Summary

Successfully implemented support for a read-only flag on the GitHub tool configuration in agentic workflows front matter.

Implementation Checklist

• Understand the current implementation of GitHub tool configuration in pkg/parser/mcp.go
• Add support for read-only field in GitHub tool configuration
• Pass GITHUB_READ_ONLY environment variable to Docker command when read-only is true
• Update all engines (Claude, Codex, Copilot, Custom) to support read-only mode
• Update documentation to describe the new read-only flag
• Add tests for the read-only configuration
• Update JSON schema to allow read-only field
• Ensure default behavior (no config) allows read-only with all tools
• Test compilation and validation across all engines
• Format code and run linters
• Run comprehensive test suite
• Create manual test scenarios
• Verify generated YAML output
• Inline env variable value in Docker args (per code review feedback)

Changes Made

Code Changes

1. pkg/parser/mcp.go - Inline GITHUB_READ_ONLY=1 in docker args instead of separate env
2. pkg/workflow/mcps.go - Added getGitHubReadOnly() helper function
3. pkg/workflow/claude_engine.go - Inline env value in args
4. pkg/workflow/codex_engine.go - Inline env value in args
5. pkg/workflow/copilot_engine.go - Already inlined (no change needed)
6. pkg/workflow/custom_engine.go - Inline env value in args

Schema Changes

• pkg/parser/schemas/main_workflow_schema.json - Added read-only field and null type support

Documentation

• docs/src/content/docs/reference/tools.md - Added GitHub Read-Only Mode section

Tests

• pkg/parser/mcp_test.go - Updated tests for inlined env value
• pkg/workflow/github_readonly_test.go - Added helper function tests

Usage

tools:
  github:
    read-only: true

Generated Output

When read-only: true is set:

• Docker args include: -e GITHUB_READ_ONLY=1 (inlined value)
• Environment section does NOT include GITHUB_READ_ONLY

Example:

args: [
  "run", "-i", "--rm",
  "-e", "GITHUB_PERSONAL_ACCESS_TOKEN",
  "-e", "GITHUB_READ_ONLY=1",
  "ghcr.io/github/github-mcp-server:sha-09deac4"
]
env:
  GITHUB_PERSONAL_ACCESS_TOKEN: "${{ secrets.GITHUB_TOKEN }}"

Test Results

✅ All unit tests passing
✅ All integration tests passing
✅ Verified inlined env variable across all engines (Claude, Codex, Copilot, Custom)

💬 Share your feedback on Copilot coding agent for the chance to win a $200 gift card! Click here to start the survey.