[WIP] Fix smoke cursor workflow failure due to authentication issue

[Copilot]

• Inspect the failed workflow run and relevant Cursor workflow configuration
• Preserve declarative-engine API keys in the sandbox and regenerate affected workflow output
• Add focused regression coverage and run formatting, compilation, lint, impacted tests, secret scanning, and review
• Run final CodeQL security scan and verify the committed diff

• Fixes [aw] Smoke Cursor failed #50471

[pelikhan]

/smoke-cursor

[github-actions]

🚀 Smoke Cursor Cursor delivered.

[github-actions]

Cursor Smoke Test 30975573886

• GitHub MCP: PASS
• File Writing: PASS
• Bash Tool: PASS
• Build: FAIL (go 1.26.5 download Forbidden)

Overall: FAIL

Run: https://github.com/github/gh-aw/actions/runs/30975573886

Warning

Firewall blocked 3 domains

The following domains were blocked by the firewall during workflow execution:

• proxy.golang.org
• registry.npmjs.org
• repo42.cursor.sh

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "proxy.golang.org"
    - "registry.npmjs.org"
    - "repo42.cursor.sh"

See Network Configuration for more information.

🖱️ Smoke Cursor — Powered by Cursor · ◷
_{Comment /smoke-cursor to run again}

[Copilot]

🟡 Not ready to approve

Auth credentials overridden through engine.env are still excluded from the sandbox.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.

Pull request overview

Fixes declarative engine authentication by allowing required API keys into AWF sandboxes.

Changes:

• Exempts declarative auth bindings from sandbox exclusions.
• Adds regression coverage.
• Regenerates Cursor and Kiro workflows.

File summaries

File	Description
pkg/workflow/behavior_defined_engine.go	Adjusts secret exclusions.
pkg/workflow/behavior_defined_engine_harness_test.go	Tests auth-secret passthrough.
.github/workflows/smoke-cursor.lock.yml	Regenerates Cursor workflow.
.github/workflows/smoke-kiro.lock.yml	Regenerates Kiro workflow.

Review details

• Files reviewed: 4/4 changed files
• Comments generated: 1
• Review effort level: Balanced

We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.

[github-actions]

🎉 This pull request is included in a new release.

Release: v0.85.1