fix(codex): resolve codex: command not found on GPU runners inside AWF container

[Copilot]

On aw-gpu-runner-T4, RUNNER_TOOL_CACHE=/home/runner/work/_tool — not /opt/hostedtoolcache. The AWF chroot container mounts /opt and /tmp but not /home/runner/work/_tool, so the codex binary installed there is invisible inside the container, causing daily failures.

Changes

• Installation (GetInstallationSteps): When AWF/firewall is enabled, adds a post-install step that copies the codex binary to /tmp/gh-aw/npm-bins/ on the host. /tmp is mounted read-write in the AWF container, making codex accessible on any runner type.

• Execution (GetExecutionSteps): Prepends export PATH="/tmp/gh-aw/npm-bins:$PATH" before the standard GetNpmBinPathSetup() call inside the AWF container command, so the copied binary is found first on GPU runners where the hostedtoolcache find yields nothing.

# New installation step (firewall-enabled workflows only)
- name: Copy Codex binary to AWF-accessible location
  run: |
    CODEX_BIN="$(command -v codex)" || { echo '::error::codex binary not found after npm install' >&2; exit 1; }
    mkdir -p /tmp/gh-aw/npm-bins && cp "$CODEX_BIN" /tmp/gh-aw/npm-bins/codex

# Execution inside AWF container (before existing PATH setup)
export PATH="/tmp/gh-aw/npm-bins:$PATH" && export PATH="$(find /opt/hostedtoolcache ...)$PATH" && codex exec ...

• Tests: 3 new unit tests — copy step present with firewall, absent without firewall, /tmp/gh-aw/npm-bins in AWF PATH.
• 11 codex-engine workflow lock files recompiled.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/graphql
  • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw GOMOD GOMODCACHE 4262739/b387/impGO111MODULE -c k/gh-aw/gh-aw/cmGOINSECURE k/gh-aw/gh-aw/cmGOMOD 64/bin/go GOSUMDB GOWORK 64/bin/go /opt/hostedtoolcGO111MODULE (http block)
  • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw GOMOD GOMODCACHE 4262739/b400/impGO111MODULE -c 4262739/b400/embGOINSECURE GOPROXY 64/bin/go GOSUMDB GOWORK 64/bin/go /opt/hostedtoolcGO111MODULE (http block)
  • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw GOMOD GOMODCACHE 4262739/b403/impGO111MODULE -c k/gh-aw/gh-aw/pkGOINSECURE GOPROXY 64/bin/go GOSUMDB GOWORK run-script/lib/n-json /opt/hostedtoolcGO111MODULE (http block)
• https://api.github.com/repos/actions/checkout/git/ref/tags/v6
  • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv GOSUMDB GOWORK 64/bin/go GOINSECURE GOMOD GOMODCACHE node /opt�� prettier --check 64/bin/go **/*.ts **/*.json --ignore-path git (http block)
  • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv ignore-path ../../../.prettierignore config /usr/bin/git remote.origin.ursh GOWORK 64/bin/go git -C /workflows/daily-fact.lock.yml config /usr/bin/git l GOPROXY 64/bin/go git (http block)
• https://api.github.com/repos/actions/setup-node/git/ref/tags/v6
  • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv GOSUMDB GOWORK 64/bin/go GOINSECURE GOMOD GOMODCACHE node /opt�� prettier --check 64/bin/go **/*.ts **/*.json --ignore-path git (http block)
  • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv ignore-path ../../../.prettierignore TOKEN"; }; f get nt-scoped-approved.lock.yml l owner=github ed } } /usr/bin/gh api /workflows/daily-fact.lock.yml -f modules/@npmcli/run-script/lib/node-gyp-bin/node -f owner=github -f infocmp (http block)
• https://api.github.com/repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b
  • Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq [.object.sha, .object.type] | @tsv --check **/*.cjs 64/bin/go **/*.json --ignore-path run-script/lib/n-t go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq [.object.sha, .object.type] | @tsv prettier --check 64/bin/go --ignore-path .prettierignore 64/bin/go go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq [.object.sha, .object.type] | @tsv /workflows/grumpy-reviewer.lock.yml config deql remote.origin.urnode bash 64/bin/go deql -C w/js/**/*.json' --ignore-path show (http block)
• https://api.github.com/repos/github/gh-aw
  • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw --jq .default_branch -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } GOINSECURE GOMOD GOMODCACHE go (http block)
  • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw --jq .default_branch 7365980c12808757474442ea:.github-f go bash -json GO111MODULE ache/go/1.25.8/xxterm-color git push�� *.json' '!../../../pkg/workflow/js/**/*.json' --ignore-path ../../../.prettierignore origin repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -json GO111MODULE ache/go/1.25.8/x/home/REDACTED/work/gh-aw/gh-aw/.github/workflows git (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)