Skip to content

fix: gh aw upgrade strips BYOK credentials from engine.env#30194

Merged
pelikhan merged 2 commits intomainfrom
copilot/fix-gh-aw-upgrade-warn
May 4, 2026
Merged

fix: gh aw upgrade strips BYOK credentials from engine.env#30194
pelikhan merged 2 commits intomainfrom
copilot/fix-gh-aw-upgrade-warn

Conversation

Copy link
Copy Markdown
Contributor

Copilot AI commented May 4, 2026

gh aw upgrade was removing COPILOT_PROVIDER_API_KEY (and COPILOT_PROVIDER_BEARER_TOKEN) from engine.env with the "Remove unsafe secrets" warning — silently breaking BYOK — while gh aw compile correctly allows these keys.

Root cause: allowedEngineEnvSecretKeys() in the upgrade codemod only called getSecretRequirementsForEngine(), which returns just the single primary engine credential (e.g. COPILOT_GITHUB_TOKEN). The compile path calls engine.GetRequiredSecretNames() which unconditionally includes the three BYOK provider vars.

Changes

  • pkg/cli/codemod_engine_env_secrets.go — extend allowedEngineEnvSecretKeys() to also query GetGlobalEngineRegistry().GetEngine(id).GetRequiredSecretNames(minimalData), mirroring the allowlist logic in getEngineBaseEnvVarKeys() used by the compiler. Add a debug log when engine lookup fails.
  • pkg/cli/codemod_engine_env_secrets_test.go — add no-op test cases for the BYOK pattern:
engine:
  id: copilot
  env:
    COPILOT_PROVIDER_BASE_URL: ${{ vars.PROVIDER_BASE_URL }}
    COPILOT_PROVIDER_API_KEY: ${{ secrets.PROVIDER_API_KEY }}   # was incorrectly stripped
    COPILOT_PROVIDER_BEARER_TOKEN: ${{ secrets.BEARER_TOKEN }}  # was incorrectly stripped

Both keys now survive gh aw upgrade without modification, consistent with gh aw compile.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

  • https://api.github.com/graphql
    • Triggering command: /usr/bin/gh gh repo view --json owner,name --jq .owner.login + "/" + .name ortcfg.link GOINSECURE GOMOD GOMODCACHE 6lOae4WsPt2nvzZ6yM/kanFXMcb9Ib9j-tests env /ref/tags/v9 GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile (http block)
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile env ab-testing-advisor.md GO111MODULE 64/pkg/tool/linux_amd64/link GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/link (http block)
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile env sRemoteWithRealGitmaster_branch2628436307/001 sRemoteWithRealGitmaster_branch2628436307/002/work .cfg GOINSECURE fips140/hmac GOMODCACHE ache/go/1.25.8/x--json (http block)
  • https://api.github.com/orgs/test-owner/actions/secrets
    • Triggering command: /usr/bin/gh gh api /orgs/test-owner/actions/secrets --jq .secrets[].name -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /orgs/test-owner/actions/secrets --jq .secrets[].name -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env orts,XTestImpor GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/actions/ai-inference/git/ref/tags/v1
    • Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq [.object.sha, .object.type] | @tsv /ref/tags/v9 /opt/hostedtoolcache/go/1.25.8/x--json sv /tmp/go-build233git -trimpath 1/x64/bin/node git rev-�� --show-toplevel 1/x64/bin/node /usr/bin/git ts.TOKEN remote ache/node/24.14./repos/actions/github-script/git/ref/tags/v9 git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq [.object.sha, .object.type] | @tsv /ref/tags/v9 --jq sv npx prettier --cgit GOPROXY ache/node/24.14.--show-toplevel gh repo�� view owner/test-repo /usr/bin/git k/gh-aw/gh-aw/.ggh scripts/**/*.js (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v3
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq [.object.sha, .object.type] | @tsv ithub-script/git/ref/tags/v9 remote2 (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq [.object.sha, .object.type] | @tsv /ref/tags/v9 go sv th .prettierignoinfocmp GO111MODULE 64/bin/go git conf�� 1980252222 remote.origin.url sv 58/001/test-emptgit GO111MODULE bin/sh git (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v5
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq [.object.sha, .object.type] | @tsv 1608773/b049/importcfg tlUh/9pw3AB5m6U_Ak5qHtlUh /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/compile -p internal/stringsrev-parse -lang=go1.25 /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linuTest User -o faultBranchFromLsRemoteWithRealGitbranch_with_hyphen4121325595/001 faultBranchFromLsRemoteWithRealGitbranch_with_hyphen4121325595/002/work /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/compile -p net -lang=go1.25 /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linutest@example.com (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq [.object.sha, .object.type] | @tsv ithub-script/git/ref/tags/v9 ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet bject.type] | @tsv run --auto /opt/hostedtoolc--show-toplevel git rev-�� ithub-script/git/ref/tags/v9 /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/compile bject.type] | @tsv ithub-script/gitgit -trimpath bject.type] | @t--show-toplevel git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/gh --show-toplevel ache/go/1.25.8/xrev-parse /usr/bin/infocmp--show-toplevel gh api /repos/actions/github-script/git/ref/tags/v9 --jq /opt/hostedtoolcache/go/1.25.8/x64/bin/node xterm-color 64/pkg/tool/linurev-parse /usr/bin/git node (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v6
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv sistency_InlinedImports3793301144/001/inlined-a.md 8232432/b432/_testmain.go /usr/lib/git-core/git -p main -lang=go1.25 /usr/lib/git-core/git main�� 639137490 --auto /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/compile --detach -c=4 -nolocalimports /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linurepos/{owner}/{repo}/actions/runs/3/artifacts (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv --show-toplevel (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv /ref/tags/v9 go sv -json 9 64/bin/go git remo�� GOMODCACHE go /usr/bin/git -json GO111MODULE x_amd64/compile git (http block)
  • https://api.github.com/repos/actions/github-script/git/ref/tags/v8
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq [.object.sha, .object.type] | @tsv /ref/tags/v9 git sv user.name Test User /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git GOMODCACHE x_amd64/compile /usr/bin/gh git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq [.object.sha, .object.type] | @tsv /ref/tags/v9 /opt/hostedtoolcache/node/24.14.1/x64/bin/node sv No expressions hgit go /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --get remote.origin.urrev-parse /usr/bin/git git (http block)
  • https://api.github.com/repos/actions/github-script/git/ref/tags/v9
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv go1.25.8 -c=4 -nolocalimports -importcfg /tmp/go-build2331608773/b236/importcfg -pack UrXrkKd4vj1_ env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE aRiefE3LJ-80 env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/actions/github-script/git/ref/tags/v9.0.0
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9.0.0 --jq [.object.sha, .object.type] | @tsv go1.25.8 -c=4 -nolocalimports -importcfg /tmp/go-build2331608773/b232/importcfg -pack /home/REDACTED/go/pkg/mod/github.com/modelcontextprotocol/go-sdk@v1.6.0/jsonrpc/jsonrpc.go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9.0.0 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json son/json.go 64/bin/go GOINSECURE GOMOD GOMODCACHE TER=$(wc -c < g (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9.0.0 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/actions/setup-go/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv /repos/actions/github-script/git/ref/tags/v9 --jq /usr/bin/gh SameOutput148260infocmp ELPw/QEPjXdEopvS-1 /opt/hostedtoolcxterm-color gh api /repos/actions/github-script/git/ref/tags/v9 --jq /usr/bin/git ithub/workflows faultBranchFromLrev-parse 8232432/b423/vet--show-toplevel git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv origin REDACTED /usr/bin/git ithub/workflows/gh GO111MODULE ache/node/24.14./repos/actions/github-script/git/ref/tags/v9 git add test-file.txt go /usr/bin/git sistency_GoAndJagit GO111MODULE /opt/hostedtoolc--show-toplevel git (http block)
  • https://api.github.com/repos/actions/setup-node/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv GOMODCACHE x_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv xterm-color ache/go/1.25.8/x--jq /usr/bin/infocmp 109579478 1608773/b092/impapi flow.lock.yml infocmp -1 xterm-color /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linuremote.origin.url (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv ithub-script/git/ref/tags/v9 /tmp/go-build4088232432/b445/stats.test bject.type] | @tsv r-test2435144690git -test.v=true /usr/bin/infocmp--show-toplevel git rev-�� /ref/tags/v9 infocmp sv xterm-color s/test.md /usr/bin/git git (http block)
  • https://api.github.com/repos/actions/setup-node/git/ref/tags/v6
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv ctor || github.repository WMG8o7QiXfA2XU_VxRq0/WMG8o7QiXfA2XU_VxRq0 "warnings":[]}] -goversion go1.25.8 -c=4 /bin/sh -c 639137490 git-upload-pack '/tmp/TestParseDefaultBranchFromLsRemoteWithRealGitcustom_branch1399477020/001' ache/node/24.14.1/x64/bin/node -json GO111MODULE 64/bin/go ache/node/24.14.1/x64/bin/node (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv /tmp/gh-aw-test-runs/20260504-184148-32882/test-2509047045/.github/workflows l e/git -json GO111MODULE 64/bin/go e/git -C /tmp/compile-instructions-test-3109579478 show /usr/bin/git -json GO111MODULE x_amd64/compile git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv /tmp/gh-aw-test-runs/20260504-184148-32882/test-180967630/.github/workflows config om/org2/repo2.git remote.origin.urgit -c=4 -nolocalimports git conf�� user.name Test User /usr/bin/git -json 1.6.0/internal/mrev-parse x_amd64/compile git (http block)
  • https://api.github.com/repos/actions/upload-artifact/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv 4148-32882/test-639137490 x_amd64/asm /opt/hostedtoolcache/node/24.14.1/x64/bin/node -json GO111MODULE x_amd64/compile /opt/hostedtoolcache/node/24.14.1/x64/bin/node /tmp�� needs.build.outputs.version x_amd64/compile 8232432/b404/cli.test -json GO111MODULE x_amd64/link 8232432/b404/cli.test (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv s/test.md go repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -json GO111MODULE 64/bin/go git rev-�� --show-toplevel go /usr/bin/gh -json GO111MODULE 64/bin/go gh (http block)
  • https://api.github.com/repos/aws-actions/configure-aws-credentials/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/aws-actions/configure-aws-credentials/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --show-toplevel /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linurepos/{owner}/{repo}/actions/runs/3/artifacts /usr/bin/git /tmp/go-build408git -trimpath /usr/bin/infocmp--show-toplevel git rev-�� --show-toplevel infocmp /usr/bin/git 2" 1>&2 -dwarf=false rue,"errors":[],status git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/aws-actions/configure-aws-credentials/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/git ithub-script/gitgh config bject.type] | @t/repos/actions/github-script/git/ref/tags/v9 git rev-�� /ref/tags/v9 gh sv /repos/actions/ggit --jq /usr/bin/infocmp--show-toplevel git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/aws-actions/configure-aws-credentials/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --show-toplevel node /usr/bin/git /tmp/TestHashCongit go /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git ithub-script/gitgh remote bject.type] | @tstatus git (http block)
  • https://api.github.com/repos/azure/login/git/ref/tags/v2
    • Triggering command: /usr/bin/gh gh api /repos/azure/login/git/ref/tags/v2 --jq [.object.sha, .object.type] | @tsv --show-toplevel node /usr/bin/git /tmp/TestHashCongit go /usr/bin/git git rev-�� --show-toplevel git /usr/bin/gh --show-toplevel s mple.com/org/repxterm-color gh (http block)
    • Triggering command: /usr/bin/gh gh api /repos/azure/login/git/ref/tags/v2 --jq [.object.sha, .object.type] | @tsv --show-toplevel /usr/bin/git /usr/bin/git -v go /usr/bin/git git rev-�� --show-toplevel git /usr/bin/gh ons-test11934345infocmp config /usr/bin/git gh (http block)
  • https://api.github.com/repos/docker/login-action/git/ref/tags/v3
    • Triggering command: /usr/bin/gh gh api /repos/docker/login-action/git/ref/tags/v3 --jq [.object.sha, .object.type] | @tsv ithub-script/git/ref/tags/v9 /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/compile bject.type] | @tsv ithub-script/gitgit -trimpath bject.type] | @t--show-toplevel git rev-�� --show-toplevel infocmp /usr/bin/infocmp xterm-color l /opt/hostedtoolcxterm-color infocmp (http block)
    • Triggering command: /usr/bin/gh gh api /repos/docker/login-action/git/ref/tags/v3 --jq [.object.sha, .object.type] | @tsv ithub-script/git/ref/tags/v9 gh bject.type] | @tsv repos/{owner}/{rgit --jq /usr/bin/git git rev-�� --show-toplevel git /usr/bin/infocmp --show-toplevel go /usr/bin/git infocmp (http block)
  • https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v0.1.2
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0.1.2 --jq [.object.sha, .object.type] | @tsv --show-toplevel ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile /usr/bin/git CompiledOutput14infocmp XvR1/5IzJsHuNVIj-1 (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0.1.2 --jq [.object.sha, .object.type] | @tsv --show-toplevel go /usr/bin/infocmp ithub/workflows/gh GO111MODULE /opt/hostedtoolc/repos/actions/github-script/git/ref/tags/v9 infocmp -1 xterm-color go /usr/bin/git -json GO111MODULE e/git git (http block)
  • https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq [.object.sha, .object.type] | @tsv --show-toplevel x_amd64/compile /usr/bin/git -json GO111MODULE x_amd64/compile git rev-�� --show-toplevel x_amd64/compile /usr/bin/git -json GO111MODULE ache/go/1.25.8/x--show-toplevel git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq [.object.sha, .object.type] | @tsv 'default' || github.actor go /usr/bin/git -json GO111MODULE 64/bin/go git conf�� user.email test@example.com /usr/bin/git -json GO111MODULE odules/npm/node_--show-toplevel git (http block)
  • https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.2.3
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq [.object.sha, .object.type] | @tsv --show-toplevel x_amd64/asm /opt/hostedtoolcache/node/24.14.1/x64/bin/node -json GO111MODULE x_amd64/compile /opt/hostedtoolcache/node/24.14.1/x64/bin/node /tmp�� github.token x_amd64/compile /usr/bin/git -json GO111MODULE x_amd64/vet git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq [.object.sha, .object.type] | @tsv /tmp/gh-aw-test-runs/20260504-184612-61217/test-353775489/custom--limit remote /usr/bin/git -json GO111MODULE 64/bin/go git rev-�� --show-toplevel go /usr/bin/git -json GO111MODULE 64/bin/go git (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs
    • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --limit 100 --created >=2026-04-27 GOMOD GOMODCACHE 64/pkg/tool/linutest@example.com env g_.a GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE essage abis 64/pkg/tool/linux_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --limit 100 --created >=2026-04-04 GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile env g_.a 0/internal/number/common.go 64/pkg/tool/linux_amd64/compile GOINSECURE al_wasm.o 64/src/internal/test.txt 64/pkg/tool/linux_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --limit 100 --created >=2026-02-03 GOMOD GOMODCACHE w4/MTK9fk8zVRHRis0Hc7kg/TlDa0Hf-Bb3BnF9Rs13V env g_.a 0/message/catalog.go 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/1/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/1/artifacts --jq .artifacts[].name Y_7BzNNuM 64/pkg/tool/linux_amd64/compile GOINSECURE t GOMODCACHE 64/pkg/tool/linu^remote\..*\.gh-resolved$ env g_.a GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE erutil GOMODCACHE 64/pkg/tool/linux_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh run download 1 --dir test-logs/run-1 GO111MODULE ache/go/1.25.8/x64/pkg/tool/linux_amd64/asm GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linuremote.origin.url ortc�� 2960320256 om/goccy/go-yaml@v1.19.2/lexer/lexer.go ache/go/1.25.8/x64/pkg/tool/linux_amd64/asm GOINSECURE 1608773/b007/ GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/asm (http block)
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/1/artifacts --jq .artifacts[].name GO111MODULE es/.bin/node GOINSECURE GOMOD GOMODCACHE go k/gh�� -json GO111MODULE /opt/hostedtoolcache/go/1.25.8/x64/bin/go GOINSECURE GOMOD erignore go (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/12345/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12345/artifacts --jq .artifacts[].name sNGC5r73k ache/go/1.25.8/x64/pkg/tool/linu-importcfg GOINSECURE gset GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linu-importcfg env xH4IQXLy2 GO111MODULE x_amd64/vet GOINSECURE iment GOMODCACHE x_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh run download 12345 --dir test-logs/run-12345 GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE util GOMODCACHE 64/pkg/tool/linux_amd64/vet ortc�� (http block)
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12345/artifacts --jq .artifacts[].name GO111MODULE 1/x64/bin/node GOINSECURE GOMOD GOMODCACHE go t-ha�� ithub/workflows/ab-testing-advisor.md GO111MODULE ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linurev-parse (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/1234567890
    • Triggering command: /usr/bin/gh gh api repos/{owner}/{repo}/actions/runs/1234567890 --jq {databaseId: .id, number: .run_number, url: .html_url, status: .status, conclusion: .conclusion, workflowName: .name, workflowPath: .path, createdAt: .created_at, startedAt: .run_started_at, updatedAt: .updated_at, event: .event, headBranch: .head_branch, -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api repos/{owner}/{repo}/actions/runs/1234567890 --jq {databaseId: .id, number: .run_number, url: .html_url, status: .status, conclusion: .conclusion, workflowName: .name, workflowPath: .path, createdAt: .created_at, startedAt: .run_started_at, updatedAt: .updated_at, event: .event, headBranch: .head_branch, -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go /pre�� -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/12346/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12346/artifacts --jq .artifacts[].name GO111MODULE ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile GOINSECURE til GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile ortc�� ijOXly7jX 64/src/os/dir.go k GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh run download 12346 --dir test-logs/run-12346 sYAOo28ie ache/go/1.25.8/x64/pkg/tool/linu-buildmode=exe GOINSECURE age/compact GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linuconfig env dYFiwu7NJ GO111MODULE ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile GOINSECURE 1608773/b015/ GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linuremote.origin.url (http block)
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12346/artifacts --jq .artifacts[].name GO111MODULE .cfg GOINSECURE GOMOD GOMODCACHE go env 4612-61217/test-2888689004/.github/workflows GO111MODULE ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/2/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/2/artifacts --jq .artifacts[].name verutil_test.go 64/pkg/tool/linux_amd64/compile GOINSECURE (http block)
    • Triggering command: /usr/bin/gh gh run download 2 --dir test-logs/run-2 GO111MODULE ache/go/1.25.8/x64/pkg/tool/linux_amd64/asm GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/asm ortc�� /ref/tags/v9 om/goccy/go-yaml@v1.19.2/scanner/context.go sv GOINSECURE 1608773/b007/ GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/2/artifacts --jq .artifacts[].name GO111MODULE in/node GOINSECURE GOMOD GOMODCACHE go k/gh�� -json GO111MODULE 1/x64/bin/node GOINSECURE GOMOD erignore 1/x64/bin/node (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/3/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/3/artifacts --jq .artifacts[].name bBouUBHdz 64/pkg/tool/linux_amd64/link GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linu--json env verutil.test GO111MODULE ortcfg.link GOINSECURE GOMOD GOMODCACHE CvnNqTYlxuDgbBhCTest User (http block)
    • Triggering command: /usr/bin/gh gh run download 3 --dir test-logs/run-3 ortcfg 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linutest@example.com ortc�� 1608773/b059/_pkg_.a om/goccy/go-yaml@v1.19.2/ast/ast.go ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile GOINSECURE fips140deps/byterev-parse GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/3/artifacts --jq .artifacts[].name efaultBranchFromLsRemoteWithRealGitmaster_branch2222895448/001' .cfg GOINSECURE GOMOD GOMODCACHE go k/gh�� -json GO111MODULE ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD ode-gyp-bin/node--show-toplevel ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/4/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/4/artifacts --jq .artifacts[].name 64jHUho52 ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linurev-parse env 4/001/inlined-b.md 2XU_VxRq0 ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/xtest@example.com (http block)
    • Triggering command: /usr/bin/gh gh run download 4 --dir test-logs/run-4 GO111MODULE ache/go/1.25.8/x64/pkg/tool/linu-lang=go1.25 GOINSECURE GOMOD abis 64/src/math/big/arith_wasm.s env 2960320256 GO111MODULE k GOINSECURE t GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linu/tmp/go-build4088232432/b460/_testmain.go (http block)
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/4/artifacts --jq .artifacts[].name GO111MODULE ache/uv/0.11.8/x86_64/node GOINSECURE GOMOD GOMODCACHE go k/gh�� 4612-61217/test-2526619599/.github/workflows GO111MODULE 1/x64/bin/node GOINSECURE GOMOD erignore 1/x64/bin/node (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/5/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/5/artifacts --jq .artifacts[].name deRMpwyMD ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile GOINSECURE chema/v6/kind GOMODCACHE N_/MhA652aEkSuR8NKQxPfr/feDwSjXSrev-parse env /ref/tags/v9 GO111MODULE k GOINSECURE /math GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh run download 5 --dir test-logs/run-5 GO111MODULE ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linu--json ortc�� 1608773/b024/_pkg_.a om/goccy/go-yaml@v1.19.2/printernonexistent-workflow-12345 ache/go/1.25.8/x64/pkg/tool/linu--limit workflow/data/acgit /maps GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/5/artifacts --jq .artifacts[].name sRemoteWithRealGitmaster_branch2222895448/002/work cal/bin/node GOINSECURE GOMOD GOMODCACHE go k/gh�� /ref/tags/v9 GO111MODULE 1/x64/bin/node GOINSECURE GOMOD erignore 1/x64/bin/node (http block)
  • https://api.github.com/repos/github/gh-aw/actions/workflows
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 100 GOMOD GOMODCACHE x_amd64/compile env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 6 GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile ortc�� b/workflows n8hJV-ZkR ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile (http block)
  • https://api.github.com/repos/github/gh-aw/contents/.github/workflows/shared/reporting.md
    • Triggering command: /tmp/go-build4088232432/b404/cli.test /tmp/go-build4088232432/b404/cli.test -test.testlogfile=/tmp/go-build4088232432/b404/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true -nolocalimports -importcfg /tmp/go-build2331608773/b208/importcfg -pack env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /tmp/go-build3734131503/b404/cli.test /tmp/go-build3734131503/b404/cli.test -test.testlogfile=/tmp/go-build3734131503/b404/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v0.47.4
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v0.47.4 --jq [.object.sha, .object.type] | @tsv --show-toplevel infocmp (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v0.47.4 --jq [.object.sha, .object.type] | @tsv --show-toplevel git (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq [.object.sha, .object.type] | @tsv DefaultBranchFromLsRemoteWithRealGitmain_branch2-errorsas DefaultBranchFromLsRemoteWithRealGitmain_branch2-ifaceassert ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile GOINSECURE fips140 GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile env 1608773/b220/_pkg_.a i2Jk/kxQktkbJrdZm0O72i2Jk 1608773/b220=> GOINSECURE GOMOD GOMODCACHE /opt/hostedtoolc--jq (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.2.3
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env ub/workflows GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE reflectlite/asm.s (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env ub/workflows GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v2.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json GO111MODULE x_amd64/vet GOINSECURE GOMOD reflectlite/asm./tmp/gh-aw-test-runs/20260504-184148-32882/test-2960320256 x_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env ub/workflows GO111MODULE x_amd64/link GOINSECURE GOMOD GOMODCACHE x_amd64/link (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v3.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env ub/workflows GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env ub/workflows GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet (http block)
  • https://api.github.com/repos/google-github-actions/auth/git/ref/tags/v2
    • Triggering command: /usr/bin/gh gh api /repos/google-github-actions/auth/git/ref/tags/v2 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/git ons-test22494173git rev-parse /opt/hostedtoolc--show-toplevel git rev-�� --show-toplevel node /usr/bin/git /tmp/TestHashCongit go 0"}} git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/google-github-actions/auth/git/ref/tags/v2 --jq [.object.sha, .object.type] | @tsv --show-toplevel /opt/hostedtoolcache/go/1.25.8/xsh /usr/bin/git /tmp/go-build373git -importcfg /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git ithub-script/gitgit remote bject.type] | @t--show-toplevel git (http block)
  • https://api.github.com/repos/nonexistent/action/git/ref/tags/v999.999.999
    • Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq [.object.sha, .object.type] | @tsv ortcfg GO111MODULE ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile GOINSECURE fips140/sha256 GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile env 4148-32882/test-2527242671/.github/workflows t2Bi/LbyKJAzlPTfrrG8ct2Bi 1608773/b222=> GOINSECURE g/x/net/http2/hprev-parse GOMODCACHE gcc (http block)
    • Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go 2228�� -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/nonexistent/repo/actions/runs/12345
    • Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile env 180967630/.github/workflows GO111MODULE ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet env -json GO111MODULE /opt/hostedtoolcache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/owner/repo/actions/workflows
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh workflow list --repo owner/repo --json name,path,state ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile GOINSECURE 1608773/b036/ GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linuTest User ortc�� agent-persona-explorer.md om/modelcontextprotocol/go-sdk@v1.6.0/auth/auth.go ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile GOINSECURE ntio/asm/cpu/x86config 1608773/b036/sym--get-regexp ache/go/1.25.8/x^remote\..*\.gh-resolved$ (http block)
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo 64/bin/go GOINSECURE GOMOD GOMODCACHE go /pre�� -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/test-owner/test-repo/actions/secrets
    • Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name -json GO111MODULE 7d125ba095d50184-d GOINSECURE GOMOD GOMODCACHE go env h ../../../.prettierignore GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/test/repo
    • Triggering command: /usr/bin/gh gh api /repos/test/repo --jq .default_branch 180967630/.github/workflows GO111MODULE ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile env 4148-32882/test-2970217670/.github/workflows zm1t/ybsydLQ-bM8eUCGDzm1t 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh api /repos/test/repo --jq .default_branch /tmp/TestHashConsistency_GoAndJavaScript3056735858/001/test-inlined-imports-enabled-with-env-temgit go /usr/bin/git -json GO111MODULE 64/bin/go git conf�� --get remote.origin.url /usr/bin/git -json GO111MODULE 64/bin/go git (http block)
  • invalid.example.invalid
    • Triggering command: /usr/lib/git-core/git-remote-https /usr/lib/git-core/git-remote-https origin https://invalid.example.invalid/nonexistent-repo.git e/git init�� git git ode_modules/.bin/git =receive test@example.com--git-dir=/tmp/bare-incremental-jlgxu3 /git (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

The upgrade codemod was stripping COPILOT_PROVIDER_API_KEY (and other
BYOK credentials) from engine.env even though the compile path correctly
allows them. Update allowedEngineEnvSecretKeys() to also query the
workflow engine registry via GetRequiredSecretNames(), matching the
compile-time strict-mode allowlist exactly.

Fixes: gh aw upgrade warns 'Remove unsafe secrets from engine.env'
despite compile allowing BYOK keys

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/0c3a3540-9b38-4673-92b5-9299e35834f8

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copilot AI changed the title [WIP] Fix warning of unsafe secrets in gh aw upgrade fix: gh aw upgrade strips BYOK credentials from engine.env May 4, 2026
Copilot AI requested a review from pelikhan May 4, 2026 18:49
@pelikhan pelikhan marked this pull request as ready for review May 4, 2026 19:08
Copilot AI review requested due to automatic review settings May 4, 2026 19:08
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Fixes gh aw upgrade incorrectly stripping BYOK Copilot provider credentials from engine.env by expanding the codemod’s allowlist to match compile-time strict-mode behavior.

Changes:

  • Expand allowedEngineEnvSecretKeys() to include engine-provided required secret/env-var keys via GetRequiredSecretNames(minimal WorkflowData).
  • Add regression tests ensuring COPILOT_PROVIDER_API_KEY and COPILOT_PROVIDER_BEARER_TOKEN remain untouched during upgrade.
  • Remove a stray whitespace-only line in an OTLP observability test file.
Show a summary per file
File Description
pkg/cli/codemod_engine_env_secrets.go Expands the upgrade codemod allowlist using engine registry GetRequiredSecretNames to preserve BYOK provider credentials.
pkg/cli/codemod_engine_env_secrets_test.go Adds no-op test cases covering BYOK env keys to prevent future regressions.
pkg/workflow/observability_otlp_test.go Removes an extraneous whitespace-only line in tests.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

  • Files reviewed: 3/3 changed files
  • Comments generated: 0

@pelikhan pelikhan merged commit 4a935d9 into main May 4, 2026
4 checks passed
@pelikhan pelikhan deleted the copilot/fix-gh-aw-upgrade-warn branch May 4, 2026 19:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

gh aw upgrade: still warns 'Remove unsafe secrets from engine.env' despite fix in #29378 for compile

3 participants