Skip to content

Rename tools.github.repos to tools.github.allowed-repos#22311

Merged
pelikhan merged 5 commits intomainfrom
copilot/rename-tools-github-repos
Mar 22, 2026
Merged

Rename tools.github.repos to tools.github.allowed-repos#22311
pelikhan merged 5 commits intomainfrom
copilot/rename-tools-github-repos

Conversation

Copy link
Copy Markdown
Contributor

Copilot AI commented Mar 22, 2026

tools.github.repos was confusing — users expected it to mean "grant access to these repos" when it actually restricts which repos the agent can access. Rename to allowed-repos to make intent unambiguous, with full backward compatibility and auto-migration.

Changes

  • Schema: Added allowed-repos field to tools.github in JSON schema; marked repos as deprecated
  • Parser: Accepts allowed-repos (preferred) or repos (emits deprecation warning, migrates to AllowedRepos internally)
  • Struct: GitHubToolConfig gains AllowedRepos as the canonical field; Repos kept for schema round-trip only
  • Validation/compilation: All internal logic reads from AllowedRepos; raw-map paths (mcp_github_config, compiler_github_mcp_steps) check allowed-repos first, fall back to repos
  • Codemod: gh aw fix now auto-migrates repos:allowed-repos: inside tools.github blocks
  • Docs: Updated github-tools.md, regenerated frontmatter-full.md, updated .github/aw workflow examples

New syntax

tools:
  github:
    mode: remote
    toolsets: [default]
    allowed-repos:
      - "myorg/*"
      - "partner/shared-repo"
    min-integrity: approved

Old repos: continues to work but emits a warning. Run gh aw fix to migrate automatically.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

  • https://api.github.com/graphql
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw GO111MODULE ache/go/1.25.0/x--show-toplevel git rev-�� --show-toplevel go /usr/bin/git -json GO111MODULE 64/pkg/tool/linu--show-toplevel git (http block)
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw git /usr/bin/wc git remo�� add origin /usr/bin/git 246176285/.githugit git /usr/bin/git git (http block)
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw git /usr/bin/git git rev-�� HEAD git 0/x64/bin/node --show-toplevel git /usr/bin/git git (http block)
  • https://api.github.com/orgs/test-owner/actions/secrets
    • Triggering command: /usr/bin/gh gh api /orgs/test-owner/actions/secrets --jq .secrets[].name 5747734/b413/_pkGOINSECURE GO111MODULE 64/bin/go GOINSECURE b/gh-aw/pkg/loggenv GOMODCACHE go env sdFl/I7quLUnZ5FkGOINSECURE GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE 5747734/b413/impGOPROXY (http block)
    • Triggering command: /usr/bin/gh gh api /orgs/test-owner/actions/secrets --jq .secrets[].name --show-toplevel ache/go/1.25.0/x64/pkg/tool/linux_amd64/vet /usr/bin/git orts930275055/00git GO111MODULE Name,createdAt,s--show-toplevel git rev-�� --show-toplevel go /usr/bin/gh licyMinIntegritygit GO111MODULE 1846631/b404/vet--show-toplevel gh (http block)
  • https://api.github.com/repos/actions/ai-inference/git/ref/tags/v1
    • Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq .object.sha .github/workflows/test.md go /opt/hostedtoolcache/node/24.14.0/x64/bin/node -json GO111MODULE 64/bin/go node /tmp�� /home/REDACTED/work/gh-aw/gh-aw/.github/workflows/bot-detection.md go /opt/hostedtoolcache/node/24.14.0/x64/bin/node -json GO111MODULE 64/bin/go /opt/hostedtoolcache/node/24.14.0/x64/bin/node (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq .object.sha --show-toplevel git /usr/bin/git --show-toplevel nly /usr/bin/git git conf�� --get remote.origin.url ache/node/24.14.0/x64/bin/node --show-toplevel infocmp /usr/bin/git ache/node/24.14.0/x64/bin/node (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v3
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq .object.sha th .prettierignore --log-level=error k/gh-aw/gh-aw/pkg/parser/schemas/ ndor/bin/bash credential.helpe/opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/link (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq .object.sha -aw/git/ref/tags/v2.0.0 GOPROXY /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/compile GOSUMDB GOWORK 64/bin/go /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/compile -o /tmp/go-build3501846631/b408/_pkg_.a -trimpath /usr/bin/git -p github.com/githurev-parse -lang=go1.25 git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq .object.sha runs/20260322-194104-33910/test-2114725946/.githremote.origin.url git /home/REDACTED/go/bin/bash --show-toplevel go /usr/bin/git bash --no�� --noprofile git /usr/bin/git --show-toplevel go /usr/bin/git git (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v5
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha ./../pkg/workflo-errorsas --local nfig/composer/ve-nilfunc user.name (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha -json GO111MODULE ache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env 72/001/test-frontmatter-with-nested-objects.md GO111MODULE util.test GOINSECURE GOMOD GOMODCACHE util.test (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha --git-dir go /usr/bin/git -json GO111MODULE x_amd64/vet git rev-�� --show-toplevel x_amd64/vet /usr/bin/git -json GO111MODULE 64/bin/go git (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v6
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha user.name Test User /usr/bin/git k/gh-aw/gh-aw/pkgit k/gh-aw/gh-aw/pkrev-parse 64/bin/go git init�� ../../../.prettixterm-color /opt/hostedtoolcache/go/1.25.0/xGO111MODULE /usr/bin/git /tmp/go-build419git -trimpath 64/bin/go git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha /tmp/go-build3501846631/b453/_pkg_.a -trimpath /usr/bin/git -p main -lang=go1.25 git add .github/workflows/test.md -dwarf=false /usr/bin/git go1.25.0 -c=4 -nolocalimports git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha --show-toplevel 64/pkg/tool/linux_amd64/vet /usr/bin/git -json GO111MODULE ache/go/1.25.0/x--show-toplevel git rev-�� --show-toplevel go /usr/bin/git -json GO111MODULE .cfg git (http block)
  • https://api.github.com/repos/actions/github-script/git/ref/tags/v8
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha -json 106bb2d493f778e3GOMOD 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE sh (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE sh -c npx prettier --cGOSUMDB GOPROXY 64/bin/go GOSUMDB GOWORK 64/bin/go node (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE node /opt�� prettier --check 64/bin/go **/*.ts **/*.json --ignore-path go (http block)
  • https://api.github.com/repos/actions/setup-go/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq .object.sha --get remote.origin.url /usr/bin/git k/gh-aw/gh-aw/pkgit k/gh-aw/gh-aw/pkrev-parse 64/bin/go git conf�� -aw/git/ref/tags/v1.0.0 test@example.com /usr/bin/git /tmp/go-build419git -trimpath 64/bin/go git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq .object.sha /repos/actions/github-script/git/ref/tags/v8 --jq e/git --show-toplevel 0602f89e /usr/bin/git e/git rev-�� --show-toplevel git /usr/bin/git --show-toplevel /opt/hostedtoolcrev-parse /usr/bin/git git (http block)
  • https://api.github.com/repos/actions/setup-node/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq .object.sha add origin /usr/bin/git che/go-build/ab/git **/*.cjs 64/bin/go git init�� ../../../.pretti-bool /opt/hostedtoolc-buildtags /usr/bin/git /tmp/go-build419git -trimpath nch,headSha,disp--show-toplevel git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq .object.sha --show-toplevel git /opt/hostedtoolcache/node/24.14.0/x64/bin/node --show-toplevel 1846631/b430/reprev-parse /usr/bin/git node /tmp�� /home/REDACTED/work/gh-aw/gh-aw/.github/workflows/ai-moderator.md git /usr/bin/git --show-toplevel /opt/hostedtoolcrev-parse /usr/bin/git git (http block)
  • https://api.github.com/repos/actions/upload-artifact/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq .object.sha -json GO111MODULE /opt/hostedtoolcache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 1846631/b429/vet.cfg GOINSECURE GOMOD GOMODCACHE grep (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq .object.sha --show-toplevel git /usr/bin/git --show-toplevel go /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel go /usr/bin/git git (http block)
  • https://api.github.com/repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b
    • Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq .object.sha h ../../../.prettierignore git 0/x64/bin/node --show-toplevel (http block)
  • https://api.github.com/repos/github/gh-aw
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw --jq .visibility json' --ignore-premote.origin.url git r: $owner, name: $name) { hasDiscussionsEnabled } } user.email resolved$ /usr/bin/git git _har�� th .prettierigno-f git _modules/.bin/no-f --show-toplevel git /usr/bin/git git (http block)
  • https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq .object.sha -json GO111MODULE /bin/sh GOINSECURE GOMOD GOMODCACHE /bin/sh -c k/gh-aw/gh-aw/.github/workflows GOPROXY /usr/local/bin/bash GOSUMDB GOWORK 64/bin/go bash (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq .object.sha itattributes-test1667827166/.github/workflows git /usr/bin/git l 64/pkg/tool/linu-1 /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel go /usr/bin/git git (http block)
  • https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.2.3
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq .object.sha -json GO111MODULE /opt/hostedtoolcache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE /home/REDACTED/.dotnet/tools/bash GOINSECURE GOMOD GOMODCACHE bash (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq .object.sha --show-toplevel git /usr/bin/git --show-toplevel 64/pkg/tool/linu-1 /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel go /usr/bin/git git (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/1/artifacts
    • Triggering command: /usr/bin/gh gh run download 1 --dir test-logs/run-1 GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh run download 1 --dir test-logs/run-1 git /usr/bin/git --show-toplevel go /usr/bin/git git rev-�� --show-toplevel git ache/node/24.14.0/x64/bin/node --show-toplevel go /usr/bin/git git (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/12345/artifacts
    • Triggering command: /usr/bin/gh gh run download 12345 --dir test-logs/run-12345 GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh run download 12345 --dir test-logs/run-12345 git /usr/bin/git --show-toplevel go /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel go /usr/bin/git git (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/12346/artifacts
    • Triggering command: /usr/bin/gh gh run download 12346 --dir test-logs/run-12346 GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh run download 12346 --dir test-logs/run-12346 git /usr/bin/git --show-toplevel go /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel go /usr/bin/git git (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/2/artifacts
    • Triggering command: /usr/bin/gh gh run download 2 --dir test-logs/run-2 GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh run download 2 --dir test-logs/run-2 git /usr/bin/git --show-toplevel go /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel go /usr/bin/git git (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/3/artifacts
    • Triggering command: /usr/bin/gh gh run download 3 --dir test-logs/run-3 GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh run download 3 --dir test-logs/run-3 git /usr/bin/git --show-toplevel go /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel go /usr/bin/git git (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/4/artifacts
    • Triggering command: /usr/bin/gh gh run download 4 --dir test-logs/run-4 GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh run download 4 --dir test-logs/run-4 git /usr/bin/git --show-toplevel go /usr/bin/git git rev-�� --show-toplevel git (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/5/artifacts
    • Triggering command: /usr/bin/gh gh run download 5 --dir test-logs/run-5 GO111MODULE x_amd64/link GOINSECURE GOMOD GOMODCACHE x_amd64/link env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE ef/N6GE9dzJuLpfUe9tz4e_/ThKvzodBlPIPkS6j74YO (http block)
    • Triggering command: /usr/bin/gh gh run download 5 --dir test-logs/run-5 git /usr/bin/git --show-toplevel go /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel go /usr/bin/git git (http block)
  • https://api.github.com/repos/github/gh-aw/actions/workflows
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path 5747734/b414/_pkGOINSECURE GO111MODULE 64/bin/go GOINSECURE b/gh-aw/pkg/loggenv GOMODCACHE go env ae3Q/-oHPdAgNIy-GOINSECURE GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE 5747734/b414/impGOPROXY (http block)
    • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 100 GOMOD GOMODCACHE node /hom�� --check **/*.cjs 64/bin/go **/*.json --ignore-path ../../../.pretti/tmp/gh-aw-test-runs/20260322-194002-29064/test-413975731/.github/workflows go (http block)
    • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 6 GOMOD GOMODCACHE x_amd64/compile env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env y_with_explicit_repo1126540051/001 GO111MODULE ache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq .object.sha --show-toplevel 64/pkg/tool/linux_amd64/vet /usr/bin/git ository }} GO111MODULE /opt/hostedtoolc--show-toplevel git rev-�� --show-toplevel go /usr/bin/git runs/20260322-19git GO111MODULE .cfg git (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.2.3
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq .object.sha lint:cjs GOPROXY 64/bin/go GOSUMDB GOWORK 64/bin/go sh -c "prettier" --check 'scripts/**/*GOINSECURE bash 64/bin/go --noprofile -tests 64/bin/go go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq .object.sha --show-toplevel 64/pkg/tool/linuowner/repo /usr/bin/git kflow.test --jq ortcfg.link git rev-�� b/workflows 2efhWi9M2e-nse98Ac/Nkj2eH9CDZC64a6m6QNA/Q8jLC1yB0SIk2xf3QUN0 e/git k/gh-aw/gh-aw/.ggit --jq 173a86aca8ae490f--show-toplevel e/git (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v2.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq .object.sha npx prettier --cGOSUMDB GOPROXY 64/bin/go GOSUMDB GOWORK 64/bin/go sh -c "prettier" --check 'scripts/**/*GOINSECURE bash 64/bin/go tierignore _value"]."\n"; 64/bin/go go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq .object.sha npx prettier --cGOSUMDB GOPROXY 64/bin/go GOSUMDB GOWORK 64/bin/go sh -c "prettier" --che-p /opt/hostedtoolcgithub.com/github/gh-aw/pkg/constants 64/bin/go tierignore -tests 64/bin/go go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq .object.sha npx prettier --cGOSUMDB GOPROXY 64/bin/go GOSUMDB GOWORK 64/bin/go node /hom�� --check scripts/**/*.js 64/bin/go .prettierignore -tests 64/bin/go go (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v3.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq .object.sha npx prettier --cGOSUMDB GOPROXY 64/bin/go GOSUMDB GOWORK 64/bin/go sh -c "prettier" --che-errorsas bash 64/bin/go tierignore -tests 64/bin/go go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq .object.sha --show-toplevel /usr/bin/git /usr/bin/git --get-regexp ^remote\..*\.gh--C /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git /tmp/gh-aw-test-git config /tmp/go-build3501846631/b441/tes-test.paniconexit0 git (http block)
  • https://api.github.com/repos/githubnext/agentics/git/ref/tags/
    • Triggering command: /usr/bin/gh gh api /repos/githubnext/agentics/git/ref/tags/# --jq .object.sha re --log-level=error /opt/hostedtoolcache/node/24.14.0/x64/bin/node da3c0ed79a8b03f65a3bc5bcd89031bea0bd76ce79ba28d0-d /tmp/go-build350git infocmp /usr/bin/git git /pre�� --show-toplevel git 64/pkg/tool/linux_amd64/vet --show-toplevel git /usr/bin/git 64/pkg/tool/linurev-parse (http block)
  • https://api.github.com/repos/nonexistent/action/git/ref/tags/v999.999.999
    • Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env y_with_repos=public_2564702176/001 GO111MODULE x86_64/bash GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq .object.sha --show-toplevel ache/go/1.25.0/x64/pkg/tool/linux_amd64/vet /usr/bin/git -json GO111MODULE Name,createdAt,s--show-toplevel git rev-�� --show-toplevel go /usr/bin/git -json GO111MODULE ache/go/1.25.0/x--show-toplevel git (http block)
  • https://api.github.com/repos/nonexistent/repo/actions/runs/12345
    • Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion GOINSECURE GOMOD GOMODCACHE go env plorer.md GO111MODULE 64/bin/bash GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion --show-toplevel go /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel go /usr/bin/git git (http block)
  • https://api.github.com/repos/owner/repo/actions/workflows
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo 64/bin/go GOINSECURE b/gh-aw/pkg/strienv GOMODCACHE go env ZEU9/jerxdY-62TEGOINSECURE GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE 5747734/b425/impGOPROXY (http block)
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo 64/bin/go GOINSECURE b/gh-aw/pkg/stylenv GOMODCACHE go env OtSB/1BXT0psTDMYGOINSECURE GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE 5747734/b427/impGOPROXY (http block)
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo /usr/bin/git -json GO111MODULE /opt/hostedtoolc--show-toplevel git rev-�� --show-toplevel go /usr/bin/git -json GO111MODULE 0/x64/bin/node git (http block)
  • https://api.github.com/repos/owner/repo/contents/file.md
    • Triggering command: /tmp/go-build3501846631/b400/cli.test /tmp/go-build3501846631/b400/cli.test -test.testlogfile=/tmp/go-build3501846631/b400/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE sh (http block)
    • Triggering command: /tmp/go-build1223168415/b376/cli.test /tmp/go-build1223168415/b376/cli.test -test.testlogfile=/tmp/go-build1223168415/b376/testlog.txt -test.paniconexit0 -test.timeout=10m0s rev-�� --show-toplevel go /usr/bin/git -json GO111MODULE /opt/hostedtoolc--show-toplevel git rev-�� --show-toplevel go /usr/bin/git -json GO111MODULE (http block)
  • https://api.github.com/repos/test-owner/test-repo/actions/secrets
    • Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name 5747734/b403/_pkGOINSECURE GO111MODULE 64/bin/go GOINSECURE bagabas/go-udiffenv GOMODCACHE go env TMZq/ffkCVWcA1pyGOINSECURE GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE 5747734/b403/impGOPROXY (http block)
    • Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name --show-toplevel ache/go/1.25.0/x64/pkg/tool/linux_amd64/vet /usr/bin/git 14 GO111MODULE /opt/hostedtoolc--show-toplevel git rev-�� --show-toplevel go /usr/bin/git licyMinIntegritygit GO111MODULE ache/go/1.25.0/x--show-toplevel git (http block)

If you need me to access, download, or install something from one of these locations, you can either:


💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

- Add `AllowedRepos` field to `GitHubToolConfig`, keep `Repos` as deprecated
- Update parser to handle `allowed-repos` (preferred) and deprecated `repos` with warning
- Update validation to use `AllowedRepos` with updated error messages
- Update MCP config and compiler to check `allowed-repos` first, fall back to `repos`
- Add `allowed-repos` to JSON schema, mark `repos` as deprecated
- Add codemod to auto-migrate `repos` → `allowed-repos` in `tools.github`
- Update documentation, workflow examples, and regenerate frontmatter-full.md"

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/gh-aw/sessions/7df0cf56-3abc-4ad0-9648-835882321816
Copilot AI changed the title [WIP] Rename tools.github.repos to tools.github.allowed-repos Rename tools.github.repos to tools.github.allowed-repos Mar 22, 2026
Copilot AI requested a review from pelikhan March 22, 2026 19:47
@pelikhan pelikhan marked this pull request as ready for review March 22, 2026 19:53
Copilot AI review requested due to automatic review settings March 22, 2026 19:53
@pelikhan
Copy link
Copy Markdown
Collaborator

@copilot merge main and recompile

…github-repos

# Conflicts:
#	docs/src/content/docs/reference/frontmatter-full.md
#	pkg/parser/schemas/main_workflow_schema.json
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Renames the GitHub tools repository scope configuration key from tools.github.repos to the clearer tools.github.allowed-repos, while keeping backward compatibility via parsing fallback, schema deprecation, and an auto-migration codemod.

Changes:

  • Added allowed-repos to the workflow schema and marked repos as deprecated.
  • Updated workflow parsing/validation and MCP compilation paths to prefer allowed-repos while still accepting repos.
  • Added a gh aw fix codemod to migrate tools.github.repostools.github.allowed-repos, and updated docs/examples.

Reviewed changes

Copilot reviewed 15 out of 15 changed files in this pull request and generated 4 comments.

Show a summary per file
File Description
scratchpad/github-mcp-access-control-specification.md Updates spec examples to use allowed-repos.
pkg/workflow/tools_validation.go Validates guard policy using canonical AllowedRepos and updates related error messages.
pkg/workflow/tools_validation_test.go Updates expected error substrings to reference allowed-repos.
pkg/workflow/tools_types.go Adds AllowedRepos as the canonical guard-policy field; keeps Repos for legacy/deprecated support.
pkg/workflow/tools_parser.go Parses allowed-repos (preferred) and falls back to repos with a deprecation warning.
pkg/workflow/mcp_github_config.go Reads allowed-repos first (then repos) when rendering MCP guard policies.
pkg/workflow/compiler_github_mcp_steps.go Reads allowed-repos first (then repos) for MCP step generation/debug output.
pkg/parser/schemas/main_workflow_schema.json Introduces allowed-repos and adds deprecated repos alias in schema.
pkg/cli/fix_codemods.go Registers the new GitHub repos → allowed-repos codemod.
pkg/cli/fix_codemods_test.go Updates codemod registry count and expected ordering.
pkg/cli/codemod_github_repos.go Implements frontmatter codemod to rename repos: to allowed-repos: under tools.github.
pkg/cli/codemod_github_repos_test.go Adds unit tests covering common migration scenarios.
docs/src/content/docs/reference/github-tools.md Updates reference docs and examples to tools.github.allowed-repos and documents migration path.
docs/src/content/docs/reference/frontmatter-full.md Regenerates full frontmatter reference to reflect current schema (including allowed-repos).
.github/aw/create-agentic-workflow.md Updates workflow template guidance to use allowed-repos.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment on lines +64 to +65
// Guard policy fields (allowed-repos/repos, min-integrity) are specified flat under github:.
// If allowed-repos/repos is not specified but min-integrity is, repos defaults to "all".
Copy link

Copilot AI Mar 22, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The docstring still says “repos defaults to "all"” even though the user-facing key is now allowed-repos (with repos deprecated). Please update the comment to refer to allowed-repos (and optionally mention the deprecated alias) to avoid confusing readers.

Suggested change
// Guard policy fields (allowed-repos/repos, min-integrity) are specified flat under github:.
// If allowed-repos/repos is not specified but min-integrity is, repos defaults to "all".
// Guard policy fields (allowed-repos, min-integrity) are specified flat under github: (with deprecated alias 'repos' for 'allowed-repos').
// If allowed-repos (or deprecated alias repos) is not specified but min-integrity is, allowed-repos defaults to "all".

Copilot uses AI. Check for mistakes.
Comment on lines 81 to 83
// Default repos to "all" when not specified
if !hasRepos {
toolsValidationLog.Printf("Defaulting repos to 'all' in guard policy for workflow: %s", workflowName)
Copy link

Copilot AI Mar 22, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This log message says “Defaulting repos to 'all'” but the code now sets github.AllowedRepos. Consider updating the message to “allowed-repos” (or “allowed-repos/repos”) so the warning matches the current configuration key.

Suggested change
// Default repos to "all" when not specified
if !hasRepos {
toolsValidationLog.Printf("Defaulting repos to 'all' in guard policy for workflow: %s", workflowName)
// Default allowed-repos to "all" when not specified
if !hasRepos {
toolsValidationLog.Printf("Defaulting allowed-repos (repos) to 'all' in guard policy for workflow: %s", workflowName)

Copilot uses AI. Check for mistakes.
Comment on lines +42 to +54
githubAny, hasGitHub := toolsMap["github"]
if !hasGitHub {
return false
}
githubMap, ok := githubAny.(map[string]any)
if !ok {
return false
}
_, hasRepos := githubMap["repos"]
if hasRepos {
githubReposCodemodLog.Print("Deprecated 'repos' field found in tools.github")
}
return hasRepos
Copy link

Copilot AI Mar 22, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

hasDeprecatedGitHubReposField returns true whenever tools.github.repos is present, even if tools.github.allowed-repos is already present. In that case, the codemod will rename repos: to allowed-repos: and can create duplicate allowed-repos keys in the YAML (invalid/ambiguous). Consider skipping the codemod when allowed-repos already exists, or removing repos instead of renaming when both are present.

Copilot uses AI. Check for mistakes.

# Option 3: Set to false to disable the default checkout step. The agent job will
# not check out any repository (dev-mode checkouts are unaffected).
checkout: true
Copy link

Copilot AI Mar 22, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The generated example for the boolean checkout option is incorrect: the schema only allows checkout: false (enum [false]) to disable checkout, but this doc shows checkout: true. Please change the example to checkout: false (or remove the example line) so the docs match the schema.

Suggested change
checkout: true
checkout: false

Copilot uses AI. Check for mistakes.
@pelikhan
Copy link
Copy Markdown
Collaborator

@copilot review comments

Copy link
Copy Markdown
Contributor Author

Copilot AI commented Mar 22, 2026

@copilot merge main and recompile

Done — merged main (resolved conflicts in main_workflow_schema.json and frontmatter-full.md, keeping the mounts field from main) and recompiled all 177 workflows successfully in a3fe419.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

  • https://api.github.com/graphql
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw (http block)
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw 6ktmNUD/vAOVX0dQ-C (http block)
  • https://api.github.com/repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b
    • Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq .object.sha (http block)
  • https://api.github.com/repos/github/gh-aw
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw --jq .visibility (http block)
  • https://api.github.com/repos/githubnext/agentics/git/ref/tags/
    • Triggering command: /usr/bin/gh gh api /repos/githubnext/agentics/git/ref/tags/# --jq .object.sha (http block)

If you need me to access, download, or install something from one of these locations, you can either:

Copy link
Copy Markdown
Contributor Author

Copilot AI commented Mar 22, 2026

@copilot review comments

Addressed all 4 review comments in 1710ca8:

  1. Updated tools_validation.go docstring to reference allowed-repos with repos as a deprecated alias
  2. Updated log message to "Defaulting allowed-repos (repos) to 'all'"
  3. Fixed codemod hasDeprecatedGitHubReposField to return false when allowed-repos is already present (prevents duplicate keys), with an added test case covering that scenario
  4. Fixed checkout: truecheckout: false in frontmatter-full.md

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

  • https://api.github.com/graphql
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw GO111MODULE 64/bin/go git rev-�� --show-toplevel go /usr/bin/git (http block)
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw (http block)
  • https://api.github.com/orgs/test-owner/actions/secrets
    • Triggering command: /usr/bin/gh gh api /orgs/test-owner/actions/secrets --jq .secrets[].name GOSUMDB GOWORK 64/bin/go GOINSECURE GOMOD GOMODCACHE ache/go/1.25.0/xGO111MODULE env 8160834/b404/_pkGOINSECURE GO111MODULE 64/bin/go GOINSECURE bracelet/x/exp/genv GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /orgs/test-owner/actions/secrets --jq .secrets[].name &#34;prettier&#34; --wriGOINSECURE git 64/bin/go tierignore go run-script/lib/nprettier node /hom�� --write ../../../**/*.js**/*.json 64/bin/go --ignore-path ../../../.pretti-c /usr/bin/git go (http block)
    • Triggering command: /usr/bin/gh gh api /orgs/test-owner/actions/secrets --jq .secrets[].name -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env 3213532548/.github/workflows GO111MODULE ode GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/actions/ai-inference/git/ref/tags/v1
    • Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq .object.sha .github/workflows/test.md node /usr/bin/git --check **/*.cjs 64/bin/go git rev-�� --git-dir go /opt/hostedtoolcache/node/24.14.0/x64/bin/node -json GO111MODULE 64/bin/go /opt/hostedtoolcache/node/24.14.0/x64/bin/node (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq .object.sha --get remote.origin.url /usr/bin/git -json GO111MODULE k/gh-aw/gh-aw/ac--show-toplevel ub.actor }} ${{ github.actor }} ${{ github.acto rev-�� --show-toplevel go /usr/bin/git rity897445362/00git GO111MODULE /opt/hostedtoolc--show-toplevel git (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v3
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq .object.sha -aw/git/ref/tags/v2.0.0 GO111MODULE ache/go/1.25.0/x64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE ache/go/1.25.0/x64/pkg/tool/linux_amd64/vet -tes�� -test.paniconexit0 -test.v=true /usr/bin/git -test.timeout=10git -test.run=^Test -test.short=true--show-toplevel git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq .object.sha GOMODCACHE go /usr/bin/docker json&#39; --ignore-pdocker GO111MODULE 64/bin/go docker pull�� test/concurrent-image:v1.0.0 go /usr/bin/git th .prettierignogit GO111MODULE 64/bin/go op.prop.prop.prop.prop.prop.pro (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v5
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha --show-toplevel go /usr/bin/git -json GO111MODULE x_amd64/vet git rev-�� --show-toplevel x_amd64/vet /usr/bin/git -json GO111MODULE 64/bin/go git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha --show-toplevel go /usr/bin/git 0754-28842/test-git GO111MODULE ser.test git rev-�� --show-toplevel ser.test /usr/bin/git blog-auditor.md GO111MODULE ache/go/1.25.0/x--show-toplevel git (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v6
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha user.email test@example.com /opt/hostedtoolcache/node/24.14.0/x64/bin/node ae3Q/-oHPdAgNIy-git GO111MODULE 64/bin/go node /tmp�� /home/REDACTED/work/gh-aw/gh-aw/.github/workflows/agent-performance-analyzer.md 8160834/b414/imp--json /usr/bin/git k/gh-aw/gh-aw/pkgit GOPROXY 64/bin/go git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha /tmp/TestHashConsistency_GoAndJavaScript2275383790/001/test-frontmatter-with-arrays.md go /usr/bin/git pAbU/df2Fx0C0xZwgit GO111MODULE 64/bin/go git add .github/workflows/test.md 8160834/b429/impGOPROXY /usr/bin/git k/gh-aw/gh-aw/pkgit **/*.cjs 64/bin/go git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha --show-toplevel 64/pkg/tool/linux_amd64/vet /usr/bin/git -json GO111MODULE ache/go/1.25.0/x--show-toplevel git rev-�� --show-toplevel go /usr/bin/git 901822937/.githugit GO111MODULE .cfg git (http block)
  • https://api.github.com/repos/actions/github-script/git/ref/tags/v8
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha GOSUMDB GOWORK 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE 388157ec580a1fe6env GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE sh (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha ript formatting GOINSECURE GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE node (http block)
  • https://api.github.com/repos/actions/setup-go/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq .object.sha --get remote.origin.url /usr/bin/git ZEU9/jerxdY-62TEgit GO111MODULE 64/bin/go git conf�� -aw/git/ref/tags/v1.0.0 test@example.com /usr/bin/git k/gh-aw/gh-aw/pkgit k/gh-aw/gh-aw/pkrev-parse 64/bin/go git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq .object.sha --show-toplevel go /usr/bin/git -json GO111MODULE ache/go/1.25.0/x--show-toplevel git init�� GOMODCACHE go /usr/bin/git -json GO111MODULE ache/go/1.25.0/x--show-toplevel git (http block)
  • https://api.github.com/repos/actions/setup-node/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq .object.sha --get remote.origin.url /usr/bin/git TOQZ/wNm9Ia6Stp5git GO111MODULE 64/bin/go git init�� GOMODCACHE 8160834/b422/imp--json /usr/bin/git che/go-build/ec/git GOPROXY 64/bin/go git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq .object.sha /tmp/TestHashStability_SameInputSameOutput3680587364/001/stability-test.md go 0/x64/bin/node -json GO111MODULE ache/go/1.25.0/x--show-toplevel 0/x64/bin/node -1 xterm-color go 0/x64/bin/node -json GO111MODULE ache/go/1.25.0/x--show-toplevel 0/x64/bin/node (http block)
  • https://api.github.com/repos/actions/upload-artifact/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq .object.sha 9534788/b430/repoutil.test GO111MODULE 9534788/b430/importcfg.link GOINSECURE GOMOD GOMODCACHE BlPIPkS6j74YO/KCyQm7JrG_JTdGyVRlef/N6GE9dzJuLpfUe9tz4e_/ThKvzodBlPIPkS6j74YO env runs/20260322-200754-28842/test-117267904/.github/workflows GO111MODULE 9534788/b430/_pkg_.a l GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq .object.sha env.NODE_VERSION go ache/node/24.14.0/x64/bin/node -json GO111MODULE 64/bin/go git t-20�� sistency_GoAndJavaScript1588111648/001/test-complex-frontmatter-with-tools.md go /usr/bin/git ub/workflows GO111MODULE ode_modules/.bin--show-toplevel git (http block)
  • https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq .object.sha -json GO111MODULE 0/x64/bin/node GOINSECURE GOMOD GOMODCACHE go -has�� ithub/workflows/auto-triage-issues.md GO111MODULE 9534788/b432/vet.cfg GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq .object.sha /tmp/gh-aw-test-runs/20260322-200916-41866/test-2307671000 status /usr/bin/git .github/workflow/opt/hostedtoolcache/node/24.14.0/x64/bin/node GO111MODULE 64/bin/go git rev-�� 866714550/001 go /usr/bin/git repo2609475904/0git GO111MODULE 64/bin/go git (http block)
  • https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.2.3
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq .object.sha -json GO111MODULE g_.a GOINSECURE GOMOD GOMODCACHE go env k/gh-aw/gh-aw/.github/workflows GO111MODULE /opt/hostedtoolcache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq .object.sha --git-dir go /usr/bin/git -json GO111MODULE 64/bin/go git conf�� user.name Test User 0/x64/bin/node -json GO111MODULE node /usr/bin/git (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/1/artifacts
    • Triggering command: /usr/bin/gh gh run download 1 --dir test-logs/run-1 GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh run download 1 --dir test-logs/run-1 GO111MODULE x_amd64/link GOINSECURE GOMOD GOMODCACHE x_amd64/link env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh run download 1 --dir test-logs/run-1 -buildtags /usr/bin/git l -ifaceassert -nilfunc git conf�� user.email test@example.com /opt/hostedtoolcache/node/24.14.0/x64/bin/node &#34;prettier&#34; --wrigit git 64/bin/go node (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/12345/artifacts
    • Triggering command: /usr/bin/gh gh run download 12345 --dir test-logs/run-12345 GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh run download 12345 --dir test-logs/run-12345 GO111MODULE x_amd64/asm GOINSECURE GOMOD GOMODCACHE x_amd64/asm env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh run download 12345 --dir test-logs/run-12345 t /opt/hostedtoolcache/node/24.14.0/x64/bin/node --write **/*.cjs 64/bin/go node /tmp�� Onlymin-integrity_only_defaults_repo285882805/001 node /usr/bin/gh prettier --write 64/bin/go gh (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/12346/artifacts
    • Triggering command: /usr/bin/gh gh run download 12346 --dir test-logs/run-12346 GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh run download 12346 --dir test-logs/run-12346 GO111MODULE x_amd64/cgo GOINSECURE GOMOD GOMODCACHE x_amd64/cgo env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh run download 12346 --dir test-logs/run-12346 node /usr/bin/git --write **/*.cjs 64/bin/go git rev-�� --show-toplevel node /usr/bin/infocmp prettier --write 64/bin/go infocmp (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/2/artifacts
    • Triggering command: /usr/bin/gh gh run download 2 --dir test-logs/run-2 GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go estl�� -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh run download 2 --dir test-logs/run-2 GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh run download 2 --dir test-logs/run-2 -importcfg /usr/bin/git -s -w -buildmode=exe git conf�� user.name Test User /usr/bin/git &#34;prettier&#34; --wrigit git 64/bin/go git (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/3/artifacts
    • Triggering command: /usr/bin/gh gh run download 3 --dir test-logs/run-3 GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh run download 3 --dir test-logs/run-3 GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh run download 3 --dir test-logs/run-3 -buildtags /usr/bin/git -errorsas -ifaceassert -nilfunc git rev-�� --show-toplevel -tests /usr/bin/git &#34;prettier&#34; --wrigit 53 64/bin/go git (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/4/artifacts
    • Triggering command: /usr/bin/gh gh run download 4 --dir test-logs/run-4 GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh run download 4 --dir test-logs/run-4 GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh run download 4 --dir test-logs/run-4 (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/5/artifacts
    • Triggering command: /usr/bin/gh gh run download 5 --dir test-logs/run-5 GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE 0XVD7GS/mRL0tEU7JbrieQ94-F8q env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh run download 5 --dir test-logs/run-5 GO111MODULE x_amd64/link GOINSECURE GOMOD GOMODCACHE x_amd64/link env -json GO111MODULE ache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE zf/SWtywrsSukpJwremote.origin.url (http block)
    • Triggering command: /usr/bin/gh gh run download 5 --dir test-logs/run-5 -buildtags /usr/bin/git -errorsas -ifaceassert -nilfunc git -C /tmp/compile-instructions-test-4282508249/.github/workflows config /usr/bin/git remote.origin.urgit owner modules/@npmcli/--show-toplevel git (http block)
  • https://api.github.com/repos/github/gh-aw/actions/workflows
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path GOSUMDB GOWORK 64/bin/go GOINSECURE GOMOD GOMODCACHE ache/go/1.25.0/xGO111MODULE env 8160834/b416/_pkGOINSECURE GO111MODULE 64/bin/go GOINSECURE b/gh-aw/pkg/mathenv GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 100 GOMOD GOMODCACHE go env Pr7i/BVfOlHDkTyfGOSUMDB GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE 8160834/b406/imprev-parse (http block)
    • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 6 GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env y_only_defaults_repo1871559854/001 GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq .object.sha go1.25.0 -c=4 -nolocalimports -importcfg /tmp/go-build759686993/b001/importcfg -pack /tmp/go-build759686993/b001/_testmain.go env */*.ts&#39; &#39;**/*.json&#39; --ignore-path ../../../.pret--ignore-path GO111MODULE 64/bin/node GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.2.3
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE node (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq .object.sha ath ../../../.pr**/*.json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq .object.sha .js&#39; --ignore-path .prettierigno--detach GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet env -json GO111MODULE k/_temp/uv-python-dir/node GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v2.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE /bin/sh -c cd actions/setup-errorsas GOPROXY 64/bin/go GOSUMDB GOWORK 64/bin/go sh (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE sh -c npx prettier --c-test.timeout=10m0s GOPROXY 64/bin/go GOSUMDB GOWORK 64/bin/go sh (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE sh -c npx prettier --c-errorsas GOPROXY 64/bin/go GOSUMDB GOWORK 64/bin/go sh (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v3.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE sh -c npx prettier --c-p GOPROXY 64/bin/go GOSUMDB GOWORK 64/bin/go sh (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq .object.sha ath ../../../.pr**/*.json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env re GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq .object.sha -json GO111MODULE ache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env 0916-41866/test-2332540649/.github/workflows GO111MODULE 0/x64/bin/node GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/nonexistent/action/git/ref/tags/v999.999.999
    • Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env y_with_explicit_repo3656296772/001 GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq .object.sha 4281202327/.github/workflows GO111MODULE 0/x64/bin/sh GOINSECURE GOMOD GOMODCACHE go env */*.ts&#39; &#39;**/*.json&#39; --ignore-path ../../../.prettierignore GO111MODULE ache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/nonexistent/repo/actions/runs/12345
    • Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/sh GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion run format:pkg-json 64/bin/go git t-ha�� vaScript1588111648/001/test-frontmatter-with-nested-objects.md go /usr/bin/docker ys.md GO111MODULE 64/bin/go docker (http block)
  • https://api.github.com/repos/owner/repo/actions/workflows
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo 64/bin/go GOINSECURE GOMOD GOMODCACHE ache/go/1.25.0/xGO111MODULE env 8160834/b415/_pkGOINSECURE GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo 64/bin/go GOINSECURE GOMOD GOMODCACHE ache/go/1.25.0/xGO111MODULE env 8160834/b423/_pkGOINSECURE GO111MODULE 64/bin/go GOINSECURE b/gh-aw/pkg/slicenv GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo 64/bin/go tierignore go /usr/bin/git node /hom�� --write ../../../**/*.js**/*.json 64/bin/go --ignore-path ../../../.pretti-c /usr/bin/git go (http block)
  • https://api.github.com/repos/owner/repo/contents/file.md
    • Triggering command: /tmp/go-build1969534788/b400/cli.test /tmp/go-build1969534788/b400/cli.test -test.testlogfile=/tmp/go-build1969534788/b400/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true GOINSECURE GOMOD GOMODCACHE go m/_n�� -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /tmp/go-build4280266639/b400/cli.test /tmp/go-build4280266639/b400/cli.test -test.testlogfile=/tmp/go-build4280266639/b400/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true OUTPUT -d 168.63.129.16 sh -c &#34;prettier&#34; --wriGOSUMDB owner 64/bin/go 0 -j ACCEPT go (http block)
    • Triggering command: /tmp/go-build759686993/b001/cli.test /tmp/go-build759686993/b001/cli.test -test.testlogfile=/tmp/go-build759686993/b001/testlog.txt -test.paniconexit0 -test.timeout=10m0s env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env 2/001/test-complex-frontmatter-with-tools.md GO111MODULE ache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/test-owner/test-repo/actions/secrets
    • Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name GOSUMDB GOWORK 64/bin/go GOINSECURE GOMOD GOMODCACHE ache/go/1.25.0/xGO111MODULE env 8160834/b407/_pkGOINSECURE GO111MODULE 64/bin/go GOINSECURE b/gh-aw/pkg/consenv GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name &#34;prettier&#34; --wriGOINSECURE git 64/bin/go tierignore go /usr/bin/git node /hom�� --write ../../../**/*.jsGOWORK 64/bin/go --ignore-path ../../../.pretti-c /usr/bin/git go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name (http block)

If you need me to access, download, or install something from one of these locations, you can either:

@pelikhan
Copy link
Copy Markdown
Collaborator

Copy link
Copy Markdown
Contributor Author

Copilot AI commented Mar 22, 2026

@copilot fix docs

https://github.com/github/gh-aw/actions/runs/23411577465/job/68099616439

Fixed in 2e7e1ce. The link in cross-repository.md referenced the old anchor #github-repository-access-restrictions-toolsgithubrepos, which changed when the github-tools.md heading was renamed to use allowed-repos. Updated to #github-repository-access-restrictions-toolsgithuballowed-repos.

@pelikhan pelikhan merged commit 757cf27 into main Mar 22, 2026
53 checks passed
@pelikhan pelikhan deleted the copilot/rename-tools-github-repos branch March 22, 2026 20:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Rename tools.github.repos to tools.github.allowed-repos

3 participants