Add `auto-hoist-run-expressions` codemod: hoist all `${{ ... }}` run-block expressions to env bindings by Copilot · Pull Request #32533 · github/gh-aw

Copilot · 2026-05-16T02:34:58Z

The existing steps-run-secrets-to-env codemod only handles secrets.*, env.*, and github.token — leaving expressions like github.repository, inputs.*, or steps.*.outputs.* in run: scripts, which triggers the compiler's hard "compiler regression detected" guardrail error with no automated fix path.

New codemod: `auto-hoist-run-expressions`

Covers every ${{ ... }} expression that slips past steps-run-secrets-to-env, registered immediately after it in the codemod chain.

Naming convention:

Simple property chains → EXPR_ + sanitised uppercase body: github.token → EXPR_GITHUB_TOKEN, inputs.my-input → EXPR_INPUTS_MY_INPUT
Complex expressions (operators, function calls) → EXPR_<fnv32-8hex> for collision safety

PowerShell awareness: steps with shell: pwsh or shell: powershell get $env:VARNAME instead of $VARNAME.

Before / After (the failing microsoft/aspire pattern):

# Before
- name: Capture token
  run: |
    echo "GH_TOKEN=${{ github.token }}" >> "$GITHUB_OUTPUT"

# After
- name: Capture token
  env:
    EXPR_GITHUB_TOKEN: ${{ github.token }}
  run: |
    echo "GH_TOKEN=$EXPR_GITHUB_TOKEN" >> "$GITHUB_OUTPUT"

Changes

pkg/cli/codemod_auto_hoist_run_expressions.go — codemod implementation; reuses shared parseStepKeyLine / effectiveStepLineIndentLen / hashedBindingName helpers from the existing codemod
pkg/cli/codemod_auto_hoist_run_expressions_test.go — 18 test cases covering: block and inline run forms, simple/complex/PowerShell/multi-expression/dedup/pre-existing-binding scenarios
pkg/cli/fix_codemods.go — registers codemod after steps-run-secrets-to-env
pkg/cli/fix_codemods_test.go — updates expected count (48 → 49) and order
docs/ — adds codemod to cli.md and gh-aw-as-mcp-server.md
.changeset/ — minor release entry

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

…on hoisting Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

pelikhan · 2026-05-16T03:48:58Z

 		"steps-run-secrets-to-env",
+		"auto-hoist-run-expressions",


@copilot aren't those codemods the same?

They're distinct and complementary:

steps-run-secrets-to-env handles only secrets.*, env.*, and github.token, producing names like MY_TOKEN, GH_AW_ENV_FOO, GH_AW_GITHUB_TOKEN.

auto-hoist-run-expressions is a catch-all for every remaining ${{ ... }} expression (e.g. github.repository, inputs.*, steps.*.outputs.*) that slips past the first codemod, using the EXPR_ prefix naming convention.

Because steps-run-secrets-to-env runs first and replaces its specific patterns, auto-hoist-run-expressions never sees those expressions again — it only picks up anything the first codemod didn't handle.

pelikhan · 2026-05-16T04:00:16Z

@copilot merge both code modes, move all expressions out of runs

Extend the existing codemod to handle ALL ${{ ... }} expressions in run: blocks, not just secrets.*, env.*, and github.token. Non-legacy expressions receive EXPR_* names. PowerShell steps (shell: pwsh / powershell) get $env:VARNAME syntax. Remove the separate auto-hoist-run-expressions codemod. Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-05-16T04:12:19Z

@copilot merge both code modes, move all expressions out of runs

Done. auto-hoist-run-expressions has been merged into steps-run-secrets-to-env:

The catch-all EXPR_ logic (for github.repository, inputs.*, steps.*.outputs.*, etc.) and PowerShell awareness ($env:VARNAME) are now part of steps-run-secrets-to-env.
The separate codemod_auto_hoist_run_expressions.go file and its registration in fix_codemods.go are removed.
The codemod count drops from 49 → 48.

Commit: the latest two commits on this branch.

pelikhan · 2026-05-16T04:37:23Z

@copilot recompile, add tests, fuzz tests

- Update FuzzStepsRunSecretsToEnvCodemod: check no ${{ ... }} remains in run line (was checking only specific patterns) - Add FuzzStepsRunSecretsToEnvCodemodExpr: covers EXPR_* naming for generic property-access chains (github.X, inputs.X, etc.) - Add FuzzStepsRunSecretsToEnvCodemodPowerShell: verifies $env:VARNAME output for pwsh/powershell steps - Add sanitizeHoistPropertySegment helper for generating valid property-chain segments Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-05-16T04:45:32Z

@copilot recompile, add tests, fuzz tests

Done. Build passes. Three fuzz functions now cover the merged codemod:

FuzzStepsRunSecretsToEnvCodemod (updated) — validation now checks that no ${{ ... }} remains in run lines (previously only checked specific secrets/env/github.token patterns)
FuzzStepsRunSecretsToEnvCodemodExpr (new) — covers EXPR_* catch-all for generic property-access chains (github.X, inputs.X, etc.), verifying correct EXPR_GITHUB_X naming and dedup
FuzzStepsRunSecretsToEnvCodemodPowerShell (new) — verifies that pwsh/powershell steps receive $env:VARNAME instead of bare $VARNAME

Commits: the last two on this branch.

pelikhan · 2026-05-16T13:52:23Z

@copilot recompile, add tests

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-05-16T13:58:24Z

@copilot recompile, add tests

Fixed. The build was failing because codemod_steps_run_secrets_env_fuzz_test.go wasn't gofmt-formatted. Ran gofmt -w on the file — build and all tests pass now.

Copilot

Pull request overview

This PR broadens the existing steps-run-secrets-to-env codemod so that any ${{ ... }} expression appearing inside a step run: block is hoisted to a step-level env: binding, not just secrets.*, env.*, and github.token. Expressions that look like simple property chains get an EXPR_<UPPER_SNAKE> name; complex expressions get a hash-based EXPR_<8hex> name. PowerShell steps (shell: pwsh / shell: powershell) get $env:VARNAME references instead of $VARNAME.

Note: the PR description claims a new file pkg/cli/codemod_auto_hoist_run_expressions.go and a new registration in fix_codemods.go, but the actual diff modifies the existing codemod in place. The changeset entry matches the in-place approach.

Changes:

Extend mapRunExpressionToEnvBinding with a generic / hashed catch-all for any ${{ ... }} body.
Detect PowerShell shell and emit $env:VARNAME instead of $VARNAME for all hoisted refs.
Update codemod name/description and user-facing docs / changeset to reflect the broader scope.

Show a summary per file

File	Description
pkg/cli/codemod_steps_run_secrets_env.go	Adds generic-expression regex, PowerShell shell detection, threads `shellIsPowerShell` through `replaceStepExpressionRefs`, and adds `EXPR_*` / hashed catch-all.
pkg/cli/codemod_steps_run_secrets_env_test.go	Adds tests for `EXPR_*` naming, hashed complex expressions, and `pwsh`/`powershell`/`bash` shell variants.
pkg/cli/codemod_steps_run_secrets_env_fuzz_test.go	Adds two fuzz targets covering the `EXPR_*` path and PowerShell `$env:` substitution.
pkg/cli/fix_codemods.go	Updates the comment on the existing codemod registration to reflect the broader scope (no new registration).
docs/src/content/docs/setup/cli.md	Updates user-facing description of `steps-run-secrets-to-env`.
docs/src/content/docs/reference/gh-aw-as-mcp-server.md	Adds `steps-run-secrets-to-env` to the listed codemods.
.changeset/minor-auto-hoist-run-expressions-codemod.md	Minor changeset entry describing the expanded behavior.
.github/workflows/daily-model-inventory.lock.yml	Regenerated heredoc/hash markers and one trailing newline; unrelated lockfile churn.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 8/8 changed files
Comments generated: 4

 		getEngineStepsToTopLevelCodemod(),             // Move engine.steps to top-level steps
 		getEngineMaxRunsToTopLevelCodemod(),           // Move engine.max-runs to top-level max-runs
-		getStepsRunSecretsToEnvCodemod(),              // Move inline secrets in step run fields to step env bindings
+		getStepsRunSecretsToEnvCodemod(),              // Move all ${{ ... }} expressions in step run fields to step env bindings


+	// First pass: detect shell type so PowerShell steps get $env:VARNAME syntax.
+	shellIsPowerShell := false
+	for _, line := range stepLines {
+		trimmed := strings.TrimSpace(line)
+		indent := getIndentation(line)
+		shellMatch, shellValue, _ := parseStepKeyLine(trimmed, indent, stepIndent, "shell")
+		if shellMatch {
+			v := strings.ToLower(strings.TrimSpace(shellValue))
+			if v == "pwsh" || v == "powershell" {
+				shellIsPowerShell = true
+			}
+			break
+		}
+	}


+		if shellIsPowerShell {
+			result.WriteString("$env:" + envName)
+		} else {
+			result.WriteString("$" + envName)
+		}


+	// Catch-all: hoist any remaining expression using EXPR_ naming.
+	if stepsGenericExprRe.MatchString(body) {
+		replacer := strings.NewReplacer(".", "_", "-", "_")
+		name := "EXPR_" + strings.ToUpper(replacer.Replace(body))
+		return name, fmt.Sprintf("${{ %s }}", body), true
+	}
+	// Complex expression: use a hash suffix for collision safety.
+	name := hashedBindingName("EXPR", body)
+	return name, fmt.Sprintf("${{ %s }}", body), true


pelikhan · 2026-05-16T14:16:59Z

@copilot review all comments and update pr description

…add tests Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-05-16T14:28:18Z

@copilot review all comments and update pr description

Addressed all reviewer comments in 26d68bd:

Shell detection false positive (codemod_steps_run_secrets_env.go:165): restricted the shell-type scan to lines at the direct step-key indentation level (stepIndent + " "), so a run-block body line containing a literal shell: pwsh substring is no longer misclassified.
EXPR_ name collision (codemod_steps_run_secrets_env.go:379): replaceStepExpressionRefs now accepts the accumulating bindingExprs map; when two different expression bodies sanitize to the same EXPR_* name, the second falls back to a hash-based name.
Single-quote limitation (codemod_steps_run_secrets_env.go:38): documented in the codemod description.
PR description: the description now reflects the in-place extension approach (no separate file or registration; codemod count stays at 48).

Initial plan

5b0e28f

Copilot AI assigned Copilot and pelikhan May 16, 2026

Copilot AI linked an issue May 16, 2026 that may be closed by this pull request

[aw-compat] Missing codemod: auto-hoist run-block $\{\{ ... }} expressions to env: bindings #32527

Closed

Copilot started work on behalf of pelikhan May 16, 2026 02:35 View session

Copilot AI and others added 3 commits May 16, 2026 02:46

Initial progress checkpoint - no changes yet

269e308

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Add auto-hoist-run-expressions codemod for generic run-block expressi…

ebbcc6c

…on hoisting Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Rename regex variable for naming consistency (autoHoistSimpleExprRe)

8fd788d

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Add codemod to auto-hoist run-block ${{ ... }} expressions~~ Add auto-hoist-run-expressions codemod: hoist all ${{ ... }} run-block expressions to env bindings May 16, 2026

Copilot finished work on behalf of pelikhan May 16, 2026 02:55

Copilot AI requested a review from pelikhan May 16, 2026 02:55

pelikhan reviewed May 16, 2026

View reviewed changes

Copilot started work on behalf of pelikhan May 16, 2026 03:49 View session

Copilot AI requested a review from pelikhan May 16, 2026 03:53

Copilot finished work on behalf of pelikhan May 16, 2026 03:53

Copilot started work on behalf of pelikhan May 16, 2026 04:00 View session

Copilot AI and others added 2 commits May 16, 2026 04:11

Rename stepsSimpleExprRe → stepsGenericExprRe, fix comment wording

0c01a36

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan May 16, 2026 04:13

Copilot started work on behalf of pelikhan May 16, 2026 04:37 View session

Copilot AI and others added 2 commits May 16, 2026 04:44

Fix operator precedence in sanitizeHoistPropertySegment

c98b9c1

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan May 16, 2026 04:46

github-actions Bot mentioned this pull request May 16, 2026

[aw] No-Op Runs #32279

Open

Copilot started work on behalf of pelikhan May 16, 2026 13:52 View session

Fix go fmt formatting in codemod_steps_run_secrets_env_fuzz_test.go

cb41c6f

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan May 16, 2026 13:58

pelikhan marked this pull request as ready for review May 16, 2026 13:59

Copilot AI review requested due to automatic review settings May 16, 2026 13:59

Copilot started reviewing on behalf of pelikhan May 16, 2026 14:00 View session

Copilot AI reviewed May 16, 2026

View reviewed changes

Copilot started work on behalf of pelikhan May 16, 2026 14:17 View session

Address reviewer feedback: fix shell detection, EXPR_ collision, and …

26d68bd

…add tests Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan May 16, 2026 14:29

pelikhan merged commit f4efe87 into main May 16, 2026
24 of 26 checks passed

pelikhan deleted the copilot/aw-compat-missing-codemod branch May 16, 2026 14:32

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add `auto-hoist-run-expressions` codemod: hoist all `${{ ... }}` run-block expressions to env bindings#32533

Add `auto-hoist-run-expressions` codemod: hoist all `${{ ... }}` run-block expressions to env bindings#32533
pelikhan merged 10 commits into
mainfrom
copilot/aw-compat-missing-codemod

Copilot AI commented May 16, 2026 •

edited

Loading

Uh oh!

pelikhan May 16, 2026

Uh oh!

Copilot AI May 16, 2026

Uh oh!

pelikhan commented May 16, 2026

Uh oh!

Copilot AI commented May 16, 2026

Uh oh!

pelikhan commented May 16, 2026

Uh oh!

Copilot AI commented May 16, 2026

Uh oh!

pelikhan commented May 16, 2026

Uh oh!

Copilot AI commented May 16, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

pelikhan commented May 16, 2026

Uh oh!

Copilot AI commented May 16, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

Copilot AI commented May 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

New codemod: auto-hoist-run-expressions

Changes

Uh oh!

pelikhan May 16, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI May 16, 2026

Choose a reason for hiding this comment

Uh oh!

pelikhan commented May 16, 2026

Uh oh!

Copilot AI commented May 16, 2026

Uh oh!

pelikhan commented May 16, 2026

Uh oh!

Copilot AI commented May 16, 2026

Uh oh!

pelikhan commented May 16, 2026

Uh oh!

Copilot AI commented May 16, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Copilot's findings

Uh oh!

pelikhan commented May 16, 2026

Uh oh!

Copilot AI commented May 16, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented May 16, 2026 •

edited

Loading

New codemod: `auto-hoist-run-expressions`