Skip to content

Fix Copilot CLI path for agentic workflows #37447

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kubaflo merged 5 commits into from
Aug 20, 2026
Merged

Fix Copilot CLI path for agentic workflows #37447

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
b07fe50
Fix agentic workflow Copilot CLI path
Aug 15, 2026
2732c13
Align gh-aw container pins
Aug 15, 2026
9eea171
Complete gh-aw v0.86.2 upgrade
Aug 18, 2026
6d34d8e
Pin agentic workflow guidance
Aug 18, 2026
8f91d43
Remove missing gh-aw guide reference
Aug 18, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 11 additions & 11 deletions .github/aw/actions-lock.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,10 +25,10 @@
"version": "v7.0.1",
"sha": "043fb46d1a93c77aae656e7c1c64a875d1fc6a0a"
},
"github/gh-aw-actions/setup@v0.85.4": {
"github/gh-aw-actions/setup@v0.86.2": {
"repo": "github/gh-aw-actions/setup",
"version": "v0.85.4",
"sha": "2709137ea6c5b0e19aa621454dc643ea8dc526b1"
"version": "v0.86.2",
Comment thread
kubaflo marked this conversation as resolved.
Resolved
"sha": "6aab9e5b5c91c615506061f09bedd81a23babe3c"
}
Comment thread
kubaflo marked this conversation as resolved.
Resolved
},
"containers": {
Expand All @@ -47,20 +47,20 @@
"digest": "sha256:83e48bbe12c634be8c228a576832fe45f66c529ac3659db92bddbcf2eeb6d627",
"pinned_image": "ghcr.io/github/gh-aw-firewall/squid:0.27.44@sha256:83e48bbe12c634be8c228a576832fe45f66c529ac3659db92bddbcf2eeb6d627"
},
"ghcr.io/github/gh-aw-mcpg:v0.4.8": {
"image": "ghcr.io/github/gh-aw-mcpg:v0.4.8",
"digest": "sha256:38bbea36cdb46a3c9d04d1db05e672966f5239b431a2022eb35881688e5721d8",
"pinned_image": "ghcr.io/github/gh-aw-mcpg:v0.4.8@sha256:38bbea36cdb46a3c9d04d1db05e672966f5239b431a2022eb35881688e5721d8"
"ghcr.io/github/gh-aw-mcpg:v0.4.9": {
"image": "ghcr.io/github/gh-aw-mcpg:v0.4.9",
"digest": "sha256:e5a1569aeaf41820fa7bdee3e94468cae448133cdbf00119ad24f5b74db1ab9f",
"pinned_image": "ghcr.io/github/gh-aw-mcpg:v0.4.9@sha256:e5a1569aeaf41820fa7bdee3e94468cae448133cdbf00119ad24f5b74db1ab9f"
},
"ghcr.io/github/gh-aw-node": {
"image": "ghcr.io/github/gh-aw-node",
"digest": "sha256:0d9f1fb5fd6610c0ac1f5194a38e45a8a1e81f8a390d5142d8e4e6f26a4b3196",
"pinned_image": "ghcr.io/github/gh-aw-node@sha256:0d9f1fb5fd6610c0ac1f5194a38e45a8a1e81f8a390d5142d8e4e6f26a4b3196"
},
"ghcr.io/github/github-mcp-server:v1.8.0": {
"image": "ghcr.io/github/github-mcp-server:v1.8.0",
"digest": "sha256:d5a18c04b92714c309eb46a2305087e91a4dbd80420f6e462656699f95093520",
"pinned_image": "ghcr.io/github/github-mcp-server:v1.8.0@sha256:d5a18c04b92714c309eb46a2305087e91a4dbd80420f6e462656699f95093520"
"ghcr.io/github/github-mcp-server:v1.9.0": {
"image": "ghcr.io/github/github-mcp-server:v1.9.0",
"digest": "sha256:881b53d6f75f69bdbc1b5b10fc2f1361717c19054143b3a8529fb5c32061a50e",
"pinned_image": "ghcr.io/github/github-mcp-server:v1.9.0@sha256:881b53d6f75f69bdbc1b5b10fc2f1361717c19054143b3a8529fb5c32061a50e"
}
}
}
253 changes: 128 additions & 125 deletions .github/workflows/agentic-labeler.lock.yml
View file
Open in desktop

Large diffs are not rendered by default.

1 change: 1 addition & 0 deletions .github/workflows/agentic-labeler.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -92,6 +92,7 @@ safe-outputs:
# for the issue-creation step is correctly suppressed.

tools:
bash: false

@PureWeen PureWeen Aug 17, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[moderate] Cross-Component Consistency — bash: false correctly satisfies the v0.86.2 strict rule for min-integrity: none, and the compiled agent invocation drops to --allow-tool github --allow-tool safeoutputs --allow-tool write (agentic-labeler.lock.yml:827) with no shell tool. However the compiler still injects the MCP-CLI prompt into this workflow's prompt ({"file":"mcp_cli_tools_prompt.md"} in GH_AW_PROMPT_CONFIG, agentic-labeler.lock.yml:304) and still mounts ${RUNNER_TEMP}/gh-aw/mcp-cli/bin on PATH (line 827). That prompt text (gh-aw v0.86.2 actions/setup/md/mcp_cli_tools_prompt.md) instructs the agent: "Invoke them from bash" and "For safeoutputs ... always use the CLI commands above." Concrete failure scenario: on a real labeler run the agent follows that instruction, attempts a shell invocation it no longer has permission for, and can end the turn without emitting add_labels/noop — a silent no-label run rather than a hard failure (and this workflow deliberately disables failure-issue reporting, so it would not surface). safeoutputs is still reachable as an MCP tool, so this is recoverable, but please validate one live labeler run (issue opened → label applied) before merging, and consider reporting the prompt/capability mismatch upstream.

@kubaflo kubaflo Aug 18, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Confirmed the prompt/capability mismatch in the v0.86.2 output: the generated prompt says safeoutputs must be invoked from Bash while strict min-integrity: none requires tools.bash: false. There is no safe local workaround without either weakening first-time-contributor coverage or violating strict mode, so I reported it upstream as github/gh-aw#53532. A true live run cannot safely validate this unmerged fork workflow on dotnet/maui, and the fork does not have the target repo PAT-pool environment; I’m leaving this thread open pending the upstream fix or post-merge live evidence.

github:
# `default` gives us issues, repos, pull_requests, context.
# `labels` adds `list_label` (singular) and `get_label` — needed for
Expand Down
270 changes: 129 additions & 141 deletions .github/workflows/aw-actions-update.lock.yml
View file
Open in desktop

Large diffs are not rendered by default.

263 changes: 125 additions & 138 deletions .github/workflows/aw-version-update.lock.yml
View file
Open in desktop

Large diffs are not rendered by default.

298 changes: 157 additions & 141 deletions .github/workflows/ci-status-fix-net11.lock.yml
View file
Open in desktop

Large diffs are not rendered by default.

298 changes: 157 additions & 141 deletions .github/workflows/ci-status-fix.lock.yml
View file
Open in desktop

Large diffs are not rendered by default.

257 changes: 122 additions & 135 deletions .github/workflows/ci-status-main.lock.yml
View file
Open in desktop

Large diffs are not rendered by default.

257 changes: 122 additions & 135 deletions .github/workflows/ci-status-net11.lock.yml
View file
Open in desktop

Large diffs are not rendered by default.

278 changes: 147 additions & 131 deletions .github/workflows/copilot-evaluate-tests.lock.yml
View file
Open in desktop

Large diffs are not rendered by default.

278 changes: 147 additions & 131 deletions .github/workflows/copilot-review-tests.lock.yml
View file
Open in desktop

Large diffs are not rendered by default.

261 changes: 124 additions & 137 deletions .github/workflows/daily-leak-hunter.lock.yml
View file
Open in desktop

Large diffs are not rendered by default.

250 changes: 125 additions & 125 deletions .github/workflows/daily-repo-status.lock.yml
View file
Open in desktop

Large diffs are not rendered by default.

292 changes: 151 additions & 141 deletions .github/workflows/leak-fixer.lock.yml
View file
Open in desktop

Large diffs are not rendered by default.

257 changes: 129 additions & 128 deletions .github/workflows/regression-corpus-scanner.lock.yml
View file
Open in desktop

Large diffs are not rendered by default.

250 changes: 125 additions & 125 deletions .github/workflows/rerun-review-scanner.lock.yml
View file
Open in desktop

Large diffs are not rendered by default.

Loading