Deduplicate workflow expression regex usage across extraction and validation paths#33716
Conversation
Agent-Logs-Url: https://github.com/github/gh-aw/sessions/29e7c138-92c6-49b2-bc82-67275b7e1667 Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/gh-aw/sessions/29e7c138-92c6-49b2-bc82-67275b7e1667 Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/gh-aw/sessions/29e7c138-92c6-49b2-bc82-67275b7e1667 Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>
|
Hey This PR cannot be accepted because it violates the project's contribution guidelines. This project explicitly does not accept traditional pull requests from contributors outside the core team. From CONTRIBUTING.md:
The What you should do instead:
This workflow ensures high-quality, well-thought-out contributions that align with the project's agentic development model. Why this matters: This project is developed using an inner-circle + agentic workflow model. The contribution process is designed to encourage detailed planning and discussion before implementation, which leads to better outcomes than direct code submissions. Please see CONTRIBUTING.md for the full contribution guidelines. Thank you for understanding! 🤖 Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "patchdiff.githubusercontent.com"See Network Configuration for more information.
|
There was a problem hiding this comment.
Pull request overview
This PR centralizes GitHub Actions expression-related regex usage by replacing file-local regex definitions in extraction and validation codepaths with the shared, exported patterns in pkg/workflow/expression_patterns.go, reducing drift risk and simplifying future grammar updates.
Changes:
- Replaced locally defined expression/unsafe-context regexes with shared patterns across template-injection validation, secret extraction, expression extraction, and expression safety validation.
- Updated related test helpers and benchmarks to reference the shared exported patterns directly.
- Removed redundant regex variables/indirections where patterns are now centrally defined.
Show a summary per file
| File | Description |
|---|---|
| pkg/workflow/template_injection_validation.go | Switched inline-expression and unsafe-context detection to shared patterns. |
| pkg/workflow/template_injection_validation_test.go | Updated test helper fast-path to use shared unsafe-context pattern. |
| pkg/workflow/secret_extraction.go | Reused shared secret-expression and inline-expression patterns. |
| pkg/workflow/expressions_benchmark_test.go | Updated benchmark options to use shared validation patterns. |
| pkg/workflow/expression_safety_validation.go | Switched markdown expression extraction/validation regex inputs to shared patterns. |
| pkg/workflow/expression_extraction.go | Reused shared expression patterns and shared AW inputs/import-inputs expression patterns for substitution. |
Copilot's findings
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comments suppressed due to low confidence (1)
pkg/workflow/template_injection_validation.go:62
- The header comment says “regex patterns” (plural) but this block now only defines allowedRunScriptExpressionRegex; inline/unsafe expression patterns are pulled from expression_patterns.go. Consider adjusting the comment to avoid implying multiple local regex definitions.
// Pre-compiled regex patterns for template injection detection
var (
// allowedRunScriptExpressionRegex matches trusted compiler-owned expressions that are
// intentionally rendered in generated run scripts and are not user-controlled.
allowedRunScriptExpressionRegex = regexp.MustCompile(`^\$\{\{\s*(env\.[^}]+|vars\.[^}]+|runner\.[^}]+|github\.(repository|run_id|workspace)|steps\.parse-guard-vars\.outputs\.(approval_labels|blocked_users|trusted_users)|job\.services\[[^]]+\]\.ports\[[^]]+\])\s*\}\}$`)
)
- Files reviewed: 6/6 changed files
- Comments generated: 2
| // Matches: ${{ secrets.SECRET_NAME }} or ${{ secrets.SECRET_NAME || 'default' }} | ||
| var secretExprPattern = regexp.MustCompile(`\$\{\{\s*secrets\.([A-Z_][A-Z0-9_]*)\s*(?:\|\|.*?)?\s*\}\}`) | ||
|
|
||
| // Pre-compiled regex patterns for ExtractSecretsFromValue (performance optimization) |
| @@ -19,10 +19,7 @@ var expressionExtractionLog = logger.New("workflow:expression_extraction") | |||
|
|
|||
| // Pre-compiled regexes for performance (avoid recompilation in hot paths) | |||
|
✅ PR Code Quality Reviewer completed the code quality review. |
|
🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅ |
|
🧪 Test Quality Sentinel completed test quality analysis. |
|
✅ Design Decision Gate 🏗️ completed the design decision gate check. No ADR enforcement needed: PR #33716 does not have the 'implementation' label and has 45 new lines of code in business logic directories (below the 100-line threshold). This is a refactor that consolidates duplicate regex patterns, not a new architectural decision. |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Review Summary
This PR successfully consolidates duplicated regex patterns into a centralized location (pkg/workflow/expression_patterns.go), eliminating multiple sources of truth for expression parsing, import-input substitution, secret extraction, and template-injection checks.
What was reviewed:
- 6 files with regex pattern replacements
- All replacements are exact equivalents - no logic changes
- Pattern naming is consistent and descriptive
Key strengths:
- ✅ Clean mechanical refactoring
- ✅ Improves maintainability
- ✅ Single source of truth for regex patterns
- ✅ No behavioral changes
No issues found - this refactoring is ready to merge.
Note
🔒 Integrity filter blocked 1 item
The following item was blocked because it doesn't meet the GitHub integrity level.
- #33716
pull_request_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
To allow these resources, lower min-integrity in your GitHub frontmatter:
tools:
github:
min-integrity: approved # merged | approved | unapproved | none🔎 Code quality review by PR Code Quality Reviewer · ● 619.8K
|
❌ Design Decision Gate 🏗️ failed during design decision gate check. |
|
✅ PR Code Quality Reviewer completed the code quality review. |
There was a problem hiding this comment.
Warning
Firewall blocked 1 domain
The following domain was blocked by the firewall during workflow execution:
proxy.golang.org
To allow these domains, add them to the
network.allowedlist in your workflow frontmatter:
network:
allowed:
- defaults
- "proxy.golang.org"See Network Configuration for more information.
🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer · ● 1.2M
Comments that could not be inline-anchored
pkg/workflow/expression_safety_validation.go:30
[/improve-codebase-architecture] Missed deduplication opportunity: orExpressionPattern here is identical to the centralized OrPattern already defined in expression_patterns.go (line 186).
// Both are identical:
orExpressionPattern = regexp.MustCompile(`^(.+?)\s*\|\|\s*(.+)$`)
OrPattern = regexp.MustCompile(`^(.+?)\s*\|\|\s*(.+)$`)Suggestion: Replace orExpressionPattern with OrPattern to complete the consolidation.
Note: `comparisonEx…
|
🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅ |
🧪 Test Quality Sentinel ReportNo new or modified tests to analyze. This PR contains only mechanical refactoring changes to test files:
Summary:
Verdict:
📖 About This CheckThe Test Quality Sentinel analyzes new and modified test functions to ensure they enforce behavioral contracts rather than implementation details. Since this PR contains no new or modified test logic, no quality scoring was performed.
|
|
🧪 Test Quality Sentinel completed test quality analysis. No new or behaviorally modified tests in PR #33716. All changes to test files are pure refactoring (renamed regex variables to pattern constants). Benchmark tests updated variable references only. No test quality analysis needed. |
There was a problem hiding this comment.
Code Quality Review Summary
This PR successfully consolidates duplicate regex patterns into the centralized expression_patterns.go file, eliminating redundancy across multiple validation and extraction files. The refactoring is clean, correct, and improves maintainability.
What Was Reviewed
✅ 6 files changed — all expression-related validation and extraction code
✅ 45 lines added (pattern references), 58 lines removed (duplicate definitions)
✅ Single source of truth for expression matching logic
✅ No behavior changes — pure refactoring with correct pattern substitution
Key Observations
Well-executed migration:
- Removed duplicate patterns:
expressionExtractionRegex,expressionRegex,needsStepsRegex,inputsRegex,awInputsRegex,awImportInputsRegex,envRegex,secretExprPattern,secretsExprFindPattern,inlineExpressionRegex,unsafeContextRegex - Replaced with centralized versions:
ExpressionPattern,ExpressionPatternDotAll,NeedsStepsPattern,InputsPattern,AWInputsPattern,AWImportInputsPattern,EnvPattern,SecretExpressionPattern,InlineExpressionPattern,UnsafeContextPattern - All substitutions are semantically identical — regex patterns match exactly
Intentionally preserved patterns:
comparisonExpressionPattern(local) ≠ComparisonExtractionPattern(centralized) — these serve different purposes and should remain separate- Local version captures both sides of comparison for validation
- Centralized version extracts property name only for extraction
orExpressionPattern(local) =OrPattern(centralized) — identical but kept local (minor opportunity for future cleanup)
Benefits
- Single source of truth — easier to maintain and update patterns
- Reduced code duplication — DRY principle applied effectively
- Better performance — patterns are pre-compiled once
- Consistent behavior — validation and extraction use same patterns
Verdict
APPROVE — This is a solid refactoring that improves code quality without changing behavior. No issues found.
Warning
Firewall blocked 1 domain
The following domain was blocked by the firewall during workflow execution:
proxy.golang.org
To allow these domains, add them to the
network.allowedlist in your workflow frontmatter:
network:
allowed:
- defaults
- "proxy.golang.org"See Network Configuration for more information.
Note
🔒 Integrity filter blocked 1 item
The following item was blocked because it doesn't meet the GitHub integrity level.
- #33716
pull_request_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
To allow these resources, lower min-integrity in your GitHub frontmatter:
tools:
github:
min-integrity: approved # merged | approved | unapproved | none🔎 Code quality review by PR Code Quality Reviewer · ● 1.3M
There was a problem hiding this comment.
Skills-Based Review 🧠
Applied /improve-codebase-architecture and /zoom-out based on this refactoring PR that consolidates regex patterns.
Key Themes
Architecture improvement:
- ✅ Single source of truth eliminates duplication across 4+ files (
expression_extraction.go,expression_safety_validation.go,secret_extraction.go,template_injection_validation.go) - ✅ Clear naming convention with
Patternsuffix improves discoverability - ✅ Excellent documentation in
expression_patterns.gowith categorization and usage examples
Opportunity for deeper safeguards:
- The centralized file lacks tests to verify the patterns are behaviorally identical to the ones they replace
- Without tests, future regex tweaks could introduce silent bugs in validation or extraction logic
- Consider adding pattern-specific tests (see inline comment)
Positive Highlights
- ✅ Deep module design:
expression_patterns.goprovides a simple, well-documented interface with clear categories - ✅ Complete migration: All call sites updated consistently, including benchmark tests
- ✅ Domain language: Pattern names (
AWInputsPattern,SecretExpressionPattern,UnsafeContextPattern) match the project's vocabulary - ✅ Future-proof: Regex grammar updates now happen in one place, reducing maintenance burden
- ✅ Performance preserved: Pre-compiled patterns maintain the hot-path optimization strategy
Verdict
This is a solid architectural improvement that makes the codebase easier to maintain. The pattern consolidation follows the /improve-codebase-architecture principle of deepening the module — creating a rich, well-documented interface for expression matching while eliminating scattered definitions.
The one suggestion is to add tests for the centralized patterns to guard against behavioral regressions. This is optional but recommended for long-term confidence.
🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer · ● 808.7K
|
🛠️ Agentic Maintenance updated this pull request branch. |
|
@copilot fix build wasm, merge main, recompile |
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
|
@copilot Merge main, recompile , fix conflicts |
…-regex-patterns # Conflicts: # pkg/workflow/testdata/TestWasmGolden_AllEngines/claude.golden # pkg/workflow/testdata/TestWasmGolden_AllEngines/codex.golden # pkg/workflow/testdata/TestWasmGolden_AllEngines/copilot.golden # pkg/workflow/testdata/TestWasmGolden_AllEngines/gemini.golden # pkg/workflow/testdata/TestWasmGolden_AllEngines/pi.golden # pkg/workflow/testdata/TestWasmGolden_CompileFixtures/basic-copilot.golden # pkg/workflow/testdata/TestWasmGolden_CompileFixtures/playwright-cli-mode.golden # pkg/workflow/testdata/TestWasmGolden_CompileFixtures/smoke-copilot.golden # pkg/workflow/testdata/TestWasmGolden_CompileFixtures/with-imports.golden Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
|
`` ``
|
Several workflow files were still redefining regexes that already exist in
pkg/workflow/expression_patterns.go, leaving multiple sources of truth for expression parsing, import-input substitution, secret extraction, and template-injection checks. This change switches those paths to the shared patterns so future grammar updates stay centralized.Use centralized expression patterns
expression_patterns.goAlign extraction paths with shared regexes
${{ ... }}extractiongithub.aw.inputs.*github.aw.import-inputs.*secrets.*Align template injection checks
Result
Warning
Firewall rules blocked me from connecting to one or more addresses (expand for details)
I tried to connect to the following addresses, but was blocked by firewall rules:
cafe.github.com/usr/bin/gh /usr/bin/gh send-telemetry GOMODCACHE go env Gitmain_branch2615418521/001' Gitmain_branch2615418521/001' x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(dns block)/usr/bin/gh /usr/bin/gh send-telemetry GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet(dns block)/usr/bin/gh /usr/bin/gh send-telemetry GOMODCACHE e/git env 3 GO111MODULE ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x-f -o 6733692/b001/_pk-f -trimpath 6733692/b001=> -p github.com/githu-C -lang=go1.25 /opt/hostedtoolcconfig(dns block)https://api.github.com/graphql/usr/bin/gh gh repo view --json owner,name --jq .owner.login + "/" + .name 64/bin/go tierignore GO111MODULE 64/bin/go go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)/usr/bin/gh gh repo view --json owner,name --jq .owner.login + "/" + .name k GOINSECURE GOMOD GOMODCACHE sY5xy3c/9ezsDU_VTest User sRem�� 1729696702 GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x^remote\..*\.gh-resolved$(http block)/usr/bin/gh gh pr list --repo github/gh-aw --state all --author app/github-actions --search created:2026-05-11T23:58:00Z..2026-05-12T00:05:00Z --limit 1 --json number --jq .[0].number GOMOD GOMODCACHE 64/pkg/tool/linu--json(http block)https://api.github.com/orgs/owner/actions/secrets/usr/bin/gh gh api /orgs/owner/actions/secrets --jq .secrets[].name prettier --check 64/bin/go --ignore-path .prettierignore 64/bin/go go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)https://api.github.com/orgs/test-owner/actions/secrets/usr/bin/gh gh api /orgs/test-owner/actions/secrets --jq .secrets[].name "prettier" --che-p go 64/bin/go -json GO111MODULE 64/bin/go go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)https://api.github.com/repos/actions/ai-inference/git/ref/tags/v1/usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq [.object.sha, .object.type] | @tsv /tmp/TestGuardPolicyTrustedUsersRequiresMinInteg-f config /usr/bin/git remote.origin.urinfocmp -nolocalimports -importcfg git -C /tmp/gh-aw-test-runs/20260521-065353-41798/aw-manifest-legacy-1811421881/.github-p config /usr/bin/git remote.upstream./usr/bin/git 5418521/002/work-C x_amd64/vet git(http block)https://api.github.com/repos/actions/checkout/git/ref/tags/v3/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq [.object.sha, .object.type] | @tsv -bool tPath,Error,Dir,GoFiles,IgnoredGnonexistent-workflow-12345 64/pkg/tool/linux_amd64/compile 001' 001' -nilfunc 64/pkg/tool/linu--jq -ato�� _.a -buildtags 2489902/b001/importcfg.link -errorsas rX-3xWlwZwP6g/x_-C -nilfunc 2489902/b001/_pkconfig(http block)https://api.github.com/repos/actions/checkout/git/ref/tags/v5/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq [.object.sha, .object.type] | @tsv Onlymin-integrity_with_repos_array_c1426915605/0remote.upstream.url GO111MODULE 163015/b510/importcfg.link GOINSECURE GOMOD GOMODCACHE pVpa0PbTt-W87/iTowner/test-repo env 5353-41798/test-1729696702/custom/workflows '/tmp/TestParseDefaultBranchFromLsRemoteWithRealGitcustom_branch3275158186/001' ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE /opt/hostedtoolc--jq(http block)/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq [.object.sha, .object.type] | @tsv ensions/gh-aw go /usr/bin/git 275158186/001 275158186/002/wo/opt/hostedtoolcache/node/24.15.0/x64/bin/npm x_amd64/vet git -C ensions/gh-aw config l remote.upstream./usr/bin/git GO111MODULE x_amd64/link git(http block)/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq [.object.sha, .object.type] | @tsv ensions/gh-aw config /usr/bin/git efaultBranchFrom/usr/bin/git efaultBranchFrom-C 64/bin/go /usr/bin/git -C ensions/gh-aw config bject.type] | @tsv -json GoFiles,IgnoredG-1 x_amd64/compile gh(http block)https://api.github.com/repos/actions/checkout/git/ref/tags/v6/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv /ref/tags/v9.0.0 GO111MODULE 0/x64/bin/node GOINSECURE GOMOD GOMODCACHE /opt/hostedtoolc--jq t-ha�� vaScript764076335/001/test-complex-frontmatter-w-errorsas /tmp/go-build584163015/b427/vet.cfg 350930/main.go GOSUMDB GOWORK 64/bin/go git(http block)/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv hLXh/0ELBy97bxPkfrkiwhLXh GO111MODULE ache/go/1.25.8/x64/pkg/tool/linux_amd64/link GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/link 1630�� api-consumption-report.md 163015/b507/_testmain.go 163015/b547/ssljson.test -errorsas ITI2U65IfuQQh/0t-C -nilfunc 163015/b547/ssljconfig(http block)/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE r: $owner, name: $name) { hasDiscussionsEnabled } } GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile -ato�� approach-validator.md -buildtags 0/x64/bin/node -errorsas es -nilfunc git(http block)https://api.github.com/repos/actions/github-script/git/ref/tags/v8/usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq [.object.sha, .object.type] | @tsv /tmp/TestHashConsistency_WithImports3204759248/001/main.md x_amd64/vet /usr/bin/git ub/workflows GO111MODULE 64/bin/go git remo�� GOMODCACHE go /usr/bin/git 002326/001 GO111MODULE x_amd64/asm git(http block)/usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq [.object.sha, .object.type] | @tsv cal/share/gh/extensions/gh-aw ^remote\..*\.gh-resolved$ l -json GO111MODULE 64/pkg/tool/linu/home/REDACTED/.local/share/gh/extensions/gh-aw /opt/hostedtoolcconfig /tmp�� /ref/tags/v9 64/pkg/tool/linux_amd64/vet sv e-frontmatter.mdinfocmp l_test.go ache/go/1.25.8/xxterm-color /usr/bin/git(http block)https://api.github.com/repos/actions/github-script/git/ref/tags/v9/usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv prettier --write 64/bin/go !../../../pkg/wogo --ignore-path ../../../.pretti-json node /opt�� prettier --check 64/bin/go **/*.ts **/*.json --ignore-path go(http block)/usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv "prettier" --wriGOINSECURE go 64/bin/go rror GO111MODULE run-script/lib/n-json sh -c "prettier" --cheGOINSECURE go 64/bin/go -json GO111MODULE 64/bin/go /opt/hostedtoolc-buildtags(http block)/usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv "prettier" --wriGOINSECURE go 64/bin/go -json GO111MODULE 64/bin/go sh -c "prettier" --cheGOINSECURE go 64/bin/go ot formatted. Ru/opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/vet GO111MODULE 64/bin/go go(http block)https://api.github.com/repos/actions/github-script/git/ref/tags/v9.0.0/usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9.0.0 --jq [.object.sha, .object.type] | @tsv npx prettier --wGOINSECURE go 64/bin/go -json GO111MODULE 64/bin/go node /opt�� prettier --check 64/bin/go **/*.ts **/*.json --ignore-path /bin/sh(http block)/usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9.0.0 --jq [.object.sha, .object.type] | @tsv prettier --write 64/bin/go !../../../pkg/wogo --ignore-path ../../../.pretti-json sh -c "prettier" --cheGOINSECURE go 64/bin/go -json GO111MODULE 64/bin/go /opt/hostedtoolc/tmp/go-build584163015/b432/vet.cfg(http block)/usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9.0.0 --jq [.object.sha, .object.type] | @tsv "prettier" --wriGOINSECURE go 64/bin/go -json GO111MODULE 64/bin/go sh -c "prettier" --cheGOINSECURE go 64/bin/go -json GO111MODULE 64/bin/go go(http block)https://api.github.com/repos/actions/setup-go/git/ref/tags/v4/usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv /tmp/go-build3297264636/b001/exe/a.out l ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet -buildmode=exe -buildid=fPSg5gi-1 -extld=gcc ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet -C /tmp/TestGuardPolicyBlockedUsersApprovalLabelsCononexistent/repo s/1/artifacts /usr/bin/git remote.origin.ur/usr/bin/git GO111MODULE 64/bin/go git(http block)https://api.github.com/repos/actions/setup-node/git/ref/tags/v4/usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv k/gh-aw/gh-aw/pkg/envutil/envutil.go k/gh-aw/gh-aw/pkg/envutil/envutil_test.go 0/x64/bin/node -errorsas -ifaceassert -nilfunc /opt/hostedtoolc--jq t-ha�� SameOutput348523305/001/stability-test.md -trimpath /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linu-lang=go1.25 -p main -lang=go1.25 /opt/hostedtoolcconfig(http block)/usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv ry=1 tmain.go ache/go/1.25.8/x64/pkg/tool/linux_amd64/link -p main -lang=go1.25 9J/dGwAo6v4tOJEHconfig list�� 163015/b594/typeutil.test -f 163015/b594/importcfg.link -- unsafe -importcfg OVeUyFlVlSS3Z/Zhconfig(http block)/usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv /ref/tags/v9 test@example.com sv -json GO111MODULE 64/bin/go git add test.txt resolved$(http block)https://api.github.com/repos/actions/setup-node/git/ref/tags/v6/usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv /ref/tags/v9 GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linuconfig -uns�� -unreachable=false /tmp/go-build584163015/b432/vet.cfg /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linu-test.short=true GOSUMDB GOWORK 64/bin/go /opt/hostedtoolcconfig(http block)/usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv 5353-41798/test-2973402740/.github/workflows GO111MODULE s.test GOINSECURE set GOMODCACHE s.test 8416�� -bool }} {{context.Compiler}} 0/x64/bin/node -errorsas -ifaceassert -nilfunc /tmp/go-build584config(http block)/usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv cQxnhNoye GO111MODULE ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE ortcfg -ato�� 163015/b544/_pkg_.a -buildtags 64/pkg/tool/linux_amd64/vet -errorsas -ifaceassert -nilfunc 64/pkg/tool/linuconfig(http block)https://api.github.com/repos/actions/upload-artifact/git/ref/tags/v4/usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv 5353-41798/test-1729696702/custom/workflows =develop 163015/b541/rawloginlib.test GOINSECURE GOMOD GOMODCACHE 163015/b541/rawloginlib.test e=/t�� t0 163015/b510/_testmain.go 0/x64/bin/node m0s -ifaceassert(http block)https://api.github.com/repos/aws-actions/configure-aws-credentials/git/ref/tags/v4/usr/bin/gh gh api /repos/aws-actions/configure-aws-credentials/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv /ref/tags/v9 Test User sv -json GO111MODULE 64/bin/go git conf�� user.name Test User(http block)/usr/bin/gh gh api /repos/aws-actions/configure-aws-credentials/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv /ref/tags/v9 -trimpath sv -p main -lang=go1.25 git -C cal/share/gh/extensions/gh-aw rev-parse l @{u} -c=4 ed } } git(http block)https://api.github.com/repos/azure/login/git/ref/tags/v2/usr/bin/gh gh api /repos/azure/login/git/ref/tags/v2 --jq [.object.sha, .object.type] | @tsv /ref/tags/v9 x_amd64/vet sv -json GO111MODULE 64/bin/go git log --oneline resolved$(http block)https://api.github.com/repos/docker/login-action/git/ref/tags/v3/usr/bin/gh gh api /repos/docker/login-action/git/ref/tags/v3 --jq [.object.sha, .object.type] | @tsv /ref/tags/v9 -trimpath sv -p main -lang=go1.25 git add test.txt resolved$(http block)https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v0.1.2/usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0.1.2 --jq [.object.sha, .object.type] | @tsv 3770298812 /opt/hostedtoolc-buildtags(http block)https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.0.0/usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linu--jq -ato�� architecture-guardian.md -buildtags /usr/bin/gh -errorsas -ifaceassert -nilfunc gh(http block)https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.2.3/usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq [.object.sha, .object.type] | @tsv -json =my-default /opt/hostedtoolcnew (upstream) GOINSECURE GOMOD GOMODCACHE /opt/hostedtoolcconfig -uns�� archie.md /tmp/go-build584163015/b458/vet.cfg ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile url GOWORK 64/bin/go ache/go/1.25.8/xconfig(http block)https://api.github.com/repos/github/gh-aw/actions/runs/usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --limit 100 --created >=2026-05-14 69/4VILL07qD5J8ninit GOMODCACHE x_amd64/vet env -json GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)/usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --limit 100 --created >=2026-04-21 GOMOD GOMODCACHE x_amd64/link env -json cfg ache/go/1.25.8/x64/bin/go GOINSECURE z7/kYzOnThqHdcIWcheckout GOMODCACHE go(http block)/usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --limit 100 --created >=2026-02-20 GOMOD GOMODCACHE x_amd64/vet env e-frontmatter.md cfg ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)https://api.github.com/repos/github/gh-aw/actions/runs/1/artifacts/usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/1/artifacts --jq .artifacts[].name GO111MODULE ache/go/1.25.8/x-nilfunc GOINSECURE GOMOD GOMODCACHE go env /ref/tags/v9.0.0 GO111MODULE sv GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet(http block)/usr/bin/gh gh run download 1 --dir test-logs/run-1 GO111MODULE 64/pkg/tool/linux_amd64/link GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linuremote2 env -json GO111MODULE ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x--jq(http block)https://api.github.com/repos/github/gh-aw/actions/runs/12345/artifacts/usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12345/artifacts --jq .artifacts[].name GO111MODULE x_amd64/link GOINSECURE GOMOD GOMODCACHE x_amd64/link env _.a GO111MODULE 64/pkg/tool/linux_amd64/asm GOINSECURE GOMOD GOMODCACHE In/lR17yz83lXghDbbXTNzJ/TycN1Lqvremote.origin.url(http block)/usr/bin/gh gh run download 12345 --dir test-logs/run-12345 GO111MODULE 64/pkg/tool/linu-test.short=true GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linuremote.upstream.url env tringmatch.test GO111MODULE rtcfg.link GOINSECURE GOMOD GOMODCACHE Sgs0LVLhScxLVluoremote.origin.url(http block)https://api.github.com/repos/github/gh-aw/actions/runs/1234567890/usr/bin/gh gh api repos/{owner}/{repo}/actions/runs/1234567890 --jq {databaseId: .id, number: .run_number, url: .html_url, status: .status, conclusion: .conclusion, workflowName: .name, workflowPath: .path, createdAt: .created_at, startedAt: .run_started_at, updatedAt: .updated_at, event: .event, headBranch: .head_branch, -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)https://api.github.com/repos/github/gh-aw/actions/runs/12346/artifacts/usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12346/artifacts --jq .artifacts[].name GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linuupstream env edOutput623854296/001 GO111MODULE ck GOINSECURE GOMOD GOMODCACHE rtcfg(http block)/usr/bin/gh gh run download 12346 --dir test-logs/run-12346 GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE cfg GOINSECURE GOMOD GOMODCACHE go(http block)https://api.github.com/repos/github/gh-aw/actions/runs/2/artifacts/usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/2/artifacts --jq .artifacts[].name GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE rtcfg env t1973705855/.github/workflows GO111MODULE cfg GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/xremote.origin.url(http block)/usr/bin/gh gh run download 2 --dir test-logs/run-2 GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env _dcPBYLrc GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet(http block)https://api.github.com/repos/github/gh-aw/actions/runs/3/artifacts/usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/3/artifacts --jq .artifacts[].name GO111MODULE ache/go/1.25.8/x-test.short=true GOINSECURE GOMOD GOMODCACHE hNpLusf/mfmHkuRMupstream env t1973705855 GO111MODULE .yml GOINSECURE GOMOD GOMODCACHE go(http block)/usr/bin/gh gh run download 3 --dir test-logs/run-3 GO111MODULE 64/pkg/tool/linux_amd64/link GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linu--json env /a.out GO111MODULE 64/pkg/tool/linu--created GOINSECURE KLJqapVFogrp8dUe/tmp/js-hash-test-1690848886/test-hash.js GOMODCACHE 64/pkg/tool/linux_amd64/vet(http block)https://api.github.com/repos/github/gh-aw/actions/runs/4/artifacts/usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/4/artifacts --jq .artifacts[].name GO111MODULE 64/pkg/tool/linu-test.short=true GOINSECURE ole GOMODCACHE 64/pkg/tool/linuremote.origin.url env HInQBJGmz GO111MODULE ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE rtcfg(http block)/usr/bin/gh gh run download 4 --dir test-logs/run-4 GO111MODULE cfg GOINSECURE GOMOD GOMODCACHE go env 1358059550 efaultBranchFromLsRemoteWithRealGitmain_branch2615418521/001' 64/pkg/tool/linux_amd64/link GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/link(http block)https://api.github.com/repos/github/gh-aw/actions/runs/5/artifacts/usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/5/artifacts --jq .artifacts[].name GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linuremote.upstream.url env -json GO111MODULE cfg GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet(http block)/usr/bin/gh gh run download 5 --dir test-logs/run-5 GO111MODULE rtcfg.link GOINSECURE GOMOD GOMODCACHE GWZZf7lJ-_dcPBYLrc/41keXdH1z2BvUconfig env sRemoteWithRealGitmain_branch261remote.upstream.url sRemoteWithRealGitmain_branch2615418521/002/work--all _.a GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/xconfig(http block)https://api.github.com/repos/github/gh-aw/actions/workflows/usr/bin/gh gh workflow list --json name,state,path "prettier" --che-errorsas go 64/bin/go -json GO111MODULE 64/bin/go go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)/usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 100 GOMOD GOMODCACHE x_amd64/vet env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)/usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 6 GOMOD GOMODCACHE x_amd64/link env -json GO111MODULE k GOINSECURE ye/7irdyxDfw9woXconfig GOMODCACHE go(http block)https://api.github.com/repos/github/gh-aw/contents/.github/workflows/shared/reporting.md/tmp/go-build584163015/b480/cli.test /tmp/go-build584163015/b480/cli.test -test.testlogfile=/tmp/go-build584163015/b480/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true -json GO111MODULE run-script/lib/n-json sh -c npx prettier --cGOINSECURE go 64/bin/go ignore-path .././opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/vet GO111MODULE 64/bin/go node(http block)https://api.github.com/repos/github/gh-aw/git/ref/tags/dev/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/dev --jq [.object.sha, .object.type] | @tsv ensions/gh-aw rev-parse /usr/bin/git @{u} GO111MODULE 64/bin/go git conf�� --get remote.origin.url(http block)/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/dev --jq [.object.sha, .object.type] | @tsv ensions/gh-aw status /usr/bin/git .github/workflow/usr/bin/git GO111MODULE 64/bin/go git remo�� GOMODCACHE resolved$ /opt/hostedtoolcache/node/24.15.0/x64/bin/node -json GO111MODULE x_amd64/link /opt/hostedtoolcconfig(http block)https://api.github.com/repos/github/gh-aw/git/ref/tags/v0.47.4/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v0.47.4 --jq [.object.sha, .object.type] | @tsv ensions/gh-aw remote.origin.url /usr/bin/git /workflows GO111MODULE 64/bin/go git remo�� get-url(http block)https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.0.0/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE 64/pkg/tool/linux_amd64/asm GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linurepos/{owner}/{repo}/actions/runs/5/artifacts env 5/001/test-inlin.artifacts[].name GO111MODULE ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x--jq(http block)https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.2.3/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env -json herFiles,CFiles,CgoFiles,CXXFiles,MFiles,HFiles,FFiles,SFiles,SwigFiles,SwigCXXFiles,SysoFiles,Tconfig 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)https://api.github.com/repos/github/gh-aw/git/ref/tags/v2.0.0/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq [.object.sha, .object.type] | @tsv -json herFiles,CFiles,CgoFiles,CXXFiles,MFiles,HFiles,FFiles,SFiles,SwigFiles,SwigCXXFiles,SysoFiles,T-C x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env -json GO111MODULE x_amd64/link GOINSECURE GOMOD GOMODCACHE x_amd64/link(http block)/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)https://api.github.com/repos/github/gh-aw/git/ref/tags/v3.0.0/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env -json GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet(http block)https://api.github.com/repos/github/gh-aw/issues/17/usr/bin/gh gh api repos/github/gh-aw/issues/17 /opt/hostedtoolc-buildtags -o /tmp/go-build976-errorsas -trimpath 64/bin/go -p main -lang=go1.25 go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)https://api.github.com/repos/google-github-actions/auth/git/ref/tags/v2/usr/bin/gh gh api /repos/google-github-actions/auth/git/ref/tags/v2 --jq [.object.sha, .object.type] | @tsv /ref/tags/v9 l sv -json GO111MODULE 64/bin/go git chec�� -b feature-branch(http block)https://api.github.com/repos/nonexistent/action/git/ref/tags/v999.999.999/usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq [.object.sha, .object.type] | @tsv e-analyzer.md g/constants/engine_constants.go 163015/b475/agentdrain.test GOINSECURE GOMOD GOMODCACHE ortcfg e=/t�� 305/001/stability-test.md GO111MODULE(http block)https://api.github.com/repos/nonexistent/repo/actions/runs/12345/usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion GOINSECURE GOMOD GOMODCACHE go env TLToKHbFM GO111MODULE ache/go/1.25.8/x64/pkg/tool/linu-buildmode=exe GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/xconfig(http block)https://api.github.com/repos/org/repo/pulls/1/usr/bin/gh gh api repos/org/repo/pulls/1 /bin/sh -c echo "��� JavaScGOSUMDB go 64/bin/go tierignore GO111MODULE 64/bin/go go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)https://api.github.com/repos/owner/repo/actions/secrets/usr/bin/gh gh api /repos/owner/repo/actions/secrets --jq .secrets[].name prettier --check 64/bin/go --ignore-path .prettierignore 64/bin/go go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)https://api.github.com/repos/owner/repo/actions/workflows/usr/bin/gh gh workflow list --json name,state,path --repo owner/repo 64/bin/go -json GO111MODULE 64/bin/go go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)/usr/bin/gh gh workflow list --json name,state,path --repo owner/repo 64/bin/go tierignore GO111MODULE /prettier go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)/usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-remote-workflow --limit 30 --repo owner/repo go env ut3153559002/001 GO111MODULE cfg GOINSECURE GOMOD GOMODCACHE go(http block)https://api.github.com/repos/test-owner/test-repo/actions/secrets/usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name "prettier" --cheGOSUMDB pkg/workflow/actGOWORK 64/bin/go pkg/workflow/act/opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/vet pkg/workflow/act-atomic pkg/workflow/act-bool go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)https://api.github.com/repos/test/repo/usr/bin/gh gh api /repos/test/repo --jq .default_branch ternal/tools/actions-build/main.go GO111MODULE x_amd64/link GOINSECURE GOMOD GOMODCACHE x_amd64/link(http block)If you need me to access, download, or install something from one of these locations, you can either: