/bin/git --show-toplevel nly /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel git e/git git (http block)
https://api.github.com/repos/actions/checkout/git/ref/tags/v3
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq [.object.sha, .object.type] | @tsv ed } } go /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/vet k/gh-aw/gh-aw/.ggit GO111MODULE x_amd64/vet /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/vet -ato�� -bool -buildtags (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/git --show-toplevel ache/go/1.25.8/xrev-parse /usr/bin/git git rev-�� --show-toplevel git .cfg --show-toplevel e/git /usr/bin/git git (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq [.object.sha, .object.type] | @tsv --show-toplevel git nfig/composer/vendor/bin/bash --show-toplevel git /usr/bin/git git rev-�� --show-toplevel git cfg --show-toplevel x_amd64/vet /usr/bin/git git (http block)
https://api.github.com/repos/actions/checkout/git/ref/tags/v5
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq [.object.sha, .object.type] | @tsv /home/REDACTED/work/gh-aw/gh-aw/.github/workflows config ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet remote.origin.urinfocmp GO111MODULE 64/bin/go ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet -C agentic-observability-kit.md rev-parse 1/x64/bin/node -json GO111MODULE r: $owner, name:--show-toplevel git (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq [.object.sha, .object.type] | @tsv --show-toplevel ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile /usr/bin/git efaultBranchFromtr efaultBranchFrom\n ache/uv/0.11.7/x: git rev-�� --show-toplevel git /usr/bin/git CompiledOutput19git rev-parse 64/pkg/tool/linu--show-toplevel git (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/git oRAb/yYxzhiyRkBQgit (http block)
https://api.github.com/repos/actions/checkout/git/ref/tags/v6
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv /tmp/TestGuardPolicyBlockedUsersApprovalLabelsCononexistent/repo rev-parse /usr/bin/git -json GO111MODULE er: String!, $na--show-toplevel git -C tagedFiles2855675441/001/workflow.md rev-parse ache/node/24.14.1/x64/bin/node ithub/workflows GO111MODULE kflows/code-simp--show-toplevel git (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/git ref/tags/v1.2.3 ortcfg sv git rev-�� --show-toplevel git /usr/bin/git --show-toplevel ache/go/1.25.8/xrev-parse /usr/sbin/iptabl--show-toplevel git (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/git --show-toplevel git /usr/bin/git git rev-�� --show-toplevel git ache/node/24.14.1/x64/bin/bash --show-toplevel git /usr/bin/git git (http block)
https://api.github.com/repos/actions/github-script/git/ref/tags/v8
- Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq [.object.sha, .object.type] | @tsv --show-toplevel ser.test /usr/bin/git /home/REDACTED/worbash config /opt/hostedtoolcnew (upstream) git rev-�� --show-toplevel /opt/hostedtoolc/tmp/gh-aw-merge-1063413820/new.md /usr/bin/git /tmp/go-build158git -importcfg 8806066/b390/vet--show-toplevel git (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/git --show-toplevel git /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel git /home/REDACTED/.lo--show-toplevel git (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/git --show-toplevel git /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel /opt/hostedtoolcrev-parse /usr/bin/du git (http block)
https://api.github.com/repos/actions/github-script/git/ref/tags/v9
- Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv ithub/workflows GO111MODULE r: $owner, name: $name) { hasDiscussionsEnabled } } GOINSECURE GOMOD GOMODCACHE go env ithub/workflows GO111MODULE /opt/hostedtoolcache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv ithub/workflows GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD ed } } go env -json GO111MODULE 64/bin/node GOINSECURE GOMOD GOMODCACHE go (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE ml GOINSECURE GOMOD GOMODCACHE go (http block)
https://api.github.com/repos/actions/setup-go/git/ref/tags/v4
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --git-dir /usr/bin/gh /usr/bin/git k/gh-aw/gh-aw -f kflows/schema-co--show-toplevel /usr/bin/git remo�� -v git /usr/bin/git 1529536875/.githgit rev-parse 64/pkg/tool/linu--show-toplevel git (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --show-toplevel git 7549796/b416/vet.cfg --show-toplevel git /usr/bin/git git rev-�� --show-toplevel git /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/vet --show-toplevel git /usr/bin/git /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/vet (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv -v -run 686873/b426/vet.cfg ./pkg/workflow/ 64/pkg/tool/linurev-parse /usr/bin/git bash --no�� --noprofile git /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/vet --show-toplevel HsIxcrGMzF8uDRarrev-parse /usr/bin/git /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/vet (http block)
https://api.github.com/repos/actions/setup-node/git/ref/tags/v4
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --show-toplevel uVsL8NFDM1C9 /usr/bin/git k/gh-aw/gh-aw/.ggit GO111MODULE m-status.lock.ym--show-toplevel git -C /home/REDACTED/work/gh-aw/gh-aw/.github/workflows rev-parse /usr/bin/git ithub/workflows GO111MODULE kflows/codex-git--show-toplevel git (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/git LsRemoteWithRealgit LsRemoteWithRealrev-parse n-dir/bash /usr/bin/git conf�� --get-regexp ^remote\..*\.gh-resolved$ /usr/bin/git 1529536875/.githgit ne_constants.go x_amd64/compile git (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/git --show-toplevel infocmp /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel ache/go/1.25.8/xrev-parse /usr/sbin/iptabl--show-toplevel git (http block)
https://api.github.com/repos/actions/upload-artifact/git/ref/tags/v4
- Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv ons-test1684995131 go 8806066/b452/_pkg_.a -json GO111MODULE /opt/hostedtoolc--show-toplevel git conf�� --get l /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/vet 01 GO111MODULE k.yml /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/vet (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/git --show-toplevel x_amd64/compile /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel ache/go/1.25.8/xrev-parse /usr/bin/git git (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/git --show-toplevel git /usr/bin/git git rev-�� --show-toplevel git ache/uv/0.11.7/x86_64/bash --show-toplevel git /usr/bin/git git (http block)
https://api.github.com/repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b
- Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq [.object.sha, .object.type] | @tsv GOSUMDB GOWORK 64/bin/go GOINSECURE GOMOD GOMODCACHE 1757413/b402/impGO111MODULE -c k/gh-aw/gh-aw/pkGOINSECURE k/gh-aw/gh-aw/pkGOMOD 64/bin/go GOSUMDB GOWORK 64/bin/go /opt/hostedtoolcGO111MODULE (http block)
- Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq [.object.sha, .object.type] | @tsv che/go-build/4c/GOINSECURE **/*.cjs $name) { hasDiscussionsEnabled } } **/*.json --ignore-path ../../../.pretti-json /opt/hostedtoolcGO111MODULE -o /tmp/go-build398GOINSECURE -trimpath 64/bin/go -p main -lang=go1.25 go (http block)
- Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq [.object.sha, .object.type] | @tsv --check **/*.cjs 64/bin/go **/*.json --ignore-path run-script/lib/n--noprofile expr 2 - 1 64/bin/go -json GO111MODULE 64/bin/go go (http block)
https://api.github.com/repos/github/gh-aw
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw --jq .default_branch -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v0.1.2
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0.1.2 --jq [.object.sha, .object.type] | @tsv --show-toplevel 64/pkg/tool/linu-buildtags /usr/bin/gh hub/workflows /opt/hostedtoolcrev-parse 64/bin/go gh api --paginate repos/{owner}/{repo}/actions/runs/4/artifacts /usr/bin/gh .artifacts[].namgit go 64/pkg/tool/linu--show-toplevel gh (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0.1.2 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/git --show-toplevel /bin/sh /usr/bin/git git rev-�� --show-toplevel git /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/vet --show-toplevel git /usr/bin/git /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/vet (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0.1.2 --jq [.object.sha, .object.type] | @tsv --noprofile git 686873/b403/vet.cfg --show-toplevel 64/pkg/tool/linurev-parse /usr/bin/git bash --no�� --noprofile git /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/vet --show-toplevel git /usr/bin/git /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/vet (http block)
https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.0.0
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq [.object.sha, .object.type] | @tsv --show-toplevel go /usr/bin/git e=false GO111MODULE ed.lock.yml git init�� GOMODCACHE l ache/node/24.14.1/x64/bin/node ithub/workflows GO111MODULE x_amd64/asm git (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/git --show-toplevel x_amd64/compile /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel ache/go/1.25.8/xrev-parse /usr/bin/git git (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/git --show-toplevel gh /usr/bin/git git rev-�� --show-toplevel git ache/go/1.25.8/x64/bin/go --show-toplevel git /usr/bin/git infocmp (http block)
https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.2.3
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq [.object.sha, .object.type] | @tsv /tmp/gh-aw-test-0 8806066/b444/_te-j /opt/hostedtoolcACCEPT remote.origin.urgit rsion=02e3cde-direv-parse /opt/hostedtoolc--show-toplevel node /tmp�� /tmp/TestHashConsistency_GoAndJavaScript1148637836/001/test-empty-frontmatter.md-p git /usr/bin/git -json GO111MODULE layTitle git (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/git --show-toplevel g2/XhJDf54YAm-TVrev-parse /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel ache/go/1.25.8/xrev-parse /usr/bin/git git (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq [.object.sha, .object.type] | @tsv --show-toplevel git 1/x64/bin/bash --show-toplevel git /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel git /usr/bin/git git (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/1/artifacts
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/1/artifacts --jq .artifacts[].name show 64/pkg/tool/linux_amd64/compile l GO111MODULE 64/bin/go 64/pkg/tool/linux_amd64/compile -C g_.a rev-parse x_amd64/vet l GO111MODULE 64/bin/go x_amd64/vet (http block)
- Triggering command: /usr/bin/gh gh run download 1 --dir test-logs/run-1 rev-parse 64/pkg/tool/linux_amd64/vet -json GO111MODULE 64/bin/go ylQP4Z8/vCNYLdc7test@example.com -C /home/REDACTED/work/gh-aw/gh-aw show /usr/bin/git -json GO111MODULE 64/bin/go git (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/12345/artifacts
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12345/artifacts --jq .artifacts[].name -- 64/pkg/tool/linux_amd64/vet name GO111MODULE $name) { has--show-toplevel 64/pkg/tool/linux_amd64/vet api 1771500466 -f bin/bash -f owner=github -f git (http block)
- Triggering command: /usr/bin/gh gh run download 12345 --dir test-logs/run-12345 config 64/pkg/tool/linux_amd64/compile remote.origin.urnode GO111MODULE 64/bin/go 64/pkg/tool/linux_amd64/compile -C 1702408432 show tnet/tools/bash -json GO111MODULE 64/bin/go git (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/12346/artifacts
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12346/artifacts --jq .artifacts[].name @sentry/mcp-server@0.32.0 64/pkg/tool/linux_amd64/vet -json GO111MODULE 64/bin/go Ul/b3vow9Hb3mWlOxIqNRmm/xzqspGFh-trimpath imag�� inspect mcp/ast-grep:latest cal/bin/bash -json GO111MODULE 64/bin/go git (http block)
- Triggering command: /usr/bin/gh gh run download 12346 --dir test-logs/run-12346 rev-parse 64/pkg/tool/linux_amd64/vet l GO111MODULE 64/bin/go 64/pkg/tool/linux_amd64/vet -C ility-kit.md config p/bin/bash l GO111MODULE r: $owner, name:--git-dir infocmp (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/2/artifacts
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/2/artifacts --jq .artifacts[].name -f 64/pkg/tool/linux_amd64/link -f owner=github -f 64/pkg/tool/linuTest User -C ntdrain.test config ortcfg.link remote.origin.urgit GO111MODULE DiscussionsEnabl--show-toplevel b4L7Ikj7IChhS-MVF4/opxEl9d6gxDxhg-XZsIZ/B--vCgKY599KyWunMvtm (http block)
- Triggering command: /usr/bin/gh gh run download 2 --dir test-logs/run-2 -f 64/pkg/tool/linux_amd64/vet -f owner=github -f 64/pkg/tool/linux_amd64/vet -C -aw rev-parse /usr/bin/git -json GO111MODULE 64/bin/go git (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/3/artifacts
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/3/artifacts --jq .artifacts[].name -f 64/pkg/tool/linux_amd64/vet -f owner=github DiscussionsEnabl--git-dir 64/pkg/tool/linux_amd64/vet -C 2603510135/.github/workflows rev-parse x_amd64/compile l GO111MODULE DiscussionsEnabl--show-toplevel x_amd64/compile (http block)
- Triggering command: /usr/bin/gh gh run download 3 --dir test-logs/run-3 show x_amd64/link -json GO111MODULE 64/bin/go x_amd64/link -C sole.test config ortcfg.link remote.origin.urgit GO111MODULE $name) { has--git-dir Eu/7mNRYRFA9RXlMxf9qL--/YcBrNqCW-trimpath (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/4/artifacts
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/4/artifacts --jq .artifacts[].name go 64/pkg/tool/linux_amd64/vet -json GO111MODULE 64/bin/go 64/pkg/tool/linux_amd64/vet -C 2603510135/.github/workflows config x_amd64/compile remote.origin.urgit GO111MODULE 64/bin/go x_amd64/compile (http block)
- Triggering command: /usr/bin/gh gh run download 4 --dir test-logs/run-4 go 64/pkg/tool/linu-importcfg l GO111MODULE 64/bin/go 64/pkg/tool/linuTest User -C /home/REDACTED/work/gh-aw/gh-aw/.g-s config ck remote.origin.urgit GO111MODULE DiscussionsEnabl--show-toplevel git (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/5/artifacts
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/5/artifacts --jq .artifacts[].name go 64/pkg/tool/linux_amd64/vet -json GO111MODULE 64/bin/go 64/pkg/tool/linutest@example.com -C k/gh-aw/gh-aw/.github/workflows show ache/go/1.25.8/x64/pkg/tool/linux_amd64/asm -json GO111MODULE $name) { has--show-toplevel ache/go/1.25.8/x64/pkg/tool/linux_amd64/asm (http block)
- Triggering command: /usr/bin/gh gh run download 5 --dir test-logs/run-5 config x_amd64/compile remote.origin.urgit GO111MODULE $name) { has--git-dir x_amd64/compile -C g_.a rev-parse /usr/bin/git -json GO111MODULE 64/bin/go git (http block)
https://api.github.com/repos/github/gh-aw/actions/workflows
- Triggering command: /usr/bin/gh gh workflow list --json name,state,path ithub/workflows GO111MODULE /opt/hostedtoolcache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env ithub/workflows GO111MODULE /opt/hostedtoolcache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
- Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 100 GOMOD DiscussionsEnabl-m go env -json GO111MODULE ock.yml GOINSECURE GOMOD GOMODCACHE infocmp (http block)
- Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 6 GO111MODULE DiscussionsEnablremove 64/pkg/tool/linuremote2 api k/gh-aw/gh-aw/.github/workflows .cfg /usr/bin/git -f owner=github -f git (http block)
https://api.github.com/repos/github/gh-aw/contents/.github/workflows/shared/reporting.md
- Triggering command: /tmp/go-build1038806066/b404/cli.test /tmp/go-build1038806066/b404/cli.test -test.testlogfile=/tmp/go-build1038806066/b404/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true GOINSECURE GOMOD ed } } go env -json GO111MODULE repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } GOINSECURE GOMOD GOMODCACHE go (http block)
https://api.github.com/repos/github/gh-aw/git/ref/tags/v0.47.4
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v0.47.4 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/git Onlymin-integritgit show 64/pkg/tool/linu--show-toplevel git rev-�� --show-toplevel 64/pkg/tool/linux_amd64/link /usr/bin/git ceutil.test go ortcfg.link git (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v0.47.4 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/git --show-toplevel git /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel node /usr/bin/git git (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v0.47.4 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/git --show-toplevel git /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel git /usr/bin/git git (http block)
https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.0.0
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq [.object.sha, .object.type] | @tsv 4200-34573/test-source-field-variant-2841860686/.github/workflows rev-parse /usr/bin/git -json GO111MODULE 64/bin/go git -C efaultBranchFromLsRemoteWithRealGitcustom_branch1243364091/001' efaultBranchFromLsRemoteWithRealGitcustom_branch1243364091/001' ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile -json GO111MODULE $name) { has--show-toplevel ache/go/1.25.8/x64/pkg/tool/linuupstream (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq [.object.sha, .object.type] | @tsv --show-toplevel 64/pkg/tool/linux_amd64/vet /usr/bin/git /tmp/TestHashCongit go ache/node/24.14.--show-toplevel git rev-�� --show-toplevel git /usr/bin/git k/gh-aw/gh-aw/.ggit rev-parse .cfg git (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/git --show-toplevel git /usr/bin/git git rev-�� --show-toplevel git /opt/hostedtoolcache/uv/0.11.7/x86_64/node --show-toplevel git /usr/bin/git node (http block)
https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.2.3
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq [.object.sha, .object.type] | @tsv k/gh-aw/gh-aw/.github/workflows GO111MODULE ck.yml l GOMOD GOMODCACHE go env k/gh-aw/gh-aw/.github/workflows GO111MODULE /usr/bin/git GOINSECURE GOMOD ed } } git (http block)
https://api.github.com/repos/github/gh-aw/git/ref/tags/v2.0.0
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq [.object.sha, .object.type] | @tsv ithub/workflows GO111MODULE kflows/copilot-token-audit.lock.yml GOINSECURE GOMOD ed } } BFU4hJRv0Iid env k/gh-aw/gh-aw/.g-p GO111MODULE k.yml l GOMOD ed } } /usr/bin/gh (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq [.object.sha, .object.type] | @tsv -json :latest (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq [.object.sha, .object.type] | @tsv k/gh-aw/gh-aw/.github/workflows y smoke-ci.lock.yml l GOMOD ed } } bash --no�� k/gh-aw/gh-aw GOPROXY kflows/daily-regulatory.lock.yml GOSUMDB GOWORK 64/bin/go infocmp (http block)
https://api.github.com/repos/github/gh-aw/git/ref/tags/v3.0.0
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq [.object.sha, .object.type] | @tsv ithub/workflows GO111MODULE /opt/hostedtoolcache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env Gitmain_branch42remote.origin.url Gitmain_branch4286541201/001' /usr/bin/git GOINSECURE GOMOD GOMODCACHE git (http block)
https://api.github.com/repos/nonexistent/action/git/ref/tags/v999.999.999
- Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq [.object.sha, .object.type] | @tsv 4200-34573/test-source-field-variant-2841860686 show kflow.lock.yml -json GO111MODULE 64/bin/go git -C /home/REDACTED/work/gh-aw/gh-aw/.github/workflows config x_amd64/vet remote.origin.urinfocmp GO111MODULE 64/bin/go x_amd64/vet (http block)
- Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq [.object.sha, .object.type] | @tsv --show-toplevel kflow.test /usr/bin/git /repos/github/ghgit --jq /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git /tmp/TestCompilegit remote /usr/bin/git git (http block)
- Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/git --show-toplevel git /usr/bin/git git rev-�� --show-toplevel (http block)
https://api.github.com/repos/nonexistent/repo/actions/runs/12345
- Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion remote.origin.urgit GO111MODULE r: $owner, name:--show-toplevel git -C 4200-34573/test-source-field-variant-2841860686 show kflow.lock.yml -json GO111MODULE 64/bin/go git (http block)
https://api.github.com/repos/owner/repo/actions/workflows
- Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo bash GOINSECURE GOMOD GOMODCACHE zrBJsxG/LAGKGk18-buildtags env -json GO111MODULE 4b78511e3acd2953-nilfunc GOINSECURE GOMOD GOMODCACHE go (http block)
- Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo /opt/hostedtoolcache/go/1.25.8/x64/bin/go CodexEngine|Test/opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/vet GOMOD ed } } go env -json GO111MODULE (http block)
- Triggering command: /usr/bin/gh gh workflow list --repo owner/repo --json name,path,state bin/bash -f owner=github -f git -C 36/001/test-inlined-imports-enabled-with-env-template-expressions-in-body.md show .cfg 07a9d4d84ff7a3b GO111MODULE 64/bin/go infocmp (http block)
https://api.github.com/repos/test-owner/test-repo/actions/secrets
- Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name -c=4 -nolocalimports -importcfg /tmp/go-build1038806066/b434/importcfg -pack /home/REDACTED/work/gh-aw/gh-aw/pkg/repoutil/repoutil.go /home/REDACTED/work/gh-aw/gh-aw/pkg/repoutil/repoutil_test.go env k/gh-aw/gh-aw GO111MODULE me: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } GOINSECURE GOMOD GOMODCACHE go (http block)
https://api.github.com/repos/test/repo
- Triggering command: /usr/bin/gh gh api /repos/test/repo --jq .default_branch g_.a rev-parse /usr/bin/git -json GO111MODULE 64/bin/go git -C aJd7B2VBq config rgo/bin/bash remote.origin.urgh GO111MODULE x_amd64/compile infocmp (http block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

- install_awf_binary.sh: add AWF_CACHE_DIR/AWF_CACHE_HIT env var support for cross-run caching; increase curl retry budget from 5×10s to 6×15s (max 300s); add stale-cache fallback so CDN blips don't fail the workflow - copilot_engine_installation.go: replace generateAWFInstallationStep with generateAWFInstallationSteps returning cache-restore + install step pair - nodejs.go, codex_engine.go: use new multi-step AWF installation - Updated tests and recompiled all 202 lock files Fixes #28521 / addresses CDN 502 fragility from issue description Agent-Logs-Url: https://github.com/github/gh-aw/sessions/1f250741-a7ca-4855-a4f0-705f27aae5e4 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Initial plan

02e3cde

Copilot AI assigned Copilot and pelikhan Apr 26, 2026

Copilot started work on behalf of pelikhan April 26, 2026 01:27 View session

Copilot AI linked an issue Apr 26, 2026 that may be closed by this pull request

[aw-failures] AWF binary download fragility: intermittent HTTP 502 from GitHub releases CDN affects agent and detection jobs #28529

Closed

github-actions Bot mentioned this pull request Apr 26, 2026

Smoke Test: Claude - 24945190957 #28537

Closed

Copilot AI changed the title ~~[WIP] Fix intermittent HTTP 502 for AWF binary download~~ fix: harden AWF binary install against GitHub releases CDN 502s Apr 26, 2026

Copilot AI requested a review from pelikhan April 26, 2026 01:48

Copilot finished work on behalf of pelikhan April 26, 2026 01:48

pelikhan closed this Apr 26, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: harden AWF binary install against GitHub releases CDN 502s#28533

fix: harden AWF binary install against GitHub releases CDN 502s#28533
Copilot wants to merge 2 commits intomainfrom
copilot/fix-awf-binary-download-issue

Copilot AI commented Apr 26, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

Copilot AI commented Apr 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

install_awf_binary.sh — resilience improvements

Go compiler — emit cache steps around AWF install

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Copilot AI commented Apr 26, 2026 •

edited

Loading

`install_awf_binary.sh` — resilience improvements