Remove srt and sandbox-runtime from schema, retain migration codemod#15999
Merged
Remove srt and sandbox-runtime from schema, retain migration codemod#15999
Conversation
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copilot
AI
changed the title
[WIP] Remove support for srt and sandbox-runtime
Remove srt and sandbox-runtime from schema, retain migration codemod
Feb 15, 2026
pelikhan
approved these changes
Feb 15, 2026
Contributor
There was a problem hiding this comment.
Pull request overview
This PR removes deprecated srt and sandbox-runtime sandbox types from user-facing JSON schema validation while preserving automatic backward compatibility through a migration codemod. New workflows with these legacy values will fail schema validation, but existing compiled workflows continue to work as they are automatically migrated to awf during compilation.
Changes:
- Removed
srtandsandbox-runtimefrom schema enum values inmain_workflow_schema.json(onlydefaultandawfnow accepted) - Updated test files to use
awfinstead ofsrtand removed obsolete feature flag tests - Updated documentation to reflect removal of SRT examples while noting automatic migration
- Retained
migrateSRTToAWF()codemod function for backward compatibility
Reviewed changes
Copilot reviewed 12 out of 12 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| pkg/parser/schemas/main_workflow_schema.json | Removed srt and sandbox-runtime from enum values, updated descriptions to note automatic migration |
| pkg/workflow/sandbox_experimental_warning_test.go | Deleted entire test file (feature flag validation no longer applicable) |
| pkg/workflow/sandbox_custom_agent_test.go | Updated test from "custom command and args for SRT" to "custom command and args for AWF" with corresponding variable/comment updates |
| pkg/workflow/sandbox_agent_tools_default_test.go | Updated test from "sandbox.agent: srt" to "sandbox.agent: awf" |
| pkg/workflow/frontmatter_extraction_security.go | Updated comments to note legacy srt/sandbox-runtime values are auto-migrated |
| pkg/workflow/compiler_safe_outputs.go | Updated comments to remove SRT references |
| pkg/workflow/copilot_engine.go | Removed obsolete comment about copilot_srt.go file |
| pkg/cli/workflows/test-custom-agent.md | Removed all SRT examples and documentation, added note about automatic migration |
| .github/workflows/*.lock.yml | Recompiled workflows with updated AWF binary installation and firewall steps |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Remove deprecated
srtandsandbox-runtimesandbox types from user-facing schema validation while preserving automatic migration for backward compatibility.Changes
srtandsandbox-runtimefrommain_workflow_schema.jsonenum values; schema now accepts onlydefaultandawfsrtreferences toawfinsandbox_agent_tools_default_test.goandsandbox_custom_agent_test.go; removesandbox_experimental_warning_test.go(feature flag validation no longer applicable)test-custom-agent.mdto remove SRT examplesmigrateSRTToAWF()function insandbox.gofor automatic migration during compilationBehavior
New workflows with
sandbox: srtwill fail schema validation:Existing compiled workflows with legacy values continue to work - the codemod migrates
srt→awfautomatically during recompilation.Warning
Firewall rules blocked me from connecting to one or more addresses (expand for details)
I tried to connect to the following addresses, but was blocked by firewall rules:
https://api.github.com/graphql/usr/bin/gh gh repo view --json owner,name --jq .owner.login + "/" + .name 64/pkg/tool/linux_amd64/vet(http block)/usr/bin/gh gh repo view owner/repo(http block)/usr/bin/gh gh repo view owner/host-repo(http block)https://api.github.com/repos/actions/ai-inference/git/ref/tags/v1/usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq .object.sha -json GO111MODULE 0/x64/bin/node GOINSECURE GOMOD GOMODCACHE sh t-ha�� ithub/workflows/audit-workflows.md GOPROXY /usr/bin/gh ettierignore GOWORK 64/bin/go gh(http block)https://api.github.com/repos/actions/checkout/git/ref/tags/v3/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq .object.sha -json GO111MODULE ache/go/1.25.0/x64/bin/sh GOINSECURE GOMOD GOMODCACHE go env 4720-39850/test-2354601237/.github/workflows GO111MODULE 0/x64/bin/node GOINSECURE GOMOD GOMODCACHE go(http block)https://api.github.com/repos/actions/checkout/git/ref/tags/v4/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v4 --jq .object.sha SameOutput3389641081/001/stability-test.md GO111MODULE /opt/hostedtoolcache/go/1.25.0/x64/bin/go GOINSECURE %H %ct %D GOMODCACHE go estl�� -json GO111MODULE /usr/sbin/sh GOINSECURE GOMOD GOMODCACHE sh(http block)/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v4 --jq .object.sha -json GO111MODULE /opt/hostedtoolcache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env runs/20260215-234720-39850/test-1404842149/.github/workflows GO111MODULE /home/REDACTED/work/node_modules/.bin/node l GOMOD GOMODCACHE node(http block)/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v4 --jq .object.sha 64/bin/go go ache/go/1.25.0/x64/pkg/tool/linux_amd64/vet re GO111MODULE 64/bin/go ache/go/1.25.0/x64/pkg/tool/linux_amd64/vet rev-�� --show-toplevel go /usr/bin/git -json GO111MODULE 64/bin/go git(http block)https://api.github.com/repos/actions/checkout/git/ref/tags/v5/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha -json GO111MODULE bin/sh GOINSECURE GOMOD GOMODCACHE go env .js' --ignore-path .prettierignore GO111MODULE ache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha ons-test1907278717 /opt/hostedtoolcGO111MODULE /usr/bin/gh tierignore go 64/bin/go gh api /repos/actions/github-script/git/ref/tags/v8 --jq /usr/bin/git run format:cjs 64/bin/go git(http block)/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha GOMODCACHE go /usr/bin/git -json GO111MODULE 64/bin/go git remo�� tup/sh/sanitize_path.sh' ':::/usr/bin:/usr/local/bin' && echo "$PATH" origin /usr/bin/git -json GO111MODULE es/.bin/node git(http block)https://api.github.com/repos/actions/github-script/git/ref/tags/v8/usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha(http block)/usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha go1.25.0 -c=4 -nolocalimports -importcfg /tmp/go-build3800382481/b386/importcfg -pack HV13EWybwoFQ(http block)/usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha go1.25.0 -c=4 -nolocalimports -importcfg /tmp/go-build3800382481/b395/importcfg -pack /tmp/go-build3800382481/b395/_testmain.go(http block)https://api.github.com/repos/actions/setup-go/git/ref/tags/v4/usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq .object.sha ository }} GO111MODULE /opt/hostedtoolcache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env runs/20260215-234720-39850/test-1387681600/.github/workflows GO111MODULE /home/REDACTED/work/gh-aw/gh-aw/actions/setup/js/node_modules/.bin/node GOINSECURE GOMOD GOMODCACHE node(http block)https://api.github.com/repos/actions/setup-node/git/ref/tags/v4/usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq .object.sha -json GO111MODULE /opt/hostedtoolcache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env runs/20260215-234720-39850/test-2486051156/.github/workflows GO111MODULE /home/REDACTED/work/gh-aw/gh-aw/actions/setup/js/node_modules/.bin/prettier l GOMOD GOMODCACHE prettier(http block)https://api.github.com/repos/github/gh-aw/actions/runs/1/artifacts/usr/bin/gh gh run download 1 --dir test-logs/run-1(http block)/usr/bin/gh gh run download 1 --dir test-logs/run-1 GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)https://api.github.com/repos/github/gh-aw/actions/runs/12345/artifacts/usr/bin/gh gh run download 12345 --dir test-logs/run-12345(http block)/usr/bin/gh gh run download 12345 --dir test-logs/run-12345 GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)https://api.github.com/repos/github/gh-aw/actions/runs/12346/artifacts/usr/bin/gh gh run download 12346 --dir test-logs/run-12346(http block)/usr/bin/gh gh run download 12346 --dir test-logs/run-12346 GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)https://api.github.com/repos/github/gh-aw/actions/runs/2/artifacts/usr/bin/gh gh run download 2 --dir test-logs/run-2(http block)/usr/bin/gh gh run download 2 --dir test-logs/run-2 GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env ty-test.md GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)https://api.github.com/repos/github/gh-aw/actions/runs/3/artifacts/usr/bin/gh gh run download 3 --dir test-logs/run-3(http block)/usr/bin/gh gh run download 3 --dir test-logs/run-3 GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env -json GO111MODULE 64/bin/go ATH/bin:$PATH" gnode GOMOD GOMODCACHE go(http block)https://api.github.com/repos/github/gh-aw/actions/runs/4/artifacts/usr/bin/gh gh run download 4 --dir test-logs/run-4(http block)/usr/bin/gh gh run download 4 --dir test-logs/run-4 GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)https://api.github.com/repos/github/gh-aw/actions/runs/5/artifacts/usr/bin/gh gh run download 5 --dir test-logs/run-5(http block)/usr/bin/gh gh run download 5 --dir test-logs/run-5 GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)https://api.github.com/repos/github/gh-aw/actions/workflows/usr/bin/gh gh workflow list --json name,state,path(http block)/usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 100(http block)/usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 6(http block)https://api.github.com/repos/github/gh-aw/contents/.github%2Fworkflows%2Faudit-workflows.md/opt/hostedtoolcache/node/24.13.0/x64/bin/node /opt/hostedtoolcache/node/24.13.0/x64/bin/node --conditions node --conditions development --experimental-import-meta-resolve --require /home/REDACTED/work/gh-aw/gh-aw/actions/setup/js/node_modules/vitest/suppress-warnings.cjs /home/REDACTED/work/gh-aw/gh-aw/actions/setup/js/node_modules/vitest/dist/workers/forks.js GO111MODULE 0/x64/bin/node git rev-�� --show-toplevel ache/go/1.25.0/x64/pkg/tool/linu--name-only /usr/bin/git vaScript14015944/opt/hostedtoolcache/node/24.13.0/x64/bin/node GO111MODULE 766725/b388=> git(http block)https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.0.0/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq .object.sha -json GO111MODULE 64/bin/sh GOINSECURE GOMOD GOMODCACHE go env 2354601237/.github/workflows GO111MODULE ache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)https://api.github.com/repos/nonexistent/repo/actions/runs/12345/usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion(http block)/usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE h GOINSECURE GOMOD GOMODCACHE go(http block)https://api.github.com/repos/owner/repo/actions/workflows/usr/bin/gh gh workflow list --json name,state,path --repo owner/repo(http block)/usr/bin/gh gh workflow list --repo owner/repo --json name,path,state 64/pkg/tool/linux_amd64/vet(http block)/usr/bin/gh gh workflow list --json name,state,path --repo owner/repo 64/bin/go /dev/null GO111MODULE 64/bin/go sh -c "prettier" --wriGOSUMDB sh 64/bin/go "prettier" --chego GOPROXY /sh node(http block)https://api.github.com/repos/test-owner/test-repo/actions/secrets/usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name(http block)/usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name --write ../../../pkg/worGOMOD 64/bin/go /dev/null GO111MODULE 64/bin/go sh -c "prettier" --wriGOSUMDB sh 64/bin/go ettierignore GOPROXY 64/bin/go node(http block)https://api.github.com/user/usr/bin/gh gh api user --jq .login(http block)/usr/bin/gh gh api user --jq .login -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env ck 'scripts/**/*GOINSECURE GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)/usr/bin/gh gh api user --jq .login "prettier" --wriGOINSECURE go 64/bin/go -json GO111MODULE 64/bin/go sh -c "prettier" --wriGOINSECURE node 64/bin/go /github-workflowsh **/*.cjs 64/bin/go sh(http block)If you need me to access, download, or install something from one of these locations, you can either:
✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.