fix: mint checkout app tokens in agent job, not activation job#24902
Merged
fix: mint checkout app tokens in agent job, not activation job#24902
Conversation
GitHub Actions runner (v2.308+) silently drops masked job outputs.
actions/create-github-app-token calls ::add-mask:: on the token,
so tokens passed from activation→agent via job outputs were being
suppressed, causing 'Input required and not supplied: token'.
Fix: mint checkout tokens directly in the agent job (same approach
already used for github-mcp-app-token), so they are accessible as
steps.checkout-app-token-{index}.outputs.token within the same job.
Changes:
- compiler_activation_job.go: remove checkout token minting + outputs
- compiler_main_job.go: remove invariant blocking checkout minting in agent job
- compiler_yaml_main_job.go: add checkout token minting before checkout steps
- checkout_step_generator.go: update all token refs to steps.* form
- checkout_manager.go: remove now-unused CheckoutAppTokenOutputs method
- tests: update to verify new behavior (tokens in agent job)
Agent-Logs-Url: https://github.com/github/gh-aw/sessions/7124be57-8902-4d7f-8689-588206019162
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copilot
AI
changed the title
[WIP] Fix cross-repo checkout fails due to suppressed job output
fix: mint checkout app tokens in agent job, not activation job
Apr 6, 2026
Contributor
There was a problem hiding this comment.
Pull request overview
Fixes cross-repo checkout failures caused by GitHub Actions runner v2.308+ dropping masked job outputs by minting checkout GitHub App tokens in the agent job (where they’re consumed) instead of the activation job.
Changes:
- Mint checkout GitHub App tokens directly in the agent job before any checkout steps, and reference them via
steps.checkout-app-token-{index}.outputs.token. - Remove activation-job checkout token minting and activation output plumbing (
checkout_app_token_{N}). - Update generators/tests to use same-job
steps.*references and delete now-dead helper code.
Show a summary per file
| File | Description |
|---|---|
| pkg/workflow/compiler_yaml_main_job.go | Adds checkout app token minting steps to the agent job before checkout execution. |
| pkg/workflow/compiler_activation_job.go | Removes checkout token minting steps and activation job outputs for checkout tokens. |
| pkg/workflow/compiler_main_job.go | Removes the previous invariant that forbade checkout-app-token steps in the agent job. |
| pkg/workflow/checkout_step_generator.go | Updates checkout/fetch/invalidation to reference steps.checkout-app-token-{index}.outputs.token. |
| pkg/workflow/checkout_manager.go | Deletes now-unused activation-output helper (CheckoutAppTokenOutputs). |
| pkg/workflow/github_mcp_app_token_test.go | Renames/updates test to expect checkout app tokens minted in the agent job. |
| pkg/workflow/checkout_manager_test.go | Updates assertions to ensure same-job step output references are used (not activation outputs). |
Copilot's findings
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 7/7 changed files
- Comments generated: 2
Comment on lines
+606
to
+616
| // The token minting step must appear in the compiled workflow | ||
| assert.Contains(t, lockContent, "id: checkout-app-token-0", | ||
| "Checkout app token minting step must be present in the compiled workflow") | ||
| assert.Contains(t, lockContent, "create-github-app-token", | ||
| "Checkout app token minting step must use create-github-app-token action") | ||
|
|
||
| // The token must be referenced via the step output (same-job), not via activation outputs. | ||
| // Activation job outputs of masked values are silently dropped by the runner (v2.308+). | ||
| assert.Contains(t, lockContent, "steps.checkout-app-token-0.outputs.token", | ||
| "Token must be referenced via step output within the same job") | ||
| assert.NotContains(t, lockContent, "needs.activation.outputs.checkout_app_token_0", |
There was a problem hiding this comment.
This test asserts that the compiled workflow contains the checkout-app-token step and that checkout steps reference steps.checkout-app-token-0.outputs.token, but it no longer verifies that the minting step is located in the agent job (vs accidentally being emitted in activation). That could let a regression slip through where the step exists but is in the wrong job (and the steps.* reference would be invalid at runtime). Consider reintroducing the agent-job section extraction (or explicitly asserting the step appears under jobs:\n agent: and not under jobs:\n activation:).
Comment on lines
+53
to
+54
| // Update the if condition to reference the step output (not activation outputs) | ||
| modified = strings.ReplaceAll(modified, "if: always() && steps.safe-outputs-app-token.outputs.token != ''", fmt.Sprintf("if: always() && steps.%s.outputs.token != ''", stepID)) |
There was a problem hiding this comment.
In GenerateCheckoutAppTokenInvalidationSteps, the first ReplaceAll already rewrites the if: line because it contains steps.safe-outputs-app-token.outputs.token, so the subsequent ReplaceAll targeting the full if: always() && steps.safe-outputs-app-token.outputs.token != '' string is a no-op. Consider removing the second replacement (or applying it before the token replacement) to avoid misleading future readers about what’s actually being rewritten.
Suggested change
| // Update the if condition to reference the step output (not activation outputs) | |
| modified = strings.ReplaceAll(modified, "if: always() && steps.safe-outputs-app-token.outputs.token != ''", fmt.Sprintf("if: always() && steps.%s.outputs.token != ''", stepID)) |
Collaborator
|
@copilot review comments |
…coped assertions in test - checkout_step_generator.go: remove redundant second ReplaceAll in GenerateCheckoutAppTokenInvalidationSteps (the first pass already rewrites the if: condition when it replaces steps.safe-outputs-app-token) - github_mcp_app_token_test.go: use extractJobSection helper to assert the checkout-app-token-0 step is inside the agent job and NOT in the activation job, preventing a silent regression where the step could be emitted in the wrong job Agent-Logs-Url: https://github.com/github/gh-aw/sessions/d385f64e-bf00-4ed1-87f1-20fff6a5a838 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
Addressed both review comments in fe0f737:
Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
GitHub Actions runner v2.308+ silently drops masked job outputs. Since
actions/create-github-app-tokencalls::add-mask::on its token, checkout tokens minted in theactivationjob and forwarded vianeeds.activation.outputs.checkout_app_token_Nwere being suppressed — causingactions/checkoutto fail withInput required and not supplied: tokenon cross-repo checkouts.Changes
compiler_yaml_main_job.go): checkout app tokens are now minted directly in the agent job before checkout steps execute, identical to howgithub-mcp-app-tokenis handledcompiler_activation_job.go): delete token minting steps andcheckout_app_token_Njob outputscompiler_main_job.go): drop the guard that blockedcheckout-app-token-*steps from appearing in the agent job (now intentional)checkout_step_generator.go): all checkout, fetch, and invalidation steps now referencesteps.checkout-app-token-{index}.outputs.tokeninstead ofneeds.activation.outputs.checkout_app_token_Ncheckout_manager.go): deleteCheckoutAppTokenOutputs()which was only used to populate activation job outputsgithub_mcp_app_token_test.go,checkout_manager_test.go):TestCheckoutAppTokensNotMintedInAgentJob→TestCheckoutAppTokensMintedInAgentJobwith assertions that verify same-job step references and no activation output pass-throughBefore (broken — token suppressed in transit):
After (fixed — token minted where it's used):
Warning
Firewall rules blocked me from connecting to one or more addresses (expand for details)
I tried to connect to the following addresses, but was blocked by firewall rules:
https://api.github.com/graphql/usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw(http block)/usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw /lcs(http block)/usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw ire(http block)https://api.github.com/orgs/test-owner/actions/secrets/usr/bin/gh gh api /orgs/test-owner/actions/secrets --jq .secrets[].name /tmp/go-build334-p -trimpath 64/bin/go -p main -lang=go1.25 go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)/usr/bin/gh gh api /orgs/test-owner/actions/secrets --jq .secrets[].name --write ../../../**/*.jsGOMOD 64/bin/go --ignore-path ../../../.pretti-c /usr/bin/git go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)/usr/bin/gh gh api /orgs/test-owner/actions/secrets --jq .secrets[].name --show-toplevel nly /usr/bin/git -json GO111MODULE ache/go/1.25.8/x64/bin/go git rev-�� --show-toplevel go /usr/bin/git -json GO111MODULE k/gh-aw/gh-aw/actions/setup/js/n--show-toplevel git(http block)https://api.github.com/repos/actions/ai-inference/git/ref/tags/v1/usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq .object.sha bytealg/compare_-test.paniconexit0 x_amd64/compile /opt/hostedtoolcache/node/24.14.1/x64/bin/node -json GO111MODULE 64/pkg/tool/linu--show-toplevel /opt/hostedtoolcache/node/24.14.1/x64/bin/node /tmp�� env.NODE_VERSION 64/pkg/tool/linux_amd64/compile /usr/bin/git g_.a GO111MODULE 64/pkg/tool/linu--show-toplevel /usr/bin/git(http block)/usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq .object.sha -json GO111MODULE /home/REDACTED/work/gh-aw/gh-aw/node_modules/.bin/sh GOINSECURE GOMOD GOMODCACHE sh -c "prettier" --check '**/*.cjs' '**/*.ts' '**/*.json' --ignore-path ../../../.prettierignore GOPROXY /opt/hostedtoolcache/go/1.25.8/x64/bin/bash GOSUMDB GOWORK 64/bin/go bash(http block)https://api.github.com/repos/actions/checkout/git/ref/tags/v3/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq .object.sha sistency_WithImports2655640194/001/main.md --stdin /usr/bin/gh --exclude-hiddengit --all --quiet gh api /repos/actions/github-script/git/ref/tags/v8 s/test.md /opt/hostedtoolcache/node/24.14.1/x64/bin/node -json GO111MODULE 64/bin/go node(http block)/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq .object.sha */*.ts' '**/*.json' --ignore-path ../../../.prettierignore GO111MODULE 64/pkg/tool/linux_amd64/asm GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/asm env -json GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)https://api.github.com/repos/actions/checkout/git/ref/tags/v5/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha /home/REDACTED/work/gh-aw/gh-aw/pkg/workflow/action_resolver_test.go /home/REDACTED/work/gh-aw/gh-aw/pkg/workflow/action_sha_checker.go /home/REDACTED/work/gh-aw/gh-aw/pkg/workflow/action_sha_checker_integration_test.go /home/REDACTED/work/gh-aw/gh-aw/pkg/workflow/action_sha_checker_test.go /home/REDACTED/work/gh-aw/gh-aw/pkg/workflow/action_sha_validation_test.go /home/REDACTED/work/gh-aw/gh-aw/pkg/workflow/activation_checkout_test.go /home/REDACTED/work/gh-aw/gh-aw/pkg/workflow/activation_github_token_test.go conf�� submodules | head -n 10 --get x_amd64/vet(http block)/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha ortcfg RR0X2oXnN x_amd64/link GOINSECURE GOMOD GOMODCACHE x_amd64/link env DefaultBranchFromLsRemoteWithRealGitbranch_with_hyphen4161322917/001' DefaultBranchFromLsRemoteWithRealGitbranch_with_hyphen4161322917/001' ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile GOINSECURE 3689660/b078/ GOMODCACHE J_/CWrYu2czG7Ca7ylQP4Z8/vCNYLdc7D8RXanEmFBss(http block)/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha xterm-color xvLX0kW/sVnmb7t6Add workflow /usr/bin/git g_.a rotocol/go-sdk@vrev-parse 64/pkg/tool/linu--show-toplevel git rev-�� --show-toplevel 64/pkg/tool/linux_amd64/compile /usr/bin/git 2749879369 QyquJZDcH /opt/hostedtoolc--show-toplevel git(http block)https://api.github.com/repos/actions/checkout/git/ref/tags/v6/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha GOMODCACHE hT50UqE/9k5zS8fxGvEC3R_91kvz /usr/bin/git -json GO111MODULE x_amd64/compile git rev-�� --show-toplevel x_amd64/compile /usr/bin/git -json GO111MODULE x_amd64/vet git(http block)/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha GOMODCACHE 8qDaCOJ/F2B9BFkfrev-parse /usr/bin/git -json GO111MODULE x_amd64/compile git rev-�� --show-toplevel x_amd64/compile /usr/bin/git -json GO111MODULE x_amd64/vet git(http block)/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha --show-toplevel ache/go/1.25.8/x64/pkg/tool/linux_amd64/asm /usr/bin/git ithub/workflows GO111MODULE 64/pkg/tool/linu--show-toplevel git rev-�� --show-toplevel 64/pkg/tool/linux_amd64/link /usr/bin/git thSetup_GorootOrgit '/tmp/TestParseDrev-parse ortcfg.link git(http block)https://api.github.com/repos/actions/github-script/git/ref/tags/v8/usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha go1.25.8 -c=4 -nolocalimports -importcfg /tmp/go-build3103689660/b227/importcfg -pack /home/REDACTED/go/pkg/mod/github.com/modelcontextprotocol/go-sdk@v1.4.1/internal/jsonrpc2/conn.go -o /tmp/go-build334-p o 64/bin/go -p github.com/githu-o -lang=go1.25 go(http block)/usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE x_amd64/asm GOINSECURE GOMOD GOMODCACHE x_amd64/asm(http block)/usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD tomic_wasm.s go env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile(http block)https://api.github.com/repos/actions/setup-go/git/ref/tags/v4/usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq .object.sha -m resolved$ /usr/bin/git Gitbranch_with_hgit Gitbranch_with_hrev-parse x_amd64/compile git conf�� user.email test@example.com /usr/bin/git -json GO111MODULE x_amd64/compile git(http block)/usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq .object.sha ck 'scripts/**/*.js' --ignore-path .prettierignore GO111MODULE /opt/hostedtoolcache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE /opt/hostedtoolcache/node/24.14.1/x64/bin/sh GOINSECURE GOMOD GOMODCACHE sh(http block)https://api.github.com/repos/actions/setup-node/git/ref/tags/v4/usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq .object.sha user.email resolved$ /usr/bin/git -json GO111MODULE x_amd64/compile git init�� GOMODCACHE x_amd64/compile /usr/bin/git -json GO111MODULE x_amd64/link git(http block)/usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq .object.sha ck 'scripts/**/*.js' --ignore-path .prettierignore GO111MODULE /opt/hostedtoolcache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE /home/REDACTED/go/bin/sh GOINSECURE GOMOD GOMODCACHE sh(http block)https://api.github.com/repos/actions/upload-artifact/git/ref/tags/v4/usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq .object.sha 999 -trimpath /usr/bin/git -p net/http/httptrarev-parse -lang=go1.25 git add . 9pw3AB5m6U_Ak5qHtlUh/9pw3AB5m6U_Ak5qHtlUh 1/x64/bin/node -goversion go1.25.8 -c=4 1/x64/bin/node(http block)/usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 86_64/node GOINSECURE GOMOD GOMODCACHE go(http block)https://api.github.com/repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b/usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq .object.sha ath ../../../.pr**/*.json .cfg 64/pkg/tool/linu../../../.prettierignore(http block)https://api.github.com/repos/github/gh-aw/usr/bin/gh gh api /repos/github/gh-aw --jq .visibility json' --ignore-path ../../../.pr**/*.json 1939927/b078/vet.cfg .cfg(http block)https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v0.1.2/usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0.1.2 --jq .object.sha GOMODCACHE x_amd64/compile /usr/bin/git Gitbranch_with_hgit Gitbranch_with_hrev-parse x_amd64/compile git rev-�� --show-toplevel x_amd64/compile /usr/bin/git 01 GO111MODULE x_amd64/compile git(http block)/usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0.1.2 --jq .object.sha ck 'scripts/**/*.js' --ignore-path .prettierignore GO111MODULE /opt/hostedtoolcache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE /home/REDACTED/work/gh-aw/gh-aw/actions/setup/node_modules/.bin/sh GOINSECURE GOMOD GOMODCACHE sh(http block)https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.0.0/usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq .object.sha k/gh-aw/gh-aw/.github/workflows -D /usr/bin/git -gensymabis -o /tmp/go-build310--show-toplevel git init�� --bare l /usr/bin/git "prettier" --chegit sh 64/bin/go git(http block)/usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq .object.sha -json GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go 1/x6�� -json GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.2.3/usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq .object.sha -buildid JYbkfQ24WgmEFuVqG1PQ/JYbkfQ24WgmEFuVqG1PQ /bin/sh -goversion go1.25.8 -c=4 /bin/sh -c git-upload-pack '/tmp/TestParseDefaultBranchFromLsRemoteWithRealGitmain_branch445256052/001' git-upload-pack '/tmp/TestParseDefaultBranchFromLsRemoteWithRealGitmain_branch445256052/001' e/git "prettier" --chegit sh 64/bin/go e/git(http block)/usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq .object.sha -json GO111MODULE n-dir/node GOINSECURE GOMOD GOMODCACHE go 1/x6�� -json GO111MODULE bin/sh GOINSECURE GOMOD GOMODCACHE go(http block)https://api.github.com/repos/github/gh-aw/actions/runs/1/artifacts/usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/1/artifacts --jq .artifacts[].name @v1.1.3/cpu/arm/arm.go 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile env g_.a hOYFQ3cxW util.test GOINSECURE 64 GOMODCACHE util.test(http block)/usr/bin/gh gh run download 1 --dir test-logs/run-1 0/internal/language/common.go 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile env plorer.md 5-yTJqrnP 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile(http block)/usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/1/artifacts --jq .artifacts[].name GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env 5870/001/stability-test.md GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)https://api.github.com/repos/github/gh-aw/actions/runs/12345/artifacts/usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12345/artifacts --jq .artifacts[].name GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile env b/workflows ne_constants.go 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linuTest User(http block)/usr/bin/gh gh run download 12345 --dir test-logs/run-12345 GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile env g_.a 6D-KwQuTc 64/pkg/tool/linux_amd64/link GOINSECURE ack GOMODCACHE 64/pkg/tool/linuremote.origin.url(http block)/usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12345/artifacts --jq .artifacts[].name GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env 3785799458/.github/workflows GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)https://api.github.com/repos/github/gh-aw/actions/runs/12346/artifacts/usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12346/artifacts --jq .artifacts[].name GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile env b/workflows l_test.go 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD abis 64/pkg/tool/linutest@example.com(http block)/usr/bin/gh gh run download 12346 --dir test-logs/run-12346 GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile env g_.a AUUx1O_e3 x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet(http block)/usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12346/artifacts --jq .artifacts[].name GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env 6/001/test-inlined-imports-enabled-with-env-template-expressions-in-body.md GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)https://api.github.com/repos/github/gh-aw/actions/runs/2/artifacts/usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/2/artifacts --jq .artifacts[].name @v1.1.3/cpu/arm64/arm64.go 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile env g_.a m0O72i2Jk 64/pkg/tool/linux_amd64/compile GOINSECURE(http block)/usr/bin/gh gh run download 2 --dir test-logs/run-2 0/internal/language/compact/compact.go 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile env 983612088 GO111MODULE ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile GOINSECURE pguts GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile(http block)/usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/2/artifacts --jq .artifacts[].name mLsRemoteWithRealGitcustom_branch1727825108/001' ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env '**/*.ts' '**/*.json' --ignore-path ../../../.pr**/*.json GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)https://api.github.com/repos/github/gh-aw/actions/runs/3/artifacts/usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/3/artifacts --jq .artifacts[].name @v1.1.3/cpu/x86/x86.go 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linuTest User env til.go o 64/pkg/tool/linux_amd64/compile GOINSECURE go-sdk/internal/rev-parse GOMODCACHE 64/pkg/tool/linux_amd64/compile(http block)/usr/bin/gh gh run download 3 --dir test-logs/run-3 GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD abis 64/pkg/tool/linux_amd64/compile env 983612088 KjIdi_zAe ache/go/1.25.8/x64/pkg/tool/linux_amd64/asm GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/asm(http block)/usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/3/artifacts --jq .artifacts[].name GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env y_with_repos_array_c1467153012/001 GO111MODULE 1/x64/lib/node_modules/npm/node_modules/@npmcli/run-script/lib/node-gyp-bin/node GOINSECURE GOMOD GOMODCACHE go(http block)https://api.github.com/repos/github/gh-aw/actions/runs/4/artifacts/usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/4/artifacts --jq .artifacts[].name rotocol/go-sdk@v1.4.1/internal/mcpgodebug/mcpgodebug.go 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linutest@example.com env l.go l_test.go x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet(http block)/usr/bin/gh gh run download 4 --dir test-logs/run-4 0/language/cover-c=4 64/pkg/tool/linu-nolocalimports GOINSECURE GOMOD abis 64/pkg/tool/linutest@example.com env g_.a 3GMM57Ps3 ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile GOINSECURE go-sdk/internal/rev-parse GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile(http block)/usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/4/artifacts --jq .artifacts[].name GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env y_with_repos_array_c1467153012/001 GO111MODULE 86_64/node GOINSECURE GOMOD GOMODCACHE go(http block)https://api.github.com/repos/github/gh-aw/actions/runs/5/artifacts/usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/5/artifacts --jq .artifacts[].name @v1.1.3/cpu/cpu.go 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile env g_.a LZuHOSZyr x_amd64/link GOINSECURE go-sdk/internal/rev-parse GOMODCACHE x_amd64/link(http block)/usr/bin/gh gh run download 5 --dir test-logs/run-5 l.go 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD abis 64/pkg/tool/linux_amd64/compile 64/s�� g_.a bbyq8rTOi 64/pkg/tool/linux_amd64/link GOINSECURE g GOMODCACHE 64/pkg/tool/linux_amd64/link(http block)/usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/5/artifacts --jq .artifacts[].name GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env y_with_repos_array_c1467153012/0remote.origin.url GO111MODULE n-dir/node GOINSECURE GOMOD GOMODCACHE go(http block)https://api.github.com/repos/github/gh-aw/actions/workflows/usr/bin/gh gh workflow list --json name,state,path /tmp/go-build334-p -trimpath 64/bin/go -p github.com/githu-o -lang=go1.25 go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)/usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 100 GOMOD GOMODCACHE go env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile(http block)/usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 6 GOMOD GOMODCACHE 64/pkg/tool/linuremote2 env 68104536/001 GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE clr_wasm.o 64/src/runtime/m--show-toplevel 64/pkg/tool/linux_amd64/vet(http block)https://api.github.com/repos/github/gh-aw/git/ref/tags/v0.47.4/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v0.47.4 --jq .object.sha --show-toplevel -tests /usr/bin/git 68104536/001 GO111MODULE 64/pkg/tool/linu--show-toplevel git rev-�� --show-toplevel 64/pkg/tool/linux_amd64/vet /usr/bin/git -json 7zDW0_L0m ache/go/1.25.8/xgit-upload-pack 'origin' git(http block)/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v0.47.4 --jq .object.sha --show-toplevel sh /usr/bin/git $GOPATH/bin/golagit go 64/bin/go git rev-�� --show-toplevel go /usr/bin/git -json GO111MODULE 64/bin/go git(http block)https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.0.0/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq .object.sha g_.a lNGu_38wk 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet env 49/001/test-empty-frontmatter.md-test.timeout=10m0s 1T9iaPhBz ache/go/1.25.8/x64/pkg/tool/linu-test.short=true GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile(http block)/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq .object.sha npx prettier --wGOINSECURE go 64/bin/go -json GO111MODULE 1/x64/bin/node go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.2.3/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq .object.sha -json GO111MODULE x_amd64/asm GOINSECURE GOMOD GOMODCACHE x_amd64/asm env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile(http block)/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq .object.sha --show-toplevel go /usr/bin/git ck '**/*.cjs' '*git-receive-pack GO111MODULE k/_temp/uv-python-dir/bash git rev-�� --show-toplevel go /usr/bin/git -json GO111MODULE /opt/hostedtoolc/tmp/TestGuardPolicyTrustedUsersCompiledOutput356673220/001 git(http block)https://api.github.com/repos/github/gh-aw/git/ref/tags/v2.0.0/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq .object.sha -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json GO111MODULE x_amd64/asm GOINSECURE GOMOD GOMODCACHE x_amd64/asm(http block)/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq .object.sha -json GO111MODULE x_amd64/asm GOINSECURE GOMOD GOMODCACHE x_amd64/asm env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile(http block)/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq .object.sha -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile(http block)https://api.github.com/repos/github/gh-aw/git/ref/tags/v3.0.0/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq .object.sha -json GO111MODULE x_amd64/asm GOINSECURE GOMOD GOMODCACHE x_amd64/asm env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile(http block)/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq .object.sha re GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq .object.sha --show-toplevel go /usr/bin/git ck '**/*.cjs' '*/usr/lib/git-core/git GO111MODULE ache/go/1.25.8/xfor-each-ref git rev-�� --show-toplevel go /usr/bin/infocmp -json GO111MODULE /opt/hostedtoolc/tmp/TestGuardPolicyTrustedUsersExpressionCompiledOutput3630302049/001 infocmp(http block)https://api.github.com/repos/githubnext/agentics/git/ref/tags/-/usr/bin/gh gh api /repos/githubnext/agentics/git/ref/tags/- --jq .object.sha re --log-level=error .cfg $name) { hasDiscussionsEnabled } } OUTPUT -d 168.63.129.16 64/pkg/tool/linurev-parse /pre�� 0732960/b001/exe/a.out conntrack n-dir/bash enerateAdditionagit jGc01fFUqJLHx/5Z-C DROP ache/go/1.25.8/xrev-parse(http block)https://api.github.com/repos/nonexistent/action/git/ref/tags/v999.999.999/usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq .object.sha edOutput4215177711/001 GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE obyte GOMODCACHE 64/pkg/tool/linuTest User ortc�� -json .cfg ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linurev-parse(http block)/usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq .object.sha npx prettier --wGOINSECURE go 64/bin/go -json GO111MODULE k/_temp/uv-pytho-json go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)https://api.github.com/repos/nonexistent/repo/actions/runs/12345/usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion GOINSECURE GOMOD abis 64/pkg/tool/linux_amd64/compile env g_.a Bzwz7Kv-X 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet(http block)/usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion GOINSECURE GOMOD GOMODCACHE go env /workflows GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet(http block)/usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion --show-toplevel sh /usr/bin/git git rev-�� y_only_defaults_repo2185368523/001 git 1/x64/bin/node --show-toplevel go /usr/bin/git git(http block)https://api.github.com/repos/owner/repo/actions/workflows/usr/bin/gh gh workflow list --json name,state,path --repo owner/repo -importcfg /tmp/go-build2984495921/b410/importcfg -pack /home/REDACTED/work/gh-aw/gh-aw/pkg/fileutil/fileutil.go /home/REDACTED/work/gh-aw/gh-aw/pkg/fileutil/tar.go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE y.s(http block)/usr/bin/gh gh workflow list --json name,state,path --repo owner/repo 64/bin/go -p main -lang=go1.25 go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)/usr/bin/gh gh workflow list --json name,state,path --repo owner/repo 64/bin/go --ignore-path ../../../.pretti-c /usr/bin/git go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)https://api.github.com/repos/owner/repo/contents/file.md/tmp/go-build2984495921/b396/cli.test /tmp/go-build2984495921/b396/cli.test -test.testlogfile=/tmp/go-build2984495921/b396/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true -importcfg /tmp/go-build3103689660/b220/importcfg -pack /home/REDACTED/go/pkg/mod/golang.org/x/sys@v0.42.0/cpu/byteorder.go -o /tmp/go-build334-p -trimpath 64/bin/go -p github.com/githu-o -lang=go1.25 go(http block)/tmp/go-build1390562315/b396/cli.test /tmp/go-build1390562315/b396/cli.test -test.testlogfile=/tmp/go-build1390562315/b396/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true .prettierignore --log-level=erroenv /usr/bin/git node /hom�� --write ../../../**/*.jsGOMOD 64/bin/go ./cmd/... ./pkg/...; \ else \ echo "golangci-lint is not installed. Run 'make deps-dev' to in ../../../.pretti-c /usr/bin/git go(http block)/tmp/go-build493097877/b001/cli.test /tmp/go-build493097877/b001/cli.test -test.paniconexit0 -test.timeout=10m0s -test.count=1 rev-�� --show-toplevel go /usr/bin/git -json GO111MODULE ache/go/1.25.8/x64/bin/go git rev-�� --show-toplevel go /usr/bin/git -json GO111MODULE ache/go/1.25.8/x64/bin/go git(http block)https://api.github.com/repos/test-owner/test-repo/actions/secrets/usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name /tmp/go-build334-p -trimpath 64/bin/go -p main -lang=go1.25 go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)/usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name --write ../../../**/*.jsGOMOD 64/bin/go --ignore-path ../../../.pretti-c /usr/bin/git go env -json GO111MODULE modules/@npmcli/run-script/lib/node-gyp-bin/node GOINSECURE GOMOD GOMODCACHE go(http block)/usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name --show-toplevel nly /usr/bin/git kflow.test GO111MODULE ortcfg.link git rev-�� --show-toplevel A2gHe1F9YDcEZtILEN/RTJuwazXMLQc0TCIbfvP/fe9Na3CfsKdte85JObks /usr/bin/git -json GO111MODULE 66f2c6c8f82e3a1b5ef4e7b689abdce0--show-toplevel git(http block)If you need me to access, download, or install something from one of these locations, you can either: