[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10,"_11":12},"actionData","errors","root",{"_228":-5,"_231":232,"_233":234},"routes/shell",{"_40":41,"_227":-5,"_228":-5,"_229":230},"routes/repo",{"_33":-7,"_34":35,"_36":37,"_38":39,"_40":41,"_42":31,"_43":31,"_44":31,"_45":31,"_46":31,"_47":31,"_48":49,"_50":49,"_51":31,"_52":-7,"_53":-7,"_54":55,"_56":57,"_58":59,"_60":-5,"_61":62,"_63":64,"_65":66,"_67":68},"routes/repo.blob",{"_13":14,"_15":16,"_17":18,"_19":20,"_21":14,"_22":23,"_24":-5,"_25":26,"_27":28,"_28":29,"_30":31,"_32":14},"ref","7c690cbcfdf23f1e1925f493bd4e10949afcb76d","path",".github/workflows/pr-readiness-worker.lock.yml","oid","f588ddd1636ae387fe9877b1087aad27cd39e8dc","size",122130,"commit","mounts",[],"source","plain",{"_13":14,"_15":16},"kind","text","# gh-aw-metadata: {\"schema_version\":\"v4\",\"frontmatter_hash\":\"21ef186020169d04460fb41d60c95448402966bb87701135c3479a5dbdaa3612\",\"body_hash\":\"006cce3f3afed8e474bf995e7e79770b532a248641d6a6f5efa2e889d43d7344\",\"compiler_version\":\"v0.86.2\",\"strict\":true,\"agent_id\":\"codex\",\"agent_model\":\"gpt-5.4\",\"detection_agent_id\":\"codex\",\"engine_versions\":{\"codex\":\"0.147.0\"}}\n# gh-aw-manifest: {\"version\":1,\"secrets\":[\"CODEX_API_KEY\",\"COPILOT_GITHUB_TOKEN\",\"GH_AW_GITHUB_MCP_SERVER_TOKEN\",\"GH_AW_GITHUB_TOKEN\",\"GITHUB_TOKEN\",\"OPENAI_API_KEY\",\"PR_MAINTENANCE_STATE_KEY\",\"PR_MAITENANCE_TOKEN\"],\"actions\":[{\"repo\":\"actions/cache/restore\",\"sha\":\"55cc8345863c7cc4c66a329aec7e433d2d1c52a9\",\"version\":\"v6.1.0\"},{\"repo\":\"actions/cache/save\",\"sha\":\"55cc8345863c7cc4c66a329aec7e433d2d1c52a9\",\"version\":\"v6.1.0\"},{\"repo\":\"actions/checkout\",\"sha\":\"3d3c42e5aac5ba805825da76410c181273ba90b1\",\"version\":\"v7.0.1\"},{\"repo\":\"actions/download-artifact\",\"sha\":\"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c\",\"version\":\"v8.0.1\"},{\"repo\":\"actions/github-script\",\"sha\":\"3a2844b7e9c422d3c10d287c895573f7108da1b3\",\"version\":\"v9.0.0\"},{\"repo\":\"actions/setup-node\",\"sha\":\"820762786026740c76f36085b0efc47a31fe5020\",\"version\":\"v7.0.0\"},{\"repo\":\"actions/upload-artifact\",\"sha\":\"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a\",\"version\":\"v7.0.1\"},{\"repo\":\"github/gh-aw-actions/setup\",\"sha\":\"6aab9e5b5c91c615506061f09bedd81a23babe3c\",\"version\":\"v0.86.2\"},{\"repo\":\"oven-sh/setup-bun\",\"sha\":\"0c5077e51419868618aeaa5fe8019c62421857d6\",\"version\":\"v2.2.0\"}],\"containers\":[{\"image\":\"ghcr.io/github/gh-aw-firewall/agent:0.27.44\",\"digest\":\"sha256:0d727725c737b58c7bdf51f640cffb928385ec46517e0917c7f1a02f1bada8b4\",\"pinned_image\":\"ghcr.io/github/gh-aw-firewall/agent:0.27.44@sha256:0d727725c737b58c7bdf51f640cffb928385ec46517e0917c7f1a02f1bada8b4\"},{\"image\":\"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.44\",\"digest\":\"sha256:b50fbadba138f6e9aba94aca09711335c489bb3b15861220cb66f6092e042dc7\",\"pinned_image\":\"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.44@sha256:b50fbadba138f6e9aba94aca09711335c489bb3b15861220cb66f6092e042dc7\"},{\"image\":\"ghcr.io/github/gh-aw-firewall/cli-proxy:0.27.44\",\"digest\":\"sha256:c064d15974f7c933ec7d3f7b4038f4fd203547b3154bdc821afd379144887eff\",\"pinned_image\":\"ghcr.io/github/gh-aw-firewall/cli-proxy:0.27.44@sha256:c064d15974f7c933ec7d3f7b4038f4fd203547b3154bdc821afd379144887eff\"},{\"image\":\"ghcr.io/github/gh-aw-firewall/squid:0.27.44\",\"digest\":\"sha256:83e48bbe12c634be8c228a576832fe45f66c529ac3659db92bddbcf2eeb6d627\",\"pinned_image\":\"ghcr.io/github/gh-aw-firewall/squid:0.27.44@sha256:83e48bbe12c634be8c228a576832fe45f66c529ac3659db92bddbcf2eeb6d627\"},{\"image\":\"ghcr.io/github/gh-aw-mcpg:v0.4.9\",\"digest\":\"sha256:e5a1569aeaf41820fa7bdee3e94468cae448133cdbf00119ad24f5b74db1ab9f\",\"pinned_image\":\"ghcr.io/github/gh-aw-mcpg:v0.4.9@sha256:e5a1569aeaf41820fa7bdee3e94468cae448133cdbf00119ad24f5b74db1ab9f\"},{\"image\":\"ghcr.io/github/gh-aw-node\",\"digest\":\"sha256:0d9f1fb5fd6610c0ac1f5194a38e45a8a1e81f8a390d5142d8e4e6f26a4b3196\",\"pinned_image\":\"ghcr.io/github/gh-aw-node@sha256:0d9f1fb5fd6610c0ac1f5194a38e45a8a1e81f8a390d5142d8e4e6f26a4b3196\"},{\"image\":\"ghcr.io/github/github-mcp-server:v1.9.0\",\"digest\":\"sha256:881b53d6f75f69bdbc1b5b10fc2f1361717c19054143b3a8529fb5c32061a50e\",\"pinned_image\":\"ghcr.io/github/github-mcp-server:v1.9.0@sha256:881b53d6f75f69bdbc1b5b10fc2f1361717c19054143b3a8529fb5c32061a50e\"}]}\n# This file was automatically generated by gh-aw (v0.86.2). DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md\n#\n# ___ _ _\n# / _ \\ | | (_)\n# | |_| | __ _ ___ _ __ | |_ _ ___\n# | _ |/ _` |/ _ \\ '_ \\| __| |/ __|\n# | | | | (_| | __/ | | | |_| | (__\n# \\_| |_/\\__, |\\___|_| |_|\\__|_|\\___|\n# __/ |\n# _ _ |___/\n# | | | | / _| |\n# | | | | ___ _ __ _ __| |_| | _____ ____\n# | |/\\| |/ _ \\ '__| |/ /| _| |/ _ \\ \\ /\\ / / ___|\n# \\ /\\ / (_) | | | | ( | | | | (_) \\ V V /\\__ \\\n# \\/ \\/ \\___/|_| |_|\\_\\|_| |_|\\___/ \\_/\\_/ |___/\n#\n#\n# To update this file, edit the corresponding .md file and run:\n# gh aw compile\n# Not all edits will cause changes to this file.\n#\n# For more information: https://github.github.com/gh-aw/introduction/overview/\n#\n# Resolve one authenticated PR maintenance attempt and propose a guarded update.\n#\n# Secrets used:\n# - CODEX_API_KEY\n# - COPILOT_GITHUB_TOKEN\n# - GH_AW_GITHUB_MCP_SERVER_TOKEN\n# - GH_AW_GITHUB_TOKEN\n# - GITHUB_TOKEN\n# - OPENAI_API_KEY\n# - PR_MAINTENANCE_STATE_KEY\n# - PR_MAITENANCE_TOKEN\n#\n# Custom actions used:\n# - actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0\n# - actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0\n# - actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1\n# - actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1\n# - actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n# - actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 (source v9)\n# - actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0\n# - actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 (source v7)\n# - actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1\n# - github/gh-aw-actions/setup@6aab9e5b5c91c615506061f09bedd81a23babe3c # v0.86.2\n# - oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0\n#\n# Container images used:\n# - ghcr.io/github/gh-aw-firewall/agent:0.27.44@sha256:0d727725c737b58c7bdf51f640cffb928385ec46517e0917c7f1a02f1bada8b4\n# - ghcr.io/github/gh-aw-firewall/api-proxy:0.27.44@sha256:b50fbadba138f6e9aba94aca09711335c489bb3b15861220cb66f6092e042dc7\n# - ghcr.io/github/gh-aw-firewall/cli-proxy:0.27.44@sha256:c064d15974f7c933ec7d3f7b4038f4fd203547b3154bdc821afd379144887eff\n# - ghcr.io/github/gh-aw-firewall/squid:0.27.44@sha256:83e48bbe12c634be8c228a576832fe45f66c529ac3659db92bddbcf2eeb6d627\n# - ghcr.io/github/gh-aw-mcpg:v0.4.9@sha256:e5a1569aeaf41820fa7bdee3e94468cae448133cdbf00119ad24f5b74db1ab9f\n# - ghcr.io/github/gh-aw-node@sha256:0d9f1fb5fd6610c0ac1f5194a38e45a8a1e81f8a390d5142d8e4e6f26a4b3196\n# - ghcr.io/github/github-mcp-server:v1.9.0@sha256:881b53d6f75f69bdbc1b5b10fc2f1361717c19054143b3a8529fb5c32061a50e\n\nname: \"PR readiness worker\"\non:\n workflow_dispatch:\n inputs:\n aw_context:\n default: \"\"\n description: \"Agent caller context (used internally by Agentic Workflows).\"\n required: false\n type: string\n attempt:\n description: Authenticated attempt identifier\n required: true\n type: string\n pr:\n description: PR number reserved by the coordinator\n required: true\n type: string\n\npermissions: {}\n\nconcurrency:\n cancel-in-progress: false\n group: pr-readiness-${{ inputs.pr }}\n queue: max\n\nrun-name: \"PR maintenance #${{ inputs.pr }} [${{ inputs.attempt }}]\"\n\njobs:\n activation:\n if: vars.PR_READINESS_ENABLED == 'true'\n runs-on: ubuntu-slim\n permissions:\n actions: read\n contents: read\n env:\n GH_AW_MAX_DAILY_AI_CREDITS: \"2000\"\n GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }}\n outputs:\n comment_id: \"\"\n comment_repo: \"\"\n daily_ai_credits_exceeded: ${{ steps.daily-effective-workflow-guardrail.outputs.daily_ai_credits_exceeded == 'true' }}\n daily_ai_credits_guardrail_status: ${{ steps.daily-effective-workflow-guardrail.outputs.daily_ai_credits_guardrail_status || '' }}\n daily_ai_credits_threshold: ${{ steps.daily-effective-workflow-guardrail.outputs.daily_ai_credits_threshold || '' }}\n daily_ai_credits_total_effective_tokens: ${{ steps.daily-effective-workflow-guardrail.outputs.daily_ai_credits_total_effective_tokens || '' }}\n engine_id: ${{ steps.generate_aw_info.outputs.engine_id }}\n lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }}\n model: ${{ steps.generate_aw_info.outputs.model }}\n oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }}\n secret_verification_result: ${{ steps.validate-secret.outputs.verification_result }}\n setup-parent-span-id: ${{ steps.setup.outputs.parent-span-id || steps.setup.outputs.span-id }}\n setup-span-id: ${{ steps.setup.outputs.span-id }}\n setup-trace-id: ${{ steps.setup.outputs.trace-id }}\n stale_lock_file_failed: ${{ steps.check-lock-file.outputs.stale_lock_file_failed == 'true' }}\n steps:\n - name: Setup Scripts\n id: setup\n uses: github/gh-aw-actions/setup@6aab9e5b5c91c615506061f09bedd81a23babe3c # v0.86.2\n with:\n destination: ${{ runner.temp }}/gh-aw/actions\n job-name: ${{ github.job }}\n safe-output-artifact-client: ${{ env.GH_AW_MAX_DAILY_AI_CREDITS != '' }}\n env:\n GH_AW_SETUP_WORKFLOW_NAME: \"PR readiness worker\"\n GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/pr-readiness-worker.lock.yml@${{ github.ref }}\n GH_AW_INFO_VERSION: \"0.147.0\"\n GH_AW_INFO_AWF_VERSION: \"v0.27.44\"\n GH_AW_INFO_ENGINE_ID: \"codex\"\n - name: Generate agentic run info\n id: generate_aw_info\n env:\n GH_AW_INFO_ENGINE_ID: \"codex\"\n GH_AW_INFO_ENGINE_NAME: \"Codex\"\n GH_AW_INFO_MODEL: \"gpt-5.4\"\n GH_AW_INFO_VERSION: \"0.147.0\"\n GH_AW_INFO_AGENT_VERSION: \"0.147.0\"\n GH_AW_INFO_CLI_VERSION: \"v0.86.2\"\n GH_AW_INFO_WORKFLOW_NAME: \"PR readiness worker\"\n GH_AW_INFO_EXPERIMENTAL: \"false\"\n GH_AW_INFO_SUPPORTS_TOOLS_ALLOWLIST: \"true\"\n GH_AW_INFO_STAGED: \"false\"\n GH_AW_INFO_ALLOWED_DOMAINS: '[\"defaults\",\"node\",\"release-assets.githubusercontent.com\"]'\n GH_AW_INFO_FIREWALL_ENABLED: \"true\"\n GH_AW_INFO_AWF_VERSION: \"v0.27.44\"\n GH_AW_INFO_AWMG_VERSION: \"\"\n GH_AW_INFO_FIREWALL_TYPE: \"squid\"\n GH_AW_INFO_AGENT_RUNTIME: \"\"\n GH_AW_COMPILED_STRICT: \"true\"\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n with:\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/generate_aw_info.cjs');\n await main(core, context);\n - name: Restore daily AIC usage cache\n id: restore-daily-aic-cache\n if: ${{ env.GH_AW_MAX_DAILY_AI_CREDITS != '' }}\n continue-on-error: true\n uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0\n with:\n key: agentic-workflow-usage-prreadinessworker-${{ github.run_id }}\n restore-keys: agentic-workflow-usage-prreadinessworker-\n path: /tmp/gh-aw/agentic-workflow-usage-cache.jsonl\n - name: Restore daily AIC usage cache (artifact fallback)\n id: restore-daily-aic-cache-fallback\n if: ${{ env.GH_AW_MAX_DAILY_AI_CREDITS != '' }}\n continue-on-error: true\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n env:\n GH_AW_RESTORE_DAILY_AIC_CACHE_HIT: ${{ steps.restore-daily-aic-cache.outputs.cache-hit }}\n GH_AW_RESTORE_DAILY_AIC_CACHE_MATCHED_KEY: ${{ steps.restore-daily-aic-cache.outputs.cache-matched-key }}\n with:\n github-token: ${{ secrets.GITHUB_TOKEN }}\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/restore_aic_usage_cache_fallback.cjs');\n await main();\n - name: Check daily workflow token guardrail\n id: daily-effective-workflow-guardrail\n if: ${{ env.GH_AW_MAX_DAILY_AI_CREDITS != '' }}\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n env:\n GH_AW_WORKFLOW_NAME: \"PR readiness worker\"\n GH_AW_WORKFLOW_ID: \"pr-readiness-worker\"\n GH_AW_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}\n GH_AW_WORKFLOW_DISPATCH_AW_CONTEXT: ${{ github.event.inputs.aw_context || '' }}\n GH_AW_HAS_SLASH_COMMAND: \"false\"\n GH_AW_HAS_LABEL_COMMAND: \"false\"\n GH_AW_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}\n GH_AW_MAX_DAILY_AI_CREDITS: \"2000\"\n with:\n github-token: ${{ secrets.GITHUB_TOKEN }}\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/check_daily_aic_workflow_guardrail.cjs');\n await main();\n - name: Validate CODEX_API_KEY or OPENAI_API_KEY secret\n id: validate-secret\n run: bash \"${RUNNER_TEMP}/gh-aw/actions/validate_multi_secret.sh\" CODEX_API_KEY OPENAI_API_KEY Codex https://github.github.com/gh-aw/reference/engines/#openai-codex\n env:\n CODEX_API_KEY: ${{ secrets.CODEX_API_KEY }}\n OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}\n - name: Check for OAuth tokens\n id: check-oauth-tokens\n run: bash \"${RUNNER_TEMP}/gh-aw/actions/check_oauth_tokens.sh\"\n env:\n COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}\n GH_AW_GITHUB_TOKEN: ${{ secrets.GH_AW_GITHUB_TOKEN }}\n GH_AW_GITHUB_MCP_SERVER_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN }}\n - name: Checkout .github and .agents folders\n uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1\n with:\n persist-credentials: false\n sparse-checkout: |\n .github\n .agents\n .claude\n .codex\n .gemini\n .pi\n sparse-checkout-cone-mode: true\n fetch-depth: 1\n - name: Save agent config folders for base branch restoration\n env:\n GH_AW_AGENT_FOLDERS: \".agents .codex .github\"\n GH_AW_AGENT_FILES: \"AGENTS.md\"\n run: |\n bash \"${RUNNER_TEMP}/gh-aw/actions/save_base_github_folders.sh\"\n - name: Check workflow lock file\n id: check-lock-file\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n env:\n GH_AW_WORKFLOW_FILE: \"pr-readiness-worker.lock.yml\"\n GH_AW_CONTEXT_WORKFLOW_REF: \"${{ github.workflow_ref }}\"\n with:\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/check_workflow_timestamp_api.cjs');\n await main();\n - name: Check compile-agentic version\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n env:\n GH_AW_COMPILED_VERSION: \"v0.86.2\"\n with:\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/check_version_updates.cjs');\n await main();\n - name: Log runtime features\n if: ${{ contains(toJSON(vars), '\"GH_AW_RUNTIME_FEATURES\":') }}\n run: bash \"${RUNNER_TEMP}/gh-aw/actions/log_runtime_features_summary.sh\"\n - name: Create prompt with built-in context\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n env:\n GH_AW_ACTIONS_DIR: ${{ runner.temp }}/gh-aw/actions\n GH_AW_PROMPT: ${{ runner.temp }}/gh-aw/aw-prompts/prompt.txt\n GH_AW_SAFE_OUTPUTS: ${{ runner.temp }}/gh-aw/safeoutputs/outputs.jsonl\n GH_AW_PROMPT_CONFIG: \"{\\\"items\\\":[{\\\"content_env\\\":\\\"GH_AW_PROMPT_CONTENT_0000\\\"},{\\\"file\\\":\\\"xpia.md\\\"},{\\\"file\\\":\\\"temp_folder_prompt.md\\\"},{\\\"file\\\":\\\"markdown.md\\\"},{\\\"file\\\":\\\"safe_outputs_prompt.md\\\"},{\\\"content_env\\\":\\\"GH_AW_PROMPT_CONTENT_0001\\\"},{\\\"content_env\\\":\\\"GH_AW_PROMPT_CONTENT_0002\\\"},{\\\"file\\\":\\\"mcp_cli_tools_prompt.md\\\"},{\\\"content_env\\\":\\\"GH_AW_PROMPT_CONTENT_0003\\\"},{\\\"file\\\":\\\"cli_proxy_with_safeoutputs_prompt.md\\\"},{\\\"content_env\\\":\\\"GH_AW_PROMPT_CONTENT_0004\\\"},{\\\"content_env\\\":\\\"GH_AW_PROMPT_CONTENT_0005\\\"}]}\"\n GH_AW_EXPR_1A3A194A: ${{ github.event.discussion.number || (fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_type == 'discussion' && fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_number) }}\n GH_AW_EXPR_463A214A: ${{ github.event.pull_request.number || (fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_type == 'pull_request' && fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_number) }}\n GH_AW_EXPR_802A9F6A: ${{ github.event.issue.number || (fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_type == 'issue' && fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_number) }}\n GH_AW_EXPR_FF1D34CE: ${{ github.event.comment.id || fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').comment_id }}\n GH_AW_GITHUB_ACTOR: ${{ github.actor }}\n GH_AW_GITHUB_REPOSITORY: ${{ github.repository }}\n GH_AW_GITHUB_RUN_ID: ${{ github.run_id }}\n GH_AW_GITHUB_WORKSPACE: ${{ github.workspace }}\n GH_AW_PROMPT_CONTENT_0000: \"\\n\"\n GH_AW_PROMPT_CONTENT_0001: \"\\nTools: missing_tool, missing_data, noop, finish_attempt\\n\"\n GH_AW_PROMPT_CONTENT_0002: \"\\n\"\n GH_AW_PROMPT_CONTENT_0003: \"\\nThe following GitHub context information is available for this workflow:\\n{{#if github.actor}}\\n- **actor**: __GH_AW_GITHUB_ACTOR__\\n{{/if}}\\n{{#if github.repository}}\\n- **repository**: __GH_AW_GITHUB_REPOSITORY__\\n{{/if}}\\n{{#if github.workspace}}\\n- **workspace**: __GH_AW_GITHUB_WORKSPACE__\\n{{/if}}\\n{{#if github.event.issue.number || (github.aw.context.item_type == 'issue' && github.aw.context.item_number)}}\\n- **issue-number**: #__GH_AW_EXPR_802A9F6A__\\n{{/if}}\\n{{#if github.event.discussion.number || (github.aw.context.item_type == 'discussion' && github.aw.context.item_number)}}\\n- **discussion-number**: #__GH_AW_EXPR_1A3A194A__\\n{{/if}}\\n{{#if github.event.pull_request.number || (github.aw.context.item_type == 'pull_request' && github.aw.context.item_number)}}\\n- **pull-request-number**: #__GH_AW_EXPR_463A214A__\\n{{/if}}\\n{{#if github.event.comment.id || github.aw.context.comment_id}}\\n- **comment-id**: __GH_AW_EXPR_FF1D34CE__\\n{{/if}}\\n{{#if github.run_id}}\\n- **workflow-run-id**: __GH_AW_GITHUB_RUN_ID__\\n{{/if}}\\n- **checkouts**: The following repositories have been checked out and are available in the workspace:\\n - repo `__GH_AW_GITHUB_REPOSITORY__` → `$GITHUB_WORKSPACE` (cwd) [full history, all branches available as remote-tracking refs] [additional refs fetched: *]\\n - **Note**: If a branch you need is not in the list above and is not listed as an additional fetched ref, it has NOT been checked out. For private repositories you cannot fetch it. If the branch is required and not available, exit with an error and ask the user to add it to the `fetch:` option of the `checkout:` configuration (e.g., `fetch: [\\\"refs/pulls/open/*\\\"]` for all open PR refs, or `fetch: [\\\"main\\\", \\\"feature/my-branch\\\"]` for specific branches).\\n - **Warning: No git credentials are available to the agent.** Credentials are\\n intentionally removed after the checkout step for security. This means any git\\n operation that needs to authenticate to the remote will fail. In private repositories, that includes:\\n - `git fetch`, `git pull`, `git clone`, and `git push` (direct push, not via safe-output tools)\\n - Checking out or switching to a remote branch that is not already fetched\\n - Deepening a shallow clone (`git fetch --unshallow`)\\n - On-demand blob fetches in partial/blobless clones (operations on files not in the initial checkout)\\n Do NOT attempt to configure credentials, run `git credential fill`, or modify `.gitconfig` —\\n authentication will not succeed. If you encounter credential prompts or authentication errors,\\n stop immediately and report the limitation rather than spending turns trying to work around it.\\n\\n\\n\"\n GH_AW_PROMPT_CONTENT_0004: \"\\n\"\n GH_AW_PROMPT_CONTENT_0005: \"{{#runtime-import .github/workflows/pr-readiness-worker.md}}\\n\"\n with:\n script: |\n const { setupGlobals } = require(process.env.GH_AW_ACTIONS_DIR + '/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require(process.env.GH_AW_ACTIONS_DIR + '/create_prompt.cjs');\n await main(core);\n - name: Interpolate variables and render templates\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n env:\n GH_AW_PROMPT: ${{ runner.temp }}/gh-aw/aw-prompts/prompt.txt\n GH_AW_ENGINE_ID: \"codex\"\n with:\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/interpolate_prompt.cjs');\n await main();\n - name: Substitute placeholders\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n env:\n GH_AW_PROMPT: ${{ runner.temp }}/gh-aw/aw-prompts/prompt.txt\n GH_AW_EXPR_1A3A194A: ${{ github.event.discussion.number || (fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_type == 'discussion' && fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_number) }}\n GH_AW_EXPR_463A214A: ${{ github.event.pull_request.number || (fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_type == 'pull_request' && fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_number) }}\n GH_AW_EXPR_802A9F6A: ${{ github.event.issue.number || (fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_type == 'issue' && fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_number) }}\n GH_AW_EXPR_FF1D34CE: ${{ github.event.comment.id || fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').comment_id }}\n GH_AW_GITHUB_ACTOR: ${{ github.actor }}\n GH_AW_GITHUB_REPOSITORY: ${{ github.repository }}\n GH_AW_GITHUB_RUN_ID: ${{ github.run_id }}\n GH_AW_GITHUB_WORKSPACE: ${{ github.workspace }}\n GH_AW_MCP_CLI_SERVERS_LIST: '- `safeoutputs` — run `safeoutputs --help` to see available tools'\n with:\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n\n const substitutePlaceholders = require('${{ runner.temp }}/gh-aw/actions/substitute_placeholders.cjs');\n\n // Call the substitution function\n return await substitutePlaceholders({\n file: process.env.GH_AW_PROMPT,\n substitutions: {\n GH_AW_EXPR_1A3A194A: process.env.GH_AW_EXPR_1A3A194A,\n GH_AW_EXPR_463A214A: process.env.GH_AW_EXPR_463A214A,\n GH_AW_EXPR_802A9F6A: process.env.GH_AW_EXPR_802A9F6A,\n GH_AW_EXPR_FF1D34CE: process.env.GH_AW_EXPR_FF1D34CE,\n GH_AW_GITHUB_ACTOR: process.env.GH_AW_GITHUB_ACTOR,\n GH_AW_GITHUB_REPOSITORY: process.env.GH_AW_GITHUB_REPOSITORY,\n GH_AW_GITHUB_RUN_ID: process.env.GH_AW_GITHUB_RUN_ID,\n GH_AW_GITHUB_WORKSPACE: process.env.GH_AW_GITHUB_WORKSPACE,\n GH_AW_MCP_CLI_SERVERS_LIST: process.env.GH_AW_MCP_CLI_SERVERS_LIST\n }\n });\n - name: Validate prompt placeholders\n env:\n GH_AW_PROMPT: ${{ runner.temp }}/gh-aw/aw-prompts/prompt.txt\n run: |\n bash \"${RUNNER_TEMP}/gh-aw/actions/validate_prompt_placeholders.sh\"\n - name: Print prompt\n env:\n GH_AW_PROMPT: ${{ runner.temp }}/gh-aw/aw-prompts/prompt.txt\n run: |\n bash \"${RUNNER_TEMP}/gh-aw/actions/print_prompt_summary.sh\"\n - name: Stage prompt files for artifact upload\n run: |\n mkdir -p /tmp/gh-aw/aw-prompts\n cp -a \"${RUNNER_TEMP}/gh-aw/aw-prompts/.\" /tmp/gh-aw/aw-prompts/\n - name: Upload activation artifact\n if: success()\n uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1\n with:\n name: activation\n include-hidden-files: true\n path: |\n /tmp/gh-aw/aw_info.json\n /tmp/gh-aw/models.json\n /tmp/gh-aw/aw-prompts/prompt.txt\n /tmp/gh-aw/aw-prompts/prompt-template.txt\n /tmp/gh-aw/aw-prompts/prompt-import-tree.json\n /tmp/gh-aw/github_rate_limits.jsonl\n /tmp/gh-aw/base\n /tmp/gh-aw/.codex/agents\n /tmp/gh-aw/.codex/skills\n if-no-files-found: ignore\n retention-days: 1\n\n agent:\n needs: activation\n if: needs.activation.outputs.daily_ai_credits_exceeded != 'true'\n runs-on: ubuntu-latest\n permissions:\n actions: read\n contents: read\n pull-requests: read\n env:\n DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}\n GH_AW_ASSETS_ALLOWED_EXTS: \"\"\n GH_AW_ASSETS_BRANCH: \"\"\n GH_AW_ASSETS_MAX_SIZE_KB: 0\n GH_AW_MCP_LOG_DIR: /tmp/gh-aw/mcp-logs/safeoutputs\n GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }}\n GH_AW_WORKFLOW_ID_SANITIZED: prreadinessworker\n outputs:\n agentic_engine_timeout: ${{ steps.detect-agent-errors.outputs.agentic_engine_timeout || 'false' }}\n ai_credits_rate_limit_error: ${{ steps.parse-mcp-gateway.outputs.ai_credits_rate_limit_error || 'false' }}\n aic: ${{ steps.parse-mcp-gateway.outputs.aic }}\n ambient_context: ${{ steps.parse-mcp-gateway.outputs.ambient_context }}\n checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}\n effective_tokens: ${{ steps.parse-mcp-gateway.outputs.effective_tokens }}\n has_patch: ${{ steps.collect_output.outputs.has_patch }}\n http_400_response_error: ${{ steps.detect-agent-errors.outputs.http_400_response_error || 'false' }}\n inference_access_error: ${{ steps.detect-agent-errors.outputs.inference_access_error || 'false' }}\n invocation_cap_exceeded: ${{ steps.detect-agent-errors.outputs.invocation_cap_exceeded || 'false' }}\n max_cache_misses_exceeded: ${{ steps.detect-agent-errors.outputs.max_cache_misses_exceeded || 'false' }}\n mcp_policy_error: ${{ steps.detect-agent-errors.outputs.mcp_policy_error || 'false' }}\n missing_model_pricing_error: ${{ steps.detect-agent-errors.outputs.missing_model_pricing_error || 'false' }}\n missing_model_pricing_model_name: ${{ steps.detect-agent-errors.outputs.missing_model_pricing_model_name || '' }}\n model: ${{ needs.activation.outputs.model }}\n model_not_supported_error: ${{ steps.detect-agent-errors.outputs.model_not_supported_error || 'false' }}\n output: ${{ steps.collect_output.outputs.output }}\n output_types: ${{ steps.collect_output.outputs.output_types }}\n setup-parent-span-id: ${{ steps.setup.outputs.parent-span-id || steps.setup.outputs.span-id }}\n setup-span-id: ${{ steps.setup.outputs.span-id }}\n setup-trace-id: ${{ steps.setup.outputs.trace-id }}\n unknown_model_ai_credits: ${{ steps.parse-mcp-gateway.outputs.unknown_model_ai_credits || 'false' }}\n steps:\n - name: Setup Scripts\n id: setup\n uses: github/gh-aw-actions/setup@6aab9e5b5c91c615506061f09bedd81a23babe3c # v0.86.2\n with:\n destination: ${{ runner.temp }}/gh-aw/actions\n job-name: ${{ github.job }}\n trace-id: ${{ needs.activation.outputs.setup-trace-id }}\n parent-span-id: ${{ needs.activation.outputs.setup-parent-span-id || needs.activation.outputs.setup-span-id }}\n env:\n GH_AW_SETUP_WORKFLOW_NAME: \"PR readiness worker\"\n GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/pr-readiness-worker.lock.yml@${{ github.ref }}\n GH_AW_INFO_VERSION: \"0.147.0\"\n GH_AW_INFO_AWF_VERSION: \"v0.27.44\"\n GH_AW_INFO_ENGINE_ID: \"codex\"\n - name: Set runtime paths\n id: set-runtime-paths\n run: |\n {\n echo \"GH_AW_SAFE_OUTPUTS=${RUNNER_TEMP}/gh-aw/safeoutputs/outputs.jsonl\"\n echo \"GH_AW_SAFE_OUTPUTS_CONFIG_PATH=${RUNNER_TEMP}/gh-aw/safeoutputs/config.json\"\n echo \"GH_AW_SAFE_OUTPUTS_TOOLS_PATH=${RUNNER_TEMP}/gh-aw/safeoutputs/tools.json\"\n } >> \"$GITHUB_OUTPUT\"\n - name: Checkout repository\n uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1\n with:\n persist-credentials: false\n ref: main\n fetch-depth: 0\n - name: Fetch additional refs\n env:\n GH_AW_FETCH_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}\n run: |\n header=$(printf \"x-access-token:%s\" \"${GH_AW_FETCH_TOKEN}\" | base64 -w 0)\n git -c \"http.extraheader=Authorization: Basic ${header}\" fetch origin '+refs/heads/*:refs/remotes/origin/*'\n - name: Setup Bun\n uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0\n with:\n bun-version: '1.4.2'\n - name: Setup Node.js\n uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0\n with:\n node-version: '24'\n package-manager-cache: false\n - name: Create gh-aw temp directory\n run: bash \"${RUNNER_TEMP}/gh-aw/actions/create_gh_aw_tmp_dir.sh\"\n - name: Configure gh CLI for GitHub Enterprise\n run: bash \"${RUNNER_TEMP}/gh-aw/actions/configure_gh_for_ghe.sh\"\n env:\n GH_TOKEN: ${{ github.token }}\n - name: Download activation artifact\n uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1\n with:\n name: activation\n path: /tmp/gh-aw\n - name: Expose pinned Bun through the sandbox tool cache\n run: |\n test \"$(bun --version)\" = \"1.4.2\"\n directory=\"${RUNNER_TOOL_CACHE:?}/bun/1.4.2/x64/bin\"\n mkdir -p \"$directory\"\n install -m 755 \"$(command -v bun)\" \"$directory/bun\"\n test \"$(\"$directory/bun\" --version)\" = \"1.4.2\"\n - env:\n ATTEMPT: ${{ inputs.attempt }}\n GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}\n PR_MAINTENANCE_STATE_KEY: ${{ secrets.PR_MAINTENANCE_STATE_KEY }}\n PR_NUMBER: ${{ inputs.pr }}\n name: Authenticate the reserved attempt\n run: node scripts/pr-maintenance/worker-run.mjs prepare\n - name: Prepare browser and PostgreSQL binaries from trusted main\n run: \"# Runner setup only: the agent keeps its strict, unprivileged sandbox.\\nsudo /usr/share/postgresql-common/pgdg/apt.postgresql.org.sh -y\\nsudo apt-get install -y --no-install-recommends postgresql-17\\nbun install --frozen-lockfile\\nPLAYWRIGHT_BROWSERS_PATH=/tmp/gh-aw/browsers bun run e2e:browsers\\necho \\\"PLAYWRIGHT_BROWSERS_PATH=/tmp/gh-aw/browsers\\\" >> \\\"$GITHUB_ENV\\\"\\ninstall -m 644 scripts/pr-maintenance/test-databases.sh /tmp/gh-aw/data/test-databases.sh\"\n\n - name: Configure Git credentials\n env:\n GITHUB_REPOSITORY: ${{ github.repository }}\n GITHUB_SERVER_URL: ${{ github.server_url }}\n GITHUB_TOKEN: ${{ github.token }}\n run: bash \"${RUNNER_TEMP}/gh-aw/actions/configure_git_credentials.sh\"\n - name: Checkout PR branch\n id: checkout-pr\n if: |\n github.event.pull_request || github.event.issue.pull_request || github.event_name == 'workflow_dispatch' && fromJSON(github.event.inputs.aw_context || '{}').item_type == 'pull_request'\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n env:\n GH_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}\n with:\n github-token: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/checkout_pr_branch.cjs');\n await main();\n - name: Setup Node.js\n uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0\n with:\n node-version: '24'\n package-manager-cache: false\n - name: Install Codex CLI\n run: npm install --ignore-scripts -g @openai/codex@0.147.0\n - name: Install AWF binary\n run: bash \"${RUNNER_TEMP}/gh-aw/actions/install_awf_binary.sh\" v0.27.44 --rootless\n - name: Determine automatic lockdown mode for GitHub MCP Server\n id: determine-automatic-lockdown\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 (source v9)\n env:\n GH_AW_GITHUB_TOKEN: ${{ secrets.GH_AW_GITHUB_TOKEN }}\n GH_AW_GITHUB_MCP_SERVER_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN }}\n with:\n script: |\n const determineAutomaticLockdown = require('${{ runner.temp }}/gh-aw/actions/determine_automatic_lockdown.cjs');\n await determineAutomaticLockdown(github, context, core);\n - name: Restore agent config folders from base branch\n if: steps.checkout-pr.outcome == 'success'\n env:\n GH_AW_AGENT_FOLDERS: \".agents .codex .github\"\n GH_AW_AGENT_FILES: \"AGENTS.md\"\n run: bash \"${RUNNER_TEMP}/gh-aw/actions/restore_base_github_folders.sh\"\n - name: Restore inline sub-agents from activation artifact\n env:\n GH_AW_SUB_AGENT_DIR: \".codex/agents\"\n GH_AW_SUB_AGENT_EXT: \".md\"\n run: bash \"${RUNNER_TEMP}/gh-aw/actions/restore_inline_sub_agents.sh\"\n - name: Restore inline skills from activation artifact\n env:\n GH_AW_SKILL_DIR: \".codex/skills\"\n run: bash \"${RUNNER_TEMP}/gh-aw/actions/restore_inline_skills.sh\"\n - name: Download container images\n run: bash \"${RUNNER_TEMP}/gh-aw/actions/download_docker_images.sh\" ghcr.io/github/gh-aw-firewall/agent:0.27.44@sha256:0d727725c737b58c7bdf51f640cffb928385ec46517e0917c7f1a02f1bada8b4 ghcr.io/github/gh-aw-firewall/api-proxy:0.27.44@sha256:b50fbadba138f6e9aba94aca09711335c489bb3b15861220cb66f6092e042dc7 ghcr.io/github/gh-aw-firewall/cli-proxy:0.27.44@sha256:c064d15974f7c933ec7d3f7b4038f4fd203547b3154bdc821afd379144887eff ghcr.io/github/gh-aw-firewall/squid:0.27.44@sha256:83e48bbe12c634be8c228a576832fe45f66c529ac3659db92bddbcf2eeb6d627 ghcr.io/github/gh-aw-mcpg:v0.4.9@sha256:e5a1569aeaf41820fa7bdee3e94468cae448133cdbf00119ad24f5b74db1ab9f ghcr.io/github/gh-aw-node@sha256:0d9f1fb5fd6610c0ac1f5194a38e45a8a1e81f8a390d5142d8e4e6f26a4b3196 ghcr.io/github/github-mcp-server:v1.9.0@sha256:881b53d6f75f69bdbc1b5b10fc2f1361717c19054143b3a8529fb5c32061a50e\n - name: Generate Safe Outputs Config\n run: |\n mkdir -p \"${RUNNER_TEMP}/gh-aw/safeoutputs\"\n mkdir -p /tmp/gh-aw/safeoutputs\n mkdir -p /tmp/gh-aw/mcp-logs/safeoutputs\n cat > \"${RUNNER_TEMP}/gh-aw/safeoutputs/config.json\" << 'GH_AW_SAFE_OUTPUTS_CONFIG_88041607a66aed1b_EOF'\n {\"create_report_incomplete_issue\":{},\"finish-attempt\":{\"description\":\"Submit exactly one proposed update, human decision, or infrastructure blocker.\",\"inputs\":{\"attempt\":{\"default\":null,\"description\":\"The exact reserved attempt identifier\",\"required\":true,\"type\":\"string\"},\"kind\":{\"default\":null,\"description\":\"Proposal, human decision, or infrastructure failure\",\"options\":[\"proposal\",\"human\",\"infrastructure\"],\"required\":true,\"type\":\"choice\"},\"reason\":{\"default\":null,\"description\":\"Nonempty concrete blocker and next action; omit for a proposal\",\"required\":false,\"type\":\"string\"},\"review\":{\"default\":null,\"description\":\"Exact bounded binary Git diff of the proposed repair; omit for a report\",\"required\":false,\"type\":\"string\"}},\"max\":1},\"missing_data\":{},\"missing_tool\":{},\"noop\":{\"max\":1,\"report-as-issue\":\"false\"},\"report_incomplete\":{}}\n GH_AW_SAFE_OUTPUTS_CONFIG_88041607a66aed1b_EOF\n - name: Generate Safe Outputs Tools\n env:\n GH_AW_TOOLS_META_JSON: |\n {\n \"description_suffixes\": {},\n \"repo_params\": {},\n \"dynamic_tools\": [\n {\n \"description\": \"Submit exactly one proposed update, human decision, or infrastructure blocker.\",\n \"inputSchema\": {\n \"additionalProperties\": false,\n \"properties\": {\n \"attempt\": {\n \"description\": \"The exact reserved attempt identifier\",\n \"type\": \"string\"\n },\n \"kind\": {\n \"description\": \"Proposal, human decision, or infrastructure failure\",\n \"enum\": [\n \"proposal\",\n \"human\",\n \"infrastructure\"\n ],\n \"type\": \"string\"\n },\n \"reason\": {\n \"description\": \"Nonempty concrete blocker and next action; omit for a proposal\",\n \"type\": \"string\"\n },\n \"review\": {\n \"description\": \"Exact bounded binary Git diff of the proposed repair; omit for a report\",\n \"type\": \"string\"\n }\n },\n \"required\": [\n \"attempt\",\n \"kind\"\n ],\n \"type\": \"object\"\n },\n \"name\": \"finish_attempt\"\n }\n ]\n }\n GH_AW_VALIDATION_JSON: |\n {\n \"missing_data\": {\n \"defaultMax\": 20,\n \"fields\": {\n \"alternatives\": {\n \"type\": \"string\",\n \"sanitize\": true,\n \"maxLength\": 256\n },\n \"context\": {\n \"type\": \"string\",\n \"sanitize\": true,\n \"maxLength\": 256\n },\n \"data_type\": {\n \"type\": \"string\",\n \"sanitize\": true,\n \"maxLength\": 128\n },\n \"reason\": {\n \"type\": \"string\",\n \"sanitize\": true,\n \"maxLength\": 256\n }\n }\n },\n \"missing_tool\": {\n \"defaultMax\": 20,\n \"fields\": {\n \"alternatives\": {\n \"type\": \"string\",\n \"sanitize\": true,\n \"maxLength\": 512\n },\n \"reason\": {\n \"required\": true,\n \"type\": \"string\",\n \"sanitize\": true,\n \"maxLength\": 256\n },\n \"tool\": {\n \"type\": \"string\",\n \"sanitize\": true,\n \"maxLength\": 128\n }\n }\n },\n \"noop\": {\n \"defaultMax\": 1,\n \"fields\": {\n \"message\": {\n \"required\": true,\n \"type\": \"string\",\n \"sanitize\": true,\n \"maxLength\": 65000\n }\n }\n },\n \"report_incomplete\": {\n \"defaultMax\": 5,\n \"fields\": {\n \"details\": {\n \"type\": \"string\",\n \"sanitize\": true,\n \"maxLength\": 65000\n },\n \"reason\": {\n \"required\": true,\n \"type\": \"string\",\n \"sanitize\": true,\n \"maxLength\": 1024\n }\n }\n }\n }\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n with:\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/generate_safe_outputs_tools.cjs');\n await main();\n - name: Start MCP Gateway\n id: start-mcp-gateway\n env:\n CODEX_HOME: /tmp/gh-aw/mcp-config\n GH_AW_POLICY_ALLOW_CREATE_PULL_REQUEST: ${{ vars.GH_AW_POLICY_ALLOW_CREATE_PULL_REQUEST || 'true' }}\n GH_AW_SAFE_OUTPUTS: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS }}\n GH_AW_SAFE_OUTPUTS_CONFIG_PATH: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS_CONFIG_PATH }}\n GH_AW_SAFE_OUTPUTS_TOOLS_PATH: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS_TOOLS_PATH }}\n GH_AW_SINK_VISIBILITY: ${{ steps.determine-automatic-lockdown.outputs.visibility }}\n GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}\n run: |\n set -eo pipefail\n mkdir -p \"${RUNNER_TEMP}/gh-aw/mcp-config\"\n\n # Export gateway environment variables for MCP config and gateway script\n export MCP_GATEWAY_PORT=\"8080\"\n export MCP_GATEWAY_DOMAIN=\"awmg-mcpg\"\n export MCP_GATEWAY_HOST_DOMAIN=\"localhost\"\n MCP_GATEWAY_API_KEY=$(openssl rand -base64 45 | tr -d '/+=')\n echo \"::add-mask::${MCP_GATEWAY_API_KEY}\"\n export MCP_GATEWAY_API_KEY\n export MCP_GATEWAY_PAYLOAD_DIR=\"/tmp/gh-aw/mcp-payloads\"\n mkdir -p \"${MCP_GATEWAY_PAYLOAD_DIR}\"\n export MCP_GATEWAY_PAYLOAD_SIZE_THRESHOLD=\"524288\"\n export MCP_GATEWAY_ALLOWED_MOUNT_ROOTS=\"${GITHUB_WORKSPACE}:rw,${RUNNER_TEMP}/gh-aw:ro,${RUNNER_TEMP}/gh-aw/safeoutputs:rw,/opt:ro,/tmp:rw,/usr/bin/gh:ro\"\n export DEBUG=\"*\"\n\n export GH_AW_ENGINE=\"codex\"\n MCP_GATEWAY_UID=$(id -u 2>/dev/null || echo '0')\n MCP_GATEWAY_GID=$(id -g 2>/dev/null || echo '0')\n source \"${RUNNER_TEMP}/gh-aw/actions/resolve_docker_socket_gid.sh\"\n export MCP_GATEWAY_DOCKER_COMMAND='docker run -i --rm --network bridge -p 127.0.0.1:'\"${MCP_GATEWAY_PORT}\"':'\"${MCP_GATEWAY_PORT}\"' --name awmg-mcpg --add-host host.docker.internal:host-gateway --user '\"${MCP_GATEWAY_UID}\"':'\"${MCP_GATEWAY_GID}\"' --group-add '\"${DOCKER_SOCK_GID}\"' -v '\"${DOCKER_SOCK_PATH}\"':/var/run/docker.sock -e MCP_GATEWAY_PORT -e MCP_GATEWAY_DOMAIN -e MCP_GATEWAY_API_KEY -e MCP_GATEWAY_PAYLOAD_DIR -e MCP_GATEWAY_PAYLOAD_SIZE_THRESHOLD -e DOCKER_HOST=unix:///var/run/docker.sock -e DEBUG -e MCP_GATEWAY_LOG_DIR -e GH_AW_MCP_LOG_DIR -e GH_AW_SAFE_OUTPUTS -e GH_AW_SAFE_OUTPUTS_CONFIG_PATH -e GH_AW_SAFE_OUTPUTS_TOOLS_PATH -e GH_AW_POLICY_ALLOW_CREATE_PULL_REQUEST -e GH_AW_ASSETS_BRANCH -e GH_AW_ASSETS_MAX_SIZE_KB -e GH_AW_ASSETS_ALLOWED_EXTS -e DEFAULT_BRANCH -e GITHUB_MCP_SERVER_TOKEN -e GITHUB_MCP_GUARD_MIN_INTEGRITY -e GITHUB_MCP_GUARD_REPOS -e GH_AW_SINK_VISIBILITY -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e GITHUB_SHA -e GITHUB_WORKSPACE -e GITHUB_TOKEN -e GITHUB_RUN_ID -e GITHUB_RUN_NUMBER -e GITHUB_RUN_ATTEMPT -e GITHUB_JOB -e GITHUB_ACTION -e GITHUB_EVENT_NAME -e GITHUB_EVENT_PATH -e GITHUB_ACTOR -e GITHUB_ACTOR_ID -e GITHUB_TRIGGERING_ACTOR -e GITHUB_WORKFLOW -e GITHUB_WORKFLOW_REF -e GITHUB_WORKFLOW_SHA -e GITHUB_REF -e GITHUB_REF_NAME -e GITHUB_REF_TYPE -e GITHUB_HEAD_REF -e GITHUB_BASE_REF -e RUNNER_TEMP -e MCP_GATEWAY_ALLOWED_MOUNT_ROOTS -e CODEX_HOME -v /tmp/gh-aw/mcp-payloads:/tmp/gh-aw/mcp-payloads:rw -v /opt:/opt:ro -v /tmp:/tmp:rw -v '\"${GITHUB_WORKSPACE}\"':'\"${GITHUB_WORKSPACE}\"':rw -v '\"${RUNNER_TEMP}\"'/gh-aw/safeoutputs:'\"${RUNNER_TEMP}\"'/gh-aw/safeoutputs:rw ghcr.io/github/gh-aw-mcpg:v0.4.9'\n\n cat > \"${RUNNER_TEMP}/gh-aw/mcp-config/config.toml\" << GH_AW_MCP_CONFIG_5f908bd414542dec_EOF\n [history]\n persistence = \"none\"\n\n [shell_environment_policy]\n inherit = \"core\"\n include_only = [\"^CODEX_API_KEY$\", \"^GH_AW_ASSETS_ALLOWED_EXTS$\", \"^GH_AW_ASSETS_BRANCH$\", \"^GH_AW_ASSETS_MAX_SIZE_KB$\", \"^GH_AW_SAFE_OUTPUTS$\", \"^GITHUB_REPOSITORY$\", \"^GITHUB_SERVER_URL$\", \"^HOME$\", \"^OPENAI_API_KEY$\", \"^PATH$\"]\n\n [mcp_servers.safeoutputs]\n container = \"ghcr.io/github/gh-aw-node\"\n mounts = [\"\\${GITHUB_WORKSPACE}:\\${GITHUB_WORKSPACE}:rw\", \"${RUNNER_TEMP}/gh-aw/safeoutputs:${RUNNER_TEMP}/gh-aw/safeoutputs:rw\", \"/tmp/gh-aw:/tmp/gh-aw:rw\"]\n args = [\"-w\", \"$GITHUB_WORKSPACE\"]\n entrypoint = \"sh\"\n entrypointArgs = [\"-c\", \"sh ${RUNNER_TEMP}/gh-aw/safeoutputs/start_safe_outputs_mcp.sh\"]\n env_vars = [\"DEBUG\", \"DEFAULT_BRANCH\", \"GH_AW_ASSETS_ALLOWED_EXTS\", \"GH_AW_ASSETS_BRANCH\", \"GH_AW_ASSETS_MAX_SIZE_KB\", \"GH_AW_MCP_LOG_DIR\", \"GH_AW_SAFE_OUTPUTS\", \"GH_AW_SAFE_OUTPUTS_CONFIG_PATH\", \"GH_AW_SAFE_OUTPUTS_TOOLS_PATH\", \"GH_AW_POLICY_ALLOW_CREATE_PULL_REQUEST\", \"GITHUB_REPOSITORY\", \"GITHUB_SHA\", \"GITHUB_TOKEN\", \"GITHUB_WORKSPACE\", \"RUNNER_TEMP\"]\n\n [mcp_servers.safeoutputs.\"guard-policies\"]\n\n [mcp_servers.safeoutputs.\"guard-policies\".write-sink]\n accept = [\"*\"]\n sink-visibility = \"${GH_AW_SINK_VISIBILITY}\"\n GH_AW_MCP_CONFIG_5f908bd414542dec_EOF\n\n # Generate JSON config for MCP gateway\n GH_AW_NODE=$(which node 2>/dev/null || command -v node 2>/dev/null || echo node)\n cat << GH_AW_MCP_CONFIG_d977eda2a4154b95_EOF | \"$GH_AW_NODE\" \"${RUNNER_TEMP}/gh-aw/actions/start_mcp_gateway.cjs\"\n {\n \"mcpServers\": {\n \"safeoutputs\": {\n \"container\": \"ghcr.io/github/gh-aw-node\",\n \"mounts\": [\"\\${GITHUB_WORKSPACE}:\\${GITHUB_WORKSPACE}:rw\", \"${RUNNER_TEMP}/gh-aw/safeoutputs:${RUNNER_TEMP}/gh-aw/safeoutputs:rw\", \"/tmp/gh-aw:/tmp/gh-aw:rw\"],\n \"args\": [\"-w\", \"\\${GITHUB_WORKSPACE}\"],\n \"entrypoint\": \"sh\",\n \"entrypointArgs\": [\"-c\", \"sh ${RUNNER_TEMP}/gh-aw/safeoutputs/start_safe_outputs_mcp.sh\"],\n \"env\": {\n \"DEBUG\": \"*\",\n \"DEFAULT_BRANCH\": \"\\${DEFAULT_BRANCH}\",\n \"GH_AW_ASSETS_ALLOWED_EXTS\": \"\\${GH_AW_ASSETS_ALLOWED_EXTS}\",\n \"GH_AW_ASSETS_BRANCH\": \"\\${GH_AW_ASSETS_BRANCH}\",\n \"GH_AW_ASSETS_MAX_SIZE_KB\": \"\\${GH_AW_ASSETS_MAX_SIZE_KB}\",\n \"GH_AW_MCP_LOG_DIR\": \"\\${GH_AW_MCP_LOG_DIR}\",\n \"GH_AW_SAFE_OUTPUTS\": \"\\${GH_AW_SAFE_OUTPUTS}\",\n \"GH_AW_SAFE_OUTPUTS_CONFIG_PATH\": \"\\${GH_AW_SAFE_OUTPUTS_CONFIG_PATH}\",\n \"GH_AW_SAFE_OUTPUTS_TOOLS_PATH\": \"\\${GH_AW_SAFE_OUTPUTS_TOOLS_PATH}\",\n \"GH_AW_POLICY_ALLOW_CREATE_PULL_REQUEST\": \"\\${GH_AW_POLICY_ALLOW_CREATE_PULL_REQUEST}\",\n \"GITHUB_REPOSITORY\": \"\\${GITHUB_REPOSITORY}\",\n \"GITHUB_SHA\": \"\\${GITHUB_SHA}\",\n \"GITHUB_TOKEN\": \"\\${GITHUB_TOKEN}\",\n \"GITHUB_WORKSPACE\": \"\\${GITHUB_WORKSPACE}\",\n \"RUNNER_TEMP\": \"\\${RUNNER_TEMP}\"\n },\n \"guard-policies\": {\n \"write-sink\": {\n \"accept\": [\n \"*\"\n ],\n \"sink-visibility\": \"${GH_AW_SINK_VISIBILITY}\"\n }\n }\n }\n },\n \"gateway\": {\n \"port\": $MCP_GATEWAY_PORT,\n \"domain\": \"${MCP_GATEWAY_DOMAIN}\",\n \"apiKey\": \"${MCP_GATEWAY_API_KEY}\",\n \"payloadDir\": \"${MCP_GATEWAY_PAYLOAD_DIR}\",\n \"startupTimeout\": 120\n }\n }\n GH_AW_MCP_CONFIG_d977eda2a4154b95_EOF\n\n # Sync converter output to writable CODEX_HOME for Codex\n mkdir -p /tmp/gh-aw/mcp-config\n cat > \"/tmp/gh-aw/mcp-config/config.toml\" << GH_AW_CODEX_SHELL_POLICY_d8326fb8068eb0d4_EOF\n\n model_provider = \"openai-proxy\"\n\n [model_providers.openai-proxy]\n name = \"OpenAI AWF proxy\"\n base_url = \"http://172.30.0.30:10000\"\n env_key = \"OPENAI_API_KEY\"\n supports_websockets = false\n [shell_environment_policy]\n inherit = \"core\"\n include_only = [\"^CODEX_API_KEY$\", \"^GH_AW_ASSETS_ALLOWED_EXTS$\", \"^GH_AW_ASSETS_BRANCH$\", \"^GH_AW_ASSETS_MAX_SIZE_KB$\", \"^GH_AW_SAFE_OUTPUTS$\", \"^GITHUB_REPOSITORY$\", \"^GITHUB_SERVER_URL$\", \"^HOME$\", \"^OPENAI_API_KEY$\", \"^PATH$\"]\n GH_AW_CODEX_SHELL_POLICY_d8326fb8068eb0d4_EOF\n awk '\n BEGIN { skip_openai_proxy = 0 }\n /^[[:space:]]*model_provider[[:space:]]*=/ { next }\n /^\\[model_providers\\.openai-proxy\\][[:space:]]*$/ { skip_openai_proxy = 1; next }\n /^\\[/ { skip_openai_proxy = 0 }\n !skip_openai_proxy { print }\n ' \"${RUNNER_TEMP}/gh-aw/mcp-config/config.toml\" >> \"/tmp/gh-aw/mcp-config/config.toml\"\n chmod 600 \"/tmp/gh-aw/mcp-config/config.toml\"\n mkdir -p \"${CODEX_HOME}\"\n if [ \"/tmp/gh-aw/mcp-config/config.toml\" != \"${CODEX_HOME}/config.toml\" ]; then cp \"/tmp/gh-aw/mcp-config/config.toml\" \"${CODEX_HOME}/config.toml\"; fi\n chmod 600 \"${CODEX_HOME}/config.toml\"\n - name: Mount MCP servers as CLIs\n id: mount-mcp-clis\n continue-on-error: true\n env:\n MCP_GATEWAY_API_KEY: ${{ steps.start-mcp-gateway.outputs.gateway-api-key }}\n MCP_GATEWAY_DOMAIN: ${{ steps.start-mcp-gateway.outputs.gateway-domain }}\n MCP_GATEWAY_PORT: ${{ steps.start-mcp-gateway.outputs.gateway-port }}\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n with:\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/mount_mcp_as_cli.cjs');\n await main();\n - name: Clean credentials\n continue-on-error: true\n run: bash \"${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh\"\n - name: Audit pre-agent workspace\n id: pre_agent_audit\n continue-on-error: true\n run: bash \"${RUNNER_TEMP}/gh-aw/actions/audit_pre_agent_workspace.sh\"\n - name: Start CLI Proxy\n env:\n GH_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}\n GITHUB_SERVER_URL: ${{ github.server_url }}\n GITHUB_API_URL: ${{ github.api_url }}\n GH_HOST: ${{ env.GH_HOST }}\n GITHUB_HOST: ${{ env.GITHUB_HOST }}\n GITHUB_ENTERPRISE_HOST: ${{ env.GITHUB_ENTERPRISE_HOST }}\n GITHUB_GRAPHQL_URL: ${{ env.GITHUB_GRAPHQL_URL }}\n GITHUB_COPILOT_BASE_URL: ${{ env.GITHUB_COPILOT_BASE_URL }}\n GH_AW_NETWORK_ISOLATION: 'true'\n CLI_PROXY_POLICY: '{\"allow-only\":{\"repos\":\"${{ steps.determine-automatic-lockdown.outputs.repos }}\",\"min-integrity\":\"${{ steps.determine-automatic-lockdown.outputs.min_integrity }}\"}}'\n CLI_PROXY_IMAGE: 'ghcr.io/github/gh-aw-mcpg:v0.4.9'\n run: |\n bash \"${RUNNER_TEMP}/gh-aw/actions/start_cli_proxy.sh\"\n - name: Execute Codex CLI\n id: agentic_execution\n timeout-minutes: 35\n run: |\n set -o pipefail\n printf '%s' \"$(date +%s%3N)\" > /tmp/gh-aw/agent_cli_start_ms.txt\n mkdir -p \"$CODEX_HOME/logs\" && touch /tmp/gh-aw/agent-step-summary.md\n (umask 177 && touch /tmp/gh-aw/agent-stdio.log)\n # shellcheck disable=SC2016\n printf '%s\\n' '{\"$schema\":\"https://github.com/github/gh-aw-firewall/releases/download/v0.27.44/awf-config.schema.json\",\"network\":{\"allowDomains\":[\"172.30.0.1\",\"api.github.com\",\"api.npms.io\",\"api.openai.com\",\"api.snapcraft.io\",\"archive.ubuntu.com\",\"azure.archive.ubuntu.com\",\"bun.sh\",\"cdn.jsdelivr.net\",\"chatgpt.com\",\"crl.geotrust.com\",\"crl.globalsign.com\",\"crl.identrust.com\",\"crl.sectigo.com\",\"crl.thawte.com\",\"crl.usertrust.com\",\"crl.verisign.com\",\"crl3.digicert.com\",\"crl4.digicert.com\",\"crls.ssl.com\",\"deb.nodesource.com\",\"deno.land\",\"esm.sh\",\"get.pnpm.io\",\"github.com\",\"googleapis.deno.dev\",\"googlechromelabs.github.io\",\"host.docker.internal\",\"json-schema.org\",\"json.schemastore.org\",\"jsr.io\",\"keyserver.ubuntu.com\",\"nodejs.org\",\"npm.pkg.github.com\",\"npmjs.com\",\"npmjs.org\",\"ocsp.digicert.com\",\"ocsp.geotrust.com\",\"ocsp.globalsign.com\",\"ocsp.identrust.com\",\"ocsp.sectigo.com\",\"ocsp.ssl.com\",\"ocsp.thawte.com\",\"ocsp.usertrust.com\",\"ocsp.verisign.com\",\"openai.com\",\"packagecloud.io\",\"packages.cloud.google.com\",\"packages.microsoft.com\",\"ppa.launchpad.net\",\"registry.bower.io\",\"registry.npmjs.com\",\"registry.npmjs.org\",\"registry.yarnpkg.com\",\"release-assets.githubusercontent.com\",\"repo.yarnpkg.com\",\"s.symcb.com\",\"s.symcd.com\",\"security.ubuntu.com\",\"skimdb.npmjs.com\",\"storage.googleapis.com\",\"telemetry.vercel.com\",\"ts-crl.ws.symantec.com\",\"ts-ocsp.ws.symantec.com\",\"www.googleapis.com\",\"www.npmjs.com\",\"www.npmjs.org\",\"yarnpkg.com\"],\"isolation\":true,\"topologyAttach\":[\"awmg-mcpg\",\"awmg-cli-proxy\"]},\"apiProxy\":{\"enabled\":true,\"enableTokenSteering\":false,\"maxRuns\":120,\"maxCacheMisses\":5,\"maxAiCredits\":500,\"modelFallback\":{\"enabled\":false},\"models\":{\"agent\":[\"sonnet-6x\",\"gpt-5.4\",\"gpt-5.5\",\"gpt-5.6\",\"gpt-5.3\",\"gemini-pro\",\"any\"],\"antigravity\":[\"copilot/antigravity*\",\"google/antigravity*\",\"gemini/antigravity*\"],\"any\":[\"copilot/*\",\"anthropic/*\",\"openai/*\",\"google/*\",\"gemini/*\"],\"auto\":[\"copilot/auto\",\"large\"],\"claude\":[\"agent\"],\"codex\":[\"agent\"],\"coding\":[\"copilot/gpt-5*codex*\",\"openai/gpt-5*codex*\",\"gpt-5-codex\",\"kimi\"],\"computer-use\":[\"copilot/*computer-use*\",\"google/*computer-use*\",\"gemini/*computer-use*\",\"openai/*computer-use*\"],\"copilot\":[\"agent\"],\"deep-research\":[\"copilot/deep-research*\",\"copilot/o3-deep-research*\",\"copilot/o4-mini-deep-research*\",\"google/deep-research*\",\"gemini/deep-research*\",\"openai/o3-deep-research*\",\"openai/o4-mini-deep-research*\"],\"detection\":[\"small\"],\"evals\":[\"small\"],\"fable\":[\"copilot/*fable*\",\"anthropic/*fable*\"],\"gemini\":[\"agent\"],\"gemini-3-flash\":[\"copilot/gemini-3*flash*\",\"google/gemini-3*flash*\",\"gemini/gemini-3*flash*\"],\"gemini-3-pro\":[\"copilot/gemini-3*pro*\",\"google/gemini-3*pro*\",\"google/nano-banana*\",\"gemini/gemini-3*pro*\"],\"gemini-3.1-flash\":[\"copilot/gemini-3.1*flash*\",\"google/gemini-3.1*flash*\",\"gemini/gemini-3.1*flash*\"],\"gemini-3.1-pro\":[\"copilot/gemini-3.1*pro*\",\"google/gemini-3.1*pro*\",\"gemini/gemini-3.1*pro*\"],\"gemini-3.5-flash\":[\"copilot/gemini-3.5*flash*\",\"google/gemini-3.5*flash*\",\"gemini/gemini-3.5*flash*\"],\"gemini-3.6-flash\":[\"copilot/gemini-3.6*flash*\",\"google/gemini-3.6*flash*\",\"gemini/gemini-3.6*flash*\"],\"gemini-flash\":[\"copilot/gemini-*flash*\",\"google/gemini-*flash*\",\"gemini/gemini-*flash*\"],\"gemini-flash-lite\":[\"copilot/gemini-*flash*lite*\",\"google/gemini-*flash*lite*\",\"gemini/gemini-*flash*lite*\"],\"gemini-omni\":[\"copilot/gemini-omni*\",\"google/gemini-omni*\",\"gemini/gemini-omni*\"],\"gemini-pro\":[\"copilot/gemini-*pro*\",\"google/gemini-*pro*\",\"gemini/gemini-*pro*\"],\"gemma\":[\"copilot/gemma*\",\"google/gemma*\",\"gemini/gemma*\"],\"gpt-5\":[\"copilot/gpt-5*\",\"openai/gpt-5*\"],\"gpt-5-codex\":[\"copilot/gpt-5*codex*\",\"openai/gpt-5*codex*\"],\"gpt-5-mini\":[\"copilot/gpt-5*mini*\",\"openai/gpt-5*mini*\"],\"gpt-5-nano\":[\"copilot/gpt-5*nano*\",\"openai/gpt-5*nano*\"],\"gpt-5-pro\":[\"copilot/gpt-5*pro*\",\"openai/gpt-5*pro*\"],\"gpt-5.1\":[\"copilot/gpt-5.1*\",\"openai/gpt-5.1*\"],\"gpt-5.2\":[\"copilot/gpt-5.2*\",\"openai/gpt-5.2*\"],\"gpt-5.3\":[\"copilot/gpt-5.3*\",\"openai/gpt-5.3*\"],\"gpt-5.4\":[\"copilot/gpt-5.4*\",\"openai/gpt-5.4*\"],\"gpt-5.5\":[\"copilot/gpt-5.5*\",\"openai/gpt-5.5*\"],\"gpt-5.6\":[\"copilot/gpt-5.6*\",\"openai/gpt-5.6*\"],\"grok\":[\"copilot/*grok*\",\"openai/*grok*\"],\"haiku\":[\"copilot/*haiku*\",\"anthropic/*haiku*\"],\"image-generation\":[\"copilot/gpt-image*\",\"openai/gpt-image*\",\"openai/chatgpt-image*\",\"copilot/gemini-*image*\",\"google/gemini-*image*\",\"gemini/gemini-*image*\",\"google/imagen*\"],\"kimi\":[\"copilot/kimi*\",\"openai/kimi*\"],\"kiwi\":[\"copilot/kiwi*\",\"openai/kiwi*\"],\"large\":[\"sonnet\",\"gpt-5-pro\",\"gpt-5\",\"gemini-pro\"],\"lyria\":[\"google/lyria*\",\"gemini/lyria*\",\"copilot/lyria*\"],\"mai-code\":[\"copilot/MAI-Code*\",\"copilot/mai-code*\",\"openai/MAI-Code*\"],\"mai-code-1-flash-picker\":[\"copilot/MAI-Code-1-Flash-picker*\",\"copilot/mai-code-1-flash-picker*\",\"openai/MAI-Code-1-Flash-picker*\"],\"mini\":[\"haiku\",\"gpt-5-mini\",\"gpt-5-nano\",\"gemini-flash-lite\"],\"nano-banana\":[\"copilot/nano-banana*\",\"google/nano-banana*\",\"gemini/nano-banana*\"],\"opus\":[\"copilot/*opus*\",\"anthropic/*opus*\"],\"opusplan\":[\"opus?effort=high\"],\"raptor-mini\":[\"copilot/raptor*\",\"openai/raptor*\"],\"reasoning\":[\"copilot/o1*\",\"copilot/o3*\",\"copilot/o4*\",\"openai/o1*\",\"openai/o3*\",\"openai/o4*\"],\"robotics\":[\"copilot/*robotics*\",\"google/*robotics*\",\"gemini/*robotics*\"],\"small\":[\"mini\"],\"small-agent\":[\"haiku\",\"gpt-5-mini\",\"gemini-flash\"],\"sonnet\":[\"copilot/*sonnet*\",\"anthropic/*sonnet*\"],\"sonnet-6x\":[\"copilot/*sonnet-4.5*\",\"copilot/*sonnet-4.6*\",\"copilot/*sonnet-5*\",\"copilot/*sonnet-4-5-*\",\"anthropic/*sonnet-4-5-*\",\"copilot/*sonnet-4-6*\",\"anthropic/*sonnet-4-6*\",\"anthropic/*sonnet-5*\"],\"summarization\":[\"haiku\",\"gpt-5-mini\",\"gemini-flash-lite\",\"mini\"],\"veo\":[\"google/veo*\",\"gemini/veo*\"],\"vision\":[\"copilot/gemini-*image*\",\"google/gemini-*image*\",\"gemini/gemini-*image*\",\"copilot/gemini-*flash*\",\"google/gemini-*flash*\",\"gemini/gemini-*flash*\"]}},\"container\":{\"imageTag\":\"0.27.44,squid=sha256:83e48bbe12c634be8c228a576832fe45f66c529ac3659db92bddbcf2eeb6d627,agent=sha256:0d727725c737b58c7bdf51f640cffb928385ec46517e0917c7f1a02f1bada8b4,api-proxy=sha256:b50fbadba138f6e9aba94aca09711335c489bb3b15861220cb66f6092e042dc7,cli-proxy=sha256:c064d15974f7c933ec7d3f7b4038f4fd203547b3154bdc821afd379144887eff\"},\"logging\":{\"proxyLogsDir\":\"/tmp/gh-aw/sandbox/firewall/logs\",\"auditDir\":\"/tmp/gh-aw/sandbox/firewall/audit\"}}' > \"${RUNNER_TEMP}/gh-aw/awf-config.json\"\n cp \"${RUNNER_TEMP}/gh-aw/awf-config.json\" /tmp/gh-aw/awf-config.json\n export GH_AW_MODELS_JSON_PATH=\"/tmp/gh-aw/models.json\"\n GH_AW_DOCKER_HOST=\"\"\n if [[ \"${DOCKER_HOST:-}\" =~ ^tcp:// ]]; then\n GH_AW_DOCKER_HOST=\"${DOCKER_HOST}\"\n fi\n if [[ \"${DOCKER_HOST:-}\" =~ ^tcp:// ]]; then\n GH_AW_CHROOT_BINARIES_SOURCE_PATH=\"${RUNNER_TEMP}/gh-aw\" GH_AW_CHROOT_IDENTITY_HOME=\"${RUNNER_TEMP}/gh-aw/home\" node \"${RUNNER_TEMP}/gh-aw/actions/patch_awf_chroot_config.cjs\"\n fi\n GH_AW_TOOL_CACHE_MOUNT=\"\"\n GH_AW_TOOL_CACHE=\"${RUNNER_TOOL_CACHE:?RUNNER_TOOL_CACHE must be set}\"\n if [ -d \"$GH_AW_TOOL_CACHE\" ]; then\n if [[ \"$GH_AW_TOOL_CACHE\" != /opt/* ]]; then\n GH_AW_TOOL_CACHE_MOUNT=\"$GH_AW_TOOL_CACHE:$GH_AW_TOOL_CACHE:ro\"\n fi\n fi\n # shellcheck disable=SC1003,SC2016,SC2086\n awf --config \"${RUNNER_TEMP}/gh-aw/awf-config.json\" --container-workdir \"${GITHUB_WORKSPACE}\" --mount \"${RUNNER_TEMP}/gh-aw:${RUNNER_TEMP}/gh-aw:ro\" --mount \"${RUNNER_TEMP}/gh-aw:/host${RUNNER_TEMP}/gh-aw:ro\" ${GH_AW_TOOL_CACHE_MOUNT:+--mount \"$GH_AW_TOOL_CACHE_MOUNT\"} ${GH_AW_DOCKER_HOST:+--docker-host \"$GH_AW_DOCKER_HOST\"} --env-all --exclude-env ACTIONS_ID_TOKEN_REQUEST_TOKEN --exclude-env ACTIONS_ID_TOKEN_REQUEST_URL --exclude-env CODEX_API_KEY --exclude-env GH_TOKEN --exclude-env GITHUB_MCP_SERVER_TOKEN --exclude-env MCP_GATEWAY_API_KEY --exclude-env OPENAI_API_KEY --mount /tmp/gh-aw:/tmp/gh-aw:rw --log-level info --skip-pull --difc-proxy-host awmg-cli-proxy:18443 --difc-proxy-ca-cert /tmp/gh-aw/difc-proxy-tls/ca.crt \\\n -- /bin/bash -c 'set +o histexpand; export PATH=\"${RUNNER_TEMP}/gh-aw/mcp-cli/bin:$PATH\" && : \"${RUNNER_TOOL_CACHE:?RUNNER_TOOL_CACHE must be set}\"; GH_AW_TOOL_CACHE=\"$RUNNER_TOOL_CACHE\"; export PATH=\"$(find \"$GH_AW_TOOL_CACHE\" -maxdepth 5 -type d -name bin 2>/dev/null | tr '\\''\\n'\\'' '\\'':'\\'')$PATH\"; [ -n \"$GOROOT\" ] && export PATH=\"$GOROOT/bin:$PATH\" || true; [ -n \"$ERLANG_HOME\" ] && export PATH=\"$ERLANG_HOME/bin:$PATH\" || true && GH_AW_NODE_EXEC=\"${GH_AW_NODE_BIN:-}\"; if [ -z \"$GH_AW_NODE_EXEC\" ] || [ ! -x \"$GH_AW_NODE_EXEC\" ]; then GH_AW_NODE_EXEC=\"$(command -v node 2>/dev/null || true)\"; fi; if [ -z \"$GH_AW_NODE_EXEC\" ]; then echo \"node runtime missing on this runner — check runtimes.node in workflow YAML\" >&2; exit 127; fi; GH_AW_NPM_GLOBAL_ROOT=\"$(npm root -g 2>/dev/null || true)\"; if [ -n \"$GH_AW_NPM_GLOBAL_ROOT\" ]; then export NODE_PATH=\"${GH_AW_NPM_GLOBAL_ROOT}${NODE_PATH:+:${NODE_PATH}}\"; fi; \"$GH_AW_NODE_EXEC\" ${RUNNER_TEMP}/gh-aw/actions/codex_harness.cjs codex exec${GH_AW_MODEL_AGENT_CODEX:+ --model \"$GH_AW_MODEL_AGENT_CODEX\"} -c web_search=\"disabled\" -c fetch=\"disabled\" --dangerously-bypass-approvals-and-sandbox --skip-git-repo-check -c model_reasoning_effort=\\\"low\\\" --prompt-file /tmp/gh-aw/aw-prompts/prompt.txt' 2>&1 | tee -a /tmp/gh-aw/agent-stdio.log\n env:\n CODEX_API_KEY: ${{ secrets.CODEX_API_KEY || secrets.OPENAI_API_KEY }}\n CODEX_HOME: /tmp/gh-aw/mcp-config\n GH_AW_MAX_TURNS: 120\n GH_AW_MCP_CONFIG: ${{ runner.temp }}/gh-aw/mcp-config/config.toml\n GH_AW_MODEL_AGENT_CODEX: gpt-5.4\n GH_AW_PHASE: agent\n GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt\n GH_AW_SAFE_OUTPUTS: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS }}\n GH_AW_VERSION: v0.86.2\n GH_TOKEN: ${{ secrets.GH_AW_GITHUB_TOKEN || github.token }}\n GITHUB_AW: true\n GITHUB_STEP_SUMMARY: /tmp/gh-aw/agent-step-summary.md\n GIT_AUTHOR_EMAIL: github-actions[bot]@users.noreply.github.com\n GIT_AUTHOR_NAME: github-actions[bot]\n GIT_COMMITTER_EMAIL: github-actions[bot]@users.noreply.github.com\n GIT_COMMITTER_NAME: github-actions[bot]\n OPENAI_API_KEY: ${{ secrets.CODEX_API_KEY || secrets.OPENAI_API_KEY }}\n RUNNER_TEMP: ${{ runner.temp }}\n RUST_LOG: ${{ runner.debug == 1 && 'trace,hyper_util=info,mio=info,reqwest=info,os_info=info,codex_otel=warn,codex_core=debug,ocodex_exec=debug' || 'warn' }}\n TRACEPARENT: ${{ env.GITHUB_AW_OTEL_TRACE_ID != '' && env.GITHUB_AW_OTEL_PARENT_SPAN_ID != '' && format('00-{0}-{1}-01', env.GITHUB_AW_OTEL_TRACE_ID, env.GITHUB_AW_OTEL_PARENT_SPAN_ID) || '' }}\n - name: Stop CLI Proxy\n if: always()\n continue-on-error: true\n run: bash \"${RUNNER_TEMP}/gh-aw/actions/stop_cli_proxy.sh\"\n - name: Detect agent errors\n if: always()\n id: detect-agent-errors\n continue-on-error: true\n run: node \"${RUNNER_TEMP}/gh-aw/actions/detect_agent_errors.cjs\"\n - name: Configure Git credentials\n env:\n GITHUB_REPOSITORY: ${{ github.repository }}\n GITHUB_SERVER_URL: ${{ github.server_url }}\n GITHUB_TOKEN: ${{ github.token }}\n run: bash \"${RUNNER_TEMP}/gh-aw/actions/configure_git_credentials.sh\"\n - name: Stop MCP Gateway\n if: always()\n continue-on-error: true\n env:\n MCP_GATEWAY_PORT: ${{ steps.start-mcp-gateway.outputs.gateway-port }}\n MCP_GATEWAY_API_KEY: ${{ steps.start-mcp-gateway.outputs.gateway-api-key }}\n GATEWAY_PID: ${{ steps.start-mcp-gateway.outputs.gateway-pid }}\n run: |\n bash \"${RUNNER_TEMP}/gh-aw/actions/stop_mcp_gateway.sh\" \"$GATEWAY_PID\"\n - name: Redact secrets in logs\n if: always()\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n with:\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/redact_secrets.cjs');\n await main();\n env:\n GH_AW_SECRET_NAMES: 'CODEX_API_KEY,GH_AW_GITHUB_MCP_SERVER_TOKEN,GH_AW_GITHUB_TOKEN,GITHUB_TOKEN,OPENAI_API_KEY,PR_MAINTENANCE_STATE_KEY'\n SECRET_CODEX_API_KEY: ${{ secrets.CODEX_API_KEY }}\n SECRET_GH_AW_GITHUB_MCP_SERVER_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN }}\n SECRET_GH_AW_GITHUB_TOKEN: ${{ secrets.GH_AW_GITHUB_TOKEN }}\n SECRET_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}\n SECRET_OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}\n SECRET_PR_MAINTENANCE_STATE_KEY: ${{ secrets.PR_MAINTENANCE_STATE_KEY }}\n - name: Append agent step summary\n if: always()\n run: bash \"${RUNNER_TEMP}/gh-aw/actions/append_agent_step_summary.sh\"\n - name: Copy Safe Outputs\n if: always()\n env:\n GH_AW_SAFE_OUTPUTS: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS }}\n run: |\n mkdir -p /tmp/gh-aw\n cp \"$GH_AW_SAFE_OUTPUTS\" /tmp/gh-aw/safeoutputs.jsonl 2>/dev/null || true\n - name: Ingest agent output\n id: collect_output\n if: always()\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n env:\n GH_AW_SAFE_OUTPUTS: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS }}\n GH_AW_ALLOWED_DOMAINS: \"172.30.0.1,api.github.com,api.npms.io,api.openai.com,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,bun.sh,cdn.jsdelivr.net,chatgpt.com,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,deb.nodesource.com,deno.land,esm.sh,get.pnpm.io,github.com,googleapis.deno.dev,googlechromelabs.github.io,host.docker.internal,json-schema.org,json.schemastore.org,jsr.io,keyserver.ubuntu.com,nodejs.org,npm.pkg.github.com,npmjs.com,npmjs.org,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,openai.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,ppa.launchpad.net,registry.bower.io,registry.npmjs.com,registry.npmjs.org,registry.yarnpkg.com,release-assets.githubusercontent.com,repo.yarnpkg.com,s.symcb.com,s.symcd.com,security.ubuntu.com,skimdb.npmjs.com,storage.googleapis.com,telemetry.vercel.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com,www.googleapis.com,www.npmjs.com,www.npmjs.org,yarnpkg.com\"\n GITHUB_SERVER_URL: ${{ github.server_url }}\n GITHUB_API_URL: ${{ github.api_url }}\n with:\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/collect_ndjson_output.cjs');\n await main();\n - name: Parse agent logs for step summary\n if: always()\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n env:\n GH_AW_AGENT_OUTPUT: /tmp/gh-aw/agent-stdio.log\n GH_AW_SAFE_OUTPUTS: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS }}\n with:\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/parse_codex_log.cjs');\n await main();\n - name: Parse MCP Gateway logs for step summary\n if: always()\n id: parse-mcp-gateway\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n with:\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/parse_mcp_gateway_log.cjs');\n await main();\n - name: Print firewall logs\n if: always()\n continue-on-error: true\n env:\n AWF_LOGS_DIR: /tmp/gh-aw/sandbox/firewall/logs\n run: bash \"${RUNNER_TEMP}/gh-aw/actions/print_firewall_logs.sh\" --rootless\n - name: Parse token usage for step summary\n if: always()\n continue-on-error: true\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n with:\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/parse_token_usage.cjs');\n await main();\n - name: Print AWF reflect summary\n if: always()\n continue-on-error: true\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n with:\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/awf_reflect_summary.cjs');\n await main();\n - name: Write agent output placeholder if missing\n if: always()\n run: |\n if [ ! -f /tmp/gh-aw/agent_output.json ]; then\n echo '{\"items\":[]}' > /tmp/gh-aw/agent_output.json\n fi\n - name: Upload the proposed Git graph\n uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1\n with:\n if-no-files-found: ignore\n name: pr-maintenance-proposal\n path: |\n /tmp/gh-aw/proposal/proposal.json\n /tmp/gh-aw/proposal/proposal.bundle\n retention-days: 7\n\n - name: Upload agent artifacts\n if: always()\n continue-on-error: true\n uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1\n with:\n name: agent\n path: |\n /tmp/gh-aw/aw-prompts/prompt.txt\n /tmp/gh-aw/mcp-config/logs/\n /tmp/gh-aw/redacted-urls.log\n /tmp/gh-aw/mcp-logs/\n /tmp/gh-aw/agent_usage.json\n /tmp/gh-aw/agent-stdio.log\n /tmp/gh-aw/pre-agent-audit.txt\n /tmp/gh-aw/agent/\n /tmp/gh-aw/github_rate_limits.jsonl\n /tmp/gh-aw/safeoutputs.jsonl\n /tmp/gh-aw/agent_output.json\n /tmp/gh-aw/aw-*.patch\n /tmp/gh-aw/aw-*.bundle\n /tmp/gh-aw/awf-config.json\n /tmp/gh-aw/sandbox/firewall/logs/\n /tmp/gh-aw/sandbox/firewall/audit/\n /tmp/gh-aw/sandbox/firewall/awf-reflect.json\n if-no-files-found: ignore\n\n conclusion:\n needs:\n - activation\n - agent\n - detection\n - finish_attempt\n - safe_outputs\n if: >\n always() && (needs.agent.result != 'skipped' || needs.activation.outputs.lockdown_check_failed == 'true' ||\n needs.activation.outputs.oauth_token_check_failed == 'true' || needs.activation.outputs.stale_lock_file_failed == 'true' ||\n needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')\n runs-on: ubuntu-slim\n permissions:\n actions: read\n issues: write\n concurrency:\n group: \"gh-aw-conclusion-pr-readiness-worker\"\n cancel-in-progress: false\n queue: max\n env:\n GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }}\n outputs:\n incomplete_count: ${{ steps.report_incomplete.outputs.incomplete_count }}\n noop_message: ${{ steps.noop.outputs.noop_message }}\n tools_reported: ${{ steps.missing_tool.outputs.tools_reported }}\n total_count: ${{ steps.missing_tool.outputs.total_count }}\n steps:\n - name: Setup Scripts\n id: setup\n uses: github/gh-aw-actions/setup@6aab9e5b5c91c615506061f09bedd81a23babe3c # v0.86.2\n with:\n destination: ${{ runner.temp }}/gh-aw/actions\n job-name: ${{ github.job }}\n trace-id: ${{ needs.activation.outputs.setup-trace-id }}\n parent-span-id: ${{ needs.activation.outputs.setup-parent-span-id || needs.activation.outputs.setup-span-id }}\n env:\n GH_AW_SETUP_WORKFLOW_NAME: \"PR readiness worker\"\n GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/pr-readiness-worker.lock.yml@${{ github.ref }}\n GH_AW_INFO_VERSION: \"0.147.0\"\n GH_AW_INFO_AWF_VERSION: \"v0.27.44\"\n GH_AW_INFO_ENGINE_ID: \"codex\"\n - name: Download agent output artifact\n id: download-agent-output\n continue-on-error: true\n uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1\n with:\n name: agent\n path: /tmp/gh-aw/\n - name: Setup agent output environment variable\n id: setup-agent-output-env\n if: steps.download-agent-output.outcome == 'success'\n run: |\n mkdir -p /tmp/gh-aw/\n find \"/tmp/gh-aw/\" -type f -print\n echo \"GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json\" >> \"$GITHUB_OUTPUT\"\n - name: Download Safe Outputs Items Manifest\n id: download-safe-outputs-manifest\n if: always()\n continue-on-error: true\n uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1\n with:\n name: safe-outputs-items\n path: /tmp/gh-aw/\n - name: Collect usage artifact files\n if: always()\n continue-on-error: true\n run: bash \"${RUNNER_TEMP}/gh-aw/actions/collect_usage_artifact_files.sh\"\n - name: Upload usage artifact\n if: always()\n continue-on-error: true\n uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1\n with:\n name: usage\n path: |\n /tmp/gh-aw/usage/aw_info.json\n /tmp/gh-aw/usage/aw-info.jsonl\n /tmp/gh-aw/usage/agent_usage.json\n /tmp/gh-aw/usage/agent_usage.jsonl\n /tmp/gh-aw/usage/detection_usage.jsonl\n /tmp/gh-aw/usage/evals.jsonl\n /tmp/gh-aw/usage/github_rate_limits.jsonl\n /tmp/gh-aw/usage/agent/token_usage.jsonl\n /tmp/gh-aw/usage/detection/token_usage.jsonl\n /tmp/gh-aw/usage/activity/summary.json\n if-no-files-found: ignore\n - name: Restore daily AIC usage cache\n id: restore-daily-aic-cache-conclusion\n if: always()\n continue-on-error: true\n uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0\n with:\n key: agentic-workflow-usage-prreadinessworker-${{ github.run_id }}\n restore-keys: agentic-workflow-usage-prreadinessworker-\n path: /tmp/gh-aw/agentic-workflow-usage-cache.jsonl\n - name: Write daily AIC usage cache entry\n id: write-daily-aic-cache\n if: always()\n continue-on-error: true\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n with:\n github-token: ${{ github.token }}\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/write_daily_aic_usage_cache.cjs');\n await main();\n - name: Save daily AIC usage cache\n id: save-daily-aic-cache\n if: always()\n continue-on-error: true\n uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0\n with:\n key: agentic-workflow-usage-prreadinessworker-${{ github.run_id }}\n path: /tmp/gh-aw/agentic-workflow-usage-cache.jsonl\n - name: Upload daily AIC usage cache artifact\n id: upload-daily-aic-cache\n if: always()\n continue-on-error: true\n uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1\n with:\n name: aic-usage-cache\n path: /tmp/gh-aw/agentic-workflow-usage-cache.jsonl\n if-no-files-found: ignore\n retention-days: 7\n - name: Process no-op messages\n id: noop\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n env:\n GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }}\n GH_AW_NOOP_MAX: \"1\"\n GH_AW_WORKFLOW_NAME: \"PR readiness worker\"\n GH_AW_WORKFLOW_SOURCE_URL: \"${{ github.server_url }}/${{ github.repository }}/blob/${{ github.ref_name }}/.github/workflows/pr-readiness-worker.md\"\n GH_AW_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}\n GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }}\n GH_AW_NOOP_REPORT_AS_ISSUE: \"false\"\n GH_AW_AIC: ${{ needs.agent.outputs.aic }}\n GH_AW_THREAT_DETECTION_AIC: ${{ needs.detection.outputs.aic }}\n GH_AW_AMBIENT_CONTEXT: ${{ needs.agent.outputs.ambient_context }}\n GH_AW_WORKFLOW_ID: \"pr-readiness-worker\"\n with:\n github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/handle_noop_message.cjs');\n await main();\n - name: Log detection run\n id: detection_runs\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n env:\n GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }}\n GH_AW_WORKFLOW_NAME: \"PR readiness worker\"\n GH_AW_WORKFLOW_SOURCE_URL: \"${{ github.server_url }}/${{ github.repository }}/blob/${{ github.ref_name }}/.github/workflows/pr-readiness-worker.md\"\n GH_AW_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}\n GH_AW_DETECTION_CONCLUSION: ${{ needs.detection.outputs.detection_conclusion }}\n GH_AW_DETECTION_REASON: ${{ needs.detection.outputs.detection_reason }}\n with:\n github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/handle_detection_runs.cjs');\n await main();\n - name: Record missing tool\n id: missing_tool\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n env:\n GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }}\n GH_AW_MISSING_TOOL_CREATE_ISSUE: \"true\"\n GH_AW_WORKFLOW_NAME: \"PR readiness worker\"\n GH_AW_WORKFLOW_SOURCE_URL: \"${{ github.server_url }}/${{ github.repository }}/blob/${{ github.ref_name }}/.github/workflows/pr-readiness-worker.md\"\n with:\n github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/missing_tool.cjs');\n await main();\n - name: Record incomplete\n id: report_incomplete\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n env:\n GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }}\n GH_AW_REPORT_INCOMPLETE_CREATE_ISSUE: \"true\"\n GH_AW_WORKFLOW_NAME: \"PR readiness worker\"\n GH_AW_WORKFLOW_SOURCE_URL: \"${{ github.server_url }}/${{ github.repository }}/blob/${{ github.ref_name }}/.github/workflows/pr-readiness-worker.md\"\n with:\n github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/report_incomplete_handler.cjs');\n await main();\n - name: Handle agent failure\n id: handle_agent_failure\n if: always()\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n env:\n GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }}\n GH_AW_WORKFLOW_NAME: \"PR readiness worker\"\n GH_AW_WORKFLOW_SOURCE_URL: \"${{ github.server_url }}/${{ github.repository }}/blob/${{ github.ref_name }}/.github/workflows/pr-readiness-worker.md\"\n GH_AW_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}\n GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }}\n GH_AW_WORKFLOW_ID: \"pr-readiness-worker\"\n GH_AW_ACTION_FAILURE_ISSUE_EXPIRES_HOURS: \"168\"\n GH_AW_ENGINE_ID: \"codex\"\n GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}\n GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}\n GH_AW_EFFECTIVE_TOKENS: ${{ needs.agent.outputs.effective_tokens || '' }}\n GH_AW_AI_CREDITS_RATE_LIMIT_ERROR: ${{ needs.agent.outputs.ai_credits_rate_limit_error || 'false' }}\n GH_AW_UNKNOWN_MODEL_AI_CREDITS: ${{ needs.agent.outputs.unknown_model_ai_credits || 'false' }}\n GH_AW_AIC: ${{ needs.agent.outputs.aic }}\n GH_AW_THREAT_DETECTION_AIC: ${{ needs.detection.outputs.aic }}\n GH_AW_MAX_AI_CREDITS: \"500\"\n GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}\n GH_AW_MCP_POLICY_ERROR: ${{ needs.agent.outputs.mcp_policy_error }}\n GH_AW_AGENTIC_ENGINE_TIMEOUT: ${{ needs.agent.outputs.agentic_engine_timeout }}\n GH_AW_MODEL_NOT_SUPPORTED_ERROR: ${{ needs.agent.outputs.model_not_supported_error }}\n GH_AW_HTTP_400_RESPONSE_ERROR: ${{ needs.agent.outputs.http_400_response_error }}\n GH_AW_MAX_CACHE_MISSES_EXCEEDED: ${{ needs.agent.outputs.max_cache_misses_exceeded }}\n GH_AW_MISSING_MODEL_PRICING_ERROR: ${{ needs.agent.outputs.missing_model_pricing_error }}\n GH_AW_MISSING_MODEL_PRICING_MODEL_NAME: ${{ needs.agent.outputs.missing_model_pricing_model_name }}\n GH_AW_ENGINE_API_HOSTS: \"api.openai.com\"\n GH_AW_LOCKDOWN_CHECK_FAILED: ${{ needs.activation.outputs.lockdown_check_failed }}\n GH_AW_OAUTH_TOKEN_CHECK_FAILED: ${{ needs.activation.outputs.oauth_token_check_failed }}\n GH_AW_STALE_LOCK_FILE_FAILED: ${{ needs.activation.outputs.stale_lock_file_failed }}\n GH_AW_DAILY_AI_CREDITS_EXCEEDED: ${{ needs.activation.outputs.daily_ai_credits_exceeded }}\n GH_AW_DAILY_AI_CREDITS_TOTAL_EFFECTIVE_TOKENS: ${{ needs.activation.outputs.daily_ai_credits_total_effective_tokens }}\n GH_AW_DAILY_AI_CREDITS_THRESHOLD: ${{ needs.activation.outputs.daily_ai_credits_threshold }}\n GH_AW_GROUP_REPORTS: \"false\"\n GH_AW_FAILURE_REPORT_AS_ISSUE: \"false\"\n GH_AW_MISSING_TOOL_REPORT_AS_FAILURE: \"true\"\n GH_AW_MISSING_DATA_REPORT_AS_FAILURE: \"true\"\n GH_AW_TIMEOUT_MINUTES: \"35\"\n with:\n github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/handle_agent_failure.cjs');\n await main();\n - name: Report failed jobs\n id: report_failed_jobs\n if: always()\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n env:\n GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }}\n GH_AW_WORKFLOW_NAME: \"PR readiness worker\"\n GH_AW_WORKFLOW_SOURCE_URL: \"${{ github.server_url }}/${{ github.repository }}/blob/${{ github.ref_name }}/.github/workflows/pr-readiness-worker.md\"\n GH_AW_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}\n GH_AW_REPORT_FAILED_JOBS: \"true\"\n with:\n github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/report_failed_jobs.cjs');\n await main();\n\n detection:\n needs:\n - activation\n - agent\n if: always() && needs.agent.result != 'skipped'\n runs-on: ubuntu-latest\n permissions:\n contents: read\n env:\n GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }}\n outputs:\n aic: ${{ steps.parse_detection_token_usage.outputs.aic }}\n detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}\n detection_reason: ${{ steps.detection_conclusion.outputs.reason }}\n detection_success: ${{ steps.detection_conclusion.outputs.success }}\n steps:\n - name: Setup Scripts\n id: setup\n uses: github/gh-aw-actions/setup@6aab9e5b5c91c615506061f09bedd81a23babe3c # v0.86.2\n with:\n destination: ${{ runner.temp }}/gh-aw/actions\n job-name: ${{ github.job }}\n trace-id: ${{ needs.activation.outputs.setup-trace-id }}\n parent-span-id: ${{ needs.activation.outputs.setup-parent-span-id || needs.activation.outputs.setup-span-id }}\n env:\n GH_AW_SETUP_WORKFLOW_NAME: \"PR readiness worker\"\n GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/pr-readiness-worker.lock.yml@${{ github.ref }}\n GH_AW_INFO_VERSION: \"0.147.0\"\n GH_AW_INFO_AWF_VERSION: \"v0.27.44\"\n GH_AW_INFO_ENGINE_ID: \"codex\"\n - name: Download agent output artifact\n id: download-agent-output\n continue-on-error: true\n uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1\n with:\n name: agent\n path: /tmp/gh-aw/\n - name: Setup agent output environment variable\n id: setup-agent-output-env\n if: steps.download-agent-output.outcome == 'success'\n run: |\n mkdir -p /tmp/gh-aw/\n find \"/tmp/gh-aw/\" -type f -print\n echo \"GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json\" >> \"$GITHUB_OUTPUT\"\n - name: Checkout repository for patch context\n if: needs.agent.outputs.has_patch == 'true'\n uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1\n with:\n persist-credentials: false\n # --- Threat Detection ---\n - name: Clean stale firewall files from agent artifact\n run: |\n rm -rf /tmp/gh-aw/sandbox/firewall/logs\n rm -rf /tmp/gh-aw/sandbox/firewall/audit\n - name: Check if detection needed\n id: detection_guard\n if: always()\n env:\n OUTPUT_TYPES: ${{ needs.agent.outputs.output_types }}\n HAS_PATCH: ${{ needs.agent.outputs.has_patch }}\n run: |\n if [[ -n \"$OUTPUT_TYPES\" || \"$HAS_PATCH\" == \"true\" ]]; then\n echo \"run_detection=true\" >> \"$GITHUB_OUTPUT\"\n echo \"Detection will run: output_types=$OUTPUT_TYPES, has_patch=$HAS_PATCH\"\n else\n echo \"run_detection=false\" >> \"$GITHUB_OUTPUT\"\n echo \"Detection skipped: no agent outputs or patches to analyze\"\n fi\n - name: Clear MCP Config for detection\n if: always() && steps.detection_guard.outputs.run_detection == 'true'\n run: |\n rm -f \"${RUNNER_TEMP}/gh-aw/mcp-config/mcp-servers.json\"\n rm -f \"$HOME/.copilot/mcp-config.json\"\n rm -f \"$GITHUB_WORKSPACE/.gemini/settings.json\"\n - name: Prepare threat detection files\n if: always() && steps.detection_guard.outputs.run_detection == 'true'\n run: |\n bash \"${RUNNER_TEMP}/gh-aw/actions/prepare_threat_detection_files.sh\"\n - name: Setup threat detection\n if: always() && steps.detection_guard.outputs.run_detection == 'true'\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n env:\n WORKFLOW_NAME: \"PR readiness worker\"\n WORKFLOW_DESCRIPTION: \"Resolve one authenticated PR maintenance attempt and propose a guarded update.\"\n HAS_PATCH: ${{ needs.agent.outputs.has_patch }}\n GH_AW_DETECTION_CONTINUE_ON_ERROR: \"false\"\n with:\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/setup_threat_detection.cjs');\n await main();\n - name: Ensure threat-detection directory and log\n if: always() && steps.detection_guard.outputs.run_detection == 'true'\n run: |\n mkdir -p /tmp/gh-aw/threat-detection\n touch /tmp/gh-aw/threat-detection/detection.log\n rm -f /tmp/gh-aw/step-summary.md\n touch /tmp/gh-aw/step-summary.md\n - name: Setup Node.js\n uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0\n with:\n node-version: '24'\n package-manager-cache: false\n - name: Install Codex CLI\n run: npm install --ignore-scripts -g @openai/codex@0.147.0\n - name: Install AWF binary\n run: bash \"${RUNNER_TEMP}/gh-aw/actions/install_awf_binary.sh\" v0.27.44\n - name: Download container images\n run: bash \"${RUNNER_TEMP}/gh-aw/actions/download_docker_images.sh\" ghcr.io/github/gh-aw-firewall/agent:0.27.44@sha256:0d727725c737b58c7bdf51f640cffb928385ec46517e0917c7f1a02f1bada8b4 ghcr.io/github/gh-aw-firewall/api-proxy:0.27.44@sha256:b50fbadba138f6e9aba94aca09711335c489bb3b15861220cb66f6092e042dc7 ghcr.io/github/gh-aw-firewall/squid:0.27.44@sha256:83e48bbe12c634be8c228a576832fe45f66c529ac3659db92bddbcf2eeb6d627 ghcr.io/github/gh-aw-mcpg:v0.4.9@sha256:e5a1569aeaf41820fa7bdee3e94468cae448133cdbf00119ad24f5b74db1ab9f\n - name: Start MCP Gateway\n id: start-mcp-gateway\n env:\n CODEX_HOME: /tmp/gh-aw/mcp-config\n run: |\n set -eo pipefail\n mkdir -p \"${RUNNER_TEMP}/gh-aw/mcp-config\"\n\n # Export gateway environment variables for MCP config and gateway script\n export MCP_GATEWAY_PORT=\"8080\"\n export MCP_GATEWAY_DOMAIN=\"host.docker.internal\"\n export MCP_GATEWAY_HOST_DOMAIN=\"localhost\"\n MCP_GATEWAY_API_KEY=$(openssl rand -base64 45 | tr -d '/+=')\n echo \"::add-mask::${MCP_GATEWAY_API_KEY}\"\n export MCP_GATEWAY_API_KEY\n export MCP_GATEWAY_PAYLOAD_DIR=\"/tmp/gh-aw/mcp-payloads\"\n mkdir -p \"${MCP_GATEWAY_PAYLOAD_DIR}\"\n export MCP_GATEWAY_PAYLOAD_SIZE_THRESHOLD=\"524288\"\n export MCP_GATEWAY_ALLOWED_MOUNT_ROOTS=\"${GITHUB_WORKSPACE}:rw,${RUNNER_TEMP}/gh-aw:ro,${RUNNER_TEMP}/gh-aw/safeoutputs:rw,/opt:ro,/tmp:rw,/usr/bin/gh:ro\"\n export DEBUG=\"*\"\n\n export GH_AW_ENGINE=\"codex\"\n MCP_GATEWAY_UID=$(id -u 2>/dev/null || echo '0')\n MCP_GATEWAY_GID=$(id -g 2>/dev/null || echo '0')\n source \"${RUNNER_TEMP}/gh-aw/actions/resolve_docker_socket_gid.sh\"\n export MCP_GATEWAY_DOCKER_COMMAND='docker run -i --rm --network host --name awmg-mcpg --add-host host.docker.internal:127.0.0.1 --user '\"${MCP_GATEWAY_UID}\"':'\"${MCP_GATEWAY_GID}\"' --group-add '\"${DOCKER_SOCK_GID}\"' -v '\"${DOCKER_SOCK_PATH}\"':/var/run/docker.sock -e MCP_GATEWAY_PORT -e MCP_GATEWAY_DOMAIN -e MCP_GATEWAY_API_KEY -e MCP_GATEWAY_PAYLOAD_DIR -e MCP_GATEWAY_PAYLOAD_SIZE_THRESHOLD -e DOCKER_HOST=unix:///var/run/docker.sock -e DEBUG -e MCP_GATEWAY_LOG_DIR -e GH_AW_MCP_LOG_DIR -e GH_AW_SAFE_OUTPUTS -e GH_AW_SAFE_OUTPUTS_CONFIG_PATH -e GH_AW_SAFE_OUTPUTS_TOOLS_PATH -e GH_AW_POLICY_ALLOW_CREATE_PULL_REQUEST -e GH_AW_ASSETS_BRANCH -e GH_AW_ASSETS_MAX_SIZE_KB -e GH_AW_ASSETS_ALLOWED_EXTS -e DEFAULT_BRANCH -e GITHUB_MCP_SERVER_TOKEN -e GITHUB_MCP_GUARD_MIN_INTEGRITY -e GITHUB_MCP_GUARD_REPOS -e GH_AW_SINK_VISIBILITY -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e GITHUB_SHA -e GITHUB_WORKSPACE -e GITHUB_TOKEN -e GITHUB_RUN_ID -e GITHUB_RUN_NUMBER -e GITHUB_RUN_ATTEMPT -e GITHUB_JOB -e GITHUB_ACTION -e GITHUB_EVENT_NAME -e GITHUB_EVENT_PATH -e GITHUB_ACTOR -e GITHUB_ACTOR_ID -e GITHUB_TRIGGERING_ACTOR -e GITHUB_WORKFLOW -e GITHUB_WORKFLOW_REF -e GITHUB_WORKFLOW_SHA -e GITHUB_REF -e GITHUB_REF_NAME -e GITHUB_REF_TYPE -e GITHUB_HEAD_REF -e GITHUB_BASE_REF -e RUNNER_TEMP -e MCP_GATEWAY_ALLOWED_MOUNT_ROOTS -e CODEX_HOME -v /tmp/gh-aw/mcp-payloads:/tmp/gh-aw/mcp-payloads:rw -v /opt:/opt:ro -v /tmp:/tmp:rw -v '\"${GITHUB_WORKSPACE}\"':'\"${GITHUB_WORKSPACE}\"':rw -v '\"${RUNNER_TEMP}\"'/gh-aw/safeoutputs:'\"${RUNNER_TEMP}\"'/gh-aw/safeoutputs:rw ghcr.io/github/gh-aw-mcpg:v0.4.9'\n\n cat > \"${RUNNER_TEMP}/gh-aw/mcp-config/config.toml\" << GH_AW_MCP_CONFIG_2f5d9885311152cf_EOF\n [history]\n persistence = \"none\"\n\n [shell_environment_policy]\n inherit = \"core\"\n include_only = [\"^CODEX_API_KEY$\", \"^HOME$\", \"^OPENAI_API_KEY$\", \"^PATH$\"]\n GH_AW_MCP_CONFIG_2f5d9885311152cf_EOF\n\n # Generate JSON config for MCP gateway\n GH_AW_NODE=$(which node 2>/dev/null || command -v node 2>/dev/null || echo node)\n cat << GH_AW_MCP_CONFIG_124f4e7dd5e01bb9_EOF | \"$GH_AW_NODE\" \"${RUNNER_TEMP}/gh-aw/actions/start_mcp_gateway.cjs\"\n {\n \"mcpServers\": {\n },\n \"gateway\": {\n \"port\": $MCP_GATEWAY_PORT,\n \"domain\": \"${MCP_GATEWAY_DOMAIN}\",\n \"apiKey\": \"${MCP_GATEWAY_API_KEY}\",\n \"payloadDir\": \"${MCP_GATEWAY_PAYLOAD_DIR}\",\n \"startupTimeout\": 120\n }\n }\n GH_AW_MCP_CONFIG_124f4e7dd5e01bb9_EOF\n\n # Sync converter output to writable CODEX_HOME for Codex\n mkdir -p /tmp/gh-aw/mcp-config\n cat > \"/tmp/gh-aw/mcp-config/config.toml\" << GH_AW_CODEX_SHELL_POLICY_f48e0018706875a8_EOF\n model_provider = \"openai-proxy\"\n [model_providers.openai-proxy]\n name = \"OpenAI AWF proxy\"\n base_url = \"http://172.30.0.30:10000\"\n env_key = \"OPENAI_API_KEY\"\n supports_websockets = false\n [shell_environment_policy]\n inherit = \"core\"\n include_only = [\"^CODEX_API_KEY$\", \"^HOME$\", \"^OPENAI_API_KEY$\", \"^PATH$\"]\n GH_AW_CODEX_SHELL_POLICY_f48e0018706875a8_EOF\n awk '\n BEGIN { skip_openai_proxy = 0 }\n /^[[:space:]]*model_provider[[:space:]]*=/ { next }\n /^\\[model_providers\\.openai-proxy\\][[:space:]]*$/ { skip_openai_proxy = 1; next }\n /^\\[/ { skip_openai_proxy = 0 }\n !skip_openai_proxy { print }\n ' \"${RUNNER_TEMP}/gh-aw/mcp-config/config.toml\" >> \"/tmp/gh-aw/mcp-config/config.toml\"\n chmod 600 \"/tmp/gh-aw/mcp-config/config.toml\"\n mkdir -p \"${CODEX_HOME}\"\n if [ \"/tmp/gh-aw/mcp-config/config.toml\" != \"${CODEX_HOME}/config.toml\" ]; then cp \"/tmp/gh-aw/mcp-config/config.toml\" \"${CODEX_HOME}/config.toml\"; fi\n chmod 600 \"${CODEX_HOME}/config.toml\"\n - name: Execute Codex CLI\n if: always() && steps.detection_guard.outputs.run_detection == 'true'\n continue-on-error: true\n id: detection_agentic_execution\n timeout-minutes: 20\n run: |\n set -o pipefail\n printf '%s' \"$(date +%s%3N)\" > /tmp/gh-aw/agent_cli_start_ms.txt\n mkdir -p \"$CODEX_HOME/logs\" && touch /tmp/gh-aw/agent-step-summary.md && mkdir -p /tmp/gh-aw/threat-detection && printf '%s' '{\"type\":\"object\",\"properties\":{\"prompt_injection\":{\"type\":\"boolean\"},\"secret_leak\":{\"type\":\"boolean\"},\"malicious_patch\":{\"type\":\"boolean\"},\"reasons\":{\"type\":\"array\",\"items\":{\"type\":\"string\"}}},\"required\":[\"prompt_injection\",\"secret_leak\",\"malicious_patch\",\"reasons\"],\"additionalProperties\":false}' > /tmp/gh-aw/threat-detection/detection_schema.json\n (umask 177 && touch /tmp/gh-aw/threat-detection/detection.log)\n GH_AW_MAX_AI_CREDITS=\"${{ vars.GH_AW_DEFAULT_DETECTION_MAX_AI_CREDITS || '400' }}\"\n printf '%s\\n' \"{\\\"\\$schema\\\":\\\"https://github.com/github/gh-aw-firewall/releases/download/v0.27.44/awf-config.schema.json\\\",\\\"network\\\":{\\\"allowDomains\\\":[\\\"172.30.0.1\\\",\\\"api.github.com\\\",\\\"api.openai.com\\\",\\\"chatgpt.com\\\",\\\"github.com\\\",\\\"host.docker.internal\\\",\\\"openai.com\\\"]},\\\"apiProxy\\\":{\\\"enabled\\\":true,\\\"enableTokenSteering\\\":true,\\\"maxRuns\\\":500,\\\"maxAiCredits\\\":${GH_AW_MAX_AI_CREDITS},\\\"maxCacheMisses\\\":5,\\\"models\\\":{\\\"agent\\\":[\\\"sonnet-6x\\\",\\\"gpt-5.4\\\",\\\"gpt-5.5\\\",\\\"gpt-5.6\\\",\\\"gpt-5.3\\\",\\\"gemini-pro\\\",\\\"any\\\"],\\\"antigravity\\\":[\\\"copilot/antigravity*\\\",\\\"google/antigravity*\\\",\\\"gemini/antigravity*\\\"],\\\"any\\\":[\\\"copilot/*\\\",\\\"anthropic/*\\\",\\\"openai/*\\\",\\\"google/*\\\",\\\"gemini/*\\\"],\\\"auto\\\":[\\\"copilot/auto\\\",\\\"large\\\"],\\\"claude\\\":[\\\"agent\\\"],\\\"codex\\\":[\\\"agent\\\"],\\\"coding\\\":[\\\"copilot/gpt-5*codex*\\\",\\\"openai/gpt-5*codex*\\\",\\\"gpt-5-codex\\\",\\\"kimi\\\"],\\\"computer-use\\\":[\\\"copilot/*computer-use*\\\",\\\"google/*computer-use*\\\",\\\"gemini/*computer-use*\\\",\\\"openai/*computer-use*\\\"],\\\"copilot\\\":[\\\"agent\\\"],\\\"deep-research\\\":[\\\"copilot/deep-research*\\\",\\\"copilot/o3-deep-research*\\\",\\\"copilot/o4-mini-deep-research*\\\",\\\"google/deep-research*\\\",\\\"gemini/deep-research*\\\",\\\"openai/o3-deep-research*\\\",\\\"openai/o4-mini-deep-research*\\\"],\\\"detection\\\":[\\\"small\\\"],\\\"evals\\\":[\\\"small\\\"],\\\"fable\\\":[\\\"copilot/*fable*\\\",\\\"anthropic/*fable*\\\"],\\\"gemini\\\":[\\\"agent\\\"],\\\"gemini-3-flash\\\":[\\\"copilot/gemini-3*flash*\\\",\\\"google/gemini-3*flash*\\\",\\\"gemini/gemini-3*flash*\\\"],\\\"gemini-3-pro\\\":[\\\"copilot/gemini-3*pro*\\\",\\\"google/gemini-3*pro*\\\",\\\"google/nano-banana*\\\",\\\"gemini/gemini-3*pro*\\\"],\\\"gemini-3.1-flash\\\":[\\\"copilot/gemini-3.1*flash*\\\",\\\"google/gemini-3.1*flash*\\\",\\\"gemini/gemini-3.1*flash*\\\"],\\\"gemini-3.1-pro\\\":[\\\"copilot/gemini-3.1*pro*\\\",\\\"google/gemini-3.1*pro*\\\",\\\"gemini/gemini-3.1*pro*\\\"],\\\"gemini-3.5-flash\\\":[\\\"copilot/gemini-3.5*flash*\\\",\\\"google/gemini-3.5*flash*\\\",\\\"gemini/gemini-3.5*flash*\\\"],\\\"gemini-3.6-flash\\\":[\\\"copilot/gemini-3.6*flash*\\\",\\\"google/gemini-3.6*flash*\\\",\\\"gemini/gemini-3.6*flash*\\\"],\\\"gemini-flash\\\":[\\\"copilot/gemini-*flash*\\\",\\\"google/gemini-*flash*\\\",\\\"gemini/gemini-*flash*\\\"],\\\"gemini-flash-lite\\\":[\\\"copilot/gemini-*flash*lite*\\\",\\\"google/gemini-*flash*lite*\\\",\\\"gemini/gemini-*flash*lite*\\\"],\\\"gemini-omni\\\":[\\\"copilot/gemini-omni*\\\",\\\"google/gemini-omni*\\\",\\\"gemini/gemini-omni*\\\"],\\\"gemini-pro\\\":[\\\"copilot/gemini-*pro*\\\",\\\"google/gemini-*pro*\\\",\\\"gemini/gemini-*pro*\\\"],\\\"gemma\\\":[\\\"copilot/gemma*\\\",\\\"google/gemma*\\\",\\\"gemini/gemma*\\\"],\\\"gpt-5\\\":[\\\"copilot/gpt-5*\\\",\\\"openai/gpt-5*\\\"],\\\"gpt-5-codex\\\":[\\\"copilot/gpt-5*codex*\\\",\\\"openai/gpt-5*codex*\\\"],\\\"gpt-5-mini\\\":[\\\"copilot/gpt-5*mini*\\\",\\\"openai/gpt-5*mini*\\\"],\\\"gpt-5-nano\\\":[\\\"copilot/gpt-5*nano*\\\",\\\"openai/gpt-5*nano*\\\"],\\\"gpt-5-pro\\\":[\\\"copilot/gpt-5*pro*\\\",\\\"openai/gpt-5*pro*\\\"],\\\"gpt-5.1\\\":[\\\"copilot/gpt-5.1*\\\",\\\"openai/gpt-5.1*\\\"],\\\"gpt-5.2\\\":[\\\"copilot/gpt-5.2*\\\",\\\"openai/gpt-5.2*\\\"],\\\"gpt-5.3\\\":[\\\"copilot/gpt-5.3*\\\",\\\"openai/gpt-5.3*\\\"],\\\"gpt-5.4\\\":[\\\"copilot/gpt-5.4*\\\",\\\"openai/gpt-5.4*\\\"],\\\"gpt-5.5\\\":[\\\"copilot/gpt-5.5*\\\",\\\"openai/gpt-5.5*\\\"],\\\"gpt-5.6\\\":[\\\"copilot/gpt-5.6*\\\",\\\"openai/gpt-5.6*\\\"],\\\"grok\\\":[\\\"copilot/*grok*\\\",\\\"openai/*grok*\\\"],\\\"haiku\\\":[\\\"copilot/*haiku*\\\",\\\"anthropic/*haiku*\\\"],\\\"image-generation\\\":[\\\"copilot/gpt-image*\\\",\\\"openai/gpt-image*\\\",\\\"openai/chatgpt-image*\\\",\\\"copilot/gemini-*image*\\\",\\\"google/gemini-*image*\\\",\\\"gemini/gemini-*image*\\\",\\\"google/imagen*\\\"],\\\"kimi\\\":[\\\"copilot/kimi*\\\",\\\"openai/kimi*\\\"],\\\"kiwi\\\":[\\\"copilot/kiwi*\\\",\\\"openai/kiwi*\\\"],\\\"large\\\":[\\\"sonnet\\\",\\\"gpt-5-pro\\\",\\\"gpt-5\\\",\\\"gemini-pro\\\"],\\\"lyria\\\":[\\\"google/lyria*\\\",\\\"gemini/lyria*\\\",\\\"copilot/lyria*\\\"],\\\"mai-code\\\":[\\\"copilot/MAI-Code*\\\",\\\"copilot/mai-code*\\\",\\\"openai/MAI-Code*\\\"],\\\"mai-code-1-flash-picker\\\":[\\\"copilot/MAI-Code-1-Flash-picker*\\\",\\\"copilot/mai-code-1-flash-picker*\\\",\\\"openai/MAI-Code-1-Flash-picker*\\\"],\\\"mini\\\":[\\\"haiku\\\",\\\"gpt-5-mini\\\",\\\"gpt-5-nano\\\",\\\"gemini-flash-lite\\\"],\\\"nano-banana\\\":[\\\"copilot/nano-banana*\\\",\\\"google/nano-banana*\\\",\\\"gemini/nano-banana*\\\"],\\\"opus\\\":[\\\"copilot/*opus*\\\",\\\"anthropic/*opus*\\\"],\\\"opusplan\\\":[\\\"opus?effort=high\\\"],\\\"raptor-mini\\\":[\\\"copilot/raptor*\\\",\\\"openai/raptor*\\\"],\\\"reasoning\\\":[\\\"copilot/o1*\\\",\\\"copilot/o3*\\\",\\\"copilot/o4*\\\",\\\"openai/o1*\\\",\\\"openai/o3*\\\",\\\"openai/o4*\\\"],\\\"robotics\\\":[\\\"copilot/*robotics*\\\",\\\"google/*robotics*\\\",\\\"gemini/*robotics*\\\"],\\\"small\\\":[\\\"mini\\\"],\\\"small-agent\\\":[\\\"haiku\\\",\\\"gpt-5-mini\\\",\\\"gemini-flash\\\"],\\\"sonnet\\\":[\\\"copilot/*sonnet*\\\",\\\"anthropic/*sonnet*\\\"],\\\"sonnet-6x\\\":[\\\"copilot/*sonnet-4.5*\\\",\\\"copilot/*sonnet-4.6*\\\",\\\"copilot/*sonnet-5*\\\",\\\"copilot/*sonnet-4-5-*\\\",\\\"anthropic/*sonnet-4-5-*\\\",\\\"copilot/*sonnet-4-6*\\\",\\\"anthropic/*sonnet-4-6*\\\",\\\"anthropic/*sonnet-5*\\\"],\\\"summarization\\\":[\\\"haiku\\\",\\\"gpt-5-mini\\\",\\\"gemini-flash-lite\\\",\\\"mini\\\"],\\\"veo\\\":[\\\"google/veo*\\\",\\\"gemini/veo*\\\"],\\\"vision\\\":[\\\"copilot/gemini-*image*\\\",\\\"google/gemini-*image*\\\",\\\"gemini/gemini-*image*\\\",\\\"copilot/gemini-*flash*\\\",\\\"google/gemini-*flash*\\\",\\\"gemini/gemini-*flash*\\\"]}},\\\"container\\\":{\\\"imageTag\\\":\\\"0.27.44,squid=sha256:83e48bbe12c634be8c228a576832fe45f66c529ac3659db92bddbcf2eeb6d627,agent=sha256:0d727725c737b58c7bdf51f640cffb928385ec46517e0917c7f1a02f1bada8b4,api-proxy=sha256:b50fbadba138f6e9aba94aca09711335c489bb3b15861220cb66f6092e042dc7,cli-proxy=sha256:c064d15974f7c933ec7d3f7b4038f4fd203547b3154bdc821afd379144887eff\\\"},\\\"logging\\\":{\\\"proxyLogsDir\\\":\\\"/tmp/gh-aw/sandbox/firewall/logs\\\",\\\"auditDir\\\":\\\"/tmp/gh-aw/sandbox/firewall/audit\\\"}}\" > \"${RUNNER_TEMP}/gh-aw/awf-config.json\"\n cp \"${RUNNER_TEMP}/gh-aw/awf-config.json\" /tmp/gh-aw/awf-config.json\n export GH_AW_MODELS_JSON_PATH=\"/tmp/gh-aw/models.json\"\n GH_AW_DOCKER_HOST=\"\"\n if [[ \"${DOCKER_HOST:-}\" =~ ^tcp:// ]]; then\n GH_AW_DOCKER_HOST=\"${DOCKER_HOST}\"\n fi\n if [[ \"${DOCKER_HOST:-}\" =~ ^tcp:// ]]; then\n _GH_AW_CHROOT_JSON=$(jq -c --arg src \"${RUNNER_TEMP}/gh-aw\" --arg user \"$(id -un)\" --argjson uid \"$(id -u)\" --argjson gid \"$(id -g)\" --arg home \"${RUNNER_TEMP}/gh-aw/home\" '.chroot={\"binariesSourcePath\":$src,\"identity\":{\"user\":$user,\"uid\":$uid,\"gid\":$gid,\"home\":$home}}' \"${RUNNER_TEMP}/gh-aw/awf-config.json\") || { echo \"chroot config patch failed\" >&2; exit 1; }\n printf '%s\\n' \"$_GH_AW_CHROOT_JSON\" > \"${RUNNER_TEMP}/gh-aw/awf-config.json\"\n printf '%s\\n' \"$_GH_AW_CHROOT_JSON\" > \"${RUNNER_TEMP}/gh-aw/awf-config.json\"\n fi\n GH_AW_TOOL_CACHE_MOUNT=\"\"\n GH_AW_TOOL_CACHE=\"${RUNNER_TOOL_CACHE:?RUNNER_TOOL_CACHE must be set}\"\n if [ -d \"$GH_AW_TOOL_CACHE\" ]; then\n if [[ \"$GH_AW_TOOL_CACHE\" != /opt/* ]]; then\n GH_AW_TOOL_CACHE_MOUNT=\"$GH_AW_TOOL_CACHE:$GH_AW_TOOL_CACHE:ro\"\n fi\n fi\n # shellcheck disable=SC1003,SC2016,SC2086\n awf --config \"${RUNNER_TEMP}/gh-aw/awf-config.json\" --container-workdir \"${GITHUB_WORKSPACE}\" --mount \"${RUNNER_TEMP}/gh-aw:${RUNNER_TEMP}/gh-aw:ro\" --mount \"${RUNNER_TEMP}/gh-aw:/host${RUNNER_TEMP}/gh-aw:ro\" ${GH_AW_TOOL_CACHE_MOUNT:+--mount \"$GH_AW_TOOL_CACHE_MOUNT\"} ${GH_AW_DOCKER_HOST:+--docker-host \"$GH_AW_DOCKER_HOST\"} --env-all --exclude-env ACTIONS_ID_TOKEN_REQUEST_TOKEN --exclude-env ACTIONS_ID_TOKEN_REQUEST_URL --exclude-env CODEX_API_KEY --exclude-env OPENAI_API_KEY --mount /tmp/gh-aw:/tmp/gh-aw:rw --log-level info --skip-pull \\\n -- /bin/bash -c 'set +o histexpand; : \"${RUNNER_TOOL_CACHE:?RUNNER_TOOL_CACHE must be set}\"; GH_AW_TOOL_CACHE=\"$RUNNER_TOOL_CACHE\"; export PATH=\"$(find \"$GH_AW_TOOL_CACHE\" -maxdepth 5 -type d -name bin 2>/dev/null | tr '\\''\\n'\\'' '\\'':'\\'')$PATH\"; [ -n \"$GOROOT\" ] && export PATH=\"$GOROOT/bin:$PATH\" || true; [ -n \"$ERLANG_HOME\" ] && export PATH=\"$ERLANG_HOME/bin:$PATH\" || true && GH_AW_NODE_EXEC=\"${GH_AW_NODE_BIN:-}\"; if [ -z \"$GH_AW_NODE_EXEC\" ] || [ ! -x \"$GH_AW_NODE_EXEC\" ]; then GH_AW_NODE_EXEC=\"$(command -v node 2>/dev/null || true)\"; fi; if [ -z \"$GH_AW_NODE_EXEC\" ]; then echo \"node runtime missing on this runner — check runtimes.node in workflow YAML\" >&2; exit 127; fi; GH_AW_NPM_GLOBAL_ROOT=\"$(npm root -g 2>/dev/null || true)\"; if [ -n \"$GH_AW_NPM_GLOBAL_ROOT\" ]; then export NODE_PATH=\"${GH_AW_NPM_GLOBAL_ROOT}${NODE_PATH:+:${NODE_PATH}}\"; fi; \"$GH_AW_NODE_EXEC\" ${RUNNER_TEMP}/gh-aw/actions/codex_harness.cjs codex exec${GH_AW_MODEL_DETECTION_CODEX:+ --model \"$GH_AW_MODEL_DETECTION_CODEX\"} -c web_search=\"disabled\" -c fetch=\"disabled\" --dangerously-bypass-approvals-and-sandbox --skip-git-repo-check --output-schema /tmp/gh-aw/threat-detection/detection_schema.json -o /tmp/gh-aw/threat-detection/detection_result.json --prompt-file /tmp/gh-aw/aw-prompts/prompt.txt' 2>&1 | tee -a /tmp/gh-aw/threat-detection/detection.log\n env:\n GITHUB_STEP_SUMMARY: /tmp/gh-aw/step-summary.md\n CODEX_API_KEY: ${{ secrets.CODEX_API_KEY || secrets.OPENAI_API_KEY }}\n CODEX_HOME: /tmp/gh-aw/mcp-config\n GH_AW_MAX_TURNS: ${{ vars.GH_AW_DEFAULT_MAX_TURNS || '' }}\n GH_AW_MCP_CONFIG: ${{ runner.temp }}/gh-aw/mcp-config/config.toml\n GH_AW_MODEL_DETECTION_CODEX: gpt-5.4\n GH_AW_PHASE: detection\n GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt\n GH_AW_VERSION: v0.86.2\n GITHUB_AW: true\n GIT_AUTHOR_EMAIL: github-actions[bot]@users.noreply.github.com\n GIT_AUTHOR_NAME: github-actions[bot]\n GIT_COMMITTER_EMAIL: github-actions[bot]@users.noreply.github.com\n GIT_COMMITTER_NAME: github-actions[bot]\n OPENAI_API_KEY: ${{ secrets.CODEX_API_KEY || secrets.OPENAI_API_KEY }}\n RUNNER_TEMP: ${{ runner.temp }}\n RUST_LOG: ${{ runner.debug == 1 && 'trace,hyper_util=info,mio=info,reqwest=info,os_info=info,codex_otel=warn,codex_core=debug,ocodex_exec=debug' || 'warn' }}\n TRACEPARENT: ${{ env.GITHUB_AW_OTEL_TRACE_ID != '' && env.GITHUB_AW_OTEL_PARENT_SPAN_ID != '' && format('00-{0}-{1}-01', env.GITHUB_AW_OTEL_TRACE_ID, env.GITHUB_AW_OTEL_PARENT_SPAN_ID) || '' }}\n - name: Echo detection step summary\n if: always() && steps.detection_guard.outputs.run_detection == 'true'\n continue-on-error: true\n run: |\n if [ -s /tmp/gh-aw/step-summary.md ]; then\n cat /tmp/gh-aw/step-summary.md\n fi\n - name: Render detection log\n if: always() && steps.detection_guard.outputs.run_detection == 'true'\n continue-on-error: true\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n with:\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/render_detection_log.cjs');\n await main();\n - name: Parse threat detection token usage for step summary\n id: parse_detection_token_usage\n if: always()\n continue-on-error: true\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n env:\n GH_AW_TOKEN_USAGE_SUMMARY_TITLE: Threat Detection Token Usage\n with:\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/parse_token_usage.cjs');\n await main();\n - name: Upload threat detection log\n if: always() && steps.detection_guard.outputs.run_detection == 'true'\n uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1\n with:\n name: detection\n path: /tmp/gh-aw/threat-detection/detection.log\n if-no-files-found: ignore\n - name: Parse and conclude threat detection\n id: detection_conclusion\n if: always()\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n env:\n RUN_DETECTION: ${{ steps.detection_guard.outputs.run_detection }}\n DETECTION_AGENTIC_EXECUTION_OUTCOME: ${{ steps.detection_agentic_execution.outcome }}\n GH_AW_DETECTION_CONTINUE_ON_ERROR: \"false\"\n with:\n script: |\n try {\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/parse_threat_detection_results.cjs');\n await main();\n } catch (loadErr) {\n const continueOnError = process.env.GH_AW_DETECTION_CONTINUE_ON_ERROR !== 'false';\n const detectionExecutionFailed = process.env.DETECTION_AGENTIC_EXECUTION_OUTCOME === 'failure';\n const msg = 'ERR_SYSTEM: \\u274C Unexpected error loading threat detection module: ' + (loadErr && loadErr.message ? loadErr.message : String(loadErr));\n core.error(msg);\n core.setOutput('reason', 'parse_error');\n if (continueOnError && !detectionExecutionFailed) {\n core.warning('\\u26A0\\uFE0F ' + msg);\n core.setOutput('conclusion', 'warning');\n core.setOutput('success', 'false');\n } else {\n core.setOutput('conclusion', 'failure');\n core.setOutput('success', 'false');\n core.setFailed(msg);\n }\n }\n\n finish_attempt:\n needs:\n - agent\n - detection\n if: >\n (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'finish_attempt') &&\n (needs.detection.outputs.detection_success == 'true')\n runs-on: ubuntu-latest\n permissions:\n actions: read\n contents: read\n steps:\n - name: Download agent output artifact\n continue-on-error: true\n uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1\n with:\n name: agent\n path: ${{ runner.temp }}/gh-aw/safe-jobs/\n - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1\n env:\n GH_AW_AGENT_OUTPUT: ${{ runner.temp }}/gh-aw/safe-jobs/agent_output.json\n with:\n fetch-depth: 0\n persist-credentials: false\n ref: main\n - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 (source v7)\n env:\n GH_AW_AGENT_OUTPUT: ${{ runner.temp }}/gh-aw/safe-jobs/agent_output.json\n with:\n node-version: \"24\"\n - name: Identify the bounded output\n id: proposal\n run: |\n if jq -e '.items | length == 1 and .[0].type == \"finish_attempt\" and .[0].kind == \"proposal\"' \"$GH_AW_AGENT_OUTPUT\" >/dev/null; then\n echo \"download=true\" >> \"$GITHUB_OUTPUT\"\n else\n echo \"download=false\" >> \"$GITHUB_OUTPUT\"\n fi\n env:\n GH_AW_AGENT_OUTPUT: ${{ runner.temp }}/gh-aw/safe-jobs/agent_output.json\n - name: Download the proposal\n if: steps.proposal.outputs.download == 'true'\n uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1\n env:\n GH_AW_AGENT_OUTPUT: ${{ runner.temp }}/gh-aw/safe-jobs/agent_output.json\n with:\n name: pr-maintenance-proposal\n path: /tmp/gh-aw/proposal\n - name: Validate and finish the attempt\n run: timeout 5m node scripts/pr-maintenance/worker-run.mjs finish\n env:\n ATTEMPT: ${{ inputs.attempt }}\n GH_AW_AGENT_OUTPUT: ${{ runner.temp }}/gh-aw/safe-jobs/agent_output.json\n GH_TOKEN: ${{ secrets.PR_MAITENANCE_TOKEN }}\n PR_MAINTENANCE_STATE_KEY: ${{ secrets.PR_MAINTENANCE_STATE_KEY }}\n PR_NUMBER: ${{ inputs.pr }}\n PR_WRITE_TOKEN: ${{ secrets.PR_MAITENANCE_TOKEN }}\n - name: Upload the authenticated result\n if: always()\n uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1\n env:\n GH_AW_AGENT_OUTPUT: ${{ runner.temp }}/gh-aw/safe-jobs/agent_output.json\n with:\n if-no-files-found: ignore\n name: pr-maintenance-result\n path: /tmp/gh-aw/result/result.json\n retention-days: 7\n\n safe_outputs:\n needs:\n - activation\n - agent\n - detection\n if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'\n runs-on: ubuntu-slim\n permissions:\n issues: write\n timeout-minutes: 45\n env:\n GH_AW_AGENT_AIC: ${{ needs.agent.outputs.aic }}\n GH_AW_AIC: ${{ needs.agent.outputs.aic }}\n GH_AW_AMBIENT_CONTEXT: ${{ needs.agent.outputs.ambient_context }}\n GH_AW_CALLER_WORKFLOW_ID: \"${{ github.repository }}/pr-readiness-worker\"\n GH_AW_DETECTION_CONCLUSION: ${{ needs.detection.outputs.detection_conclusion }}\n GH_AW_DETECTION_REASON: ${{ needs.detection.outputs.detection_reason }}\n GH_AW_EFFECTIVE_TOKENS: ${{ needs.agent.outputs.effective_tokens }}\n GH_AW_ENGINE_ID: \"codex\"\n GH_AW_ENGINE_MODEL: \"gpt-5.4\"\n GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }}\n GH_AW_THREAT_DETECTION_AIC: ${{ needs.detection.outputs.aic }}\n GH_AW_WORKFLOW_ID: \"pr-readiness-worker\"\n GH_AW_WORKFLOW_NAME: \"PR readiness worker\"\n GH_AW_WORKFLOW_SOURCE_URL: \"${{ github.server_url }}/${{ github.repository }}/blob/${{ github.ref_name }}/.github/workflows/pr-readiness-worker.md\"\n outputs:\n code_push_failure_count: ${{ steps.process_safe_outputs.outputs.code_push_failure_count }}\n code_push_failure_errors: ${{ steps.process_safe_outputs.outputs.code_push_failure_errors }}\n create_discussion_error_count: ${{ steps.process_safe_outputs.outputs.create_discussion_error_count }}\n create_discussion_errors: ${{ steps.process_safe_outputs.outputs.create_discussion_errors }}\n process_safe_outputs_items_applied: ${{ steps.process_safe_outputs.outputs.items_applied }}\n process_safe_outputs_items_cancelled: ${{ steps.process_safe_outputs.outputs.items_cancelled }}\n process_safe_outputs_items_deferred: ${{ steps.process_safe_outputs.outputs.items_deferred }}\n process_safe_outputs_items_failed: ${{ steps.process_safe_outputs.outputs.items_failed }}\n process_safe_outputs_items_skipped: ${{ steps.process_safe_outputs.outputs.items_skipped }}\n process_safe_outputs_items_succeeded: ${{ steps.process_safe_outputs.outputs.items_succeeded }}\n process_safe_outputs_items_warnings: ${{ steps.process_safe_outputs.outputs.items_warnings }}\n process_safe_outputs_processed_count: ${{ steps.process_safe_outputs.outputs.processed_count }}\n process_safe_outputs_status: ${{ steps.process_safe_outputs.outputs.status }}\n process_safe_outputs_temporary_id_map: ${{ steps.process_safe_outputs.outputs.temporary_id_map }}\n steps:\n - name: Setup Scripts\n id: setup\n uses: github/gh-aw-actions/setup@6aab9e5b5c91c615506061f09bedd81a23babe3c # v0.86.2\n with:\n destination: ${{ runner.temp }}/gh-aw/actions\n job-name: ${{ github.job }}\n trace-id: ${{ needs.activation.outputs.setup-trace-id }}\n parent-span-id: ${{ needs.activation.outputs.setup-parent-span-id || needs.activation.outputs.setup-span-id }}\n env:\n GH_AW_SETUP_WORKFLOW_NAME: \"PR readiness worker\"\n GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/pr-readiness-worker.lock.yml@${{ github.ref }}\n GH_AW_INFO_VERSION: \"0.147.0\"\n GH_AW_INFO_AWF_VERSION: \"v0.27.44\"\n GH_AW_INFO_ENGINE_ID: \"codex\"\n - name: Download agent output artifact\n id: download-agent-output\n continue-on-error: true\n uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1\n with:\n name: agent\n path: /tmp/gh-aw/\n - name: Setup agent output environment variable\n id: setup-agent-output-env\n if: steps.download-agent-output.outcome == 'success'\n run: |\n mkdir -p /tmp/gh-aw/\n find \"/tmp/gh-aw/\" -type f -print\n echo \"GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json\" >> \"$GITHUB_OUTPUT\"\n - name: Configure GH_HOST for enterprise compatibility\n id: ghes-host-config\n shell: bash\n run: | # zizmor: ignore[github-env] - GITHUB_SERVER_URL is set by GitHub Actions, not user input.\n # Derive GH_HOST from GITHUB_SERVER_URL so the gh CLI targets the correct\n # GitHub instance (GHES/GHEC). On github.com this is a harmless no-op.\n GH_HOST=\"${GITHUB_SERVER_URL#https://}\"\n GH_HOST=\"${GH_HOST#http://}\"\n echo \"GH_HOST=${GH_HOST}\" >> \"$GITHUB_ENV\"\n - name: Process Safe Outputs\n id: process_safe_outputs\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n env:\n GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }}\n GH_AW_COMMENT_ID: ${{ needs.activation.outputs.comment_id }}\n GH_AW_ALLOWED_DOMAINS: \"172.30.0.1,api.github.com,api.npms.io,api.openai.com,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,bun.sh,cdn.jsdelivr.net,chatgpt.com,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,deb.nodesource.com,deno.land,esm.sh,get.pnpm.io,github.com,googleapis.deno.dev,googlechromelabs.github.io,host.docker.internal,json-schema.org,json.schemastore.org,jsr.io,keyserver.ubuntu.com,nodejs.org,npm.pkg.github.com,npmjs.com,npmjs.org,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,openai.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,ppa.launchpad.net,registry.bower.io,registry.npmjs.com,registry.npmjs.org,registry.yarnpkg.com,release-assets.githubusercontent.com,repo.yarnpkg.com,s.symcb.com,s.symcd.com,security.ubuntu.com,skimdb.npmjs.com,storage.googleapis.com,telemetry.vercel.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com,www.googleapis.com,www.npmjs.com,www.npmjs.org,yarnpkg.com\"\n GITHUB_SERVER_URL: ${{ github.server_url }}\n GITHUB_API_URL: ${{ github.api_url }}\n GH_AW_SAFE_OUTPUT_JOBS: \"{\\\"finish_attempt\\\":\\\"\\\"}\"\n GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: \"{\\\"create_report_incomplete_issue\\\":{},\\\"missing_data\\\":{},\\\"missing_tool\\\":{},\\\"noop\\\":{\\\"max\\\":1,\\\"report-as-issue\\\":\\\"false\\\"},\\\"report_incomplete\\\":{}}\"\n with:\n github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/process_safe_outputs.cjs');\n await main();\n - name: Upload Safe Outputs Items\n if: always()\n uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1\n with:\n name: safe-outputs-items\n path: |\n /tmp/gh-aw/safe-output-items.jsonl\n /tmp/gh-aw/temporary-id-map.json\n if-no-files-found: ignore\n","editable",false,"branch","documentNavigation","repo","githubnext/chopin","repoId","7d1a8ac3-35b0-4dea-85d4-06a980f3bada","ownerId","org:89615882","site","nexthub","private","admin","settings","maintainer","triage","starred","stars",0,"watchers","watching","pinned","notify","views",[183,184,185,186,187,188,189,190,191,192,193,194,195],"navigation",{"_54":55,"_139":140,"_141":142,"_143":144,"_145":146,"_147":148,"_149":150},"sources",[],"viewer","meta",{"_131":132,"_133":134,"_135":136,"_42":31,"_137":126,"_138":31,"_48":49,"_50":49},"branches",[73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130],"tags",[69,70,71,72],"cloneUrl","https://git.nexthub.sh/githubnext/chopin.git","color-controls-slice-1","color-controls-slice-2","color-controls-slice-3","color-controls-slice-4","Krzysztof-Cieslak-patch-1","Krzysztof-Cieslak-patch-2","Maggie/app-preview-toolkit","Maggie/ci-playwright-install-timeout","Maggie/collaborative-visual-decision","Maggie/design-audit","Maggie/generic-visual-decision-runtime","Maggie/impeccable-chopin-metadata","Maggie/jev-chat-product","Maggie/jev-composed-assessment","Maggie/native-document-layouts","Maggie/openui-composition-product","Maggie/openui-composition-trial","Maggie/planner-visual-authoring","Maggie/planner-visual-requests","Maggie/visual-selection-eval","artifacts/pr-419-live-preview-20261009","automation/pr-maintenance-state","automation/use-effect/callout-disabled-picker-8cf9e49ba5c09471","automation/use-effect/collaboration-options-ref-4e3a5a08a879a5ae","automation/use-effect/room-workspace-effective-access-a57d40866c71bed0","chore/bun-1.4.2","color-controls","color-controls-plan","comments","design-pr-assets","design/archived-decisions-badge","design/channel-route-remount","design/chat-decision-entry","design/conversation-analysis-markers","design/decision-evidence","design/settled-line-icon","dev/integration","diagram-step-controls","feat/liveapp-frontend-pilot","feat/local-experiments","feat/local-launcher-tracer","fix/autolink-mdx-crash","github-pills/2-pills","github-pills/3-hover-card","maggie/app-preview-toolkit","maggie/ci-playwright-install-timeout","maggie/collaborative-visual-decision","maggie/design-audit","maggie/generic-visual-decision-runtime","maggie/impeccable-chopin-metadata","maggie/jev-composed-assessment","maggie/native-document-layouts","maggie/openui-composition-product","maggie/openui-composition-trial","maggie/planner-visual-authoring","maggie/planner-visual-requests","maggie/visual-selection-eval","main","plain-text-fence-chrome","tokens/09-copy","wireframes/2-renderer","wireframes/3-planner","description","Let's compose rich plans together","owner","githubnext","section","","head","empty","pins",[165,166,167],"documents",{"_160":161,"_162":163},"code",{"_156":157,"_158":159},"automations",{"_153":154,"_155":-5},"delivery",{"_151":49,"_152":-5},"tag","04zvKQ8QOrDUF8TO1Ovz0Zy8_TT","releases","applications","workflows",3,"deployments","commits",1000,"changes",13,"counts",{"_164":163},"total",11,"issue",{"_168":158,"_170":181,"_15":158,"_172":182,"_52":174,"_175":31,"_176":174,"_177":159},{"_168":178,"_170":179,"_15":178,"_172":180,"_52":174,"_175":31,"_176":174,"_177":49},{"_168":169,"_170":171,"_15":169,"_172":173,"_52":174,"_175":31,"_176":174,"_177":163},"id","issues","name","Issues","filters",{},true,"saved","pinnable","count","tasks","Tasks",{},"Changes",{},{"_168":158,"_170":181,"_15":158,"_172":226,"_52":174,"_175":31,"_176":174},{"_168":178,"_170":179,"_15":178,"_172":225,"_52":174,"_175":31,"_176":174},{"_168":169,"_170":171,"_15":169,"_172":224,"_52":174,"_175":31,"_176":174},{"_168":221,"_170":222,"_15":221,"_172":223,"_52":31,"_175":31,"_176":174},{"_168":218,"_170":219,"_15":218,"_172":220,"_52":31,"_175":31,"_176":174},{"_168":153,"_170":216,"_15":145,"_172":217,"_52":31,"_175":31,"_176":174},{"_168":155,"_170":213,"_15":214,"_172":215,"_52":31,"_175":31,"_176":174},{"_168":151,"_170":211,"_15":151,"_172":212,"_52":31,"_175":31,"_176":174},{"_168":207,"_170":208,"_15":209,"_172":210,"_52":31,"_175":31,"_176":174},{"_168":141,"_170":205,"_15":141,"_172":206,"_52":31,"_175":31,"_176":31},{"_168":202,"_170":203,"_15":202,"_172":204,"_52":31,"_175":31,"_176":31},{"_168":199,"_170":200,"_15":199,"_172":201,"_52":31,"_175":31,"_176":31},{"_168":196,"_170":197,"_15":196,"_172":198,"_52":31,"_175":31,"_176":31},"decisions","Decisions",{},"changelog","Changelog",{},"roadmap","Roadmap",{},"Documents",{},"activity","Activity","insights",{},"Releases",{},"Deployments","automations/deployments",{},"Workflows",{},"discussions","Discussions",{},"goals","Goals",{},{},{},{},"groups","user","agents",[],"now",1794512491295,"sidebar","expanded"]