# gh-aw-manifest: {"version":1,"secrets":["GH_AW_DEFAULT_OTLP_ENDPOINT","GH_AW_DEFAULT_OTLP_HEADERS","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/checkout","sha":"3d3c42e5aac5ba805825da76410c181273ba90b1","version":"v7.0.1"},{"repo":"actions/download-artifact","sha":"9000827ccba6bdab643e8b6fd33ac0654aef8333","version":"v8.0.2"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/upload-artifact","sha":"cf430e030ddbb5b0abf93d22962f4752f3646cd9","version":"v7.0.2"},{"repo":"github/gh-aw-actions/setup","sha":"221ba4f4319de6b8e809d1a15528b3ae6a818aa5","version":"v1.0.1"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.29.0","digest":"sha256:b14bd399376180b5649a9324be3b50fbfc82bfe8f0c80045840416b5a4e65b96","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.29.0@sha256:b14bd399376180b5649a9324be3b50fbfc82bfe8f0c80045840416b5a4e65b96"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.29.0","digest":"sha256:baff00b856a4bdc93bce134928c70af3d3492f2e518757115042040674d56b0b","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.29.0@sha256:baff00b856a4bdc93bce134928c70af3d3492f2e518757115042040674d56b0b"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.29.0","digest":"sha256:6e0cbf7f980beb78b5461563a8164f6439ca959bc93733d5a6b52972e523ed50","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.29.0@sha256:6e0cbf7f980beb78b5461563a8164f6439ca959bc93733d5a6b52972e523ed50"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.4.36","digest":"sha256:b4d2856018959c798b3e3f81ae4ab5b275e06354e123e1f7971de931f2f450f2","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.4.36@sha256:b4d2856018959c798b3e3f81ae4ab5b275e06354e123e1f7971de931f2f450f2"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:a8082161d7dceda14b68f32eb39d0eaa96b825d07f5895b096afab9d9e0c7748","pinned_image":"ghcr.io/github/gh-aw-node@sha256:a8082161d7dceda14b68f32eb39d0eaa96b825d07f5895b096afab9d9e0c7748"},{"image":"ghcr.io/github/github-mcp-server:v2.0.3","digest":"sha256:250bc6ce70788207608ef74cef4397230ff2e8481218da74d6093e4bd9101132","pinned_image":"ghcr.io/github/github-mcp-server:v2.0.3@sha256:250bc6ce70788207608ef74cef4397230ff2e8481218da74d6093e4bd9101132"}],"has_pull_request":true,"mcp_servers":[{"name":"github","tools":["get_commit","get_file_contents","get_latest_release","get_pull_request","get_pull_request_comments","get_pull_request_diff","get_pull_request_files","get_pull_request_review_comments","get_pull_request_reviews","get_pull_request_status","get_release_by_tag","get_tag","issue_read","list_branches","list_commits","list_issue_types","list_issues","list_pull_requests","list_releases","list_starred_repositories","list_tags","pull_request_read","search_code","search_issues","search_pull_requests","search_repositories"]},{"name":"safeoutputs","tools":["add_comment","add_labels","create_issue","noop","report_incomplete","report_missing_data","report_missing_tool"]}],"threat_detection":{"mode":"disabled"},"admission":false}

name: "Read-Only Stress: default runtime"

on:

pull_request:

types:

- opened

- synchronize

- reopened

# roles: all # Roles processed as role check in pre-activation job

# skip-bots: # Skip-bots processed as bot check in pre-activation job

# - copilot # Skip-bots processed as bot check in pre-activation job

workflow_dispatch:

inputs:

aw_context:

default: ""

description: "Agent caller context (Reserved for Agentic Workflows)."

required: false

type: string

permissions: {}

concurrency:

group: "gh-aw-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref || github.run_id }}"

cancel-in-progress: true

run-name: "Read-Only Stress: default runtime"

env:

OTEL_EXPORTER_OTLP_ENDPOINT: ${{ secrets.GH_AW_DEFAULT_OTLP_ENDPOINT || vars.GH_AW_DEFAULT_OTLP_ENDPOINT }}

OTEL_SERVICE_NAME: gh-aw.readonly-stress-default

OTEL_RESOURCE_ATTRIBUTES: 'gh-aw.workflow.name=Read-Only%20Stress%3A%20default%20runtime,gh-aw.repository=${{ github.repository }},gh-aw.run.id=${{ github.run_id }},github.run_id=${{ github.run_id }},gh-aw.engine.id=copilot'

OTEL_EXPORTER_OTLP_HEADERS: ${{ secrets.GH_AW_DEFAULT_OTLP_HEADERS }}

GH_AW_OTLP_ENDPOINTS: '[{"url":"${{ secrets.GH_AW_DEFAULT_OTLP_ENDPOINT || vars.GH_AW_DEFAULT_OTLP_ENDPOINT }}","headers":"${{ secrets.GH_AW_DEFAULT_OTLP_HEADERS }}"}]'

GH_AW_OTLP_IF_MISSING: ignore

jobs:

activation:

name: activation

needs: pre_activation

if: >

runs-on: ubuntu-slim

# Permissions for the activation job (workflow permissions default to none).

permissions:

actions: read

contents: read

issues: write

pull-requests: write

env:

GH_AW_MAX_DAILY_AI_CREDITS: ${{ vars.GH_AW_DEFAULT_MAX_DAILY_AI_CREDITS || '5000' }}

GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }}

outputs:

aw_context: ${{ steps.generate_aw_info.outputs.aw_context }}

body: ${{ steps.sanitized.outputs.body }}

comment_id: ""

comment_repo: ""

daily_ai_credits_estimated: ${{ steps.daily-ai-credits-workflow-guardrail.outputs.daily_ai_credits_estimated || '' }}

daily_ai_credits_exceeded: ${{ steps.daily-ai-credits-workflow-guardrail.outputs.daily_ai_credits_exceeded == 'true' }}

daily_ai_credits_guardrail_error: ${{ steps.daily-ai-credits-workflow-guardrail.outputs.daily_ai_credits_guardrail_error || '' }}

daily_ai_credits_guardrail_status: ${{ steps.daily-ai-credits-workflow-guardrail.outputs.daily_ai_credits_guardrail_status || '' }}

daily_ai_credits_threshold: ${{ steps.daily-ai-credits-workflow-guardrail.outputs.daily_ai_credits_threshold || '' }}

daily_ai_credits_total: ${{ steps.daily-ai-credits-workflow-guardrail.outputs.daily_ai_credits_total || '' }}

engine_id: ${{ steps.generate_aw_info.outputs.engine_id }}

lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }}

model: ${{ steps.generate_aw_info.outputs.model }}

oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }}

setup-parent-span-id: ${{ steps.setup.outputs.parent-span-id || steps.setup.outputs.span-id }}

setup-span-id: ${{ steps.setup.outputs.span-id }}

setup-trace-id: ${{ steps.setup.outputs.trace-id }}

stale_lock_file_failed: ${{ steps.check-lock-file.outputs.stale_lock_file_failed == 'true' }}

text: ${{ steps.sanitized.outputs.text }}

title: ${{ steps.sanitized.outputs.title }}

steps:

- name: Setup Scripts

id: setup

uses: github/gh-aw-actions/setup@221ba4f4319de6b8e809d1a15528b3ae6a818aa5 # v1.0.1

with:

destination: ${{ runner.temp }}/gh-aw/actions

job-name: ${{ github.job }}

trace-id: ${{ needs.pre_activation.outputs.setup-trace-id }}

parent-span-id: ${{ needs.pre_activation.outputs.setup-parent-span-id || needs.pre_activation.outputs.setup-span-id }}

safe-output-artifact-client: ${{ env.GH_AW_MAX_DAILY_AI_CREDITS != '' }}

env:

GH_AW_SETUP_WORKFLOW_NAME: "Read-Only Stress: default runtime"

GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/readonly-stress-default.lock.yml@${{ github.ref }}

GH_AW_INFO_VERSION: "1.0.98"

GH_AW_INFO_AWF_VERSION: "v0.29.0"

GH_AW_INFO_ENGINE_ID: "copilot"

GH_AW_SETUP_AW_CONTEXT: ${{ inputs.aw_context }}

- name: Mask OTLP telemetry headers

run: bash "${RUNNER_TEMP}/gh-aw/actions/mask_otlp_headers.sh"

- name: Generate agentic run info

id: generate_aw_info

env:

GH_AW_INFO_ENGINE_ID: "copilot"

GH_AW_INFO_ENGINE_NAME: "GitHub Copilot CLI"

GH_AW_INFO_MODEL: "claude-sonnet-5"

GH_AW_INFO_VERSION: "1.0.98"

GH_AW_INFO_AGENT_VERSION: "1.0.98"

GH_AW_INFO_CLI_VERSION: "v1.0.1"

GH_AW_INFO_WORKFLOW_NAME: "Read-Only Stress: default runtime"

GH_AW_INFO_WORKFLOW_ID: ${{ job.workflow_ref }}

GH_AW_INFO_EXPERIMENTAL: "false"

GH_AW_INFO_SUPPORTS_TOOLS_ALLOWLIST: "true"

GH_AW_INFO_STAGED: "false"

GH_AW_INFO_ALLOWED_DOMAINS: '["defaults","github","github.com"]'

GH_AW_INFO_FIREWALL_ENABLED: "true"

GH_AW_INFO_AWF_VERSION: "v0.29.0"

GH_AW_INFO_AWMG_VERSION: "v0.4.36"

GH_AW_INFO_FIREWALL_TYPE: "squid"

GH_AW_INFO_AGENT_RUNTIME: ""

GH_AW_INFO_ENGINE_HARNESS: "copilot-cli"

GH_AW_INFO_MODEL_CONFIG: '{"routing":{"enabled":false},"models":{"allowed":[],"blocked":[]},"max_ai_credits_source":"default"}'

GH_AW_INFO_MAX_AI_CREDITS: ${{ vars.GH_AW_DEFAULT_MAX_AI_CREDITS || '1000' }}

GH_AW_INFO_FRONTMATTER_EMOJI: "🔒"

GH_AW_COMPILED_STRICT: "false"

GH_AW_INFO_MODEL_COSTS: '{"providers":{"github-copilot":{"models":{"claude-sonnet-5":{"cost":{"cache_read":"2e-07","cache_write":"2.5e-06","input":"2e-06","output":"1e-05"}}}}}}'

uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0

with:

script: |

- name: Enforce strict mode policy

if: ${{ vars.GH_AW_POLICY_STRICT == 'true' }}

run: |

- name: Restore daily AIC scan observations

id: restore-daily-aic-cache-fallback

if: ${{ env.GH_AW_ADMISSION_RESULT != 'admitted' && env.GH_AW_MAX_DAILY_AI_CREDITS != '' }}

uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0

env:

GH_AW_HAS_SLASH_COMMAND: "false"

GH_AW_HAS_LABEL_COMMAND: "false"

with:

github-token: ${{ secrets.GITHUB_TOKEN }}

script: |

- name: Check daily workflow token guardrail

id: daily-ai-credits-workflow-guardrail

if: ${{ env.GH_AW_ADMISSION_RESULT != 'admitted' && env.GH_AW_MAX_DAILY_AI_CREDITS != '' }}

uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0

env:

GH_AW_WORKFLOW_NAME: "Read-Only Stress: default runtime"

GH_AW_WORKFLOW_ID: "readonly-stress-default"

GH_AW_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}

GH_AW_WORKFLOW_DISPATCH_AW_CONTEXT: ${{ github.event.inputs.aw_context || '' }}

GH_AW_HAS_SLASH_COMMAND: "false"

GH_AW_HAS_LABEL_COMMAND: "false"

GH_AW_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

GH_AW_MAX_DAILY_AI_CREDITS: ${{ vars.GH_AW_DEFAULT_MAX_DAILY_AI_CREDITS || '5000' }}

GH_AW_MAX_AI_CREDITS: ${{ vars.GH_AW_DEFAULT_MAX_AI_CREDITS || '1000' }}

with:

github-token: ${{ secrets.GITHUB_TOKEN }}

script: |

- name: Publish daily AIC scan observations

if: always() && env.GH_AW_ADMISSION_RESULT != 'admitted' && env.GH_AW_MAX_DAILY_AI_CREDITS != ''

continue-on-error: true

uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2

with:

name: aic-usage-scan-v2

path: /tmp/gh-aw/agentic-workflow-usage-scan-v2.jsonl

overwrite: true

if-no-files-found: ignore

retention-days: ${{ vars.GH_AW_DEFAULT_ARTIFACT_RETENTION_DAYS || '3' }}

- name: Add eyes reaction for immediate feedback

id: react

if: github.event_name == 'issues' || github.event_name == 'issue_comment' || github.event_name == 'pull_request_review_comment' || github.event_name == 'discussion' || github.event_name == 'discussion_comment' || github.event_name == 'pull_request' && github.event.pull_request.head.repo.id == github.repository_id

uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0

env:

GH_AW_REACTION: "eyes"

with:

github-token: ${{ secrets.GITHUB_TOKEN }}

script: |

- name: Check for OAuth tokens

id: check-oauth-tokens

run: bash "${RUNNER_TEMP}/gh-aw/actions/check_oauth_tokens.sh"

env:

GH_AW_GITHUB_TOKEN: ${{ secrets.GH_AW_GITHUB_TOKEN }}

GH_AW_GITHUB_MCP_SERVER_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN }}

- name: Checkout .github and .agents folders

uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

with:

persist-credentials: false

ref: ${{ (github.event_name == 'pull_request' || github.event_name == 'pull_request_review' || github.event_name == 'pull_request_review_comment') && github.event.pull_request != null && github.event.pull_request.base.sha || github.sha }}

sparse-checkout: |

sparse-checkout-cone-mode: true

fetch-depth: 1

- name: Save agent config folders for base branch restoration

env:

GH_AW_AGENT_FOLDERS: ".agents .github"

GH_AW_AGENT_FILES: "AGENTS.md"

run: |

- name: Check workflow lock file

id: check-lock-file

uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0

env:

GH_AW_WORKFLOW_FILE: "readonly-stress-default.lock.yml"

GH_AW_CONTEXT_WORKFLOW_REF: "${{ github.workflow_ref }}"

with:

script: |

- name: Check compile-agentic version

uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0

env:

GH_AW_COMPILED_VERSION: "v1.0.1"

GH_AW_HAS_SAFE_OUTPUTS: "true"

GH_AW_BLOCKED_VERSION_REPORT_AS_ISSUE: "true"

GH_AW_WORKFLOW_NAME: "Read-Only Stress: default runtime"

with:

script: |

- name: Compute current body text

id: sanitized

uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0

env:

GH_AW_ALLOWED_DOMAINS: "*.githubusercontent.com,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,codeload.github.com,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,docs.github.com,github-cloud.githubusercontent.com,github-cloud.s3.amazonaws.com,github.blog,github.com,github.githubassets.com,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,lfs.github.com,objects.githubusercontent.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,patch-diff.githubusercontent.com,patchdiff.githubusercontent.com,ppa.launchpad.net,raw.githubusercontent.com,s.symcb.com,s.symcd.com,security.ubuntu.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com,www.googleapis.com"

with:

script: |

- name: Log runtime features

if: ${{ contains(toJSON(vars), '"GH_AW_RUNTIME_FEATURES":') }}

run: bash "${RUNNER_TEMP}/gh-aw/actions/log_runtime_features_summary.sh"

- name: Create prompt with built-in context

uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0

env:

GH_AW_ACTIONS_DIR: ${{ runner.temp }}/gh-aw/actions

GH_AW_PROMPT: ${{ runner.temp }}/gh-aw/aw-prompts/prompt.txt

GH_AW_SAFE_OUTPUTS: ${{ runner.temp }}/gh-aw/safeoutputs/outputs.jsonl

GH_AW_PROMPT_CONFIG: "{\"items\":[{\"content_env\":\"GH_AW_PROMPT_CONTENT_0000\"},{\"file\":\"xpia.md\"},{\"file\":\"temp_folder_prompt.md\"},{\"file\":\"markdown.md\"},{\"file\":\"safe_outputs_cli_only_transport_prompt.md\"},{\"file\":\"safe_outputs_prompt.md\"},{\"content_env\":\"GH_AW_PROMPT_CONTENT_0001\"},{\"content_env\":\"GH_AW_PROMPT_CONTENT_0002\"},{\"file\":\"mcp_cli_tools_with_safeoutputs_prompt.md\"},{\"content_env\":\"GH_AW_PROMPT_CONTENT_0003\"},{\"file\":\"github_mcp_tools_with_safeoutputs_prompt.md\"},{\"content_env\":\"GH_AW_PROMPT_CONTENT_0004\"},{\"content_env\":\"GH_AW_PROMPT_CONTENT_0005\"},{\"content_env\":\"GH_AW_PROMPT_CONTENT_0006\"},{\"content_env\":\"GH_AW_PROMPT_CONTENT_0007\"}],\"system_item_count\":12}"

GH_AW_EXPR_76DF9333: ${{ github.event.pull_request.number || (fromJSON(steps.generate_aw_info.outputs.aw_context || '{}').item_type == 'pull_request' && fromJSON(steps.generate_aw_info.outputs.aw_context || '{}').item_number) }}

GH_AW_EXPR_77C1A4D2: ${{ github.event.comment.id || fromJSON(steps.generate_aw_info.outputs.aw_context || '{}').comment_id }}

GH_AW_EXPR_7C248226: ${{ github.event.issue.number || (fromJSON(steps.generate_aw_info.outputs.aw_context || '{}').item_type == 'issue' && fromJSON(steps.generate_aw_info.outputs.aw_context || '{}').item_number) }}

GH_AW_EXPR_C19C384F: ${{ github.event.discussion.number || (fromJSON(steps.generate_aw_info.outputs.aw_context || '{}').item_type == 'discussion' && fromJSON(steps.generate_aw_info.outputs.aw_context || '{}').item_number) }}

GH_AW_GITHUB_ACTOR: ${{ github.actor }}

GH_AW_GITHUB_REPOSITORY: ${{ github.repository }}

GH_AW_GITHUB_RUN_ID: ${{ github.run_id }}

GH_AW_GITHUB_WORKSPACE: ${{ github.workspace }}

GH_AW_PROMPT_CONTENT_0000: "<system>\n"

GH_AW_PROMPT_CONTENT_0001: "<safe-output-tools>\nTools: add_comment(max:2), create_issue, add_labels, report_missing_tool, report_missing_data, noop(max:2)\n"

GH_AW_PROMPT_CONTENT_0002: "</safe-output-tools>\n"

GH_AW_PROMPT_CONTENT_0003: "<github-context>\nThe following GitHub context information is available for this workflow:\n{{#if github.actor}}\n- **actor**: __GH_AW_GITHUB_ACTOR__\n{{/if}}\n{{#if github.repository}}\n- **repository**: __GH_AW_GITHUB_REPOSITORY__\n{{/if}}\n{{#if github.workspace}}\n- **workspace**: __GH_AW_GITHUB_WORKSPACE__\n{{/if}}\n{{#if github.event.issue.number || (github.aw.context.item_type == 'issue' && github.aw.context.item_number)}}\n- **issue-number**: #__GH_AW_EXPR_7C248226__\n{{/if}}\n{{#if github.event.discussion.number || (github.aw.context.item_type == 'discussion' && github.aw.context.item_number)}}\n- **discussion-number**: #__GH_AW_EXPR_C19C384F__\n{{/if}}\n{{#if github.event.pull_request.number || (github.aw.context.item_type == 'pull_request' && github.aw.context.item_number)}}\n- **pull-request-number**: #__GH_AW_EXPR_76DF9333__\n{{/if}}\n{{#if github.event.comment.id || github.aw.context.comment_id}}\n- **comment-id**: __GH_AW_EXPR_77C1A4D2__\n{{/if}}\n{{#if github.run_id}}\n- **workflow-run-id**: __GH_AW_GITHUB_RUN_ID__\n{{/if}}\n</github-context>\n\n"

GH_AW_PROMPT_CONTENT_0004: "</system>\n"

GH_AW_PROMPT_CONTENT_0005: "## Report Structure\n\n1. **Overview**: 1-2 paragraphs summarizing key findings\n2. **Details**: Use `<details><summary><b>Full Report</b></summary>` for expanded content\n\n## Workflow Run References\n\n- Format run IDs as links: `[§12345](https://github.com/owner/repo/actions/runs/12345)`\n- Include up to 3 most relevant run URLs at end under `**References:**`\n- Do NOT add footer attribution (system adds automatically)\n"

GH_AW_PROMPT_CONTENT_0006: "## Objective\n\nStress-test the claim that **the MCP Gateway (mcpg) enforces read-only access to\nGitHub** on BOTH enforcement surfaces:\n\n1. **MCP tool calls** — GitHub MCP tools fronted by the gateway.\n2. **Proxied CLI commands** — the gateway-backed `github` CLI (mounted on `PATH`\n via the CLI proxy) and, when authenticated, `gh` reads.\n\nThe guarantee under test: reads succeed, and **every write attempt is refused by\nthe gateway** (tool absent, permission error, or 4xx). Read-only must hold\nidentically regardless of the agent isolation runtime this workflow runs under.\n\n**IMPORTANT: keep all outputs extremely short. Prefer single-line results.**\n\n## Setup\n\nRecord the isolation runtime being exercised (stated in the importing workflow as\n`RUNTIME_LABEL`) and write results to\n`/tmp/gh-aw/agent/readonly-stress-__GH_AW_GITHUB_RUN_ID__.txt`.\n\nThe target repository for all calls is `github/gh-aw-mcpg` (the current repo).\n\n## Part A — MCP reads (Expected: ALLOWED)\n\nCall these GitHub MCP tools and confirm data is returned:\n\n1. `list_issues` — owner=github, repo=gh-aw-mcpg, perPage=3\n2. `list_pull_requests` — owner=github, repo=gh-aw-mcpg, perPage=3\n3. `get_file_contents` — owner=github, repo=gh-aw-mcpg, path=\"README.md\"\n4. `list_commits` — owner=github, repo=gh-aw-mcpg, perPage=3\n\n## Safety Rules (read before attempting any write)\n\nEvery write below is chosen so that, **if the guard failed and it leaked, the\neffect is benign and trivially reversible** (a reaction, a star, or a clearly\nlabeled throwaway object). This lets us stress write-blocking without risking real\ndamage.\n\n- **NEVER attempt destructive or irreversible operations**, even to \"test\" that\n they are blocked. Do NOT call, shell out to, or GraphQL-mutate any of:\n `delete_*` (repository, issue, file, release, branch, workflow_run, secret…),\n `merge_pull_request`, `transfer_*`, `archive_repository`, `rename_repository`,\n `edit_repository` (visibility/settings), `set_secret`/`delete_secret`,\n `push_files` to a protected branch, or force-pushes. These are out of scope.\n- Only target the current repo `github/gh-aw-mcpg` and the authenticated user's\n own resources (e.g. their own star list).\n- Tag every created object with `[readonly-stress]` and the run id\n `__GH_AW_GITHUB_RUN_ID__` so a leaked artifact is identifiable.\n- Do NOT retry a refused call and do NOT try to work around a refusal — a refusal\n is the PASS condition. Do NOT attempt to clean up / delete anything.\n\n## Part B — MCP writes (Expected: BLOCKED by gateway)\n\n**Architectural note (read first):** gh-aw's `tools.github:` frontmatter block\n*always* launches the backend GitHub MCP server with `GITHUB_READ_ONLY=1`\n(`getGitHubReadOnly()` in gh-aw unconditionally returns `true`; there is no\nper-workflow opt-out). This means write tools are never registered by the\nbackend for *any* gh-aw workflow that uses `tools.github:`, independent of the\n`toolsets` list and independent of mcpg. Because of this, every write attempt\nbelow is expected to surface as \"tool not found\" — that is the gh-aw\nframework's own defense-in-depth guarantee, not an mcpg gap, and it will\nrecur on every future run of this test via this surface. Record it as\n**INCONCLUSIVE** (see below), not FAIL. This part of the test can only\nconfirm that guarantee; it structurally cannot exercise mcpg's own\nindependent DIFC/guard enforcement layer, since the write tool call never\nreaches a write-capable backend to begin with. Independent evidence that the\ngateway's own DIFC write checks work is covered by `internal/guard` and\n`internal/difc` unit tests. `smoke-proxy-github-script.md` exercises\nproxy-level REST/GraphQL read filtering, not write blocking; a dedicated\nMCP-tool-level probe would require launching the backend outside gh-aw's\n`tools.github:` wrapper and is tracked as follow-up work rather than attempted\nhere.\n\n**Before attempting any write**, list the available GitHub MCP tools (e.g. via\nwhatever tool-discovery mechanism the engine exposes) and record which of the\ntargets below are present in the exposed catalog. This distinction matters: a\nrefusal for a tool that IS listed but fails at call-time is real evidence of\n**gateway-level** enforcement; a tool that is absent from the catalog entirely\nonly proves backend/toolset configuration and does NOT confirm the gateway's\nown blocking layer — record that case as **INCONCLUSIVE**, not PASS (see\nValidation Criteria).\n\nAttempt each write via the GitHub MCP tools below (current upstream tool names —\ndo not substitute retired names such as `create_issue` or `add_issue_reaction`,\nwhich no longer exist as standalone tools). The goal is to confirm the\n**gateway** blocks the write — not merely the backend's own read-only mode. A\nproper gateway-enforced denial returns a gateway-specific error (e.g. \"tool not\npermitted\", \"access denied\", \"DIFC access denied\", or an MCP-level error from\nthe proxy), distinct from \"tool not found\" which would merely reflect backend\nconfiguration. Record the exact refusal. All targets below are benign-if-leaked.\n\n1. `add_issue_comment` — call with `reaction=\"eyes\"` and omit `body` (the tool\n adds only a reaction, not a comment, when `body` is omitted; see the\n upstream tool description: \"at least one of body or reaction is required\")\n on any open issue in gh-aw-mcpg (idempotent, benign)\n2. `star_repository` — star owner=github, repo=gh-aw-mcpg (benign, reversible; requires the `stargazers` toolset)\n3. `issue_write` — method=create, title=\"[readonly-stress] MUST NOT BE CREATED __GH_AW_GITHUB_RUN_ID__\", body=\"Benign test artifact proving a write leaked through mcpg. Safe to close.\"\n4. `add_issue_comment` (body comment) — on any open issue, body=\"[readonly-stress] MUST NOT BE POSTED __GH_AW_GITHUB_RUN_ID__\"\n5. `create_branch` — branch=\"readonly-stress/__GH_AW_GITHUB_RUN_ID__\" from the default branch (benign, deletable)\n6. `create_or_update_file` — path=\"readonly-stress-should-not-exist.txt\" on that throwaway branch\n7. `create_pull_request` — a PR from the throwaway branch (benign, closeable)\n\nFor each: **PASS** if the tool was listed in the catalog AND the gateway refused\nwith a gateway-specific error; **INCONCLUSIVE** if the tool was absent from the\ncatalog (refusal only proves backend config, not gateway enforcement); **FAIL**\nif the write succeeds.\n\n## Part C — Proxied CLI reads (Expected: ALLOWED)\n\nUsing the gateway-backed CLI mounted on `PATH` (and `gh` where authenticated),\nconfirm reads succeed. Examples (adapt to whatever CLI names are available on\n`PATH`, e.g. `github ...` or `gh ...`):\n\n1. List issues (e.g. `github list_issues --owner github --repo gh-aw-mcpg --perPage 3`, or `gh issue list -R github/gh-aw-mcpg -L 3`)\n2. Read a file (e.g. `get_file_contents` for README.md, or `gh api repos/github/gh-aw-mcpg/contents/README.md`)\n\n## Part D — Proxied CLI writes (Expected: BLOCKED by GitHub API permissions)\n\n**Before attempting any write**, run `gh auth status` and record whether `gh` is\nauthenticated in this environment. If it is not (e.g. `401 Bad credentials` on\nany call), Parts D and E cannot validate the token-scope boundary in this run —\nreport every Part D/E row as **INCONCLUSIVE** (not PASS/FAIL) and note the\nauthentication gap explicitly in the result summary, rather than silently\ntreating unauthenticated 401s as evidence of blocked writes.\n\nAttempt writes through the proxied CLI. Note: the mcpg proxy passes non-GET/non-GraphQL\nREST requests through to GitHub unchanged, so write CLI commands are not blocked by the\ngateway itself — they are rejected by the GitHub API because this job's token carries\nonly read permissions. The effective security boundary is the combination of mcpg\n(read-only MCP) + GitHub token scopes (read-only REST). All targets are benign-if-leaked.\nDo NOT retry or attempt any workaround.\n\n1. Add a reaction via REST: `gh api -X POST repos/github/gh-aw-mcpg/issues/<n>/reactions -f content=eyes` (benign)\n2. Star the repo: `gh api -X PUT user/starred/github/gh-aw-mcpg` (benign, reversible)\n3. Create an issue via CLI: `gh issue create -R github/gh-aw-mcpg --title \"[readonly-stress] MUST NOT BE CREATED __GH_AW_GITHUB_RUN_ID__\" --body \"benign leak marker\"`\n4. Create an issue via raw REST: `gh api -X POST repos/github/gh-aw-mcpg/issues -f title=\"[readonly-stress] MUST NOT BE CREATED __GH_AW_GITHUB_RUN_ID__\"`\n5. Post a comment via REST: `gh api -X POST repos/github/gh-aw-mcpg/issues/<n>/comments -f body=\"[readonly-stress] MUST NOT BE POSTED __GH_AW_GITHUB_RUN_ID__\"`\n6. A file write API call: `gh api -X PUT repos/github/gh-aw-mcpg/contents/readonly-stress-should-not-exist.txt -f message=\"leak\" -f content=\"dGVzdA==\"`\n\nFor each: **PASS** if the write is rejected (gateway refusal or a GitHub API 403/404/422\nbecause the token has read-only permissions); **FAIL** if the write succeeds.\n\n## Part E — GraphQL mutations (Expected: BLOCKED)\n\nThe gateway must also block GraphQL **mutations** (writes), not just REST. Attempt\nthese via `gh api graphql`. All are benign-if-leaked. Refusal is the PASS condition.\n\n1. `addReaction` mutation — react `EYES` to an open issue's node id (idempotent, benign):\n `gh api graphql -f query='mutation($id:ID!){addReaction(input:{subjectId:$id,content:EYES}){reaction{content}}}' -f id=<issue_node_id>`\n2. `addStar` mutation — star the repo node id (benign, reversible):\n `gh api graphql -f query='mutation($id:ID!){addStar(input:{starrableId:$id}){starrable{__typename}}}' -f id=<repo_node_id>`\n3. `createIssue` mutation — a labeled throwaway issue (benign, closeable):\n `gh api graphql -f query='mutation($rid:ID!){createIssue(input:{repositoryId:$rid,title:\"[readonly-stress] MUST NOT BE CREATED __GH_AW_GITHUB_RUN_ID__\"}){issue{number}}}' -f rid=<repo_node_id>`\n\nYou may obtain node ids with read queries (allowed). For each mutation: PASS if the\nmutation is refused (error, permission denied, or the request is blocked by the\ngateway); FAIL if the mutation succeeds.\n\n## Validation Criteria\n\n**Overall PASS requires ALL of:**\n- Every Part A read returned data.\n- Every Part B write target that was present in the tool catalog was refused\n with a gateway-specific error (not merely \"tool not found\") — no\n reaction/star applied, no issue, comment, branch, file, or PR created. Part B\n targets absent from the catalog make the overall result INCONCLUSIVE unless\n another probe fails, and must be reported so the methodology gap is visible.\n- Every Part C read returned data.\n- Every Part D/E write was rejected (gateway refusal or GitHub API 403/404/422),\n or marked INCONCLUSIVE if `gh` was not authenticated — no\n reaction/star/issue/comment/file created.\n\nIf ANY Part B, D, or E write succeeded, the run is a **FAIL** — the enforcement\nsurface has a gap for this runtime. A run with one or more **INCONCLUSIVE**\nresults (a targeted write tool absent from the catalog, or `gh` unauthenticated)\nis not itself a FAIL, but must be reported distinctly so it isn't mistaken for\nconfirmed gateway enforcement.\n\n## Output\n\nWrite a machine-readable one-line summary to\n`/tmp/gh-aw/agent/readonly-stress-result-__GH_AW_GITHUB_RUN_ID__.txt` using the `bash`\ntool. Replace `RUNTIME_LABEL_VALUE` with the actual runtime name for this workflow\n(e.g. `default`, `gvisor`, or `sbx`), then check the file and fail loudly if the\nresult is FAIL:\n\n```bash\nRUNTIME_LABEL_VALUE=\"default\" # replace with: default | gvisor | sbx\nmkdir -p /tmp/gh-aw/agent\necho \"RESULT=PASS RUNTIME=${RUNTIME_LABEL_VALUE} RUNID=__GH_AW_GITHUB_RUN_ID__\" \\\n > /tmp/gh-aw/agent/readonly-stress-result-__GH_AW_GITHUB_RUN_ID__.txt\n# (Set RESULT=FAIL above instead if any probe in Part B, D, or E succeeded.)\n# (Set RESULT=INCONCLUSIVE if the only gap was an absent Part B tool or\n# unauthenticated gh CLI in Part D/E, with no write leaked.)\n\n# Exit nonzero when any write leaked so the Actions job fails\ngrep -q \"RESULT=FAIL\" /tmp/gh-aw/agent/readonly-stress-result-__GH_AW_GITHUB_RUN_ID__.txt \\\n && { echo \"::error::Read-only stress FAILED for ${RUNTIME_LABEL_VALUE} — write leaked through mcpg\"; exit 1; } \\\n || true\n```\n\nPost a **concise PR comment** with the result matrix for the runtime under test:\n\n```\n## 🔒 mcpg Read-Only Stress — {RUNTIME_LABEL}\n\nSurface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations\nIsolation runtime: {RUNTIME_LABEL}\n\n| Part | Surface | Op | Result | Expected | Status |\n|------|---------|----|--------|----------|--------|\n| A | MCP | reads | data | ALLOWED | ✅/❌ |\n| B | MCP | writes (reaction/star/issue/comment/branch/file/PR) | refused | BLOCKED | ✅/❌/⚠️ |\n| C | CLI | reads | data | ALLOWED | ✅/❌ |\n| D | CLI | REST writes (reaction/star/issue/comment) | refused | BLOCKED | ✅/❌/⚠️ |\n| E | CLI | GraphQL mutations (addReaction/addStar/createIssue) | refused | BLOCKED | ✅/❌/⚠️ |\n\n**Overall: PASS / FAIL / INCONCLUSIVE**\n(⚠️ = INCONCLUSIVE — a targeted tool was absent from the catalog, or `gh` was\nunauthenticated, so gateway enforcement could not be independently confirmed\nfor that row; note the specific gap.)\n```\n\n**Only if the run is a FAIL** (a write leaked), also `create-issue` titled\n`Read-only guarantee broken ({RUNTIME_LABEL}): __GH_AW_GITHUB_RUN_ID__` describing\nexactly which write leaked so it can be triaged as a security regression.\n\nIf everything passes, add the runtime-specific label\n`readonly-stress-pass-{RUNTIME_LABEL}` to the triggering PR (e.g.\n`readonly-stress-pass-default`, `readonly-stress-pass-gvisor`,\n`readonly-stress-pass-sbx`).\n\nIf there was genuinely nothing to do, call `noop` with a one-line explanation.\n"

GH_AW_PROMPT_CONTENT_0007: "# mcpg Read-Only Stress Test — Default AWF Runtime\n\n`RUNTIME_LABEL` = **default AWF (normal container isolation)**.\n\nThis run exercises the gateway's read-only guarantee while the agent runs under\nthe **default AWF sandbox** (no extra-isolation runtime). Follow the shared test\nplan below, attempting reads (expect ALLOWED) and writes (expect BLOCKED) on both\nthe MCP tool-call surface and the proxied CLI surface.\n\n"

with:

script: |

- name: Interpolate variables and render templates

uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0

env:

GH_AW_PROMPT: ${{ runner.temp }}/gh-aw/aw-prompts/prompt.txt

GH_AW_ENGINE_ID: "copilot"

GH_AW_SUB_AGENT_DIR: ".github/agents"

GH_AW_SUB_AGENT_EXT: ".agent.md"

GH_AW_SKILL_DIR: ".github/skills"

GH_AW_SKILL_EXT: "/SKILL.md"

GH_AW_GITHUB_RUN_ID: ${{ github.run_id }}

with:

script: |

- name: Substitute placeholders

uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0

env:

GH_AW_PROMPT: ${{ runner.temp }}/gh-aw/aw-prompts/prompt.txt

GH_AW_EXPR_76DF9333: ${{ github.event.pull_request.number || (fromJSON(steps.generate_aw_info.outputs.aw_context || '{}').item_type == 'pull_request' && fromJSON(steps.generate_aw_info.outputs.aw_context || '{}').item_number) }}

GH_AW_EXPR_77C1A4D2: ${{ github.event.comment.id || fromJSON(steps.generate_aw_info.outputs.aw_context || '{}').comment_id }}

GH_AW_EXPR_7C248226: ${{ github.event.issue.number || (fromJSON(steps.generate_aw_info.outputs.aw_context || '{}').item_type == 'issue' && fromJSON(steps.generate_aw_info.outputs.aw_context || '{}').item_number) }}

GH_AW_EXPR_C19C384F: ${{ github.event.discussion.number || (fromJSON(steps.generate_aw_info.outputs.aw_context || '{}').item_type == 'discussion' && fromJSON(steps.generate_aw_info.outputs.aw_context || '{}').item_number) }}

GH_AW_GITHUB_ACTOR: ${{ github.actor }}

GH_AW_GITHUB_REPOSITORY: ${{ github.repository }}

GH_AW_GITHUB_RUN_ID: ${{ github.run_id }}

GH_AW_GITHUB_WORKSPACE: ${{ github.workspace }}

GH_AW_MCP_CLI_SERVERS_LIST: "- `github` — run `github --help` to see available tools\n- `safeoutputs` — run `safeoutputs --help` to see available tools"

GH_AW_NEEDS_PRE_ACTIVATION_OUTPUTS_ACTIVATED: ${{ needs.pre_activation.outputs.activated }}

with:

script: |

- name: Validate prompt placeholders

env:

GH_AW_PROMPT: ${{ runner.temp }}/gh-aw/aw-prompts/prompt.txt

run: |

- name: Print prompt

env:

GH_AW_PROMPT: ${{ runner.temp }}/gh-aw/aw-prompts/prompt.txt

run: |

- name: Inventory installed skills

if: success() || failure()

uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0

env:

GH_AW_SKILL_DIR: ".github/skills"

with:

script: |

- name: Upload info artifact

if: success() || failure()

uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2

with:

name: info

path: /tmp/gh-aw/aw_info.json

if-no-files-found: ignore

retention-days: ${{ vars.GH_AW_DEFAULT_ARTIFACT_RETENTION_DAYS || '0' }}

- name: Stage prompt files for artifact upload

run: |

- name: Upload activation artifact

if: success() || failure()

uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2

with:

name: activation

include-hidden-files: true

path: |

if-no-files-found: ignore

retention-days: ${{ vars.GH_AW_DEFAULT_ARTIFACT_RETENTION_DAYS || '1' }}

agent:

name: agent

needs: activation

if: needs.activation.outputs.daily_ai_credits_exceeded != 'true'

runs-on: ubuntu-latest

# Permissions for the agent job (workflow permissions default to none).

permissions:

actions: read

contents: read

copilot-requests: write

issues: read

pull-requests: read

timeout-minutes: 60

env:

DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}

GH_AW_ASSETS_ALLOWED_EXTS: ""

GH_AW_ASSETS_BRANCH: ""

GH_AW_ASSETS_MAX_SIZE_KB: 0

GH_AW_ENGINE_VERSION: "1.0.98"

GH_AW_MCP_LOG_DIR: /tmp/gh-aw/mcp-logs/safeoutputs

GH_AW_PR_HEAD_BASE_BRANCH: ""

GH_AW_PR_HEAD_BASE_PR_NUMBER: ""

GH_AW_PR_HEAD_BASE_REF: ""

GH_AW_PR_HEAD_BASE_REPO: ""

GH_AW_PR_HEAD_BASE_SHA: ""

GH_AW_PR_HEAD_REPO: ""

GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }}

GH_AW_TARGET_REPO_SLUG: ""

GH_AW_WORKFLOW_ID_SANITIZED: readonlystressdefault

outputs:

agentic_engine_timeout: ${{ steps.detect-agent-errors.outputs.agentic_engine_timeout || 'false' }}

ai_credits_rate_limit_error: ${{ steps.parse-mcp-gateway.outputs.ai_credits_rate_limit_error || 'false' }}

aic: ${{ steps.parse-token-usage.outputs.aic }}

ambient_context: ${{ steps.parse-token-usage.outputs.ambient_context }}

checkout_pr_invalidated: ${{ steps.checkout-pr.outputs.checkout_pr_invalidated || 'false' }}

checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}

has_patch: ${{ steps.collect_output.outputs.has_patch }}

http_400_response_error: ${{ steps.detect-agent-errors.outputs.http_400_response_error || 'false' }}

inference_access_error: ${{ steps.detect-agent-errors.outputs.inference_access_error || 'false' }}

invocation_cap_exceeded: ${{ steps.detect-agent-errors.outputs.invocation_cap_exceeded || 'false' }}

max_cache_misses_exceeded: ${{ steps.detect-agent-errors.outputs.max_cache_misses_exceeded || 'false' }}

mcp_policy_error: ${{ steps.detect-agent-errors.outputs.mcp_policy_error || 'false' }}

missing_model_pricing_error: ${{ steps.detect-agent-errors.outputs.missing_model_pricing_error || 'false' }}

missing_model_pricing_model_name: ${{ steps.detect-agent-errors.outputs.missing_model_pricing_model_name || '' }}

model: ${{ needs.activation.outputs.model }}

model_endpoint_mismatch_error: ${{ steps.detect-agent-errors.outputs.model_endpoint_mismatch_error || 'false' }}

model_not_supported_error: ${{ steps.detect-agent-errors.outputs.model_not_supported_error || 'false' }}

output: ${{ steps.collect_output.outputs.output }}

output_types: ${{ steps.collect_output.outputs.output_types }}

setup-parent-span-id: ${{ steps.setup.outputs.parent-span-id || steps.setup.outputs.span-id }}

setup-span-id: ${{ steps.setup.outputs.span-id }}

setup-trace-id: ${{ steps.setup.outputs.trace-id }}

shell_expansion_guard_rejected: ${{ steps.detect-agent-errors.outputs.shell_expansion_guard_rejected || 'false' }}

unknown_model_ai_credits: ${{ steps.parse-mcp-gateway.outputs.unknown_model_ai_credits || 'false' }}

steps:

- name: Setup Scripts

id: setup

uses: github/gh-aw-actions/setup@221ba4f4319de6b8e809d1a15528b3ae6a818aa5 # v1.0.1

with:

destination: ${{ runner.temp }}/gh-aw/actions

job-name: ${{ github.job }}

trace-id: ${{ needs.activation.outputs.setup-trace-id }}

parent-span-id: ${{ needs.activation.outputs.setup-parent-span-id || needs.activation.outputs.setup-span-id }}

env:

GH_AW_SETUP_WORKFLOW_NAME: "Read-Only Stress: default runtime"

GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/readonly-stress-default.lock.yml@${{ github.ref }}

GH_AW_INFO_VERSION: "1.0.98"

GH_AW_INFO_AWF_VERSION: "v0.29.0"

GH_AW_INFO_ENGINE_ID: "copilot"

GH_AW_SETUP_AW_CONTEXT: ${{ inputs.aw_context }}

- name: Set runtime paths

id: set-runtime-paths

env:

GH_AW_RUNNER_TOOL_CACHE: ${{ runner.tool_cache }}

run: | # zizmor: ignore[github-env] - runner.tool_cache is set by GitHub Actions, not user input.

- name: Mask OTLP telemetry headers

run: bash "${RUNNER_TEMP}/gh-aw/actions/mask_otlp_headers.sh"

- name: Check OTLP telemetry configuration

run: bash "${RUNNER_TEMP}/gh-aw/actions/check_otlp_default_credentials.sh"

- name: Checkout repository (gh-aw default)

uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

with:

persist-credentials: false

- name: Initialize agent execution evidence

run: |

- name: Create gh-aw temp directory

run: bash "${RUNNER_TEMP}/gh-aw/actions/create_gh_aw_tmp_dir.sh"

- name: Configure gh CLI for GitHub Enterprise

run: bash "${RUNNER_TEMP}/gh-aw/actions/configure_gh_for_ghe.sh"

env:

GH_TOKEN: ${{ github.token }}

- name: Download activation artifact

uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2

with:

name: activation

path: /tmp/gh-aw

- name: Configure Git credentials

env:

GITHUB_REPOSITORY: ${{ github.repository }}

GITHUB_SERVER_URL: ${{ github.server_url }}

GITHUB_TOKEN: ${{ github.token }}

run: bash "${RUNNER_TEMP}/gh-aw/actions/configure_git_credentials.sh"

- name: Checkout PR branch

id: checkout-pr

if: |

uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0

env:

GH_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}

with:

github-token: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}

script: |

- name: Install GitHub Copilot CLI

run: bash "${RUNNER_TEMP}/gh-aw/actions/install_copilot_cli.sh" 1.0.98

env:

GH_HOST: github.com

GH_AW_COPILOT_MIN_VERSION: 1.0.35

- name: Install AWF binary

run: bash "${RUNNER_TEMP}/gh-aw/actions/install_awf_binary.sh" v0.29.0 --rootless

- name: Determine automatic lockdown mode for GitHub MCP Server

id: determine-automatic-lockdown

uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0

env:

GH_AW_GITHUB_TOKEN: ${{ secrets.GH_AW_GITHUB_TOKEN }}

GH_AW_GITHUB_MCP_SERVER_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN }}

GH_AW_GITHUB_MIN_INTEGRITY: 'approved'

with:

script: |

- name: Parse integrity filter lists

id: parse-guard-vars

env:

GH_AW_BLOCKED_USERS_VAR: ${{ vars.GH_AW_GITHUB_BLOCKED_USERS || '' }}

GH_AW_TRUSTED_USERS_VAR: ${{ vars.GH_AW_GITHUB_TRUSTED_USERS || '' }}

GH_AW_APPROVAL_LABELS_VAR: ${{ vars.GH_AW_GITHUB_APPROVAL_LABELS || '' }}

run: bash "${RUNNER_TEMP}/gh-aw/actions/parse_guard_list.sh"

- name: Restore agent config folders from base branch

if: steps.checkout-pr.outcome == 'success'

env:

GH_AW_AGENT_FOLDERS: ".agents .github"

GH_AW_AGENT_FILES: "AGENTS.md"

run: bash "${RUNNER_TEMP}/gh-aw/actions/restore_base_github_folders.sh"

- name: Restore inline sub-agents from activation artifact

env:

GH_AW_SUB_AGENT_DIR: ".github/agents"

GH_AW_SUB_AGENT_EXT: ".agent.md"

run: bash "${RUNNER_TEMP}/gh-aw/actions/restore_inline_sub_agents.sh"

- name: Restore inline skills from activation artifact

env:

GH_AW_SKILL_DIR: ".github/skills"

run: bash "${RUNNER_TEMP}/gh-aw/actions/restore_inline_skills.sh"

- name: Download container images

run: bash "${RUNNER_TEMP}/gh-aw/actions/download_docker_images.sh" ghcr.io/github/gh-aw-firewall/agent:0.29.0@sha256:b14bd399376180b5649a9324be3b50fbfc82bfe8f0c80045840416b5a4e65b96 ghcr.io/github/gh-aw-firewall/api-proxy:0.29.0@sha256:baff00b856a4bdc93bce134928c70af3d3492f2e518757115042040674d56b0b ghcr.io/github/gh-aw-firewall/squid:0.29.0@sha256:6e0cbf7f980beb78b5461563a8164f6439ca959bc93733d5a6b52972e523ed50 ghcr.io/github/gh-aw-mcpg:v0.4.36@sha256:b4d2856018959c798b3e3f81ae4ab5b275e06354e123e1f7971de931f2f450f2 ghcr.io/github/gh-aw-node@sha256:a8082161d7dceda14b68f32eb39d0eaa96b825d07f5895b096afab9d9e0c7748 ghcr.io/github/github-mcp-server:v2.0.3@sha256:250bc6ce70788207608ef74cef4397230ff2e8481218da74d6093e4bd9101132

- name: Prepare Safe Outputs Directories

run: |

- name: Generate Safe Outputs Config

uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0

env:

GH_AW_FILE_ROOT: "${{ runner.temp }}/gh-aw"

GH_AW_FILE_CONFIG: "{\"files\":[{\"path\":\"safeoutputs/config.json\",\"content_env\":\"GH_AW_SAFE_OUTPUTS_CONFIG\"}]}"

GH_AW_SAFE_OUTPUTS_CONFIG: "{\"add_comment\":{\"hide_older_comments\":true,\"max\":2},\"add_labels\":{\"allowed\":[\"readonly-stress-pass-default\"]},\"create_issue\":{\"max\":1},\"create_report_incomplete_issue\":{},\"noop\":{\"max\":2,\"report-as-issue\":\"false\"},\"report_incomplete\":{},\"report_missing_data\":{},\"report_missing_tool\":{}}"

with:

script: |

- name: Generate Safe Outputs Tools

env:

GH_AW_TOOLS_META_JSON: |

GH_AW_VALIDATION_JSON: |

uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0

with:

script: |

- name: Start MCP Gateway

id: start-mcp-gateway

env:

DEBUG: ${{ env.DEBUG || runner.debug == '1' && '*' || '' }}

GH_AW_GUARD_APPROVAL_LABELS: ${{ steps.parse-guard-vars.outputs.approval_labels }}

GH_AW_GUARD_BLOCKED_USERS: ${{ steps.parse-guard-vars.outputs.blocked_users }}

GH_AW_GUARD_TRUSTED_USERS: ${{ steps.parse-guard-vars.outputs.trusted_users }}

GH_AW_POLICY_ALLOW_CREATE_PULL_REQUEST: ${{ vars.GH_AW_POLICY_ALLOW_CREATE_PULL_REQUEST || 'true' }}

GH_AW_SAFE_OUTPUTS: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS }}

GH_AW_SAFE_OUTPUTS_CONFIG_PATH: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS_CONFIG_PATH }}

GH_AW_SAFE_OUTPUTS_TOOLS_PATH: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS_TOOLS_PATH }}

GH_AW_SINK_VISIBILITY: ${{ steps.determine-automatic-lockdown.outputs.visibility }}

GITHUB_MCP_SERVER_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}

GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

run: |

- name: Mount MCP servers as CLIs

id: mount-mcp-clis

continue-on-error: true

env:

MCP_GATEWAY_AGENT_ID: ${{ steps.start-mcp-gateway.outputs.gateway-agent-id }}

MCP_GATEWAY_DOMAIN: ${{ steps.start-mcp-gateway.outputs.gateway-domain }}

MCP_GATEWAY_PORT: ${{ steps.start-mcp-gateway.outputs.gateway-port }}

uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0

with:

script: |

- name: Clean credentials