chore: sync actions from gh-aw@v0.81.3 (#171)

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Author: github-actions[bot]

setup/js/assign_agent_helpers.cjs

@@ -72,34 +72,86 @@ function getAgentName(assignee) {
 
 /**
  * Return list of coding agent bot login names that are currently available as assignable actors
- * in this repository, as determined by checkUserCanBeAssigned.
+ * in this repository, preferring issue-scoped checks when issue/PR context is available
+ * and falling back to repository-scoped checks.
  * @param {string} owner
  * @param {string} repo
+ * @param {number|string|null} [issueNumber]
  * @param {Object} [githubClient] - Authenticated GitHub client (defaults to global github)
  * @returns {Promise<string[]>}
  */
-async function getAvailableAgentLogins(owner, repo, githubClient = github) {
+async function getAvailableAgentLogins(owner, repo, issueNumber = null, githubClient = github) {
   // Deduplicate defensively so future alias additions across agents do not duplicate REST lookups.
   const knownValues = [...new Set(Object.values(AGENT_LOGIN_NAMES).flat())];
   const available = [];
   for (const login of knownValues) {
     try {
-      await githubClient.rest.issues.checkUserCanBeAssigned({
-        owner,
-        repo,
-        assignee: login,
-      });
+      await validateAssigneeAlias(owner, repo, login, issueNumber, githubClient);
       available.push(login);
     } catch (e) {
       const status = e && typeof e === "object" && "status" in e ? e.status : undefined;
       if (status !== 404) {
-        core.debug(`Failed to check assignability for ${login}: ${getErrorMessage(e)}`);
+        core.info(`Failed to check assignability for ${login}: ${getErrorMessage(e)}`);
       }
     }
   }
   return available.sort();
 }
 
+/**
+ * Validate whether an assignee alias can be assigned in the repository context.
+ * Prefer issue-level assignability checks when issue/PR number is available because
+ * some agent bots are not surfaced by repository-scoped checks.
+ * @param {string} owner
+ * @param {string} repo
+ * @param {string} assignee
+ * @param {number|string|null} issueNumber
+ * @param {Object} githubClient
+ */
+async function validateAssigneeAlias(owner, repo, assignee, issueNumber, githubClient) {
+  const parsedIssueNumber = Number(issueNumber);
+  const hasValidIssueNumber = Number.isInteger(parsedIssueNumber) && parsedIssueNumber > 0;
+  const hasIssueScopedRequest = typeof githubClient?.request === "function";
+
+  if (issueNumber && hasValidIssueNumber && hasIssueScopedRequest) {
+    core.info(`Checking assignee alias ${assignee} via issue-scoped endpoint for ${owner}/${repo}#${parsedIssueNumber}`);
+    try {
+      const issueScopedResponse = await githubClient.request("GET /repos/{owner}/{repo}/issues/{issue_number}/assignees/{assignee}", {
+        owner,
+        repo,
+        issue_number: parsedIssueNumber,
+        assignee,
+      });
+      const issueScopedStatus = issueScopedResponse && typeof issueScopedResponse === "object" && "status" in issueScopedResponse ? Number(issueScopedResponse.status) : undefined;
+      if (issueScopedStatus !== undefined && Number.isInteger(issueScopedStatus) && issueScopedStatus >= 200 && issueScopedStatus < 300) {
+        core.info(`Assignee alias ${assignee} is assignable via issue-scoped check`);
+        return;
+      }
+      core.info(`Issue-scoped assignee check returned unexpected response for ${assignee} (status ${issueScopedStatus ?? "unknown"}); falling back to repository-scoped check`);
+    } catch (e) {
+      const status = e && typeof e === "object" && "status" in e ? e.status : undefined;
+      // Some coding-agent bot aliases can return 404 on issue-scoped checks even when
+      // assignment may still succeed; use repository-scoped endpoint as fallback.
+      if (status !== 404 && status !== 422) {
+        core.info(`Issue-scoped assignee check failed for ${assignee} with status ${status ?? "unknown"}: ${getErrorMessage(e)}`);
+        throw e;
+      }
+      core.info(`Issue-scoped assignee check returned ${status} for ${assignee}; falling back to repository-scoped check`);
+    }
+  } else if (issueNumber && !hasValidIssueNumber) {
+    core.info(`Skipping issue-scoped assignee check for ${assignee}: invalid issue number ${String(issueNumber)}`);
+  } else if (issueNumber && !hasIssueScopedRequest) {
+    core.info(`Skipping issue-scoped assignee check for ${assignee}: github client does not support request()`);
+  }
+  core.info(`Checking assignee alias ${assignee} via repository-scoped endpoint for ${owner}/${repo}`);
+  await githubClient.rest.issues.checkUserCanBeAssigned({
+    owner,
+    repo,
+    assignee,
+  });
+  core.info(`Assignee alias ${assignee} is assignable via repository-scoped check`);
+}
+
 /**
  * Return assignable bot logins from the repository assignee list.
  * @param {string} owner
@@ -145,10 +197,11 @@ async function getAssignableBots(owner, repo, githubClient = github) {
  * @param {string} owner - Repository owner
  * @param {string} repo - Repository name
  * @param {string} agentName - Agent name (copilot)
+ * @param {number|string|null} [issueNumber] - Optional issue/PR number for issue-scoped assignability check
  * @param {Object} [githubClient] - Authenticated GitHub client (defaults to global github)
  * @returns {Promise<string|null>} Agent ID or null if not found
  */
-async function findAgent(owner, repo, agentName, githubClient = github) {
+async function findAgent(owner, repo, agentName, issueNumber = null, githubClient = github) {
   const loginNames = getAgentLogins(agentName);
   if (loginNames.length === 0) {
     core.error(`Unknown agent: ${agentName}. Supported agents: ${Object.keys(AGENT_LOGIN_NAMES).join(", ")}`);
@@ -161,11 +214,7 @@ async function findAgent(owner, repo, agentName, githubClient = github) {
   for (const loginName of loginNames) {
     try {
       core.info(`Checking assignee alias: ${loginName}`);
-      await githubClient.rest.issues.checkUserCanBeAssigned({
-        owner,
-        repo,
-        assignee: loginName,
-      });
+      await validateAssigneeAlias(owner, repo, loginName, issueNumber, githubClient);
     } catch (checkError) {
       const errorMessage = getErrorMessage(checkError);
       const status = checkError?.status;
@@ -536,7 +585,7 @@ async function assignAgentToIssueByName(owner, repo, issueNumber, agentName) {
   try {
     // Find agent using the github object authenticated via step-level github-token
     core.info(`Looking for ${agentName} coding agent...`);
-    const agentId = await findAgent(owner, repo, agentName);
+    const agentId = await findAgent(owner, repo, agentName, issueNumber);
     if (!agentId) {
       return { success: false, error: `${agentName} coding agent is not available for this repository` };
     }

setup/js/assign_copilot_to_created_issues.cjs

@@ -73,7 +73,7 @@ async function main() {
       // Find agent (reuse cached ID for same repo)
       if (!agentId) {
         core.info(`Looking for ${agentName} coding agent...`);
-        agentId = await findAgent(owner, repo, agentName);
+        agentId = await findAgent(owner, repo, agentName, issueNumber);
         if (!agentId) {
           throw new Error(`${ERR_PERMISSION}: ${agentName} coding agent is not available for this repository`);
         }

setup/js/assign_to_agent.cjs

@@ -330,7 +330,7 @@ async function main(config = {}) {
       let agentId = agentCache[agentName];
       if (!agentId) {
         core.info(`Looking for ${agentName} coding agent...`);
-        agentId = await findAgent(effectiveOwner, effectiveRepo, agentName, githubClient);
+        agentId = await findAgent(effectiveOwner, effectiveRepo, agentName, issueNumber || pullNumber, githubClient);
         if (!agentId) {
           throw new Error(`${agentName} coding agent is not available for this repository`);
         }
@@ -405,7 +405,7 @@ async function main(config = {}) {
 
       if (isAvailabilityError) {
         try {
-          const available = await getAvailableAgentLogins(effectiveOwner, effectiveRepo, githubClient);
+          const available = await getAvailableAgentLogins(effectiveOwner, effectiveRepo, issueNumber || pullNumber, githubClient);
           if (available.length > 0) errorMessage += ` (available agents: ${available.join(", ")})`;
         } catch (e) {
           core.debug("Failed to enrich unavailable agent message with available list");

setup/js/create_issue.cjs

@@ -1073,7 +1073,7 @@ async function main(config = {}) {
         }
         core.info(`Assigning copilot coding agent to issue #${issue.number} in ${qualifiedItemRepo}...`);
         try {
-          const agentId = await findAgent(repoParts.owner, repoParts.repo, "copilot", copilotClient);
+          const agentId = await findAgent(repoParts.owner, repoParts.repo, "copilot", issue.number, copilotClient);
           if (!agentId) {
             core.warning(`copilot coding agent is not available for ${qualifiedItemRepo}`);
           } else {

setup/js/create_pr_review_comment.cjs

@@ -10,7 +10,7 @@ const { resolveTargetRepoConfig, resolveAndValidateRepo } = require("./repo_help
 const { sanitizeContent } = require("./sanitize_content.cjs");
 const { createAuthenticatedGitHubClient } = require("./handler_auth.cjs");
 const { buildWorkflowRunUrl } = require("./workflow_metadata_helpers.cjs");
-const { isStagedMode, logStagedPreviewInfo, checkRequiredFilter } = require("./safe_output_helpers.cjs");
+const { isTemplatableTrue, isStagedMode, logStagedPreviewInfo, checkRequiredFilter } = require("./safe_output_helpers.cjs");
 const { resolveAllowedMentionsFromPayload } = require("./resolve_mentions_from_payload.cjs");
 
 /** @type {string} Safe output type handled by this module */
@@ -59,7 +59,7 @@ async function main(config = {}) {
   }
 
   // Propagate per-handler staged flag to the shared PR review buffer
-  if (config.staged === true) {
+  if (isTemplatableTrue(config.staged)) {
     buffer.setStaged(true);
   }
   if (isStagedMode(config)) {

setup/js/create_pull_request.cjs

@@ -676,7 +676,7 @@ async function main(config = {}) {
     }
     core.info(`Assigning copilot coding agent to fallback issue #${issueNumber} in ${owner}/${repo}...`);
     try {
-      const agentId = await findAgent(owner, repo, "copilot", copilotClient);
+      const agentId = await findAgent(owner, repo, "copilot", issueNumber, copilotClient);
       if (!agentId) {
         core.warning(`copilot coding agent is not available for ${owner}/${repo}`);
         return;

setup/js/dispatch_repository.cjs

@@ -137,7 +137,7 @@ async function main(config = {}) {
     core.info(`dispatch_repository: dispatching event_type="${eventType}" to ${targetRepoSlug} (workflow: ${toolConfig.workflow || "unspecified"})`);
 
     // If in staged mode, preview without executing
-    if (isStaged || toolConfig.staged) {
+    if (isStaged || isStagedMode(toolConfig)) {
       logStagedPreviewInfo(`Would dispatch repository_dispatch event: event_type="${eventType}" to ${targetRepoSlug}, client_payload=${JSON.stringify(clientPayload)}`);
       dispatchCounts[toolName] = currentCount + 1;
       return {

setup/js/issue_intents.cjs

@@ -1,5 +1,6 @@
 // @ts-check
 /// <reference types="@actions/github-script" />
+// @safe-outputs-exempt SEC-005: this file only normalizes issue-intent labels/metadata; "target repository" appears only in a label-not-found error message, with no target-repo parameter or cross-repo write path.
 
 const { sanitizeContent } = require("./sanitize_content.cjs");
 const { sanitizeLabelContent } = require("./sanitize_label_content.cjs");

setup/js/messages_footer.cjs

@@ -136,6 +136,7 @@ function getAICFromEnv() {
  * @property {string} [workflowSource] - Source of the workflow (owner/repo/path@ref)
  * @property {string} [workflowSourceUrl] - GitHub URL for the workflow source
  * @property {number|string} [triggeringNumber] - Issue, PR, or discussion number that triggered this workflow
+ * @property {"issue"|"PR"|"discussion"} [triggeringType] - Triggering item type used in the default footer
  * @property {string} [historyUrl] - GitHub search URL for items created by this workflow (for the history link)
  * @property {string} [historyLink] - Pre-formatted markdown history link (e.g. " · [◷](url)"), or "" if unavailable
  * @property {number|string} [aiCredits] - Total AI Credits cost for the run (1 AIC == 0.01 USD)
@@ -211,7 +212,8 @@ function getFooterMessage(ctx) {
   const workflowLabel = ctx.emoji ? `${ctx.emoji} {workflow_name}` : "{workflow_name}";
   let defaultFooter = `> Generated by [${workflowLabel}]({run_url})`;
   if (ctx.triggeringNumber) {
-    defaultFooter += " for issue #{triggering_number}";
+    const prefix = ctx.triggeringType === "discussion" ? "discussion " : "";
+    defaultFooter += ` for ${prefix}#{triggering_number}`;
   }
   const metricSuffixes = [];
   if (aiCredits) {
@@ -560,12 +562,17 @@ function generateXMLMarker(workflowName, runUrl) {
 function generateFooterWithMessages(workflowName, runUrl, workflowSource, workflowSourceURL, triggeringIssueNumber, triggeringPRNumber, triggeringDiscussionNumber, historyUrl, options) {
   // Determine triggering number (issue takes precedence, then PR, then discussion)
   let triggeringNumber;
+  /** @type {"issue"|"PR"|"discussion"|undefined} */
+  let triggeringType;
   if (triggeringIssueNumber) {
     triggeringNumber = triggeringIssueNumber;
+    triggeringType = "issue";
   } else if (triggeringPRNumber) {
     triggeringNumber = triggeringPRNumber;
+    triggeringType = "PR";
   } else if (triggeringDiscussionNumber) {
-    triggeringNumber = `discussion #${triggeringDiscussionNumber}`;
+    triggeringNumber = triggeringDiscussionNumber;
+    triggeringType = "discussion";
   }
 
   // Read workflow emoji from environment variable if available.
@@ -598,6 +605,7 @@ function generateFooterWithMessages(workflowName, runUrl, workflowSource, workfl
     workflowSource,
     workflowSourceUrl: workflowSourceURL,
     triggeringNumber,
+    triggeringType,
     historyUrl: historyUrl || undefined,
     emoji,
     slashCommand,

setup/js/mount_mcp_as_cli.cjs

@@ -32,6 +32,7 @@ const MANIFEST_FILE = path.join(process.env.RUNNER_TEMP || "/home/runner/work/_t
 const RUNNER_TEMP = process.env.RUNNER_TEMP || "/home/runner/work/_temp";
 const CLI_BIN_DIR = `${RUNNER_TEMP}/gh-aw/mcp-cli/bin`;
 const TOOLS_DIR = `${RUNNER_TEMP}/gh-aw/mcp-cli/tools`;
+const AWF_GATEWAY_IP = "172.30.0.1";
 
 /** MCP servers that are handled differently and should not be user-facing CLIs.
  *  Note: safeoutputs and mcpscripts are NOT excluded — they are always CLI-mounted
@@ -76,8 +77,13 @@ function shellEscapeDoubleQuoted(str) {
  * @returns {string} URL suitable for use inside AWF containers
  */
 function toContainerUrl(rawUrl) {
-  const domain = process.env.MCP_GATEWAY_DOMAIN;
+  let domain = process.env.MCP_GATEWAY_DOMAIN;
   const port = process.env.MCP_GATEWAY_PORT;
+  if (domain === "host.docker.internal") {
+    // The CLI wrappers may run inside a chrooted host environment where
+    // host.docker.internal is not resolvable. Use the AWF gateway IP instead.
+    domain = AWF_GATEWAY_IP;
+  }
   if (domain && port) {
     return rawUrl.replace(/^https?:\/\/[^/]+\/mcp\//, `http://${domain}:${port}/mcp/`);
   }
@@ -447,4 +453,4 @@ async function main() {
   core.setOutput("mounted-servers", mountedServers.join(","));
 }
 
-module.exports = { main, fetchMCPTools, generateCLIWrapperScript, isValidServerName, shellEscapeDoubleQuoted, parseMCPResponseBody };
+module.exports = { AWF_GATEWAY_IP, main, fetchMCPTools, generateCLIWrapperScript, isValidServerName, shellEscapeDoubleQuoted, parseMCPResponseBody, toContainerUrl };