Repository navigation
fix(daily-compiler-quality): unlock bash to enable cache writes and historical trends - #29053
Merged
Merged
Conversation
…istorical trends Add missing bash commands needed for cache management: - mkdir — create cache directories - cat — read/write JSON cache files with heredoc - jq — update JSON cache files atomically - mv — atomically replace cache files via temp - git log -1 --format=%H -- — per-file git hash lookup - wc -l — generalized (replaces wc -l pkg/workflow/compiler*.go) - echo, bc — arithmetic for test-to-source ratio Recompile lock file to apply new shell() allow-tool entries. Agent-Logs-Url: https://github.com/github/gh-aw/sessions/332eebc5-fa3f-487f-b8b7-c1a745845e22 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
…tory Refine security scope of new bash commands per code review: - wc -l: keep specific 'wc -l pkg/workflow/compiler*.go' + add 'wc -l < pkg/workflow/' for stdin redirect pattern - mkdir: scoped to 'mkdir -p /tmp/gh-aw/cache-memory/compiler-quality' - cat: split into 'cat /tmp/gh-aw/cache-memory/' (reads) and 'cat > /tmp/gh-aw/cache-memory/' (heredoc writes) - mv: scoped to 'mv /tmp/gh-aw/cache-memory/' Agent-Logs-Url: https://github.com/github/gh-aw/sessions/332eebc5-fa3f-487f-b8b7-c1a745845e22 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copilot
AI
changed the title
[WIP] Fix daily compiler quality by unlocking bash for cache writes
fix(daily-compiler-quality): unlock bash to enable cache writes and historical trends
Apr 29, 2026
This was referenced Apr 29, 2026
Closed
pelikhan
marked this pull request as ready for review
April 29, 2026 11:23
Contributor
There was a problem hiding this comment.
Pull request overview
Updates the daily-compiler-quality agentic workflow to permit the additional shell commands needed to read/write cache-memory files so analyses can persist across runs and enable historical trending.
Changes:
- Expanded the
tools.bashallowlist indaily-compiler-quality.mdto include cache write/read and simple computation commands. - Recompiled
daily-compiler-quality.lock.ymlso the Copilot CLI invocation includes the new--allow-tool shell(...)permissions.
Show a summary per file
| File | Description |
|---|---|
.github/workflows/daily-compiler-quality.md |
Adds bash allowlist entries intended to enable cache directory creation and JSON read/write/update operations. |
.github/workflows/daily-compiler-quality.lock.yml |
Regenerates the compiled workflow so Copilot CLI receives the new shell allowlist entries. |
Copilot's findings
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comments suppressed due to low confidence (5)
.github/workflows/daily-compiler-quality.md:35
cat /tmp/gh-aw/cache-memory/andcat > /tmp/gh-aw/cache-memory/don’t include any filename/glob, but the workflow uses file paths under that directory (e.g.cat > /tmp/gh-aw/cache-memory/compiler-quality/analyses/...). To ensure the agent can actually read/write the intended cache files under strict mode, prefer allowlist entries that include explicit globs for the JSON files you expect (similar to other workflows usingcat */cat > /tmp/.../*.json).
- "cat /tmp/gh-aw/cache-memory/"
- "cat > /tmp/gh-aw/cache-memory/"
.github/workflows/daily-compiler-quality.md:36
- The workflow’s cache update example runs
jqwith arguments and file paths, but the allowlist only includesjq. In this repo, workflows that need jq typically allowjq *(e.g..github/workflows/auto-triage-issues.md:33) or a more specific jq invocation; otherwise jq may be blocked when any args are present.
- "jq"
.github/workflows/daily-compiler-quality.md:37
- The workflow instructions use
mv /tmp/gh-aw/cache-memory/compiler-quality/file-hashes.json.tmp ..., but the allowlist entry is justmv /tmp/gh-aw/cache-memory/. If shell permissions require argument matching, this may not permit the actual two-argmvcall. Consider allowing a globbedmvpattern for the cache directory (e.g., temp-to-final renames withincompiler-quality/).
- "mv /tmp/gh-aw/cache-memory/"
.github/workflows/daily-compiler-quality.md:32
git log -1 --format=%H --is currently not scoped topkg/workflow/as described in the PR, and it also doesn’t match the way the workflow later calls it (e.g.git log -1 --format=%H -- pkg/workflow/compiler.go). Consider scoping this allowlist entry topkg/workflow/compiler*.go(or similar) so per-file hash lookups work while keeping permissions narrow.
- "git log -1 --format=%H --"
.github/workflows/daily-compiler-quality.md:33
- The allowlist permits
mkdir -p /tmp/gh-aw/cache-memory/compiler-quality, but the workflow instructions later usemkdir -p /tmp/gh-aw/cache-memory/compiler-quality/analyses. If Copilot CLI matches shell permissions on full command/args (as in other workflows that usemkdir -p <exact-path>), cache initialization will still be blocked. Add an allowlist pattern that covers the.../analysessubdir (and any other required subpaths).
- "mkdir -p /tmp/gh-aw/cache-memory/compiler-quality"
- Files reviewed: 2/2 changed files
- Comments generated: 2
| # shellcheck disable=SC1003 | ||
| sudo -E awf --container-workdir "${GITHUB_WORKSPACE}" --mount "${RUNNER_TEMP}/gh-aw:${RUNNER_TEMP}/gh-aw:ro" --mount "${RUNNER_TEMP}/gh-aw:/host${RUNNER_TEMP}/gh-aw:ro" --env-all --exclude-env COPILOT_GITHUB_TOKEN --exclude-env GITHUB_MCP_SERVER_TOKEN --exclude-env MCP_GATEWAY_API_KEY --allow-domains api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,github.com,host.docker.internal,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,ppa.launchpad.net,raw.githubusercontent.com,registry.npmjs.org,s.symcb.com,s.symcd.com,security.ubuntu.com,telemetry.enterprise.githubcopilot.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com,www.googleapis.com --log-level info --proxy-logs-dir /tmp/gh-aw/sandbox/firewall/logs --audit-dir /tmp/gh-aw/sandbox/firewall/audit --enable-host-access --allow-host-ports 80,443,8080 --image-tag 0.25.29,squid=sha256:8a71ad9e40454051672312917e51567abfb8251d7c294d086c48f63d84e4cb53,agent=sha256:e68f37e36962dcb3f3d1de680a49bc2302cefd001b941a7dc377155ec7ce42f4,agent-act=sha256:97b4cc14dc2123a45b9d5b9927489f66882dec5857de6afc0e5bab257be92ef1,api-proxy=sha256:d1219e4110684402aabbeb5a43858f26790c9d0be210581cf3f7a521bd2c87b6,cli-proxy=sha256:29917488eb90a01ff9544ffeeb5cc26434a8ea16d69ae8972f5f6be0e567e276 --skip-pull --enable-api-proxy \ | ||
| -- /bin/bash -c 'export PATH="${RUNNER_TEMP}/gh-aw/mcp-cli/bin:$PATH" && export PATH="$(find /opt/hostedtoolcache /home/runner/work/_tool -maxdepth 4 -type d -name bin 2>/dev/null | tr '\''\n'\'' '\'':'\'')$PATH"; [ -n "$GOROOT" ] && export PATH="$GOROOT/bin:$PATH" || true && GH_AW_NODE_EXEC="${GH_AW_NODE_BIN:-}"; if [ -z "$GH_AW_NODE_EXEC" ] || [ ! -x "$GH_AW_NODE_EXEC" ]; then GH_AW_NODE_EXEC="$(command -v node 2>/dev/null || echo node)"; fi; "$GH_AW_NODE_EXEC" ${RUNNER_TEMP}/gh-aw/actions/copilot_harness.cjs /usr/local/bin/copilot --add-dir /tmp/gh-aw/ --log-level all --log-dir /tmp/gh-aw/sandbox/agent/logs/ --disable-builtin-mcps --no-ask-user --allow-tool github --allow-tool safeoutputs --allow-tool serena --allow-tool '\''shell(cat pkg/**/*.go)'\'' --allow-tool '\''shell(cat)'\'' --allow-tool '\''shell(date)'\'' --allow-tool '\''shell(echo)'\'' --allow-tool '\''shell(find pkg -name '\''\'\'''\''*.go'\''\'\'''\'' ! -name '\''\'\'''\''*_test.go'\''\'\'''\'' -type f)'\'' --allow-tool '\''shell(find pkg -type f -name '\''\'\'''\''*.go'\''\'\'''\'' ! -name '\''\'\'''\''*_test.go'\''\'\'''\'')'\'' --allow-tool '\''shell(find pkg/ -maxdepth 1 -ls)'\'' --allow-tool '\''shell(find pkg/workflow -name '\''\'\'''\''compiler*.go'\''\'\'''\'' ! -name '\''\'\'''\''*_test.go'\''\'\'''\'' -type f)'\'' --allow-tool '\''shell(find pkg/workflow/ -maxdepth 1 -ls)'\'' --allow-tool '\''shell(git log --since='\''\'\'''\''7 days ago'\''\'\'''\'' --format='\''\'\'''\''%h %s'\''\'\'''\'' -- pkg/workflow/compiler*.go)'\'' --allow-tool '\''shell(git log --since='\''\'\'''\''7 days ago'\''\'\'''\'' --oneline --name-only -- pkg/workflow/compiler*.go)'\'' --allow-tool '\''shell(grep -r '\''\'\'''\''func '\''\'\'''\'' pkg --include='\''\'\'''\''*.go'\''\'\'''\'')'\'' --allow-tool '\''shell(grep)'\'' --allow-tool '\''shell(head -n * pkg/**/*.go)'\'' --allow-tool '\''shell(head)'\'' --allow-tool '\''shell(ls)'\'' --allow-tool '\''shell(pwd)'\'' --allow-tool '\''shell(safeoutputs:*)'\'' --allow-tool '\''shell(serena:*)'\'' --allow-tool '\''shell(sort)'\'' --allow-tool '\''shell(tail)'\'' --allow-tool '\''shell(uniq)'\'' --allow-tool '\''shell(wc -l pkg/**/*.go)'\'' --allow-tool '\''shell(wc -l pkg/workflow/compiler*.go)'\'' --allow-tool '\''shell(wc)'\'' --allow-tool '\''shell(yq)'\'' --allow-tool write --add-dir /tmp/gh-aw/cache-memory/ --allow-all-paths --add-dir "${GITHUB_WORKSPACE}" --prompt-file /tmp/gh-aw/aw-prompts/prompt.txt' 2>&1 | tee -a /tmp/gh-aw/agent-stdio.log | ||
| -- /bin/bash -c 'export PATH="${RUNNER_TEMP}/gh-aw/mcp-cli/bin:$PATH" && export PATH="$(find /opt/hostedtoolcache /home/runner/work/_tool -maxdepth 4 -type d -name bin 2>/dev/null | tr '\''\n'\'' '\'':'\'')$PATH"; [ -n "$GOROOT" ] && export PATH="$GOROOT/bin:$PATH" || true && GH_AW_NODE_EXEC="${GH_AW_NODE_BIN:-}"; if [ -z "$GH_AW_NODE_EXEC" ] || [ ! -x "$GH_AW_NODE_EXEC" ]; then GH_AW_NODE_EXEC="$(command -v node 2>/dev/null || echo node)"; fi; "$GH_AW_NODE_EXEC" ${RUNNER_TEMP}/gh-aw/actions/copilot_harness.cjs /usr/local/bin/copilot --add-dir /tmp/gh-aw/ --log-level all --log-dir /tmp/gh-aw/sandbox/agent/logs/ --disable-builtin-mcps --no-ask-user --allow-tool github --allow-tool safeoutputs --allow-tool serena --allow-tool '\''shell(bc)'\'' --allow-tool '\''shell(cat /tmp/gh-aw/cache-memory/)'\'' --allow-tool '\''shell(cat > /tmp/gh-aw/cache-memory/)'\'' --allow-tool '\''shell(cat pkg/**/*.go)'\'' --allow-tool '\''shell(cat)'\'' --allow-tool '\''shell(date)'\'' --allow-tool '\''shell(echo)'\'' --allow-tool '\''shell(find pkg -name '\''\'\'''\''*.go'\''\'\'''\'' ! -name '\''\'\'''\''*_test.go'\''\'\'''\'' -type f)'\'' --allow-tool '\''shell(find pkg -type f -name '\''\'\'''\''*.go'\''\'\'''\'' ! -name '\''\'\'''\''*_test.go'\''\'\'''\'')'\'' --allow-tool '\''shell(find pkg/ -maxdepth 1 -ls)'\'' --allow-tool '\''shell(find pkg/workflow -name '\''\'\'''\''compiler*.go'\''\'\'''\'' ! -name '\''\'\'''\''*_test.go'\''\'\'''\'' -type f)'\'' --allow-tool '\''shell(find pkg/workflow/ -maxdepth 1 -ls)'\'' --allow-tool '\''shell(git log --since='\''\'\'''\''7 days ago'\''\'\'''\'' --format='\''\'\'''\''%h %s'\''\'\'''\'' -- pkg/workflow/compiler*.go)'\'' --allow-tool '\''shell(git log --since='\''\'\'''\''7 days ago'\''\'\'''\'' --oneline --name-only -- pkg/workflow/compiler*.go)'\'' --allow-tool '\''shell(git log -1 --format=%H --)'\'' --allow-tool '\''shell(grep -r '\''\'\'''\''func '\''\'\'''\'' pkg --include='\''\'\'''\''*.go'\''\'\'''\'')'\'' --allow-tool '\''shell(grep)'\'' --allow-tool '\''shell(head -n * pkg/**/*.go)'\'' --allow-tool '\''shell(head)'\'' --allow-tool '\''shell(jq)'\'' --allow-tool '\''shell(ls)'\'' --allow-tool '\''shell(mkdir -p /tmp/gh-aw/cache-memory/compiler-quality)'\'' --allow-tool '\''shell(mv /tmp/gh-aw/cache-memory/)'\'' --allow-tool '\''shell(pwd)'\'' --allow-tool '\''shell(safeoutputs:*)'\'' --allow-tool '\''shell(serena:*)'\'' --allow-tool '\''shell(sort)'\'' --allow-tool '\''shell(tail)'\'' --allow-tool '\''shell(uniq)'\'' --allow-tool '\''shell(wc -l < pkg/workflow/)'\'' --allow-tool '\''shell(wc -l pkg/**/*.go)'\'' --allow-tool '\''shell(wc -l pkg/workflow/compiler*.go)'\'' --allow-tool '\''shell(wc)'\'' --allow-tool '\''shell(yq)'\'' --allow-tool write --add-dir /tmp/gh-aw/cache-memory/ --allow-all-paths --add-dir "${GITHUB_WORKSPACE}" --prompt-file /tmp/gh-aw/aw-prompts/prompt.txt' 2>&1 | tee -a /tmp/gh-aw/agent-stdio.log |
There was a problem hiding this comment.
In the compiled Copilot CLI invocation, --allow-tool 'shell(jq)' is likely too restrictive for the workflow’s intended usage (jq is invoked with filters and file args in daily-compiler-quality.md). Other workflows typically grant shell(jq *) when jq needs arguments (e.g. .github/workflows/auto-triage-issues.md). Regenerate this lock after adjusting the bash allowlist so jq/cat/mv/mkdir patterns match the actual commands.
Suggested change
| -- /bin/bash -c 'export PATH="${RUNNER_TEMP}/gh-aw/mcp-cli/bin:$PATH" && export PATH="$(find /opt/hostedtoolcache /home/runner/work/_tool -maxdepth 4 -type d -name bin 2>/dev/null | tr '\''\n'\'' '\'':'\'')$PATH"; [ -n "$GOROOT" ] && export PATH="$GOROOT/bin:$PATH" || true && GH_AW_NODE_EXEC="${GH_AW_NODE_BIN:-}"; if [ -z "$GH_AW_NODE_EXEC" ] || [ ! -x "$GH_AW_NODE_EXEC" ]; then GH_AW_NODE_EXEC="$(command -v node 2>/dev/null || echo node)"; fi; "$GH_AW_NODE_EXEC" ${RUNNER_TEMP}/gh-aw/actions/copilot_harness.cjs /usr/local/bin/copilot --add-dir /tmp/gh-aw/ --log-level all --log-dir /tmp/gh-aw/sandbox/agent/logs/ --disable-builtin-mcps --no-ask-user --allow-tool github --allow-tool safeoutputs --allow-tool serena --allow-tool '\''shell(bc)'\'' --allow-tool '\''shell(cat /tmp/gh-aw/cache-memory/)'\'' --allow-tool '\''shell(cat > /tmp/gh-aw/cache-memory/)'\'' --allow-tool '\''shell(cat pkg/**/*.go)'\'' --allow-tool '\''shell(cat)'\'' --allow-tool '\''shell(date)'\'' --allow-tool '\''shell(echo)'\'' --allow-tool '\''shell(find pkg -name '\''\'\'''\''*.go'\''\'\'''\'' ! -name '\''\'\'''\''*_test.go'\''\'\'''\'' -type f)'\'' --allow-tool '\''shell(find pkg -type f -name '\''\'\'''\''*.go'\''\'\'''\'' ! -name '\''\'\'''\''*_test.go'\''\'\'''\'')'\'' --allow-tool '\''shell(find pkg/ -maxdepth 1 -ls)'\'' --allow-tool '\''shell(find pkg/workflow -name '\''\'\'''\''compiler*.go'\''\'\'''\'' ! -name '\''\'\'''\''*_test.go'\''\'\'''\'' -type f)'\'' --allow-tool '\''shell(find pkg/workflow/ -maxdepth 1 -ls)'\'' --allow-tool '\''shell(git log --since='\''\'\'''\''7 days ago'\''\'\'''\'' --format='\''\'\'''\''%h %s'\''\'\'''\'' -- pkg/workflow/compiler*.go)'\'' --allow-tool '\''shell(git log --since='\''\'\'''\''7 days ago'\''\'\'''\'' --oneline --name-only -- pkg/workflow/compiler*.go)'\'' --allow-tool '\''shell(git log -1 --format=%H --)'\'' --allow-tool '\''shell(grep -r '\''\'\'''\''func '\''\'\'''\'' pkg --include='\''\'\'''\''*.go'\''\'\'''\'')'\'' --allow-tool '\''shell(grep)'\'' --allow-tool '\''shell(head -n * pkg/**/*.go)'\'' --allow-tool '\''shell(head)'\'' --allow-tool '\''shell(jq)'\'' --allow-tool '\''shell(ls)'\'' --allow-tool '\''shell(mkdir -p /tmp/gh-aw/cache-memory/compiler-quality)'\'' --allow-tool '\''shell(mv /tmp/gh-aw/cache-memory/)'\'' --allow-tool '\''shell(pwd)'\'' --allow-tool '\''shell(safeoutputs:*)'\'' --allow-tool '\''shell(serena:*)'\'' --allow-tool '\''shell(sort)'\'' --allow-tool '\''shell(tail)'\'' --allow-tool '\''shell(uniq)'\'' --allow-tool '\''shell(wc -l < pkg/workflow/)'\'' --allow-tool '\''shell(wc -l pkg/**/*.go)'\'' --allow-tool '\''shell(wc -l pkg/workflow/compiler*.go)'\'' --allow-tool '\''shell(wc)'\'' --allow-tool '\''shell(yq)'\'' --allow-tool write --add-dir /tmp/gh-aw/cache-memory/ --allow-all-paths --add-dir "${GITHUB_WORKSPACE}" --prompt-file /tmp/gh-aw/aw-prompts/prompt.txt' 2>&1 | tee -a /tmp/gh-aw/agent-stdio.log | |
| -- /bin/bash -c 'export PATH="${RUNNER_TEMP}/gh-aw/mcp-cli/bin:$PATH" && export PATH="$(find /opt/hostedtoolcache /home/runner/work/_tool -maxdepth 4 -type d -name bin 2>/dev/null | tr '\''\n'\'' '\'':'\'')$PATH"; [ -n "$GOROOT" ] && export PATH="$GOROOT/bin:$PATH" || true && GH_AW_NODE_EXEC="${GH_AW_NODE_BIN:-}"; if [ -z "$GH_AW_NODE_EXEC" ] || [ ! -x "$GH_AW_NODE_EXEC" ]; then GH_AW_NODE_EXEC="$(command -v node 2>/dev/null || echo node)"; fi; "$GH_AW_NODE_EXEC" ${RUNNER_TEMP}/gh-aw/actions/copilot_harness.cjs /usr/local/bin/copilot --add-dir /tmp/gh-aw/ --log-level all --log-dir /tmp/gh-aw/sandbox/agent/logs/ --disable-builtin-mcps --no-ask-user --allow-tool github --allow-tool safeoutputs --allow-tool serena --allow-tool '\''shell(bc)'\'' --allow-tool '\''shell(cat /tmp/gh-aw/cache-memory/*)'\'' --allow-tool '\''shell(cat > /tmp/gh-aw/cache-memory/*)'\'' --allow-tool '\''shell(cat pkg/**/*.go)'\'' --allow-tool '\''shell(cat *)'\'' --allow-tool '\''shell(date)'\'' --allow-tool '\''shell(echo)'\'' --allow-tool '\''shell(find pkg -name '\''\'\'''\''*.go'\''\'\'''\'' ! -name '\''\'\'''\''*_test.go'\''\'\'''\'' -type f)'\'' --allow-tool '\''shell(find pkg -type f -name '\''\'\'''\''*.go'\''\'\'''\'' ! -name '\''\'\'''\''*_test.go'\''\'\'''\'')'\'' --allow-tool '\''shell(find pkg/ -maxdepth 1 -ls)'\'' --allow-tool '\''shell(find pkg/workflow -name '\''\'\'''\''compiler*.go'\''\'\'''\'' ! -name '\''\'\'''\''*_test.go'\''\'\'''\'' -type f)'\'' --allow-tool '\''shell(find pkg/workflow/ -maxdepth 1 -ls)'\'' --allow-tool '\''shell(git log --since='\''\'\'''\''7 days ago'\''\'\'''\'' --format='\''\'\'''\''%h %s'\''\'\'''\'' -- pkg/workflow/compiler*.go)'\'' --allow-tool '\''shell(git log --since='\''\'\'''\''7 days ago'\''\'\'''\'' --oneline --name-only -- pkg/workflow/compiler*.go)'\'' --allow-tool '\''shell(git log -1 --format=%H --)'\'' --allow-tool '\''shell(grep -r '\''\'\'''\''func '\''\'\'''\'' pkg --include='\''\'\'''\''*.go'\''\'\'''\'')'\'' --allow-tool '\''shell(grep)'\'' --allow-tool '\''shell(head -n * pkg/**/*.go)'\'' --allow-tool '\''shell(head)'\'' --allow-tool '\''shell(jq *)'\'' --allow-tool '\''shell(ls)'\'' --allow-tool '\''shell(mkdir -p /tmp/gh-aw/cache-memory/compiler-quality*)'\'' --allow-tool '\''shell(mv /tmp/gh-aw/cache-memory/*)'\'' --allow-tool '\''shell(pwd)'\'' --allow-tool '\''shell(safeoutputs:*)'\'' --allow-tool '\''shell(serena:*)'\'' --allow-tool '\''shell(sort)'\'' --allow-tool '\''shell(tail)'\'' --allow-tool '\''shell(uniq)'\'' --allow-tool '\''shell(wc -l < pkg/workflow/)'\'' --allow-tool '\''shell(wc -l pkg/**/*.go)'\'' --allow-tool '\''shell(wc -l pkg/workflow/compiler*.go)'\'' --allow-tool '\''shell(wc)'\'' --allow-tool '\''shell(yq)'\'' --allow-tool write --add-dir /tmp/gh-aw/cache-memory/ --allow-all-paths --add-dir "${GITHUB_WORKSPACE}" --prompt-file /tmp/gh-aw/aw-prompts/prompt.txt' 2>&1 | tee -a /tmp/gh-aw/agent-stdio.log |
| bash: | ||
| - "find pkg/workflow -name 'compiler*.go' ! -name '*_test.go' -type f" | ||
| - "wc -l pkg/workflow/compiler*.go" | ||
| - "wc -l < pkg/workflow/" |
There was a problem hiding this comment.
wc -l < pkg/workflow/ redirects stdin from a directory path, which will fail at runtime with an “Is a directory” error. If you meant to line-count specific files, point the redirect at an actual file (or remove this allowlist entry since wc -l pkg/workflow/compiler*.go is already allowed).
This issue also appears in the following locations of the same file:
- line 32
- line 33
- line 34
- line 36
- line 37
Suggested change
| - "wc -l < pkg/workflow/" |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The
daily-compiler-qualityworkflow was restricted to 4 read-only bash commands, blockingmkdir,cat,jq, andmv— all required to write cache files. Every run started cold; historical trend tracking never worked.Changes
daily-compiler-quality.md: Expandedbash:allowlist with write commands scoped to the cache directory and source paths:git log -1 --format=%H --wc -l < pkg/workflow/mkdir -p /tmp/gh-aw/cache-memory/compiler-qualitycat /tmp/gh-aw/cache-memory/cat > /tmp/gh-aw/cache-memory/jqmv /tmp/gh-aw/cache-memory/echo/bcdaily-compiler-quality.lock.yml: Recompiled to apply new--allow-tool shell(...)entries to the Copilot CLI invocation.Write commands are scoped to
/tmp/gh-aw/cache-memory/orpkg/workflow/rather than being left open (e.g.mkdir→mkdir -p /tmp/gh-aw/cache-memory/compiler-quality, notmkdir).Warning
Firewall rules blocked me from connecting to one or more addresses (expand for details)
I tried to connect to the following addresses, but was blocked by firewall rules:
https://api.github.com/graphql/usr/bin/gh gh repo view --json owner,name --jq .owner.login + "/" + .name ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet(http block)/usr/bin/gh gh repo view owner/repo --no�� 9746302/b082/_pkg_.a(http block)/usr/bin/gh gh repo view owner/repo --no�� --noprofile(http block)https://api.github.com/orgs/test-owner/actions/secrets/usr/bin/gh gh api /orgs/test-owner/actions/secrets --jq .secrets[].name on' --ignore-path ../../../.prettierignore(http block)https://api.github.com/repos/actions/ai-inference/git/ref/tags/v1/usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq [.object.sha, .object.type] | @tsv /tmp/TestCollectWorkflowFiles_TransitiveImports816286780/001 remote /usr/bin/git se 9746302/b018/vetrev-parse ache/go/1.25.8/x--show-toplevel git rev-�� --show-toplevel ache/go/1.25.8/x64/pkg/tool/linuremote.origin.url /usr/bin/git 63/001/test-inlinode(http block)https://api.github.com/repos/actions/checkout/git/ref/tags/v3/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq [.object.sha, .object.type] | @tsv 2455-13770/test-4265347566(http block)https://api.github.com/repos/actions/checkout/git/ref/tags/v5/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq [.object.sha, .object.type] | @tsv 2455-13770/test---workflow 9746302/b211/vetnonexistent-workflow-ci-test-67890 ache/go/1.25.8/x--limit !../../../pkg/wogh --ignore-path ../../../.prettierignore ache/go/1.25.8/x64/pkg/tool/linu^remote\..*\.gh-resolved$ -uns�� audit-workflows.md /tmp/go-build1389746302/b040/vet.cfg ingutil.test ignore-path ../.git bagabas/go-udiffrev-parse _TOKEN"; }; f ingutil.test(http block)/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq [.object.sha, .object.type] | @tsv --show-toplevel x_amd64/compile /usr/bin/git se 9746302/b215/vet\n ache/go/1.25.8/x: git rev-�� --show-toplevel ache/go/1.25.8/xrev-parse /usr/bin/git /ref/tags/v9 /tmp/go-build138rev-parse sv git(http block)/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq [.object.sha, .object.type] | @tsv --show-toplevel 1/x64/bin/node /usr/bin/git : ${{ github.repgit remote /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git runs/20260429-05git config /usr/bin/gh git(http block)https://api.github.com/repos/actions/checkout/git/ref/tags/v6/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv '/tmp/TestParseDefaultBranchFromLsRemoteWithRealGitmaster_branchremote.origin.url '/tmp/TestParseDefaultBranchFromLsRemoteWithRealGitmaster_branch412805622/001' 1/x64/bin/node -errorsas -ifaceassert -nilfunc /opt/hostedtoolcache/go/1.25.8/x3 t-ha�� ithub/workflows/api-consumption-test-logs/run-3 -buildtags /usr/bin/gh -errorsas -ifaceassert -nilfunc gh(http block)/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv 0wv0fZFWo -trimpath 1/x64/bin/node -p github.com/githurev-parse -lang=go1.25 1/x64/bin/node ortc�� bility_SameInputSameOutput2054161890/001/stability-test.md stmain.go ache/go/1.25.8/x64/pkg/tool/linux_amd64/link .github/workflowgit -nolocalimports -importcfg ache/go/1.25.8/x64/pkg/tool/linux_amd64/link(http block)/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv for-each-ref(http block)https://api.github.com/repos/actions/github-script/git/ref/tags/v8/usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq [.object.sha, .object.type] | @tsv --show-toplevel 64/pkg/tool/linu-trimpath /usr/bin/git ts.test /tmp/go-build138log ortcfg.link git rev-�� --show-toplevel tymj2WcILd1bgTIF-dwarf=false(http block)https://api.github.com/repos/actions/github-script/git/ref/tags/v9/usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv(http block)/usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv go1.25.8 -c=4 -nolocalimports -importcfg /tmp/go-build1389746302/b399/importcfg -pack /tmp/go-build1389746302/b399/_testmain.go ode_��(http block)/usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv -c=4 -nolocalimports -importcfg /tmp/go-build1389746302/b415/importcfg -pack /home/REDACTED/work/gh-aw/gh-aw/pkg/constants/spec_test.go(http block)https://api.github.com/repos/actions/setup-go/git/ref/tags/v4/usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --show-toplevel 64/pkg/tool/linux_amd64/vet 9746302/b471/vet.cfg te 'scripts/**/*git .cfg 64/pkg/tool/linu--show-toplevel infocmp -1 xterm-color 64/pkg/tool/linux_amd64/vet /tmp/go-build1389746302/b469/workflow.test -v on x_amd64/compile /tmp/go-build1389746302/b469/workflow.test(http block)https://api.github.com/repos/actions/setup-node/git/ref/tags/v4/usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv /tmp/compile-instructions-test-3131433887/.github/workflows config clusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle remote.origin.urgit 90 x_amd64/vet git init��(http block)/usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv ft-H/OUlbhhZwLJCD44Meft-H xf9qL--/YcBrNqCWBFU4hJRv0Iid /usr/bin/infocmp te 'scripts/**/*git(http block)https://api.github.com/repos/actions/setup-node/git/ref/tags/v6/usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv aA5BM4NdI =develop 64/pkg/tool/linux_amd64/vet -errorsas -ifaceassert -nilfunc 64/pkg/tool/linux_amd64/vet ortc�� licyMinIntegrityOnlyCompiledOutput1952159449/001 stmain.go /usr/bin/infocmp -errorsas -ifaceassert -nilfunc infocmp(http block)/usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv go(http block)/usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv --symref l e/git on' --ignore-patgit(http block)https://api.github.com/repos/actions/upload-artifact/git/ref/tags/v4/usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv k/gh-aw/gh-aw/.github/workflows/ace-editor.md rev-parse .test(http block)https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v0.1.2/usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0.1.2 --jq [.object.sha, .object.type] | @tsv --show-toplevel 64/pkg/tool/linux_amd64/vet /usr/bin/git FETCH_HEAD^{commgit(http block)https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.0.0/usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq [.object.sha, .object.type] | @tsv se 9746302/b115/vet.cfg /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/link(http block)https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.2.3/usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq [.object.sha, .object.type] | @tsv se 9746302/b111/vet.cfg /usr/bin/git(http block)https://api.github.com/repos/github/gh-aw/actions/runs/usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --limit 100 --created >=2026-04-22(http block)/usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --limit 100 --created >=2026-03-30(http block)/usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --limit 100 --created >=2026-01-29(http block)https://api.github.com/repos/github/gh-aw/actions/runs/1/artifacts/usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/1/artifacts --jq .artifacts[].name(http block)/usr/bin/gh gh run download 1 --dir test-logs/run-1 origin x_amd64/compile(http block)https://api.github.com/repos/github/gh-aw/actions/runs/12345/artifacts/usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12345/artifacts --jq .artifacts[].name(http block)/usr/bin/gh gh run download 12345 --dir test-logs/run-12345(http block)https://api.github.com/repos/github/gh-aw/actions/runs/12346/artifacts/usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12346/artifacts --jq .artifacts[].name go-udiff@v0.4.1/export.go 64/pkg/tool/linux_amd64/vet rkflow/js/**/*.j/usr/bin/git(http block)/usr/bin/gh gh run download 12346 --dir test-logs/run-12346 om/davecgh/go-spew@v1.1.1/spew/common.go 64/pkg/tool/linux_amd64/link(http block)https://api.github.com/repos/github/gh-aw/actions/runs/2/artifacts/usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/2/artifacts --jq .artifacts[].name om/stretchr/testify@v1.11.1/assert/assertion_forhub.lumenfield.work/github/gh-aw/pkg/actionpins_test x_amd64/vet(http block)/usr/bin/gh gh run download 2 --dir test-logs/run-2 origin .cfg(http block)https://api.github.com/repos/github/gh-aw/actions/runs/3/artifacts/usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/3/artifacts --jq .artifacts[].name(http block)/usr/bin/gh gh run download 3 --dir test-logs/run-3 on .cfg /../../.prettiergit erignore(http block)https://api.github.com/repos/github/gh-aw/actions/runs/4/artifacts/usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/4/artifacts --jq .artifacts[].name(http block)/usr/bin/gh gh run download 4 --dir test-logs/run-4 eat_detection_isolation_test.go 64/pkg/tool/linux_amd64/vet(http block)https://api.github.com/repos/github/gh-aw/actions/runs/5/artifacts/usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/5/artifacts --jq .artifacts[].name .cfg util.test(http block)/usr/bin/gh gh run download 5 --dir test-logs/run-5 rkflow/js/**/*.json ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet erignore(http block)https://api.github.com/repos/github/gh-aw/actions/workflows/usr/bin/gh gh workflow list --json name,state,path(http block)/usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 100(http block)/usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 6(http block)https://api.github.com/repos/github/gh-aw/contents/.github/workflows/shared/reporting.md/tmp/go-build1389746302/b404/cli.test /tmp/go-build1389746302/b404/cli.test -test.testlogfile=/tmp/go-build1389746302/b404/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true(http block)https://api.github.com/repos/github/gh-aw/git/ref/tags/v0.47.4/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v0.47.4 --jq [.object.sha, .object.type] | @tsv --show-toplevel ache/go/1.25.8/xsh /usr/bin/git CompiledOutput14git ../../../**/*.jsrev-parse /opt/hostedtoolc--show-toplevel git rev-�� --show-toplevel /opt/hostedtoolcache/go/1.25.8/xTest User /usr/bin/git runs/20260429-05du /tmp/go-build138-k clusion,workflow/tmp/gh-aw/aw-feature-branch.patch git(http block)https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.0.0/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq [.object.sha, .object.type] | @tsv se 9746302/b073/vet.cfg .cfg(http block)https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.2.3/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq [.object.sha, .object.type] | @tsv get --global x_amd64/vet http.https://gitgh(http block)https://api.github.com/repos/github/gh-aw/git/ref/tags/v2.0.0/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq [.object.sha, .object.type] | @tsv --get-regexp --global x_amd64/vet(http block)/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq [.object.sha, .object.type] | @tsv --get-regexp --global x_amd64/vet tion_pins.json..git(http block)/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq [.object.sha, .object.type] | @tsv get atted/golang/pkg/flatted/flatted.go x_amd64/vet(http block)https://api.github.com/repos/github/gh-aw/git/ref/tags/v3.0.0/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq [.object.sha, .object.type] | @tsv --get-regexp --global x_amd64/vet(http block)https://api.github.com/repos/nonexistent/action/git/ref/tags/v999.999.999/usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq [.object.sha, .object.type] | @tsv npx prettier --write '**/*.cjs' '**/*.ts' '**/*.json' --ignore-p-errorsas(http block)https://api.github.com/repos/nonexistent/repo/actions/runs/12345/usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion INVALID,NEW -j DROP ache/go/1.25.8/x64/pkg/tool/linuremote.origin.url -c npx prettier --write '**/*.cjs' '**/*.ts' '**/*.json' --ignore-p-errorsas(http block)https://api.github.com/repos/owner/repo/actions/workflows/usr/bin/gh gh workflow list --json name,state,path --repo owner/repo es/.bin/sh(http block)/usr/bin/gh gh workflow list --json name,state,path --repo owner/repo rgo/bin/git(http block)/usr/bin/gh gh workflow list --repo owner/repo --json name,path,state .cfg(http block)https://api.github.com/repos/test-owner/test-repo/actions/secrets/usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name on' --ignore-path ../../../.prettierignore(http block)https://api.github.com/repos/test/repo/usr/bin/gh gh api /repos/test/repo --jq .default_branch se 9746302/b005/vet.cfg .cfg(http block)If you need me to access, download, or install something from one of these locations, you can either: