Skip to content

fix: escape bare $schema in double-quoted AWF config printf to prevent bash variable expansion#30879

Merged
pelikhan merged 3 commits intomainfrom
copilot/fix-json-config-unescaped-schema
May 7, 2026
Merged

fix: escape bare $schema in double-quoted AWF config printf to prevent bash variable expansion#30879
pelikhan merged 3 commits intomainfrom
copilot/fix-json-config-unescaped-schema

Conversation

Copy link
Copy Markdown
Contributor

Copilot AI commented May 7, 2026

When AllowedDomains contains a GitHub Actions expression (${{ }}), shellEscapeArg must use double-quote wrapping (single-quoting would break 'staging' literals inside expressions). Inside that double-quoted printf argument, bash expands $schema as a variable—always unset, always empty—producing {"": "https://..."} on disk. AWF rejects this with config. is not supported.

Changes

  • pkg/workflow/shell.go: Added escapeBareShellDollarSigns() called in the double-quote path of shellEscapeArg. It replaces every $ not immediately followed by {{ with \$, so bash treats it as a literal dollar sign while leaving ${{ }} expressions untouched for GitHub Actions evaluation.

    Before: "{\"$schema\":\"https://...\",\"network\":{\"allowDomains\":[\"${{ env.DOMAINS }}\"]}}"
    After:  "{\"\$schema\":\"https://...\",\"network\":{\"allowDomains\":[\"${{ env.DOMAINS }}\"]}}"
    
  • pkg/workflow/shell_test.go: Added TestEscapeBareShellDollarSigns unit tests and new table-driven cases in TestShellEscapeArg covering the mixed $schema/${{ }} scenario.

  • pkg/workflow/awf_config_test.go: Added TestBuildAWFCommand_SchemaKeyEscapedWhenExpressionPresent — builds an AWF command with a ${{ }} expression in AllowedDomains and asserts \$schema appears in the shell command while the expression is preserved verbatim.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

  • https://api.github.com/graphql
    • Triggering command: /usr/bin/gh gh repo view --json owner,name --jq .owner.login + "/" + .name k -errorsas s $k => $v) echorev-parse -nilfunc /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linuremote.origin.url sRem�� 2596719828/custom/workflows /tmp/go-build499315447/b194/vet.cfg k/_temp/uv-python-dir/node ath ../../../.prgit r 64/bin/git /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linuremote (http block)
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw s $k => $v) echoinit (http block)
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw (http block)
  • https://api.github.com/orgs/test-owner/actions/secrets
    • Triggering command: /usr/bin/gh gh api /orgs/test-owner/actions/secrets --jq .secrets[].name re --log-level=error --local x_amd64/vet http.https://git/opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/compile (http block)
  • https://api.github.com/repos/actions/ai-inference/git/ref/tags/v1
    • Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq [.object.sha, .object.type] | @tsv --show-toplevel /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/compile /usr/bin/git 6 -trimpath 1/x64/bin/node git rev-�� --show-toplevel 1/x64/bin/node /usr/bin/git e: ${{ secrets.Tgh -goversion /opt/hostedtoolc/repos/actions/github-script/git/ref/tags/v9 git (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v3
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq [.object.sha, .object.type] | @tsv --show-toplevel x_amd64/link (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v5
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq [.object.sha, .object.type] | @tsv ring1683838436/001/test1.md **/*.cjs (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq [.object.sha, .object.type] | @tsv ithub-script/git/ref/tags/v9 infocmp bject.type] | @tsv xterm-color -tests /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git /tmp/compile-insgit s/12346/artifactrev-parse /tmp/go-build310--show-toplevel git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq [.object.sha, .object.type] | @tsv ithub-script/git/ref/tags/v9 git bject.type] | @tsv --show-toplevel ache/go/1.25.8/xrev-parse /usr/bin/git gh api /repos/actions/github-script/git/ref/tags/v9 --jq /opt/hostedtoolcache/node/24.14.1/x64/bin/node --show-toplevel node /usr/bin/infocmp--show-toplevel node (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v6
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv runs/20260507-190900-14667/test-998313606/.github/workflows -extld=gcc x_amd64/vet ath ../../../.prgh (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv /tmp/TestCompileUpdateDiscussionFieldEnforcement552350176/001 rev-parse /usr/bin/git on' --ignore-patgit Z6jRXmgJ6 64/pkg/tool/linu--show-toplevel git conf�� user.name Test User /usr/lib/git-core/git rite '../../../*git cfg x_amd64/vet /usr/lib/git-core/git (http block)
  • https://api.github.com/repos/actions/github-script/git/ref/tags/v8
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/git /ref/tags/v9 remote sv git rev-�� ithub-script/git/ref/tags/v9 git bject.type] | @tsv (http block)
  • https://api.github.com/repos/actions/github-script/git/ref/tags/v9
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv submodules | head -n 10 (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv ath ../../../.pr**/*.json (http block)
  • https://api.github.com/repos/actions/github-script/git/ref/tags/v9.0.0
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9.0.0 --jq [.object.sha, .object.type] | @tsv d-schema (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9.0.0 --jq [.object.sha, .object.type] | @tsv (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9.0.0 --jq [.object.sha, .object.type] | @tsv go1.25.8 -c=4 -nolocalimports -importcfg /tmp/go-build310667193/b415/importcfg -pack /tmp/go-build310667193/b415/_testmain.go tion�� re --log-level=error --local /node (http block)
  • https://api.github.com/repos/actions/setup-go/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv xterm-color node /usr/bin/git 0900-14667/test-infocmp **/*.cjs bject.type] | @txterm-color git rev-�� --show-toplevel sh /usr/bin/git "prettier" --wrigit (http block)
  • https://api.github.com/repos/actions/setup-node/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv -c 64/pkg/tool/linu-test.v=true /usr/bin/git ../pkg/workflow/git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv xterm-color node /usr/bin/gh ring1683838436/0gh **/*.cjs 1/x64/bin/node gh api /repos/actions/github-script/git/ref/tags/v9 --jq /usr/bin/git ithub/workflows/git 667193/b415/_tesrev-parse /opt/hostedtoolc--show-toplevel git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/git --show-toplevel x_amd64/vet clusion,workflow--show-toplevel git rev-�� /ref/tags/v9 git sv --show-toplevel 64/pkg/tool/linu-1 /usr/bin/git gh (http block)
  • https://api.github.com/repos/actions/setup-node/git/ref/tags/v6
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv runs/20260507-190900-14667/test-998313606/.github/workflows rev-parse x_amd64/vet ath ../../../.prgit (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv /tmp/TestGuardPolicyMinIntegrityOnlymin-integrity_with_explicit_repo3196455806/0-s remote /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/vet js/**/*.json' --git --local 64/pkg/tool/linu--show-toplevel /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/vet -ato�� 2" 1>&2 -buildtags rue,"errors":[],"warnings":[]}] eturned -ifaceassert -nilfunc git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv /tmp/TestCompileUpdateDiscussionFieldEnforcement552350176/001 remote /usr/bin/git on' --ignore-patgit cfg 64/pkg/tool/linu--show-toplevel git remo�� /ref/tags/v9 origin sv g/testutil/tempdgit cfg ndor/bin/bash git (http block)
  • https://api.github.com/repos/actions/upload-artifact/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv sMr_w3qRcZY0wv0fZFWo/sMr_w3qRcZY0wv0fZFWo -dwarf=false /opt/hostedtoolcache/node/24.14.1/x64/bin/node go1.25.8 -c=4 -nolocalimports /opt/hostedtoolcache/node/24.14.security /tmp�� 'default' || github.actor /tmp/go-build310667193/b472/_tes-d r,url,status,conclusion,workflow168.63.129.16 --exclude-standagit flow-12345 ules/.bin/node git (http block)
  • https://api.github.com/repos/aws-actions/configure-aws-credentials/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/aws-actions/configure-aws-credentials/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/git /tmp/TestGuardPogit rev-parse clusion,workflow--show-toplevel git rev-�� --show-toplevel git /usr/bin/git /tmp/gh-aw-test-gh (http block)
    • Triggering command: /usr/bin/gh gh api /repos/aws-actions/configure-aws-credentials/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --show-toplevel /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/compile /usr/bin/git /tmp/go-build310gh 667193/b478/_tesapi /opt/hostedtoolc/repos/actions/github-script/git/ref/tags/v9 git rev-�� /ref/tags/v9 /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/link sv /tmp/go-build310git -importcfg /usr/bin/git infocmp (http block)
  • https://api.github.com/repos/azure/login/git/ref/tags/v2
    • Triggering command: /usr/bin/gh gh api /repos/azure/login/git/ref/tags/v2 --jq [.object.sha, .object.type] | @tsv --show-toplevel e/git /usr/bin/git /tmp/compile-insgit remote /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --get remote.origin.ur-1 /usr/bin/git git (http block)
  • https://api.github.com/repos/docker/login-action/git/ref/tags/v3
    • Triggering command: /usr/bin/gh gh api /repos/docker/login-action/git/ref/tags/v3 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/git /tmp/compile-insgit s/12346/artifactrev-parse /tmp/go-build310--show-toplevel git rev-�� --show-toplevel /tmp/go-build310667193/b472/type--jq /usr/bin/infocmp ansitiveImports1infocmp -test.v=true /usr/bin/git infocmp (http block)
  • https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v0.1.2
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0.1.2 --jq [.object.sha, .object.type] | @tsv --show-toplevel 64/pkg/tool/linuconfig /usr/bin/gh _.a (http block)
  • https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq [.object.sha, .object.type] | @tsv sX9FX53sm1OTZ6jdpoJ_/sX9FX53sm1OTZ6jdpoJ_ -dwarf=false /usr/bin/git go1.25.8 -c=4 -nolocalimports git init�� /ref/tags/v9 /tmp/go-build310667193/b478/_testmain.go sv repo1206674895/0git cfg x_amd64/compile /usr/bin/git (http block)
  • https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.2.3
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq [.object.sha, .object.type] | @tsv /ref/tags/v9 l sv go cfg x_amd64/compile git comm�� -m Initial commit /usr/bin/git lex-frontmatter-git (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs
    • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --limit 100 --created >=2026-04-30 (http block)
    • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --limit 100 --created >=2026-04-07 **/*.json --ignore-path ache/go/1.25.8/xremote.origin.url itcu�� */*.json' '!../../../pkg/workflow/js/**/*.json' --ignore-path ../../../.prettierignore 315447/b244/vet.cfg 64/pkg/tool/linux_amd64/compile tierignore (http block)
    • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --limit 100 --created >=2026-02-06 **/*.json --ignore-path pBvTgXO/G1KutSxXHjoE8hqd2SJr itbr�� run format:pkg-json 64/pkg/tool/linux_amd64/compile son (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/1/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/1/artifacts --jq .artifacts[].name (http block)
    • Triggering command: /usr/bin/gh gh run download 1 --dir test-logs/run-1 -trimpath k/gh-aw/gh-aw/actions/node_modules/.bin/node -p tants -lang=go1.17 /opt/hostedtoolctest@example.com k/gh�� 3030639508 /tmp/go-build499315447/b091/vet.cfg k/gh-aw/gh-aw/actions/setup/node_modules/.bin/sh--quiet -c=4 -nolocalimports erignore rtcfg (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/12345/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12345/artifacts --jq .artifacts[].name 315447/b362/vet.cfg k/node_modules/.bin/sh nore ../../../.prettiinit (http block)
    • Triggering command: /usr/bin/gh gh run download 12345 --dir test-logs/run-12345 (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/1234567890
    • Triggering command: /usr/bin/gh gh api repos/{owner}/{repo}/actions/runs/1234567890 --jq {databaseId: .id, number: .run_number, url: .html_url, status: .status, conclusion: .conclusion, workflowName: .name, workflowPath: .path, createdAt: .created_at, startedAt: .run_started_at, updatedAt: .updated_at, event: .event, headBranch: .head_branch, --get-regexp --local x_amd64/vet (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/12346/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12346/artifacts --jq .artifacts[].name ../../../**/*.json e_modules/.bin/sh nore ../../../.prettirev-parse (http block)
    • Triggering command: /usr/bin/gh gh run download 12346 --dir test-logs/run-12346 (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/2/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/2/artifacts --jq .artifacts[].name (http block)
    • Triggering command: /usr/bin/gh gh run download 2 --dir test-logs/run-2 /tmp/go-build499315447/b009/vet.cfg rtcfg.link ignore-path ../.git (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/3/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/3/artifacts --jq .artifacts[].name (http block)
    • Triggering command: /usr/bin/gh gh run download 3 --dir test-logs/run-3 /tmp/go-build499315447/b006/vet.cfg 64/pkg/tool/linux_amd64/link ignore-path ../.git tants_test (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/4/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/4/artifacts --jq .artifacts[].name st.go x_amd64/link nore tdrain (http block)
    • Triggering command: /usr/bin/gh gh run download 4 --dir test-logs/run-4 /tmp/go-build499315447/b007/vet.-w k/gh-aw/node_modules/.bin/node ignore-path ../.git (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/5/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/5/artifacts --jq .artifacts[].name (http block)
    • Triggering command: /usr/bin/gh gh run download 5 --dir test-logs/run-5 (http block)
  • https://api.github.com/repos/github/gh-aw/actions/workflows
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path re --log-level=error --local x_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 100 (http block)
    • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 6 setup/js/node_moremote (http block)
  • https://api.github.com/repos/github/gh-aw/contents/.github/workflows/shared/reporting.md
    • Triggering command: /tmp/go-build310667193/b405/cli.test /tmp/go-build310667193/b405/cli.test -test.testlogfile=/tmp/go-build310667193/b405/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v0.47.4
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v0.47.4 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/git --show-toplevel -dwarf=false /usr/bin/git git rev-�� --show-toplevel git /usr/bin/infocmp --show-toplevel /tmp/go-build310rev-parse /usr/bin/git infocmp (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq [.object.sha, .object.type] | @tsv rite '../../../**/*.json' '!../../../pkg/workfloremote.origin.url /tmp/go-build499315447/b224/vet.cfg ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet h ../../../.pret/usr/bin/git (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.2.3
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq [.object.sha, .object.type] | @tsv th .prettierigno--thin commit.gpgsign 64/pkg/tool/linu-q (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v2.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq [.object.sha, .object.type] | @tsv th .prettierigno--detach cfg ode_modules/.bin/node (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq [.object.sha, .object.type] | @tsv th .prettierignore --log-level=error cfg 64/pkg/tool/linux_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq [.object.sha, .object.type] | @tsv th .prettierignore --log-level=error core.hooksPath _modules/.bin/node (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v3.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq [.object.sha, .object.type] | @tsv th .prettierignore --log-level=error cfg 64/pkg/tool/linux_amd64/vet (http block)
  • https://api.github.com/repos/google-github-actions/auth/git/ref/tags/v2
    • Triggering command: /usr/bin/gh gh api /repos/google-github-actions/auth/git/ref/tags/v2 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/git k/gh-aw/gh-aw/pkgit test@example.comrev-parse clusion,workflow--show-toplevel git rev-�� --show-toplevel ache/node/24.14.1/x64/bin/node /usr/bin/git /repos/actions/ggit --jq /usr/bin/git git (http block)
  • https://api.github.com/repos/nonexistent/action/git/ref/tags/v999.999.999
    • Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq [.object.sha, .object.type] | @tsv rite '../../../**/*.json' '!../../../pkg/workflow/js/**/*.json' --ignore-path /tmp/go-build499315447/b226/vet.cfg 64/pkg/tool/linux_amd64/compile h ../../../.pretgit (http block)
  • https://api.github.com/repos/nonexistent/repo/actions/runs/12345
    • Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion (http block)
  • https://api.github.com/repos/owner/repo/actions/workflows
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo x_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh workflow list --repo owner/repo --json name,path,state k/gh-aw/gh-aw/actions/setup/js/node_modules/.bin/sh -errorsas -ifaceassert erignore rtcfg -uns�� ons/secrets /tmp/go-build499315447/b267/vet.cfg ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile (http block)
  • https://api.github.com/repos/test-owner/test-repo/actions/secrets
    • Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name re --log-level=error --local x_amd64/vet http.https://git/opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/compile (http block)
  • https://api.github.com/repos/test/repo
    • Triggering command: /usr/bin/gh gh api /repos/test/repo --jq .default_branch t644767014 /tmp/go-build499315447/b179/vet.cfg .yml ath ../../../.prgit (http block)

If you need me to access, download, or install something from one of these locations, you can either:

…t bash variable expansion

When AllowedDomains contains a GitHub Actions expression (${{ }}),
shellEscapeArg switches to double-quote wrapping for the entire AWF
config JSON. Inside that double-quoted bash string the JSON key $schema
was expanded by bash as a variable — always empty — which produced ""
as the key and caused AWF to reject the config with:

  Error loading --config: Invalid AWF config: config. is not supported

Fix: add escapeBareShellDollarSigns() which replaces every $ that is
NOT the start of a ${{ }} expression with \$, preventing bash variable
expansion. ${{ }} GitHub Actions expressions are left untouched so the
runner can evaluate them before the shell runs.

Fixes: AWF JSON-config printf emits unescaped $schema

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/42052bb9-c390-4568-a862-9e444c35a2ed

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copilot AI changed the title [WIP] Fix unescaped $schema in AWF JSON-config printf fix: escape bare $schema in double-quoted AWF config printf to prevent bash variable expansion May 7, 2026
Copilot AI requested a review from pelikhan May 7, 2026 19:12
@pelikhan pelikhan marked this pull request as ready for review May 7, 2026 19:54
Copilot AI review requested due to automatic review settings May 7, 2026 19:54
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Fixes a bug where AWF config JSON written via a double-quoted printf argument could have $schema interpreted by bash as a shell variable (expanding to empty), producing invalid JSON when AllowedDomains contains a ${{ ... }} GitHub Actions expression.

Changes:

  • Updated shellEscapeArg to escape “bare” dollar signs ($) when using the double-quote path, while preserving ${{ ... }} expressions.
  • Added focused unit tests for dollar escaping and new shellEscapeArg table cases covering mixed $schema + ${{ ... }} inputs.
  • Added an AWF command-building regression test asserting \$schema appears in the generated shell command while expressions remain intact.
Show a summary per file
File Description
pkg/workflow/shell.go Adds escapeBareShellDollarSigns() and applies it in the expression/double-quote escaping path.
pkg/workflow/shell_test.go Adds unit tests and new table cases for mixed $schema + ${{ ... }} escaping behavior.
pkg/workflow/awf_config_test.go Adds regression coverage ensuring \$schema is present in the AWF command when expressions force double-quoting.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

  • Files reviewed: 3/3 changed files
  • Comments generated: 1

Comment thread pkg/workflow/shell_test.go Outdated
{
name: "JSON with $schema key and GitHub Actions expression escapes bare dollar",
input: `{"$schema":"https://example.com","network":{"allowDomains":["${{ env.DOMAINS }}"]}}`,
expected: `"{\"\$schema\":\"https://example.com\",\"network\":{\"allowDomains\":[\"${{ env.DOMAINS }}\"]}}"`},
@pelikhan
Copy link
Copy Markdown
Collaborator

pelikhan commented May 7, 2026

@copilot review all comments

The test case for the JSON $schema / GitHub Actions expression mix was
missing a trailing comma after the expected: field in the struct literal.
Go requires comma-terminated fields in composite literals; without it the
code would not compile under strict formatting checks.

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/5e45fe27-8fb4-450d-b268-1d3428562217

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copy link
Copy Markdown
Contributor Author

Copilot AI commented May 7, 2026

@copilot review all comments

Fixed in e87c4e9 — added the missing trailing comma after the expected: field and moved the struct-closing }, to its own line.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

  • https://api.github.com/graphql
    • Triggering command: /usr/bin/gh gh repo view --json owner,name --jq .owner.login &#43; &#34;/&#34; &#43; .name /usr/bin/tail OUTPUT -d 168.63.129.16 tail -5 742507278 owner m/_npx/b388654678d519d9/node_modules/.bin/sh 0 -j ACCEPT /bin/sh (http block)
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw (http block)
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw erignore (http block)
  • https://api.github.com/orgs/test-owner/actions/secrets
    • Triggering command: /usr/bin/gh gh api /orgs/test-owner/actions/secrets --jq .secrets[].name h ../../../.pret.prettierignore (http block)
  • https://api.github.com/repos/actions/ai-inference/git/ref/tags/v1
    • Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq [.object.sha, .object.type] | @tsv --show-toplevel sh /usr/bin/gh 77035619/001 /home/REDACTED/worrev-parse /opt/hostedtoolc--show-toplevel gh api /repos/actions/checkout/git/ref/tags/v6 --jq /usr/bin/git tructions-test-3gh -buildtags /opt/hostedtoolc/repos/actions/github-script/git/ref/tags/v9 git (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v3
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq [.object.sha, .object.type] | @tsv WorkflowFiles_AlwaysRecompiles2327854545/001 --json /usr/bin/git --limit 100 --created git init�� /ref/tags/v9 git sv --local user.name tions/setup/js/n--show-toplevel gh (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v5
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq [.object.sha, .object.type] | @tsv 896579872/.github/workflows -trimpath (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq [.object.sha, .object.type] | @tsv --show-toplevel git-upload-pack /usr/bin/git -aw/git/ref/tagsgit (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq [.object.sha, .object.type] | @tsv k/_tool infocmp /usr/bin/infocmp xterm-color node /usr/bin/git infocmp -1 xterm-color git /home/REDACTED/.local/bin/node --show-toplevel ache/go/1.25.8/xrev-parse /usr/bin/gh node (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v6
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv tructions-test-3896579872/.github/workflows -buildtags /opt/hostedtoolcache/node/24.14.1/x64/bin/node l -ifaceassert -nilfunc node /tmp�� ithub-script/git/ref/tags/v9 -tests bject.type] | @tsv github/workflowsgit (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv /tmp/TestHashConsistency_InlinedImports1712497905/001/inlined-a.remote.origin.url l /usr/bin/git h ../../../.pretgit (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv (http block)
  • https://api.github.com/repos/actions/github-script/git/ref/tags/v8
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq [.object.sha, .object.type] | @tsv xterm-color git /usr/bin/git md d /usr/bin/git git rev-�� ithub-script/git/ref/tags/v9 git bject.type] | @tsv (http block)
  • https://api.github.com/repos/actions/github-script/git/ref/tags/v9
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv d (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv h1327636317/001&#39; h1327636317/001&#39; ache/node/24.14.../../../.prettierignore o (http block)
  • https://api.github.com/repos/actions/github-script/git/ref/tags/v9.0.0
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9.0.0 --jq [.object.sha, .object.type] | @tsv (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9.0.0 --jq [.object.sha, .object.type] | @tsv js/**/*.json&#39; --ignore-path ../../../.prettierignore (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9.0.0 --jq [.object.sha, .object.type] | @tsv ../pkg/workflow/js/**/*.json&#39; --ignore-path ../../../.prettierignore (http block)
  • https://api.github.com/repos/actions/setup-go/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --show-toplevel ache/go/1.25.8/x64/pkg/tool/linux_amd64/link /usr/bin/git 6684037/b426/gitgh (http block)
  • https://api.github.com/repos/actions/setup-node/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/git on&#39; --ignore-patgit --global tions/setup/js/n--show-toplevel git -C /tmp/gh-aw-test-runs/20260507-204432-9044/test-219907163 resolved$ (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv /repos/actions/github-script/git/ref/tags/v9 --jq /usr/bin/git RequiresMinInteggh -run (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/git --show-toplevel (http block)
  • https://api.github.com/repos/actions/setup-node/git/ref/tags/v6
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv tructions-test-3896579872 -test.v=true ache/node/24.14.1/x64/bin/node -test.timeout=10gh -test.run=^Test -test.short=true/repos/actions/github-script/git/ref/tags/v9 ache/node/24.14.--jq 0462�� &#39;x&#39; &amp;&amp; github.actor || github.repository (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv /tmp/TestHashConsistency_InlinedImports1712497905/001/inlined-b.md (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv waysRecompiles2327854545/001 rev-parse /usr/bin/git (http block)
  • https://api.github.com/repos/actions/upload-artifact/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv (http block)
  • https://api.github.com/repos/aws-actions/configure-aws-credentials/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/aws-actions/configure-aws-credentials/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/git --show-toplevel (http block)
    • Triggering command: /usr/bin/gh gh api /repos/aws-actions/configure-aws-credentials/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/git --show-toplevel s/12346/artifactapi /usr/bin/git git rev-�� /ref/tags/v9 git sv /tmp/gh-aw-test-git config /usr/bin/git git (http block)
  • https://api.github.com/repos/azure/login/git/ref/tags/v2
    • Triggering command: /usr/bin/gh gh api /repos/azure/login/git/ref/tags/v2 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/git /tmp/gh-aw-test-git rev-parse /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel l me: String!) { xterm-color git (http block)
  • https://api.github.com/repos/docker/login-action/git/ref/tags/v3
    • Triggering command: /usr/bin/gh gh api /repos/docker/login-action/git/ref/tags/v3 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/git --show-toplevel (http block)
  • https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v0.1.2
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0.1.2 --jq [.object.sha, .object.type] | @tsv --show-toplevel ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet /usr/bin/git ApprovalLabelsCogh ../../../**/*.jsapi /home/REDACTED/wor/repos/actions/github-script/git/ref/tags/v9 git rev-�� --show-toplevel node /usr/bin/git prettier --write ache/node/24.14.xterm-color git (http block)
  • https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq [.object.sha, .object.type] | @tsv --show-toplevel (http block)
  • https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.2.3
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq [.object.sha, .object.type] | @tsv /ref/tags/v9 --jq sv json&#39; --ignore-pgit (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs
    • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --limit 100 --created &gt;=2026-04-30 (http block)
    • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --limit 100 --created &gt;=2026-04-07 (http block)
    • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --limit 100 --created &gt;=2026-02-06 (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/1/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/1/artifacts --jq .artifacts[].name HEAD 64/pkg/tool/linux_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh run download 1 --dir test-logs/run-1 stmain.go util.test (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/12345/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12345/artifacts --jq .artifacts[].name origin in/node (http block)
    • Triggering command: /usr/bin/gh gh run download 12345 --dir test-logs/run-12345 origin /usr/bin/bash (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/1234567890
    • Triggering command: /usr/bin/gh gh api repos/{owner}/{repo}/actions/runs/1234567890 --jq {databaseId: .id, number: .run_number, url: .html_url, status: .status, conclusion: .conclusion, workflowName: .name, workflowPath: .path, createdAt: .created_at, startedAt: .run_started_at, updatedAt: .updated_at, event: .event, headBranch: .head_branch, on&#39; --ignore-path ../../../.prettierignore (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/12346/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12346/artifacts --jq .artifacts[].name origin ache/node/24.14.1/x64/lib/node_modules/npm/node_modules/@npmcli/run-script/lib/node-gyp-bin/node--show-toplevel (http block)
    • Triggering command: /usr/bin/gh gh run download 12346 --dir test-logs/run-12346 origin 64/pkg/tool/linux_amd64/vet (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/2/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/2/artifacts --jq .artifacts[].name HEAD 64/pkg/tool/linux_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh run download 2 --dir test-logs/run-2 g/workflow/import_schema_test.go 64/pkg/tool/linux_amd64/vet (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/3/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/3/artifacts --jq .artifacts[].name HEAD 64/pkg/tool/linux_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh run download 3 --dir test-logs/run-3 copilot/fix-json-config-unescaped-schema 64/pkg/tool/linux_amd64/vet (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/4/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/4/artifacts --jq .artifacts[].name HEAD 64/pkg/tool/linux_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh run download 4 --dir test-logs/run-4 copilot/fix-json-config-unescaped-schema ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/5/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/5/artifacts --jq .artifacts[].name HEAD l_url, status: .status, conclusion: .conclusion, workflowName: .name, workflowPath: .path, creat--show-toplevel (http block)
    • Triggering command: /usr/bin/gh gh run download 5 --dir test-logs/run-5 copilot/fix-json-config-unescaped-schema ache/go/1.25.8/x64/pkg/tool/linux_amd64/link (http block)
  • https://api.github.com/repos/github/gh-aw/actions/workflows
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path h ../../../.prettierignore (http block)
    • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 100 (http block)
    • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 6 (http block)
  • https://api.github.com/repos/github/gh-aw/contents/.github/workflows/shared/reporting.md
    • Triggering command: /tmp/go-build1616684037/b405/cli.test /tmp/go-build1616684037/b405/cli.test -test.testlogfile=/tmp/go-build1616684037/b405/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v0.47.4
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v0.47.4 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/git (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq [.object.sha, .object.type] | @tsv rite &#39;**/*.cjs&#39; &#39;**/*.ts&#39; &#39;**/*.json&#39; --ignore-path ../../../.pr**/*.json (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.2.3
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq [.object.sha, .object.type] | @tsv json&#39; --ignore-path ../../../.pr**/*.json (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v2.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq [.object.sha, .object.type] | @tsv json&#39; --ignore-path ../../../.pr**/*.json (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq [.object.sha, .object.type] | @tsv json&#39; --ignore-p--thin (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq [.object.sha, .object.type] | @tsv tmatter-with-arrays.md (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v3.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq [.object.sha, .object.type] | @tsv ant-1679254166/.github/workflows (http block)
  • https://api.github.com/repos/google-github-actions/auth/git/ref/tags/v2
    • Triggering command: /usr/bin/gh gh api /repos/google-github-actions/auth/git/ref/tags/v2 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/git ons-test18831702git remote ow-without-react--show-toplevel git rev-�� --show-toplevel git /usr/bin/infocmp --get remote.origin.urrev-parse om/owner/repo.gi--show-toplevel infocmp (http block)
  • https://api.github.com/repos/nonexistent/action/git/ref/tags/v999.999.999
    • Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq [.object.sha, .object.type] | @tsv 4432-9044/test-source-field-variant-1679254166/.github/workflows (http block)
  • https://api.github.com/repos/nonexistent/repo/actions/runs/12345
    • Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion (http block)
  • https://api.github.com/repos/owner/repo/actions/workflows
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo es/.bin/node hub.com/.extrahe/opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo de/node/bin/git hub.com/.extrahe/opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh workflow list --repo owner/repo --json name,path,state k/node_modules/.bin/sh nore (http block)
  • https://api.github.com/repos/test-owner/test-repo/actions/secrets
    • Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name h ../../../.pret.prettierignore (http block)
  • https://api.github.com/repos/test/repo
    • Triggering command: /usr/bin/gh gh api /repos/test/repo --jq .default_branch 4432-9044/test-source-field-variant-2283527500 log 1/x64/bin/node -n1 --format=format:rev-parse --end-of-options--show-toplevel node t-ha�� SameOutput4260869308/001/stability-test.md **/*.cjs 1/x64/bin/node **/*.json --ignore-path erignore sh (http block)

If you need me to access, download, or install something from one of these locations, you can either:

@pelikhan pelikhan merged commit 89e3ea6 into main May 7, 2026
@pelikhan pelikhan deleted the copilot/fix-json-config-unescaped-schema branch May 7, 2026 20:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

AWF JSON-config printf emits unescaped $schema, bash expands to empty key, AWF rejects with config. is not supported

3 participants