[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10,"_11":12},"actionData","errors","root",{"_228":-5,"_231":232,"_233":234},"routes/shell",{"_41":42,"_227":-5,"_228":-5,"_229":230},"routes/repo",{"_34":-7,"_35":36,"_37":38,"_39":40,"_41":42,"_43":32,"_44":32,"_45":32,"_46":32,"_47":32,"_48":32,"_49":50,"_51":50,"_52":32,"_53":-7,"_54":-7,"_55":56,"_57":58,"_59":60,"_61":-5,"_62":63,"_64":65,"_66":67,"_68":69},"routes/repo.blob",{"_13":14,"_15":16,"_17":18,"_19":20,"_21":22,"_23":24,"_25":-5,"_26":27,"_28":29,"_29":30,"_31":32,"_33":14},"ref","main","path",".github/workflows/issue-triage.lock.yml","oid","434eab796f77d104851f3e9075d9bafd4f2d7a88","size",121167,"commit","2182c95de44a8f63fd86af1c5874ae0ca298f807","mounts",[],"source","plain",{"_13":14,"_15":16},"kind","text","# gh-aw-metadata: {\"schema_version\":\"v4\",\"frontmatter_hash\":\"030619c427f626a9cdcdc05953f73ceab1d91f3e62a0accb86422c2c22f6d263\",\"body_hash\":\"08a177985ca6312daa09b51ae08801312f01f25bff63b52a169c1fa3993744dc\",\"compiler_version\":\"v0.86.2\",\"strict\":true,\"agent_id\":\"codex\",\"agent_model\":\"gpt-6.1-sol\",\"detection_agent_id\":\"codex\",\"engine_versions\":{\"codex\":\"0.147.0\"}}\n# gh-aw-manifest: {\"version\":1,\"secrets\":[\"CODEX_API_KEY\",\"COPILOT_GITHUB_TOKEN\",\"GH_AW_GITHUB_MCP_SERVER_TOKEN\",\"GH_AW_GITHUB_TOKEN\",\"GITHUB_TOKEN\",\"OPENAI_API_KEY\"],\"actions\":[{\"repo\":\"actions/cache/restore\",\"sha\":\"55cc8345863c7cc4c66a329aec7e433d2d1c52a9\",\"version\":\"v6.1.0\"},{\"repo\":\"actions/cache/save\",\"sha\":\"55cc8345863c7cc4c66a329aec7e433d2d1c52a9\",\"version\":\"v6.1.0\"},{\"repo\":\"actions/checkout\",\"sha\":\"3d3c42e5aac5ba805825da76410c181273ba90b1\",\"version\":\"v7.0.1\"},{\"repo\":\"actions/download-artifact\",\"sha\":\"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c\",\"version\":\"v8.0.1\"},{\"repo\":\"actions/github-script\",\"sha\":\"3a2844b7e9c422d3c10d287c895573f7108da1b3\",\"version\":\"v9.0.0\"},{\"repo\":\"actions/setup-node\",\"sha\":\"820762786026740c76f36085b0efc47a31fe5020\",\"version\":\"v7.0.0\"},{\"repo\":\"actions/upload-artifact\",\"sha\":\"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a\",\"version\":\"v7.0.1\"},{\"repo\":\"github/gh-aw-actions/setup\",\"sha\":\"6aab9e5b5c91c615506061f09bedd81a23babe3c\",\"version\":\"v0.86.2\"}],\"containers\":[{\"image\":\"ghcr.io/github/gh-aw-firewall/agent:0.27.44\",\"digest\":\"sha256:0d727725c737b58c7bdf51f640cffb928385ec46517e0917c7f1a02f1bada8b4\",\"pinned_image\":\"ghcr.io/github/gh-aw-firewall/agent:0.27.44@sha256:0d727725c737b58c7bdf51f640cffb928385ec46517e0917c7f1a02f1bada8b4\"},{\"image\":\"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.44\",\"digest\":\"sha256:b50fbadba138f6e9aba94aca09711335c489bb3b15861220cb66f6092e042dc7\",\"pinned_image\":\"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.44@sha256:b50fbadba138f6e9aba94aca09711335c489bb3b15861220cb66f6092e042dc7\"},{\"image\":\"ghcr.io/github/gh-aw-firewall/squid:0.27.44\",\"digest\":\"sha256:83e48bbe12c634be8c228a576832fe45f66c529ac3659db92bddbcf2eeb6d627\",\"pinned_image\":\"ghcr.io/github/gh-aw-firewall/squid:0.27.44@sha256:83e48bbe12c634be8c228a576832fe45f66c529ac3659db92bddbcf2eeb6d627\"},{\"image\":\"ghcr.io/github/gh-aw-mcpg:v0.4.9\",\"digest\":\"sha256:e5a1569aeaf41820fa7bdee3e94468cae448133cdbf00119ad24f5b74db1ab9f\",\"pinned_image\":\"ghcr.io/github/gh-aw-mcpg:v0.4.9@sha256:e5a1569aeaf41820fa7bdee3e94468cae448133cdbf00119ad24f5b74db1ab9f\"},{\"image\":\"ghcr.io/github/gh-aw-node\",\"digest\":\"sha256:0d9f1fb5fd6610c0ac1f5194a38e45a8a1e81f8a390d5142d8e4e6f26a4b3196\",\"pinned_image\":\"ghcr.io/github/gh-aw-node@sha256:0d9f1fb5fd6610c0ac1f5194a38e45a8a1e81f8a390d5142d8e4e6f26a4b3196\"},{\"image\":\"ghcr.io/github/github-mcp-server:v1.9.0\",\"digest\":\"sha256:881b53d6f75f69bdbc1b5b10fc2f1361717c19054143b3a8529fb5c32061a50e\",\"pinned_image\":\"ghcr.io/github/github-mcp-server:v1.9.0@sha256:881b53d6f75f69bdbc1b5b10fc2f1361717c19054143b3a8529fb5c32061a50e\"}]}\n# This file was automatically generated by gh-aw (v0.86.2). DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md\n#\n# ___ _ _\n# / _ \\ | | (_)\n# | |_| | __ _ ___ _ __ | |_ _ ___\n# | _ |/ _` |/ _ \\ '_ \\| __| |/ __|\n# | | | | (_| | __/ | | | |_| | (__\n# \\_| |_/\\__, |\\___|_| |_|\\__|_|\\___|\n# __/ |\n# _ _ |___/\n# | | | | / _| |\n# | | | | ___ _ __ _ __| |_| | _____ ____\n# | |/\\| |/ _ \\ '__| |/ /| _| |/ _ \\ \\ /\\ / / ___|\n# \\ /\\ / (_) | | | | ( | | | | (_) \\ V V /\\__ \\\n# \\/ \\/ \\___/|_| |_|\\_\\|_| |_|\\___/ \\_/\\_/ |___/\n#\n#\n# To update this file, edit the corresponding .md file and run:\n# gh aw compile\n# Not all edits will cause changes to this file.\n#\n# For more information: https://github.github.com/gh-aw/introduction/overview/\n#\n# Route issues and acknowledge external contributors without starting implementation.\n#\n# Secrets used:\n# - CODEX_API_KEY\n# - COPILOT_GITHUB_TOKEN\n# - GH_AW_GITHUB_MCP_SERVER_TOKEN\n# - GH_AW_GITHUB_TOKEN\n# - GITHUB_TOKEN\n# - OPENAI_API_KEY\n#\n# Custom actions used:\n# - actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0\n# - actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0\n# - actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1\n# - actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 (source v7)\n# - actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1\n# - actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n# - actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 (source v9)\n# - actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0\n# - actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1\n# - github/gh-aw-actions/setup@6aab9e5b5c91c615506061f09bedd81a23babe3c # v0.86.2\n#\n# Container images used:\n# - ghcr.io/github/gh-aw-firewall/agent:0.27.44@sha256:0d727725c737b58c7bdf51f640cffb928385ec46517e0917c7f1a02f1bada8b4\n# - ghcr.io/github/gh-aw-firewall/api-proxy:0.27.44@sha256:b50fbadba138f6e9aba94aca09711335c489bb3b15861220cb66f6092e042dc7\n# - ghcr.io/github/gh-aw-firewall/squid:0.27.44@sha256:83e48bbe12c634be8c228a576832fe45f66c529ac3659db92bddbcf2eeb6d627\n# - ghcr.io/github/gh-aw-mcpg:v0.4.9@sha256:e5a1569aeaf41820fa7bdee3e94468cae448133cdbf00119ad24f5b74db1ab9f\n# - ghcr.io/github/gh-aw-node@sha256:0d9f1fb5fd6610c0ac1f5194a38e45a8a1e81f8a390d5142d8e4e6f26a4b3196\n# - ghcr.io/github/github-mcp-server:v1.9.0@sha256:881b53d6f75f69bdbc1b5b10fc2f1361717c19054143b3a8529fb5c32061a50e\n\nname: \"Issue triage\"\non:\n # roles: all # Roles processed as role check in pre-activation job\n schedule:\n - cron: \"43 9 * * *\"\n # skip-bots: # Skip-bots processed as bot check in pre-activation job\n # - github-actions # Skip-bots processed as bot check in pre-activation job\n # - copilot # Skip-bots processed as bot check in pre-activation job\n # - dependabot # Skip-bots processed as bot check in pre-activation job\n workflow_dispatch:\n inputs:\n aw_context:\n default: \"\"\n description: \"Agent caller context (used internally by Agentic Workflows).\"\n required: false\n type: string\n\npermissions: {}\n\nconcurrency:\n cancel-in-progress: false\n group: issue-triage\n queue: single\n\nrun-name: \"Issue triage\"\n\njobs:\n activation:\n needs:\n - pre_activation\n - select\n if: needs.pre_activation.outputs.activated == 'true' && (needs.select.outputs.has_candidates == 'true')\n runs-on: ubuntu-slim\n permissions:\n actions: read\n contents: read\n env:\n GH_AW_MAX_DAILY_AI_CREDITS: \"500\"\n GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }}\n outputs:\n comment_id: \"\"\n comment_repo: \"\"\n daily_ai_credits_exceeded: ${{ steps.daily-effective-workflow-guardrail.outputs.daily_ai_credits_exceeded == 'true' }}\n daily_ai_credits_guardrail_status: ${{ steps.daily-effective-workflow-guardrail.outputs.daily_ai_credits_guardrail_status || '' }}\n daily_ai_credits_threshold: ${{ steps.daily-effective-workflow-guardrail.outputs.daily_ai_credits_threshold || '' }}\n daily_ai_credits_total_effective_tokens: ${{ steps.daily-effective-workflow-guardrail.outputs.daily_ai_credits_total_effective_tokens || '' }}\n engine_id: ${{ steps.generate_aw_info.outputs.engine_id }}\n lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }}\n model: ${{ steps.generate_aw_info.outputs.model }}\n oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }}\n secret_verification_result: ${{ steps.validate-secret.outputs.verification_result }}\n setup-parent-span-id: ${{ steps.setup.outputs.parent-span-id || steps.setup.outputs.span-id }}\n setup-span-id: ${{ steps.setup.outputs.span-id }}\n setup-trace-id: ${{ steps.setup.outputs.trace-id }}\n stale_lock_file_failed: ${{ steps.check-lock-file.outputs.stale_lock_file_failed == 'true' }}\n steps:\n - name: Setup Scripts\n id: setup\n uses: github/gh-aw-actions/setup@6aab9e5b5c91c615506061f09bedd81a23babe3c # v0.86.2\n with:\n destination: ${{ runner.temp }}/gh-aw/actions\n job-name: ${{ github.job }}\n trace-id: ${{ needs.pre_activation.outputs.setup-trace-id }}\n parent-span-id: ${{ needs.pre_activation.outputs.setup-parent-span-id || needs.pre_activation.outputs.setup-span-id }}\n safe-output-artifact-client: ${{ env.GH_AW_MAX_DAILY_AI_CREDITS != '' }}\n env:\n GH_AW_SETUP_WORKFLOW_NAME: \"Issue triage\"\n GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/issue-triage.lock.yml@${{ github.ref }}\n GH_AW_INFO_VERSION: \"0.147.0\"\n GH_AW_INFO_AWF_VERSION: \"v0.27.44\"\n GH_AW_INFO_ENGINE_ID: \"codex\"\n - name: Generate agentic run info\n id: generate_aw_info\n env:\n GH_AW_INFO_ENGINE_ID: \"codex\"\n GH_AW_INFO_ENGINE_NAME: \"Codex\"\n GH_AW_INFO_MODEL: \"gpt-6.1-sol\"\n GH_AW_INFO_VERSION: \"0.147.0\"\n GH_AW_INFO_AGENT_VERSION: \"0.147.0\"\n GH_AW_INFO_CLI_VERSION: \"v0.86.2\"\n GH_AW_INFO_WORKFLOW_NAME: \"Issue triage\"\n GH_AW_INFO_EXPERIMENTAL: \"false\"\n GH_AW_INFO_SUPPORTS_TOOLS_ALLOWLIST: \"true\"\n GH_AW_INFO_STAGED: \"false\"\n GH_AW_INFO_ALLOWED_DOMAINS: '[\"defaults\"]'\n GH_AW_INFO_FIREWALL_ENABLED: \"true\"\n GH_AW_INFO_AWF_VERSION: \"v0.27.44\"\n GH_AW_INFO_AWMG_VERSION: \"\"\n GH_AW_INFO_FIREWALL_TYPE: \"squid\"\n GH_AW_INFO_AGENT_RUNTIME: \"\"\n GH_AW_COMPILED_STRICT: \"true\"\n GH_AW_INFO_MODEL_COSTS: '{\"providers\":{\"openai\":{\"models\":{\"gpt-6.1-sol\":{\"cost\":{\"cache_read\":\"1e-7\",\"cache_write\":\"2.5e-6\",\"input\":\"2e-6\",\"output\":\"1e-5\"}}}}}}'\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n with:\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/generate_aw_info.cjs');\n await main(core, context);\n - name: Restore daily AIC usage cache\n id: restore-daily-aic-cache\n if: ${{ env.GH_AW_MAX_DAILY_AI_CREDITS != '' }}\n continue-on-error: true\n uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0\n with:\n key: agentic-workflow-usage-issuetriage-${{ github.run_id }}\n restore-keys: agentic-workflow-usage-issuetriage-\n path: /tmp/gh-aw/agentic-workflow-usage-cache.jsonl\n - name: Restore daily AIC usage cache (artifact fallback)\n id: restore-daily-aic-cache-fallback\n if: ${{ env.GH_AW_MAX_DAILY_AI_CREDITS != '' }}\n continue-on-error: true\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n env:\n GH_AW_RESTORE_DAILY_AIC_CACHE_HIT: ${{ steps.restore-daily-aic-cache.outputs.cache-hit }}\n GH_AW_RESTORE_DAILY_AIC_CACHE_MATCHED_KEY: ${{ steps.restore-daily-aic-cache.outputs.cache-matched-key }}\n with:\n github-token: ${{ secrets.GITHUB_TOKEN }}\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/restore_aic_usage_cache_fallback.cjs');\n await main();\n - name: Check daily workflow token guardrail\n id: daily-effective-workflow-guardrail\n if: ${{ env.GH_AW_MAX_DAILY_AI_CREDITS != '' }}\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n env:\n GH_AW_WORKFLOW_NAME: \"Issue triage\"\n GH_AW_WORKFLOW_ID: \"issue-triage\"\n GH_AW_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}\n GH_AW_WORKFLOW_DISPATCH_AW_CONTEXT: ${{ github.event.inputs.aw_context || '' }}\n GH_AW_HAS_SLASH_COMMAND: \"false\"\n GH_AW_HAS_LABEL_COMMAND: \"false\"\n GH_AW_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}\n GH_AW_MAX_DAILY_AI_CREDITS: \"500\"\n with:\n github-token: ${{ secrets.GITHUB_TOKEN }}\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/check_daily_aic_workflow_guardrail.cjs');\n await main();\n - name: Validate CODEX_API_KEY or OPENAI_API_KEY secret\n id: validate-secret\n run: bash \"${RUNNER_TEMP}/gh-aw/actions/validate_multi_secret.sh\" CODEX_API_KEY OPENAI_API_KEY Codex https://github.github.com/gh-aw/reference/engines/#openai-codex\n env:\n CODEX_API_KEY: ${{ secrets.CODEX_API_KEY }}\n OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}\n - name: Check for OAuth tokens\n id: check-oauth-tokens\n run: bash \"${RUNNER_TEMP}/gh-aw/actions/check_oauth_tokens.sh\"\n env:\n COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}\n GH_AW_GITHUB_TOKEN: ${{ secrets.GH_AW_GITHUB_TOKEN }}\n GH_AW_GITHUB_MCP_SERVER_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN }}\n - name: Checkout .github and .agents folders\n uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1\n with:\n persist-credentials: false\n sparse-checkout: |\n .github\n .agents\n .claude\n .codex\n .gemini\n .pi\n sparse-checkout-cone-mode: true\n fetch-depth: 1\n - name: Save agent config folders for base branch restoration\n env:\n GH_AW_AGENT_FOLDERS: \".agents .codex .github\"\n GH_AW_AGENT_FILES: \"AGENTS.md\"\n run: |\n bash \"${RUNNER_TEMP}/gh-aw/actions/save_base_github_folders.sh\"\n - name: Check workflow lock file\n id: check-lock-file\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n env:\n GH_AW_WORKFLOW_FILE: \"issue-triage.lock.yml\"\n GH_AW_CONTEXT_WORKFLOW_REF: \"${{ github.workflow_ref }}\"\n with:\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/check_workflow_timestamp_api.cjs');\n await main();\n - name: Check compile-agentic version\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n env:\n GH_AW_COMPILED_VERSION: \"v0.86.2\"\n with:\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/check_version_updates.cjs');\n await main();\n - name: Log runtime features\n if: ${{ contains(toJSON(vars), '\"GH_AW_RUNTIME_FEATURES\":') }}\n run: bash \"${RUNNER_TEMP}/gh-aw/actions/log_runtime_features_summary.sh\"\n - name: Create prompt with built-in context\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n env:\n GH_AW_ACTIONS_DIR: ${{ runner.temp }}/gh-aw/actions\n GH_AW_PROMPT: ${{ runner.temp }}/gh-aw/aw-prompts/prompt.txt\n GH_AW_SAFE_OUTPUTS: ${{ runner.temp }}/gh-aw/safeoutputs/outputs.jsonl\n GH_AW_PROMPT_CONFIG: \"{\\\"items\\\":[{\\\"content_env\\\":\\\"GH_AW_PROMPT_CONTENT_0000\\\"},{\\\"file\\\":\\\"xpia.md\\\"},{\\\"file\\\":\\\"temp_folder_prompt.md\\\"},{\\\"file\\\":\\\"markdown.md\\\"},{\\\"file\\\":\\\"safe_outputs_prompt.md\\\"},{\\\"content_env\\\":\\\"GH_AW_PROMPT_CONTENT_0001\\\"},{\\\"content_env\\\":\\\"GH_AW_PROMPT_CONTENT_0002\\\"},{\\\"file\\\":\\\"mcp_cli_tools_prompt.md\\\"},{\\\"content_env\\\":\\\"GH_AW_PROMPT_CONTENT_0003\\\"},{\\\"file\\\":\\\"github_mcp_tools_with_safeoutputs_prompt.md\\\"},{\\\"content_env\\\":\\\"GH_AW_PROMPT_CONTENT_0004\\\"},{\\\"content_env\\\":\\\"GH_AW_PROMPT_CONTENT_0005\\\"}]}\"\n GH_AW_EXPR_1A3A194A: ${{ github.event.discussion.number || (fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_type == 'discussion' && fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_number) }}\n GH_AW_EXPR_463A214A: ${{ github.event.pull_request.number || (fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_type == 'pull_request' && fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_number) }}\n GH_AW_EXPR_802A9F6A: ${{ github.event.issue.number || (fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_type == 'issue' && fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_number) }}\n GH_AW_EXPR_FF1D34CE: ${{ github.event.comment.id || fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').comment_id }}\n GH_AW_GITHUB_ACTOR: ${{ github.actor }}\n GH_AW_GITHUB_REPOSITORY: ${{ github.repository }}\n GH_AW_GITHUB_RUN_ID: ${{ github.run_id }}\n GH_AW_GITHUB_WORKSPACE: ${{ github.workspace }}\n GH_AW_NEEDS_SELECT_OUTPUTS_CANDIDATES: ${{ needs.select.outputs.candidates }}\n GH_AW_PROMPT_CONTENT_0000: \"\\n\"\n GH_AW_PROMPT_CONTENT_0001: \"\\nTools: add_comment(max:5), add_labels(max:5), remove_labels(max:5), missing_tool, missing_data, noop\\n\"\n GH_AW_PROMPT_CONTENT_0002: \"\\n\"\n GH_AW_PROMPT_CONTENT_0003: \"\\nThe following GitHub context information is available for this workflow:\\n{{#if github.actor}}\\n- **actor**: __GH_AW_GITHUB_ACTOR__\\n{{/if}}\\n{{#if github.repository}}\\n- **repository**: __GH_AW_GITHUB_REPOSITORY__\\n{{/if}}\\n{{#if github.workspace}}\\n- **workspace**: __GH_AW_GITHUB_WORKSPACE__\\n{{/if}}\\n{{#if github.event.issue.number || (github.aw.context.item_type == 'issue' && github.aw.context.item_number)}}\\n- **issue-number**: #__GH_AW_EXPR_802A9F6A__\\n{{/if}}\\n{{#if github.event.discussion.number || (github.aw.context.item_type == 'discussion' && github.aw.context.item_number)}}\\n- **discussion-number**: #__GH_AW_EXPR_1A3A194A__\\n{{/if}}\\n{{#if github.event.pull_request.number || (github.aw.context.item_type == 'pull_request' && github.aw.context.item_number)}}\\n- **pull-request-number**: #__GH_AW_EXPR_463A214A__\\n{{/if}}\\n{{#if github.event.comment.id || github.aw.context.comment_id}}\\n- **comment-id**: __GH_AW_EXPR_FF1D34CE__\\n{{/if}}\\n{{#if github.run_id}}\\n- **workflow-run-id**: __GH_AW_GITHUB_RUN_ID__\\n{{/if}}\\n\\n\\n\"\n GH_AW_PROMPT_CONTENT_0004: \"\\n\"\n GH_AW_PROMPT_CONTENT_0005: \"{{#runtime-import .github/workflows/issue-triage.md}}\\n\"\n with:\n script: |\n const { setupGlobals } = require(process.env.GH_AW_ACTIONS_DIR + '/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require(process.env.GH_AW_ACTIONS_DIR + '/create_prompt.cjs');\n await main(core);\n - name: Interpolate variables and render templates\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n env:\n GH_AW_PROMPT: ${{ runner.temp }}/gh-aw/aw-prompts/prompt.txt\n GH_AW_ENGINE_ID: \"codex\"\n GH_AW_NEEDS_SELECT_OUTPUTS_CANDIDATES: ${{ needs.select.outputs.candidates }}\n with:\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/interpolate_prompt.cjs');\n await main();\n - name: Substitute placeholders\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n env:\n GH_AW_PROMPT: ${{ runner.temp }}/gh-aw/aw-prompts/prompt.txt\n GH_AW_EXPR_1A3A194A: ${{ github.event.discussion.number || (fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_type == 'discussion' && fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_number) }}\n GH_AW_EXPR_463A214A: ${{ github.event.pull_request.number || (fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_type == 'pull_request' && fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_number) }}\n GH_AW_EXPR_802A9F6A: ${{ github.event.issue.number || (fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_type == 'issue' && fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_number) }}\n GH_AW_EXPR_FF1D34CE: ${{ github.event.comment.id || fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').comment_id }}\n GH_AW_GITHUB_ACTOR: ${{ github.actor }}\n GH_AW_GITHUB_REPOSITORY: ${{ github.repository }}\n GH_AW_GITHUB_RUN_ID: ${{ github.run_id }}\n GH_AW_GITHUB_WORKSPACE: ${{ github.workspace }}\n GH_AW_MCP_CLI_SERVERS_LIST: '- `safeoutputs` — run `safeoutputs --help` to see available tools'\n GH_AW_NEEDS_PRE_ACTIVATION_OUTPUTS_ACTIVATED: ${{ needs.pre_activation.outputs.activated }}\n GH_AW_NEEDS_SELECT_OUTPUTS_CANDIDATES: ${{ needs.select.outputs.candidates }}\n with:\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n\n const substitutePlaceholders = require('${{ runner.temp }}/gh-aw/actions/substitute_placeholders.cjs');\n\n // Call the substitution function\n return await substitutePlaceholders({\n file: process.env.GH_AW_PROMPT,\n substitutions: {\n GH_AW_EXPR_1A3A194A: process.env.GH_AW_EXPR_1A3A194A,\n GH_AW_EXPR_463A214A: process.env.GH_AW_EXPR_463A214A,\n GH_AW_EXPR_802A9F6A: process.env.GH_AW_EXPR_802A9F6A,\n GH_AW_EXPR_FF1D34CE: process.env.GH_AW_EXPR_FF1D34CE,\n GH_AW_GITHUB_ACTOR: process.env.GH_AW_GITHUB_ACTOR,\n GH_AW_GITHUB_REPOSITORY: process.env.GH_AW_GITHUB_REPOSITORY,\n GH_AW_GITHUB_RUN_ID: process.env.GH_AW_GITHUB_RUN_ID,\n GH_AW_GITHUB_WORKSPACE: process.env.GH_AW_GITHUB_WORKSPACE,\n GH_AW_MCP_CLI_SERVERS_LIST: process.env.GH_AW_MCP_CLI_SERVERS_LIST,\n GH_AW_NEEDS_PRE_ACTIVATION_OUTPUTS_ACTIVATED: process.env.GH_AW_NEEDS_PRE_ACTIVATION_OUTPUTS_ACTIVATED,\n GH_AW_NEEDS_SELECT_OUTPUTS_CANDIDATES: process.env.GH_AW_NEEDS_SELECT_OUTPUTS_CANDIDATES\n }\n });\n - name: Validate prompt placeholders\n env:\n GH_AW_PROMPT: ${{ runner.temp }}/gh-aw/aw-prompts/prompt.txt\n run: |\n bash \"${RUNNER_TEMP}/gh-aw/actions/validate_prompt_placeholders.sh\"\n - name: Print prompt\n env:\n GH_AW_PROMPT: ${{ runner.temp }}/gh-aw/aw-prompts/prompt.txt\n run: |\n bash \"${RUNNER_TEMP}/gh-aw/actions/print_prompt_summary.sh\"\n - name: Stage prompt files for artifact upload\n run: |\n mkdir -p /tmp/gh-aw/aw-prompts\n cp -a \"${RUNNER_TEMP}/gh-aw/aw-prompts/.\" /tmp/gh-aw/aw-prompts/\n - name: Upload activation artifact\n if: success()\n uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1\n with:\n name: activation\n include-hidden-files: true\n path: |\n /tmp/gh-aw/aw_info.json\n /tmp/gh-aw/models.json\n /tmp/gh-aw/aw-prompts/prompt.txt\n /tmp/gh-aw/aw-prompts/prompt-template.txt\n /tmp/gh-aw/aw-prompts/prompt-import-tree.json\n /tmp/gh-aw/github_rate_limits.jsonl\n /tmp/gh-aw/base\n /tmp/gh-aw/.codex/agents\n /tmp/gh-aw/.codex/skills\n if-no-files-found: ignore\n retention-days: 1\n\n agent:\n needs:\n - activation\n - select\n if: (needs.select.outputs.has_candidates == 'true') && (needs.activation.outputs.daily_ai_credits_exceeded != 'true')\n runs-on: ubuntu-latest\n permissions:\n contents: read\n issues: read\n pull-requests: read\n concurrency:\n group: \"gh-aw-codex-${{ github.workflow }}\"\n queue: max\n env:\n DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}\n GH_AW_ASSETS_ALLOWED_EXTS: \"\"\n GH_AW_ASSETS_BRANCH: \"\"\n GH_AW_ASSETS_MAX_SIZE_KB: 0\n GH_AW_MCP_LOG_DIR: /tmp/gh-aw/mcp-logs/safeoutputs\n GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }}\n GH_AW_WORKFLOW_ID_SANITIZED: issuetriage\n outputs:\n agentic_engine_timeout: ${{ steps.detect-agent-errors.outputs.agentic_engine_timeout || 'false' }}\n ai_credits_rate_limit_error: ${{ steps.parse-mcp-gateway.outputs.ai_credits_rate_limit_error || 'false' }}\n aic: ${{ steps.parse-mcp-gateway.outputs.aic }}\n ambient_context: ${{ steps.parse-mcp-gateway.outputs.ambient_context }}\n effective_tokens: ${{ steps.parse-mcp-gateway.outputs.effective_tokens }}\n has_patch: ${{ steps.collect_output.outputs.has_patch }}\n http_400_response_error: ${{ steps.detect-agent-errors.outputs.http_400_response_error || 'false' }}\n inference_access_error: ${{ steps.detect-agent-errors.outputs.inference_access_error || 'false' }}\n invocation_cap_exceeded: ${{ steps.detect-agent-errors.outputs.invocation_cap_exceeded || 'false' }}\n max_cache_misses_exceeded: ${{ steps.detect-agent-errors.outputs.max_cache_misses_exceeded || 'false' }}\n mcp_policy_error: ${{ steps.detect-agent-errors.outputs.mcp_policy_error || 'false' }}\n missing_model_pricing_error: ${{ steps.detect-agent-errors.outputs.missing_model_pricing_error || 'false' }}\n missing_model_pricing_model_name: ${{ steps.detect-agent-errors.outputs.missing_model_pricing_model_name || '' }}\n model: ${{ needs.activation.outputs.model }}\n model_not_supported_error: ${{ steps.detect-agent-errors.outputs.model_not_supported_error || 'false' }}\n output: ${{ steps.collect_output.outputs.output }}\n output_types: ${{ steps.collect_output.outputs.output_types }}\n setup-parent-span-id: ${{ steps.setup.outputs.parent-span-id || steps.setup.outputs.span-id }}\n setup-span-id: ${{ steps.setup.outputs.span-id }}\n setup-trace-id: ${{ steps.setup.outputs.trace-id }}\n unknown_model_ai_credits: ${{ steps.parse-mcp-gateway.outputs.unknown_model_ai_credits || 'false' }}\n steps:\n - name: Setup Scripts\n id: setup\n uses: github/gh-aw-actions/setup@6aab9e5b5c91c615506061f09bedd81a23babe3c # v0.86.2\n with:\n destination: ${{ runner.temp }}/gh-aw/actions\n job-name: ${{ github.job }}\n trace-id: ${{ needs.activation.outputs.setup-trace-id }}\n parent-span-id: ${{ needs.activation.outputs.setup-parent-span-id || needs.activation.outputs.setup-span-id }}\n env:\n GH_AW_SETUP_WORKFLOW_NAME: \"Issue triage\"\n GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/issue-triage.lock.yml@${{ github.ref }}\n GH_AW_INFO_VERSION: \"0.147.0\"\n GH_AW_INFO_AWF_VERSION: \"v0.27.44\"\n GH_AW_INFO_ENGINE_ID: \"codex\"\n - name: Set runtime paths\n id: set-runtime-paths\n run: |\n {\n echo \"GH_AW_SAFE_OUTPUTS=${RUNNER_TEMP}/gh-aw/safeoutputs/outputs.jsonl\"\n echo \"GH_AW_SAFE_OUTPUTS_CONFIG_PATH=${RUNNER_TEMP}/gh-aw/safeoutputs/config.json\"\n echo \"GH_AW_SAFE_OUTPUTS_TOOLS_PATH=${RUNNER_TEMP}/gh-aw/safeoutputs/tools.json\"\n } >> \"$GITHUB_OUTPUT\"\n - name: Setup Node.js\n uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0\n with:\n node-version: '24'\n package-manager-cache: false\n - name: Create gh-aw temp directory\n run: bash \"${RUNNER_TEMP}/gh-aw/actions/create_gh_aw_tmp_dir.sh\"\n - name: Configure gh CLI for GitHub Enterprise\n run: bash \"${RUNNER_TEMP}/gh-aw/actions/configure_gh_for_ghe.sh\"\n env:\n GH_TOKEN: ${{ github.token }}\n - name: Download activation artifact\n uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1\n with:\n name: activation\n path: /tmp/gh-aw\n - name: Use MCP safe-output instructions\n run: \"node --input-type=module <<'JS'\\nimport { readFileSync, writeFileSync } from \\\"node:fs\\\";\\nlet path = \\\"/tmp/gh-aw/aw-prompts/prompt.txt\\\";\\nlet prompt = readFileSync(path, \\\"utf8\\\");\\nprompt = prompt.replace(\\n /[\\\\s\\\\S]*?<\\\\/mcp-clis>/g,\\n \\\"Use safeoutputs MCP tools directly. Shell access is disabled.\\\",\\n);\\nprompt = prompt.replace(\\n \\\"Use the `safeoutputs` CLI tool for GitHub writes and completion signaling — CLI commands required.\\\",\\n \\\"Use the safeoutputs MCP tools for GitHub writes and completion signaling.\\\",\\n);\\nprompt = prompt.replace(\\n /\\\\*\\\\*Note\\\\*\\\\*: safeoutputs tools[^\\\\n]*/g,\\n \\\"Provide safeoutputs MCP arguments inline; do not use file references or shell commands.\\\",\\n);\\nif (prompt.includes(\\\"CLI commands required\\\") || prompt.includes(\\\"\\\")) {\\n throw new Error(\\\"Unexpected CLI-only safe-output instructions\\\");\\n}\\nwriteFileSync(path, prompt);\\nJS\"\n\n - name: Setup Node.js\n uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0\n with:\n node-version: '24'\n package-manager-cache: false\n - name: Install Codex CLI\n run: npm install --ignore-scripts -g @openai/codex@0.147.0\n - name: Install AWF binary\n run: bash \"${RUNNER_TEMP}/gh-aw/actions/install_awf_binary.sh\" v0.27.44 --rootless\n - name: Determine automatic lockdown mode for GitHub MCP Server\n id: determine-automatic-lockdown\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 (source v9)\n env:\n GH_AW_GITHUB_TOKEN: ${{ secrets.GH_AW_GITHUB_TOKEN }}\n GH_AW_GITHUB_MCP_SERVER_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN }}\n GH_AW_GITHUB_MIN_INTEGRITY: 'none'\n GH_AW_GITHUB_REPOS: '[\"githubnext/chopin\"]'\n with:\n script: |\n const determineAutomaticLockdown = require('${{ runner.temp }}/gh-aw/actions/determine_automatic_lockdown.cjs');\n await determineAutomaticLockdown(github, context, core);\n - name: Parse integrity filter lists\n id: parse-guard-vars\n env:\n GH_AW_BLOCKED_USERS_VAR: ${{ vars.GH_AW_GITHUB_BLOCKED_USERS || '' }}\n GH_AW_TRUSTED_USERS_VAR: ${{ vars.GH_AW_GITHUB_TRUSTED_USERS || '' }}\n GH_AW_APPROVAL_LABELS_VAR: ${{ vars.GH_AW_GITHUB_APPROVAL_LABELS || '' }}\n run: bash \"${RUNNER_TEMP}/gh-aw/actions/parse_guard_list.sh\"\n - name: Restore inline sub-agents from activation artifact\n env:\n GH_AW_SUB_AGENT_DIR: \".codex/agents\"\n GH_AW_SUB_AGENT_EXT: \".md\"\n run: bash \"${RUNNER_TEMP}/gh-aw/actions/restore_inline_sub_agents.sh\"\n - name: Restore inline skills from activation artifact\n env:\n GH_AW_SKILL_DIR: \".codex/skills\"\n run: bash \"${RUNNER_TEMP}/gh-aw/actions/restore_inline_skills.sh\"\n - name: Download container images\n run: bash \"${RUNNER_TEMP}/gh-aw/actions/download_docker_images.sh\" ghcr.io/github/gh-aw-firewall/agent:0.27.44@sha256:0d727725c737b58c7bdf51f640cffb928385ec46517e0917c7f1a02f1bada8b4 ghcr.io/github/gh-aw-firewall/api-proxy:0.27.44@sha256:b50fbadba138f6e9aba94aca09711335c489bb3b15861220cb66f6092e042dc7 ghcr.io/github/gh-aw-firewall/squid:0.27.44@sha256:83e48bbe12c634be8c228a576832fe45f66c529ac3659db92bddbcf2eeb6d627 ghcr.io/github/gh-aw-mcpg:v0.4.9@sha256:e5a1569aeaf41820fa7bdee3e94468cae448133cdbf00119ad24f5b74db1ab9f ghcr.io/github/gh-aw-node@sha256:0d9f1fb5fd6610c0ac1f5194a38e45a8a1e81f8a390d5142d8e4e6f26a4b3196 ghcr.io/github/github-mcp-server:v1.9.0@sha256:881b53d6f75f69bdbc1b5b10fc2f1361717c19054143b3a8529fb5c32061a50e\n - name: Generate Safe Outputs Config\n run: |\n mkdir -p \"${RUNNER_TEMP}/gh-aw/safeoutputs\"\n mkdir -p /tmp/gh-aw/safeoutputs\n mkdir -p /tmp/gh-aw/mcp-logs/safeoutputs\n cat > \"${RUNNER_TEMP}/gh-aw/safeoutputs/config.json\" << 'GH_AW_SAFE_OUTPUTS_CONFIG_d33038d8d87097c1_EOF'\n {\"add_comment\":{\"max\":5,\"target\":\"*\"},\"add_labels\":{\"allowed\":[\"triage/agent-candidate\",\"triage/human-response\",\"triage/needs-info\",\"triage/backlog-note\",\"bug\",\"enhancement\",\"documentation\",\"question\",\"duplicate\"],\"max\":5,\"target\":\"*\"},\"create_report_incomplete_issue\":{},\"missing_data\":{},\"missing_tool\":{},\"noop\":{\"max\":1,\"report-as-issue\":\"false\"},\"remove_labels\":{\"allowed\":[\"triage/agent-candidate\",\"triage/human-response\",\"triage/needs-info\",\"triage/backlog-note\"],\"max\":5,\"target\":\"*\"},\"report_incomplete\":{}}\n GH_AW_SAFE_OUTPUTS_CONFIG_d33038d8d87097c1_EOF\n - name: Generate Safe Outputs Tools\n env:\n GH_AW_TOOLS_META_JSON: |\n {\n \"description_suffixes\": {\n \"add_comment\": \" CONSTRAINTS: Maximum 5 comment(s) can be added. Target: *. Supports reply_to_id for discussion threading.\",\n \"add_labels\": \" CONSTRAINTS: Maximum 5 label(s) can be added. Only these labels are allowed: [\\\"triage/agent-candidate\\\" \\\"triage/human-response\\\" \\\"triage/needs-info\\\" \\\"triage/backlog-note\\\" \\\"bug\\\" \\\"enhancement\\\" \\\"documentation\\\" \\\"question\\\" \\\"duplicate\\\"]. Target: *.\",\n \"remove_labels\": \" CONSTRAINTS: Maximum 5 label(s) can be removed. Only these labels can be removed: [triage/agent-candidate triage/human-response triage/needs-info triage/backlog-note]. Target: *.\"\n },\n \"repo_params\": {},\n \"dynamic_tools\": []\n }\n GH_AW_VALIDATION_JSON: |\n {\n \"add_comment\": {\n \"defaultMax\": 1,\n \"fields\": {\n \"body\": {\n \"required\": true,\n \"type\": \"string\",\n \"sanitize\": true,\n \"maxLength\": 65000\n },\n \"comment_id\": {\n \"optionalPositiveInteger\": true\n },\n \"item_number\": {\n \"issueOrPRNumber\": true\n },\n \"pr\": {\n \"issueOrPRNumber\": true\n },\n \"pr_number\": {\n \"issueOrPRNumber\": true\n },\n \"reply_to_id\": {\n \"type\": \"string\",\n \"maxLength\": 256\n },\n \"repo\": {\n \"type\": \"string\",\n \"maxLength\": 256\n },\n \"target\": {\n \"type\": \"string\",\n \"enum\": [\n \"status\"\n ]\n },\n \"temporary_id\": {\n \"type\": \"string\",\n \"pattern\": \"^#?aw_[A-Za-z0-9_]{3,12}$\"\n }\n }\n },\n \"add_labels\": {\n \"defaultMax\": 5,\n \"fields\": {\n \"item_number\": {\n \"issueNumberOrTemporaryId\": true\n },\n \"labels\": {\n \"required\": true,\n \"type\": \"array\"\n },\n \"repo\": {\n \"type\": \"string\",\n \"maxLength\": 256\n }\n }\n },\n \"missing_data\": {\n \"defaultMax\": 20,\n \"fields\": {\n \"alternatives\": {\n \"type\": \"string\",\n \"sanitize\": true,\n \"maxLength\": 256\n },\n \"context\": {\n \"type\": \"string\",\n \"sanitize\": true,\n \"maxLength\": 256\n },\n \"data_type\": {\n \"type\": \"string\",\n \"sanitize\": true,\n \"maxLength\": 128\n },\n \"reason\": {\n \"type\": \"string\",\n \"sanitize\": true,\n \"maxLength\": 256\n }\n }\n },\n \"missing_tool\": {\n \"defaultMax\": 20,\n \"fields\": {\n \"alternatives\": {\n \"type\": \"string\",\n \"sanitize\": true,\n \"maxLength\": 512\n },\n \"reason\": {\n \"required\": true,\n \"type\": \"string\",\n \"sanitize\": true,\n \"maxLength\": 256\n },\n \"tool\": {\n \"type\": \"string\",\n \"sanitize\": true,\n \"maxLength\": 128\n }\n }\n },\n \"noop\": {\n \"defaultMax\": 1,\n \"fields\": {\n \"message\": {\n \"required\": true,\n \"type\": \"string\",\n \"sanitize\": true,\n \"maxLength\": 65000\n }\n }\n },\n \"remove_labels\": {\n \"defaultMax\": 5,\n \"fields\": {\n \"item_number\": {\n \"issueNumberOrTemporaryId\": true\n },\n \"labels\": {\n \"required\": true,\n \"type\": \"array\"\n },\n \"repo\": {\n \"type\": \"string\",\n \"maxLength\": 256\n }\n }\n },\n \"report_incomplete\": {\n \"defaultMax\": 5,\n \"fields\": {\n \"details\": {\n \"type\": \"string\",\n \"sanitize\": true,\n \"maxLength\": 65000\n },\n \"reason\": {\n \"required\": true,\n \"type\": \"string\",\n \"sanitize\": true,\n \"maxLength\": 1024\n }\n }\n }\n }\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n with:\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/generate_safe_outputs_tools.cjs');\n await main();\n - name: Start MCP Gateway\n id: start-mcp-gateway\n env:\n CODEX_HOME: /tmp/gh-aw/mcp-config\n GH_AW_POLICY_ALLOW_CREATE_PULL_REQUEST: ${{ vars.GH_AW_POLICY_ALLOW_CREATE_PULL_REQUEST || 'true' }}\n GH_AW_SAFE_OUTPUTS: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS }}\n GH_AW_SAFE_OUTPUTS_CONFIG_PATH: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS_CONFIG_PATH }}\n GH_AW_SAFE_OUTPUTS_TOOLS_PATH: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS_TOOLS_PATH }}\n GH_AW_SINK_VISIBILITY: ${{ steps.determine-automatic-lockdown.outputs.visibility }}\n GITHUB_MCP_SERVER_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}\n GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}\n run: |\n set -eo pipefail\n mkdir -p \"${RUNNER_TEMP}/gh-aw/mcp-config\"\n\n # Export gateway environment variables for MCP config and gateway script\n export MCP_GATEWAY_PORT=\"8080\"\n export MCP_GATEWAY_DOMAIN=\"awmg-mcpg\"\n export MCP_GATEWAY_HOST_DOMAIN=\"localhost\"\n MCP_GATEWAY_API_KEY=$(openssl rand -base64 45 | tr -d '/+=')\n echo \"::add-mask::${MCP_GATEWAY_API_KEY}\"\n export MCP_GATEWAY_API_KEY\n export MCP_GATEWAY_PAYLOAD_DIR=\"/tmp/gh-aw/mcp-payloads\"\n mkdir -p \"${MCP_GATEWAY_PAYLOAD_DIR}\"\n export MCP_GATEWAY_PAYLOAD_SIZE_THRESHOLD=\"524288\"\n export MCP_GATEWAY_ALLOWED_MOUNT_ROOTS=\"${GITHUB_WORKSPACE}:rw,${RUNNER_TEMP}/gh-aw:ro,${RUNNER_TEMP}/gh-aw/safeoutputs:rw,/opt:ro,/tmp:rw,/usr/bin/gh:ro\"\n export DEBUG=\"*\"\n\n export GH_AW_ENGINE=\"codex\"\n MCP_GATEWAY_UID=$(id -u 2>/dev/null || echo '0')\n MCP_GATEWAY_GID=$(id -g 2>/dev/null || echo '0')\n source \"${RUNNER_TEMP}/gh-aw/actions/resolve_docker_socket_gid.sh\"\n export MCP_GATEWAY_DOCKER_COMMAND='docker run -i --rm --network bridge -p 127.0.0.1:'\"${MCP_GATEWAY_PORT}\"':'\"${MCP_GATEWAY_PORT}\"' --name awmg-mcpg --add-host host.docker.internal:host-gateway --user '\"${MCP_GATEWAY_UID}\"':'\"${MCP_GATEWAY_GID}\"' --group-add '\"${DOCKER_SOCK_GID}\"' -v '\"${DOCKER_SOCK_PATH}\"':/var/run/docker.sock -e MCP_GATEWAY_PORT -e MCP_GATEWAY_DOMAIN -e MCP_GATEWAY_API_KEY -e MCP_GATEWAY_PAYLOAD_DIR -e MCP_GATEWAY_PAYLOAD_SIZE_THRESHOLD -e DOCKER_HOST=unix:///var/run/docker.sock -e DEBUG -e MCP_GATEWAY_LOG_DIR -e GH_AW_MCP_LOG_DIR -e GH_AW_SAFE_OUTPUTS -e GH_AW_SAFE_OUTPUTS_CONFIG_PATH -e GH_AW_SAFE_OUTPUTS_TOOLS_PATH -e GH_AW_POLICY_ALLOW_CREATE_PULL_REQUEST -e GH_AW_ASSETS_BRANCH -e GH_AW_ASSETS_MAX_SIZE_KB -e GH_AW_ASSETS_ALLOWED_EXTS -e DEFAULT_BRANCH -e GITHUB_MCP_SERVER_TOKEN -e GITHUB_MCP_GUARD_MIN_INTEGRITY -e GITHUB_MCP_GUARD_REPOS -e GH_AW_SINK_VISIBILITY -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e GITHUB_SHA -e GITHUB_WORKSPACE -e GITHUB_TOKEN -e GITHUB_RUN_ID -e GITHUB_RUN_NUMBER -e GITHUB_RUN_ATTEMPT -e GITHUB_JOB -e GITHUB_ACTION -e GITHUB_EVENT_NAME -e GITHUB_EVENT_PATH -e GITHUB_ACTOR -e GITHUB_ACTOR_ID -e GITHUB_TRIGGERING_ACTOR -e GITHUB_WORKFLOW -e GITHUB_WORKFLOW_REF -e GITHUB_WORKFLOW_SHA -e GITHUB_REF -e GITHUB_REF_NAME -e GITHUB_REF_TYPE -e GITHUB_HEAD_REF -e GITHUB_BASE_REF -e RUNNER_TEMP -e MCP_GATEWAY_ALLOWED_MOUNT_ROOTS -e CODEX_HOME -v /tmp/gh-aw/mcp-payloads:/tmp/gh-aw/mcp-payloads:rw -v /opt:/opt:ro -v /tmp:/tmp:rw -v '\"${GITHUB_WORKSPACE}\"':'\"${GITHUB_WORKSPACE}\"':rw -v '\"${RUNNER_TEMP}\"'/gh-aw/safeoutputs:'\"${RUNNER_TEMP}\"'/gh-aw/safeoutputs:rw ghcr.io/github/gh-aw-mcpg:v0.4.9'\n\n cat > \"${RUNNER_TEMP}/gh-aw/mcp-config/config.toml\" << GH_AW_MCP_CONFIG_dc1c9a1458f8b0da_EOF\n [history]\n persistence = \"none\"\n\n [shell_environment_policy]\n inherit = \"core\"\n include_only = [\"^CODEX_API_KEY$\", \"^GH_AW_ASSETS_ALLOWED_EXTS$\", \"^GH_AW_ASSETS_BRANCH$\", \"^GH_AW_ASSETS_MAX_SIZE_KB$\", \"^GH_AW_SAFE_OUTPUTS$\", \"^GITHUB_PERSONAL_ACCESS_TOKEN$\", \"^GITHUB_REPOSITORY$\", \"^GITHUB_SERVER_URL$\", \"^HOME$\", \"^OPENAI_API_KEY$\", \"^PATH$\"]\n\n [mcp_servers.github]\n user_agent = \"issue-triage\"\n startup_timeout_sec = 120\n tool_timeout_sec = 60\n container = \"ghcr.io/github/github-mcp-server:v1.9.0\"\n env = { \"GITHUB_FEATURES\" = \"fields_param\", \"GITHUB_HOST\" = \"$GITHUB_SERVER_URL\", \"GITHUB_PERSONAL_ACCESS_TOKEN\" = \"$GH_AW_GITHUB_TOKEN\", \"GITHUB_READ_ONLY\" = \"1\", \"GITHUB_TOOLSETS\" = \"repos,issues,labels,pull_requests\" }\n env_vars = [\"GITHUB_FEATURES\", \"GITHUB_HOST\", \"GITHUB_PERSONAL_ACCESS_TOKEN\", \"GITHUB_READ_ONLY\", \"GITHUB_TOOLSETS\"]\n\n [mcp_servers.safeoutputs]\n container = \"ghcr.io/github/gh-aw-node\"\n mounts = [\"\\${GITHUB_WORKSPACE}:\\${GITHUB_WORKSPACE}:rw\", \"${RUNNER_TEMP}/gh-aw/safeoutputs:${RUNNER_TEMP}/gh-aw/safeoutputs:rw\", \"/tmp/gh-aw:/tmp/gh-aw:rw\"]\n args = [\"-w\", \"$GITHUB_WORKSPACE\"]\n entrypoint = \"sh\"\n entrypointArgs = [\"-c\", \"sh ${RUNNER_TEMP}/gh-aw/safeoutputs/start_safe_outputs_mcp.sh\"]\n env_vars = [\"DEBUG\", \"DEFAULT_BRANCH\", \"GH_AW_ASSETS_ALLOWED_EXTS\", \"GH_AW_ASSETS_BRANCH\", \"GH_AW_ASSETS_MAX_SIZE_KB\", \"GH_AW_MCP_LOG_DIR\", \"GH_AW_SAFE_OUTPUTS\", \"GH_AW_SAFE_OUTPUTS_CONFIG_PATH\", \"GH_AW_SAFE_OUTPUTS_TOOLS_PATH\", \"GH_AW_POLICY_ALLOW_CREATE_PULL_REQUEST\", \"GITHUB_REPOSITORY\", \"GITHUB_SHA\", \"GITHUB_TOKEN\", \"GITHUB_WORKSPACE\", \"RUNNER_TEMP\"]\n\n [mcp_servers.safeoutputs.\"guard-policies\"]\n\n [mcp_servers.safeoutputs.\"guard-policies\".write-sink]\n accept = [\"private:githubnext/chopin\"]\n sink-visibility = \"${GH_AW_SINK_VISIBILITY}\"\n GH_AW_MCP_CONFIG_dc1c9a1458f8b0da_EOF\n\n # Generate JSON config for MCP gateway\n GH_AW_NODE=$(which node 2>/dev/null || command -v node 2>/dev/null || echo node)\n cat << GH_AW_MCP_CONFIG_8b05fce9d46ef4f9_EOF | \"$GH_AW_NODE\" \"${RUNNER_TEMP}/gh-aw/actions/start_mcp_gateway.cjs\"\n {\n \"mcpServers\": {\n \"github\": {\n \"container\": \"ghcr.io/github/github-mcp-server:v1.9.0\",\n \"env\": {\n \"GITHUB_FEATURES\": \"fields_param\",\n \"GITHUB_HOST\": \"$GITHUB_SERVER_URL\",\n \"GITHUB_PERSONAL_ACCESS_TOKEN\": \"$GITHUB_MCP_SERVER_TOKEN\",\n \"GITHUB_READ_ONLY\": \"1\",\n \"GITHUB_TOOLSETS\": \"repos,issues,labels,pull_requests\"\n },\n \"guard-policies\": {\n \"allow-only\": {\n \"approval-labels\": ${{ steps.parse-guard-vars.outputs.approval_labels }},\n \"blocked-users\": ${{ steps.parse-guard-vars.outputs.blocked_users }},\n \"min-integrity\": \"none\",\n \"repos\": [\n \"githubnext/chopin\"\n ],\n \"trusted-users\": ${{ steps.parse-guard-vars.outputs.trusted_users }}\n }\n }\n },\n \"safeoutputs\": {\n \"container\": \"ghcr.io/github/gh-aw-node\",\n \"mounts\": [\"\\${GITHUB_WORKSPACE}:\\${GITHUB_WORKSPACE}:rw\", \"${RUNNER_TEMP}/gh-aw/safeoutputs:${RUNNER_TEMP}/gh-aw/safeoutputs:rw\", \"/tmp/gh-aw:/tmp/gh-aw:rw\"],\n \"args\": [\"-w\", \"\\${GITHUB_WORKSPACE}\"],\n \"entrypoint\": \"sh\",\n \"entrypointArgs\": [\"-c\", \"sh ${RUNNER_TEMP}/gh-aw/safeoutputs/start_safe_outputs_mcp.sh\"],\n \"env\": {\n \"DEBUG\": \"*\",\n \"DEFAULT_BRANCH\": \"\\${DEFAULT_BRANCH}\",\n \"GH_AW_ASSETS_ALLOWED_EXTS\": \"\\${GH_AW_ASSETS_ALLOWED_EXTS}\",\n \"GH_AW_ASSETS_BRANCH\": \"\\${GH_AW_ASSETS_BRANCH}\",\n \"GH_AW_ASSETS_MAX_SIZE_KB\": \"\\${GH_AW_ASSETS_MAX_SIZE_KB}\",\n \"GH_AW_MCP_LOG_DIR\": \"\\${GH_AW_MCP_LOG_DIR}\",\n \"GH_AW_SAFE_OUTPUTS\": \"\\${GH_AW_SAFE_OUTPUTS}\",\n \"GH_AW_SAFE_OUTPUTS_CONFIG_PATH\": \"\\${GH_AW_SAFE_OUTPUTS_CONFIG_PATH}\",\n \"GH_AW_SAFE_OUTPUTS_TOOLS_PATH\": \"\\${GH_AW_SAFE_OUTPUTS_TOOLS_PATH}\",\n \"GH_AW_POLICY_ALLOW_CREATE_PULL_REQUEST\": \"\\${GH_AW_POLICY_ALLOW_CREATE_PULL_REQUEST}\",\n \"GITHUB_REPOSITORY\": \"\\${GITHUB_REPOSITORY}\",\n \"GITHUB_SHA\": \"\\${GITHUB_SHA}\",\n \"GITHUB_TOKEN\": \"\\${GITHUB_TOKEN}\",\n \"GITHUB_WORKSPACE\": \"\\${GITHUB_WORKSPACE}\",\n \"RUNNER_TEMP\": \"\\${RUNNER_TEMP}\"\n },\n \"guard-policies\": {\n \"write-sink\": {\n \"accept\": [\n \"private:githubnext/chopin\"\n ],\n \"sink-visibility\": \"${GH_AW_SINK_VISIBILITY}\"\n }\n }\n }\n },\n \"gateway\": {\n \"port\": $MCP_GATEWAY_PORT,\n \"domain\": \"${MCP_GATEWAY_DOMAIN}\",\n \"apiKey\": \"${MCP_GATEWAY_API_KEY}\",\n \"payloadDir\": \"${MCP_GATEWAY_PAYLOAD_DIR}\",\n \"startupTimeout\": 120\n }\n }\n GH_AW_MCP_CONFIG_8b05fce9d46ef4f9_EOF\n\n # Sync converter output to writable CODEX_HOME for Codex\n mkdir -p /tmp/gh-aw/mcp-config\n cat > \"/tmp/gh-aw/mcp-config/config.toml\" << GH_AW_CODEX_SHELL_POLICY_47d4538748fe3213_EOF\n\n model_provider = \"openai-proxy\"\n\n [model_providers.openai-proxy]\n name = \"OpenAI AWF proxy\"\n base_url = \"http://172.30.0.30:10000\"\n env_key = \"OPENAI_API_KEY\"\n supports_websockets = false\n [shell_environment_policy]\n inherit = \"core\"\n include_only = [\"^CODEX_API_KEY$\", \"^GH_AW_ASSETS_ALLOWED_EXTS$\", \"^GH_AW_ASSETS_BRANCH$\", \"^GH_AW_ASSETS_MAX_SIZE_KB$\", \"^GH_AW_SAFE_OUTPUTS$\", \"^GITHUB_PERSONAL_ACCESS_TOKEN$\", \"^GITHUB_REPOSITORY$\", \"^GITHUB_SERVER_URL$\", \"^HOME$\", \"^OPENAI_API_KEY$\", \"^PATH$\"]\n GH_AW_CODEX_SHELL_POLICY_47d4538748fe3213_EOF\n awk '\n BEGIN { skip_openai_proxy = 0 }\n /^[[:space:]]*model_provider[[:space:]]*=/ { next }\n /^\\[model_providers\\.openai-proxy\\][[:space:]]*$/ { skip_openai_proxy = 1; next }\n /^\\[/ { skip_openai_proxy = 0 }\n !skip_openai_proxy { print }\n ' \"${RUNNER_TEMP}/gh-aw/mcp-config/config.toml\" >> \"/tmp/gh-aw/mcp-config/config.toml\"\n chmod 600 \"/tmp/gh-aw/mcp-config/config.toml\"\n mkdir -p \"${CODEX_HOME}\"\n if [ \"/tmp/gh-aw/mcp-config/config.toml\" != \"${CODEX_HOME}/config.toml\" ]; then cp \"/tmp/gh-aw/mcp-config/config.toml\" \"${CODEX_HOME}/config.toml\"; fi\n chmod 600 \"${CODEX_HOME}/config.toml\"\n - name: Mount MCP servers as CLIs\n id: mount-mcp-clis\n continue-on-error: true\n env:\n MCP_GATEWAY_API_KEY: ${{ steps.start-mcp-gateway.outputs.gateway-api-key }}\n MCP_GATEWAY_DOMAIN: ${{ steps.start-mcp-gateway.outputs.gateway-domain }}\n MCP_GATEWAY_PORT: ${{ steps.start-mcp-gateway.outputs.gateway-port }}\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n with:\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/mount_mcp_as_cli.cjs');\n await main();\n - name: Clean credentials\n continue-on-error: true\n run: bash \"${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh\"\n - name: Audit pre-agent workspace\n id: pre_agent_audit\n continue-on-error: true\n run: bash \"${RUNNER_TEMP}/gh-aw/actions/audit_pre_agent_workspace.sh\"\n - name: Execute Codex CLI\n id: agentic_execution\n timeout-minutes: 15\n run: |\n set -o pipefail\n printf '%s' \"$(date +%s%3N)\" > /tmp/gh-aw/agent_cli_start_ms.txt\n mkdir -p \"$CODEX_HOME/logs\" && touch /tmp/gh-aw/agent-step-summary.md\n (umask 177 && touch /tmp/gh-aw/agent-stdio.log)\n # shellcheck disable=SC2016\n printf '%s\\n' '{\"$schema\":\"https://github.com/github/gh-aw-firewall/releases/download/v0.27.44/awf-config.schema.json\",\"network\":{\"allowDomains\":[\"172.30.0.1\",\"api.github.com\",\"api.npms.io\",\"api.openai.com\",\"api.snapcraft.io\",\"archive.ubuntu.com\",\"azure.archive.ubuntu.com\",\"bun.sh\",\"cdn.jsdelivr.net\",\"chatgpt.com\",\"crl.geotrust.com\",\"crl.globalsign.com\",\"crl.identrust.com\",\"crl.sectigo.com\",\"crl.thawte.com\",\"crl.usertrust.com\",\"crl.verisign.com\",\"crl3.digicert.com\",\"crl4.digicert.com\",\"crls.ssl.com\",\"deb.nodesource.com\",\"deno.land\",\"esm.sh\",\"get.pnpm.io\",\"github.com\",\"googleapis.deno.dev\",\"googlechromelabs.github.io\",\"host.docker.internal\",\"json-schema.org\",\"json.schemastore.org\",\"jsr.io\",\"keyserver.ubuntu.com\",\"nodejs.org\",\"npm.pkg.github.com\",\"npmjs.com\",\"npmjs.org\",\"ocsp.digicert.com\",\"ocsp.geotrust.com\",\"ocsp.globalsign.com\",\"ocsp.identrust.com\",\"ocsp.sectigo.com\",\"ocsp.ssl.com\",\"ocsp.thawte.com\",\"ocsp.usertrust.com\",\"ocsp.verisign.com\",\"openai.com\",\"packagecloud.io\",\"packages.cloud.google.com\",\"packages.microsoft.com\",\"ppa.launchpad.net\",\"registry.bower.io\",\"registry.npmjs.com\",\"registry.npmjs.org\",\"registry.yarnpkg.com\",\"repo.yarnpkg.com\",\"s.symcb.com\",\"s.symcd.com\",\"security.ubuntu.com\",\"skimdb.npmjs.com\",\"storage.googleapis.com\",\"telemetry.vercel.com\",\"ts-crl.ws.symantec.com\",\"ts-ocsp.ws.symantec.com\",\"www.googleapis.com\",\"www.npmjs.com\",\"www.npmjs.org\",\"yarnpkg.com\"],\"isolation\":true,\"topologyAttach\":[\"awmg-mcpg\"]},\"apiProxy\":{\"enabled\":true,\"enableTokenSteering\":true,\"maxRuns\":40,\"maxCacheMisses\":5,\"maxAiCredits\":100,\"providers\":{\"openai\":{\"models\":{\"gpt-6.1-sol\":{\"cost\":{\"cache_read\":\"1e-7\",\"cache_write\":\"2.5e-6\",\"input\":\"2e-6\",\"output\":\"1e-5\"}}}}},\"models\":{\"agent\":[\"sonnet-6x\",\"gpt-5.4\",\"gpt-5.5\",\"gpt-5.6\",\"gpt-5.3\",\"gemini-pro\",\"any\"],\"antigravity\":[\"copilot/antigravity*\",\"google/antigravity*\",\"gemini/antigravity*\"],\"any\":[\"copilot/*\",\"anthropic/*\",\"openai/*\",\"google/*\",\"gemini/*\"],\"auto\":[\"copilot/auto\",\"large\"],\"claude\":[\"agent\"],\"codex\":[\"agent\"],\"coding\":[\"copilot/gpt-5*codex*\",\"openai/gpt-5*codex*\",\"gpt-5-codex\",\"kimi\"],\"computer-use\":[\"copilot/*computer-use*\",\"google/*computer-use*\",\"gemini/*computer-use*\",\"openai/*computer-use*\"],\"copilot\":[\"agent\"],\"deep-research\":[\"copilot/deep-research*\",\"copilot/o3-deep-research*\",\"copilot/o4-mini-deep-research*\",\"google/deep-research*\",\"gemini/deep-research*\",\"openai/o3-deep-research*\",\"openai/o4-mini-deep-research*\"],\"detection\":[\"small\"],\"evals\":[\"small\"],\"fable\":[\"copilot/*fable*\",\"anthropic/*fable*\"],\"gemini\":[\"agent\"],\"gemini-3-flash\":[\"copilot/gemini-3*flash*\",\"google/gemini-3*flash*\",\"gemini/gemini-3*flash*\"],\"gemini-3-pro\":[\"copilot/gemini-3*pro*\",\"google/gemini-3*pro*\",\"google/nano-banana*\",\"gemini/gemini-3*pro*\"],\"gemini-3.1-flash\":[\"copilot/gemini-3.1*flash*\",\"google/gemini-3.1*flash*\",\"gemini/gemini-3.1*flash*\"],\"gemini-3.1-pro\":[\"copilot/gemini-3.1*pro*\",\"google/gemini-3.1*pro*\",\"gemini/gemini-3.1*pro*\"],\"gemini-3.5-flash\":[\"copilot/gemini-3.5*flash*\",\"google/gemini-3.5*flash*\",\"gemini/gemini-3.5*flash*\"],\"gemini-3.6-flash\":[\"copilot/gemini-3.6*flash*\",\"google/gemini-3.6*flash*\",\"gemini/gemini-3.6*flash*\"],\"gemini-flash\":[\"copilot/gemini-*flash*\",\"google/gemini-*flash*\",\"gemini/gemini-*flash*\"],\"gemini-flash-lite\":[\"copilot/gemini-*flash*lite*\",\"google/gemini-*flash*lite*\",\"gemini/gemini-*flash*lite*\"],\"gemini-omni\":[\"copilot/gemini-omni*\",\"google/gemini-omni*\",\"gemini/gemini-omni*\"],\"gemini-pro\":[\"copilot/gemini-*pro*\",\"google/gemini-*pro*\",\"gemini/gemini-*pro*\"],\"gemma\":[\"copilot/gemma*\",\"google/gemma*\",\"gemini/gemma*\"],\"gpt-5\":[\"copilot/gpt-5*\",\"openai/gpt-5*\"],\"gpt-5-codex\":[\"copilot/gpt-5*codex*\",\"openai/gpt-5*codex*\"],\"gpt-5-mini\":[\"copilot/gpt-5*mini*\",\"openai/gpt-5*mini*\"],\"gpt-5-nano\":[\"copilot/gpt-5*nano*\",\"openai/gpt-5*nano*\"],\"gpt-5-pro\":[\"copilot/gpt-5*pro*\",\"openai/gpt-5*pro*\"],\"gpt-5.1\":[\"copilot/gpt-5.1*\",\"openai/gpt-5.1*\"],\"gpt-5.2\":[\"copilot/gpt-5.2*\",\"openai/gpt-5.2*\"],\"gpt-5.3\":[\"copilot/gpt-5.3*\",\"openai/gpt-5.3*\"],\"gpt-5.4\":[\"copilot/gpt-5.4*\",\"openai/gpt-5.4*\"],\"gpt-5.5\":[\"copilot/gpt-5.5*\",\"openai/gpt-5.5*\"],\"gpt-5.6\":[\"copilot/gpt-5.6*\",\"openai/gpt-5.6*\"],\"grok\":[\"copilot/*grok*\",\"openai/*grok*\"],\"haiku\":[\"copilot/*haiku*\",\"anthropic/*haiku*\"],\"image-generation\":[\"copilot/gpt-image*\",\"openai/gpt-image*\",\"openai/chatgpt-image*\",\"copilot/gemini-*image*\",\"google/gemini-*image*\",\"gemini/gemini-*image*\",\"google/imagen*\"],\"kimi\":[\"copilot/kimi*\",\"openai/kimi*\"],\"kiwi\":[\"copilot/kiwi*\",\"openai/kiwi*\"],\"large\":[\"sonnet\",\"gpt-5-pro\",\"gpt-5\",\"gemini-pro\"],\"lyria\":[\"google/lyria*\",\"gemini/lyria*\",\"copilot/lyria*\"],\"mai-code\":[\"copilot/MAI-Code*\",\"copilot/mai-code*\",\"openai/MAI-Code*\"],\"mai-code-1-flash-picker\":[\"copilot/MAI-Code-1-Flash-picker*\",\"copilot/mai-code-1-flash-picker*\",\"openai/MAI-Code-1-Flash-picker*\"],\"mini\":[\"haiku\",\"gpt-5-mini\",\"gpt-5-nano\",\"gemini-flash-lite\"],\"nano-banana\":[\"copilot/nano-banana*\",\"google/nano-banana*\",\"gemini/nano-banana*\"],\"opus\":[\"copilot/*opus*\",\"anthropic/*opus*\"],\"opusplan\":[\"opus?effort=high\"],\"raptor-mini\":[\"copilot/raptor*\",\"openai/raptor*\"],\"reasoning\":[\"copilot/o1*\",\"copilot/o3*\",\"copilot/o4*\",\"openai/o1*\",\"openai/o3*\",\"openai/o4*\"],\"robotics\":[\"copilot/*robotics*\",\"google/*robotics*\",\"gemini/*robotics*\"],\"small\":[\"mini\"],\"small-agent\":[\"haiku\",\"gpt-5-mini\",\"gemini-flash\"],\"sonnet\":[\"copilot/*sonnet*\",\"anthropic/*sonnet*\"],\"sonnet-6x\":[\"copilot/*sonnet-4.5*\",\"copilot/*sonnet-4.6*\",\"copilot/*sonnet-5*\",\"copilot/*sonnet-4-5-*\",\"anthropic/*sonnet-4-5-*\",\"copilot/*sonnet-4-6*\",\"anthropic/*sonnet-4-6*\",\"anthropic/*sonnet-5*\"],\"summarization\":[\"haiku\",\"gpt-5-mini\",\"gemini-flash-lite\",\"mini\"],\"veo\":[\"google/veo*\",\"gemini/veo*\"],\"vision\":[\"copilot/gemini-*image*\",\"google/gemini-*image*\",\"gemini/gemini-*image*\",\"copilot/gemini-*flash*\",\"google/gemini-*flash*\",\"gemini/gemini-*flash*\"]}},\"container\":{\"imageTag\":\"0.27.44,squid=sha256:83e48bbe12c634be8c228a576832fe45f66c529ac3659db92bddbcf2eeb6d627,agent=sha256:0d727725c737b58c7bdf51f640cffb928385ec46517e0917c7f1a02f1bada8b4,api-proxy=sha256:b50fbadba138f6e9aba94aca09711335c489bb3b15861220cb66f6092e042dc7,cli-proxy=sha256:c064d15974f7c933ec7d3f7b4038f4fd203547b3154bdc821afd379144887eff\"},\"logging\":{\"proxyLogsDir\":\"/tmp/gh-aw/sandbox/firewall/logs\",\"auditDir\":\"/tmp/gh-aw/sandbox/firewall/audit\"}}' > \"${RUNNER_TEMP}/gh-aw/awf-config.json\"\n cp \"${RUNNER_TEMP}/gh-aw/awf-config.json\" /tmp/gh-aw/awf-config.json\n export GH_AW_MODELS_JSON_PATH=\"/tmp/gh-aw/models.json\"\n GH_AW_DOCKER_HOST=\"\"\n if [[ \"${DOCKER_HOST:-}\" =~ ^tcp:// ]]; then\n GH_AW_DOCKER_HOST=\"${DOCKER_HOST}\"\n fi\n if [[ \"${DOCKER_HOST:-}\" =~ ^tcp:// ]]; then\n GH_AW_CHROOT_BINARIES_SOURCE_PATH=\"${RUNNER_TEMP}/gh-aw\" GH_AW_CHROOT_IDENTITY_HOME=\"${RUNNER_TEMP}/gh-aw/home\" node \"${RUNNER_TEMP}/gh-aw/actions/patch_awf_chroot_config.cjs\"\n fi\n GH_AW_TOOL_CACHE_MOUNT=\"\"\n GH_AW_TOOL_CACHE=\"${RUNNER_TOOL_CACHE:?RUNNER_TOOL_CACHE must be set}\"\n if [ -d \"$GH_AW_TOOL_CACHE\" ]; then\n if [[ \"$GH_AW_TOOL_CACHE\" != /opt/* ]]; then\n GH_AW_TOOL_CACHE_MOUNT=\"$GH_AW_TOOL_CACHE:$GH_AW_TOOL_CACHE:ro\"\n fi\n fi\n # shellcheck disable=SC1003,SC2016,SC2086\n awf --config \"${RUNNER_TEMP}/gh-aw/awf-config.json\" --container-workdir \"${GITHUB_WORKSPACE}\" --mount \"${RUNNER_TEMP}/gh-aw:${RUNNER_TEMP}/gh-aw:ro\" --mount \"${RUNNER_TEMP}/gh-aw:/host${RUNNER_TEMP}/gh-aw:ro\" ${GH_AW_TOOL_CACHE_MOUNT:+--mount \"$GH_AW_TOOL_CACHE_MOUNT\"} ${GH_AW_DOCKER_HOST:+--docker-host \"$GH_AW_DOCKER_HOST\"} --env-all --exclude-env ACTIONS_ID_TOKEN_REQUEST_TOKEN --exclude-env ACTIONS_ID_TOKEN_REQUEST_URL --exclude-env CODEX_API_KEY --exclude-env GITHUB_MCP_SERVER_TOKEN --exclude-env MCP_GATEWAY_API_KEY --exclude-env OPENAI_API_KEY --mount /tmp/gh-aw:/tmp/gh-aw:rw --log-level info --skip-pull \\\n -- /bin/bash -c 'set +o histexpand; export PATH=\"${RUNNER_TEMP}/gh-aw/mcp-cli/bin:$PATH\" && : \"${RUNNER_TOOL_CACHE:?RUNNER_TOOL_CACHE must be set}\"; GH_AW_TOOL_CACHE=\"$RUNNER_TOOL_CACHE\"; export PATH=\"$(find \"$GH_AW_TOOL_CACHE\" -maxdepth 5 -type d -name bin 2>/dev/null | tr '\\''\\n'\\'' '\\'':'\\'')$PATH\"; [ -n \"$GOROOT\" ] && export PATH=\"$GOROOT/bin:$PATH\" || true; [ -n \"$ERLANG_HOME\" ] && export PATH=\"$ERLANG_HOME/bin:$PATH\" || true && GH_AW_NODE_EXEC=\"${GH_AW_NODE_BIN:-}\"; if [ -z \"$GH_AW_NODE_EXEC\" ] || [ ! -x \"$GH_AW_NODE_EXEC\" ]; then GH_AW_NODE_EXEC=\"$(command -v node 2>/dev/null || true)\"; fi; if [ -z \"$GH_AW_NODE_EXEC\" ]; then echo \"node runtime missing on this runner — check runtimes.node in workflow YAML\" >&2; exit 127; fi; GH_AW_NPM_GLOBAL_ROOT=\"$(npm root -g 2>/dev/null || true)\"; if [ -n \"$GH_AW_NPM_GLOBAL_ROOT\" ]; then export NODE_PATH=\"${GH_AW_NPM_GLOBAL_ROOT}${NODE_PATH:+:${NODE_PATH}}\"; fi; \"$GH_AW_NODE_EXEC\" ${RUNNER_TEMP}/gh-aw/actions/codex_harness.cjs codex exec${GH_AW_MODEL_AGENT_CODEX:+ --model \"$GH_AW_MODEL_AGENT_CODEX\"} -c web_search=\"disabled\" -c fetch=\"disabled\" -c features.shell_tool=false --dangerously-bypass-approvals-and-sandbox --skip-git-repo-check -c model_reasoning_effort=\\\"low\\\" --prompt-file /tmp/gh-aw/aw-prompts/prompt.txt' 2>&1 | tee -a /tmp/gh-aw/agent-stdio.log\n env:\n CODEX_API_KEY: ${{ secrets.CODEX_API_KEY || secrets.OPENAI_API_KEY }}\n CODEX_HOME: /tmp/gh-aw/mcp-config\n GH_AW_MAX_TURNS: 40\n GH_AW_MCP_CONFIG: ${{ runner.temp }}/gh-aw/mcp-config/config.toml\n GH_AW_MODEL_AGENT_CODEX: gpt-6.1-sol\n GH_AW_PHASE: agent\n GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt\n GH_AW_SAFE_OUTPUTS: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS }}\n GH_AW_VERSION: v0.86.2\n GITHUB_AW: true\n GITHUB_STEP_SUMMARY: /tmp/gh-aw/agent-step-summary.md\n GIT_AUTHOR_EMAIL: github-actions[bot]@users.noreply.github.com\n GIT_AUTHOR_NAME: github-actions[bot]\n GIT_COMMITTER_EMAIL: github-actions[bot]@users.noreply.github.com\n GIT_COMMITTER_NAME: github-actions[bot]\n OPENAI_API_KEY: ${{ secrets.CODEX_API_KEY || secrets.OPENAI_API_KEY }}\n RUNNER_TEMP: ${{ runner.temp }}\n RUST_LOG: ${{ runner.debug == 1 && 'trace,hyper_util=info,mio=info,reqwest=info,os_info=info,codex_otel=warn,codex_core=debug,ocodex_exec=debug' || 'warn' }}\n TRACEPARENT: ${{ env.GITHUB_AW_OTEL_TRACE_ID != '' && env.GITHUB_AW_OTEL_PARENT_SPAN_ID != '' && format('00-{0}-{1}-01', env.GITHUB_AW_OTEL_TRACE_ID, env.GITHUB_AW_OTEL_PARENT_SPAN_ID) || '' }}\n - name: Detect agent errors\n if: always()\n id: detect-agent-errors\n continue-on-error: true\n run: node \"${RUNNER_TEMP}/gh-aw/actions/detect_agent_errors.cjs\"\n - name: Stop MCP Gateway\n if: always()\n continue-on-error: true\n env:\n MCP_GATEWAY_PORT: ${{ steps.start-mcp-gateway.outputs.gateway-port }}\n MCP_GATEWAY_API_KEY: ${{ steps.start-mcp-gateway.outputs.gateway-api-key }}\n GATEWAY_PID: ${{ steps.start-mcp-gateway.outputs.gateway-pid }}\n run: |\n bash \"${RUNNER_TEMP}/gh-aw/actions/stop_mcp_gateway.sh\" \"$GATEWAY_PID\"\n - name: Redact secrets in logs\n if: always()\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n with:\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/redact_secrets.cjs');\n await main();\n env:\n GH_AW_SECRET_NAMES: 'CODEX_API_KEY,GH_AW_GITHUB_MCP_SERVER_TOKEN,GH_AW_GITHUB_TOKEN,GITHUB_TOKEN,OPENAI_API_KEY'\n SECRET_CODEX_API_KEY: ${{ secrets.CODEX_API_KEY }}\n SECRET_GH_AW_GITHUB_MCP_SERVER_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN }}\n SECRET_GH_AW_GITHUB_TOKEN: ${{ secrets.GH_AW_GITHUB_TOKEN }}\n SECRET_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}\n SECRET_OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}\n - name: Append agent step summary\n if: always()\n run: bash \"${RUNNER_TEMP}/gh-aw/actions/append_agent_step_summary.sh\"\n - name: Copy Safe Outputs\n if: always()\n env:\n GH_AW_SAFE_OUTPUTS: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS }}\n run: |\n mkdir -p /tmp/gh-aw\n cp \"$GH_AW_SAFE_OUTPUTS\" /tmp/gh-aw/safeoutputs.jsonl 2>/dev/null || true\n - name: Ingest agent output\n id: collect_output\n if: always()\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n env:\n GH_AW_SAFE_OUTPUTS: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS }}\n GH_AW_ALLOWED_DOMAINS: \"172.30.0.1,api.github.com,api.npms.io,api.openai.com,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,bun.sh,cdn.jsdelivr.net,chatgpt.com,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,deb.nodesource.com,deno.land,esm.sh,get.pnpm.io,github.com,googleapis.deno.dev,googlechromelabs.github.io,host.docker.internal,json-schema.org,json.schemastore.org,jsr.io,keyserver.ubuntu.com,nodejs.org,npm.pkg.github.com,npmjs.com,npmjs.org,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,openai.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,ppa.launchpad.net,registry.bower.io,registry.npmjs.com,registry.npmjs.org,registry.yarnpkg.com,repo.yarnpkg.com,s.symcb.com,s.symcd.com,security.ubuntu.com,skimdb.npmjs.com,storage.googleapis.com,telemetry.vercel.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com,www.googleapis.com,www.npmjs.com,www.npmjs.org,yarnpkg.com\"\n GITHUB_SERVER_URL: ${{ github.server_url }}\n GITHUB_API_URL: ${{ github.api_url }}\n with:\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/collect_ndjson_output.cjs');\n await main();\n - name: Parse agent logs for step summary\n if: always()\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n env:\n GH_AW_AGENT_OUTPUT: /tmp/gh-aw/agent-stdio.log\n GH_AW_SAFE_OUTPUTS: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS }}\n with:\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/parse_codex_log.cjs');\n await main();\n - name: Parse MCP Gateway logs for step summary\n if: always()\n id: parse-mcp-gateway\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n with:\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/parse_mcp_gateway_log.cjs');\n await main();\n - name: Print firewall logs\n if: always()\n continue-on-error: true\n env:\n AWF_LOGS_DIR: /tmp/gh-aw/sandbox/firewall/logs\n run: bash \"${RUNNER_TEMP}/gh-aw/actions/print_firewall_logs.sh\" --rootless\n - name: Parse token usage for step summary\n if: always()\n continue-on-error: true\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n with:\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/parse_token_usage.cjs');\n await main();\n - name: Print AWF reflect summary\n if: always()\n continue-on-error: true\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n with:\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/awf_reflect_summary.cjs');\n await main();\n - name: Write agent output placeholder if missing\n if: always()\n run: |\n if [ ! -f /tmp/gh-aw/agent_output.json ]; then\n echo '{\"items\":[]}' > /tmp/gh-aw/agent_output.json\n fi\n - name: Upload agent artifacts\n if: always()\n continue-on-error: true\n uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1\n with:\n name: agent\n path: |\n /tmp/gh-aw/aw-prompts/prompt.txt\n /tmp/gh-aw/mcp-config/logs/\n /tmp/gh-aw/redacted-urls.log\n /tmp/gh-aw/mcp-logs/\n /tmp/gh-aw/proxy-logs/\n !/tmp/gh-aw/proxy-logs/proxy-tls/\n /tmp/gh-aw/agent_usage.json\n /tmp/gh-aw/agent-stdio.log\n /tmp/gh-aw/pre-agent-audit.txt\n /tmp/gh-aw/agent/\n /tmp/gh-aw/github_rate_limits.jsonl\n /tmp/gh-aw/safeoutputs.jsonl\n /tmp/gh-aw/agent_output.json\n /tmp/gh-aw/aw-*.patch\n /tmp/gh-aw/aw-*.bundle\n /tmp/gh-aw/awf-config.json\n /tmp/gh-aw/sandbox/firewall/logs/\n /tmp/gh-aw/sandbox/firewall/audit/\n /tmp/gh-aw/sandbox/firewall/awf-reflect.json\n if-no-files-found: ignore\n\n conclusion:\n needs:\n - activation\n - agent\n - detection\n - safe_outputs\n - select\n if: >\n always() && (needs.agent.result != 'skipped' || needs.activation.outputs.lockdown_check_failed == 'true' ||\n needs.activation.outputs.oauth_token_check_failed == 'true' || needs.activation.outputs.stale_lock_file_failed == 'true' ||\n needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')\n runs-on: ubuntu-slim\n permissions:\n actions: read\n issues: write\n pull-requests: write\n concurrency:\n group: \"gh-aw-conclusion-issue-triage\"\n cancel-in-progress: false\n queue: max\n env:\n GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }}\n outputs:\n incomplete_count: ${{ steps.report_incomplete.outputs.incomplete_count }}\n noop_message: ${{ steps.noop.outputs.noop_message }}\n tools_reported: ${{ steps.missing_tool.outputs.tools_reported }}\n total_count: ${{ steps.missing_tool.outputs.total_count }}\n steps:\n - name: Setup Scripts\n id: setup\n uses: github/gh-aw-actions/setup@6aab9e5b5c91c615506061f09bedd81a23babe3c # v0.86.2\n with:\n destination: ${{ runner.temp }}/gh-aw/actions\n job-name: ${{ github.job }}\n trace-id: ${{ needs.activation.outputs.setup-trace-id }}\n parent-span-id: ${{ needs.activation.outputs.setup-parent-span-id || needs.activation.outputs.setup-span-id }}\n env:\n GH_AW_SETUP_WORKFLOW_NAME: \"Issue triage\"\n GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/issue-triage.lock.yml@${{ github.ref }}\n GH_AW_INFO_VERSION: \"0.147.0\"\n GH_AW_INFO_AWF_VERSION: \"v0.27.44\"\n GH_AW_INFO_ENGINE_ID: \"codex\"\n - name: Download agent output artifact\n id: download-agent-output\n continue-on-error: true\n uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1\n with:\n name: agent\n path: /tmp/gh-aw/\n - name: Setup agent output environment variable\n id: setup-agent-output-env\n if: steps.download-agent-output.outcome == 'success'\n run: |\n mkdir -p /tmp/gh-aw/\n find \"/tmp/gh-aw/\" -type f -print\n echo \"GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json\" >> \"$GITHUB_OUTPUT\"\n - name: Download Safe Outputs Items Manifest\n id: download-safe-outputs-manifest\n if: always()\n continue-on-error: true\n uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1\n with:\n name: safe-outputs-items\n path: /tmp/gh-aw/\n - name: Collect usage artifact files\n if: always()\n continue-on-error: true\n run: bash \"${RUNNER_TEMP}/gh-aw/actions/collect_usage_artifact_files.sh\"\n - name: Upload usage artifact\n if: always()\n continue-on-error: true\n uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1\n with:\n name: usage\n path: |\n /tmp/gh-aw/usage/aw_info.json\n /tmp/gh-aw/usage/aw-info.jsonl\n /tmp/gh-aw/usage/agent_usage.json\n /tmp/gh-aw/usage/agent_usage.jsonl\n /tmp/gh-aw/usage/detection_usage.jsonl\n /tmp/gh-aw/usage/evals.jsonl\n /tmp/gh-aw/usage/github_rate_limits.jsonl\n /tmp/gh-aw/usage/agent/token_usage.jsonl\n /tmp/gh-aw/usage/detection/token_usage.jsonl\n /tmp/gh-aw/usage/activity/summary.json\n if-no-files-found: ignore\n - name: Restore daily AIC usage cache\n id: restore-daily-aic-cache-conclusion\n if: always()\n continue-on-error: true\n uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0\n with:\n key: agentic-workflow-usage-issuetriage-${{ github.run_id }}\n restore-keys: agentic-workflow-usage-issuetriage-\n path: /tmp/gh-aw/agentic-workflow-usage-cache.jsonl\n - name: Write daily AIC usage cache entry\n id: write-daily-aic-cache\n if: always()\n continue-on-error: true\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n with:\n github-token: ${{ github.token }}\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/write_daily_aic_usage_cache.cjs');\n await main();\n - name: Save daily AIC usage cache\n id: save-daily-aic-cache\n if: always()\n continue-on-error: true\n uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0\n with:\n key: agentic-workflow-usage-issuetriage-${{ github.run_id }}\n path: /tmp/gh-aw/agentic-workflow-usage-cache.jsonl\n - name: Upload daily AIC usage cache artifact\n id: upload-daily-aic-cache\n if: always()\n continue-on-error: true\n uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1\n with:\n name: aic-usage-cache\n path: /tmp/gh-aw/agentic-workflow-usage-cache.jsonl\n if-no-files-found: ignore\n retention-days: 7\n - name: Process no-op messages\n id: noop\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n env:\n GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }}\n GH_AW_NOOP_MAX: \"1\"\n GH_AW_WORKFLOW_NAME: \"Issue triage\"\n GH_AW_WORKFLOW_SOURCE_URL: \"${{ github.server_url }}/${{ github.repository }}/blob/${{ github.ref_name }}/.github/workflows/issue-triage.md\"\n GH_AW_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}\n GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }}\n GH_AW_NOOP_REPORT_AS_ISSUE: \"false\"\n GH_AW_AIC: ${{ needs.agent.outputs.aic }}\n GH_AW_THREAT_DETECTION_AIC: ${{ needs.detection.outputs.aic }}\n GH_AW_AMBIENT_CONTEXT: ${{ needs.agent.outputs.ambient_context }}\n GH_AW_WORKFLOW_ID: \"issue-triage\"\n with:\n github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/handle_noop_message.cjs');\n await main();\n - name: Log detection run\n id: detection_runs\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n env:\n GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }}\n GH_AW_WORKFLOW_NAME: \"Issue triage\"\n GH_AW_WORKFLOW_SOURCE_URL: \"${{ github.server_url }}/${{ github.repository }}/blob/${{ github.ref_name }}/.github/workflows/issue-triage.md\"\n GH_AW_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}\n GH_AW_DETECTION_CONCLUSION: ${{ needs.detection.outputs.detection_conclusion }}\n GH_AW_DETECTION_REASON: ${{ needs.detection.outputs.detection_reason }}\n with:\n github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/handle_detection_runs.cjs');\n await main();\n - name: Record missing tool\n id: missing_tool\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n env:\n GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }}\n GH_AW_MISSING_TOOL_CREATE_ISSUE: \"true\"\n GH_AW_WORKFLOW_NAME: \"Issue triage\"\n GH_AW_WORKFLOW_SOURCE_URL: \"${{ github.server_url }}/${{ github.repository }}/blob/${{ github.ref_name }}/.github/workflows/issue-triage.md\"\n with:\n github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/missing_tool.cjs');\n await main();\n - name: Record incomplete\n id: report_incomplete\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n env:\n GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }}\n GH_AW_REPORT_INCOMPLETE_CREATE_ISSUE: \"true\"\n GH_AW_WORKFLOW_NAME: \"Issue triage\"\n GH_AW_WORKFLOW_SOURCE_URL: \"${{ github.server_url }}/${{ github.repository }}/blob/${{ github.ref_name }}/.github/workflows/issue-triage.md\"\n with:\n github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/report_incomplete_handler.cjs');\n await main();\n - name: Handle agent failure\n id: handle_agent_failure\n if: always()\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n env:\n GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }}\n GH_AW_WORKFLOW_NAME: \"Issue triage\"\n GH_AW_WORKFLOW_SOURCE_URL: \"${{ github.server_url }}/${{ github.repository }}/blob/${{ github.ref_name }}/.github/workflows/issue-triage.md\"\n GH_AW_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}\n GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }}\n GH_AW_WORKFLOW_ID: \"issue-triage\"\n GH_AW_ACTION_FAILURE_ISSUE_EXPIRES_HOURS: \"168\"\n GH_AW_ENGINE_ID: \"codex\"\n GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}\n GH_AW_EFFECTIVE_TOKENS: ${{ needs.agent.outputs.effective_tokens || '' }}\n GH_AW_AI_CREDITS_RATE_LIMIT_ERROR: ${{ needs.agent.outputs.ai_credits_rate_limit_error || 'false' }}\n GH_AW_UNKNOWN_MODEL_AI_CREDITS: ${{ needs.agent.outputs.unknown_model_ai_credits || 'false' }}\n GH_AW_AIC: ${{ needs.agent.outputs.aic }}\n GH_AW_THREAT_DETECTION_AIC: ${{ needs.detection.outputs.aic }}\n GH_AW_MAX_AI_CREDITS: \"100\"\n GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}\n GH_AW_MCP_POLICY_ERROR: ${{ needs.agent.outputs.mcp_policy_error }}\n GH_AW_AGENTIC_ENGINE_TIMEOUT: ${{ needs.agent.outputs.agentic_engine_timeout }}\n GH_AW_MODEL_NOT_SUPPORTED_ERROR: ${{ needs.agent.outputs.model_not_supported_error }}\n GH_AW_HTTP_400_RESPONSE_ERROR: ${{ needs.agent.outputs.http_400_response_error }}\n GH_AW_MAX_CACHE_MISSES_EXCEEDED: ${{ needs.agent.outputs.max_cache_misses_exceeded }}\n GH_AW_MISSING_MODEL_PRICING_ERROR: ${{ needs.agent.outputs.missing_model_pricing_error }}\n GH_AW_MISSING_MODEL_PRICING_MODEL_NAME: ${{ needs.agent.outputs.missing_model_pricing_model_name }}\n GH_AW_ENGINE_API_HOSTS: \"api.openai.com\"\n GH_AW_LOCKDOWN_CHECK_FAILED: ${{ needs.activation.outputs.lockdown_check_failed }}\n GH_AW_OAUTH_TOKEN_CHECK_FAILED: ${{ needs.activation.outputs.oauth_token_check_failed }}\n GH_AW_STALE_LOCK_FILE_FAILED: ${{ needs.activation.outputs.stale_lock_file_failed }}\n GH_AW_DAILY_AI_CREDITS_EXCEEDED: ${{ needs.activation.outputs.daily_ai_credits_exceeded }}\n GH_AW_DAILY_AI_CREDITS_TOTAL_EFFECTIVE_TOKENS: ${{ needs.activation.outputs.daily_ai_credits_total_effective_tokens }}\n GH_AW_DAILY_AI_CREDITS_THRESHOLD: ${{ needs.activation.outputs.daily_ai_credits_threshold }}\n GH_AW_GROUP_REPORTS: \"false\"\n GH_AW_FAILURE_REPORT_AS_ISSUE: \"false\"\n GH_AW_MISSING_TOOL_REPORT_AS_FAILURE: \"true\"\n GH_AW_MISSING_DATA_REPORT_AS_FAILURE: \"true\"\n GH_AW_TIMEOUT_MINUTES: \"15\"\n with:\n github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/handle_agent_failure.cjs');\n await main();\n - name: Report failed jobs\n id: report_failed_jobs\n if: always()\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n env:\n GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }}\n GH_AW_WORKFLOW_NAME: \"Issue triage\"\n GH_AW_WORKFLOW_SOURCE_URL: \"${{ github.server_url }}/${{ github.repository }}/blob/${{ github.ref_name }}/.github/workflows/issue-triage.md\"\n GH_AW_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}\n GH_AW_REPORT_FAILED_JOBS: \"true\"\n with:\n github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/report_failed_jobs.cjs');\n await main();\n\n detection:\n needs:\n - activation\n - agent\n if: always() && needs.agent.result != 'skipped'\n runs-on: ubuntu-latest\n permissions:\n contents: read\n env:\n GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }}\n outputs:\n aic: ${{ steps.parse_detection_token_usage.outputs.aic }}\n detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}\n detection_reason: ${{ steps.detection_conclusion.outputs.reason }}\n detection_success: ${{ steps.detection_conclusion.outputs.success }}\n steps:\n - name: Setup Scripts\n id: setup\n uses: github/gh-aw-actions/setup@6aab9e5b5c91c615506061f09bedd81a23babe3c # v0.86.2\n with:\n destination: ${{ runner.temp }}/gh-aw/actions\n job-name: ${{ github.job }}\n trace-id: ${{ needs.activation.outputs.setup-trace-id }}\n parent-span-id: ${{ needs.activation.outputs.setup-parent-span-id || needs.activation.outputs.setup-span-id }}\n env:\n GH_AW_SETUP_WORKFLOW_NAME: \"Issue triage\"\n GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/issue-triage.lock.yml@${{ github.ref }}\n GH_AW_INFO_VERSION: \"0.147.0\"\n GH_AW_INFO_AWF_VERSION: \"v0.27.44\"\n GH_AW_INFO_ENGINE_ID: \"codex\"\n - name: Download agent output artifact\n id: download-agent-output\n continue-on-error: true\n uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1\n with:\n name: agent\n path: /tmp/gh-aw/\n - name: Setup agent output environment variable\n id: setup-agent-output-env\n if: steps.download-agent-output.outcome == 'success'\n run: |\n mkdir -p /tmp/gh-aw/\n find \"/tmp/gh-aw/\" -type f -print\n echo \"GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json\" >> \"$GITHUB_OUTPUT\"\n - name: Checkout repository for patch context\n if: needs.agent.outputs.has_patch == 'true'\n uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1\n with:\n persist-credentials: false\n # --- Threat Detection ---\n - name: Clean stale firewall files from agent artifact\n run: |\n rm -rf /tmp/gh-aw/sandbox/firewall/logs\n rm -rf /tmp/gh-aw/sandbox/firewall/audit\n - name: Check if detection needed\n id: detection_guard\n if: always()\n env:\n OUTPUT_TYPES: ${{ needs.agent.outputs.output_types }}\n HAS_PATCH: ${{ needs.agent.outputs.has_patch }}\n run: |\n if [[ -n \"$OUTPUT_TYPES\" || \"$HAS_PATCH\" == \"true\" ]]; then\n echo \"run_detection=true\" >> \"$GITHUB_OUTPUT\"\n echo \"Detection will run: output_types=$OUTPUT_TYPES, has_patch=$HAS_PATCH\"\n else\n echo \"run_detection=false\" >> \"$GITHUB_OUTPUT\"\n echo \"Detection skipped: no agent outputs or patches to analyze\"\n fi\n - name: Clear MCP Config for detection\n if: always() && steps.detection_guard.outputs.run_detection == 'true'\n run: |\n rm -f \"${RUNNER_TEMP}/gh-aw/mcp-config/mcp-servers.json\"\n rm -f \"$HOME/.copilot/mcp-config.json\"\n rm -f \"$GITHUB_WORKSPACE/.gemini/settings.json\"\n - name: Prepare threat detection files\n if: always() && steps.detection_guard.outputs.run_detection == 'true'\n run: |\n bash \"${RUNNER_TEMP}/gh-aw/actions/prepare_threat_detection_files.sh\"\n - name: Setup threat detection\n if: always() && steps.detection_guard.outputs.run_detection == 'true'\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n env:\n WORKFLOW_NAME: \"Issue triage\"\n WORKFLOW_DESCRIPTION: \"Route issues and acknowledge external contributors without starting implementation.\"\n HAS_PATCH: ${{ needs.agent.outputs.has_patch }}\n GH_AW_DETECTION_CONTINUE_ON_ERROR: \"false\"\n with:\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/setup_threat_detection.cjs');\n await main();\n - name: Ensure threat-detection directory and log\n if: always() && steps.detection_guard.outputs.run_detection == 'true'\n run: |\n mkdir -p /tmp/gh-aw/threat-detection\n touch /tmp/gh-aw/threat-detection/detection.log\n rm -f /tmp/gh-aw/step-summary.md\n touch /tmp/gh-aw/step-summary.md\n - name: Setup Node.js\n uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0\n with:\n node-version: '24'\n package-manager-cache: false\n - name: Install Codex CLI\n run: npm install --ignore-scripts -g @openai/codex@0.147.0\n - name: Install AWF binary\n run: bash \"${RUNNER_TEMP}/gh-aw/actions/install_awf_binary.sh\" v0.27.44\n - name: Download container images\n run: bash \"${RUNNER_TEMP}/gh-aw/actions/download_docker_images.sh\" ghcr.io/github/gh-aw-firewall/agent:0.27.44@sha256:0d727725c737b58c7bdf51f640cffb928385ec46517e0917c7f1a02f1bada8b4 ghcr.io/github/gh-aw-firewall/api-proxy:0.27.44@sha256:b50fbadba138f6e9aba94aca09711335c489bb3b15861220cb66f6092e042dc7 ghcr.io/github/gh-aw-firewall/squid:0.27.44@sha256:83e48bbe12c634be8c228a576832fe45f66c529ac3659db92bddbcf2eeb6d627 ghcr.io/github/gh-aw-mcpg:v0.4.9@sha256:e5a1569aeaf41820fa7bdee3e94468cae448133cdbf00119ad24f5b74db1ab9f\n - name: Start MCP Gateway\n id: start-mcp-gateway\n env:\n CODEX_HOME: /tmp/gh-aw/mcp-config\n run: |\n set -eo pipefail\n mkdir -p \"${RUNNER_TEMP}/gh-aw/mcp-config\"\n\n # Export gateway environment variables for MCP config and gateway script\n export MCP_GATEWAY_PORT=\"8080\"\n export MCP_GATEWAY_DOMAIN=\"host.docker.internal\"\n export MCP_GATEWAY_HOST_DOMAIN=\"localhost\"\n MCP_GATEWAY_API_KEY=$(openssl rand -base64 45 | tr -d '/+=')\n echo \"::add-mask::${MCP_GATEWAY_API_KEY}\"\n export MCP_GATEWAY_API_KEY\n export MCP_GATEWAY_PAYLOAD_DIR=\"/tmp/gh-aw/mcp-payloads\"\n mkdir -p \"${MCP_GATEWAY_PAYLOAD_DIR}\"\n export MCP_GATEWAY_PAYLOAD_SIZE_THRESHOLD=\"524288\"\n export MCP_GATEWAY_ALLOWED_MOUNT_ROOTS=\"${GITHUB_WORKSPACE}:rw,${RUNNER_TEMP}/gh-aw:ro,${RUNNER_TEMP}/gh-aw/safeoutputs:rw,/opt:ro,/tmp:rw,/usr/bin/gh:ro\"\n export DEBUG=\"*\"\n\n export GH_AW_ENGINE=\"codex\"\n MCP_GATEWAY_UID=$(id -u 2>/dev/null || echo '0')\n MCP_GATEWAY_GID=$(id -g 2>/dev/null || echo '0')\n source \"${RUNNER_TEMP}/gh-aw/actions/resolve_docker_socket_gid.sh\"\n export MCP_GATEWAY_DOCKER_COMMAND='docker run -i --rm --network host --name awmg-mcpg --add-host host.docker.internal:127.0.0.1 --user '\"${MCP_GATEWAY_UID}\"':'\"${MCP_GATEWAY_GID}\"' --group-add '\"${DOCKER_SOCK_GID}\"' -v '\"${DOCKER_SOCK_PATH}\"':/var/run/docker.sock -e MCP_GATEWAY_PORT -e MCP_GATEWAY_DOMAIN -e MCP_GATEWAY_API_KEY -e MCP_GATEWAY_PAYLOAD_DIR -e MCP_GATEWAY_PAYLOAD_SIZE_THRESHOLD -e DOCKER_HOST=unix:///var/run/docker.sock -e DEBUG -e MCP_GATEWAY_LOG_DIR -e GH_AW_MCP_LOG_DIR -e GH_AW_SAFE_OUTPUTS -e GH_AW_SAFE_OUTPUTS_CONFIG_PATH -e GH_AW_SAFE_OUTPUTS_TOOLS_PATH -e GH_AW_POLICY_ALLOW_CREATE_PULL_REQUEST -e GH_AW_ASSETS_BRANCH -e GH_AW_ASSETS_MAX_SIZE_KB -e GH_AW_ASSETS_ALLOWED_EXTS -e DEFAULT_BRANCH -e GITHUB_MCP_SERVER_TOKEN -e GITHUB_MCP_GUARD_MIN_INTEGRITY -e GITHUB_MCP_GUARD_REPOS -e GH_AW_SINK_VISIBILITY -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e GITHUB_SHA -e GITHUB_WORKSPACE -e GITHUB_TOKEN -e GITHUB_RUN_ID -e GITHUB_RUN_NUMBER -e GITHUB_RUN_ATTEMPT -e GITHUB_JOB -e GITHUB_ACTION -e GITHUB_EVENT_NAME -e GITHUB_EVENT_PATH -e GITHUB_ACTOR -e GITHUB_ACTOR_ID -e GITHUB_TRIGGERING_ACTOR -e GITHUB_WORKFLOW -e GITHUB_WORKFLOW_REF -e GITHUB_WORKFLOW_SHA -e GITHUB_REF -e GITHUB_REF_NAME -e GITHUB_REF_TYPE -e GITHUB_HEAD_REF -e GITHUB_BASE_REF -e RUNNER_TEMP -e MCP_GATEWAY_ALLOWED_MOUNT_ROOTS -e CODEX_HOME -v /tmp/gh-aw/mcp-payloads:/tmp/gh-aw/mcp-payloads:rw -v /opt:/opt:ro -v /tmp:/tmp:rw -v '\"${GITHUB_WORKSPACE}\"':'\"${GITHUB_WORKSPACE}\"':rw -v '\"${RUNNER_TEMP}\"'/gh-aw/safeoutputs:'\"${RUNNER_TEMP}\"'/gh-aw/safeoutputs:rw ghcr.io/github/gh-aw-mcpg:v0.4.9'\n\n cat > \"${RUNNER_TEMP}/gh-aw/mcp-config/config.toml\" << GH_AW_MCP_CONFIG_2f5d9885311152cf_EOF\n [history]\n persistence = \"none\"\n\n [shell_environment_policy]\n inherit = \"core\"\n include_only = [\"^CODEX_API_KEY$\", \"^HOME$\", \"^OPENAI_API_KEY$\", \"^PATH$\"]\n GH_AW_MCP_CONFIG_2f5d9885311152cf_EOF\n\n # Generate JSON config for MCP gateway\n GH_AW_NODE=$(which node 2>/dev/null || command -v node 2>/dev/null || echo node)\n cat << GH_AW_MCP_CONFIG_124f4e7dd5e01bb9_EOF | \"$GH_AW_NODE\" \"${RUNNER_TEMP}/gh-aw/actions/start_mcp_gateway.cjs\"\n {\n \"mcpServers\": {\n },\n \"gateway\": {\n \"port\": $MCP_GATEWAY_PORT,\n \"domain\": \"${MCP_GATEWAY_DOMAIN}\",\n \"apiKey\": \"${MCP_GATEWAY_API_KEY}\",\n \"payloadDir\": \"${MCP_GATEWAY_PAYLOAD_DIR}\",\n \"startupTimeout\": 120\n }\n }\n GH_AW_MCP_CONFIG_124f4e7dd5e01bb9_EOF\n\n # Sync converter output to writable CODEX_HOME for Codex\n mkdir -p /tmp/gh-aw/mcp-config\n cat > \"/tmp/gh-aw/mcp-config/config.toml\" << GH_AW_CODEX_SHELL_POLICY_f48e0018706875a8_EOF\n model_provider = \"openai-proxy\"\n [model_providers.openai-proxy]\n name = \"OpenAI AWF proxy\"\n base_url = \"http://172.30.0.30:10000\"\n env_key = \"OPENAI_API_KEY\"\n supports_websockets = false\n [shell_environment_policy]\n inherit = \"core\"\n include_only = [\"^CODEX_API_KEY$\", \"^HOME$\", \"^OPENAI_API_KEY$\", \"^PATH$\"]\n GH_AW_CODEX_SHELL_POLICY_f48e0018706875a8_EOF\n awk '\n BEGIN { skip_openai_proxy = 0 }\n /^[[:space:]]*model_provider[[:space:]]*=/ { next }\n /^\\[model_providers\\.openai-proxy\\][[:space:]]*$/ { skip_openai_proxy = 1; next }\n /^\\[/ { skip_openai_proxy = 0 }\n !skip_openai_proxy { print }\n ' \"${RUNNER_TEMP}/gh-aw/mcp-config/config.toml\" >> \"/tmp/gh-aw/mcp-config/config.toml\"\n chmod 600 \"/tmp/gh-aw/mcp-config/config.toml\"\n mkdir -p \"${CODEX_HOME}\"\n if [ \"/tmp/gh-aw/mcp-config/config.toml\" != \"${CODEX_HOME}/config.toml\" ]; then cp \"/tmp/gh-aw/mcp-config/config.toml\" \"${CODEX_HOME}/config.toml\"; fi\n chmod 600 \"${CODEX_HOME}/config.toml\"\n - name: Execute Codex CLI\n if: always() && steps.detection_guard.outputs.run_detection == 'true'\n continue-on-error: true\n id: detection_agentic_execution\n timeout-minutes: 20\n run: |\n set -o pipefail\n printf '%s' \"$(date +%s%3N)\" > /tmp/gh-aw/agent_cli_start_ms.txt\n mkdir -p \"$CODEX_HOME/logs\" && touch /tmp/gh-aw/agent-step-summary.md && mkdir -p /tmp/gh-aw/threat-detection && printf '%s' '{\"type\":\"object\",\"properties\":{\"prompt_injection\":{\"type\":\"boolean\"},\"secret_leak\":{\"type\":\"boolean\"},\"malicious_patch\":{\"type\":\"boolean\"},\"reasons\":{\"type\":\"array\",\"items\":{\"type\":\"string\"}}},\"required\":[\"prompt_injection\",\"secret_leak\",\"malicious_patch\",\"reasons\"],\"additionalProperties\":false}' > /tmp/gh-aw/threat-detection/detection_schema.json\n (umask 177 && touch /tmp/gh-aw/threat-detection/detection.log)\n GH_AW_MAX_AI_CREDITS=\"${{ vars.GH_AW_DEFAULT_DETECTION_MAX_AI_CREDITS || '400' }}\"\n printf '%s\\n' \"{\\\"\\$schema\\\":\\\"https://github.com/github/gh-aw-firewall/releases/download/v0.27.44/awf-config.schema.json\\\",\\\"network\\\":{\\\"allowDomains\\\":[\\\"172.30.0.1\\\",\\\"api.github.com\\\",\\\"api.openai.com\\\",\\\"chatgpt.com\\\",\\\"github.com\\\",\\\"host.docker.internal\\\",\\\"openai.com\\\"]},\\\"apiProxy\\\":{\\\"enabled\\\":true,\\\"enableTokenSteering\\\":true,\\\"maxRuns\\\":500,\\\"maxAiCredits\\\":${GH_AW_MAX_AI_CREDITS},\\\"maxCacheMisses\\\":5,\\\"providers\\\":{\\\"openai\\\":{\\\"models\\\":{\\\"gpt-6.1-sol\\\":{\\\"cost\\\":{\\\"cache_read\\\":\\\"1e-7\\\",\\\"cache_write\\\":\\\"2.5e-6\\\",\\\"input\\\":\\\"2e-6\\\",\\\"output\\\":\\\"1e-5\\\"}}}}},\\\"models\\\":{\\\"agent\\\":[\\\"sonnet-6x\\\",\\\"gpt-5.4\\\",\\\"gpt-5.5\\\",\\\"gpt-5.6\\\",\\\"gpt-5.3\\\",\\\"gemini-pro\\\",\\\"any\\\"],\\\"antigravity\\\":[\\\"copilot/antigravity*\\\",\\\"google/antigravity*\\\",\\\"gemini/antigravity*\\\"],\\\"any\\\":[\\\"copilot/*\\\",\\\"anthropic/*\\\",\\\"openai/*\\\",\\\"google/*\\\",\\\"gemini/*\\\"],\\\"auto\\\":[\\\"copilot/auto\\\",\\\"large\\\"],\\\"claude\\\":[\\\"agent\\\"],\\\"codex\\\":[\\\"agent\\\"],\\\"coding\\\":[\\\"copilot/gpt-5*codex*\\\",\\\"openai/gpt-5*codex*\\\",\\\"gpt-5-codex\\\",\\\"kimi\\\"],\\\"computer-use\\\":[\\\"copilot/*computer-use*\\\",\\\"google/*computer-use*\\\",\\\"gemini/*computer-use*\\\",\\\"openai/*computer-use*\\\"],\\\"copilot\\\":[\\\"agent\\\"],\\\"deep-research\\\":[\\\"copilot/deep-research*\\\",\\\"copilot/o3-deep-research*\\\",\\\"copilot/o4-mini-deep-research*\\\",\\\"google/deep-research*\\\",\\\"gemini/deep-research*\\\",\\\"openai/o3-deep-research*\\\",\\\"openai/o4-mini-deep-research*\\\"],\\\"detection\\\":[\\\"small\\\"],\\\"evals\\\":[\\\"small\\\"],\\\"fable\\\":[\\\"copilot/*fable*\\\",\\\"anthropic/*fable*\\\"],\\\"gemini\\\":[\\\"agent\\\"],\\\"gemini-3-flash\\\":[\\\"copilot/gemini-3*flash*\\\",\\\"google/gemini-3*flash*\\\",\\\"gemini/gemini-3*flash*\\\"],\\\"gemini-3-pro\\\":[\\\"copilot/gemini-3*pro*\\\",\\\"google/gemini-3*pro*\\\",\\\"google/nano-banana*\\\",\\\"gemini/gemini-3*pro*\\\"],\\\"gemini-3.1-flash\\\":[\\\"copilot/gemini-3.1*flash*\\\",\\\"google/gemini-3.1*flash*\\\",\\\"gemini/gemini-3.1*flash*\\\"],\\\"gemini-3.1-pro\\\":[\\\"copilot/gemini-3.1*pro*\\\",\\\"google/gemini-3.1*pro*\\\",\\\"gemini/gemini-3.1*pro*\\\"],\\\"gemini-3.5-flash\\\":[\\\"copilot/gemini-3.5*flash*\\\",\\\"google/gemini-3.5*flash*\\\",\\\"gemini/gemini-3.5*flash*\\\"],\\\"gemini-3.6-flash\\\":[\\\"copilot/gemini-3.6*flash*\\\",\\\"google/gemini-3.6*flash*\\\",\\\"gemini/gemini-3.6*flash*\\\"],\\\"gemini-flash\\\":[\\\"copilot/gemini-*flash*\\\",\\\"google/gemini-*flash*\\\",\\\"gemini/gemini-*flash*\\\"],\\\"gemini-flash-lite\\\":[\\\"copilot/gemini-*flash*lite*\\\",\\\"google/gemini-*flash*lite*\\\",\\\"gemini/gemini-*flash*lite*\\\"],\\\"gemini-omni\\\":[\\\"copilot/gemini-omni*\\\",\\\"google/gemini-omni*\\\",\\\"gemini/gemini-omni*\\\"],\\\"gemini-pro\\\":[\\\"copilot/gemini-*pro*\\\",\\\"google/gemini-*pro*\\\",\\\"gemini/gemini-*pro*\\\"],\\\"gemma\\\":[\\\"copilot/gemma*\\\",\\\"google/gemma*\\\",\\\"gemini/gemma*\\\"],\\\"gpt-5\\\":[\\\"copilot/gpt-5*\\\",\\\"openai/gpt-5*\\\"],\\\"gpt-5-codex\\\":[\\\"copilot/gpt-5*codex*\\\",\\\"openai/gpt-5*codex*\\\"],\\\"gpt-5-mini\\\":[\\\"copilot/gpt-5*mini*\\\",\\\"openai/gpt-5*mini*\\\"],\\\"gpt-5-nano\\\":[\\\"copilot/gpt-5*nano*\\\",\\\"openai/gpt-5*nano*\\\"],\\\"gpt-5-pro\\\":[\\\"copilot/gpt-5*pro*\\\",\\\"openai/gpt-5*pro*\\\"],\\\"gpt-5.1\\\":[\\\"copilot/gpt-5.1*\\\",\\\"openai/gpt-5.1*\\\"],\\\"gpt-5.2\\\":[\\\"copilot/gpt-5.2*\\\",\\\"openai/gpt-5.2*\\\"],\\\"gpt-5.3\\\":[\\\"copilot/gpt-5.3*\\\",\\\"openai/gpt-5.3*\\\"],\\\"gpt-5.4\\\":[\\\"copilot/gpt-5.4*\\\",\\\"openai/gpt-5.4*\\\"],\\\"gpt-5.5\\\":[\\\"copilot/gpt-5.5*\\\",\\\"openai/gpt-5.5*\\\"],\\\"gpt-5.6\\\":[\\\"copilot/gpt-5.6*\\\",\\\"openai/gpt-5.6*\\\"],\\\"grok\\\":[\\\"copilot/*grok*\\\",\\\"openai/*grok*\\\"],\\\"haiku\\\":[\\\"copilot/*haiku*\\\",\\\"anthropic/*haiku*\\\"],\\\"image-generation\\\":[\\\"copilot/gpt-image*\\\",\\\"openai/gpt-image*\\\",\\\"openai/chatgpt-image*\\\",\\\"copilot/gemini-*image*\\\",\\\"google/gemini-*image*\\\",\\\"gemini/gemini-*image*\\\",\\\"google/imagen*\\\"],\\\"kimi\\\":[\\\"copilot/kimi*\\\",\\\"openai/kimi*\\\"],\\\"kiwi\\\":[\\\"copilot/kiwi*\\\",\\\"openai/kiwi*\\\"],\\\"large\\\":[\\\"sonnet\\\",\\\"gpt-5-pro\\\",\\\"gpt-5\\\",\\\"gemini-pro\\\"],\\\"lyria\\\":[\\\"google/lyria*\\\",\\\"gemini/lyria*\\\",\\\"copilot/lyria*\\\"],\\\"mai-code\\\":[\\\"copilot/MAI-Code*\\\",\\\"copilot/mai-code*\\\",\\\"openai/MAI-Code*\\\"],\\\"mai-code-1-flash-picker\\\":[\\\"copilot/MAI-Code-1-Flash-picker*\\\",\\\"copilot/mai-code-1-flash-picker*\\\",\\\"openai/MAI-Code-1-Flash-picker*\\\"],\\\"mini\\\":[\\\"haiku\\\",\\\"gpt-5-mini\\\",\\\"gpt-5-nano\\\",\\\"gemini-flash-lite\\\"],\\\"nano-banana\\\":[\\\"copilot/nano-banana*\\\",\\\"google/nano-banana*\\\",\\\"gemini/nano-banana*\\\"],\\\"opus\\\":[\\\"copilot/*opus*\\\",\\\"anthropic/*opus*\\\"],\\\"opusplan\\\":[\\\"opus?effort=high\\\"],\\\"raptor-mini\\\":[\\\"copilot/raptor*\\\",\\\"openai/raptor*\\\"],\\\"reasoning\\\":[\\\"copilot/o1*\\\",\\\"copilot/o3*\\\",\\\"copilot/o4*\\\",\\\"openai/o1*\\\",\\\"openai/o3*\\\",\\\"openai/o4*\\\"],\\\"robotics\\\":[\\\"copilot/*robotics*\\\",\\\"google/*robotics*\\\",\\\"gemini/*robotics*\\\"],\\\"small\\\":[\\\"mini\\\"],\\\"small-agent\\\":[\\\"haiku\\\",\\\"gpt-5-mini\\\",\\\"gemini-flash\\\"],\\\"sonnet\\\":[\\\"copilot/*sonnet*\\\",\\\"anthropic/*sonnet*\\\"],\\\"sonnet-6x\\\":[\\\"copilot/*sonnet-4.5*\\\",\\\"copilot/*sonnet-4.6*\\\",\\\"copilot/*sonnet-5*\\\",\\\"copilot/*sonnet-4-5-*\\\",\\\"anthropic/*sonnet-4-5-*\\\",\\\"copilot/*sonnet-4-6*\\\",\\\"anthropic/*sonnet-4-6*\\\",\\\"anthropic/*sonnet-5*\\\"],\\\"summarization\\\":[\\\"haiku\\\",\\\"gpt-5-mini\\\",\\\"gemini-flash-lite\\\",\\\"mini\\\"],\\\"veo\\\":[\\\"google/veo*\\\",\\\"gemini/veo*\\\"],\\\"vision\\\":[\\\"copilot/gemini-*image*\\\",\\\"google/gemini-*image*\\\",\\\"gemini/gemini-*image*\\\",\\\"copilot/gemini-*flash*\\\",\\\"google/gemini-*flash*\\\",\\\"gemini/gemini-*flash*\\\"]}},\\\"container\\\":{\\\"imageTag\\\":\\\"0.27.44,squid=sha256:83e48bbe12c634be8c228a576832fe45f66c529ac3659db92bddbcf2eeb6d627,agent=sha256:0d727725c737b58c7bdf51f640cffb928385ec46517e0917c7f1a02f1bada8b4,api-proxy=sha256:b50fbadba138f6e9aba94aca09711335c489bb3b15861220cb66f6092e042dc7,cli-proxy=sha256:c064d15974f7c933ec7d3f7b4038f4fd203547b3154bdc821afd379144887eff\\\"},\\\"logging\\\":{\\\"proxyLogsDir\\\":\\\"/tmp/gh-aw/sandbox/firewall/logs\\\",\\\"auditDir\\\":\\\"/tmp/gh-aw/sandbox/firewall/audit\\\"}}\" > \"${RUNNER_TEMP}/gh-aw/awf-config.json\"\n cp \"${RUNNER_TEMP}/gh-aw/awf-config.json\" /tmp/gh-aw/awf-config.json\n export GH_AW_MODELS_JSON_PATH=\"/tmp/gh-aw/models.json\"\n GH_AW_DOCKER_HOST=\"\"\n if [[ \"${DOCKER_HOST:-}\" =~ ^tcp:// ]]; then\n GH_AW_DOCKER_HOST=\"${DOCKER_HOST}\"\n fi\n if [[ \"${DOCKER_HOST:-}\" =~ ^tcp:// ]]; then\n _GH_AW_CHROOT_JSON=$(jq -c --arg src \"${RUNNER_TEMP}/gh-aw\" --arg user \"$(id -un)\" --argjson uid \"$(id -u)\" --argjson gid \"$(id -g)\" --arg home \"${RUNNER_TEMP}/gh-aw/home\" '.chroot={\"binariesSourcePath\":$src,\"identity\":{\"user\":$user,\"uid\":$uid,\"gid\":$gid,\"home\":$home}}' \"${RUNNER_TEMP}/gh-aw/awf-config.json\") || { echo \"chroot config patch failed\" >&2; exit 1; }\n printf '%s\\n' \"$_GH_AW_CHROOT_JSON\" > \"${RUNNER_TEMP}/gh-aw/awf-config.json\"\n printf '%s\\n' \"$_GH_AW_CHROOT_JSON\" > \"${RUNNER_TEMP}/gh-aw/awf-config.json\"\n fi\n GH_AW_TOOL_CACHE_MOUNT=\"\"\n GH_AW_TOOL_CACHE=\"${RUNNER_TOOL_CACHE:?RUNNER_TOOL_CACHE must be set}\"\n if [ -d \"$GH_AW_TOOL_CACHE\" ]; then\n if [[ \"$GH_AW_TOOL_CACHE\" != /opt/* ]]; then\n GH_AW_TOOL_CACHE_MOUNT=\"$GH_AW_TOOL_CACHE:$GH_AW_TOOL_CACHE:ro\"\n fi\n fi\n # shellcheck disable=SC1003,SC2016,SC2086\n awf --config \"${RUNNER_TEMP}/gh-aw/awf-config.json\" --container-workdir \"${GITHUB_WORKSPACE}\" --mount \"${RUNNER_TEMP}/gh-aw:${RUNNER_TEMP}/gh-aw:ro\" --mount \"${RUNNER_TEMP}/gh-aw:/host${RUNNER_TEMP}/gh-aw:ro\" ${GH_AW_TOOL_CACHE_MOUNT:+--mount \"$GH_AW_TOOL_CACHE_MOUNT\"} ${GH_AW_DOCKER_HOST:+--docker-host \"$GH_AW_DOCKER_HOST\"} --env-all --exclude-env ACTIONS_ID_TOKEN_REQUEST_TOKEN --exclude-env ACTIONS_ID_TOKEN_REQUEST_URL --exclude-env CODEX_API_KEY --exclude-env OPENAI_API_KEY --mount /tmp/gh-aw:/tmp/gh-aw:rw --log-level info --skip-pull \\\n -- /bin/bash -c 'set +o histexpand; : \"${RUNNER_TOOL_CACHE:?RUNNER_TOOL_CACHE must be set}\"; GH_AW_TOOL_CACHE=\"$RUNNER_TOOL_CACHE\"; export PATH=\"$(find \"$GH_AW_TOOL_CACHE\" -maxdepth 5 -type d -name bin 2>/dev/null | tr '\\''\\n'\\'' '\\'':'\\'')$PATH\"; [ -n \"$GOROOT\" ] && export PATH=\"$GOROOT/bin:$PATH\" || true; [ -n \"$ERLANG_HOME\" ] && export PATH=\"$ERLANG_HOME/bin:$PATH\" || true && GH_AW_NODE_EXEC=\"${GH_AW_NODE_BIN:-}\"; if [ -z \"$GH_AW_NODE_EXEC\" ] || [ ! -x \"$GH_AW_NODE_EXEC\" ]; then GH_AW_NODE_EXEC=\"$(command -v node 2>/dev/null || true)\"; fi; if [ -z \"$GH_AW_NODE_EXEC\" ]; then echo \"node runtime missing on this runner — check runtimes.node in workflow YAML\" >&2; exit 127; fi; GH_AW_NPM_GLOBAL_ROOT=\"$(npm root -g 2>/dev/null || true)\"; if [ -n \"$GH_AW_NPM_GLOBAL_ROOT\" ]; then export NODE_PATH=\"${GH_AW_NPM_GLOBAL_ROOT}${NODE_PATH:+:${NODE_PATH}}\"; fi; \"$GH_AW_NODE_EXEC\" ${RUNNER_TEMP}/gh-aw/actions/codex_harness.cjs codex exec${GH_AW_MODEL_DETECTION_CODEX:+ --model \"$GH_AW_MODEL_DETECTION_CODEX\"} -c web_search=\"disabled\" -c fetch=\"disabled\" --dangerously-bypass-approvals-and-sandbox --skip-git-repo-check --output-schema /tmp/gh-aw/threat-detection/detection_schema.json -o /tmp/gh-aw/threat-detection/detection_result.json --prompt-file /tmp/gh-aw/aw-prompts/prompt.txt' 2>&1 | tee -a /tmp/gh-aw/threat-detection/detection.log\n env:\n GITHUB_STEP_SUMMARY: /tmp/gh-aw/step-summary.md\n CODEX_API_KEY: ${{ secrets.CODEX_API_KEY || secrets.OPENAI_API_KEY }}\n CODEX_HOME: /tmp/gh-aw/mcp-config\n GH_AW_MAX_TURNS: ${{ vars.GH_AW_DEFAULT_MAX_TURNS || '' }}\n GH_AW_MCP_CONFIG: ${{ runner.temp }}/gh-aw/mcp-config/config.toml\n GH_AW_MODEL_DETECTION_CODEX: gpt-6.1-sol\n GH_AW_PHASE: detection\n GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt\n GH_AW_VERSION: v0.86.2\n GITHUB_AW: true\n GIT_AUTHOR_EMAIL: github-actions[bot]@users.noreply.github.com\n GIT_AUTHOR_NAME: github-actions[bot]\n GIT_COMMITTER_EMAIL: github-actions[bot]@users.noreply.github.com\n GIT_COMMITTER_NAME: github-actions[bot]\n OPENAI_API_KEY: ${{ secrets.CODEX_API_KEY || secrets.OPENAI_API_KEY }}\n RUNNER_TEMP: ${{ runner.temp }}\n RUST_LOG: ${{ runner.debug == 1 && 'trace,hyper_util=info,mio=info,reqwest=info,os_info=info,codex_otel=warn,codex_core=debug,ocodex_exec=debug' || 'warn' }}\n TRACEPARENT: ${{ env.GITHUB_AW_OTEL_TRACE_ID != '' && env.GITHUB_AW_OTEL_PARENT_SPAN_ID != '' && format('00-{0}-{1}-01', env.GITHUB_AW_OTEL_TRACE_ID, env.GITHUB_AW_OTEL_PARENT_SPAN_ID) || '' }}\n - name: Echo detection step summary\n if: always() && steps.detection_guard.outputs.run_detection == 'true'\n continue-on-error: true\n run: |\n if [ -s /tmp/gh-aw/step-summary.md ]; then\n cat /tmp/gh-aw/step-summary.md\n fi\n - name: Render detection log\n if: always() && steps.detection_guard.outputs.run_detection == 'true'\n continue-on-error: true\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n with:\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/render_detection_log.cjs');\n await main();\n - name: Parse threat detection token usage for step summary\n id: parse_detection_token_usage\n if: always()\n continue-on-error: true\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n env:\n GH_AW_TOKEN_USAGE_SUMMARY_TITLE: Threat Detection Token Usage\n with:\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/parse_token_usage.cjs');\n await main();\n - name: Upload threat detection log\n if: always() && steps.detection_guard.outputs.run_detection == 'true'\n uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1\n with:\n name: detection\n path: /tmp/gh-aw/threat-detection/detection.log\n if-no-files-found: ignore\n - name: Parse and conclude threat detection\n id: detection_conclusion\n if: always()\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n env:\n RUN_DETECTION: ${{ steps.detection_guard.outputs.run_detection }}\n DETECTION_AGENTIC_EXECUTION_OUTCOME: ${{ steps.detection_agentic_execution.outcome }}\n GH_AW_DETECTION_CONTINUE_ON_ERROR: \"false\"\n with:\n script: |\n try {\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/parse_threat_detection_results.cjs');\n await main();\n } catch (loadErr) {\n const continueOnError = process.env.GH_AW_DETECTION_CONTINUE_ON_ERROR !== 'false';\n const detectionExecutionFailed = process.env.DETECTION_AGENTIC_EXECUTION_OUTCOME === 'failure';\n const msg = 'ERR_SYSTEM: \\u274C Unexpected error loading threat detection module: ' + (loadErr && loadErr.message ? loadErr.message : String(loadErr));\n core.error(msg);\n core.setOutput('reason', 'parse_error');\n if (continueOnError && !detectionExecutionFailed) {\n core.warning('\\u26A0\\uFE0F ' + msg);\n core.setOutput('conclusion', 'warning');\n core.setOutput('success', 'false');\n } else {\n core.setOutput('conclusion', 'failure');\n core.setOutput('success', 'false');\n core.setFailed(msg);\n }\n }\n\n pre_activation:\n needs: select\n runs-on: ubuntu-slim\n permissions:\n actions: read\n env:\n GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }}\n outputs:\n activated: ${{ steps.check_rate_limit.outputs.rate_limit_ok == 'true' && steps.check_skip_bots.outputs.skip_bots_ok == 'true' }}\n matched_command: ''\n setup-parent-span-id: ${{ steps.setup.outputs.parent-span-id || steps.setup.outputs.span-id }}\n setup-span-id: ${{ steps.setup.outputs.span-id }}\n setup-trace-id: ${{ steps.setup.outputs.trace-id }}\n steps:\n - name: Setup Scripts\n id: setup\n uses: github/gh-aw-actions/setup@6aab9e5b5c91c615506061f09bedd81a23babe3c # v0.86.2\n with:\n destination: ${{ runner.temp }}/gh-aw/actions\n job-name: ${{ github.job }}\n env:\n GH_AW_SETUP_WORKFLOW_NAME: \"Issue triage\"\n GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/issue-triage.lock.yml@${{ github.ref }}\n GH_AW_INFO_VERSION: \"0.147.0\"\n GH_AW_INFO_AWF_VERSION: \"v0.27.44\"\n GH_AW_INFO_ENGINE_ID: \"codex\"\n - name: Check user rate limit\n id: check_rate_limit\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n env:\n GH_AW_RATE_LIMIT_MAX: \"3\"\n GH_AW_RATE_LIMIT_WINDOW: \"60\"\n GH_AW_RATE_LIMIT_EVENTS: \"workflow_dispatch\"\n GH_AW_RATE_LIMIT_IGNORED_ROLES: \"admin,maintain,write\"\n with:\n github-token: ${{ secrets.GITHUB_TOKEN }}\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/check_rate_limit.cjs');\n await main();\n - name: Check skip-bots\n id: check_skip_bots\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n env:\n GH_AW_SKIP_BOTS: \"github-actions,copilot-swe-agent,Copilot,copilot,@app/copilot-swe-agent,dependabot\"\n GH_AW_WORKFLOW_NAME: \"Issue triage\"\n with:\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/check_skip_bots.cjs');\n await main();\n\n safe_outputs:\n needs:\n - activation\n - agent\n - detection\n if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'\n runs-on: ubuntu-slim\n permissions:\n issues: write\n pull-requests: write\n timeout-minutes: 45\n env:\n GH_AW_AGENT_AIC: ${{ needs.agent.outputs.aic }}\n GH_AW_AIC: ${{ needs.agent.outputs.aic }}\n GH_AW_AMBIENT_CONTEXT: ${{ needs.agent.outputs.ambient_context }}\n GH_AW_CALLER_WORKFLOW_ID: \"${{ github.repository }}/issue-triage\"\n GH_AW_DETECTION_CONCLUSION: ${{ needs.detection.outputs.detection_conclusion }}\n GH_AW_DETECTION_REASON: ${{ needs.detection.outputs.detection_reason }}\n GH_AW_EFFECTIVE_TOKENS: ${{ needs.agent.outputs.effective_tokens }}\n GH_AW_ENGINE_ID: \"codex\"\n GH_AW_ENGINE_MODEL: \"gpt-6.1-sol\"\n GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }}\n GH_AW_THREAT_DETECTION_AIC: ${{ needs.detection.outputs.aic }}\n GH_AW_WORKFLOW_ID: \"issue-triage\"\n GH_AW_WORKFLOW_NAME: \"Issue triage\"\n GH_AW_WORKFLOW_SOURCE_URL: \"${{ github.server_url }}/${{ github.repository }}/blob/${{ github.ref_name }}/.github/workflows/issue-triage.md\"\n outputs:\n code_push_failure_count: ${{ steps.process_safe_outputs.outputs.code_push_failure_count }}\n code_push_failure_errors: ${{ steps.process_safe_outputs.outputs.code_push_failure_errors }}\n comment_id: ${{ steps.process_safe_outputs.outputs.comment_id }}\n comment_url: ${{ steps.process_safe_outputs.outputs.comment_url }}\n create_discussion_error_count: ${{ steps.process_safe_outputs.outputs.create_discussion_error_count }}\n create_discussion_errors: ${{ steps.process_safe_outputs.outputs.create_discussion_errors }}\n process_safe_outputs_items_applied: ${{ steps.process_safe_outputs.outputs.items_applied }}\n process_safe_outputs_items_cancelled: ${{ steps.process_safe_outputs.outputs.items_cancelled }}\n process_safe_outputs_items_deferred: ${{ steps.process_safe_outputs.outputs.items_deferred }}\n process_safe_outputs_items_failed: ${{ steps.process_safe_outputs.outputs.items_failed }}\n process_safe_outputs_items_skipped: ${{ steps.process_safe_outputs.outputs.items_skipped }}\n process_safe_outputs_items_succeeded: ${{ steps.process_safe_outputs.outputs.items_succeeded }}\n process_safe_outputs_items_warnings: ${{ steps.process_safe_outputs.outputs.items_warnings }}\n process_safe_outputs_processed_count: ${{ steps.process_safe_outputs.outputs.processed_count }}\n process_safe_outputs_status: ${{ steps.process_safe_outputs.outputs.status }}\n process_safe_outputs_temporary_id_map: ${{ steps.process_safe_outputs.outputs.temporary_id_map }}\n steps:\n - name: Setup Scripts\n id: setup\n uses: github/gh-aw-actions/setup@6aab9e5b5c91c615506061f09bedd81a23babe3c # v0.86.2\n with:\n destination: ${{ runner.temp }}/gh-aw/actions\n job-name: ${{ github.job }}\n trace-id: ${{ needs.activation.outputs.setup-trace-id }}\n parent-span-id: ${{ needs.activation.outputs.setup-parent-span-id || needs.activation.outputs.setup-span-id }}\n env:\n GH_AW_SETUP_WORKFLOW_NAME: \"Issue triage\"\n GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/issue-triage.lock.yml@${{ github.ref }}\n GH_AW_INFO_VERSION: \"0.147.0\"\n GH_AW_INFO_AWF_VERSION: \"v0.27.44\"\n GH_AW_INFO_ENGINE_ID: \"codex\"\n - name: Download agent output artifact\n id: download-agent-output\n continue-on-error: true\n uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1\n with:\n name: agent\n path: /tmp/gh-aw/\n - name: Setup agent output environment variable\n id: setup-agent-output-env\n if: steps.download-agent-output.outcome == 'success'\n run: |\n mkdir -p /tmp/gh-aw/\n find \"/tmp/gh-aw/\" -type f -print\n echo \"GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json\" >> \"$GITHUB_OUTPUT\"\n - name: Configure GH_HOST for enterprise compatibility\n id: ghes-host-config\n shell: bash\n run: | # zizmor: ignore[github-env] - GITHUB_SERVER_URL is set by GitHub Actions, not user input.\n # Derive GH_HOST from GITHUB_SERVER_URL so the gh CLI targets the correct\n # GitHub instance (GHES/GHEC). On github.com this is a harmless no-op.\n GH_HOST=\"${GITHUB_SERVER_URL#https://}\"\n GH_HOST=\"${GH_HOST#http://}\"\n echo \"GH_HOST=${GH_HOST}\" >> \"$GITHUB_ENV\"\n - name: Process Safe Outputs\n id: process_safe_outputs\n uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n env:\n GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }}\n GH_AW_COMMENT_ID: ${{ needs.activation.outputs.comment_id }}\n GH_AW_ALLOWED_DOMAINS: \"172.30.0.1,api.github.com,api.npms.io,api.openai.com,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,bun.sh,cdn.jsdelivr.net,chatgpt.com,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,deb.nodesource.com,deno.land,esm.sh,get.pnpm.io,github.com,googleapis.deno.dev,googlechromelabs.github.io,host.docker.internal,json-schema.org,json.schemastore.org,jsr.io,keyserver.ubuntu.com,nodejs.org,npm.pkg.github.com,npmjs.com,npmjs.org,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,openai.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,ppa.launchpad.net,registry.bower.io,registry.npmjs.com,registry.npmjs.org,registry.yarnpkg.com,repo.yarnpkg.com,s.symcb.com,s.symcd.com,security.ubuntu.com,skimdb.npmjs.com,storage.googleapis.com,telemetry.vercel.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com,www.googleapis.com,www.npmjs.com,www.npmjs.org,yarnpkg.com\"\n GITHUB_SERVER_URL: ${{ github.server_url }}\n GITHUB_API_URL: ${{ github.api_url }}\n GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: \"{\\\"add_comment\\\":{\\\"max\\\":5,\\\"target\\\":\\\"*\\\"},\\\"add_labels\\\":{\\\"allowed\\\":[\\\"triage/agent-candidate\\\",\\\"triage/human-response\\\",\\\"triage/needs-info\\\",\\\"triage/backlog-note\\\",\\\"bug\\\",\\\"enhancement\\\",\\\"documentation\\\",\\\"question\\\",\\\"duplicate\\\"],\\\"max\\\":5,\\\"target\\\":\\\"*\\\"},\\\"create_report_incomplete_issue\\\":{},\\\"missing_data\\\":{},\\\"missing_tool\\\":{},\\\"noop\\\":{\\\"max\\\":1,\\\"report-as-issue\\\":\\\"false\\\"},\\\"remove_labels\\\":{\\\"allowed\\\":[\\\"triage/agent-candidate\\\",\\\"triage/human-response\\\",\\\"triage/needs-info\\\",\\\"triage/backlog-note\\\"],\\\"max\\\":5,\\\"target\\\":\\\"*\\\"},\\\"report_incomplete\\\":{}}\"\n with:\n github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}\n script: |\n const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');\n setupGlobals(core, github, context, exec, io, getOctokit);\n const { main } = require('${{ runner.temp }}/gh-aw/actions/process_safe_outputs.cjs');\n await main();\n - name: Upload Safe Outputs Items\n if: always()\n uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1\n with:\n name: safe-outputs-items\n path: |\n /tmp/gh-aw/safe-output-items.jsonl\n /tmp/gh-aw/temporary-id-map.json\n if-no-files-found: ignore\n\n select:\n runs-on: ubuntu-latest\n permissions:\n contents: read\n issues: read\n outputs:\n candidates: ${{ steps.select.outputs.candidates }}\n has_candidates: ${{ steps.select.outputs.has_candidates }}\n steps:\n - name: Configure GH_HOST for enterprise compatibility\n id: ghes-host-config\n shell: bash\n run: | # zizmor: ignore[github-env] - GITHUB_SERVER_URL is set by GitHub Actions, not user input.\n # Derive GH_HOST from GITHUB_SERVER_URL so the gh CLI targets the correct\n # GitHub instance (GHES/GHEC). On github.com this is a harmless no-op.\n GH_HOST=\"${GITHUB_SERVER_URL#https://}\"\n GH_HOST=\"${GH_HOST#http://}\"\n echo \"GH_HOST=${GH_HOST}\" >> \"$GITHUB_ENV\"\n - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 (source v7)\n with:\n persist-credentials: false\n ref: ${{ github.event_name == 'workflow_dispatch' && github.ref || 'refs/heads/main' }}\n - name: Select issues needing triage\n id: select\n run: node scripts/issue-triage/select.mjs\n env:\n GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}\n","editable",false,"branch","documentNavigation","repo","githubnext/chopin","repoId","7d1a8ac3-35b0-4dea-85d4-06a980f3bada","ownerId","org:89615882","site","nexthub","private","admin","settings","maintainer","triage","starred","stars",0,"watchers","watching","pinned","notify","views",[183,184,185,186,187,188,189,190,191,192,193,194,195],"navigation",{"_55":56,"_139":140,"_141":142,"_143":144,"_145":146,"_147":148,"_149":150},"sources",[],"viewer","meta",{"_131":132,"_133":134,"_135":136,"_43":32,"_137":14,"_138":32,"_49":50,"_51":50},"branches",[74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,14,127,128,129,130],"tags",[70,71,72,73],"cloneUrl","https://git.nexthub.sh/githubnext/chopin.git","color-controls-slice-1","color-controls-slice-2","color-controls-slice-3","color-controls-slice-4","Krzysztof-Cieslak-patch-1","Krzysztof-Cieslak-patch-2","Maggie/app-preview-toolkit","Maggie/ci-playwright-install-timeout","Maggie/collaborative-visual-decision","Maggie/design-audit","Maggie/generic-visual-decision-runtime","Maggie/impeccable-chopin-metadata","Maggie/jev-chat-product","Maggie/jev-composed-assessment","Maggie/native-document-layouts","Maggie/openui-composition-product","Maggie/openui-composition-trial","Maggie/planner-visual-authoring","Maggie/planner-visual-requests","Maggie/visual-selection-eval","artifacts/pr-419-live-preview-20261009","automation/pr-maintenance-state","automation/use-effect/callout-disabled-picker-8cf9e49ba5c09471","automation/use-effect/collaboration-options-ref-4e3a5a08a879a5ae","automation/use-effect/room-workspace-effective-access-a57d40866c71bed0","chore/bun-1.4.2","color-controls","color-controls-plan","comments","design-pr-assets","design/archived-decisions-badge","design/channel-route-remount","design/chat-decision-entry","design/conversation-analysis-markers","design/decision-evidence","design/settled-line-icon","dev/integration","diagram-step-controls","feat/liveapp-frontend-pilot","feat/local-experiments","feat/local-launcher-tracer","fix/autolink-mdx-crash","github-pills/2-pills","github-pills/3-hover-card","maggie/app-preview-toolkit","maggie/ci-playwright-install-timeout","maggie/collaborative-visual-decision","maggie/design-audit","maggie/generic-visual-decision-runtime","maggie/impeccable-chopin-metadata","maggie/jev-composed-assessment","maggie/native-document-layouts","maggie/openui-composition-product","maggie/openui-composition-trial","maggie/planner-visual-authoring","maggie/planner-visual-requests","maggie/visual-selection-eval","plain-text-fence-chrome","tokens/09-copy","wireframes/2-renderer","wireframes/3-planner","description","Let's compose rich plans together","owner","githubnext","section","","head","empty","pins",[165,166,167],"documents",{"_160":161,"_162":163},"code",{"_156":157,"_158":159},"automations",{"_153":154,"_155":-5},"delivery",{"_151":50,"_152":-5},"tag","04zvKQ8QOrDUF8TO1Ovz0Zy8_TT","releases","applications","workflows",3,"deployments","commits",1000,"changes",13,"counts",{"_164":163},"total",11,"issue",{"_168":158,"_170":181,"_15":158,"_172":182,"_53":174,"_175":32,"_176":174,"_177":159},{"_168":178,"_170":179,"_15":178,"_172":180,"_53":174,"_175":32,"_176":174,"_177":50},{"_168":169,"_170":171,"_15":169,"_172":173,"_53":174,"_175":32,"_176":174,"_177":163},"id","issues","name","Issues","filters",{},true,"saved","pinnable","count","tasks","Tasks",{},"Changes",{},{"_168":158,"_170":181,"_15":158,"_172":226,"_53":174,"_175":32,"_176":174},{"_168":178,"_170":179,"_15":178,"_172":225,"_53":174,"_175":32,"_176":174},{"_168":169,"_170":171,"_15":169,"_172":224,"_53":174,"_175":32,"_176":174},{"_168":221,"_170":222,"_15":221,"_172":223,"_53":32,"_175":32,"_176":174},{"_168":218,"_170":219,"_15":218,"_172":220,"_53":32,"_175":32,"_176":174},{"_168":153,"_170":216,"_15":145,"_172":217,"_53":32,"_175":32,"_176":174},{"_168":155,"_170":213,"_15":214,"_172":215,"_53":32,"_175":32,"_176":174},{"_168":151,"_170":211,"_15":151,"_172":212,"_53":32,"_175":32,"_176":174},{"_168":207,"_170":208,"_15":209,"_172":210,"_53":32,"_175":32,"_176":174},{"_168":141,"_170":205,"_15":141,"_172":206,"_53":32,"_175":32,"_176":32},{"_168":202,"_170":203,"_15":202,"_172":204,"_53":32,"_175":32,"_176":32},{"_168":199,"_170":200,"_15":199,"_172":201,"_53":32,"_175":32,"_176":32},{"_168":196,"_170":197,"_15":196,"_172":198,"_53":32,"_175":32,"_176":32},"decisions","Decisions",{},"changelog","Changelog",{},"roadmap","Roadmap",{},"Documents",{},"activity","Activity","insights",{},"Releases",{},"Deployments","automations/deployments",{},"Workflows",{},"discussions","Discussions",{},"goals","Goals",{},{},{},{},"groups","user","agents",[],"now",1794434964071,"sidebar","expanded"]