Treat `gh aw` as a first-class runtime with release `setup-cli` injection, dev source build, and firewall domains by Copilot · Pull Request #31622 · github/gh-aw

Copilot · 2026-05-12T03:45:01Z

Introduces gh aw as a first-class runtime in workflow compilation, including runtime detection, runtime setup step generation, and runtime-derived firewall domains.

What changed

Added gh-aw runtime support under runtimes, including typed frontmatter parsing/serialization.
Added gh aw command-pair detection from run: steps.
Updated runtime setup behavior:
- Release mode uses github/gh-aw/actions/setup-cli with versioned setup.
- Dev mode now builds/installs from checked-out sources (gh extension install .) to match existing dev workflows.
Removed mutable @main usage and updated affected lock workflow action references to pinned/immutable refs.
Updated runtime and compiler tests to cover both release and dev setup paths and the dev source-install flow.

Validation

Ran targeted workflow runtime tests for detection and setup-step generation.
Ran final PR validation checks (code review + CodeQL scan).

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

pelikhan · 2026-05-12T03:48:02Z

 const DefaultGoVersion Version = "1.25"

+// DefaultGhAWVersion is the default gh-aw CLI version used by runtime setup.
+const DefaultGhAWVersion Version = "v0.72.1"


@copilot use the compiler version of released, otherwise use the build gh-aw version in dev mode. Look at how gh-aw is inserted currently.

Updated in 6b03a99. The gh-aw runtime no longer uses a hardcoded default; it now resolves to the current compiler/build version so release builds use the released compiler version and dev builds use the current build version.

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot

Pull request overview

This PR makes gh aw a first-class runtime in the workflow compiler: it can be declared under runtimes, is auto-detected from run: steps, and contributes runtime-derived firewall domains. It also updates generated lock workflows to inject github/gh-aw/actions/setup-cli.

Changes:

Added a new gh-aw runtime definition and runtime-step generation behavior (including default version resolution).
Implemented gh aw (token-pair) command detection and added coverage via new/updated unit tests.
Extended typed frontmatter parsing/serialization and firewall runtime→ecosystem domain mapping for gh-aw.

Show a summary per file

File	Description
pkg/workflow/runtime_step_generator.go	Computes default version for `gh-aw` at setup-step generation time.
pkg/workflow/runtime_setup_test.go	Adds detection test cases for `gh aw` usage.
pkg/workflow/runtime_gh_aw_test.go	New tests for frontmatter parsing/serialization, runtime detection, domains, and setup-step output for `gh-aw`.
pkg/workflow/runtime_detection.go	Adds special-case detection for `gh aw` token pair and default version helper.
pkg/workflow/runtime_definitions.go	Registers `gh-aw` as a known runtime mapped to `github/gh-aw/actions/setup-cli`.
pkg/workflow/frontmatter_types.go	Adds `runtimes.gh-aw` to the typed config model.
pkg/workflow/frontmatter_serialization.go	Ensures `gh-aw` is counted and serialized back to map form.
pkg/workflow/frontmatter_parsing.go	Adds parsing support for `runtimes: { gh-aw: ... }`.
pkg/workflow/domains.go	Maps `gh-aw` runtime to a new `gh-aw` ecosystem for domain expansion.
pkg/workflow/data/ecosystem_domains.json	Adds a `gh-aw` ecosystem domain list.
.github/workflows/static-analysis-report.lock.yml	Updates locked workflow to include `setup-cli` injection and manifest entry.
.github/workflows/copilot-token-optimizer.lock.yml	Updates locked workflow to include `setup-cli` injection and manifest entry.
.github/workflows/copilot-token-audit.lock.yml	Updates locked workflow to include `setup-cli` injection and manifest entry.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 13/13 changed files
Comments generated: 4

+		ID:             "gh-aw",
+		Name:           "gh-aw CLI",
+		ActionRepo:     "github/gh-aw/actions/setup-cli",
+		ActionVersion:  "main",
+		VersionField:   "version",
+		// Default version is computed at generation time from the current gh-aw build.
+		DefaultVersion: "",
+		Commands:       []string{"gh-aw"},


+      - name: Setup gh-aw CLI
+        uses: github/gh-aw/actions/setup-cli@main
+        with:
+          version: 'v0.72.1'


+      - name: Setup gh-aw CLI
+        uses: github/gh-aw/actions/setup-cli@main
+        with:
+          version: 'v0.72.1'


+      - name: Setup gh-aw CLI
+        uses: github/gh-aw/actions/setup-cli@main
+        with:
+          version: 'v0.72.1'


pelikhan · 2026-05-12T04:27:34Z

@copilot review all comments

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-05-12T04:39:47Z

@copilot review all comments

Addressed the actionable review feedback in 23fe371:

gh-aw runtime no longer uses setup-cli@main in runtime definitions (v0.72.1 now).
Updated the three lock workflows to use immutable SHA-pinned github/gh-aw/actions/setup-cli refs.

pelikhan · 2026-05-12T04:42:50Z

@copilot in dev mode, the compiler should inject the code to build gh-aw from sources like in other jobs.

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-05-12T04:59:02Z

@copilot in dev mode, the compiler should inject the code to build gh-aw from sources like in other jobs.

Addressed in 5c41aa9 (with test follow-ups in 78e817d and 29dbdfe). In dev mode, gh-aw runtime setup now builds/installs from checked-out sources via gh extension install . instead of using setup-cli release installation.

pelikhan · 2026-05-12T13:20:21Z

@copilot recompile

Copilot AI and others added 2 commits May 12, 2026 03:42

Add gh-aw runtime detection and setup-cli mapping

8dff4ae

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Address review feedback for gh-aw runtime

8ebbb24

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI assigned Copilot and pelikhan May 12, 2026

Copilot AI changed the title ~~Treat gh aw as runtime and emit setup-cli step~~ Treat gh aw as a first-class runtime with auto setup-cli injection and firewall domains May 12, 2026

Copilot finished work on behalf of pelikhan May 12, 2026 03:45

Copilot created this pull request from a session on behalf of pelikhan May 12, 2026 03:45 View session

Copilot AI requested a review from pelikhan May 12, 2026 03:45

pelikhan reviewed May 12, 2026

View reviewed changes

Copilot started work on behalf of pelikhan May 12, 2026 03:48 View session

Copilot AI and others added 3 commits May 12, 2026 03:52

Plan for addressing PR review feedback

b9e2ebb

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Use build/compiler version for gh-aw runtime default

0b6c3bc

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Refine gh-aw runtime default version resolution

6b03a99

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan May 12, 2026 04:05

Copilot AI requested a review from pelikhan May 12, 2026 04:05

pelikhan marked this pull request as ready for review May 12, 2026 04:13

Copilot AI review requested due to automatic review settings May 12, 2026 04:13

Copilot started reviewing on behalf of pelikhan May 12, 2026 04:14 View session

Copilot AI reviewed May 12, 2026

View reviewed changes

Copilot started work on behalf of pelikhan May 12, 2026 04:27 View session

Pin gh-aw setup-cli refs in lock workflows

23fe371

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan May 12, 2026 04:40

Copilot started work on behalf of pelikhan May 12, 2026 04:42 View session

Copilot AI and others added 3 commits May 12, 2026 04:56

Build gh-aw runtime from source in dev mode

5c41aa9

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Strengthen dev-mode gh-aw runtime test assertions

78e817d

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Cover gh-aw version check in dev runtime test

29dbdfe

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI changed the title ~~Treat gh aw as a first-class runtime with auto setup-cli injection and firewall domains~~ Treat gh aw as a first-class runtime with release setup-cli injection, dev source build, and firewall domains May 12, 2026

Copilot finished work on behalf of pelikhan May 12, 2026 04:59

github-actions Bot mentioned this pull request May 12, 2026

[Contribution Check Report] Contribution Check — 2026-05-12 #31610

Closed

Copilot started work on behalf of pelikhan May 12, 2026 13:20 View session

pelikhan merged commit 86ff05e into main May 12, 2026
1 check failed

pelikhan deleted the copilot/add-gh-aw-runtime-support branch May 12, 2026 13:48

Copilot stopped work on behalf of pelikhan due to an error May 12, 2026 13:49
The session was cancelled by the user.

github-actions Bot mentioned this pull request May 13, 2026

[aw-failures] Fix dev-mode gh-aw runtime step: gh extension install . missing GH_TOKEN — breaks every dev-mode gh aw workflow (PR #31622 [Content truncated due to length] #31892

Closed

6 tasks

Copilot AI mentioned this pull request May 13, 2026

Add GH_TOKEN to dev-mode gh-aw runtime install step generation #31898

Merged

github-actions Bot mentioned this pull request May 13, 2026

[docs] Update documentation for features from 2026-05-13 #31928

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Treat `gh aw` as a first-class runtime with release `setup-cli` injection, dev source build, and firewall domains#31622

Treat `gh aw` as a first-class runtime with release `setup-cli` injection, dev source build, and firewall domains#31622
pelikhan merged 9 commits into
mainfrom
copilot/add-gh-aw-runtime-support

Copilot AI commented May 12, 2026 •

edited

Loading

Uh oh!

pelikhan May 12, 2026

Uh oh!

Copilot AI May 12, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

pelikhan commented May 12, 2026

Uh oh!

Copilot AI commented May 12, 2026

Uh oh!

pelikhan commented May 12, 2026

Uh oh!

Copilot AI commented May 12, 2026

Uh oh!

pelikhan commented May 12, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

Copilot AI commented May 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What changed

Validation

Uh oh!

pelikhan May 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI May 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Copilot's findings

Uh oh!

pelikhan commented May 12, 2026

Uh oh!

Copilot AI commented May 12, 2026

Uh oh!

pelikhan commented May 12, 2026

Uh oh!

Copilot AI commented May 12, 2026

Uh oh!

pelikhan commented May 12, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented May 12, 2026 •

edited

Loading