Scope env variables to agent job with compile-time validation#16279
Closed
Scope env variables to agent job with compile-time validation#16279
Conversation
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copilot
AI
changed the title
[WIP] Restrict env values to agent job only
Scope env variables to agent job instead of workflow-level
Feb 17, 2026
Contributor
|
@copilot update documentation |
Contributor
|
@copilot lint go |
Contributor
There was a problem hiding this comment.
Pull request overview
This pull request changes the scope of environment variables defined in workflow frontmatter from workflow-level (global) to agent job-level (scoped). This ensures that custom environment variables only apply to the agent job where the AI execution happens, not to supporting jobs like activation or pre_activation.
Changes:
- Added
EnvMap map[string]stringtoWorkflowDatastruct to store env variables separately from the legacy YAML string representation - Modified extraction logic to parse frontmatter
envsection intoEnvMapduring workflow orchestration - Updated agent job rendering to merge frontmatter env variables alongside safe-outputs and workflow ID variables
- Removed global env rendering from
generateWorkflowBodyin compiler_yaml.go - Added comprehensive tests for env scoping behavior
- Regenerated stale-repo-identifier.lock.yml to demonstrate the change
Reviewed changes
Copilot reviewed 9 out of 9 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| pkg/workflow/compiler_types.go | Added EnvMap field to WorkflowData struct for storing env variables as a map |
| pkg/workflow/compiler_orchestrator_workflow.go | Added extraction logic to parse frontmatter env section into EnvMap |
| pkg/workflow/compiler_activation_jobs.go | Modified agent job builder to merge frontmatter env variables with system env variables |
| pkg/workflow/compiler_yaml.go | Removed global env rendering and added explanatory comment |
| pkg/workflow/env_scoping_test.go | Added comprehensive unit tests for env scoping behavior |
| pkg/workflow/compiler_yaml_helpers_test.go | Updated test to reflect that env is no longer rendered globally |
| pkg/workflow/testdata/env-scoping.md | Added test workflow with env variables |
| pkg/workflow/testdata/env-scoping.lock.yml | Generated lock file showing env variables scoped to agent job |
| .github/workflows/stale-repo-identifier.lock.yml | Updated to move ORGANIZATION env variable from global to agent job level |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
181
to
183
| if strValue, ok := value.(string); ok { | ||
| workflowData.EnvMap[key] = strValue | ||
| } |
There was a problem hiding this comment.
The extraction logic only handles string values for env variables, silently skipping non-string types like numbers, booleans, or null values. This means env variables like DEBUG_MODE: true or PORT: 3000 would be silently dropped from the EnvMap and not rendered in the agent job.
Consider using fmt.Sprintf("%v", value) or similar type conversion to handle all value types, similar to how extractYAMLValue handles different types in frontmatter_extraction_yaml.go lines 17-36.
Suggested change
| if strValue, ok := value.(string); ok { | |
| workflowData.EnvMap[key] = strValue | |
| } | |
| workflowData.EnvMap[key] = fmt.Sprintf("%v", value) |
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
Documentation updated in commit b03b0df:
The key change: Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
Go linting requires golangci-lint which is not installed in this environment. However, I've verified the code with: ✅ Full linting with golangci-lint will run in CI. The changes follow established patterns in the codebase and include proper error handling and logging. Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Contributor
|
@copilot make sure env variables are sorted and stable ordering (go env keys is not ordered) |
Contributor
Author
Env variables already have sorted and stable ordering. The // Sort environment variable keys for consistent output
envKeys := make([]string, 0, len(job.Env))
for key := range job.Env {
envKeys = append(envKeys, key)
}
sort.Strings(envKeys)Verified with test
|
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
|
@copilot refuse GH_AW_ environnement variables in the frontmatter "env" section at compile time. They are reserved. |
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copilot stopped work on behalf of
pelikhan due to an error
February 17, 2026 03:34
Contributor
|
@copilot keep working |
Contributor
Author
Compile-time validation complete in commit 68ea321:
Tested validation: ✅ All 154 existing workflows compile successfully (no workflows use reserved names) Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
Copilot
AI
changed the title
Scope env variables to agent job instead of workflow-level
Scope env variables to agent job with compile-time validation
Feb 17, 2026
Contributor
|
@copilot lint go |
Contributor
|
@copilot lint go |
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
Go linting complete in commit a6a4bc9: ✅ The code follows established patterns in the codebase with proper error handling, logging, and test coverage. Full golangci-lint will run in CI. Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
Contributor
Author
Contributor
|
@copilot lint go |
Contributor
Author
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fix: Apply env values from frontmatter only to agent job
Problem
The
envvalues from the front matter were being applied globally at the workflow level, affecting all jobs. They should only be applied to the agent job.Solution - Complete ✅
EnvMapfield toWorkflowDatato store env asmap[string]stringcompiler_orchestrator_workflow.goto extract env from frontmatter as a map with compile-time validationbuildMainJobto merge frontmatter env with job-level envgenerateWorkflowBodyenv_scoping_test.go)Changes Made
Core Changes
pkg/workflow/compiler_types.go: AddedEnvMap map[string]stringfield toWorkflowDatapkg/workflow/compiler_orchestrator_workflow.go: Extract env from frontmatter withfmt.Sprintf("%v", value)for type conversion and compile-time validation that rejects reserved variable names (GH_AW_*, DEFAULT_BRANCH)pkg/workflow/compiler_activation_jobs.go: Merge frontmatter env into agent job env (validation ensures no reserved names present)pkg/workflow/compiler_yaml.go: Remove global env rendering (with explanatory comment)Test Changes
pkg/workflow/compiler_yaml_helpers_test.go: Updated test to not expect global envpkg/workflow/env_scoping_test.go: Comprehensive tests including:Documentation Updates
docs/src/content/docs/reference/frontmatter.md: Updated env section to clarify agent job scopedocs/src/content/docs/reference/environment-variables.md: Updated scope table, precedence rules, and examplespkg/parser/schemas/main_workflow_schema.json: Updated env description in JSON schemaTest Workflows
pkg/workflow/testdata/env-scoping.md: Test workflow with env variablespkg/workflow/testdata/env-scoping.lock.yml: Compiled workflow showing job-scoped envValidation Examples
Reserved env variable names are rejected at compile time:
Verification
go vet ./pkg/workflow/...- clean (0 issues)go fmt ./pkg/workflow/...- clean (formatting applied)✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.