[awf] host access: support allow-host-ports for services: ports without legacy-security

[lpcox]

Problem
gh-aw's compiler only emits AWF's --allow-host-ports/--enable-host-access flags in legacy-security mode, and even then the port list is hardcoded to 80,443,<mcp-gateway-port>. There is no way for a strict-security workflow to reach a GitHub Actions services: container port (e.g. Postgres 5432) from inside the AWF sandbox.

Context
Original report: github/gh-aw#51433 (follow-up to gh-aw#22939, previously addressed on the AWF side by #1436)

Root Cause
AWF already supports arbitrary --allow-host-ports values (added for #1436), so the capability exists. The gap is entirely on the gh-aw compiler side (pkg/workflow/awf_command_builder.go) which never derives ports from services: and never emits the flag outside legacy mode — not an AWF defect, but AWF should confirm/document that a strict-security-compatible port allowlist (without --enable-host-access) is fully supported and low-risk.

Proposed Solution

• Confirm AWF's --allow-host-ports works standalone without --enable-host-access (per the linked issue's runtime finding that host-access alone was insufficient).
• Document this combination explicitly in AWF's docs/awf-config-spec.md so gh-aw's compiler fix (deriving ports from services:) can rely on it without requiring full host access.
• No AWF code change expected; primarily a documentation/confirmation task and a note to gh-aw maintainers.

Generated by Firewall Issue Dispatcher · auto · 32.5 AIC · ⊞ 8.9K · ◷

[github-actions]

👋 Hello! I noticed this issue might be related to an existing issue:

• [awf] --allow-host-ports hardcoded to 80,443,(mcp-port); allowHostServicePorts never wired up #7132 - "[awf] --allow-host-ports hardcoded to 80,443,(mcp-port); allowHostServicePorts never wired up" — this describes the same root cause (gh-aw's awf_command_builder.go hardcoding the port list and only emitting host-access flags in legacy-security mode, tracked back to the same upstream report gh-aw#51433) and proposes essentially the same fix path (deriving ports from services: and confirming/wiring allowHostServicePorts end-to-end).

If #7132 already covers your concern, please consider closing this issue as a duplicate. Otherwise, feel free to clarify how this issue differs (e.g. if this one is scoped specifically to documentation/confirmation rather than the wiring fix).

This is an automated message from the issue duplication detector.

Generated by Issue Duplication Detector for #7149 · auto · 13.8 AIC · ⊞ 10.8K · ◷