Fix: Remove env_vars from HTTP MCP server config for safe-inputs

[Copilot]

Fixed workflow failure at step 39 ("Ingest agent output") in daily-performance-summary workflow caused by invalid MCP server configuration.

Root Cause

Used the audit tool to download logs from workflow run 20610417177. The error was:

Error loading config.toml: env_vars is not supported for streamable_http
in `mcp_servers.safeinputs`

The safe-inputs MCP server was configured with type: http but incorrectly included env_vars in the TOML configuration. The MCP protocol does not support env_vars for HTTP transport - environment variables must be passed via the workflow job's env: section instead.

Changes Made

Fixed in pkg/workflow/mcp_renderer.go:

• Removed lines 247-256 that generated env_vars for HTTP safe-inputs config
• Added comment explaining why env_vars is not supported for HTTP transport
• Environment variables are correctly passed via the job's env section

Updated tests in pkg/workflow/safe_inputs_http_codex_test.go:

• Changed tests to verify env_vars is NOT in HTTP MCP config (was incorrectly testing for the bug)
• Tests now verify environment variables are only in the job's env section
• Both TestCodexSafeInputsHTTPTransport and TestCodexSafeInputsWithSecretsHTTPTransport now pass

Recompiled workflow:

• .github/workflows/daily-performance-summary.lock.yml updated without env_vars in safe-inputs config

Testing

• ✅ Downloaded and analyzed error logs using gh-aw audit 20610417177
• ✅ Identified root cause: env_vars in HTTP MCP config
• ✅ All unit tests pass
• ✅ Workflow compiles without errors
• ✅ Validated fix addresses the exact error from the logs

Before

[mcp_servers.safeinputs]
type = "http"
url = "http://host.docker.internal:$GH_AW_SAFE_INPUTS_PORT"
headers = { Authorization = "Bearer $GH_AW_SAFE_INPUTS_API_KEY" }
env_vars = ["GH_AW_SAFE_INPUTS_PORT", "GH_AW_SAFE_INPUTS_API_KEY", "GH_TOKEN"]  # ❌ Not supported

After

[mcp_servers.safeinputs]
type = "http"
url = "http://host.docker.internal:$GH_AW_SAFE_INPUTS_PORT"
headers = { Authorization = "Bearer $GH_AW_SAFE_INPUTS_API_KEY" }
# Environment variables passed via job env section instead

This fix resolves the workflow failure at step 39 ("Ingest agent output") in the daily-performance-summary workflow.

[!WARNING]

Custom agent used: debug-agentic-workflow
Debug and refine agentic workflows using gh-aw CLI tools - analyze logs, audit runs, and improve workflow performance

Original prompt

Reference: https://github.com/githubnext/gh-aw/actions/runs/20610417177/job/59193791309#step:39:1

Custom agent used: debug-agentic-workflow
Debug and refine agentic workflows using gh-aw CLI tools - analyze logs, audit runs, and improve workflow performance

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[pelikhan]

@copilot use audit tool to download error logs

[Copilot]

@copilot use audit tool to download error logs

Downloaded logs using audit tool. Found the error:

Error loading config.toml: env_vars is not supported for streamable_http
in `mcp_servers.safeinputs`

Fixed in commit d78fab4:

• Removed env_vars from HTTP MCP server config (not supported for HTTP transport)
• Updated tests to verify correct behavior
• Environment variables now correctly passed via job env section only

The workflow should now run successfully.