fix: add --skip-trust to Gemini CLI command to prevent yolo override in AWF sandbox#28496
fix: add --skip-trust to Gemini CLI command to prevent yolo override in AWF sandbox#28496
Conversation
…verride The Gemini CLI v1.x checks whether the working directory is trusted and overrides --yolo with "default" approval mode (exit code 55) when the folder is untrusted. The GEMINI_CLI_TRUST_WORKSPACE=true env var was already set, but it can be silently lost in the AWF container's environment variable forwarding (sudo -E + --env-all chain). Add --skip-trust as a belt-and-suspenders fix: since it's a direct CLI flag, it cannot be dropped by environment variable forwarding and ensures the trust check is always bypassed in automated/headless CI runs. Recompile all workflow lock files to include the updated Gemini command. Agent-Logs-Url: https://github.com/github/gh-aw/sessions/3304da63-5f04-407f-be87-b0b7fa3fb7e3 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
|
|
|
|
|
📰 BREAKING: Smoke Copilot is now investigating this pull request. Sources say the story is developing... |
|
✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟 |
|
🚀 Smoke OpenCode MISSION COMPLETE! OpenCode delivered. 🔥 |
|
🎬 THE END — Smoke Claude MISSION: ACCOMPLISHED! The hero saves the day! ✨ |
Agent Container Tool Check
Result: 12/12 tools available ✅ Overall Status: PASS
|
|
Smoke Test Codex 24941211957: FAIL Warning Firewall blocked 2 domainsThe following domains were blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "ab.chatgpt.com"
- "chatgpt.com"See Network Configuration for more information.
|
Comment MemoryNote This comment is managed by comment memory.It stores persistent context for this thread in the code block at the top of this comment. Warning Firewall blocked 2 domainsThe following domains were blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "ab.chatgpt.com"
- "chatgpt.com"See Network Configuration for more information.
|
There was a problem hiding this comment.
Pull request overview
Ensures Gemini CLI runs in --yolo mode even when the workspace is treated as “untrusted” inside the AWF sandbox by adding an explicit CLI flag to bypass the trust gate.
Changes:
- Append
--skip-trustto the Gemini CLI invocation args (after--yolo) when generating execution steps. - Extend Gemini engine unit test to assert
--skip-trustis present in the rendered step command. - Regenerate
smoke-gemini.lock.ymlso smoke runs include--skip-trustin both agent and detection executions.
Show a summary per file
| File | Description |
|---|---|
| pkg/workflow/gemini_engine.go | Adds --skip-trust to Gemini CLI args to prevent workspace trust logic from overriding --yolo. |
| pkg/workflow/gemini_engine_test.go | Adds an assertion ensuring --skip-trust appears in the generated execution step content. |
| .github/workflows/smoke-gemini.lock.yml | Updates locked smoke workflow commands to include --skip-trust in Gemini invocations. |
Copilot's findings
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 3/3 changed files
- Comments generated: 1
| // Skip the workspace trust check so --yolo is not overridden to "default" approval mode. | ||
| // Gemini CLI v1.x checks whether the working directory is trusted and overrides --yolo | ||
| // with "default" approval mode (exit code 55) when the folder is untrusted. | ||
| // GEMINI_CLI_TRUST_WORKSPACE=true (also set in the step env) handles the same case via | ||
| // environment variable, but --skip-trust is more reliable when AWF's sandbox does not | ||
| // forward all host environment variables into the container. |
There was a problem hiding this comment.
The comment references "Gemini CLI v1.x", but this engine currently pins @google/gemini-cli to DefaultGeminiVersion = 0.39.1. To avoid confusion when troubleshooting, consider removing the version qualifier or updating it to match the actually-supported versions (and keep the wording consistent with the existing trust-related comment later in this function).
🧪 Test Quality Sentinel ReportTest Quality Score: 70/100
Test Classification Details
AnalysisThe PR adds a single assertion to the existing assert.Contains(t, stepContent, "--skip-trust", "Should include --skip-trust flag to prevent workspace trust check from overriding --yolo")What design invariant does this test enforce? What would break if deleted? Classification: ✅ Design test — verifies observable output of Suggestions (non-blocking)💡 Consider adding an edge-case scenarioSince
These are optional improvements, not blockers. Language SupportTests analyzed:
Verdict
📖 Understanding Test ClassificationsDesign Tests (High Value) verify what the system does:
Implementation Tests (Low Value) verify how the system does it:
Goal: Shift toward tests that describe the system's behavioral contract — the promises it makes to its users and collaborators. References: §24941261010
|
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
✅ Test Quality Sentinel: 70/100. Test quality is acceptable — 0% of new tests are implementation tests (threshold: 30%). The added assertion directly enforces the behavioral contract that --skip-trust is present in the generated Gemini CLI command.
|
Smoke Test 24941211935 — PR #28496
Overall: ✅ PASS
|
There was a problem hiding this comment.
Smoke test review of PR #28496 (add --skip-trust to Gemini CLI). The change is clear and well-justified — the workspace trust check was silently overriding --yolo, so this fix ensures the intended approval mode is respected. Both the implementation and the test update look correct.
📰 BREAKING: Report filed by Smoke Copilot · ● 881.9K
| assert.Contains(t, stepContent, "id: agentic_execution", "Should have agentic_execution ID") | ||
| assert.Contains(t, stepContent, "gemini", "Should invoke gemini command") | ||
| assert.Contains(t, stepContent, "--yolo", "Should include --yolo flag for auto-approving tool executions") | ||
| assert.Contains(t, stepContent, "--skip-trust", "Should include --skip-trust flag to prevent workspace trust check from overriding --yolo") |
There was a problem hiding this comment.
Good test coverage for the new --skip-trust flag. The assertion message is descriptive and helpful.
| // Gemini CLI v1.x checks whether the working directory is trusted and overrides --yolo | ||
| // with "default" approval mode (exit code 55) when the folder is untrusted. | ||
| // GEMINI_CLI_TRUST_WORKSPACE=true (also set in the step env) handles the same case via | ||
| // environment variable, but --skip-trust is more reliable when AWF's sandbox does not |
There was a problem hiding this comment.
The --skip-trust flag addition is well-documented. One minor note: the comment mentions GEMINI_CLI_TRUST_WORKSPACE=true as an alternative, but it would be useful to confirm this env var is still being set in the step env block for defense-in-depth.
|
📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤 |
Smoke Test Results — Run §24941211951Overall: PARTIAL (1 fail, 2 skipped)
❌ Test #10 failed: Note 🔒 Integrity filter blocked 1 itemThe following item was blocked because it doesn't meet the GitHub integrity level.
To allow these resources, lower tools:
github:
min-integrity: approved # merged | approved | unapproved | none
|
There was a problem hiding this comment.
💥 Automated smoke test review - all systems nominal! Run 24941211951
Note
🔒 Integrity filter blocked 1 item
The following item was blocked because it doesn't meet the GitHub integrity level.
- #28496
pull_request_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
To allow these resources, lower min-integrity in your GitHub frontmatter:
tools:
github:
min-integrity: approved # merged | approved | unapproved | none💥 [THE END] — Illustrated by Smoke Claude · ● 178.1K
| // GEMINI_CLI_TRUST_WORKSPACE=true (also set in the step env) handles the same case via | ||
| // environment variable, but --skip-trust is more reliable when AWF's sandbox does not | ||
| // forward all host environment variables into the container. | ||
| geminiArgs = append(geminiArgs, "--skip-trust") |
There was a problem hiding this comment.
✅ Good fix: using --skip-trust as a direct CLI flag is more reliable than relying on GEMINI_CLI_TRUST_WORKSPACE env var, which can be silently dropped through the AWF container's forwarding chain. This ensures the trust override works regardless of env var forwarding fidelity.
| @@ -168,6 +168,14 @@ func (e *GeminiEngine) GetExecutionSteps(workflowData *WorkflowData, logFile str | |||
| // Without this, Gemini CLI's default approval mode rejects tool calls with "Tool execution denied by policy" | |||
| geminiArgs = append(geminiArgs, "--yolo") | |||
There was a problem hiding this comment.
💡 Consider adding a comment explaining why --yolo comes before --skip-trust — the ordering might matter if Gemini CLI processes args sequentially for trust checks.
Gemini CLI v1.x overrides
--yolowith "default" approval mode (exit code 55) when the working directory is untrusted.GEMINI_CLI_TRUST_WORKSPACE=truewas already set in the step env, but this variable can be silently dropped through the AWF container's forwarding chain (sudo -E→--env-all).Changes
pkg/workflow/gemini_engine.go: Append--skip-trusttogeminiArgsafter--yolo. As a direct CLI flag embedded in the command string, it bypasses the trust check regardless of env var forwarding fidelity.pkg/workflow/gemini_engine_test.go: Assert--skip-trustis present in the generated execution step.smoke-gemini.lock.yml: Recompiled — both agent and detection runs now invokegemini --yolo --skip-trust --output-format stream-json ....Warning
Firewall rules blocked me from connecting to one or more addresses (expand for details)
I tried to connect to the following addresses, but was blocked by firewall rules:
https://api.github.com/graphql/usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw(http block)/usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw olden(http block)/usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw ire(http block)https://api.github.com/orgs/test-owner/actions/secrets/usr/bin/gh gh api /orgs/test-owner/actions/secrets --jq .secrets[].name -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)/usr/bin/gh gh api /orgs/test-owner/actions/secrets --jq .secrets[].name ithub/workflows show(http block)https://api.github.com/repos/actions/ai-inference/git/ref/tags/v1/usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq [.object.sha, .object.type] | @tsv --show-toplevel 64/pkg/tool/linuupstream /usr/bin/git rity4033584150/0git ortcfg til.test git rev-�� --show-toplevel til.test /usr/bin/git OxUhT8620 64/src/net/addrs/opt/hostedtoolcache/node/24.14.1/x64/bin/npm ache/go/1.25.8/xinstall git(http block)/usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/git /001/inlined-b.mgit piler}} 86_64/bash git rev-�� --show-toplevel resolved$ /usr/bin/git b/workflows rev-parse ache/go/1.25.8/xinstall git(http block)https://api.github.com/repos/actions/checkout/git/ref/tags/v3/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq [.object.sha, .object.type] | @tsv /tmp/go-build673274640/b447/stringutil.test(http block)/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq [.object.sha, .object.type] | @tsv /home/REDACTED/work/gh-aw/gh-aw/.github/workflows/agentic-observability-kit.md git /usr/bin/git ithub/workflows config /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git ithub/workflows show kflows/smoke-cal--show-toplevel git(http block)https://api.github.com/repos/actions/checkout/git/ref/tags/v5/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq [.object.sha, .object.type] | @tsv 2256-36240/test-290907353/.github/workflows GO111MODULE ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet GOINSECURE 5927120/b011/sysrev-parse ache/go/1.25.8/x--show-toplevel ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet env -json idHf/SNpM4ddnpkD5Lj-UidHf ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linuremote.origin.url(http block)/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq [.object.sha, .object.type] | @tsv --show-toplevel ache/go/1.25.8/x64/pkg/tool/linuTest User /usr/bin/git efaultBranchFromtr efaultBranchFrom\n ache/go/1.25.8/x: git rev-�� --show-toplevel ache/go/1.25.8/x64/pkg/tool/linuremote.origin.url /usr/bin/git CompiledOutput62git Kv-X/SrddFjc3EqPrev-parse 5927120/b228=> git(http block)/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/git oRAb/yYxzhiyRkBQgit(http block)https://api.github.com/repos/actions/checkout/git/ref/tags/v6/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv /tmp/TestGuardPolicyBlockedUsersApprovalLabelsCononexistent/repo rev-parse ache/node/24.14.1/x64/bin/node -json GO111MODULE 64/bin/go git t-37�� tagedFiles403003192/001/workflow.md rev-parse /usr/bin/git -json GO111MODULE x_amd64/asm git(http block)/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv git-receive-pack '/tmp/TestParseDefaultBranchFromLsRemoteWithRealGitmaster_brancremote.origin.urgit git-receive-pack '/tmp/TestParseDefaultBranchFromLsRemoteWithRealGitmaster_branch1168363193/001'rev-parse /usr/bin/git .exclude) git er: String!, $na--show-toplevel git rev-�� --show-toplevel /usr/bin/gh /usr/bin/git ithub/workflows -f(http block)https://api.github.com/repos/actions/github-script/git/ref/tags/v8/usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq [.object.sha, .object.type] | @tsv --show-toplevel 64/pkg/tool/linucurrent (local changes) /usr/bin/git actions/setup-clbash iMTA/2uapuyerpei/tmp/gh-aw-test-runs/20260425-212316-38883/test-patch-priority-21259�� /opt/hostedtoolcnew (upstream) git rev-�� --show-toplevel /opt/hostedtoolc/tmp/gh-aw-merge-3421214039/new.md /usr/bin/git _messages.go _messages_test.grev-parse cfg git(http block)/usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/git 2635-51929/test-bash ctionpins.go ache/go/1.25.8/x64/pkg/tool/linu--show-toplevel git rev-�� --show-toplevel ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet /usr/bin/git /home/REDACTED/worgit config ache/node/24.14.--show-toplevel git(http block)https://api.github.com/repos/actions/github-script/git/ref/tags/v9/usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv -goversion go1.25.8 -c=4 -nolocalimports -importcfg /tmp/go-build1295927120/b257/importcfg -pack env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)/usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv go1.25.8 -c=4 -nolocalimports -importcfg /tmp/go-build1295927120/b131/importcfg -pack /home/REDACTED/go/pkg/mod/github.com/modelcontextprotocol/go-sdk@v1.5.0/mcp/client.go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)/usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)https://api.github.com/repos/actions/setup-go/git/ref/tags/v4/usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv github.event.issue.number 64/pkg/tool/linu-buildtags /usr/bin/git g_.a GO111MODULE 64/pkg/tool/linu--show-toplevel /usr/bin/git conf�� --get-regexp ^remote\..*\.gh-resolved$ /usr/bin/git 1537985788/.githgit 8kq6Gg-gh 64/pkg/tool/linu--show-toplevel git(http block)/usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/git ithub/workflows show 64/pkg/tool/linu--show-toplevel git rev-�� --show-toplevel 64/pkg/tool/linurev-parse /usr/bin/git k/gh-aw/gh-aw/.ggit ode_modules/viterev-parse 86_64/bash git(http block)https://api.github.com/repos/actions/setup-node/git/ref/tags/v4/usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --show-toplevel go ache/node/24.14.1/x64/bin/node -json GO111MODULE 64/bin/go git t-96�� k/gh-aw/gh-aw/.github/workflows/agentic-optimization-kit.md rev-parse cfg -json GO111MODULE x_amd64/compile git(http block)/usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --show-toplevel 64/pkg/tool/linu-test.v=true /usr/bin/git LsRemoteWithRealgit LsRemoteWithRealrev-parse 64/pkg/tool/linu--show-toplevel /usr/bin/git conf�� --get-regexp ^remote\..*\.gh-resolved$ /usr/bin/git 1537985788/.githgit ne_constants.go 64/pkg/tool/linu--show-toplevel git(http block)/usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --symref l /usr/bin/git .github/workflowgit 4w5F5vHY_tiY er: String!, $na--show-toplevel git -C /tmp/TestGuardPolicyMinIntegrityOnlymin-integrity_with_explicit_repo2003873670/001 remote /opt/hostedtoolcache/node/24.14.1/x64/bin/node k/gh-aw/gh-aw herFiles,CFiles,rev-parse me: String!) { --show-toplevel node(http block)https://api.github.com/repos/actions/upload-artifact/git/ref/tags/v4/usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --show-toplevel go /usr/bin/git -json GO111MODULE 64/bin/go git remo�� GOMODCACHE go /opt/hostedtoolcache/node/24.14.1/x64/bin/node 1 GO111MODULE x_amd64/compile node(http block)/usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv ue.number show /usr/bin/gh --show-toplevel git nt-public-approv--show-toplevel gh api /orgs/test-owner/actions/secrets --jq /usr/bin/git ithub/workflows show(http block)https://api.github.com/repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b/usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq [.object.sha, .object.type] | @tsv re --log-level=e!../../../pkg/workflow/js/**/*.json(http block)/usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq [.object.sha, .object.type] | @tsv ure(http block)/usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq [.object.sha, .object.type] | @tsv user.email ings.cjs odules/npm/node_modules/@npmcli/run-script/lib/node-gyp-bin/git f878a44a..full-m/opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/compile st/suppress-warn-o tions/setup/js/n/tmp/go-build627879458/b001/_pkg_.a forks.js rev-�� HEAD st/suppress-warnmain _modules/.bin/gi-lang=go1.25 --bare full mode test k/node_modules/.--require st/dist/workers//home/REDACTED/work/gh-aw/gh-aw/actions/setup/js/node_modules/vitest/suppress-warnings.cjs(http block)https://api.github.com/repos/github/gh-aw/usr/bin/gh gh api /repos/github/gh-aw --jq .default_branch --exclude-standard --others son ignore(http block)/usr/bin/gh gh api /repos/github/gh-aw --jq .default_branch .go test@example.com ules/.bin/go ode-gyp-bin/git git 74 git bran�� -cwd.go main repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } --is-ancestor k/gh-aw/gh-aw/ac-C odules/npm/node_/home/REDACTED/work/gh-aw/gh-aw/.github/workflows git(http block)/usr/bin/gh gh api /repos/github/gh-aw --jq .default_branch . /opt/hostedtoolcache/node/24.14.owner=github me: String!) { repository(owne-f --require /home/REDACTED/wor-C n-dir/git /opt/hostedtoolcshow --ex�� k/gh-aw/gh-aw/.github/workflows /home/REDACTED/work/gh-aw/gh-aw/actions/setup/js/node_modules/vitest/suppress-warnings.cjs 1/x64/bin/node node --conditions development go(http block)https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v0.1.2/usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0.1.2 --jq [.object.sha, .object.type] | @tsv github.repository 64/pkg/tool/linuremote.origin.url /usr/bin/gh ty-test.md GO111MODULE 64/pkg/tool/linu--show-toplevel gh api --paginate repos/{owner}/{repo}/actions/runs/5/artifacts /usr/bin/gh .artifacts[].namgit GO111MODULE 64/pkg/tool/linu--show-toplevel gh(http block)/usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0.1.2 --jq [.object.sha, .object.type] | @tsv --show-toplevel x_amd64/vet /usr/bin/git or.md ghcr.io/github/srev-parse 64/bin/go git rev-�� --show-toplevel git /usr/bin/git itmaster_branch1git itmaster_branch1rev-parse kflows/github-mc--show-toplevel git(http block)https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.0.0/usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq [.object.sha, .object.type] | @tsv 274640/b472/_pkg_.a /tmp/go-build673274640/b413/_testmain.go 274640/b472=> -json GO111MODULE 64/bin/go /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/compile -o poJ_/sX9FX53sm1OTZ6jdpoJ_ git /tmp/go-build673274640/b452/testutil.test -p github.com/githurev-parse -lang=go1.25 /tmp/go-build673274640/b452/testutil.test(http block)/usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/git(http block)https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.2.3/usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq [.object.sha, .object.type] | @tsv ons-test1683717900 config ps remote.origin.urgit GO111MODULE 64/bin/go ps git git go om/myorg/repo.git -json GO111MODULE x_amd64/asm git(http block)/usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq [.object.sha, .object.type] | @tsv -aw/git/ref/tags/v3.0.0 git bject.type] | @tsv ithub/workflows git /usr/bin/gh git rev-�� --show-toplevel /usr/bin/gh /usr/bin/git graphql -f ect-url-default.--show-toplevel git(http block)https://api.github.com/repos/github/gh-aw/actions/runs/1/artifacts/usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/1/artifacts --jq .artifacts[].name KmEF_rn9z 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet env 1076777945/.github/workflows CLJOlIPxV x_amd64/link GOINSECURE GOMOD GOMODCACHE x_amd64/link(http block)/usr/bin/gh gh run download 1 --dir test-logs/run-1 hOYFQ3cxW 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet env 1732138090/.github/workflows ASggpb24G ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile(http block)/usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/1/artifacts --jq .artifacts[].name config ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet remote.origin.urgit --auto repository(owne--show-toplevel ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet -C /home/REDACTED/work/gh-aw/gh-aw/.github/workflows rev-parse /opt/hostedtoolcache/go/1.25.8/x64/bin/go user.email k/gh-aw/gh-aw/acrev-parse /home/REDACTED/wor--show-toplevel go(http block)https://api.github.com/repos/github/gh-aw/actions/runs/12345/artifacts/usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12345/artifacts --jq .artifacts[].name GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE s.o 64/src/runtime/iuser.email 64/pkg/tool/linutest@example.com env 4129918343 aNsjT_hWR ache/go/1.25.8/x64/pkg/tool/linu-test.short=true GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linuremote.origin.url(http block)/usr/bin/gh gh run download 12345 --dir test-logs/run-12345 GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD abis 64/pkg/tool/linux_amd64/compile env 187245672 op5fLH1pk x_amd64/vet GOINSECURE onpins GOMODCACHE x_amd64/vet(http block)/usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12345/artifacts --jq .artifacts[].name tPath,Error,Dir,GoFiles,IgnoredGoFiles,IgnoredOtherFiles,CFiles,CgoFiles,CXXFiles,MFiles,HFiles,rev-parse ache/go/1.25.8/x64/bin/go test-vH7lhX/no-igit git repository(owne--show-toplevel git -C /ref/tags/v9 nstants.go 1/x64/bin/node ature_constants.git b_constants.go ol_constants.go 1/x64/bin/node(http block)https://api.github.com/repos/github/gh-aw/actions/runs/12346/artifacts/usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12346/artifacts --jq .artifacts[].name GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE clr_wasm.o 64/src/runtime/m--git-dir 64/pkg/tool/linux_amd64/vet env 4129918343 APhUuwu-5 ache/go/1.25.8/x64/pkg/tool/linu-lang=go1.25 GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linu-goversion(http block)/usr/bin/gh gh run download 12346 --dir test-logs/run-12346 GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD abis 64/pkg/tool/linux_amd64/vet env 187245672 VGplouFzy ache/go/1.25.8/x64/pkg/tool/linu--limit GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/xremote.origin.url(http block)/usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12346/artifacts --jq .artifacts[].name config 1/x64/bin/node remote.origin.urgit s,MFiles,HFiles,rev-parse ache/node/24.14.--show-toplevel ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile t-ha�� ithub/workflows/ai-moderator.md rev-parse /opt/hostedtoolcache/go/1.25.8/x64/bin/go user.name :latest repository(owne--show-toplevel go(http block)https://api.github.com/repos/github/gh-aw/actions/runs/2/artifacts/usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/2/artifacts --jq .artifacts[].name GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE .o 64/src/internal/--show-toplevel 64/pkg/tool/linux_amd64/compile env _.a FSSLThW2J ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linutest@example.com(http block)/usr/bin/gh gh run download 2 --dir test-logs/run-2 m0O72i2Jk 64/pkg/tool/linux_amd64/compile GOINSECURE /bidi GOMODCACHE 64/pkg/tool/linux_amd64/compile env 1732138090 JmzP4TwGo ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile(http block)/usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/2/artifacts --jq .artifacts[].name ion_cache.go ache/node/24.14.1/x64/bin/node ion_pins.go ion_reference.gorev-parse ion_resolver.go ion_sha_checker.go t-25�� 2635-51929/test-2071689985/.github/workflows _reviewer.go /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/compile remote.origin.urgit k/gh-aw/gh-aw/acrev-parse repository(owne--show-toplevel /opt/hostedtoolcache/go/1.25.8/xTest User(http block)https://api.github.com/repos/github/gh-aw/actions/runs/3/artifacts/usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/3/artifacts --jq .artifacts[].name UHEwN-QbQ 64/pkg/tool/linux_amd64/link GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/link env tdrain.test jPRjWWcxh x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile(http block)/usr/bin/gh gh run download 3 --dir test-logs/run-3 GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD abis ylQP4Z8/vCNYLdc7D8RXanEmFBss env 1732138090/.github/workflows pKmvAbdZx ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linu-trimpath(http block)/usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/3/artifacts --jq .artifacts[].name rev-parse ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet test-Dx0uxf/slowgit main repository(owne--show-toplevel ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet -C 2635-51929/test-2071689985/.github/workflows show e/git-receive-pack ithub/workflows k/gh-aw/gh-aw/acrev-parse ker/cli-plugins/--show-toplevel(http block)https://api.github.com/repos/github/gh-aw/actions/runs/4/artifacts/usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/4/artifacts --jq .artifacts[].name Cy4PJHJpH 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet env 1076777945/.github/workflows v7mHHZTds ache/go/1.25.8/x64/pkg/tool/linux_amd64/asm GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linuremote.origin.url(http block)/usr/bin/gh gh run download 4 --dir test-logs/run-4 rrG8ct2Bi 64/pkg/tool/linux_amd64/link GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/link env ole.test Ffa_H-Eee x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet(http block)/usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/4/artifacts --jq .artifacts[].name show ache/node/24.14.1/x64/bin/node ithub/workflows main r: $owner, name:--show-toplevel git t-10�� 2635-51929/test-2071689985 config xpires.lock.yml remote.origin.urgit k/gh-aw/gh-aw/acrev-parse /node_modules/.b--show-toplevel e/git(http block)https://api.github.com/repos/github/gh-aw/actions/runs/5/artifacts/usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/5/artifacts --jq .artifacts[].name GO111MODULE 64/pkg/tool/linu-nilfunc GOINSECURE GOMOD abis 64/pkg/tool/linu-tests env 1076777945/.github/workflows 4Gx5UXvR1 ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linu-importcfg(http block)/usr/bin/gh gh run download 5 --dir test-logs/run-5 GO111MODULE 64/pkg/tool/linu-nolocalimports GOINSECURE rm abis 64/pkg/tool/linu/tmp/go-build673274640/b466/_testmain.go env 1732138090/.github/workflows BIoY6_isA x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet(http block)/usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/5/artifacts --jq .artifacts[].name config 9602525/b404/cli.test remote.origin.urgit main ache/node/24.14.--show-toplevel 9602525/b404/cli.test e=/t�� 2635-51929/test-2071689985/.github/workflows rev-parse e/git m0s k/gh-aw/gh-aw/acrev-parse(http block)https://api.github.com/repos/github/gh-aw/actions/workflows/usr/bin/gh gh workflow list --json name,state,path -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)/usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 100 GOMOD GOMODCACHE x_amd64/compile env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile(http block)/usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 6 GOMOD abis 64/pkg/tool/linux_amd64/vet env XMdlm1J_w cfg ache/go/1.25.8/x64/pkg/tool/linux_amd64/asm GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linutest@example.com(http block)https://api.github.com/repos/github/gh-aw/contents/.github/workflows/shared/reporting.md/tmp/go-build673274640/b404/cli.test /tmp/go-build673274640/b404/cli.test -test.testlogfile=/tmp/go-build673274640/b404/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true -nolocalimports -importcfg /tmp/go-build1295927120/b223/importcfg -pack env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)/tmp/go-build4189602525/b404/cli.test /tmp/go-build4189602525/b404/cli.test -test.testlogfile=/tmp/go-build4189602525/b404/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true node --conditions development /usr/libexec/doc{{context.GOARCH}} {{context.Compiler}} dock�� son -out=gosec-runsafe git ghts.lock.yml user.email mp DiscussionsEnabled } } git(http block)https://api.github.com/repos/github/gh-aw/git/ref/tags/v0.47.4/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v0.47.4 --jq [.object.sha, .object.type] | @tsv --show-toplevel ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile /usr/bin/git Onlymin-integritgit ahb4/lZep-2Miwczrev-parse 64/pkg/tool/linu--show-toplevel git rev-�� --show-toplevel 64/pkg/tool/linusecurity /usr/bin/git _.a EgAi/JW5fl0E13Yy-lh(http block)/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v0.47.4 --jq [.object.sha, .object.type] | @tsv --show-toplevel ache/go/1.25.8/xremote.origin.url /usr/bin/git 3892714/b342/_pkgit config ash git rev-�� --show-toplevel git /usr/bin/git Opoj/F9WO-Pdsm62ls rev-parse /usr/bin/git git(http block)https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.0.0/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq [.object.sha, .object.type] | @tsv 1333827946/001 GO111MODULE ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile GOINSECURE /exithook GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile ortc�� 5927120/b109/_pkg_.a om/santhosh-tekuri/jsonschema/v6@v6.0.2/kind/kind.go ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile GOINSECURE b/gh-aw/pkg/consrev-parse GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linuremote1(http block)/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq [.object.sha, .object.type] | @tsv repo3875047415/001 -f kflows/cli-consistency-checker.l-nilfunc -f owner=github -f infocmp estl�� ub/workflows git 64/bin/go l ode_modules/viterev-parse ache/uv/0.11.7/x--show-toplevel git(http block)https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.2.3/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE 4-oiIa1/9KqfPfOCrev-parse 3004�� -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile(http block)/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq [.object.sha, .object.type] | @tsv ithub/workflows -f k.yml -f owner=github -f git -C k/gh-aw/gh-aw/.github/workflows show x_amd64/compile l t-patch-utils-tqinit x_amd64/asm x_amd64/compile(http block)https://api.github.com/repos/github/gh-aw/git/ref/tags/v2.0.0/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq [.object.sha, .object.type] | @tsv(http block)/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env lGitmaster_branch4100043801/001' lGitmaster_branch4100043801/001' x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile(http block)/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq [.object.sha, .object.type] | @tsv with-tools.md GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE 68Vh2dK/cACoDFtjX-1PWzdY5nrQ 1000�� -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile(http block)https://api.github.com/repos/github/gh-aw/git/ref/tags/v3.0.0/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq [.object.sha, .object.type] | @tsv(http block)/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq [.object.sha, .object.type] | @tsv ithub/workflows config x_amd64/compile l st/suppress-warnrev-parse git x_amd64/compile 9183�� ithub/workflows -f kflows/test-project-url-default.pkg/stringutil/stringutil.go -f owner=github -f git(http block)https://api.github.com/repos/nonexistent/action/git/ref/tags/v999.999.999/usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq [.object.sha, .object.type] | @tsv 1333827946/001 Ak5qHtlUh ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile GOINSECURE /math GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linuTest User env efaultBranchFromLsRemoteWithRealGitcustom_branch845857421/001' efaultBranchFromLsRemoteWithRealGitcustom_branch845857421/001' ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linuremote.origin.url(http block)/usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq [.object.sha, .object.type] | @tsv 55/001 config 64/bin/node remote.origin.ur/opt/hostedtoolcache/node/24.14.1/x64/bin/node OY6a/.diffsize.t/tmp/test-process-1474235259.js tions/setup/nodeSecret: ${{ secrets.TOKEN }} git 1/x6�� source-field-variant-262122298/.github/workflows config 64/bin/go l -m 1/x64/bin/node git(http block)https://api.github.com/repos/nonexistent/repo/actions/runs/12345/usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile env ility-kit.md 2XU_VxRq0 ache/go/1.25.8/x64/pkg/tool/linux_amd64/asm GOINSECURE(http block)/usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion commit.gpgsign k/gh-aw/gh-aw/acrev-parse repository(owne--show-toplevel /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/asm -V=f�� '/tmp/TestParseDefaultBranchFromLsRemoteWithRealGitbranch_with_hremote.origin.url '/tmp/TestParseDefaultBranchFromLsRemoteWithRealGitbranch_with_hyphen2956220395/001' /home/REDACTED/.cargo/bin/bash ithub/workflows CgoFiles,CXXFilerev-parse n-dir/node bash(http block)https://api.github.com/repos/owner/repo/actions/workflows/usr/bin/gh gh workflow list --json name,state,path --repo owner/repo 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)/usr/bin/gh gh workflow list --repo owner/repo --json name,path,state ache/go/1.25.8/x64/pkg/tool/linu-test.short=true GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linuremote.origin.url env 52/001/test-inlined-imports-enabled-with-env-template-expressions-in-body.md GO111MODULE cfg GOINSECURE 5927120/b011/ GOMODCACHE ache/go/1.25.8/xrepos/{owner}/{repo}/actions/runs/12346/artifacts(http block)/usr/bin/gh gh workflow list --json name,state,path --repo owner/repo stylist.lock.yml-deps=true remote.origin.urbash RUhx/.diffsize.t--norc ules/.bin/git /usr/bin/gh api ithub/workflows -f r.lock.yml -f owner=github -f infocmp(http block)https://api.github.com/repos/test-owner/test-repo/actions/secrets/usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)/usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name k/gh-aw/gh-aw show kflows/duplicate-code-detector.lock.yml . git ed } } infocmp -1 ithub/workflows git /usr/bin/git -q -m 1/x64/lib/node_m/tmp/gh-aw-test-runs/20260425-212635-51929/test-source-field-variant-4256526718/.github/workflows git(http block)https://api.github.com/repos/test/repo/usr/bin/gh gh api /repos/test/repo --jq .default_branch 1732138090 JmzP4TwGo ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile env aJd7B2VBq GO111MODULE ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile GOINSECURE fips140/sha256 GOMODCACHE ache/go/1.25.8/x4(http block)/usr/bin/gh gh api /repos/test/repo --jq .default_branch --show-toplevel infocmp /opt/hostedtoolcache/node/24.14.1/x64/bin/node ithub/workflows git k.yml /opt/hostedtoolcache/node/24.14.1/x64/bin/node /tmp�� Safe: ${{ github.actor }}, Unsafe: ${{ secrets.TOKEN }} infocmp /usr/bin/git xterm-color st/dist/workers/rev-parse x_amd64/compile git(http block)invalid.example.invalid/usr/lib/git-core/git-remote-https /usr/lib/git-core/git-remote-https origin https://invalid.example.invalid/nonexistent-repo.git e/git init�� ndor/bin/git git ode_modules/.bin/git =receive test@example.com--git-dir=/tmp/bare-incremental-tKK9wI /git(dns block)If you need me to access, download, or install something from one of these locations, you can either:
✨ PR Review Safe Output Test - Run 24941211951
Note
🔒 Integrity filter blocked 1 item
The following item was blocked because it doesn't meet the GitHub integrity level.
pull_request_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".To allow these resources, lower
min-integrityin your GitHub frontmatter: