feat: add pre-agent workspace audit step after clean credentials#29961
Merged
feat: add pre-agent workspace audit step after clean credentials#29961
Conversation
Adds an 'Audit pre-agent workspace' step (id: pre-agent-audit) that runs after all pre-agent preparation (skills, agents, MCP servers) is complete and before the AI engine begins execution. The step: - Lists files in .github/agents/, .github/skills/, .github/copilot/ under the workspace, the agent user's ~/.github/ and gh extensions, and the runner temp gh-aw directory - Excludes common cache directories (node_modules, __pycache__, .cache, vendor, .npm, .yarn, .pnpm-store, site-packages, .bundle) - Saves the full listing to /tmp/gh-aw/pre-agent-audit.txt - Sets pre-agent-audit-file and pre-agent-audit-line-count GITHUB_OUTPUTs - Uses continue-on-error so missing directories don't block the agent The audit file is included in the agent artifact via collectArtifactPaths. Golden files and lock files are regenerated. Agent-Logs-Url: https://github.com/github/gh-aw/sessions/fe8583bc-5515-4d98-93bd-18e351b6ca8c Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copilot created this pull request from a session on behalf of
pelikhan
May 3, 2026 16:04
View session
pelikhan
reviewed
May 3, 2026
| id: pre-agent-audit | ||
| continue-on-error: true | ||
| run: | | ||
| AUDIT_FILE="/tmp/gh-aw/pre-agent-audit.txt" |
Collaborator
There was a problem hiding this comment.
@copilot move code to shell file in actions/setup/sh + add tests
Contributor
Author
There was a problem hiding this comment.
Done in 640d0d7. The logic is now in actions/setup/sh/audit_pre_agent_workspace.sh with a corresponding audit_pre_agent_workspace_test.sh (7 tests covering syntax, file creation, section headers, existing files, missing directories, GITHUB_OUTPUT, and node_modules exclusion). The generated step is now just bash "${RUNNER_TEMP}/gh-aw/actions/audit_pre_agent_workspace.sh".
| { | ||
| echo "=== Pre-agent workspace audit ===" | ||
| echo "--- Workspace agents: ${GITHUB_WORKSPACE}/.github/agents/ ---" | ||
| find "${GITHUB_WORKSPACE}/.github/agents" "${PRUNE_OPTS[@]}" -print 2>/dev/null || echo "(not found)" |
Collaborator
There was a problem hiding this comment.
@copilot absolutely no interpolation in shell scripts
Contributor
Author
There was a problem hiding this comment.
Fixed in 640d0d7. The shell script contains no Go-level string interpolation — all paths and patterns (/tmp/gh-aw/pre-agent-audit.txt, node_modules exclusions, etc.) are hardcoded directly in the shell file. The Go code only emits a single bash "..." invocation with no injected values.
Contributor
There was a problem hiding this comment.
Pull request overview
Adds a new “Audit pre-agent workspace” GitHub Actions step that runs after MCP CLI mount and before agent execution to capture a directory listing into /tmp/gh-aw/pre-agent-audit.txt, and ensures that file is included in the unified agent artifact.
Changes:
- Add
PreAgentAuditFilePathconstant and generate a new pre-agent audit step in compiled workflows. - Insert the audit step after MCP CLI mount in the main job and include the audit file in collected artifact paths.
- Update WASM golden fixtures and regenerate workflow lock files to reflect the new step and artifact path.
Show a summary per file
| File | Description |
|---|---|
| pkg/constants/constants.go | Adds PreAgentAuditFilePath used by the new audit step and artifact collection. |
| pkg/workflow/compiler_yaml_audit_step.go | Implements YAML generation for the “Audit pre-agent workspace” step. |
| pkg/workflow/compiler_yaml_main_job.go | Wires the audit step after MCP CLI mount and includes the audit file in artifact paths. |
| pkg/workflow/testdata/TestWasmGolden_CompileFixtures/with-imports.golden | Updates golden fixture to include the new audit step and artifact path. |
| pkg/workflow/testdata/TestWasmGolden_CompileFixtures/smoke-copilot.golden | Updates golden fixture to include the new audit step and artifact path. |
| pkg/workflow/testdata/TestWasmGolden_CompileFixtures/playwright-cli-mode.golden | Updates golden fixture to include the new audit step and artifact path. |
| pkg/workflow/testdata/TestWasmGolden_CompileFixtures/basic-copilot.golden | Updates golden fixture to include the new audit step and artifact path. |
| .github/workflows/workflow-skill-extractor.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/workflow-normalizer.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/workflow-generator.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/weekly-safe-outputs-spec-review.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/weekly-issue-summary.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/weekly-editors-health-check.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/visual-regression-checker.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/video-analyzer.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/update-astro.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/ubuntu-image-analyzer.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/typist.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/tidy.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/test-workflow.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/test-quality-sentinel.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/test-project-url-default.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/test-dispatcher.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/terminal-stylist.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/super-linter.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/sub-issue-closer.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/static-analysis-report.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/spec-extractor.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/spec-enforcer.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/smoke-workflow-call.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/smoke-workflow-call-with-inputs.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/smoke-test-tools.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/smoke-service-ports.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/sergo.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/security-review.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/security-compliance.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/research.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/repository-quality-improver.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/repo-tree-map.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/repo-audit-analyzer.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/release.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/refactoring-cadence.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/q.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/plan.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/pdf-summary.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/notion-issue-summary.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/metrics-collector.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/mergefest.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/layout-spec-maintainer.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/jsweep.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/issue-triage-agent.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/hippo-embed.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/gpclean.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/go-pattern-detector.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/go-fan.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/github-remote-mcp-auth-test.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/functional-pragmatist.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/firewall.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/firewall-escape.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/example-permissions-warning.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/draft-pr-cleanup.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/docs-noob-tester.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/discussion-task-miner.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/dictation-prompt.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/dev.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/dev-hawk.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/deployment-incident-monitor.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/dependabot-go-checker.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/dependabot-burner.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/delight.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/dead-code-remover.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/daily-workflow-updater.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/daily-team-status.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/daily-team-evolution-insights.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/daily-syntax-error-quality.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/daily-skill-optimizer.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/daily-sentrux-report.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/daily-semgrep-scan.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/daily-secrets-analysis.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/daily-news.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/daily-malicious-code-scan.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/daily-choice-test.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/daily-assign-issue-to-user.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/craft.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/copilot-token-optimizer.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/copilot-opt.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/copilot-cli-deep-research.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/constraint-solving-potd.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/commit-changes-analyzer.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/codex-github-remote-mcp-test.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/code-simplifier.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/cli-consistency-checker.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/ci-coach.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/changeset.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/breaking-change-checker.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/brave.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/bot-detection.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/auto-triage-issues.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/artifacts-summary.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/architecture-guardian.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/archie.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/ace-editor.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
| .github/workflows/ab-testing-advisor.lock.yml | Regenerated lock file to include the new audit step and artifact path. |
Copilot's findings
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 217/217 changed files
- Comments generated: 2
Comment on lines
+24
to
+33
| yaml.WriteString(" PRUNE_OPTS=(\n") | ||
| yaml.WriteString(" -not -path \"*/node_modules/*\"\n") | ||
| yaml.WriteString(" -not -path \"*/__pycache__/*\"\n") | ||
| yaml.WriteString(" -not -path \"*/.cache/*\"\n") | ||
| yaml.WriteString(" -not -path \"*/vendor/*\"\n") | ||
| yaml.WriteString(" -not -path \"*/.npm/*\"\n") | ||
| yaml.WriteString(" -not -path \"*/.yarn/*\"\n") | ||
| yaml.WriteString(" -not -path \"*/.pnpm-store/*\"\n") | ||
| yaml.WriteString(" -not -path \"*/site-packages/*\"\n") | ||
| yaml.WriteString(" -not -path \"*/.bundle/*\"\n") |
Comment on lines
+14
to
+16
| // The step runs with continue-on-error so a missing directory or permission error does | ||
| // not block agent execution. Common cache directories (node_modules, __pycache__, .cache, | ||
| // vendor, .npm, .yarn, site-packages, .bundle) are excluded to keep the listing concise. |
Contributor
|
test comment
|
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
✅ Test Quality Sentinel: 68/100. Test quality is acceptable — 0% of new tests are implementation tests (threshold: 30%). Minor suggestions: extract a shared test helper to address the 2.7:1 inflation ratio, and add error-path coverage to the two tests that directly invoke the unexported generator method.
Generated by Design Decision Gate workflow to document the architectural decision to insert a workspace audit step after MCP CLI mount. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Contributor
|
Commit pushed:
|
Contributor
🏗️ Design Decision Gate — ADR RequiredThis PR makes significant changes to core business logic (364 new lines in business-logic directories) but does not have a linked Architecture Decision Record (ADR). AI has analyzed the PR diff and generated a draft ADR to help you get started: 📄 Draft ADR: What to do next
Once an ADR is linked in the PR body, this gate will re-run and verify the implementation matches the decision. Why ADRs Matter
ADRs create a searchable, permanent record of why the codebase looks the way it does. Future contributors (and your future self) will thank you. 📋 Michael Nygard ADR Format ReferenceAn ADR must contain these four sections to be considered complete:
All ADRs are stored in 📝 Draft ADR PreviewThe draft ADR captures the following decision from the PR diff: Decision: Insert a Alternatives considered:
Review the full draft at
References: §25284065916
|
Move the inline bash block from the generated workflow step into a
standalone shell script `actions/setup/sh/audit_pre_agent_workspace.sh`
with a corresponding test `audit_pre_agent_workspace_test.sh`.
The generated step now simply calls:
bash "${RUNNER_TEMP}/gh-aw/actions/audit_pre_agent_workspace.sh"
No Go-level string interpolation is used in the step YAML - all paths
and patterns live inside the self-contained shell script.
Also updates Go unit tests to reflect the new structure: the two
inline-content tests are replaced by tests that verify the script
invocation and the absence of interpolated content in the step YAML.
Regenerate golden files and lock files.
Agent-Logs-Url: https://github.com/github/gh-aw/sessions/7b41376b-5c6e-4dab-991c-3149ab9a4335
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
|
Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details. Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
Collaborator
Collaborator
|
copilot make the audit work for all known agentic engines. Assume they are all activated. |
Collaborator
|
@copilot use underscore in step names |
Contributor
|
Hey One thing worth addressing before merge:
If you'd like to address this, here's a prompt you can use:
|
Agent-Logs-Url: https://github.com/github/gh-aw/sessions/af71c44d-d11d-44f3-9e91-d4c672133989 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
Done in 0271871. The audit script now scans workspace config dirs for all 7 engines (
Done in 0271871. Step ID changed from Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
Collaborator
|
@copilot insert after clean credentials |
Agent-Logs-Url: https://github.com/github/gh-aw/sessions/4263595b-50aa-4f38-967d-65e842a0d357 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
Done in 25dba10. The audit step now runs after "Clean credentials": Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
Copilot
AI
changed the title
feat: add pre-agent workspace audit step after MCP CLI mount
feat: add pre-agent workspace audit step after clean credentials
May 3, 2026
Collaborator
|
@copilot merge main and recompile |
…p-after-p-agent # Conflicts: # .github/workflows/daily-cache-strategy-analyzer.lock.yml # .github/workflows/daily-fact.lock.yml # .github/workflows/daily-observability-report.lock.yml # .github/workflows/duplicate-code-detector.lock.yml # .github/workflows/grumpy-reviewer.lock.yml # .github/workflows/issue-arborist.lock.yml # .github/workflows/schema-feature-coverage.lock.yml # .github/workflows/smoke-call-workflow.lock.yml # .github/workflows/smoke-codex.lock.yml Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/gh-aw/sessions/eb6e7249-ce3a-4bbf-b238-9e84bd26ec7b Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
Done in 2eb2851. Merged origin/main (resolved 9 lock file conflicts), rebuilt the binary, and recompiled all lock files. All tests pass. Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
This was referenced May 3, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds an "Audit pre-agent workspace" step (
id: pre_agent_audit) that runs after credentials have been cleaned and before the AI engine begins execution. The step covers all known agentic engines and uses efficient directory pruning.What the step does
$GITHUB_WORKSPACE/.github/agents/,.github/skills/,.github/copilot/— Copilot$GITHUB_WORKSPACE/.claude/— Claude$GITHUB_WORKSPACE/.codex/— Codex$GITHUB_WORKSPACE/.gemini/— Gemini$GITHUB_WORKSPACE/.crush/— Crush$GITHUB_WORKSPACE/.opencode/— OpenCode$GITHUB_WORKSPACE/.pi/— Pi$HOME/.github/,$HOME/.claude/,$HOME/.gemini/(agent user home per-engine config)$HOME/.local/share/gh/extensions/(gh extensions)$RUNNER_TEMP/gh-aw/(runner temp directory)node_modules,__pycache__,.cache,vendor,.npm,.yarn,.pnpm-store,site-packages,.bundle— using-prunesofinddoes not descend into excluded trees/tmp/gh-aw/pre-agent-audit.txtGITHUB_OUTPUTvalues:pre-agent-audit-file(path) andpre-agent-audit-line-countcontinue-on-error: trueso missing directories don't block agent executioncollectArtifactPathsStep placement
The audit runs after credentials are removed from
.git/configso no raw token values are captured in the audit file.Changes
pkg/constants/constants.go— newPreAgentAuditFilePathconstantpkg/workflow/compiler_yaml_audit_step.go— newgeneratePreAgentAuditStepthat emits a singlebashcall with no inline interpolation; stepiduses underscores (pre_agent_audit)pkg/workflow/compiler_yaml_main_job.go— call audit step after credentials cleaner; add file to artifact pathsactions/setup/sh/audit_pre_agent_workspace.sh— self-contained shell script with all audit logic; covers all 7 agentic engines; uses-prunefor efficient cache-directory exclusion; no Go-level string interpolationactions/setup/sh/audit_pre_agent_workspace_test.sh— shell tests covering syntax, file creation, section headers for all engines, existing files, missing directories, GITHUB_OUTPUT writes, and node_modules exclusionpkg/workflow/compiler_yaml_audit_step_test.go— Go tests covering step generation, ordering, artifact inclusion, script invocation, and absence of inline interpolationmake recompilemake update-wasm-golden