Skip to content

refactor: replace hardcoded /opt/gh-aw paths with GH_AW_HOME constants#21082

Closed
Copilot wants to merge 7 commits intomainfrom
copilot/recreate-pr-for-current-main
Closed

refactor: replace hardcoded /opt/gh-aw paths with GH_AW_HOME constants#21082
Copilot wants to merge 7 commits intomainfrom
copilot/recreate-pr-for-current-main

Conversation

Copy link
Contributor

Copilot AI commented Mar 15, 2026

Hardcoded /opt/gh-aw paths throughout the compiler prevented self-hosted runners from relocating the installation directory. This recreates PR #20864 against the current main branch.

New abstractions (pkg/workflow/setup_action_paths.go)

Constant/Helper Value Use in
GhAwHome ${GH_AW_HOME} bash run: blocks
GhAwHomeJS process.env.GH_AW_HOME JS require() expressions
GhAwHomeExpr ${{ env.GH_AW_HOME }} YAML env: blocks
GhAwHomeExprDefault ${{ env.GH_AW_HOME || '/opt/gh-aw' }} job-level env (with override support)
JsRequireGhAw(path) helper generates process.env.GH_AW_HOME + '/path'

SetupActionDestination updated to GhAwHomeExpr + "/actions".

// Before
yaml.WriteString("            const { main } = require('/opt/gh-aw/actions/generate_aw_info.cjs');\n")
yaml.WriteString("        run: bash /opt/gh-aw/actions/create_gh_aw_tmp_dir.sh\n")

// After
yaml.WriteString("            const { main } = require(" + JsRequireGhAw("actions/generate_aw_info.cjs") + ");\n")
yaml.WriteString("          bash " + GhAwHome + "/actions/create_gh_aw_tmp_dir.sh\n")

Other changes

  • pkg/constants/constants.go: Added GhAwHomeDefault = "/opt/gh-aw"; updated DefaultGhAwMount to \${GH_AW_HOME}:\${GH_AW_HOME}:ro (shell expansion at runtime, no :- fallback needed since job env always sets it)
  • Job-level GH_AW_HOME: Always injected via GhAwHomeExprDefault in agent, safe-outputs, conclusion, push-repo-memory, and update-cache-memory jobs — callers can override via workflow/repo env
  • compiler_main_job.go: env map always initialized (not just when safe-outputs enabled); safe-outputs paths use GhAwHomeExpr
  • compiler_yaml_main_job.go: "Create gh-aw temp directory" step also echoes GH_AW_SAFE_OUTPUTS* vars to $GITHUB_ENV so they reflect any GH_AW_HOME override
  • safe_outputs_config_generation.go: Added close_pull_request config generation
  • step_order_validation.go: isPathScannedBySecretRedaction accepts ${GH_AW_HOME} prefixed paths as scannable
  • 30+ compiler files: All /opt/gh-aw/ occurrences replaced with the appropriate typed constant
  • 173 workflow lock files recompiled

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

  • https://api.github.com/graphql
    • Triggering command: /usr/bin/gh gh pr list --head copilot/recreate-pr-for-current-main 242889b8a3b5919533b0f2c8:pkg/workflow/mcp_renderer.go ache/go/1.25.0/x--write bin/sh --show-toplevel /opt/hostedtoolcrev-parse tnet/tools/bash git show�� */*.ts' '**/*.json' --ignore-path ../../../.pret--log-level=error git t go bash k/_temp/ghcca-no--show-toplevel git (http block)
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw HEAD it git rev-�� --show-toplevel bash /usr/bin/git '**/*.ts' '**/*.git git 0/x64/lib/node_m--show-toplevel git (http block)
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw node /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel /bin/sh /usr/bin/git git (http block)
  • https://api.github.com/repos/actions/ai-inference/git/ref/tags/v1
    • Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq .object.sha --show-toplevel l /usr/bin/git w/js/**/*.json' git HEAD nfig/composer/ve--show-toplevel git rev-�� --show-toplevel git /usr/bin/git --name-only HEAD es/.bin/sh git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq .object.sha --show-toplevel /usr/bin/git 919aaf6ca98d0d8499e68578 -aw-actions/git/git bash /usr/bin/git node js/f�� k/gh-aw/gh-aw/ac--show-toplevel git /opt/hostedtoolcache/node/24.14.0/x64/bin/node uest|push_to_pulgit git /usr/bin/git node (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq .object.sha --show-toplevel git /opt/hostedtoolcache/node/24.14.0/x64/bin/node --show-toplevel e/git /usr/bin/git node js/f�� /opt/hostedtoolc--show-toplevel git /opt/hostedtoolcache/node/24.14.0/x64/bin/node --show-toplevel /opt/hostedtoolcrev-parse 0/x64/bin/npm node (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v3
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq .object.sha --write **/*.cjs /home/REDACTED/.local/bin/sh **/*.json --ignore-path run-script/lib/n--show-toplevel sh -c "prettier" --write '../../../**/*.json' '!../../--detach bash /usr/sbin/iptables --noprofile 64/pkg/tool/linurev-parse ash iptables (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq .object.sha --show-toplevel git 0/x64/bin/node --show-toplevel grep /usr/bin/git git cjs --show-toplevel git ache/node/24.14.0/x64/bin/node --show-toplevel git /usr/bin/git git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq .object.sha ithub-script/git/ref/tags/v8 node 0/x64/bin/node bin/node git /usr/bin/git git cjs --show-toplevel git /usr/bin/git --show-toplevel git /usr/bin/git git (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v5
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha s|"/opt/gh-aw/prompts/pr_context_prompt.md"|"${GH_AW_HOME}/prompts/pr_context_prompt.md"|g pkg/workflow/pr_checkout_test.go n-dir/bash npx prettier --winfocmp sh 919aaf6ca98d0d84xterm-color git diff�� --name-only HEAD ache/node/24.14.0/x64/bin/git --name-only HEAD x86_64/bash bash (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha --get remote.origin.url /usr/bin/git json' --ignore-pgit HEAD ules/.bin/pretti--show-toplevel git rev-�� --show-toplevel bash /usr/bin/git --noprofile /opt/hostedtoolcrev-parse kflow.test git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha tOrdering3776261522/001/go/1.25.0/x64"; export PATH="$(find "/tmp/TestGetNpmBinPathSetup_GorootOgit bash /usr/bin/git *.json' '!../../git bash /home/REDACTED/wor--show-toplevel git rev-�� --show-toplevel bash /usr/bin/git ting JavaScript git git ache/node/24.14.--show-toplevel git (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v6
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha .js' --ignore-path .prettierigno-errorsas k/gh-aw/gh-aw/pkg/workflow/actio-ifaceassert x_amd64/vet k/gh-aw/gh-aw/pkgit k/gh-aw/gh-aw/pkrev-parse k/gh-aw/gh-aw/pk--show-toplevel x_amd64/vet tion�� k/gh-aw/gh-aw/pkg/workflow/activation_checkout_test.go k/gh-aw/gh-aw/pkg/workflow/activation_github_token_test.go 64/pkg/tool/linux_amd64/vet ignore (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha --noprofile (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha */*.json' '!../../../pkg/workflo-s (http block)
  • https://api.github.com/repos/actions/github-script/git/ref/tags/v8
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha .js' --ignore-path .prettierigno-errorsas (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha --noprofile (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha --show-toplevel bash /usr/bin/git --noprofile (http block)
  • https://api.github.com/repos/actions/setup-go/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq .object.sha .js' --ignore-path .prettierigno-errorsas (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq .object.sha --show-toplevel bash /usr/bin/git --noprofile (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq .object.sha n_sha_checker_test.go n_sha_validation_test.go x_amd64/link ation_github_tokgit ation_outputs_alrev-parse omment_target_re--show-toplevel x_amd64/link _job�� ic_engine_test.go ic_output_test.go n-dir/bash se cq/zitB6UR_dcEasrev-parse ache/go/1.25.0/x--show-toplevel git (http block)
  • https://api.github.com/repos/actions/setup-node/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq .object.sha .js' --ignore-path .prettierigno-errorsas (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq .object.sha --show-toplevel python3 /usr/bin/git with open('/tmpgit (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq .object.sha --show-toplevel ache/go/1.25.0/x64/pkg/tool/linux_amd64/vet x_amd64/link se 0238720/b026/vetrev-parse .cfg x_amd64/link --no�� --noprofile ache/go/1.25.0/x64/pkg/tool/linux_amd64/vet /usr/bin/git se Fk/_PKbLnfENM-SFrev-parse ache/go/1.25.0/x--show-toplevel git (http block)
  • https://api.github.com/repos/actions/upload-artifact/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq .object.sha --name-only HEAD (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq .object.sha cal/bin/git git 0/x64/bin/node --show-toplevel bash /usr/bin/git git rev-�� --show-toplevel git 0/x64/bin/node --show-toplevel l /usr/bin/git git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq .object.sha /tmp/gh-aw/aw-master.patch node 0/x64/bin/node k/gh-aw/gh-aw/acgit git /opt/hostedtoolc--show-toplevel git rev-�� --show-toplevel node 0/x64/bin/node .cfg git /home/REDACTED/wor--show-toplevel git (http block)
  • https://api.github.com/repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b
    • Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE node (http block)
  • https://api.github.com/repos/github/gh-aw
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw --jq .visibility /tmp/go-build390remote.origin.url -trimpath 64/bin/go -p main -lang=go1.25 go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq .object.sha --noprofile bash /home/REDACTED/work/gh-aw/gh-aw/node_modules/.bin/sh ./../.prettieriggit ortcfg bin/git sh -c "prettier" --write '**/*.cjs' '**/*.ts' '**/*.json' --ignore-path ../../../.prettierignore git /home/REDACTED/work/_temp/ghcca-node/node/bin/sh --name-only HEAD bin/git sh (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq .object.sha git-upload-pack 'origin' git-upload-pack 'origin' 0/x64/bin/node user.email test@example.comrev-parse DiscussionsEnabl--show-toplevel git rev-�� --show-toplevel git 0/x64/bin/node --show-toplevel l /usr/lib/git-cor--show-toplevel git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq .object.sha -b feature-branch 0/x64/bin/node ortcfg.link git /opt/hostedtoolc--show-toplevel git rev-�� --show-toplevel node 0/x64/bin/node f1f5076f0e3ac691git docker /opt/hostedtoolc--show-toplevel git (http block)
  • https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.2.3
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq .object.sha --noprofile bash /home/REDACTED/work/gh-aw/gh-aw/actions/setup/node_modules/.bin/sh ./../.prettieriggit git 99e68578 sh -c "prettier" --write '**/*.cjs' '**/*.ts' '**/*.json' --ignore-patremote.origin.url git /opt/hostedtoolcache/go/1.25.0/x64/bin/sh --name-only HEAD ache/uv/0.10.10/--show-toplevel sh (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq .object.sha --verify --quiet 0/x64/bin/node --show-toplevel git /usr/bin/git git rev-�� --show-toplevel git 0/x64/bin/node --show-toplevel bash /usr/bin/git git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq .object.sha run --auto 0/x64/bin/node --detach git /opt/hostedtoolc--show-toplevel git rev-�� --show-toplevel node 0/x64/bin/node g_.a git /opt/hostedtoolc--show-toplevel git (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/1/artifacts
    • Triggering command: /usr/bin/gh gh run download 1 --dir test-logs/run-1 HEAD h nore HEAD 99e68578 git diff�� te '**/*.cjs' '**/*.ts' '**/*.json' --ignore-path ../../../.prettierignore HEAD .cfg --noprofile bash 99e68578 sed (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/12345/artifacts
    • Triggering command: /usr/bin/gh gh run download 12345 --dir test-logs/run-12345 HEAD in/sh nore HEAD 99e68578 git diff�� te '**/*.cjs' '**/*.ts' '**/*.json' --ignore-path ../../../.pret.prettierignore HEAD nfig/composer/vendor/bin/sh --name-only HEAD 99e68578 sed (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/12346/artifacts
    • Triggering command: /usr/bin/gh gh run download 12346 --dir test-logs/run-12346 pkg/workflow/pr_checkout_test.go Name,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle nore HEAD 99e68578 git diff�� te '**/*.cjs' '**/*.ts' '**/*.jsremote.origin.url HEAD rgo/bin/sh --name-only HEAD 99e68578 /usr/bin/php8.3 (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/2/artifacts
    • Triggering command: /usr/bin/gh gh run download 2 --dir test-logs/run-2 git 919aaf6ca98d0d8499e68578 nore HEAD 99e68578 git diff�� te '**/*.cjs' '**/*.ts' '**/*.json' --ignore-path ../../../.prettierignore HEAD .cfg --noprofile bash 99e68578 sed (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/3/artifacts
    • Triggering command: /usr/bin/gh gh run download 3 --dir test-logs/run-3 git 919aaf6ca98d0d8499e68578 nore HEAD 99e68578 git diff�� te '**/*.cjs' '**/*.ts' '**/*.json' --ignore-path ../../../.prettierignore HEAD .cfg --noprofile bash 99e68578 pidof (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/4/artifacts
    • Triggering command: /usr/bin/gh gh run download 4 --dir test-logs/run-4 git k/gh-aw/gh-aw/actions/setup/js/node_modules/.bin/prettier nore HEAD 99e68578 git diff�� --name-only HEAD .cfg --noprofile erignore ode-gyp-bin/sh find (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/5/artifacts
    • Triggering command: /usr/bin/gh gh run download 5 --dir test-logs/run-5 git k/gh-aw/gh-aw/actions/setup/js/node_modules/.bin/node --name-only HEAD ndor/bin/git git k/gh�� --name-only HEAD .cfg --noprofile bash erignore find (http block)
  • https://api.github.com/repos/github/gh-aw/actions/workflows
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path --name-only HEAD /prettier actions/setup-clnode conntrack emory\|TestBuildrun bash --no�� --noprofile sh 99e68578 "prettier" --wrigit sh 99e68578 git (http block)
    • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 100 --write 99e68578 git diff�� --name-only HEAD 64/bin/bash --name-only HEAD de/node/bin/git git (http block)
    • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 6 HEAD 99e68578 git diff�� rite '**/*.cjs' '**/*.ts' '**/*.json' --ignore-path ../../../.pr**/*.json HEAD sh --noprofile bash 99e68578 gcc (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq .object.sha --noprofile bash 0/x64/bin/bash --noprofile on 64/pkg/tool/linu--write git diff�� h ../../../.pret.prettierignore HEAD cal/bin/git 83-u6s0d8.txt') node --write 64/bin/git git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq .object.sha --show-toplevel sh /usr/bin/git 3797520514 bash /home/REDACTED/go/bin/sh git rev-�� --show-toplevel sh /usr/bin/git runs/20260315-15node git /home/REDACTED/work/gh-aw/gh-aw/ac--show-toplevel git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq .object.sha --show-toplevel git /usr/bin/gh --show-toplevel git 0/x64/bin/node gh api /repos/actions/checkout/git/ref/tags/v3 --jq /usr/bin/git --show-toplevel git 0/x64/bin/node git (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.2.3
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq .object.sha --name-only HEAD node "prettier" --wrigit node de/node/bin/git git diff�� --name-only HEAD rgo/bin/git --noprofile git 99e68578 bash (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v2.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq .object.sha --name-only HEAD de/node/bin/bash "prettier" --wrigit node 99e68578 bash --no�� --noprofile bash x86_64/bash --noprofile git de/node/bin/bash/tmp/gh-aw-test-runs/20260315-154001-20655/test-135016234/.github/workflows grep (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq .object.sha --name-only HEAD _modules/.bin/sh ../../../**/*.jsgit !../../../pkg/wo-C tnet/tools/bash bash --no�� on' --ignore-patremote.origin.url bash 919aaf6ca98d0d8499e68578 --noprofile git ache/go/1.25.0/x--show-toplevel git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq .object.sha --noprofile node 99e68578 --write ../../../**/*.jsrev-parse x86_64/git git diff�� on' --ignore-path ../../../.pret.prettierignore HEAD 99e68578 --name-only HEAD 99e68578 git (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v3.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq .object.sha --name-only HEAD odules/npm/node_modules/@npmcli/run-script/lib/node-gyp-bin/node "prettier" --wrigit node 99e68578 ns-lock.json doerev-parse --no�� w/actions/stop_mcp_gateway.sh|bash \${GH_AW_HOME}/actions/stop_mcp_gateway.sh|g plate_injection_validation_test.go 64/bin/bash --noprofile git 99e68578 git (http block)
  • https://api.github.com/repos/githubnext/agentics/git/ref/tags/
    • Triggering command: /usr/bin/gh gh api /repos/githubnext/agentics/git/ref/tags/# --jq .object.sha IP1v/6W5K8jb4A8GOUTPUT GO111MODULE $name) { hasDiscussionsEnabled } } GOINSECURE GOMOD GOMODCACHE 1340976/b388/imp53 -c 1340976/b388/embACCEPT GOPROXY 64/bin/go GOSUMDB GOWORK 64/bin/go /opt/hostedtoolcrev-parse (http block)
  • https://api.github.com/repos/nonexistent/action/git/ref/tags/v999.999.999
    • Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq .object.sha --noprofile conntrack 99e68578 INVALID,NEW -j DROP git diff�� h ../../../.pret.prettierignore HEAD /node prettier --write (http block)
    • Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq .object.sha --show-toplevel sh /usr/bin/git npx prettier --wnode bash /opt/hostedtoolcstatus,conclusio--show-toplevel git rev-�� --show-toplevel sh (http block)
    • Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq .object.sha --show-toplevel git (http block)
  • https://api.github.com/repos/nonexistent/repo/actions/runs/12345
    • Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion --name-only HEAD 0/x64/bin/bash git -c te 'scripts/**/*.js' --ignore-path .prettierignore --log-level=error log k/gh-aw/node_modules/.bin/node --format=%H:%ct bash cal/bin/git bash (http block)
  • https://api.github.com/repos/owner/repo/actions/workflows
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo 99e68578 --format %(refname) ache/node/24.14.npx prettier --write '../../../**/*.json' '!../../../pkg/workflow/js/**/*.json' --ignore-path bash /pre�� --noprofile sh x_amd64/link "prettier" --wribash sh 99e68578 x_amd64/link (http block)
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo de/node/bin/git /tmp/go-build161sh -trimpath 99e68578 git /pre�� --name-only HEAD 99e68578 "prettier" --wribash -goversion 0/x64/bin/git bash (http block)
  • https://api.github.com/repos/owner/repo/contents/file.md
    • Triggering command: /tmp/go-build1275292035/b359/cli.test /tmp/go-build1275292035/b359/cli.test -test.testlogfile=/tmp/go-build1275292035/b359/testlog.txt -test.paniconexit0 -test.timeout=10m0s diff�� --name-only mpts_test.go de te '../../../**/node HEAD /home/REDACTED/worprettier git diff�� --name-only HEAD tnet/tools/bash npx prettier --wsh git 99e68578 bash (http block)
  • https://api.github.com/repos/test-owner/test-repo/actions/secrets
    • Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name --name-only HEAD 64/bin/git pkg/workflow/datnode owner 0/x64/bin/git bash --no�� h ../../../.prettierignore sh modules/@npmcli/run-script/lib/node-gyp-bin/node "prettier" --wrigit sh 0/x64/bin/bash sed (http block)

If you need me to access, download, or install something from one of these locations, you can either:

Original prompt

Recreate this PR for the current mai branch.

#20864


🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.

Copilot AI and others added 2 commits March 15, 2026 15:27
- Add GhAwHome, GhAwHomeJS, GhAwHomeExpr, GhAwHomeExprDefault constants
- Add JsRequireGhAw() helper for JS require() expressions
- Update SetupActionDestination to use GhAwHomeExpr
- Add GhAwHomeDefault constant to pkg/constants
- Update DefaultGhAwMount to use shell expansion
- Add GH_AW_HOME to job-level env in agent, safe-outputs, conclusion,
  push_repo_memory, and update_cache_memory jobs
- Replace all hardcoded /opt/gh-aw paths in 30+ source files
- Update test assertions to match new dynamic path expressions
- Fix insertIndex calculation in compiler_safe_outputs_job.go to use
  hasCustomTokenSafeOutputs() for accurate line counting

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copilot AI changed the title [WIP] Recreate PR for the current main branch refactor: replace hardcoded /opt/gh-aw paths with GH_AW_HOME constants Mar 15, 2026
Copilot AI requested a review from pelikhan March 15, 2026 15:48
@github-actions

This comment has been minimized.

@github-actions

This comment has been minimized.

@github-actions

This comment has been minimized.

@pelikhan
Copy link
Contributor

@copilot merge main and recompile

Copilot AI and others added 2 commits March 16, 2026 19:34
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copy link
Contributor Author

Copilot AI commented Mar 16, 2026

@copilot merge main and recompile

Done. Merged origin/main (resolved conflicts — main's refactoring commit moved step-builder functions from safe_outputs_jobs.go into new files; applied our GH_AW_HOME path changes to the new safe_outputs_steps.go) and recompiled all 172 workflow lock files (ec10111).

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

  • https://api.github.com/graphql
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw (http block)
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw ml (http block)
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw jsonrpc2 (http block)
  • https://api.github.com/repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b
    • Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq .object.sha (http block)
  • https://api.github.com/repos/github/gh-aw
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw --jq .visibility get --local x86_64/bash pull.rebase (http block)
  • https://api.github.com/repos/githubnext/agentics/git/ref/tags/
    • Triggering command: /usr/bin/gh gh api /repos/githubnext/agentics/git/ref/tags/# --jq .object.sha js/**/*.json&#39; --ignore-path ../../../.prettierignore -pr-for-current-main $name) { hasDiscussionsEnabled } } (http block)

If you need me to access, download, or install something from one of these locations, you can either:

@pelikhan pelikhan added the smoke label Mar 16, 2026
@pelikhan pelikhan marked this pull request as ready for review March 16, 2026 21:04
Copilot AI review requested due to automatic review settings March 16, 2026 21:04
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot wasn't able to review this pull request because it exceeds the maximum number of files (300). Try reducing the number of changed files and requesting a review from Copilot again.

@github-actions

This comment has been minimized.

@github-actions
Copy link
Contributor

Hey @Copilot 👋 — great work on the GhAwHome/GhAwHomeJS/GhAwHomeExpr abstractions! Replacing hardcoded /opt/gh-aw paths across the compiler is a solid improvement that will finally let self-hosted runners relocate the installation directory. The PR body is thorough, the constant table is clear, and the test coverage across pkg/workflow/ and actions/setup/js/ is excellent.

That said, there is one significant issue to address before this can be reviewed cleanly:


⚠️ Unfocused — multiple distinct features are bundled together

The title describes a path-constants refactor, but the diff spans at least 5 separate concerns, each backed by its own changeset entry:

Concern Key files Changeset
GhAwHome path constants pkg/workflow/setup_action_paths.go, pkg/constants/constants.go, 173 lock files patch-gh-aw-home-path-constants.md
New label_command trigger pkg/workflow/label_command.go (+95), label_command_parser.go (+19), label_command_test.go (+455) patch-add-label-command-trigger.md
Reaction + status-comment defaults pkg/workflow/on_steps_test.go (+509) minor-enable-reaction-status-comment-by-default.md
Domains command pkg/cli/domains_command.go (+271), domains_command_test.go (+360)
Go SDK security fix + awf bump go.mod, go.sum patch-update-go-sdk-security-fix.md, patch-bump-awf-v0-24-2.md

Each of these is a standalone, reviewable unit. Bundling them makes it very difficult for reviewers to reason about correctness and for bisect to isolate regressions.

Suggestion: split into at least 3 PRs:

  1. Path constants refactor (the stated subject) + lock file recompilation
  2. label_command trigger + reaction/status-comment defaults (the new trigger behaviour)
  3. Domains command + SDK/awf dependency updates

If you'd like a hand splitting this up, you can assign this prompt to your coding agent:

The PR github/gh-aw#21082 bundles multiple unrelated changes. Split it into focused pull requests as follows:

**PR 1 — GhAwHome path constants refactor**
Files to include:
- pkg/workflow/setup_action_paths.go (GhAwHome, GhAwHomeJS, GhAwHomeExpr, GhAwHomeExprDefault, JsRequireGhAw constants)
- pkg/constants/constants.go (GhAwHomeDefault, DefaultGhAwMount updates)
- All compiler_*.go files where /opt/gh-aw occurrences are replaced with typed constants
- .github/workflows/*.lock.yml (the 173 recompiled lock files)
- .changeset/patch-gh-aw-home-path-constants.md

**PR 2 — label_command trigger + reaction/status-comment defaults**
Files to include:
- pkg/workflow/label_command.go
- pkg/workflow/label_command_parser.go
- pkg/workflow/label_command_test.go
- pkg/workflow/on_steps_test.go (reaction/status-comment default coverage)
- docs/src/content/docs/reference/triggers.md
- .changeset/patch-add-label-command-trigger.md
- .changeset/minor-enable-reaction-status-comment-by-default.md
- Recompile lock files: run `make recompile`

**PR 3 — Domains command + dependency updates**
Files to include:
- pkg/cli/domains_command.go + domains_command_test.go
- pkg/workflow/domains.go + domains_test.go + data/ecosystem_domains.json
- go.mod + go.sum (Go SDK security fix + awf v0.24.2 bump)
- .changeset/patch-update-go-sdk-security-fix.md
- .changeset/patch-bump-awf-v0-24-2.md

For each PR:
1. Create a new branch from main
2. Cherry-pick or re-apply only the relevant files
3. Run `make agent-finish` to validate build, tests, lint, and recompile pass
4. Open the PR with a focused title and description

Generated by Contribution Check ·

@pelikhan
Copy link
Contributor

@copilot merge main

Copilot AI and others added 2 commits March 17, 2026 15:19
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copy link
Contributor Author

Copilot AI commented Mar 17, 2026

@copilot merge main

Done. Merged origin/main and recompiled all 173 lock files (98405d1). Conflicts resolved:

  • safe_outputs_steps.go: kept JsRequireGhAw() path changes + added new debug log lines from main
  • mcp_setup_generator.go: applied GhAwHome to main's renamed tools_meta.json write and new node invocation
  • prompt_constants.go: kept GhAwHome + "/prompts" + added main's two new prompt file constants
  • git_configuration_steps.go: merged both continue-on-error: true (from main) and GhAwHome path (from ours)
  • domains.go: removed duplicate function definitions introduced by auto-merge
  • compiler_safe_outputs_job.go: took main's cleaner len() approach

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

  • https://api.github.com/graphql
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw (http block)
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw 2ZfNHBwc7Bp9 (http block)
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw ota=5% yHigh=170M (http block)
  • https://api.github.com/repos/actions/setup-node/git/ref/tags/v6
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v6 --jq .object.sha k.yml nce-analyzer.locowner=github explorer.lock.ym-f ock.yml l ary.lock.yml s.lock.yml sues�� d -n 10 lock.yml r: $owner, name: $name) { hasDiscussionsEnabled } } e-checker.lock.y/usr/bin/gh .yml yml .yml (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v6 --jq .object.sha k.yml nce-analyzer.lock.yml 64/bin/go ock.yml l ary.lock.yml s.lock.yml sues�� d -n 10 rty ndor/bin/sh e-checker.lock.ygit .yml yml .yml (http block)
  • https://api.github.com/repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b
    • Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq .object.sha re --log-level=error go x_amd64/cgo (http block)
  • https://api.github.com/repos/github/gh-aw
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw --jq .visibility --local user.name n-dir/bash (http block)
  • https://api.github.com/repos/githubnext/agentics/git/ref/tags/
    • Triggering command: /usr/bin/gh gh api /repos/githubnext/agentics/git/ref/tags/# --jq .object.sha js/**/*.json&#39; --ignore-path ../../../.prettierignore (http block)

If you need me to access, download, or install something from one of these locations, you can either:

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants