Fix Copilot CLI path in AWF sandboxes - #50908
Merged
Merged
Conversation
Stage the activated Copilot CLI under the RUNNER_TEMP directory mounted into every AWF execution environment, including Docker, gVisor, docker-sbx, and ARC/DinD. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: e35bd500-badf-49f1-a01d-7cbf6d96d2a2
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: e35bd500-badf-49f1-a01d-7cbf6d96d2a2
lpcox
changed the title
lpcox
marked this pull request as ready for review
August 6, 2026 16:53
Contributor
There was a problem hiding this comment.
Pull request overview
Fixes AWF Copilot CLI resolution by staging the activated executable under the sandbox-mounted runner directory.
Changes:
- Resolves Copilot from
PATHand uses the mounted staged path. - Adds sandbox, evals, threat-detection, and custom-command regression tests.
- Regenerates affected workflow lock files.
Show a summary per file
| File | Description |
|---|---|
pkg/workflow/copilot_engine_execution.go |
Implements Copilot path resolution and staging. |
pkg/workflow/copilot_engine_test.go |
Tests AWF runtimes and custom commands. |
pkg/workflow/evals_steps_test.go |
Tests evals staging behavior. |
pkg/workflow/threat_detection_test.go |
Tests detection staging behavior. |
.github/workflows/workflow-normalizer.lock.yml |
Regenerates staged CLI invocation. |
.github/workflows/video-analyzer.lock.yml |
Regenerates staged CLI invocation. |
.github/workflows/update-astro.lock.yml |
Regenerates staged CLI invocation. |
.github/workflows/unbloat-docs.lock.yml |
Regenerates staged CLI invocation. |
.github/workflows/super-linter.lock.yml |
Regenerates staged CLI invocation. |
.github/workflows/spec-enforcer.lock.yml |
Regenerates staged CLI invocation. |
.github/workflows/smoke-test-tools.lock.yml |
Regenerates staged CLI invocation. |
.github/workflows/smoke-pi.lock.yml |
Regenerates staged CLI invocation. |
.github/workflows/smoke-create-cross-repo-pr.lock.yml |
Regenerates staged CLI invocation. |
.github/workflows/smoke-copilot-small.lock.yml |
Regenerates staged CLI invocation. |
.github/workflows/smoke-copilot-sdk.lock.yml |
Regenerates SDK CLI invocation. |
.github/workflows/skillet.lock.yml |
Regenerates staged CLI invocation. |
.github/workflows/sighthound-security-scan.lock.yml |
Regenerates staged CLI invocation. |
.github/workflows/schema-consistency-checker.lock.yml |
Regenerates staged CLI invocation. |
.github/workflows/repo-tree-map.lock.yml |
Regenerates staged CLI invocation. |
.github/workflows/pr-nitpick-reviewer.lock.yml |
Regenerates SDK and detection invocations. |
.github/workflows/pr-description-caveman.lock.yml |
Regenerates staged CLI invocation. |
.github/workflows/poem-bot.lock.yml |
Regenerates detection invocation. |
.github/workflows/pdf-summary.lock.yml |
Regenerates SDK and detection invocations. |
.github/workflows/notion-issue-summary.lock.yml |
Regenerates staged CLI invocation. |
.github/workflows/mattpocock-skills-reviewer.lock.yml |
Regenerates staged CLI invocation. |
.github/workflows/lint-monster.lock.yml |
Regenerates detection invocation. |
.github/workflows/impeccable-skills-reviewer.lock.yml |
Regenerates staged CLI invocation. |
.github/workflows/github-remote-mcp-auth-test.lock.yml |
Regenerates staged CLI invocation. |
.github/workflows/firewall.lock.yml |
Regenerates SDK CLI invocation. |
.github/workflows/example-permissions-warning.lock.yml |
Regenerates staged CLI invocation. |
.github/workflows/example-failure-category-filter.lock.yml |
Regenerates agent and detection invocations. |
.github/workflows/eslint-monster.lock.yml |
Regenerates detection invocation. |
.github/workflows/daily-testify-uber-super-expert.lock.yml |
Regenerates SDK CLI invocation. |
.github/workflows/daily-team-status.lock.yml |
Regenerates agent and detection invocations. |
.github/workflows/daily-model-resolution.lock.yml |
Regenerates SDK CLI invocation. |
.github/workflows/daily-max-ai-credits-test.lock.yml |
Regenerates staged CLI invocation. |
.github/workflows/daily-formal-spec-verifier.lock.yml |
Regenerates SDK CLI invocation. |
.github/workflows/daily-credit-limit-test.lock.yml |
Regenerates staged CLI invocation. |
.github/workflows/daily-cli-tools-tester.lock.yml |
Regenerates agent and evals invocations. |
.github/workflows/daily-byok-ollama-test.lock.yml |
Regenerates staged CLI invocation. |
.github/workflows/bot-detection.lock.yml |
Regenerates agent and evals invocations. |
.github/workflows/architecture-guardian.lock.yml |
Regenerates SDK agent and evals invocations. |
.github/workflows/agentic-token-trend-audit.lock.yml |
Regenerates agent and evals invocations. |
.github/workflows/ace-editor.lock.yml |
Regenerates agent and evals invocations. |
Review details
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 109/178 changed files
- Comments generated: 1
- Review effort level: Balanced
| @@ -122,6 +122,18 @@ const nodePathSetupCommand = `GH_AW_NPM_GLOBAL_ROOT="$(npm root -g 2>/dev/null | | |||
| const nodeRuntimeResolutionCommand = `GH_AW_NODE_EXEC="${GH_AW_NODE_BIN:-}"; if [ -z "$GH_AW_NODE_EXEC" ] || [ ! -x "$GH_AW_NODE_EXEC" ]; then GH_AW_NODE_EXEC="$(command -v node 2>/dev/null || true)"; fi; if [ -z "$GH_AW_NODE_EXEC" ]; then echo "node runtime missing on this runner — check runtimes.node in workflow YAML" >&2; exit 127; fi; ` + nodePathSetupCommand + `; "$GH_AW_NODE_EXEC"` | |||
| const nodePathSetupCommandForCopilotSDK = `GH_AW_WORKSPACE_NODE_MODULES="${GITHUB_WORKSPACE:-$PWD}/node_modules"; if [ -d "$GH_AW_WORKSPACE_NODE_MODULES" ]; then export NODE_PATH="${GH_AW_WORKSPACE_NODE_MODULES}${NODE_PATH:+:${NODE_PATH}}"; fi; ` + nodePathSetupCommand | |||
| const nodeRuntimeResolutionCommandForCopilotSDK = `GH_AW_NODE_EXEC="${GH_AW_NODE_BIN:-}"; if [ -z "$GH_AW_NODE_EXEC" ] || [ ! -x "$GH_AW_NODE_EXEC" ]; then GH_AW_NODE_EXEC="$(command -v node 2>/dev/null || true)"; fi; if [ -z "$GH_AW_NODE_EXEC" ]; then echo "node runtime missing on this runner — check runtimes.node in workflow YAML" >&2; exit 127; fi; ` + nodePathSetupCommandForCopilotSDK + `; "$GH_AW_NODE_EXEC"` | |||
| const copilotBinaryPathSetup = `GH_AW_COPILOT_SRC="$(command -v copilot 2>/dev/null || true)" | |||
Collaborator
|
@copilot address review feedback |
Copilot stopped work on behalf of
lpcox due to an error
August 6, 2026 17:38
Collaborator
|
@copilot run pr-finisher skill |
Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
Contributor
|
No test files were added or modified in this PR. Test Quality Sentinel skipped. |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Review: Fix Copilot CLI path in AWF sandboxes
The core implementation looks correct — resolving the activated copilot binary from PATH via command -v, staging it at ${RUNNER_TEMP}/gh-aw/bin/copilot, and referencing that mounted path for Docker/gVisor/docker-sbx/evals is the right approach. The guard for empty/non-executable binary (exit 127) and the ARC/DinD exclusion at line 489 are both correctly handled.
One existing issue (already flagged in review comments) needs to be resolved before merge: the WASM golden file pkg/workflow/testdata/TestWasmGolden_AllEngines/copilot.golden still references the hardcoded /usr/local/bin/copilot path at line 546 instead of the new staged ${RUNNER_TEMP}/gh-aw/bin/copilot. The WASM golden snapshots need to be regenerated to reflect the updated compiler output.
🧵 Reviewed using Impeccable skills by Impeccable Skills Reviewer · sonnet46 · 68.7 AIC · ⊞ 5.3K
This was referenced Aug 7, 2026
Contributor
|
🎉 This pull request is included in a new release. Release: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
PATHafter installation${RUNNER_TEMP}/gh-aw/bin/copilot, inside the directory mounted into AWFengine.commandbehaviorFixes #50906