feat: port smoke-codex workflow from gh-aw#557
Conversation
Co-authored-by: Mossaka <5447827+Mossaka@users.noreply.github.com>
Co-authored-by: Mossaka <5447827+Mossaka@users.noreply.github.com>
|
💫 TO BE CONTINUED... Smoke Claude failed! Our hero faces unexpected challenges... |
|
📰 DEVELOPING STORY: Smoke Copilot reports failed. Our correspondents are investigating the incident... |
✅ Coverage Check PassedOverall Coverage
Coverage comparison generated by |
There was a problem hiding this comment.
Pull request overview
Ports the smoke-codex gh-aw workflow into this repo to validate the Codex engine under AWF firewall constraints, and updates the repo’s generated gh-aw workflow lockfiles/scripts to include it.
Changes:
- Adds a new
Smoke Codexworkflow plus shared workflow imports needed for Codex smoke scenarios (GitHub CLI safe-input, Tavily MCP config, reporting guidance, GitHub query safe-inputs). - Updates
scripts/ci/postprocess-smoke-workflows.tsto includesmoke-codex.lock.ymlin postprocessing. - Regenerates multiple
*.lock.ymlworkflows (gh-aw v0.42.10, updated AWF/agent versions, MCP gateway payload dir support, sparse checkout adjustments, etc.).
Reviewed changes
Copilot reviewed 31 out of 31 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| scripts/ci/postprocess-smoke-workflows.ts | Adds smoke-codex.lock.yml to the set of workflows postprocessed in CI. |
| .github/workflows/smoke-codex.md | New Codex smoke test definition covering MCP/GH CLI/Playwright/Tavily/files/bash/discussion/build checks. |
| .github/workflows/shared/gh.md | New shared safe-input wrapper for authenticated gh CLI usage. |
| .github/workflows/shared/mcp/tavily.md | New shared Tavily MCP server configuration. |
| .github/workflows/shared/reporting.md | New shared guidelines for consistent report formatting. |
| .github/workflows/update-release-notes.lock.yml | Regenerated gh-aw lock workflow with updated versions and MCP gateway payload dir support. |
| .github/workflows/test-coverage-improver.lock.yml | Regenerated gh-aw lock workflow with updated versions and MCP gateway payload dir support. |
| .github/workflows/smoke-claude.lock.yml | Regenerated gh-aw lock workflow with updated versions and MCP gateway payload dir support. |
| .github/workflows/smoke-chroot.lock.yml | Regenerated gh-aw lock workflow with updated versions and MCP gateway payload dir support. |
| .github/workflows/security-review.lock.yml | Regenerated gh-aw lock workflow with updated versions and MCP gateway payload dir support. |
| .github/workflows/security-guard.lock.yml | Regenerated gh-aw lock workflow with updated versions and MCP gateway payload dir support. |
| .github/workflows/pelis-agent-factory-advisor.lock.yml | Regenerated gh-aw lock workflow with updated versions and MCP gateway payload dir support. |
| .github/workflows/issue-monster.lock.yml | Regenerated gh-aw lock workflow with updated versions and MCP gateway payload dir support. |
| .github/workflows/issue-duplication-detector.lock.yml | Regenerated gh-aw lock workflow with updated versions and MCP gateway payload dir support. |
| .github/workflows/doc-maintainer.lock.yml | Regenerated gh-aw lock workflow with updated versions and MCP gateway payload dir support. |
| .github/workflows/dependency-security-monitor.lock.yml | Regenerated gh-aw lock workflow with updated versions and MCP gateway payload dir support. |
| .github/workflows/cli-flag-consistency-checker.lock.yml | Regenerated gh-aw lock workflow with updated versions and MCP gateway payload dir support. |
| .github/workflows/ci-doctor.lock.yml | Regenerated gh-aw lock workflow with updated versions and MCP gateway payload dir support. |
| .github/workflows/ci-cd-gaps-assessment.lock.yml | Regenerated gh-aw lock workflow with updated versions and MCP gateway payload dir support. |
| .github/workflows/build-test-rust.lock.yml | Regenerated gh-aw lock workflow with updated versions and MCP gateway payload dir support. |
| .github/workflows/build-test-node.lock.yml | Regenerated gh-aw lock workflow with updated versions and MCP gateway payload dir support. |
| .github/workflows/build-test-go.lock.yml | Regenerated gh-aw lock workflow with updated versions and MCP gateway payload dir support. |
| .github/workflows/build-test-cpp.lock.yml | Regenerated gh-aw lock workflow with updated versions and MCP gateway payload dir support. |
| .github/workflows/build-test-bun.lock.yml | Regenerated gh-aw lock workflow with updated versions and MCP gateway payload dir support. |
| .github/workflows/agentics-maintenance.yml | Updates the generated maintenance workflow version metadata and schedule frequency. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| run: | | ||
| echo "gh $INPUT_ARGS" | ||
| echo " token: ${GH_AW_GH_TOKEN:0:6}..." | ||
| GH_TOKEN="$GH_AW_GH_TOKEN" gh $INPUT_ARGS |
There was a problem hiding this comment.
The safe-input implementation is vulnerable to shell injection because $INPUT_ARGS is expanded unquoted in the gh invocation. An agent could pass characters like ;, &&, or command substitutions to execute arbitrary commands outside the intended gh CLI call. Consider changing the input to a JSON array (or otherwise safely parsing into an argv array) and invoking gh with an argument array (gh "${ARGS[@]}") so the input cannot be interpreted by the shell.
Mossaka
force-pushed
the
copilot/port-smoke-codex
branch
from
d1b8565 to
03e744b
Compare
|
📰 DEVELOPING STORY: Smoke Copilot reports failed. Our correspondents are investigating the incident... |
|
💫 TO BE CONTINUED... Smoke Claude failed! Our hero faces unexpected challenges... |
The lock files were manually edited by Copilot instead of being generated through the proper gh-aw compile + postprocess pipeline. This caused all agent jobs to fail with TS18003 because sparse-checkout only fetched .github/.agents folders, missing src/ and package.json. Recompiled with gh-aw v0.42.11 and ran postprocess-smoke-workflows.ts. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Mossaka
force-pushed
the
copilot/port-smoke-codex
branch
from
03e744b to
b5bc8f1
Compare
|
🎬 THE END — Smoke Claude MISSION: ACCOMPLISHED! The hero saves the day! ✨ |
|
📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤 |
C++ Build Test Results
Overall: PASS ✅ All C++ projects built successfully.
|
|
Smoke Test Results 🧪 Last 2 merged PRs:
✅ GitHub MCP: Retrieved last 2 merged PRs Overall: PASS ✨ cc @Mossaka
|
Build Test: Rust - FAILED ❌Error: Rust toolchain not available in the environment.
Overall: FAIL Error Details:
Resolution: Add Rust installation to the workflow: - name: Install Rust
run: |
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
echo "$HOME/.cargo/bin" >> $GITHUB_PATH
|
Node.js Build Test Results
Overall: PASS ✅ All Node.js projects built and tested successfully.
|
✅ Deno Build Test Results
Overall: ✅ PASS All Deno tests completed successfully.
|
❌ Java Build Test FailedStatus: FAILED - Maven Unavailable ErrorMaven installation on the GitHub Actions runner is corrupted: Test Results
Overall: FAIL Resolution Required
|
Go Build Test Results
Overall: PASS ✅ All Go projects successfully downloaded dependencies and passed tests.
|
Build Test: Bun - FAILED ❌Test Results
Overall: FAIL Error DetailsBoth projects encountered critical Bun errors: Install Error: Environment
AnalysisBun is experiencing internal errors that prevent both dependency installation and test execution. This appears to be an environment compatibility issue with the current GitHub Actions runner or Bun version 1.3.8.
|
Smoke Test Results - Claude EngineLast 2 Merged PRs:
Test Results:
Overall: PASS
|
Ports the
smoke-codex.mdworkflow from gh-aw to validate Codex engine functionality with AWF firewall capabilities.Changes
New Workflows
smokeShared Dependencies
Created 4 shared workflow files required by smoke-codex:
shared/gh.md- Authenticated GitHub CLI safe-input toolshared/mcp/tavily.md- Tavily MCP server configshared/reporting.md- Report formatting guidelinesshared/github-queries-safe-input.md- GitHub queries (issues/PRs/discussions) with jq filteringAdaptations for gh-aw-firewall
GOCACHE=/tmp/go-cache make buildtonpm ci && npm run buildMaintenance
postprocess-smoke-workflows.tsto includesmoke-codex.lock.yml- ensures CI tests local builds instead of published binaries💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.