Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions .changeset/patch-remove-generated-mcp-workdir-field.md

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

5 changes: 5 additions & 0 deletions .changeset/patch-remove-workdir-mcp-config.md

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 0 additions & 1 deletion .github/workflows/agent-performance-analyzer.lock.yml

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 0 additions & 1 deletion .github/workflows/agent-persona-explorer.lock.yml

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 0 additions & 1 deletion .github/workflows/daily-firewall-report.lock.yml

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 0 additions & 1 deletion .github/workflows/daily-observability-report.lock.yml

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 0 additions & 1 deletion .github/workflows/dev-hawk.lock.yml

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 0 additions & 1 deletion .github/workflows/example-workflow-analyzer.lock.yml

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 0 additions & 1 deletion .github/workflows/metrics-collector.lock.yml

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 0 additions & 1 deletion .github/workflows/python-data-charts.lock.yml

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 0 additions & 1 deletion .github/workflows/security-review.lock.yml

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 0 additions & 1 deletion .github/workflows/smoke-copilot.lock.yml

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

4 changes: 0 additions & 4 deletions pkg/workflow/mcp-config-builtin.go
Original file line number Diff line number Diff line change
Expand Up @@ -82,8 +82,6 @@ func renderAgenticWorkflowsMCPConfigWithOptions(yaml *strings.Builder, isLast bo
yaml.WriteString(" \"entrypointArgs\": [\"mcp-server\"],\n")
// Mount gh-aw binary (read-only), workspace (read-write for status/compile), and temp directory (read-write for logs)
yaml.WriteString(" \"mounts\": [\"" + constants.DefaultGhAwMount + "\", \"" + constants.DefaultWorkspaceMount + "\", \"" + constants.DefaultTmpGhAwMount + "\"],\n")
// Set working directory to workspace for proper command execution context
yaml.WriteString(" \"workdir\": \"${{ github.workspace }}\",\n")

// Note: tools field is NOT included here - the converter script adds it back
// for Copilot. This keeps the gateway config compatible with the schema.
Expand Down Expand Up @@ -138,8 +136,6 @@ func renderAgenticWorkflowsMCPConfigTOML(yaml *strings.Builder) {
yaml.WriteString(" entrypointArgs = [\"mcp-server\"]\n")
// Mount gh-aw binary (read-only), workspace (read-write for status/compile), and temp directory (read-write for logs)
yaml.WriteString(" mounts = [\"" + constants.DefaultGhAwMount + "\", \"" + constants.DefaultWorkspaceMount + "\", \"" + constants.DefaultTmpGhAwMount + "\"]\n")
// Set working directory to workspace for proper command execution context
yaml.WriteString(" workdir = \"${{ github.workspace }}\"\n")
// Use env_vars array to reference environment variables instead of embedding secrets
yaml.WriteString(" env_vars = [\"GITHUB_TOKEN\"]\n")
}
3 changes: 0 additions & 3 deletions pkg/workflow/mcp_config_refactor_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -215,7 +215,6 @@ func TestRenderAgenticWorkflowsMCPConfigWithOptions(t *testing.T) {
`"/opt/gh-aw:/opt/gh-aw:ro"`, // gh-aw binary mount (read-only)
`"${{ github.workspace }}:${{ github.workspace }}:rw"`, // workspace mount (read-write)
`"/tmp/gh-aw:/tmp/gh-aw:rw"`, // temp directory mount (read-write)
`"workdir": "${{ github.workspace }}"`, // working directory for command execution
`"GITHUB_TOKEN": "\${GITHUB_TOKEN}"`,
` },`,
},
Expand All @@ -236,7 +235,6 @@ func TestRenderAgenticWorkflowsMCPConfigWithOptions(t *testing.T) {
`"/opt/gh-aw:/opt/gh-aw:ro"`, // gh-aw binary mount (read-only)
`"${{ github.workspace }}:${{ github.workspace }}:rw"`, // workspace mount (read-write)
`"/tmp/gh-aw:/tmp/gh-aw:rw"`, // temp directory mount (read-write)
`"workdir": "${{ github.workspace }}"`, // working directory for command execution
// Security fix: Now uses shell variable instead of GitHub secret expression
`"GITHUB_TOKEN": "$GITHUB_TOKEN"`,
` }`,
Expand Down Expand Up @@ -390,7 +388,6 @@ func TestRenderAgenticWorkflowsMCPConfigTOML(t *testing.T) {
`"/opt/gh-aw:/opt/gh-aw:ro"`, // gh-aw binary mount (read-only)
`"${{ github.workspace }}:${{ github.workspace }}:rw"`, // workspace mount (read-write)
`"/tmp/gh-aw:/tmp/gh-aw:rw"`, // temp directory mount (read-write)
`workdir = "${{ github.workspace }}"`, // working directory for command execution
`env_vars = ["GITHUB_TOKEN"]`,
}

Expand Down
Loading