fix: correct double-npx entrypointArgs in MCP auto-containerization by Copilot · Pull Request #28930 · github/gh-aw

Copilot · 2026-04-28T11:57:57Z

The "Daily Token Consumption Report (Sentry OTel)" workflow failed because the Sentry MCP server exposed 0 tools — the container was running npx npx @sentry/mcp-server instead of npx @sentry/mcp-server.

Root Cause

In getMCPConfig(), when auto-assigning a container for well-known commands (npx, uvx), the code set entrypoint = "npx" and prepended "npx" to entrypointArgs:

// Before (buggy): command prepended to args, duplicating the entrypoint
result.Entrypoint = containerConfig.Entrypoint        // "npx"
result.EntrypointArgs = append([]string{result.Command}, result.Args...)
// → entrypointArgs: ["npx", "@sentry/mcp-server@0.32.0"]
// → Docker runs: npx npx @sentry/mcp-server@0.32.0  ✗

// After (fixed): command is the entrypoint; args are passed directly
result.Entrypoint = containerConfig.Entrypoint        // "npx"
result.EntrypointArgs = result.Args
// → entrypointArgs: ["@sentry/mcp-server@0.33.0"]
// → Docker runs: npx @sentry/mcp-server@0.33.0  ✓

Changes

pkg/workflow/mcp_config_custom.go — use result.Args directly as entrypointArgs; don't prepend the command since it is already the container entrypoint
pkg/workflow/mcp_config_compilation_test.go — add TestNpxCommandAutoContainerization regression test covering npx with a bare package arg and with a -y flag
.github/workflows/shared/mcp/sentry.md — fix malformed allowed entry ("search_docs requires SENTRY_OPENAI_API_KEY" → "search_docs" with inline comment); bump @sentry/mcp-server from 0.32.0 → 0.33.0
All 204 workflow lock files recompiled (affected: daily-token-consumption-report.lock.yml, mcp-inspector.lock.yml)

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

https://api.github.com/graphql
- Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw (http block)
- Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw ame t[bot] x_amd64/link /pre�� --noprofile .cfg 64/pkg/tool/linux_amd64/vet --get-regexp --global p/bin/git mN/YQwvhBHnGjcQFtap6Xga/vkAL_wC5BXP5qY-lohlz (http block)
- Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw r p/bin/git 64/pkg/tool/linu../../../**/*.json --no�� nore --log-level--ignore-path .cfg x_amd64/vet get --local /usr/local/.ghcu--noprofile x_amd64/vet (http block)
https://api.github.com/orgs/test-owner/actions/secrets
- Triggering command: /usr/bin/gh gh api /orgs/test-owner/actions/secrets --jq .secrets[].name 5X-9/0m24o7J2bdaGOINSECURE GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE 5767251/b406/imp/tmp/go-build3042864500/b127/vet.cfg -c che/go-build/51/GOSUMDB GOPROXY 64/bin/go GOSUMDB GOWORK 64/bin/go /opt/hostedtoolcache/go/1.25.8/xGO111MODULE (http block)
https://api.github.com/repos/actions/ai-inference/git/ref/tags/v1
- Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq [.object.sha, .object.type] | @tsv --show-toplevel sY5xy3c/9ezsDU_VWw7VJguVlRAx /usr/bin/git ithub/workflows til_test.go ache/go/1.25.8/x--show-toplevel git rev-�� --show-toplevel go /usr/bin/git -json GO111MODULE .cfg git (http block)
https://api.github.com/repos/actions/checkout/git/ref/tags/v3
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq [.object.sha, .object.type] | @tsv 2922-52614/test-1356280907 go /usr/bin/git -json GO111MODULE 64/bin/go git rev-�� --show-toplevel go /usr/bin/git -json GO111MODULE 64/bin/go git (http block)
https://api.github.com/repos/actions/checkout/git/ref/tags/v5
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq [.object.sha, .object.type] | @tsv 2922-52614/test-2352945191/.github/workflows GO111MODULE ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile ortc�� 2922-52614/test-3752519314 stmain.go ache/go/1.25.8/x64/pkg/tool/linux_amd64/link GOINSECURE b/gh-aw/pkg/agenrev-parse GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/link (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq [.object.sha, .object.type] | @tsv --show-toplevel x_amd64/vet /usr/bin/git -json GO111MODULE ache/go/1.25.8/x: git rev-�� --show-toplevel ache/go/1.25.8/xconfig /usr/bin/git -json GO111MODULE 1/x64/bin/node git (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/git --show-toplevel go /usr/bin/infocmp--show-toplevel git rev-�� --show-toplevel infocmp /usr/bin/git s/test.md s/3/artifacts /usr/bin/infocmp--show-toplevel git (http block)
https://api.github.com/repos/actions/checkout/git/ref/tags/v6
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv mcp-servers\|mcp_servers\|MCPSer-errorsas /home/REDACTED/work/gh-aw/gh-aw/pk-ifaceassert x_amd64/vet (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv /*.js' --ignore-remote.origin.url /tmp/go-build3651228340/b085/vetowner=github 1/x64/bin/sh --noprofile (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv -bool -buildtags ndor/bin/sh -errorsas -ifaceassert -nilfunc /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/vet -uns�� *.json' '!../../../pkg/workflow/js/**/*.json' --ignore-path ../../../.prettierignore /tmp/go-build3651228340/b186/vet.cfg ache/go/1.25.8/x64/bin/go (http block)
https://api.github.com/repos/actions/github-script/git/ref/tags/v8
- Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq [.object.sha, .object.type] | @tsv --show-toplevel verutil.test /usr/bin/git -json GO111MODULE 64/pkg/tool/linu--oneline git rev-�� --show-toplevel 64/pkg/tool/linux_amd64/compile /usr/bin/git g_.a GO111MODULE /usr/local/.ghcu--show-toplevel git (http block)
https://api.github.com/repos/actions/github-script/git/ref/tags/v9
- Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE sh (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE node (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv 5767251/b423/_pkGOINSECURE GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env 7Y9J/2daMmkJlvWIGOINSECURE GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE 5767251/b423/imp-buildtags (http block)
https://api.github.com/repos/actions/setup-go/git/ref/tags/v4
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --show-toplevel go 2864500/b471/vet.cfg mLsRemoteWithReagit mLsRemoteWithRearev-parse ache/go/1.25.8/x--show-toplevel infocmp -1 xterm-color go /tmp/go-build3042864500/b469/workflow.test -json GO111MODULE 64/pkg/tool/linu--show-toplevel /tmp/go-build3042864500/b469/workflow.test (http block)
https://api.github.com/repos/actions/setup-node/git/ref/tags/v4
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv /tmp/TestGuardPolicyTrustedUsersRequiresMinIntegrity2581407280/001 remote (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv ry=1 go che/go-build/a4/a453a8a21bfedfc04593a226571a9fffea74771a290d01e0d020df333eab3e1b-d -json GO111MODULE ache/go/1.25.8/x--show-toplevel gh run download 5 /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/vet test-logs/run-5 GO111MODULE 64/pkg/tool/linu--show-toplevel /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/vet (http block)
https://api.github.com/repos/actions/setup-node/git/ref/tags/v6
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv --noprofile (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv -unreachable=fal-f /tmp/go-build365owner=github repository(owne-f r\|filter.*skillgit rver/dist/index.-C n-dir/bash /opt/hostedtoolcconfig -uns�� *.json' '!../../remote.origin.url /tmp/go-build3651228340/b181/vetowner=github repository(owner: $owner, name:-f --noprofile (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv SameOutput3684985733/001/stability-test.md GO111MODULE 2864500/b419/vet.cfg GOINSECURE GOMOD GOMODCACHE go test�� licyMinIntegrityOnlymin-integrity_with_repos_arr-c=4 -run /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linu-importcfg 001' 001' 64/bin/go /opt/hostedtoolcache/go/1.25.8/x-test.v=true (http block)
https://api.github.com/repos/actions/upload-artifact/git/ref/tags/v4
- Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv /tmp/gh-aw-test-runs/20260428-122922-52614/test-1777695754/.gith.github/workflows/test.md (http block)
https://api.github.com/repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b
- Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq [.object.sha, .object.type] | @tsv submodules | hea**/*.ts (http block)
- Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq [.object.sha, .object.type] | @tsv --noprofile .cfg $name) { hasDiscussionsEnabled } } get --local ache/uv/0.11.8/x--noprofile 64/pkg/tool/linux_amd64/vet --no�� js/**/*.json' --ignore-path ../../../.prettierignore .cfg 64/pkg/tool/linux_amd64/vet get --local ache/uv/0.11.8/x/home/REDACTED/work/gh-aw/gh-aw/.github/workflows 64/pkg/tool/linuconfig (http block)
- Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq [.object.sha, .object.type] | @tsv re --log-level=e!../../../pkg/workflow/js/**/*.json .cfg 64/pkg/tool/linu../../../.prettierignore ntry tions/setup/ 86_64/node 64/pkg/tool/linux_amd64/vet --no�� js/**/*.json' --ignore-path ../../../.prettierignore .cfg 64/pkg/tool/linux_amd64/vet get --local ndor/bin/bash 64/pkg/tool/linu-f (http block)
https://api.github.com/repos/github/gh-aw
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw --jq .default_branch g/workflow/actioremote.origin.url g/workflow/activation_checkout_test.go r: $owner, name: $name) { hasDiscussionsEnabled } } ACCEPT (http block)
https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v0.1.2
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0.1.2 --jq [.object.sha, .object.type] | @tsv --git-dir go /usr/bin/git -json GO111MODULE ache/go/1.25.8/x--show-toplevel /usr/bin/git conf�� --get-regexp ^remote\..*\.gh-resolved$ /usr/bin/git y_only_defaults_git GO111MODULE util.test git (http block)
https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.0.0
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq [.object.sha, .object.type] | @tsv 2864500/b472/_pkg_.a k/gh-aw/gh-aw/pkg/sliceutil/sliceutil_test.go 2864500/b472=> npx prettier --cgit GOPROXY 64/bin/go /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linu-importcfg -o poJ_/sX9FX53sm1OTZ6jdpoJ_ -trimpath /usr/bin/git -p github.com/githurev-parse -lang=go1.25 git (http block)
https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.2.3
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq [.object.sha, .object.type] | @tsv k/gh-aw/gh-aw/pkg/cli sh /tmp/go-build3042864500/b435/repoutil.test l GOPROXY 64/bin/go /tmp/go-build3042864500/b435/repoutil.test 2864�� -test.paniconexit0 2864500/b452/_testmain.go /tmp/go-build3042864500/b450/styles.test -test.timeout=10git -test.run=^Test -test.short=true--show-toplevel /tmp/go-build3042864500/b450/styles.test (http block)
https://api.github.com/repos/github/gh-aw/actions/runs
- Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --limit 100 --created >=2026-04-21 GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
- Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --limit 100 --created >=2026-03-29 GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE RIQEcng/1ndInNVrTest User (http block)
- Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --limit 100 --created >=2026-01-28 GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/1/artifacts
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/1/artifacts --jq .artifacts[].name GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile env g_.a GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
- Triggering command: /usr/bin/gh gh run download 1 --dir test-logs/run-1 GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go estl�� -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/12345/artifacts
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12345/artifacts --jq .artifacts[].name GO111MODULE 64/pkg/tool/linux_amd64/link GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linutest@example.com env ntdrain.test GO111MODULE ortcfg.link GOINSECURE GOMOD GOMODCACHE FYD7TXdX-i1ql3kuorigin (http block)
- Triggering command: /usr/bin/gh gh run download 12345 --dir test-logs/run-12345 GO111MODULE 64/pkg/tool/linu-nolocalimports GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linu/tmp/go-build3042864500/b459/_testmain.go env -json GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/12346/artifacts
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12346/artifacts --jq .artifacts[].name GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet env -json GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
- Triggering command: /usr/bin/gh gh run download 12346 --dir test-logs/run-12346 GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet env 1119354907 GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/2/artifacts
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/2/artifacts --jq .artifacts[].name GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet env -json GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
- Triggering command: /usr/bin/gh gh run download 2 --dir test-logs/run-2 GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go estl�� -json GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/3/artifacts
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/3/artifacts --jq .artifacts[].name GO111MODULE 64/pkg/tool/linux_amd64/link GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/link env 2537850028/.github/workflows GO111MODULE ortcfg.link GOINSECURE GOMOD GOMODCACHE -4GmfpWzsnidAKUU7I/p67f43WHEJUTsrev-parse (http block)
- Triggering command: /usr/bin/gh gh run download 3 --dir test-logs/run-3 GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/4/artifacts
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/4/artifacts --jq .artifacts[].name GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet env 2537850028/.github/workflows GO111MODULE k GOINSECURE GOMOD GOMODCACHE go (http block)
- Triggering command: /usr/bin/gh gh run download 4 --dir test-logs/run-4 GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/5/artifacts
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/5/artifacts --jq .artifacts[].name GO111MODULE 64/pkg/tool/linux_amd64/link GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/link env 2537850028/.github/workflows GO111MODULE ortcfg.link GOINSECURE GOMOD GOMODCACHE vQ6WXYRl159TxgeZit/Yrt675lWeJEdZ-goversion (http block)
- Triggering command: /usr/bin/gh gh run download 5 --dir test-logs/run-5 GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linuTest User env 23/001/test-empty-frontmatter.md GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
https://api.github.com/repos/github/gh-aw/actions/workflows
- Triggering command: /usr/bin/gh gh workflow list --json name,state,path mf6a/5eacx76nVDiGOINSECURE GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE 5767251/b411/imp-buildtags -c che/go-build/10/-errorsas GOPROXY 64/bin/go GOSUMDB GOWORK 64/bin/go /opt/hostedtoolc-buildtags (http block)
- Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 100 GOPROXY 64/bin/go go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
- Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 6 GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet env 150615103 GO111MODULE x_amd64/link GOINSECURE GOMOD GOMODCACHE x_amd64/link (http block)
https://api.github.com/repos/github/gh-aw/contents/.github/workflows/shared/reporting.md
- Triggering command: /tmp/go-build3042864500/b404/cli.test /tmp/go-build3042864500/b404/cli.test -test.testlogfile=/tmp/go-build3042864500/b404/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD s,MFiles,HFiles,--noprofile npm (http block)
https://api.github.com/repos/github/gh-aw/git/ref/tags/v0.47.4
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v0.47.4 --jq [.object.sha, .object.type] | @tsv --show-toplevel go /usr/bin/git ApprovalLabelsCogit stmain.go ache/go/1.25.8/x--show-toplevel git rev-�� --show-toplevel ache/go/1.25.8/x64/pkg/tool/linux_amd64/link /usr/bin/git 2864500/b427/logdu GO111MODULE 2864500/b427/imp/tmp/gh-aw/aw-feature-branch.patch git (http block)
https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.0.0
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq [.object.sha, .object.type] | @tsv 2922-52614/test-source-field-variant-174858265/.github/workflows GO111MODULE Name,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE ache/go/1.25.8/x64/bin/bash GOINSECURE GOMOD GOMODCACHE go (http block)
https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.2.3
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq [.object.sha, .object.type] | @tsv /tmp/go-build223-errorsas -trimpath 64/bin/go -p main -lang=go1.25 go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
https://api.github.com/repos/github/gh-aw/git/ref/tags/v2.0.0
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq [.object.sha, .object.type] | @tsv /tmp/go-build223-p -trimpath 64/bin/go -p main -lang=go1.25 go env 0573475/001 0573475/002/work 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go 0573�� -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
https://api.github.com/repos/github/gh-aw/git/ref/tags/v3.0.0
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq [.object.sha, .object.type] | @tsv /tmp/go-build2235767251/b438/_pkGOINSECURE -trimpath 64/bin/go -p main -lang=go1.25 go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
https://api.github.com/repos/nonexistent/action/git/ref/tags/v999.999.999
- Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq [.object.sha, .object.type] | @tsv 23/001/test-simple-frontmatter.md GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env efaultBranchFromLsRemoteWithRealGitcustom_branchremote.origin.url efaultBranchFromLsRemoteWithRealGitcustom_branch4098952784/001' /opt/hostedtoolcache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
https://api.github.com/repos/nonexistent/repo/actions/runs/12345
- Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion GOINSECURE GOMOD GOMODCACHE go env /ref/tags/v9 GO111MODULE tartedAt,updatedAt,event,headBranch,headSha,displayTitle GOINSECURE GOMOD GOMODCACHE go (http block)
https://api.github.com/repos/owner/repo/actions/workflows
- Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo 64/bin/go GOINSECURE GOMOD GOMODCACHE 5767251/b419/imp-buildtags -c che/go-build/65/-errorsas GOPROXY 64/bin/go GOSUMDB GOWORK 64/bin/go /opt/hostedtoolcshow (http block)
- Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo 64/bin/go GOINSECURE GOMOD GOMODCACHE 5767251/b423/imp-buildtags -c che/go-build/98/-errorsas GOPROXY 64/bin/go GOSUMDB GOWORK 64/bin/go /opt/hostedtoolc-trimpath (http block)
- Triggering command: /usr/bin/gh gh workflow list --repo owner/repo --json name,path,state ortcfg.link GOINSECURE GOMOD GOMODCACHE FYD7TXdX-i1ql3kuorigin env -json GO111MODULE g_.a GOINSECURE GOMOD GOMODCACHE go (http block)
https://api.github.com/repos/test-owner/test-repo/actions/secrets
- Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name rZHU/jTcZENNbT5OGOINSECURE GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE 5767251/b404/imp-trimpath -c che/go-build/e7/-p GOPROXY 64/bin/go GOSUMDB GOWORK 64/bin/go /opt/hostedtoolc-goversion (http block)
https://api.github.com/repos/test/repo
- Triggering command: /usr/bin/gh gh api /repos/test/repo --jq .default_branch -json GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go estl�� -json GO111MODULE 64/pkg/tool/linux_amd64/link GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linu4 (http block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

…nd update sentry.md - Fix getMCPConfig() in mcp_config_custom.go: when auto-assigning a container for well-known commands like 'npx'/'uvx', the command was incorrectly prepended to entrypointArgs (e.g. ["npx", "@sentry/mcp-server"]) causing the container to run 'npx npx @sentry/mcp-server' instead of the correct 'npx @sentry/mcp-server'. Since the command is already set as the container entrypoint, it must not also appear in entrypointArgs. - Fix sentry.md: correct malformed 'allowed' entry 'search_docs requires SENTRY_OPENAI_API_KEY' → 'search_docs' (with comment), and update @sentry/mcp-server from 0.32.0 to 0.33.0 (latest). - Add TestNpxCommandAutoContainerization regression test to prevent recurrence. - Recompile all workflow lock files with the fix applied. Agent-Logs-Url: https://github.com/github/gh-aw/sessions/48310ee3-7b7c-429f-b427-d13a881a63cc Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/48310ee3-7b7c-429f-b427-d13a881a63cc Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot

Pull request overview

Fixes MCP auto-containerization for well-known commands (npx, uvx) so Docker doesn’t run a duplicated entrypoint (e.g., npx npx ...), which previously caused the Sentry MCP server to expose 0 tools.

Changes:

Adjust getMCPConfig() auto-containerization to pass original args as entrypointArgs without prepending the command.
Add a regression test covering npx auto-containerization (bare package arg and -y flag case).
Update Sentry MCP shared workflow snippet and recompile affected workflow lock files to reflect the corrected entrypoint args and version bump.

Show a summary per file

File	Description
pkg/workflow/mcp_config_custom.go	Fixes auto-containerization to avoid duplicating the command in `entrypointArgs`.
pkg/workflow/mcp_config_compilation_test.go	Adds regression coverage for `npx` containerization output in generated YAML.
.github/workflows/shared/mcp/sentry.md	Bumps `@sentry/mcp-server` and fixes malformed `allowed` entry format.
.github/workflows/mcp-inspector.lock.yml	Recompiled lock output reflecting corrected `entrypointArgs` and updated Sentry server version/allowed tools.
.github/workflows/daily-token-consumption-report.lock.yml	Recompiled lock output reflecting corrected `entrypointArgs` and updated Sentry server version/allowed tools.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 5/5 changed files
Comments generated: 1

+			}
+
+			// entrypointArgs must start with the first actual arg
+			if !strings.Contains(serverBlock, `"`+tt.wantFirstArg+`"`) {


…g separation Generated by Design Decision Gate workflow. Documents the contract that the command field becomes the container entrypoint, not the first element of entrypointArgs, when auto-containerizing npx/uvx-based MCP servers. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

github-actions · 2026-04-28T14:24:42Z

Commit pushed: 345247f

🏗️ ADR gate enforced by Design Decision Gate 🏗️

github-actions · 2026-04-28T14:24:43Z

🏗️ Design Decision Gate — ADR Required

This PR makes significant changes to core business logic (pkg/ — 110 new lines) but does not have a linked Architecture Decision Record (ADR).

AI has analyzed the PR diff and generated a draft ADR to help you get started:

📄 Draft ADR: docs/adr/28930-mcp-server-auto-containerization-entrypoint-arg-separation.md

The draft documents the architectural contract that this bug fix establishes: when getMCPConfig() auto-containerizes a well-known command (npx, uvx), the command must become the container entrypoint exclusively — it must not also appear as the first element of entrypointArgs. This is the invariant the regression test now enforces.

What to do next

Review the draft ADR committed to your branch — it was generated from the PR diff
Complete any missing sections — in particular verify the Deciders list and adjust the Consequences section to reflect your intent
Commit the finalized ADR to docs/adr/ on your branch (or accept the draft as-is)
Reference the ADR in this PR body by adding a line such as:

ADR: ADR-28930: MCP Server Auto-Containerization — Entrypoint/Arg Separation Contract

Once an ADR is linked in the PR body, this gate will re-run and verify the implementation matches the decision.

Why ADRs Matter

"AI made me procrastinate on key design decisions. Because refactoring was cheap, I could always say 'I'll deal with this later.' Deferring decisions corroded my ability to think clearly."

ADRs create a searchable, permanent record of why the codebase looks the way it does. The entrypoint/arg separation contract captured here will help the next contributor understand exactly what invariant the TestNpxCommandAutoContainerization test is guarding.

📋 Michael Nygard ADR Format Reference

An ADR must contain these four sections to be considered complete:

Context — What is the problem? What forces are at play?
Decision — What did you decide? Why?
Alternatives Considered — What else could have been done?
Consequences — What are the trade-offs (positive and negative)?

All ADRs are stored in docs/adr/ as Markdown files numbered by PR number (e.g., 28930-...md for PR #28930).

🔒 This PR cannot merge until an ADR is linked in the PR body.

References: §25058262146

🏗️ ADR gate enforced by Design Decision Gate 🏗️ · ● 188.5K · ◷

Initial plan

7d3f08f

Copilot AI assigned Copilot and pelikhan Apr 28, 2026

Copilot started work on behalf of pelikhan April 28, 2026 11:58 View session

Copilot AI linked an issue Apr 28, 2026 that may be closed by this pull request

[aw] Daily Token Consumption Report (Sentry OTel) failed #28922

Closed

Copilot AI and others added 2 commits April 28, 2026 12:30

fix: remove placeholder issue reference in test comment

bb9435e

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/48310ee3-7b7c-429f-b427-d13a881a63cc Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Fix daily token consumption report workflow failure~~ fix: correct double-npx entrypointArgs in MCP auto-containerization Apr 28, 2026

Copilot finished work on behalf of pelikhan April 28, 2026 12:38

Copilot AI requested a review from pelikhan April 28, 2026 12:38

This was referenced Apr 28, 2026

[aw] No-Op Runs #28859

Closed

[Contribution Check Report] Contribution Check — 2026-04-28 #28835

Closed

pelikhan marked this pull request as ready for review April 28, 2026 14:17

Copilot AI review requested due to automatic review settings April 28, 2026 14:17

Copilot started reviewing on behalf of pelikhan April 28, 2026 14:18 View session

Copilot AI reviewed Apr 28, 2026

View reviewed changes

Comment thread pkg/workflow/mcp_config_compilation_test.go

}

// entrypointArgs must start with the first actual arg

if !strings.Contains(serverBlock, `"`+tt.wantFirstArg+`"`) {

pelikhan merged commit 65f587a into main Apr 28, 2026

pelikhan deleted the copilot/aw-fix-daily-token-consumption-report branch April 28, 2026 14:28

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: correct double-npx entrypointArgs in MCP auto-containerization#28930

fix: correct double-npx entrypointArgs in MCP auto-containerization#28930
pelikhan merged 4 commits intomainfrom
copilot/aw-fix-daily-token-consumption-report

Copilot AI commented Apr 28, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

github-actions Bot commented Apr 28, 2026

Uh oh!

github-actions Bot commented Apr 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

Copilot AI commented Apr 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Root Cause

Changes

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Copilot's findings

Uh oh!

github-actions Bot commented Apr 28, 2026

Uh oh!

github-actions Bot commented Apr 28, 2026

🏗️ Design Decision Gate — ADR Required

What to do next

Why ADRs Matter

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Apr 28, 2026 •

edited

Loading