# gh-aw-manifest: {"version":1,"secrets":["COPILOT_GITHUB_TOKEN","GH_AW_CI_TRIGGER_TOKEN","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/cache/restore","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/cache/save","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/checkout","sha":"9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0","version":"v7"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"373c709c69115d41ff229c7e5df9f8788daa9553","version":"v9"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"820762786026740c76f36085b0efc47a31fe5020","version":"v7.0.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"},{"repo":"github/gh-aw-actions/setup","sha":"8bdba8075360648fe6802302a5b4e016361dc6ac","version":"v0.83.1"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.27.38","digest":"sha256:cb928eb62d9139a013c2d278dab19af232d35a2d83dca71a3d98eb431f786243","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.27.38@sha256:cb928eb62d9139a013c2d278dab19af232d35a2d83dca71a3d98eb431f786243"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.38","digest":"sha256:cd6145620d96acee46e1ede25180a13aa36002467e663db0caa453a8bc8eb60c","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.38@sha256:cd6145620d96acee46e1ede25180a13aa36002467e663db0caa453a8bc8eb60c"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.27.38","digest":"sha256:6c19094d95aad5f9f128ad5e583f0f2b894b158aa66c3b86dd9bcc90970a2917","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.27.38@sha256:6c19094d95aad5f9f128ad5e583f0f2b894b158aa66c3b86dd9bcc90970a2917"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.4.3","digest":"sha256:3c744710ea275cd5ee65db92a1099e0d980754bd9fafda9ce67704c67004dc83","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.4.3@sha256:3c744710ea275cd5ee65db92a1099e0d980754bd9fafda9ce67704c67004dc83"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b","pinned_image":"ghcr.io/github/gh-aw-node@sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b"},{"image":"ghcr.io/github/github-mcp-server:v1.6.0","digest":"sha256:2b0c48b070f61e9d3969269ead600f62d00fb237b60ac849ef3d166ee7de9ad3","pinned_image":"ghcr.io/github/github-mcp-server:v1.6.0@sha256:2b0c48b070f61e9d3969269ead600f62d00fb237b60ac849ef3d166ee7de9ad3"}]}

name: "Java Codegen Agentic Fix"

on:

workflow_dispatch:

inputs:

aw_context:

default: ""

description: "Agent caller context (used internally by Agentic Workflows)."

required: false

type: string

branch:

description: Branch to fix

required: true

type: string

error_summary:

description: Summary of mvn verify failures

required: true

type: string

pr_number:

description: PR number to push fixes to

required: true

type: string

permissions: {}

concurrency:

group: "gh-aw-${{ github.workflow }}-${{ github.ref || github.run_id }}"

run-name: "Java Codegen Agentic Fix"

jobs:

activation:

runs-on: ubuntu-slim

permissions:

actions: read

contents: read

env:

GH_AW_MAX_DAILY_AI_CREDITS: ${{ vars.GH_AW_DEFAULT_MAX_DAILY_AI_CREDITS || '5000' }}

GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }}

outputs:

comment_id: ""

comment_repo: ""

daily_ai_credits_exceeded: ${{ steps.daily-effective-workflow-guardrail.outputs.daily_ai_credits_exceeded == 'true' }}

daily_ai_credits_threshold: ${{ steps.daily-effective-workflow-guardrail.outputs.daily_ai_credits_threshold || '' }}

daily_ai_credits_total_effective_tokens: ${{ steps.daily-effective-workflow-guardrail.outputs.daily_ai_credits_total_effective_tokens || '' }}

engine_id: ${{ steps.generate_aw_info.outputs.engine_id }}

lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }}

model: ${{ steps.generate_aw_info.outputs.model }}

oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }}

setup-parent-span-id: ${{ steps.setup.outputs.parent-span-id || steps.setup.outputs.span-id }}

setup-span-id: ${{ steps.setup.outputs.span-id }}

setup-trace-id: ${{ steps.setup.outputs.trace-id }}

stale_lock_file_failed: ${{ steps.check-lock-file.outputs.stale_lock_file_failed == 'true' }}

steps:

- name: Setup Scripts

id: setup

uses: github/gh-aw-actions/setup@8bdba8075360648fe6802302a5b4e016361dc6ac # v0.83.1

with:

destination: ${{ runner.temp }}/gh-aw/actions

job-name: ${{ github.job }}

safe-output-artifact-client: ${{ env.GH_AW_MAX_DAILY_AI_CREDITS != '' }}

env:

GH_AW_SETUP_WORKFLOW_NAME: "Java Codegen Agentic Fix"

GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/java-codegen-fix.lock.yml@${{ github.ref }}

GH_AW_INFO_VERSION: "1.0.73"

GH_AW_INFO_AWF_VERSION: "v0.27.38"

GH_AW_INFO_ENGINE_ID: "copilot"

- name: Generate agentic run info

id: generate_aw_info

env:

GH_AW_INFO_ENGINE_ID: "copilot"

GH_AW_INFO_ENGINE_NAME: "GitHub Copilot CLI"

GH_AW_INFO_MODEL: ${{ vars.GH_AW_MODEL_AGENT_COPILOT || vars.GH_AW_DEFAULT_MODEL_COPILOT || 'claude-sonnet-4.6' }}

GH_AW_INFO_VERSION: "1.0.73"

GH_AW_INFO_AGENT_VERSION: "1.0.73"

GH_AW_INFO_CLI_VERSION: "v0.83.1"

GH_AW_INFO_WORKFLOW_NAME: "Java Codegen Agentic Fix"

GH_AW_INFO_EXPERIMENTAL: "false"

GH_AW_INFO_SUPPORTS_TOOLS_ALLOWLIST: "true"

GH_AW_INFO_STAGED: "false"

GH_AW_INFO_ALLOWED_DOMAINS: '["defaults","github"]'

GH_AW_INFO_FIREWALL_ENABLED: "true"

GH_AW_INFO_AWF_VERSION: "v0.27.38"

GH_AW_INFO_AWMG_VERSION: ""

GH_AW_INFO_FIREWALL_TYPE: "squid"

GH_AW_COMPILED_STRICT: "true"

uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0

with:

script: |

- name: Restore daily AIC usage cache

id: restore-daily-aic-cache

if: ${{ env.GH_AW_MAX_DAILY_AI_CREDITS != '' }}

continue-on-error: true

uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0

with:

key: agentic-workflow-usage-javacodegenfix-${{ github.run_id }}

restore-keys: agentic-workflow-usage-javacodegenfix-

path: /tmp/gh-aw/agentic-workflow-usage-cache.jsonl

- name: Restore daily AIC usage cache (artifact fallback)

id: restore-daily-aic-cache-fallback

if: ${{ env.GH_AW_MAX_DAILY_AI_CREDITS != '' }}

continue-on-error: true

uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0

env:

GH_AW_RESTORE_DAILY_AIC_CACHE_HIT: ${{ steps.restore-daily-aic-cache.outputs.cache-hit }}

GH_AW_RESTORE_DAILY_AIC_CACHE_MATCHED_KEY: ${{ steps.restore-daily-aic-cache.outputs.cache-matched-key }}

with:

github-token: ${{ secrets.GITHUB_TOKEN }}

script: |

- name: Check daily workflow token guardrail

id: daily-effective-workflow-guardrail

if: ${{ env.GH_AW_MAX_DAILY_AI_CREDITS != '' }}

uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0

env:

GH_AW_WORKFLOW_NAME: "Java Codegen Agentic Fix"

GH_AW_WORKFLOW_ID: "java-codegen-fix"

GH_AW_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}

GH_AW_WORKFLOW_DISPATCH_AW_CONTEXT: ${{ github.event.inputs.aw_context || '' }}

GH_AW_HAS_SLASH_COMMAND: "false"

GH_AW_HAS_LABEL_COMMAND: "false"

GH_AW_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

GH_AW_MAX_DAILY_AI_CREDITS: ${{ vars.GH_AW_DEFAULT_MAX_DAILY_AI_CREDITS || '5000' }}

with:

github-token: ${{ secrets.GITHUB_TOKEN }}

script: |

- name: Check for OAuth tokens

id: check-oauth-tokens

run: bash "${RUNNER_TEMP}/gh-aw/actions/check_oauth_tokens.sh"

env:

COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}

GH_AW_GITHUB_TOKEN: ${{ secrets.GH_AW_GITHUB_TOKEN }}

GH_AW_GITHUB_MCP_SERVER_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN }}

- name: Checkout .github and .agents folders

uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7

with:

persist-credentials: false

sparse-checkout: |

sparse-checkout-cone-mode: true

fetch-depth: 1

- name: Save agent config folders for base branch restoration

env:

GH_AW_AGENT_FOLDERS: ".agents .antigravity .claude .codex .gemini .github .opencode .pi"

GH_AW_AGENT_FILES: "AGENTS.md ANTIGRAVITY.md CLAUDE.md GEMINI.md PI.md opencode.jsonc"

# poutine:ignore untrusted_checkout_exec

run: bash "${RUNNER_TEMP}/gh-aw/actions/save_base_github_folders.sh"

- name: Check workflow lock file

id: check-lock-file

uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0

env:

GH_AW_WORKFLOW_FILE: "java-codegen-fix.lock.yml"

GH_AW_CONTEXT_WORKFLOW_REF: "${{ github.workflow_ref }}"

with:

script: |

- name: Check compile-agentic version

uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0

env:

GH_AW_COMPILED_VERSION: "v0.83.1"

with:

script: |

- name: Log runtime features

if: ${{ contains(toJSON(vars), '"GH_AW_RUNTIME_FEATURES":') }}

run: bash "${RUNNER_TEMP}/gh-aw/actions/log_runtime_features_summary.sh"

- name: Create prompt with built-in context

env:

GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt

GH_AW_SAFE_OUTPUTS: ${{ runner.temp }}/gh-aw/safeoutputs/outputs.jsonl

GH_AW_EXPR_1A3A194A: ${{ github.event.discussion.number || (fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_type == 'discussion' && fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_number) }}

GH_AW_EXPR_463A214A: ${{ github.event.pull_request.number || (fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_type == 'pull_request' && fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_number) }}

GH_AW_EXPR_802A9F6A: ${{ github.event.issue.number || (fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_type == 'issue' && fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_number) }}

GH_AW_EXPR_FF1D34CE: ${{ github.event.comment.id || fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').comment_id }}

GH_AW_GITHUB_ACTOR: ${{ github.actor }}

GH_AW_GITHUB_REPOSITORY: ${{ github.repository }}

GH_AW_GITHUB_RUN_ID: ${{ github.run_id }}

GH_AW_GITHUB_WORKSPACE: ${{ github.workspace }}

GH_AW_INPUTS_BRANCH: ${{ inputs.branch }}

GH_AW_INPUTS_ERROR_SUMMARY: ${{ inputs.error_summary }}

GH_AW_INPUTS_PR_NUMBER: ${{ inputs.pr_number }}

# poutine:ignore untrusted_checkout_exec

run: |

- name: Interpolate variables and render templates

uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0

env:

GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt

GH_AW_ENGINE_ID: "copilot"

GH_AW_INPUTS_BRANCH: ${{ inputs.branch }}

GH_AW_INPUTS_ERROR_SUMMARY: ${{ inputs.error_summary }}

GH_AW_INPUTS_PR_NUMBER: ${{ inputs.pr_number }}

with:

script: |

- name: Substitute placeholders

uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0

env:

GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt

GH_AW_EXPR_1A3A194A: ${{ github.event.discussion.number || (fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_type == 'discussion' && fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_number) }}

GH_AW_EXPR_463A214A: ${{ github.event.pull_request.number || (fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_type == 'pull_request' && fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_number) }}

GH_AW_EXPR_802A9F6A: ${{ github.event.issue.number || (fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_type == 'issue' && fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_number) }}

GH_AW_EXPR_FF1D34CE: ${{ github.event.comment.id || fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').comment_id }}

GH_AW_GITHUB_ACTOR: ${{ github.actor }}

GH_AW_GITHUB_REPOSITORY: ${{ github.repository }}

GH_AW_GITHUB_RUN_ID: ${{ github.run_id }}

GH_AW_GITHUB_WORKSPACE: ${{ github.workspace }}

GH_AW_INPUTS_BRANCH: ${{ inputs.branch }}

GH_AW_INPUTS_ERROR_SUMMARY: ${{ inputs.error_summary }}

GH_AW_INPUTS_PR_NUMBER: ${{ inputs.pr_number }}

GH_AW_MCP_CLI_SERVERS_LIST: "- `github` — run `github --help` to see available tools\n- `safeoutputs` — run `safeoutputs --help` to see available tools"

with:

script: |

- name: Validate prompt placeholders

env:

GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt

# poutine:ignore untrusted_checkout_exec

run: bash "${RUNNER_TEMP}/gh-aw/actions/validate_prompt_placeholders.sh"

- name: Print prompt

env:

GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt

# poutine:ignore untrusted_checkout_exec

run: bash "${RUNNER_TEMP}/gh-aw/actions/print_prompt_summary.sh"

- name: Upload activation artifact

if: success()

uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1

with:

name: activation

include-hidden-files: true

path: |

if-no-files-found: ignore

retention-days: 1

agent:

needs: activation

if: needs.activation.outputs.daily_ai_credits_exceeded != 'true'

runs-on: ubuntu-latest

permissions:

actions: read

contents: read

copilot-requests: write

env:

DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}

GH_AW_ASSETS_ALLOWED_EXTS: ""

GH_AW_ASSETS_BRANCH: ""

GH_AW_ASSETS_MAX_SIZE_KB: 0

GH_AW_MCP_LOG_DIR: /tmp/gh-aw/mcp-logs/safeoutputs

GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }}

GH_AW_WORKFLOW_ID_SANITIZED: javacodegenfix

outputs:

agentic_engine_timeout: ${{ steps.detect-agent-errors.outputs.agentic_engine_timeout || 'false' }}

ai_credits_rate_limit_error: ${{ steps.parse-mcp-gateway.outputs.ai_credits_rate_limit_error || 'false' }}

aic: ${{ steps.parse-mcp-gateway.outputs.aic }}

ambient_context: ${{ steps.parse-mcp-gateway.outputs.ambient_context }}

checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}

effective_tokens: ${{ steps.parse-mcp-gateway.outputs.effective_tokens }}

has_patch: ${{ steps.collect_output.outputs.has_patch }}

http_400_response_error: ${{ steps.detect-agent-errors.outputs.http_400_response_error || 'false' }}

inference_access_error: ${{ steps.detect-agent-errors.outputs.inference_access_error || 'false' }}

invocation_cap_exceeded: ${{ steps.detect-agent-errors.outputs.invocation_cap_exceeded || 'false' }}

mcp_policy_error: ${{ steps.detect-agent-errors.outputs.mcp_policy_error || 'false' }}

model: ${{ needs.activation.outputs.model }}

model_not_supported_error: ${{ steps.detect-agent-errors.outputs.model_not_supported_error || 'false' }}

output: ${{ steps.collect_output.outputs.output }}

output_types: ${{ steps.collect_output.outputs.output_types }}

setup-parent-span-id: ${{ steps.setup.outputs.parent-span-id || steps.setup.outputs.span-id }}

setup-span-id: ${{ steps.setup.outputs.span-id }}

setup-trace-id: ${{ steps.setup.outputs.trace-id }}

unknown_model_ai_credits: ${{ steps.parse-mcp-gateway.outputs.unknown_model_ai_credits || 'false' }}

steps:

- name: Setup Scripts

id: setup

uses: github/gh-aw-actions/setup@8bdba8075360648fe6802302a5b4e016361dc6ac # v0.83.1

with:

destination: ${{ runner.temp }}/gh-aw/actions

job-name: ${{ github.job }}

trace-id: ${{ needs.activation.outputs.setup-trace-id }}

parent-span-id: ${{ needs.activation.outputs.setup-parent-span-id || needs.activation.outputs.setup-span-id }}

env:

GH_AW_SETUP_WORKFLOW_NAME: "Java Codegen Agentic Fix"

GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/java-codegen-fix.lock.yml@${{ github.ref }}

GH_AW_INFO_VERSION: "1.0.73"

GH_AW_INFO_AWF_VERSION: "v0.27.38"

GH_AW_INFO_ENGINE_ID: "copilot"

- name: Set runtime paths

id: set-runtime-paths

run: |

- name: Checkout repository

uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7

with:

persist-credentials: false

- name: Create gh-aw temp directory

run: bash "${RUNNER_TEMP}/gh-aw/actions/create_gh_aw_tmp_dir.sh"

- name: Configure gh CLI for GitHub Enterprise

run: bash "${RUNNER_TEMP}/gh-aw/actions/configure_gh_for_ghe.sh"

env:

GH_TOKEN: ${{ github.token }}

- name: Download activation artifact

uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1

with:

name: activation

path: /tmp/gh-aw

- name: Configure Git credentials

env:

GITHUB_REPOSITORY: ${{ github.repository }}

GITHUB_SERVER_URL: ${{ github.server_url }}

GITHUB_TOKEN: ${{ github.token }}

run: bash "${RUNNER_TEMP}/gh-aw/actions/configure_git_credentials.sh"

- name: Checkout PR branch

id: checkout-pr

if: |

uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0

env:

GH_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}

with:

github-token: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}

script: |

- name: Install GitHub Copilot CLI

run: bash "${RUNNER_TEMP}/gh-aw/actions/install_copilot_cli.sh" 1.0.73

env:

GH_HOST: github.com

- name: Install AWF binary

run: bash "${RUNNER_TEMP}/gh-aw/actions/install_awf_binary.sh" v0.27.38 --rootless

- name: Determine automatic lockdown mode for GitHub MCP Server

id: determine-automatic-lockdown

uses: actions/github-script@373c709c69115d41ff229c7e5df9f8788daa9553 # v9

env:

GH_AW_GITHUB_TOKEN: ${{ secrets.GH_AW_GITHUB_TOKEN }}

GH_AW_GITHUB_MCP_SERVER_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN }}

with:

script: |

- name: Restore agent config folders from base branch

if: steps.checkout-pr.outcome == 'success'

env:

GH_AW_AGENT_FOLDERS: ".agents .antigravity .claude .codex .gemini .github .opencode .pi"

GH_AW_AGENT_FILES: "AGENTS.md ANTIGRAVITY.md CLAUDE.md GEMINI.md PI.md opencode.jsonc"

run: bash "${RUNNER_TEMP}/gh-aw/actions/restore_base_github_folders.sh"

- name: Restore inline sub-agents from activation artifact

env:

GH_AW_SUB_AGENT_DIR: ".github/agents"

GH_AW_SUB_AGENT_EXT: ".agent.md"

run: bash "${RUNNER_TEMP}/gh-aw/actions/restore_inline_sub_agents.sh"

- name: Restore inline skills from activation artifact

env:

GH_AW_SKILL_DIR: ".github/skills"

run: bash "${RUNNER_TEMP}/gh-aw/actions/restore_inline_skills.sh"

- name: Download container images

run: bash "${RUNNER_TEMP}/gh-aw/actions/download_docker_images.sh" ghcr.io/github/gh-aw-firewall/agent:0.27.38@sha256:cb928eb62d9139a013c2d278dab19af232d35a2d83dca71a3d98eb431f786243 ghcr.io/github/gh-aw-firewall/api-proxy:0.27.38@sha256:cd6145620d96acee46e1ede25180a13aa36002467e663db0caa453a8bc8eb60c ghcr.io/github/gh-aw-firewall/squid:0.27.38@sha256:6c19094d95aad5f9f128ad5e583f0f2b894b158aa66c3b86dd9bcc90970a2917 ghcr.io/github/gh-aw-mcpg:v0.4.3@sha256:3c744710ea275cd5ee65db92a1099e0d980754bd9fafda9ce67704c67004dc83 ghcr.io/github/gh-aw-node@sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b ghcr.io/github/github-mcp-server:v1.6.0@sha256:2b0c48b070f61e9d3969269ead600f62d00fb237b60ac849ef3d166ee7de9ad3

- name: Generate Safe Outputs Config

run: |

- name: Generate Safe Outputs Tools

env:

GH_AW_TOOLS_META_JSON: |

GH_AW_VALIDATION_JSON: |

uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0

with:

script: |

- name: Start MCP Gateway

id: start-mcp-gateway

env:

GH_AW_POLICY_ALLOW_CREATE_PULL_REQUEST: ${{ vars.GH_AW_POLICY_ALLOW_CREATE_PULL_REQUEST || 'true' }}

GH_AW_SAFE_OUTPUTS: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS }}

GH_AW_SAFE_OUTPUTS_CONFIG_PATH: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS_CONFIG_PATH }}

GH_AW_SAFE_OUTPUTS_TOOLS_PATH: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS_TOOLS_PATH }}

GITHUB_MCP_GUARD_MIN_INTEGRITY: ${{ steps.determine-automatic-lockdown.outputs.min_integrity }}

GITHUB_MCP_GUARD_REPOS: ${{ steps.determine-automatic-lockdown.outputs.repos }}

GITHUB_MCP_SERVER_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}

GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

run: |

- name: Mount MCP servers as CLIs

id: mount-mcp-clis

continue-on-error: true

env:

MCP_GATEWAY_API_KEY: ${{ steps.start-mcp-gateway.outputs.gateway-api-key }}

MCP_GATEWAY_DOMAIN: ${{ steps.start-mcp-gateway.outputs.gateway-domain }}

MCP_GATEWAY_PORT: ${{ steps.start-mcp-gateway.outputs.gateway-port }}

uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0

with:

script: |

- name: Clean credentials

continue-on-error: true

run: bash "${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh"

- name: Audit pre-agent workspace

id: pre_agent_audit

continue-on-error: true

run: bash "${RUNNER_TEMP}/gh-aw/actions/audit_pre_agent_workspace.sh"

- name: Execute GitHub Copilot CLI

id: agentic_execution

# Copilot CLI tool arguments (sorted):

timeout-minutes: 60

run: |

env:

AWF_REFLECT_ENABLED: 1

COPILOT_AGENT_RUNNER_TYPE: STANDALONE

COPILOT_DUMMY_BYOK: dummy-byok-key-for-offline-mode

COPILOT_GITHUB_TOKEN: ${{ github.token }}

COPILOT_MODEL: ${{ vars.GH_AW_MODEL_AGENT_COPILOT || vars.GH_AW_DEFAULT_MODEL_COPILOT || 'claude-sonnet-4.6' }}

GH_AW_LLM_PROVIDER: github

GH_AW_MAX_AI_CREDITS: ${{ vars.GH_AW_DEFAULT_MAX_AI_CREDITS || '1000' }}

GH_AW_MAX_TURNS: ${{ vars.GH_AW_DEFAULT_MAX_TURNS || '' }}

GH_AW_PHASE: agent

GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt

GH_AW_SAFE_OUTPUTS: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS }}

GH_AW_TIMEOUT_MINUTES: 60

GH_AW_VERSION: v0.83.1

GITHUB_API_URL: ${{ github.api_url }}

GITHUB_AW: true

GITHUB_COPILOT_INTEGRATION_ID: agentic-workflows

GITHUB_HEAD_REF: ${{ github.head_ref }}

GITHUB_MCP_SERVER_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}

GITHUB_REF_NAME: ${{ github.ref_name }}

GITHUB_SERVER_URL: ${{ github.server_url }}

GITHUB_STEP_SUMMARY: /tmp/gh-aw/agent-step-summary.md

GITHUB_WORKSPACE: ${{ github.workspace }}

GIT_AUTHOR_EMAIL: github-actions[bot]@users.noreply.github.com

GIT_AUTHOR_NAME: github-actions[bot]

GIT_COMMITTER_EMAIL: github-actions[bot]@users.noreply.github.com

GIT_COMMITTER_NAME: github-actions[bot]

RUNNER_TEMP: ${{ runner.temp }}

S2STOKENS: true

TRACEPARENT: ${{ env.GITHUB_AW_OTEL_TRACE_ID != '' && env.GITHUB_AW_OTEL_PARENT_SPAN_ID != '' && format('00-{0}-{1}-01', env.GITHUB_AW_OTEL_TRACE_ID, env.GITHUB_AW_OTEL_PARENT_SPAN_ID) || '' }}

- name: Detect agent errors

if: always()

id: detect-agent-errors

continue-on-error: true

run: node "${RUNNER_TEMP}/gh-aw/actions/detect_agent_errors.cjs"

- name: Configure Git credentials

env:

GITHUB_REPOSITORY: ${{ github.repository }}

GITHUB_SERVER_URL: ${{ github.server_url }}

GITHUB_TOKEN: ${{ github.token }}

run: bash "${RUNNER_TEMP}/gh-aw/actions/configure_git_credentials.sh"

- name: Copy Copilot session state files to logs

if: always()

continue-on-error: true

run: bash "${RUNNER_TEMP}/gh-aw/actions/copy_copilot_session_state.sh"

- name: Stop MCP Gateway

if: always()

continue-on-error: true

env:

MCP_GATEWAY_PORT: ${{ steps.start-mcp-gateway.outputs.gateway-port }}

MCP_GATEWAY_API_KEY: ${{ steps.start-mcp-gateway.outputs.gateway-api-key }}

GATEWAY_PID: ${{ steps.start-mcp-gateway.outputs.gateway-pid }}

run: |

- name: Redact secrets in logs

if: always()

uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0

with:

script: |

env:

GH_AW_SECRET_NAMES: 'GH_AW_GITHUB_MCP_SERVER_TOKEN,GH_AW_GITHUB_TOKEN,GITHUB_TOKEN'

SECRET_GH_AW_GITHUB_MCP_SERVER_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN }}

SECRET_GH_AW_GITHUB_TOKEN: ${{ secrets.GH_AW_GITHUB_TOKEN }}

SECRET_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

- name: Append agent step summary

if: always()

run: bash "${RUNNER_TEMP}/gh-aw/actions/append_agent_step_summary.sh"

- name: Copy Safe Outputs

if: always()

env:

GH_AW_SAFE_OUTPUTS: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS }}

run: |

- name: Ingest agent output

id: collect_output

if: always()

uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0

env:

GH_AW_SAFE_OUTPUTS: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS }}

GH_AW_ALLOWED_DOMAINS: "*.githubusercontent.com,api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,codeload.github.com,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,docs.github.com,github-cloud.githubusercontent.com,github-cloud.s3.amazonaws.com,github.blog,github.com,github.githubassets.com,host.docker.internal,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,lfs.github.com,objects.githubusercontent.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,patch-diff.githubusercontent.com,patchdiff.githubusercontent.com,ppa.launchpad.net,raw.githubusercontent.com,registry.npmjs.org,s.symcb.com,s.symcd.com,security.ubuntu.com,telemetry.enterprise.githubcopilot.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com,www.googleapis.com"

GITHUB_SERVER_URL: ${{ github.server_url }}

GITHUB_API_URL: ${{ github.api_url }}

with:

script: |

- name: Parse agent logs for step summary

if: always()

uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0

env:

GH_AW_AGENT_OUTPUT: /tmp/gh-aw/sandbox/agent/logs/

GH_AW_SAFE_OUTPUTS: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS }}

with:

script: |

- name: Parse MCP Gateway logs for step summary

if: always()

id: parse-mcp-gateway

uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0

with:

script: |

- name: Print firewall logs

if: always()

continue-on-error: true

env:

AWF_LOGS_DIR: /tmp/gh-aw/sandbox/firewall/logs

run: bash "${RUNNER_TEMP}/gh-aw/actions/print_firewall_logs.sh" --rootless

- name: Parse token usage for step summary

if: always()

continue-on-error: true

uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0

with:

script: |

- name: Print AWF reflect summary

if: always()

continue-on-error: true

uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0

with:

script: |

- name: Write agent output placeholder if missing

if: always()

run: |

- name: Upload agent artifacts

if: always()

continue-on-error: true

uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1

with:

name: agent

path: |

if-no-files-found: ignore

conclusion:

needs: