Skip to content

Mount gh CLI binary in agentic-workflows MCP server container #13948

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
pelikhan merged 6 commits into from
Feb 5, 2026
Merged

Mount gh CLI binary in agentic-workflows MCP server container #13948

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
40f5ccd
Initial plan
Copilot Feb 5, 2026
e0b908a
Add gh binary mount to agentic-workflows MCP configuration
Copilot Feb 5, 2026
3cf00a8
Add gh CLI version logging to mcp-server startup
Copilot Feb 5, 2026
0eab03f
Use workflow.ExecGH helper to run gh version command
Copilot Feb 5, 2026
36f72fa
Add changeset [skip-ci]
github-actions[bot] Feb 5, 2026
f0075ef
Merge branch 'main' into copilot/add-gh-tool-mount
pelikhan Feb 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions .changeset/patch-log-gh-cli-version.md
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion .github/workflows/agent-performance-analyzer.lock.yml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion .github/workflows/agent-persona-explorer.lock.yml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion .github/workflows/audit-workflows.lock.yml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion .github/workflows/cloclo.lock.yml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion .github/workflows/daily-firewall-report.lock.yml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion .github/workflows/daily-observability-report.lock.yml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion .github/workflows/daily-safe-output-optimizer.lock.yml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion .github/workflows/deep-report.lock.yml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion .github/workflows/dev-hawk.lock.yml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion .github/workflows/example-workflow-analyzer.lock.yml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion .github/workflows/mcp-inspector.lock.yml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion .github/workflows/metrics-collector.lock.yml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion .github/workflows/portfolio-analyst.lock.yml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion .github/workflows/prompt-clustering-analysis.lock.yml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion .github/workflows/python-data-charts.lock.yml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion .github/workflows/q.lock.yml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion .github/workflows/safe-output-health.lock.yml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion .github/workflows/security-review.lock.yml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion .github/workflows/smoke-claude.lock.yml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion .github/workflows/smoke-copilot.lock.yml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion .github/workflows/static-analysis-report.lock.yml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion .github/workflows/workflow-normalizer.lock.yml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

23 changes: 23 additions & 0 deletions pkg/cli/mcp_server.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -80,6 +80,26 @@ Examples:
return cmd
}

// checkAndLogGHVersion checks if gh CLI is available and logs its version
func checkAndLogGHVersion() {
cmd := workflow.ExecGH("version")
output, err := cmd.CombinedOutput()

if err != nil {
mcpLog.Print("WARNING: gh CLI not found in PATH")
fmt.Fprintln(os.Stderr, console.FormatWarningMessage("gh CLI not found in PATH - some MCP server operations may fail"))
return
}

// Parse and log the version
versionOutput := strings.TrimSpace(string(output))
mcpLog.Printf("gh CLI version: %s", versionOutput)

// Extract just the first line for cleaner logging to stderr
firstLine := strings.Split(versionOutput, "\n")[0]
fmt.Fprintln(os.Stderr, console.FormatInfoMessage(fmt.Sprintf("gh CLI: %s", firstLine)))
}

// runMCPServer starts the MCP server on stdio or HTTP transport
func runMCPServer(port int, cmdPath string) error {
if port > 0 {
Expand All @@ -88,6 +108,9 @@ func runMCPServer(port int, cmdPath string) error {
mcpLog.Print("Starting MCP server with stdio transport")
}

// Check and log gh CLI version
checkAndLogGHVersion()

// Validate that the CLI and secrets are properly configured
// Note: Validation failures are logged as warnings but don't prevent server startup
// This allows the server to start in test environments or non-repository directories
Expand Down
4 changes: 4 additions & 0 deletions pkg/constants/constants.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -387,6 +387,10 @@ const DefaultAlpineImage = "alpine:latest"
// The gh-aw binary and supporting files are mounted read-only from /opt/gh-aw
const DefaultGhAwMount = "/opt/gh-aw:/opt/gh-aw:ro"

// DefaultGhBinaryMount is the mount path for the gh CLI binary in containerized MCP servers
// The gh CLI is required for agentic-workflows MCP server to run gh commands
Comment on lines +390 to +391
Copy link

Copilot AI Feb 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The hardcoded path /usr/bin/gh assumes the GitHub CLI is installed at this specific location. While this is the standard location on Ubuntu (which is used for GitHub Actions runners per the PR context), this assumption may break if:

  1. The gh CLI is installed via a different method (e.g., Homebrew, manual download) which places it elsewhere
  2. The host system has gh in a non-standard location
  3. Future changes to GitHub Actions runner images change the installation location

Consider documenting this assumption clearly in the constant's comment, or exploring a more robust approach such as:

  • Using which gh or command -v gh to dynamically determine the gh binary location during workflow setup
  • Providing a way to override this mount path via configuration
  • Adding validation in the MCP server startup to warn users if gh is not found at the expected location

Note that the PR does add gh version checking in checkAndLogGHVersion() which will warn if gh is missing, but this happens after the mount is configured and may not provide clear guidance about the mount path issue.

Suggested change
// DefaultGhBinaryMount is the mount path for the gh CLI binary in containerized MCP servers
// The gh CLI is required for agentic-workflows MCP server to run gh commands
// DefaultGhBinaryMount is the default mount path for the gh CLI binary in containerized MCP servers.
// This assumes that gh is installed at /usr/bin/gh on both the host and in the container,
// which is true for GitHub Actions Ubuntu runners but may not hold for all environments
// (e.g., Homebrew installations, custom host images, or non-Ubuntu systems).
// Callers should override this mount when gh is installed in a different location.
// The gh CLI is required for agentic-workflows MCP server to run gh commands.

Copilot uses AI. Check for mistakes.
const DefaultGhBinaryMount = "/usr/bin/gh:/usr/bin/gh:ro"

// DefaultTmpGhAwMount is the mount path for temporary gh-aw files in containerized MCP servers
// Used for logs, cache, and other runtime data that needs read-write access
const DefaultTmpGhAwMount = "/tmp/gh-aw:/tmp/gh-aw:rw"
Expand Down
8 changes: 4 additions & 4 deletions pkg/workflow/mcp_config_builtin.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -176,8 +176,8 @@ func renderAgenticWorkflowsMCPConfigWithOptions(yaml *strings.Builder, isLast bo
yaml.WriteString(" \"container\": \"" + constants.DefaultAlpineImage + "\",\n")
yaml.WriteString(" \"entrypoint\": \"/opt/gh-aw/gh-aw\",\n")
yaml.WriteString(" \"entrypointArgs\": [\"mcp-server\"],\n")
// Mount gh-aw binary (read-only), workspace (read-write for status/compile), and temp directory (read-write for logs)
yaml.WriteString(" \"mounts\": [\"" + constants.DefaultGhAwMount + "\", \"" + constants.DefaultWorkspaceMount + "\", \"" + constants.DefaultTmpGhAwMount + "\"],\n")
// Mount gh-aw binary (read-only), gh CLI binary (read-only), workspace (read-write for status/compile), and temp directory (read-write for logs)
yaml.WriteString(" \"mounts\": [\"" + constants.DefaultGhAwMount + "\", \"" + constants.DefaultGhBinaryMount + "\", \"" + constants.DefaultWorkspaceMount + "\", \"" + constants.DefaultTmpGhAwMount + "\"],\n")

// Note: tools field is NOT included here - the converter script adds it back
// for Copilot. This keeps the gateway config compatible with the schema.
Expand Down Expand Up @@ -230,8 +230,8 @@ func renderAgenticWorkflowsMCPConfigTOML(yaml *strings.Builder) {
yaml.WriteString(" container = \"" + constants.DefaultAlpineImage + "\"\n")
yaml.WriteString(" entrypoint = \"/opt/gh-aw/gh-aw\"\n")
yaml.WriteString(" entrypointArgs = [\"mcp-server\"]\n")
// Mount gh-aw binary (read-only), workspace (read-write for status/compile), and temp directory (read-write for logs)
yaml.WriteString(" mounts = [\"" + constants.DefaultGhAwMount + "\", \"" + constants.DefaultWorkspaceMount + "\", \"" + constants.DefaultTmpGhAwMount + "\"]\n")
// Mount gh-aw binary (read-only), gh CLI binary (read-only), workspace (read-write for status/compile), and temp directory (read-write for logs)
yaml.WriteString(" mounts = [\"" + constants.DefaultGhAwMount + "\", \"" + constants.DefaultGhBinaryMount + "\", \"" + constants.DefaultWorkspaceMount + "\", \"" + constants.DefaultTmpGhAwMount + "\"]\n")
// Use env_vars array to reference environment variables instead of embedding secrets
yaml.WriteString(" env_vars = [\"GITHUB_TOKEN\"]\n")
}
3 changes: 3 additions & 0 deletions pkg/workflow/mcp_config_refactor_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -107,6 +107,7 @@ func TestRenderAgenticWorkflowsMCPConfigWithOptions(t *testing.T) {
`"entrypoint": "/opt/gh-aw/gh-aw"`,
`"entrypointArgs": ["mcp-server"]`,
`"/opt/gh-aw:/opt/gh-aw:ro"`, // gh-aw binary mount (read-only)
`"/usr/bin/gh:/usr/bin/gh:ro"`, // gh CLI binary mount (read-only)
`"${{ github.workspace }}:${{ github.workspace }}:rw"`, // workspace mount (read-write)
`"/tmp/gh-aw:/tmp/gh-aw:rw"`, // temp directory mount (read-write)
`"GITHUB_TOKEN": "\${GITHUB_TOKEN}"`,
Expand All @@ -127,6 +128,7 @@ func TestRenderAgenticWorkflowsMCPConfigWithOptions(t *testing.T) {
`"entrypoint": "/opt/gh-aw/gh-aw"`,
`"entrypointArgs": ["mcp-server"]`,
`"/opt/gh-aw:/opt/gh-aw:ro"`, // gh-aw binary mount (read-only)
`"/usr/bin/gh:/usr/bin/gh:ro"`, // gh CLI binary mount (read-only)
`"${{ github.workspace }}:${{ github.workspace }}:rw"`, // workspace mount (read-write)
`"/tmp/gh-aw:/tmp/gh-aw:rw"`, // temp directory mount (read-write)
// Security fix: Now uses shell variable instead of GitHub secret expression
Expand Down Expand Up @@ -222,6 +224,7 @@ func TestRenderAgenticWorkflowsMCPConfigTOML(t *testing.T) {
`entrypoint = "/opt/gh-aw/gh-aw"`,
`entrypointArgs = ["mcp-server"]`,
`"/opt/gh-aw:/opt/gh-aw:ro"`, // gh-aw binary mount (read-only)
`"/usr/bin/gh:/usr/bin/gh:ro"`, // gh CLI binary mount (read-only)
`"${{ github.workspace }}:${{ github.workspace }}:rw"`, // workspace mount (read-write)
`"/tmp/gh-aw:/tmp/gh-aw:rw"`, // temp directory mount (read-write)
`env_vars = ["GITHUB_TOKEN"]`,
Expand Down
Loading