Safe-outputs MCP gateway fails when GH_AW_TARGET_REPO_SLUG is unset #68881

Summary

A normal, non-trial agentic workflow using safe outputs can fail during Start MCP Gateway before the agent executes because the generated MCP configuration references GH_AW_TARGET_REPO_SLUG, but the generated gateway startup environment does not always define it.

Observed failure: https://github.com/github/gh-aw/actions/runs/38649514586/job/116154205337

config:expand Variable expansion failed: undefined variables=[GH_AW_TARGET_REPO_SLUG]
failed to load config: Configuration error at configuration: undefined environment variable referenced: GH_AW_TARGET_REPO_SLUG
Suggestion: Set the environment variable GH_AW_TARGET_REPO_SLUG before starting the gateway

The failing step exits with code 1, and Execute GitHub Copilot CLI is skipped.

Regression

The behavior appears to have been introduced by #68815. pkg/workflow/mcp_renderer_builtin.go now includes GH_AW_TARGET_REPO_SLUG unconditionally in the safe-outputs MCP container environment and renders:

"GH_AW_TARGET_REPO_SLUG": "${GH_AW_TARGET_REPO_SLUG}"

However, collectMCPEnvironmentVariables in pkg/workflow/mcp_environment.go only emits the variable when trial mode has a logical repository. After #68858 recompiled the workflow locks, ordinary workflows such as Release (safe-outputs: update-release) contained the unresolved placeholder.

Current behavior

For a non-trial workflow with safe outputs and no explicit cross-repository target:

1. The compiler emits a safe-outputs MCP config that references ${GH_AW_TARGET_REPO_SLUG}.
2. The Start MCP Gateway step does not define or normalize GH_AW_TARGET_REPO_SLUG.
3. Strict gateway variable expansion rejects the configuration.
4. The workflow fails before the agent starts.

The OTLP 401 warnings in the linked run are unrelated and non-fatal; MCP gateway initialization is the first causal failure.

Expected behavior

GH_AW_TARGET_REPO_SLUG should be optional for ordinary safe-output workflows:

• Trial/cross-repository workflows should continue passing the configured repository slug.
• Workflows without a target repository should pass a defined empty value, or the renderer should omit the variable entirely.
• MCP gateway configuration expansion should succeed, allowing the agent to execute.

Suggested fix

Normalize the optional value in pkg/workflow/mcp_setup_gateway.go, beside the existing empty defaults for optional PR-head variables:

yaml.WriteString("          export GH_AW_TARGET_REPO_SLUG=\"${GH_AW_TARGET_REPO_SLUG:-}\"\n")

This preserves real values supplied by trial/cross-repository workflows while ensuring Docker and the strict gateway config expander receive a defined value in all other workflows.

Avoid patching generated .lock.yml files directly; fix compiler generation and recompile affected workflows.

Regression coverage

Add a compiler test that generates MCP setup for a normal, non-trial safe-outputs workflow and verifies:

• the setup exports GH_AW_TARGET_REPO_SLUG="${GH_AW_TARGET_REPO_SLUG:-}";
• the safe-outputs MCP config may reference the variable without causing an undefined-variable startup failure;
• trial mode still emits and preserves a non-empty logical repository slug.