fix(daily-syntax-error-quality): unblock /tmp/gh-aw compile path, remove unused GitHub toolset

[Copilot]

The workflow was consuming ~9.3M tokens/run (~130 turns) because every gh aw compile attempt was denied — the agent copies test files to /tmp/gh-aw/syntax-error-tests/ and invokes the compiler with absolute paths, but only the relative glob gh aw compile * was permitted. This triggered a 64-turn source-code reading fallback. Expected cost: ~15–20 turns (~1.1–1.4M tokens).

Changes

• Add /tmp/gh-aw compile path — "gh aw compile /tmp/gh-aw/syntax-error-tests/*.md" added to bash tool allow-list, unblocking the agent's actual compile workflow
• Remove github toolset — the workflow does purely local file ops + compile; the default toolset schema was loaded into every turn's system prompt for no reason (~130–260K tokens/run)
• Align cp/cat/mkdir patterns — updated to use the /tmp/gh-aw/syntax-error-tests/ subdirectory (project-standard /tmp/gh-aw/ root) consistently with the Phase 2 prompt instructions; added mkdir -p /tmp/gh-aw/syntax-error-tests as an explicit allowed command
• Update prompt — all prompt references to the temp directory now point to /tmp/gh-aw/syntax-error-tests/

# Before
tools:
  github:
    toolsets:
      - default
  bash:
    - "gh aw compile *"
    - "cp .github/workflows/*.md /tmp/*.md"
    - "cat /tmp/*.md"

# After
tools:
  bash:
    - "gh aw compile *"
    - "gh aw compile /tmp/gh-aw/syntax-error-tests/*.md"
    - "cp .github/workflows/*.md /tmp/gh-aw/syntax-error-tests/*.md"
    - "cat /tmp/gh-aw/syntax-error-tests/*.md"
    - "mkdir -p /tmp/gh-aw/syntax-error-tests"

[pelikhan]

@copilot use /tmp/gh-aw/... as a root for temp folder . Update prompt.

[Copilot]

@copilot use /tmp/gh-aw/... as a root for temp folder . Update prompt.

Done in bce4f1b. Updated all /tmp/syntax-error-tests references to /tmp/gh-aw/syntax-error-tests in both the bash tool allow-list and the prompt instructions.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/graphql
  • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw (http block)
  • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw mz9FZDb/Mkyvi_yn-1 (http block)
• https://api.github.com/repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b
  • Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq .object.sha (http block)
• https://api.github.com/repos/github/gh-aw
  • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw --jq .visibility (http block)
• https://api.github.com/repos/githubnext/agentics/git/ref/tags/-
  • Triggering command: /usr/bin/gh gh api /repos/githubnext/agentics/git/ref/tags/- --jq .object.sha (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[Copilot]

Pull request overview

This PR updates the daily-syntax-error-quality agentic workflow configuration to reduce token/turn cost by unblocking the compiler’s actual /tmp/gh-aw/... usage and removing unnecessary GitHub toolset configuration from the workflow frontmatter.

Changes:

• Allow gh aw compile against /tmp/gh-aw/syntax-error-tests/*.md and align temp-file operations under /tmp/gh-aw/syntax-error-tests/.
• Remove the tools.github.toolsets: [default] block from the workflow frontmatter to avoid loading unused GitHub tool schemas.
• Regenerate the compiled lock workflow to reflect updated allow-listed shell commands.

Show a summary per file

File	Description
.github/workflows/daily-syntax-error-quality.md	Updates tool allow-list and prompt instructions to use /tmp/gh-aw/syntax-error-tests/ and allow absolute-path compilation.
.github/workflows/daily-syntax-error-quality.lock.yml	Regenerates the rendered workflow and updates --allow-tool entries for the new /tmp/gh-aw/... paths.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 2/2 changed files
• Comments generated: 3

[Copilot]

The instructions tell the agent to run cd /tmp/gh-aw/syntax-error-tests, but cd is not in the allowed bash tool list for this workflow (strict mode). This can cause tool denials if the agent follows the prompt; either add an allow-list entry for cd (e.g., cd /tmp/gh-aw/syntax-error-tests or cd*) or update the prompt to run gh aw compile using absolute paths without cd.

Suggested change

	cd /tmp/gh-aw/syntax-error-tests
	gh aw compile test-1.md 2>&1 | tee test-1-output.txt
	gh aw compile /tmp/gh-aw/syntax-error-tests/test-1.md 2>&1 | tee /tmp/gh-aw/syntax-error-tests/test-1-output.txt

[Copilot]

The allowed command pattern cp .github/workflows/*.md /tmp/gh-aw/syntax-error-tests/*.md is not a valid copy invocation if executed literally (multiple sources + a glob destination that likely doesn’t expand) and could fail with “target is not a directory”. Consider changing the allowed pattern to copy into the directory (e.g., /tmp/gh-aw/syntax-error-tests/) while still permitting the intended cp ... test-1.md usage.

Suggested change

	- "cp .github/workflows/*.md /tmp/gh-aw/syntax-error-tests/*.md"
	- "cp .github/workflows/*.md /tmp/gh-aw/syntax-error-tests/"

[Copilot]

The --allow-tool entry for cp .github/workflows/*.md /tmp/gh-aw/syntax-error-tests/*.md reflects a command that would fail if run verbatim (glob destination often won’t expand, and cp requires a directory when copying multiple sources). Prefer an allow pattern that is also a valid command (copy into /tmp/gh-aw/syntax-error-tests/) to avoid the agent selecting a broken allowed command.