Split MCP Gateway into download and start steps with gh CLI authentication

[Copilot]

The MCP Gateway startup was monolithic, combining binary download and service startup in a single step without authenticated GitHub API access. This splits them into separate steps with the download step using gh CLI and GH_TOKEN for authenticated downloads.

Changes

• New download step (generateMCPGatewayDownloadStep)

  • Uses gh release download with GH_TOKEN: ${{ github.token }} in release mode
  • Sets AWMG_CMD in $GITHUB_ENV for cross-step communication
  • Only for default mode; container/command modes unaffected

• Simplified start step (generateDefaultAWMGCommands)

  • Consumes $AWMG_CMD from environment
  • All download/detection logic removed

• Updated orchestration (generateMCPGatewaySteps)

  • Inserts download step before start for default mode
  • Preserves existing container/command mode behavior

Example

Before:

- name: Start MCP Gateway
  run: |
    curl -L -f -o "/tmp/$AWMG_BINARY" "$RELEASE_URL"
    $AWMG_CMD --config ... --port 8080 ...

After:

- name: Download MCP Gateway Binary
  env:
    GH_TOKEN: ${{ github.token }}
  run: |
    gh release download --repo githubnext/gh-aw --pattern "$AWMG_BINARY" --dir /tmp --clobber
    echo "AWMG_CMD=/tmp/$AWMG_BINARY" >> $GITHUB_ENV

- name: Start MCP Gateway
  run: |
    $AWMG_CMD --config ... --port 8080 ...

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/user
  • Triggering command: /usr/bin/gh gh api user --jq .login -json GO111MODULE 0.1-go1.25.0.linGOMODCACHE GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 0.1-go1.25.0.linux-amd64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

Split the "Start MCP Gateway" into a download step and a start step.

The download step should have access to the GitHub action token through GH_TOKEN env var and use the "gh" cli to resolve/download the release binaries. No need for other secrets.

The rest of the script is unchanged.

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.