.NET Ecosystem Support in AWF Agent Container and Agentic Workflows

[Mossaka]

.NET Ecosystem Support in AWF Agent Container and Agentic Workflows

Summary

This discussion documents the findings from testing .NET/C# agentic workflows with the AWF (Agentic Workflow Firewall) agent container. Three popular C# repositories were tested successfully:

Repository	Tests	Result
Spectre.Console	967	✅ All passed
MediatR	230	✅ All passed
Polly	140+	✅ All passed

How .NET Support Works

The runtimes: Frontmatter Field

To use .NET in agentic workflows, you must specify the runtime in the workflow frontmatter:

---
name: Build and Test C# Project
engine: copilot
on:
  workflow_dispatch:
runtimes:
  dotnet:
    version: "8.0"
network:
  firewall: true
  allowed:
    - defaults
    - nuget.org
    - api.nuget.org
---

Key points:

• Use runtimes: (plural) with nested structure, NOT runtime: (singular)
• The version field accepts standard .NET SDK versions (e.g., "8.0", "9.0")

What Happens During Compilation

When you compile a workflow with runtimes: dotnet, gh-aw:

1. Adds actions/setup-dotnet@v4 step before the agent step
2. The dotnet SDK gets installed to /opt/hostedtoolcache on the GitHub runner
3. The AWF container mounts /opt/hostedtoolcache:/opt/hostedtoolcache:ro
4. Dotnet becomes available inside the container via this mount

Required Network Domains

For .NET/NuGet package restore to work through the firewall, include these domains:

network:
  firewall: true
  allowed:
    - defaults
    - nuget.org
    - api.nuget.org

The defaults preset includes additional Microsoft and NuGet CDN domains needed for SDK downloads and package restore.

Common Issues and Solutions

Issue 1: "dotnet: command not found"

Cause: Missing runtimes: field in frontmatter

Solution: Add the runtimes block:

runtimes:
  dotnet:
    version: "8.0"

Issue 2: Using incorrect syntax runtime: dotnet

Cause: Using singular runtime: instead of plural runtimes: with nested structure

Wrong:

runtime: dotnet  # This field does not exist!

Correct:

runtimes:
  dotnet:
    version: "8.0"

Issue 3: NuGet restore failures

Cause: Missing network domains in firewall allowlist

Solution: Ensure nuget.org and api.nuget.org are in allowed domains, or use the defaults preset which includes them.

Issue 4: Missing GitHub MCP permissions

Cause: Workflows using GitHub MCP server toolsets need explicit permissions

Solution: Add permissions to frontmatter:

permissions:
  contents: read
  issues: read
  pull-requests: read

AWF Agent Container Details

The AWF agent container (ghcr.io/githubnext/gh-aw-firewall/agent) is based on Ubuntu and does NOT have .NET pre-installed. The SDK is provided through:

1. The actions/setup-dotnet action running on the host
2. Mount of /opt/hostedtoolcache into the container

This approach keeps the container lightweight while supporting multiple runtime versions.

Example Working Workflow

Here is a complete example of a working .NET agentic workflow:

---
name: Build and Test C# Project
engine: copilot
on:
  workflow_dispatch:
runtimes:
  dotnet:
    version: "8.0"
network:
  firewall: true
  allowed:
    - defaults
    - nuget.org
    - api.nuget.org
permissions:
  contents: read
  issues: read
  pull-requests: read
---

# Build and Test

You are a C# developer. Your task is to build and test this .NET project.

## Steps

1. Explore the repository structure to find the solution file (.sln or .slnx)
2. Restore NuGet packages using `dotnet restore`
3. Build the solution using `dotnet build`
4. Run the tests using `dotnet test`
5. Report the results

Verified Test Results

All three test repositories successfully completed build and test workflows:

Spectre.Console

• Run: 21458504580
• Build: Succeeded in 33.81 seconds
• Tests: 967 passed, 0 failed

MediatR

• Run: 21459108522
• Tests: 230 passed, 0 failed

Polly

• Run: 21458591496
• Tests: 140+ passed across multiple test frameworks, 0 failed

Future Improvements

Based on this investigation, potential improvements for gh-aw:

1. Better error messages when runtimes: is missing but markdown mentions dotnet commands
2. Auto-detection of runtime requirements from markdown body (currently only scans frontmatter fields)
3. Documentation improvements for the runtimes field and supported versions

References

• gh-aw Runtime Definitions
• gh-aw Runtime Detection
• AWF Agent Container Dockerfile