example-engine-network-permissions.lock.yml

# This file was automatically generated by gh-aw. DO NOT EDIT.
# To update this file, edit the corresponding .md file and run:
#   gh aw compile

name: "Secure Web Research Task"
on:
  pull_request:
    branches:
    - main
  workflow_dispatch: null

permissions: {}

concurrency:
  group: "gh-aw-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}"
  cancel-in-progress: true

run-name: "Secure Web Research Task"

jobs:
  secure-web-research-task:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    outputs:
      output: ${{ steps.collect_output.outputs.output }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@v5
      - name: Generate Network Permissions Hook
        run: |
          mkdir -p .claude/hooks
          cat > .claude/hooks/network_permissions.py << 'EOF'
          #!/usr/bin/env python3
          """
          Network permissions validator for Claude Code engine.
          Generated by gh-aw from engine network permissions configuration.
          """
          
          import json
          import sys
          import urllib.parse
          import re
          
          # Domain whitelist (populated during generation)
          ALLOWED_DOMAINS = ["docs.github.com"]
          
          def extract_domain(url_or_query):
              """Extract domain from URL or search query."""
              if not url_or_query:
                  return None
              
              if url_or_query.startswith(('http://', 'https://')):
                  return urllib.parse.urlparse(url_or_query).netloc.lower()
              
              # Check for domain patterns in search queries
              match = re.search(r'site:([a-zA-Z0-9.-]+\.[a-zA-Z]{2,})', url_or_query)
              if match:
                  return match.group(1).lower()
              
              return None
          
          def is_domain_allowed(domain):
              """Check if domain is allowed."""
              if not domain:
                  # If no domain detected, allow only if not under deny-all policy
                  return bool(ALLOWED_DOMAINS)  # False if empty list (deny-all), True if has domains
              
              # Empty allowed domains means deny all
              if not ALLOWED_DOMAINS:
                  return False
              
              for pattern in ALLOWED_DOMAINS:
                  regex = pattern.replace('.', r'\.').replace('*', '.*')
                  if re.match(f'^{regex}$', domain):
                      return True
              return False
          
          # Main logic
          try:
              data = json.load(sys.stdin)
              tool_name = data.get('tool_name', '')
              tool_input = data.get('tool_input', {})
              
              if tool_name not in ['WebFetch', 'WebSearch']:
                  sys.exit(0)  # Allow other tools
              
              target = tool_input.get('url') or tool_input.get('query', '')
              domain = extract_domain(target)
              
              # For WebSearch, apply domain restrictions consistently
              # If no domain detected in search query, check if restrictions are in place
              if tool_name == 'WebSearch' and not domain:
                  # Since this hook is only generated when network permissions are configured,
                  # empty ALLOWED_DOMAINS means deny-all policy
                  if not ALLOWED_DOMAINS:  # Empty list means deny all
                      print(f"Network access blocked: deny-all policy in effect", file=sys.stderr)
                      print(f"No domains are allowed for WebSearch", file=sys.stderr)
                      sys.exit(2)  # Block under deny-all policy
                  else:
                      print(f"Network access blocked for WebSearch: no specific domain detected", file=sys.stderr)
                      print(f"Allowed domains: {', '.join(ALLOWED_DOMAINS)}", file=sys.stderr)
                      sys.exit(2)  # Block general searches when domain allowlist is configured
              
              if not is_domain_allowed(domain):
                  print(f"Network access blocked for domain: {domain}", file=sys.stderr)
                  print(f"Allowed domains: {', '.join(ALLOWED_DOMAINS)}", file=sys.stderr)
                  sys.exit(2)  # Block with feedback to Claude
              
              sys.exit(0)  # Allow
              
          except Exception as e:
              print(f"Network validation error: {e}", file=sys.stderr)
              sys.exit(2)  # Block on errors
          
          EOF
          chmod +x .claude/hooks/network_permissions.py
      - name: Generate Claude Settings
        run: |
          cat > .claude/settings.json << 'EOF'
          {
            "hooks": {
              "PreToolUse": [
                {
                  "matcher": "WebFetch|WebSearch",
                  "hooks": [
                    {
                      "type": "command",
                      "command": ".claude/hooks/network_permissions.py"
                    }
                  ]
                }
              ]
            }
          }
          EOF
      - name: Setup agent output
        id: setup_agent_output
        uses: actions/github-script@v7
        with:
          script: |
            function main() {
              const fs = require('fs');
              const crypto = require('crypto');
              // Generate a random filename for the output file
              const randomId = crypto.randomBytes(8).toString('hex');
              const outputFile = `/tmp/aw_output_${randomId}.txt`;
              // Ensure the /tmp directory exists and create empty output file
              fs.mkdirSync('/tmp', { recursive: true });
              fs.writeFileSync(outputFile, '', { mode: 0o644 });
              // Verify the file was created and is writable
              if (!fs.existsSync(outputFile)) {
                throw new Error(`Failed to create output file: ${outputFile}`);
              }
              // Set the environment variable for subsequent steps
              core.exportVariable('GITHUB_AW_OUTPUT', outputFile);
              console.log('Created agentic output file:', outputFile);
              // Also set as step output for reference
              core.setOutput('output_file', outputFile);
            }
            main();
      - name: Setup MCPs
        run: |
          mkdir -p /tmp/mcp-config
          cat > /tmp/mcp-config/mcp-servers.json << 'EOF'
          {
            "mcpServers": {
              "github": {
                "command": "docker",
                "args": [
                  "run",
                  "-i",
                  "--rm",
                  "-e",
                  "GITHUB_PERSONAL_ACCESS_TOKEN",
                  "ghcr.io/github/github-mcp-server:sha-45e90ae"
                ],
                "env": {
                  "GITHUB_PERSONAL_ACCESS_TOKEN": "${{ secrets.GITHUB_TOKEN }}"
                }
              }
            }
          }
          EOF
      - name: Create prompt
        env:
          GITHUB_AW_OUTPUT: ${{ env.GITHUB_AW_OUTPUT }}
        run: |
          mkdir -p /tmp/aw-prompts
          cat > /tmp/aw-prompts/prompt.txt << 'EOF'
          # Secure Web Research Task
          
          Please research the GitHub API documentation or Stack Overflow and find information about repository topics. Summarize them in a brief report.
          
          
          ---
          
          **IMPORTANT**: If you need to provide output that should be captured as a workflow output variable, write it to the file "${{ env.GITHUB_AW_OUTPUT }}". This file is available for you to write any output that should be exposed from this workflow. The content of this file will be made available as the 'output' workflow output.
          EOF
      - name: Print prompt to step summary
        run: |
          echo "## Generated Prompt" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo '``````markdown' >> $GITHUB_STEP_SUMMARY
          cat /tmp/aw-prompts/prompt.txt >> $GITHUB_STEP_SUMMARY
          echo '``````' >> $GITHUB_STEP_SUMMARY
      - name: Generate agentic run info
        uses: actions/github-script@v7
        with:
          script: |
            const fs = require('fs');
            
            const awInfo = {
              engine_id: "claude",
              engine_name: "Claude Code",
              model: "",
              version: "",
              workflow_name: "Secure Web Research Task",
              experimental: false,
              supports_tools_whitelist: true,
              supports_http_transport: true,
              run_id: context.runId,
              run_number: context.runNumber,
              run_attempt: process.env.GITHUB_RUN_ATTEMPT,
              repository: context.repo.owner + '/' + context.repo.repo,
              ref: context.ref,
              sha: context.sha,
              actor: context.actor,
              event_name: context.eventName,
              created_at: new Date().toISOString()
            };
            
            // Write to /tmp directory to avoid inclusion in PR
            const tmpPath = '/tmp/aw_info.json';
            fs.writeFileSync(tmpPath, JSON.stringify(awInfo, null, 2));
            console.log('Generated aw_info.json at:', tmpPath);
            console.log(JSON.stringify(awInfo, null, 2));
      - name: Upload agentic run info
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: aw_info.json
          path: /tmp/aw_info.json
          if-no-files-found: warn
      - name: Execute Claude Code Action
        id: agentic_execution
        uses: anthropics/claude-code-base-action@v0.0.56
        with:
          # Allowed tools (sorted):
          # - Glob
          # - Grep
          # - LS
          # - NotebookRead
          # - Read
          # - Task
          # - WebFetch
          # - WebSearch
          # - mcp__github__download_workflow_run_artifact
          # - mcp__github__get_code_scanning_alert
          # - mcp__github__get_commit
          # - mcp__github__get_dependabot_alert
          # - mcp__github__get_discussion
          # - mcp__github__get_discussion_comments
          # - mcp__github__get_file_contents
          # - mcp__github__get_issue
          # - mcp__github__get_issue_comments
          # - mcp__github__get_job_logs
          # - mcp__github__get_me
          # - mcp__github__get_notification_details
          # - mcp__github__get_pull_request
          # - mcp__github__get_pull_request_comments
          # - mcp__github__get_pull_request_diff
          # - mcp__github__get_pull_request_files
          # - mcp__github__get_pull_request_reviews
          # - mcp__github__get_pull_request_status
          # - mcp__github__get_secret_scanning_alert
          # - mcp__github__get_tag
          # - mcp__github__get_workflow_run
          # - mcp__github__get_workflow_run_logs
          # - mcp__github__get_workflow_run_usage
          # - mcp__github__list_branches
          # - mcp__github__list_code_scanning_alerts
          # - mcp__github__list_commits
          # - mcp__github__list_dependabot_alerts
          # - mcp__github__list_discussion_categories
          # - mcp__github__list_discussions
          # - mcp__github__list_issues
          # - mcp__github__list_notifications
          # - mcp__github__list_pull_requests
          # - mcp__github__list_secret_scanning_alerts
          # - mcp__github__list_tags
          # - mcp__github__list_workflow_jobs
          # - mcp__github__list_workflow_run_artifacts
          # - mcp__github__list_workflow_runs
          # - mcp__github__list_workflows
          # - mcp__github__search_code
          # - mcp__github__search_issues
          # - mcp__github__search_orgs
          # - mcp__github__search_pull_requests
          # - mcp__github__search_repositories
          # - mcp__github__search_users
          allowed_tools: "Glob,Grep,LS,NotebookRead,Read,Task,WebFetch,WebSearch,mcp__github__download_workflow_run_artifact,mcp__github__get_code_scanning_alert,mcp__github__get_commit,mcp__github__get_dependabot_alert,mcp__github__get_discussion,mcp__github__get_discussion_comments,mcp__github__get_file_contents,mcp__github__get_issue,mcp__github__get_issue_comments,mcp__github__get_job_logs,mcp__github__get_me,mcp__github__get_notification_details,mcp__github__get_pull_request,mcp__github__get_pull_request_comments,mcp__github__get_pull_request_diff,mcp__github__get_pull_request_files,mcp__github__get_pull_request_reviews,mcp__github__get_pull_request_status,mcp__github__get_secret_scanning_alert,mcp__github__get_tag,mcp__github__get_workflow_run,mcp__github__get_workflow_run_logs,mcp__github__get_workflow_run_usage,mcp__github__list_branches,mcp__github__list_code_scanning_alerts,mcp__github__list_commits,mcp__github__list_dependabot_alerts,mcp__github__list_discussion_categories,mcp__github__list_discussions,mcp__github__list_issues,mcp__github__list_notifications,mcp__github__list_pull_requests,mcp__github__list_secret_scanning_alerts,mcp__github__list_tags,mcp__github__list_workflow_jobs,mcp__github__list_workflow_run_artifacts,mcp__github__list_workflow_runs,mcp__github__list_workflows,mcp__github__search_code,mcp__github__search_issues,mcp__github__search_orgs,mcp__github__search_pull_requests,mcp__github__search_repositories,mcp__github__search_users"
          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
          claude_env: |
            GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
            GITHUB_AW_OUTPUT: ${{ env.GITHUB_AW_OUTPUT }}
          mcp_config: /tmp/mcp-config/mcp-servers.json
          prompt_file: /tmp/aw-prompts/prompt.txt
          settings: .claude/settings.json
          timeout_minutes: 5
        env:
          GITHUB_AW_OUTPUT: ${{ env.GITHUB_AW_OUTPUT }}
      - name: Capture Agentic Action logs
        if: always()
        run: |
          # Copy the detailed execution file from Agentic Action if available
          if [ -n "${{ steps.agentic_execution.outputs.execution_file }}" ] && [ -f "${{ steps.agentic_execution.outputs.execution_file }}" ]; then
            cp ${{ steps.agentic_execution.outputs.execution_file }} /tmp/secure-web-research-task.log
          else
            echo "No execution file output found from Agentic Action" >> /tmp/secure-web-research-task.log
          fi
          
          # Ensure log file exists
          touch /tmp/secure-web-research-task.log
      - name: Check if workflow-complete.txt exists, if so upload it
        id: check_file
        run: |
          if [ -f workflow-complete.txt ]; then
            echo "File exists"
            echo "upload=true" >> $GITHUB_OUTPUT
          else
            echo "File does not exist"
            echo "upload=false" >> $GITHUB_OUTPUT
          fi
      - name: Upload workflow-complete.txt
        if: steps.check_file.outputs.upload == 'true'
        uses: actions/upload-artifact@v4
        with:
          name: workflow-complete
          path: workflow-complete.txt
      - name: Collect agent output
        id: collect_output
        uses: actions/github-script@v7
        with:
          script: |
            /**
             * Sanitizes content for safe output in GitHub Actions
             * @param {string} content - The content to sanitize
             * @returns {string} The sanitized content
             */
            function sanitizeContent(content) {
              if (!content || typeof content !== 'string') {
                return '';
              }
              // Read allowed domains from environment variable
              const allowedDomainsEnv = process.env.GITHUB_AW_ALLOWED_DOMAINS;
              const defaultAllowedDomains = [
                'github.com',
                'github.io',
                'githubusercontent.com',
                'githubassets.com',
                'github.dev',
                'codespaces.new'
              ];
              const allowedDomains = allowedDomainsEnv
                ? allowedDomainsEnv.split(',').map(d => d.trim()).filter(d => d)
                : defaultAllowedDomains;
              let sanitized = content;
              // Neutralize @mentions to prevent unintended notifications
              sanitized = neutralizeMentions(sanitized);
              // Remove control characters (except newlines and tabs)
              sanitized = sanitized.replace(/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/g, '');
              // XML character escaping
              sanitized = sanitized
                .replace(/&/g, '&amp;')   // Must be first to avoid double-escaping
                .replace(/</g, '&lt;')
                .replace(/>/g, '&gt;')
                .replace(/"/g, '&quot;')
                .replace(/'/g, '&apos;');
              // URI filtering - replace non-https protocols with "(redacted)"
              // Step 1: Temporarily mark HTTPS URLs to protect them
              sanitized = sanitizeUrlProtocols(sanitized);
              // Domain filtering for HTTPS URIs
              // Match https:// URIs and check if domain is in allowlist
              sanitized = sanitizeUrlDomains(sanitized);
              // Limit total length to prevent DoS (0.5MB max)
              const maxLength = 524288;
              if (sanitized.length > maxLength) {
                sanitized = sanitized.substring(0, maxLength) + '\n[Content truncated due to length]';
              }
              // Limit number of lines to prevent log flooding (65k max)
              const lines = sanitized.split('\n');
              const maxLines = 65000;
              if (lines.length > maxLines) {
                sanitized = lines.slice(0, maxLines).join('\n') + '\n[Content truncated due to line count]';
              }
              // Remove ANSI escape sequences
              sanitized = sanitized.replace(/\x1b\[[0-9;]*[mGKH]/g, '');
              // Neutralize common bot trigger phrases
              sanitized = neutralizeBotTriggers(sanitized);
              // Trim excessive whitespace
              return sanitized.trim();
              /**
               * Remove unknown domains
               * @param {string} s - The string to process
               * @returns {string} The string with unknown domains redacted
               */
              function sanitizeUrlDomains(s) {
                s = s.replace(/\bhttps:\/\/([^\/\s\])}'"<>&\x00-\x1f]+)/gi, (match, domain) => {
                  // Extract the hostname part (before first slash, colon, or other delimiter)
                  const hostname = domain.split(/[\/:\?#]/)[0].toLowerCase();
                  // Check if this domain or any parent domain is in the allowlist
                  const isAllowed = allowedDomains.some(allowedDomain => {
                    const normalizedAllowed = allowedDomain.toLowerCase();
                    return hostname === normalizedAllowed || hostname.endsWith('.' + normalizedAllowed);
                  });
                  return isAllowed ? match : '(redacted)';
                });
                return s;
              }
              /**
               * Remove unknown protocols except https
               * @param {string} s - The string to process
               * @returns {string} The string with non-https protocols redacted
               */
              function sanitizeUrlProtocols(s) {
                // Match both protocol:// and protocol: patterns
                // This covers URLs like https://example.com, javascript:alert(), mailto:user@domain.com, etc.
                return s.replace(/\b(\w+):(?:\/\/)?[^\s\])}'"<>&\x00-\x1f]+/gi, (match, protocol) => {
                  // Allow https (case insensitive), redact everything else
                  return protocol.toLowerCase() === 'https' ? match : '(redacted)';
                });
              }
              /**
               * Neutralizes @mentions by wrapping them in backticks
               * @param {string} s - The string to process
               * @returns {string} The string with neutralized mentions
               */
              function neutralizeMentions(s) {
                // Replace @name or @org/team outside code with `@name`
                return s.replace(/(^|[^\w`])@([A-Za-z0-9](?:[A-Za-z0-9-]{0,37}[A-Za-z0-9])?(?:\/[A-Za-z0-9._-]+)?)/g,
                  (_m, p1, p2) => `${p1}\`@${p2}\``);
              }
              /**
               * Neutralizes bot trigger phrases by wrapping them in backticks
               * @param {string} s - The string to process
               * @returns {string} The string with neutralized bot triggers
               */
              function neutralizeBotTriggers(s) {
                // Neutralize common bot trigger phrases like "fixes #123", "closes #asdfs", etc.
                return s.replace(/\b(fixes?|closes?|resolves?|fix|close|resolve)\s+#(\w+)/gi,
                  (match, action, ref) => `\`${action} #${ref}\``);
              }
            }
            async function main() {
              const fs = require("fs");
              const outputFile = process.env.GITHUB_AW_OUTPUT;
              if (!outputFile) {
                console.log('GITHUB_AW_OUTPUT not set, no output to collect');
                core.setOutput('output', '');
                return;
              }
              if (!fs.existsSync(outputFile)) {
                console.log('Output file does not exist:', outputFile);
                core.setOutput('output', '');
                return;
              }
              const outputContent = fs.readFileSync(outputFile, 'utf8');
              if (outputContent.trim() === '') {
                console.log('Output file is empty');
                core.setOutput('output', '');
              } else {
                const sanitizedContent = sanitizeContent(outputContent);
                console.log('Collected agentic output (sanitized):', sanitizedContent.substring(0, 200) + (sanitizedContent.length > 200 ? '...' : ''));
                core.setOutput('output', sanitizedContent);
              }
            }
            await main();
      - name: Print agent output to step summary
        env:
          GITHUB_AW_OUTPUT: ${{ env.GITHUB_AW_OUTPUT }}
        run: |
          echo "## Agent Output" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo '``````markdown' >> $GITHUB_STEP_SUMMARY
          cat ${{ env.GITHUB_AW_OUTPUT }} >> $GITHUB_STEP_SUMMARY
          echo '``````' >> $GITHUB_STEP_SUMMARY
      - name: Upload agentic output file
        if: always() && steps.collect_output.outputs.output != ''
        uses: actions/upload-artifact@v4
        with:
          name: aw_output.txt
          path: ${{ env.GITHUB_AW_OUTPUT }}
          if-no-files-found: warn
      - name: Upload engine output files
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: agent_outputs
          path: |
            output.txt
          if-no-files-found: ignore
      - name: Upload agent logs
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: secure-web-research-task.log
          path: /tmp/secure-web-research-task.log
          if-no-files-found: warn
      - name: Generate git patch
        if: always()
        run: |
          # Check current git status
          echo "Current git status:"
          git status
          # Get the initial commit SHA from the base branch of the pull request
          if [ "$GITHUB_EVENT_NAME" = "pull_request" ] || [ "$GITHUB_EVENT_NAME" = "pull_request_review_comment" ]; then
            INITIAL_SHA="$GITHUB_BASE_REF"
          else
            INITIAL_SHA="$GITHUB_SHA"
          fi
          echo "Base commit SHA: $INITIAL_SHA"
          # Configure git user for GitHub Actions
          git config --global user.email "action@github.com"
          git config --global user.name "GitHub Action"
          # Stage any unstaged files
          git add -A || true
          # Check if there are staged files to commit
          if ! git diff --cached --quiet; then
            echo "Staged files found, committing them..."
            git commit -m "[agent] staged files" || true
            echo "Staged files committed"
          else
            echo "No staged files to commit"
          fi
          # Check updated git status
          echo "Updated git status after committing staged files:"
          git status
          # Show compact diff information between initial commit and HEAD (committed changes only)
          echo '## Git diff' >> $GITHUB_STEP_SUMMARY
          echo '' >> $GITHUB_STEP_SUMMARY
          echo '```' >> $GITHUB_STEP_SUMMARY
          git diff --name-only "$INITIAL_SHA"..HEAD >> $GITHUB_STEP_SUMMARY || true
          echo '```' >> $GITHUB_STEP_SUMMARY
          echo '' >> $GITHUB_STEP_SUMMARY
          # Check if there are any committed changes since the initial commit
          if git diff --quiet "$INITIAL_SHA" HEAD; then
            echo "No committed changes detected since initial commit"
            echo "Skipping patch generation - no committed changes to create patch from"
          else
            echo "Committed changes detected, generating patch..."
            # Generate patch from initial commit to HEAD (committed changes only)
            git format-patch "$INITIAL_SHA"..HEAD --stdout > /tmp/aw.patch || echo "Failed to generate patch" > /tmp/aw.patch
            echo "Patch file created at /tmp/aw.patch"
            ls -la /tmp/aw.patch
            # Show the first 50 lines of the patch for review
            echo '## Git Patch' >> $GITHUB_STEP_SUMMARY
            echo '' >> $GITHUB_STEP_SUMMARY
            echo '```diff' >> $GITHUB_STEP_SUMMARY
            head -50 /tmp/aw.patch >> $GITHUB_STEP_SUMMARY || echo "Could not display patch contents" >> $GITHUB_STEP_SUMMARY
            echo '...' >> $GITHUB_STEP_SUMMARY
            echo '```' >> $GITHUB_STEP_SUMMARY
            echo '' >> $GITHUB_STEP_SUMMARY
          fi
      - name: Upload git patch
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: aw.patch
          path: /tmp/aw.patch
          if-no-files-found: ignore