Skip to content

Commit a17168d

Browse files
Copilotgh-aw-bot
Copilot
and
gh-aw-bot
authored
feat: implement SPDD daily spec work plan 2026-05-11
- specs/aw-harness.md: fix five/six extension count discrepancy (§1.1), add implementation status table (aw_harness.cjs not yet built), add §7.3 edge case handling (session timeout, budget exceeded, extension registration failure) with cross-references to §11.2 safeguards - specs/awf-config-sources-spec.md: add §5 Safeguards (CI failure on drift, tracking issue creation, agent corrective PR), update §4.4 to reference new awf-config-drift.yml workflow, add §6 Spec Maintenance table tracking when canonical sources were last verified - specs/security-architecture-spec-validation.md: add v1.0.2 section validating PM-10a–PM-10d pre_activation pattern; add v1.0.3 section validating CTR-012 Safe-Outputs Wildcard Push Scope; update summary table and conclusion with re-validation date 2026-05-11 - specs/security-architecture-spec-summary.md: mark 'Rerun validation report' as Done (2026-05-11) - .github/workflows/awf-config-drift.yml: new GHA workflow implementing §4.3 drift detection procedure — runs weekly (Mon 08:00 UTC) and on PRs touching AWF config handling; fails CI on PR drift, opens tracking issue on scheduled drift - tests/aw-harness/compliance_test.go: new Go test stubs for §12 compliance tests T-AW-001 through T-AW-007; all stubs skip until aw_harness.cjs is implemented Agent-Logs-Url: https://github.com/github/gh-aw/sessions/e1235992-9054-48f0-8a92-40eefbbcb250 Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>
1 parent ec54a99 commit a17168d

10 files changed

Lines changed: 820 additions & 973 deletions

File tree

‎.github/workflows/awf-config-drift.yml‎

Lines changed: 168 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,168 @@
1+
name: AWF Config Drift Detection
2+
3+
on:
4+
schedule:
5+
- cron: '0 8 * * 1' # Weekly on Mondays at 08:00 UTC
6+
pull_request:
7+
paths:
8+
- 'pkg/workflow/**'
9+
- 'actions/setup/**'
10+
- 'specs/awf-config-sources-spec.md'
11+
workflow_dispatch: {}
12+
13+
permissions:
14+
contents: read
15+
issues: write
16+
17+
jobs:
18+
drift-detection:
19+
name: AWF Config Drift Detection
20+
runs-on: ubuntu-latest
21+
timeout-minutes: 15
22+
permissions:
23+
contents: read
24+
issues: write
25+
26+
steps:
27+
- name: Checkout gh-aw
28+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
29+
with:
30+
fetch-depth: 1
31+
32+
- name: Fetch AWF canonical sources
33+
id: fetch-sources
34+
env:
35+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
36+
run: |
37+
echo "## AWF Config Drift Detection" >> "$GITHUB_STEP_SUMMARY"
38+
echo "" >> "$GITHUB_STEP_SUMMARY"
39+
echo "Fetching canonical sources from gh-aw-firewall..." >> "$GITHUB_STEP_SUMMARY"
40+
41+
mkdir -p /tmp/awf-drift
42+
43+
# Attempt to fetch published schema from gh-aw-firewall
44+
# Note: requires read access to github/gh-aw-firewall
45+
if gh api repos/github/gh-aw-firewall/contents/docs/awf-config.schema.json \
46+
--jq '.content' 2>/dev/null | base64 -d > /tmp/awf-drift/published-schema.json; then
47+
echo "✅ Fetched docs/awf-config.schema.json" >> "$GITHUB_STEP_SUMMARY"
48+
else
49+
echo "⚠️ Could not fetch docs/awf-config.schema.json (repo may be private or inaccessible)" >> "$GITHUB_STEP_SUMMARY"
50+
echo '{}' > /tmp/awf-drift/published-schema.json
51+
fi
52+
53+
if gh api repos/github/gh-aw-firewall/contents/src/awf-config-schema.json \
54+
--jq '.content' 2>/dev/null | base64 -d > /tmp/awf-drift/runtime-schema.json; then
55+
echo "✅ Fetched src/awf-config-schema.json" >> "$GITHUB_STEP_SUMMARY"
56+
else
57+
echo "⚠️ Could not fetch src/awf-config-schema.json" >> "$GITHUB_STEP_SUMMARY"
58+
echo '{}' > /tmp/awf-drift/runtime-schema.json
59+
fi
60+
61+
- name: Extract schema property inventory
62+
id: extract-inventory
63+
run: |
64+
# Extract all unique property keys from both schema files
65+
jq -r '[.. | objects | keys[]] | unique | sort[]' \
66+
/tmp/awf-drift/published-schema.json \
67+
/tmp/awf-drift/runtime-schema.json 2>/dev/null | sort -u \
68+
> /tmp/awf-drift/schema-keys.txt || true
69+
70+
echo "Schema property count: $(wc -l < /tmp/awf-drift/schema-keys.txt)" >> "$GITHUB_STEP_SUMMARY"
71+
echo "" >> "$GITHUB_STEP_SUMMARY"
72+
73+
- name: Compare against gh-aw implementation
74+
id: compare
75+
run: |
76+
DRIFT_FOUND=false
77+
DRIFT_REPORT=""
78+
79+
# Extract property references from gh-aw source
80+
grep -rh \
81+
'apiProxy\|awf-config\|awf_config\|AWF_CONFIG\|AWF_AUTH\|anthropicAutoCache\|anthropicCacheTailTtl\|dockerHostPathPrefix' \
82+
pkg/workflow/ actions/setup/ 2>/dev/null | sort -u \
83+
> /tmp/awf-drift/ghaw-refs.txt || true
84+
85+
# Check each known drift-prone property category
86+
CATEGORIES=("apiProxy" "container" "network" "model" "auth")
87+
for cat in "${CATEGORIES[@]}"; do
88+
SCHEMA_COUNT=$(grep -c "\"${cat}" /tmp/awf-drift/schema-keys.txt 2>/dev/null || echo 0)
89+
GHAW_COUNT=$(grep -c "${cat}" /tmp/awf-drift/ghaw-refs.txt 2>/dev/null || echo 0)
90+
91+
if [ "$SCHEMA_COUNT" -gt 0 ] && [ "$GHAW_COUNT" -eq 0 ]; then
92+
DRIFT_FOUND=true
93+
DRIFT_REPORT="${DRIFT_REPORT}\n- ❌ **Missing in gh-aw**: \`${cat}.*\` (${SCHEMA_COUNT} schema properties, 0 gh-aw references)"
94+
fi
95+
done
96+
97+
if [ "$DRIFT_FOUND" = "true" ]; then
98+
echo "drift_found=true" >> "$GITHUB_OUTPUT"
99+
echo "### ❌ Drift Detected" >> "$GITHUB_STEP_SUMMARY"
100+
echo "" >> "$GITHUB_STEP_SUMMARY"
101+
echo -e "$DRIFT_REPORT" >> "$GITHUB_STEP_SUMMARY"
102+
echo "" >> "$GITHUB_STEP_SUMMARY"
103+
echo "**Corrective action required**: Open a PR to add coverage for missing properties per \`specs/awf-config-sources-spec.md\` Section 4.2." >> "$GITHUB_STEP_SUMMARY"
104+
else
105+
echo "drift_found=false" >> "$GITHUB_OUTPUT"
106+
echo "### ✅ No Drift Detected" >> "$GITHUB_STEP_SUMMARY"
107+
echo "" >> "$GITHUB_STEP_SUMMARY"
108+
echo "All checked AWF config property categories have corresponding gh-aw implementation references." >> "$GITHUB_STEP_SUMMARY"
109+
fi
110+
111+
- name: Create tracking issue on scheduled drift
112+
if: >
113+
steps.compare.outputs.drift_found == 'true' &&
114+
github.event_name == 'schedule'
115+
env:
116+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
117+
run: |
118+
DATE=$(date -u +%Y-%m-%d)
119+
TITLE="AWF Config Drift Detected — ${DATE}"
120+
121+
# Check if an open drift issue already exists
122+
EXISTING=$(gh issue list \
123+
--label awf-config-drift \
124+
--state open \
125+
--json number,title \
126+
--jq '.[0].number' 2>/dev/null || echo "")
127+
128+
if [ -n "$EXISTING" ]; then
129+
echo "Adding comment to existing issue #${EXISTING}"
130+
gh issue comment "$EXISTING" \
131+
--body "### Drift re-detected on ${DATE}
132+
133+
Scheduled drift detection found AWF config property categories with no coverage in gh-aw. See the [workflow run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}) for the full drift report.
134+
135+
**Action required**: Review and address per \`specs/awf-config-sources-spec.md\` Section 4.2 and 5.3."
136+
else
137+
echo "Creating new tracking issue"
138+
gh issue create \
139+
--title "$TITLE" \
140+
--label awf-config-drift \
141+
--body "### AWF Config Drift Detected
142+
143+
The scheduled AWF config drift detection workflow found property categories present in the canonical AWF config schemas (\`github/gh-aw-firewall\`) with no corresponding coverage in \`github/gh-aw\`.
144+
145+
**Detection Date**: ${DATE}
146+
**Workflow Run**: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
147+
148+
### Required Actions
149+
150+
1. Review the drift report in the workflow run summary.
151+
2. For each missing category, add coverage per \`specs/awf-config-sources-spec.md\` Section 4.2 (Step-by-Step Procedure).
152+
3. Open a corrective PR per CR-05 in \`specs/awf-config-sources-spec.md\`.
153+
154+
### References
155+
156+
- Spec: \`specs/awf-config-sources-spec.md\`
157+
- Procedure: Section 4.2 (Step-by-Step Procedure)
158+
- Safeguards: Section 5"
159+
fi
160+
161+
- name: Fail on PR drift
162+
if: >
163+
steps.compare.outputs.drift_found == 'true' &&
164+
github.event_name == 'pull_request'
165+
run: |
166+
echo "❌ AWF config drift detected. This PR touches AWF config handling but drift was found."
167+
echo "See the step summary for details and required corrective actions."
168+
exit 1

0 commit comments

Comments
 (0)