Split safe-inputs setup into separate JavaScript/config and tool file steps

[Copilot]

The compiler was generating all safe-inputs files in a single workflow step, mixing infrastructure setup (JavaScript modules, MCP server, configuration) with tool-specific file generation.

Changes

Modified pkg/workflow/mcp_servers.go:

• Split generateMCPSetup() to produce two sequential steps instead of one:
  1. "Setup Safe Inputs JavaScript and Config" - writes MCP server modules, handlers, and tools.json
  2. "Setup Safe Inputs Tool Files" - generates user-defined tool files (.cjs, .sh, .py)

The split occurs after chmod +x /tmp/gh-aw/safe-inputs/mcp-server.cjs, cleanly separating infrastructure from tool-specific artifacts.

Example workflow output:

- name: Setup Safe Inputs JavaScript and Config
  run: |
    mkdir -p /tmp/gh-aw/safe-inputs/logs
    cat > /tmp/gh-aw/safe-inputs/read_buffer.cjs << 'EOF'
    # ... MCP server modules ...
    cat > /tmp/gh-aw/safe-inputs/tools.json << 'EOF'
    # ... config ...
    chmod +x /tmp/gh-aw/safe-inputs/mcp-server.cjs

- name: Setup Safe Inputs Tool Files
  run: |
    cat > /tmp/gh-aw/safe-inputs/analyze-numbers.py << 'EOF'
    # ... user tool implementation ...

All workflow lock files have been recompiled to reflect the new step structure.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/user
  • Triggering command: /usr/bin/gh gh api user --jq .login ut.js GO111MODULE es/.bin/sh GOINSECURE GOMOD GOMODCACHE go env '../../**/*.json' '!../../workflow/js/**/*.json' --ignore-path -- GO111MODULE ps GOINSECURE GOMOD GOMODCACHE ps (http block)
  • Triggering command: /usr/bin/gh gh api user --jq .login '**/*.cjs' '**/*.ts' '**/*.json' GO111MODULE /usr/local/.ghcup/bin/git GOINSECURE GOMOD GOMODCACHE git add . -v ps GOSUMDB GOWORK ules/.bin/sh ps (http block)
  • Triggering command: /usr/bin/gh gh api user --jq .login d/gh-aw/main.go d/gh-aw/capitalization_test.go 20c0783ad176c7a347db4b75ff6ae03bc55/log.json GOINSECURE GOMOD GOMODCACHE ache/go/1.25.0/x64/pkg/tool/linux_amd64/compile -c /ref/tags/v8 GOPROXY 4055515/b331=> GOSUMDB GOWORK -d/gh-aw sh (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

Update the compiler to split the step that generates the safe intputs files into 2 steps. One step to write the safe inputs javascript and config files, another step to generate the tool files (js/py/sh).

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.