Conversation
Agent-Logs-Url: https://github.com/github/gh-aw/sessions/e8273d71-b787-4a08-9ed6-0803b71440bf Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
… in strict mode Agent-Logs-Url: https://github.com/github/gh-aw/sessions/e8273d71-b787-4a08-9ed6-0803b71440bf Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/gh-aw/sessions/e8273d71-b787-4a08-9ed6-0803b71440bf Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copilot created this pull request from a session on behalf of
pelikhan
May 5, 2026 13:04
View session
Collaborator
|
@copilot Explicitly set the sandbox agent to awf in strict mode if empty |
…is empty Agent-Logs-Url: https://github.com/github/gh-aw/sessions/01b042cb-deca-4a8a-beee-8ac62f9dd027 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
Done in 188e315. Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
Copilot
AI
changed the title
fix: default sandbox.agent id to awf instead of requiring explicit id in strict mode
fix: explicitly default sandbox.agent to awf in strict mode when id is not specified
May 5, 2026
Contributor
There was a problem hiding this comment.
Pull request overview
Updates strict-mode handling for sandbox.agent so agent objects without an explicit id are defaulted to AWF instead of being rejected, and refreshes one generated workflow lockfile.
Changes:
- Changed strict sandbox customization validation to set
sandbox.agent.Type = awfwhen agent config has no recognized type/id. - Updated strict-mode sandbox tests to expect success for bare/empty
sandbox.agentobjects and added assertions for AWF defaulting. - Regenerated
stale-pr-cleanup.lock.yml, including an AWF version bump fromv0.25.38tov0.25.39.
Show a summary per file
| File | Description |
|---|---|
pkg/workflow/strict_mode_sandbox_validation.go |
Alters strict-mode sandbox validation behavior for agent configs without explicit type/id. |
pkg/workflow/strict_mode_sandbox_validation_test.go |
Updates expectations and adds coverage for AWF defaulting in strict mode. |
.github/workflows/stale-pr-cleanup.lock.yml |
Regenerates the locked workflow and bumps embedded AWF references to v0.25.39. |
Copilot's findings
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comments suppressed due to low confidence (1)
pkg/workflow/strict_mode_sandbox_validation.go:48
- This now defaults any unsupported agent value, not just the "missing id/type" case described in the PR. Because schema validation is skipped by default and
getAgentType()keeps preferringagent.ID, a typo likesandbox.agent.id: awffwill pass strict-mode validation here but still be treated as unsupported later, leaving the workflow unsandboxed instead of failing fast. Strict mode should only default when bothidandtypeare absent, and continue rejecting explicit unknown values.
if !agent.Disabled && !isSupportedSandboxType(getAgentType(agent)) {
strictModeValidationLog.Printf("sandbox.agent has no id/type in strict mode, defaulting to awf")
agent.Type = SandboxTypeAWF
- Files reviewed: 3/3 changed files
- Comments generated: 3
| // | ||
| // Additionally, a sandbox.agent object without an explicit 'id' field is rejected in | ||
| // strict mode: users must be unambiguous about which sandbox they are enabling. | ||
| // A sandbox.agent object without an explicit 'id' is explicitly set to AWF in strict mode. |
| @@ -1,5 +1,5 @@ | |||
| # gh-aw-metadata: {"schema_version":"v3","frontmatter_hash":"07e071eb8a3e78f3eecb8071e562e1f8291f76cb7a7610e5e007f8d4d12f0a43","strict":true,"agent_id":"copilot"} | |||
| # gh-aw-manifest: {"version":1,"secrets":["GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/checkout","sha":"de0fac2e4500dabe0009e67214ff5f5447ce83dd","version":"v6.0.2"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9"},{"repo":"actions/setup-node","sha":"48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e","version":"v6.4.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.25.38"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.25.38"},{"image":"ghcr.io/github/gh-aw-firewall/cli-proxy:0.25.38"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.25.38"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.3.6"},{"image":"ghcr.io/github/github-mcp-server:v1.0.3","digest":"sha256:2ac27ef03461ef2b877031b838a7d1fd7f12b12d4ace7796d8cad91446d55959","pinned_image":"ghcr.io/github/github-mcp-server:v1.0.3@sha256:2ac27ef03461ef2b877031b838a7d1fd7f12b12d4ace7796d8cad91446d55959"},{"image":"node:lts-alpine","digest":"sha256:d1b3b4da11eefd5941e7f0b9cf17783fc99d9c6fc34884a665f40a06dbdfc94f","pinned_image":"node:lts-alpine@sha256:d1b3b4da11eefd5941e7f0b9cf17783fc99d9c6fc34884a665f40a06dbdfc94f"}]} | |||
| # gh-aw-manifest: {"version":1,"secrets":["GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/checkout","sha":"de0fac2e4500dabe0009e67214ff5f5447ce83dd","version":"v6.0.2"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9"},{"repo":"actions/setup-node","sha":"48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e","version":"v6.4.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.25.39"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.25.39"},{"image":"ghcr.io/github/gh-aw-firewall/cli-proxy:0.25.39"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.25.39"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.3.6"},{"image":"ghcr.io/github/github-mcp-server:v1.0.3","digest":"sha256:2ac27ef03461ef2b877031b838a7d1fd7f12b12d4ace7796d8cad91446d55959","pinned_image":"ghcr.io/github/github-mcp-server:v1.0.3@sha256:2ac27ef03461ef2b877031b838a7d1fd7f12b12d4ace7796d8cad91446d55959"},{"image":"node:lts-alpine","digest":"sha256:d1b3b4da11eefd5941e7f0b9cf17783fc99d9c6fc34884a665f40a06dbdfc94f","pinned_image":"node:lts-alpine@sha256:d1b3b4da11eefd5941e7f0b9cf17783fc99d9c6fc34884a665f40a06dbdfc94f"}]} | |||
Comment on lines
+215
to
+243
| // TestValidateStrictSandboxCustomizationSetsAWFDefault verifies that in strict mode | ||
| // a sandbox.agent with no id/type is explicitly set to AWF. | ||
| func TestValidateStrictSandboxCustomizationSetsAWFDefault(t *testing.T) { | ||
| tests := []struct { | ||
| name string | ||
| agent *AgentSandboxConfig | ||
| }{ | ||
| { | ||
| name: "version-only agent gets AWF type", | ||
| agent: &AgentSandboxConfig{Version: "v0.25.29"}, | ||
| }, | ||
| { | ||
| name: "empty agent gets AWF type", | ||
| agent: &AgentSandboxConfig{}, | ||
| }, | ||
| } | ||
|
|
||
| for _, tt := range tests { | ||
| t.Run(tt.name, func(t *testing.T) { | ||
| compiler := NewCompiler() | ||
| compiler.strictMode = true | ||
|
|
||
| sandbox := &SandboxConfig{Agent: tt.agent} | ||
| err := compiler.validateStrictSandboxCustomization(sandbox) | ||
| if err != nil { | ||
| t.Errorf("Expected validation to succeed but it failed: %v", err) | ||
| } | ||
| if sandbox.Agent.Type != SandboxTypeAWF { | ||
| t.Errorf("Expected sandbox.agent.Type to be %q after strict mode validation, got %q", SandboxTypeAWF, sandbox.Agent.Type) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Removes the strict mode check that rejected
sandbox.agentconfigurations without an explicitidfield, and instead explicitly sets the agent type toawfwhen none is specified. Previously, users would see:Now,
sandbox.agentwithout anidis explicitly defaulted toawfduring strict mode validation, making the behavior unambiguous and consistent with non-strict mode (viaapplySandboxDefaults).Changes
pkg/workflow/strict_mode_sandbox_validation.go: Replaced the rejection check with an explicitagent.Type = SandboxTypeAWFassignment when the agent has no recognisedid/type. Removed the unusederrorsimport and updated the doc comment.pkg/workflow/strict_mode_sandbox_validation_test.go: Updated two test cases that previously expected an error (sandbox.agent without id is rejected in strict mode,empty sandbox.agent is rejected in strict mode) to now expect success. AddedTestValidateStrictSandboxCustomizationSetsAWFDefaultto verify thatsandbox.Agent.Typeis explicitly set toSandboxTypeAWFafter strict mode validation for both a version-only agent and an empty agent config.