ci(copilot): add cloud-agent setup-steps to default branch by rickylabs · Pull Request #9 · rickylabs/netscript

rickylabs · 2026-06-06T23:30:23Z

Why

GitHub's Copilot cloud agent reads copilot-setup-steps.yml only from the repository's default branch (main). The file currently lives on feat/package-quality (and the Wave 2 branch) but not on main — so the agent's environment is not provisioned for S1 evaluation / audit-fix runs until this lands here.

This is a workflow-only PR (single file, no code) so the setup can take effect immediately, independent of the S1 wave merges.

What it provisions

The setup job (full network, runs before each firewalled agent session) prepares the toolchain the S1 passes need:

Deno 2.x — primary toolchain (deno publish --dry-run, deno doc --lint, deno task check)
.NET SDK 10.x — CLI scaffold AppHost/ServiceDefaults target net10.0
Aspire CLI — pinned to v13.4.2 using the official dotnet/aspire installer script at the release tag commit, with SHA-256 verification before execution
Docker — AppHost container resources
Cache warming — Deno dependency cache via deno cache over package/plugin sources, plus NuGet inspection, so allowlist-firewalled sessions run faster

Validation (state-of-the-art check)

Conforms to GitHub's canonical copilot-setup-steps.yml spec: job named exactly copilot-setup-steps, runs-on: ubuntu-latest (supported runner), and the workflow_dispatch + push + pull_request path triggers from the canonical example.
Action majors confirmed current: actions/checkout@v6, denoland/setup-deno@v2, actions/setup-dotnet@v5.
Aspire installer pinned to the dotnet/aspire v13.4.2 release tag target and verified by SHA-256 before running.
Deno cache warming uses deno cache --config deno.json --no-lock instead of deno install with no arguments.
YAML and workflow syntax validated locally with actionlint, shell syntax checks, targeted installer checks, and CodeQL security scan.

🤖 Generated with Claude Code

GitHub reads copilot-setup-steps.yml only from the default branch, so the Copilot cloud agent's environment (Deno 2.x + .NET 10 + Aspire CLI + Docker, plus pre-warmed deno/NuGet caches for the firewalled session) is not provisioned until this lands on main. Validated against GitHub's canonical spec and current action majors (checkout@v6, setup-deno@v2, setup-dotnet@v5).

augmentcode · 2026-06-06T23:31:56Z

🤖 Augment PR Summary

Summary: Adds a dedicated Copilot cloud-agent bootstrap workflow on the default branch so S1 evaluation/audit runs have a pre-provisioned toolchain.

Changes:

Introduces .github/workflows/copilot-setup-steps.yml with the required copilot-setup-steps job
Installs Deno 2.x and .NET SDK 10.x for repo tooling and CLI scaffolds
Installs the Aspire CLI via the official install script and verifies it is available
Verifies Docker/Compose availability on the runner
Attempts to pre-warm Deno and .NET/NuGet caches to speed up firewalled agent sessions

_{🤖 Was this summary useful? React with 👍 or 👎}

augmentcode

Review completed. 2 suggestions posted.

Comment augment review to trigger a new review at any time.

augmentcode · 2026-06-06T23:31:57Z

+      # --- Aspire CLI (standalone install script; adds $HOME/.aspire/bin to PATH) ---
+      - name: Install Aspire CLI
+        run: |
+          curl -fsSL https://aspire.dev/install.sh | bash


.github/workflows/copilot-setup-steps.yml:53 Piping a remote install.sh directly into bash makes the setup non-reproducible and increases supply-chain risk if the script changes or is compromised. Consider adding some integrity/version pinning so Copilot sessions don’t unpredictably break (or run unexpected code).

Severity: medium

_{🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.}

augmentcode · 2026-06-06T23:31:57Z

+        run: |
+          deno --version
+          # Resolve + cache all workspace deps (jsr: + npm:) from the lockfile.
+          deno install || echo "deno install non-fatal during setup"


.github/workflows/copilot-setup-steps.yml:72 deno install without arguments typically exits non-zero (help/usage), so this step is likely a no-op and won’t actually warm the dependency cache as the comment suggests. This could leave the subsequent firewalled Copilot session still needing network fetches for deps.

Severity: medium

_{🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.}

rickylabs · 2026-06-06T23:50:15Z

@copilot ensure the yaml is perfectly valid according to augment some commands are either unsafe or incorrect do broader search to ensure everything works perfectly and respond back to augment comments on this pr

Copilot · 2026-06-07T00:02:55Z

@copilot ensure the yaml is perfectly valid according to augment some commands are either unsafe or incorrect do broader search to ensure everything works perfectly and respond back to augment...

Addressed in 6c9933f. The workflow now avoids piping the Aspire installer directly to bash by pinning the dotnet/aspire v13.4.2 tag target, verifying the installer SHA-256 before execution, and installing the pinned Aspire CLI version. The Deno warm step now runs an actual deno cache --config deno.json --no-lock pass over package/plugin source files instead of deno install with no args. Validated with actionlint, shell syntax checks, pinned installer hash/options checks, local Deno command validation (non-fatal warning path), and CodeQL reported 0 alerts.

#8 #9 #10 #15) - reference/ai: explicit note that AI provider keys have no typed config surface; raw Deno.env.get is the supported path (#8). - reference/queue + reference/kv: See-it-live link blocks to the queue-kv-cron how-to and data-persistence concept page (#9). - reference/contracts + reference/sdk: showcase sentence per lede — contracts obviate manual req.json() validation; defineServices() wires the whole typed stack in one call (#10). - durable-workflows/streams: one sentence reframing no in-process subscribe() as an intentional single HTTP/SSE surface (#15). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VifzAytcxBk5odEMaCXihM

…-tos, auth example (#686) * docs: clarify PORT/typed-config relationship across 8 pages (#660 #7) Aspire injects PORT at runtime; netscript.config.ts services.<name>.port (apps.<name>.port for Fresh apps) is the typed source of truth the scaffold wires as the fallback default. One shared sentence at each first parseInt occurrence so the raw-env read no longer reads as the canonical pattern. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VifzAytcxBk5odEMaCXihM * docs: reference showcase ledes, see-it-live links, streams framing (#660 #8 #9 #10 #15) - reference/ai: explicit note that AI provider keys have no typed config surface; raw Deno.env.get is the supported path (#8). - reference/queue + reference/kv: See-it-live link blocks to the queue-kv-cron how-to and data-persistence concept page (#9). - reference/contracts + reference/sdk: showcase sentence per lede — contracts obviate manual req.json() validation; defineServices() wires the whole typed stack in one call (#10). - durable-workflows/streams: one sentence reframing no in-process subscribe() as an intentional single HTTP/SSE surface (#15). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VifzAytcxBk5odEMaCXihM * docs: add runnable end-to-end blocks to three decision how-tos (#660 #11) discover-services, choose-a-queue-provider, and add-a-task-runtime-adapter each gain one copy-pasteable end-to-end block (resulting file + full command sequence) at deploy-local-aspire density, demonstrating the pluggability the pages previously only asserted. All commands/APIs grounded in package source. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VifzAytcxBk5odEMaCXihM * docs: add complete route-protection example to better-auth-plugins (#660 #12) A real Fresh routes/*.tsx handler gated on an active session and an admin role, at sibling auth.md's depth: resolves the session via backend.sessions.getSession, maps to a Principal with principalMapper, and fails closed on both checks. Grounded in packages/auth-better-auth + @netscript/service/auth exports. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VifzAytcxBk5odEMaCXihM * chore(run): docs-660b sweep worklog (#660) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VifzAytcxBk5odEMaCXihM --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

augmentcode Bot reviewed Jun 6, 2026

View reviewed changes

Copilot started work on behalf of rickylabs June 6, 2026 23:50 View session

Copilot AI added 9 commits June 6, 2026 23:56

ci: harden copilot setup workflow

641c3c5

ci: clarify deno cache warning

a461de6

ci: document deno cache assumptions

aa6e501

ci: shorten deno cache warning

2ed65d9

ci: clarify setup pinning assumptions

59dc1d2

ci: improve setup diagnostics

777a0b7

ci: clarify pinned setup comments

663fa5a

ci: document setup verification details

162c068

ci: clarify checksum format comment

6c9933f

Copilot finished work on behalf of rickylabs June 7, 2026 00:03

rickylabs merged commit 3b4dcb9 into main Jun 7, 2026
2 checks passed

rickylabs deleted the ci/copilot-setup-steps branch June 22, 2026 21:33

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ci(copilot): add cloud-agent setup-steps to default branch#9

ci(copilot): add cloud-agent setup-steps to default branch#9
rickylabs merged 10 commits into
mainfrom
ci/copilot-setup-steps

rickylabs commented Jun 6, 2026 •

edited by Copilot AI

Loading

Uh oh!

augmentcode Bot commented Jun 6, 2026

Uh oh!

augmentcode Bot left a comment

Uh oh!

augmentcode Bot Jun 6, 2026 •

edited

Loading

Uh oh!

augmentcode Bot Jun 6, 2026 •

edited

Loading

Uh oh!

rickylabs commented Jun 6, 2026

Uh oh!

Copilot AI commented Jun 7, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

rickylabs commented Jun 6, 2026 • edited by Copilot AI Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Why

What it provisions

Validation (state-of-the-art check)

Uh oh!

augmentcode Bot commented Jun 6, 2026

Uh oh!

augmentcode Bot left a comment

Choose a reason for hiding this comment

Uh oh!

augmentcode Bot Jun 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

augmentcode Bot Jun 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

rickylabs commented Jun 6, 2026

Uh oh!

Copilot AI commented Jun 7, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

rickylabs commented Jun 6, 2026 •

edited by Copilot AI

Loading

augmentcode Bot Jun 6, 2026 •

edited

Loading

augmentcode Bot Jun 6, 2026 •

edited

Loading