Copy Copilot session state files to logs before secret redaction #9279

Copilot · 2026-01-07T22:32:12Z

Copilot CLI writes session state to ~/.copilot/session-state/[session-id].jsonl but these files weren't being captured in workflow artifacts, making debugging difficult.

Changes

Added copy step in pkg/workflow/copilot_logs.go
- Modified GetFirewallLogsCollectionStep() to add session file copy step
- Added generateCopilotSessionFileCopyStep() function
- Copies ~/.copilot/session-state/*.jsonl to /tmp/gh-aw/sandbox/agent/logs/
- Step runs BEFORE secret redaction so files are scanned for secrets
- Uses if: always() and continue-on-error: true for reliability
Updated declared output files in pkg/workflow/copilot_engine.go
- GetDeclaredOutputFiles() returns only logs folder
- Session files copied to logs folder are automatically included in artifact upload
Added test coverage
- TestCopilotEngine verifies logs folder in declared output files
- TestCopilotSessionFileCopyStep validates copy step generation

Generated Workflow Steps

- name: Copy Copilot session state files to logs
  if: always()
  continue-on-error: true
  run: |
    SESSION_STATE_DIR="$HOME/.copilot/session-state"
    LOGS_DIR="/tmp/gh-aw/sandbox/agent/logs"
    
    if [ -d "$SESSION_STATE_DIR" ]; then
      echo "Copying Copilot session state files from $SESSION_STATE_DIR to $LOGS_DIR"
      mkdir -p "$LOGS_DIR"
      cp -v "$SESSION_STATE_DIR"/*.jsonl "$LOGS_DIR/" 2>/dev/null || true
      echo "Session state files copied successfully"
    fi

- name: Redact secrets in logs
  # ... secret redaction scans /tmp/gh-aw/ including copied session files

- name: Upload engine output files
  uses: actions/upload-artifact@...
  with:
    name: agent_outputs
    path: |
      /tmp/gh-aw/sandbox/agent/logs/
      /tmp/gh-aw/redacted-urls.log

Applies to 82 workflows using Copilot engine.

Original prompt

The copilot session file is located at ~/.copilot/session-state/[session id].jsonl . Make sure this file gets copied to the /tmp/gh-aw/sandbox/agent/logs/ folder.

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

Changeset

Type: patch
Description: Copy Copilot session state files (~/.copilot/session-state/*.jsonl) to /tmp/gh-aw/sandbox/agent/logs/ before secret redaction so they are included in workflow artifacts and available for debugging.

Ahoy! This treasure was crafted by 🏴‍☠️ Changeset Generator

pelikhan · 2026-01-07T22:45:40Z

@copilot this file path in the list of output files in the agentic engine interface. do not add a new step

- Modified GetFirewallLogsCollectionStep to return session file copy step - Added generateCopilotSessionFileCopyStep function to generate the copy step - Session files from ~/.copilot/session-state/*.jsonl are now copied to /tmp/gh-aw/sandbox/agent/logs/ - Added comprehensive test TestCopilotSessionFileCopyStep - Session files will be included in agent_outputs artifact - Step runs with if: always() and continue-on-error: true for reliability Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Instead of adding a copy step, add session-state path to GetDeclaredOutputFiles(): - Added /home/runner/.copilot/session-state/*.jsonl to declared output files - Updated validation to allow session-state path (safe - internal CLI state) - Updated test to verify both logs folder and session-state are declared - All 82 Copilot workflows now include session files in artifact upload Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-01-07T23:15:59Z

@copilot this file path in the list of output files in the agentic engine interface. do not add a new step

Done in 8c531a8. Added /home/runner/.copilot/session-state/*.jsonl to GetDeclaredOutputFiles() instead of creating a copy step. Updated validation to allow this path since session state files are internal CLI state (safe to upload without secret redaction).

pelikhan · 2026-01-07T23:18:46Z

@copilot add a step to copy the declared output files to the /tmp/gh-aw/agent/logs/ folder before the secret redaction as well.

- Modified GetFirewallLogsCollectionStep to add session file copy step - Added generateCopilotSessionFileCopyStep function - Copies files from ~/.copilot/session-state/ to /tmp/gh-aw/sandbox/agent/logs/ - Copy happens BEFORE secret redaction so files are scanned for secrets - Reverted GetDeclaredOutputFiles to only include logs folder - Removed special validation case for session-state path - Added test TestCopilotSessionFileCopyStep - All 82 Copilot workflows updated with copy step Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-01-07T23:30:56Z

@copilot add a step to copy the declared output files to the /tmp/gh-aw/agent/logs/ folder before the secret redaction as well.

Done in a88e3d4. Added copy step that runs before secret redaction:

Copies ~/.copilot/session-state/*.jsonl → /tmp/gh-aw/sandbox/agent/logs/
Step runs with if: always() and continue-on-error: true
Files are in /tmp/gh-aw/ where secret redaction scans them
Then uploaded in agent_outputs artifact

github-actions · 2026-01-08T00:05:43Z

🎉 Yo ho ho! Changeset Generator found the treasure and completed successfully! ⚓💰

github-actions · 2026-01-08T00:05:45Z

✅ Firewall validation complete... Smoke Codex Firewall confirmed network sandboxing is operational. 🛡️

github-actions · 2026-01-08T00:05:47Z

🎉 Yo ho ho! Smoke Copilot Safe Inputs found the treasure and completed successfully! ⚓💰

github-actions · 2026-01-08T00:05:47Z

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

github-actions · 2026-01-08T00:05:48Z

🤖 DIAGNOSTIC COMPLETE: Smoke Copilot No Firewall STATUS: ALL_UNITS_OPERATIONAL. MISSION_SUCCESS.

github-actions · 2026-01-08T00:05:48Z

🎬 THE END — Smoke Claude MISSION: ACCOMPLISHED! The hero saves the day! ✨

github-actions · 2026-01-08T00:05:49Z

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

github-actions · 2026-01-08T00:05:49Z

📰 VERDICT: Smoke Copilot Playwright has concluded. All systems operational. This is a developing story. 🎤

github-actions · 2026-01-08T00:07:37Z

Smoke Test Results

✅ File Writing: Created test file successfully
✅ Bash Tool: Verified file content
✅ Safe Input gh Tool: GitHub CLI access working

Overall Status: PASS

AI generated by Smoke Copilot Safe Inputs

github-actions · 2026-01-08T00:07:57Z

Smoke Test Results - Run 20800667277

Last 2 Merged PRs: #9062 (Protocol-specific domain filtering), #9055 (AWF logs summary)

✅ GitHub MCP - Retrieved PRs
✅ File Writing - Created agent test file
✅ Bash Tool - File verified
✅ Cache Memory - Cache file created and verified
✅ Web Fetch - api.github.com returned valid JSON
✅ Protocol Filtering - Found https://api.github.com and `(redacted) in logs
⚠️ GitHub MCP Default Toolset - get_me exists but returns 403 (permission issue, not toolset filtering)

Overall: PASS (7/7 core tests passed)

cc @Copilot @Mossaka

AI generated by Smoke Copilot

github-actions · 2026-01-08T00:08:06Z

Smoke Test Results

❌ Playwright MCP: Tool not available
❌ safeinputs-gh: Tool not available
✅ Cache Memory: Successfully wrote and verified test file

Overall Status: FAIL (2/3 tests failed - missing tools)

AI generated by Smoke Copilot Playwright

github-actions · 2026-01-08T00:08:14Z

PRs: Support protocol-specific domain filtering (http/https); Use awf logs summary for CI firewall reports
OpenAI curl blocked: ✅
GitHub MCP (last 2 merged PRs): ✅
File write/read /tmp/gh-aw/agent/smoke-test-codex-firewall-20800667292.txt: ✅
Blocked domain curl (example.com): ✅
AWF allow-domains includes https://api.github.com (log check): ❌ (no logs available)
Network: SANDBOXED | Overall: FAIL

AI generated by Smoke Codex Firewall

github-actions · 2026-01-08T00:08:25Z

Smoke Test Results - Claude (Run 20800667305)

Recent PRs:

Add workflow: githubnext/agentics/weekly-research #8: Add workflow: githubnext/agentics/weekly-research
Remove ai-inference, opencode, genaiscript agentic engines for now #10: Remove ai-inference, opencode, genaiscript agentic engines for now

Tests:

✅ GitHub MCP - Retrieved 2 PRs
✅ File Writing - Created agent test file
✅ Bash Tool - Verified file contents
✅ Playwright MCP - Navigated to GitHub, title verified
✅ Cache Memory - Created and verified cache file
✅ gh Tool - Listed 3 issues successfully

Status: PASS

AI generated by Smoke Claude

github-actions · 2026-01-08T00:08:36Z

Smoke Test Results - Copilot Engine (No Firewall)

✅ All tests passed

GitHub PR Search - Retrieved last 2 merged PRs: #9062 (Protocol-specific domain filtering), #9055 (AWF logs summary)
File Creation - Created /tmp/gh-aw/agent/smoke-test-copilot-20800667302.txt
Playwright Navigation - Navigated to https://github.com, verified page title: "GitHub · Change is constant. GitHub keeps you ahead. · GitHub"
GitHub Issues - Retrieved 3 open issues using GitHub API tools (#9268, #9260, #9254)

AI generated by Smoke Copilot No Firewall

github-actions · 2026-01-08T00:08:55Z

PR titles reviewed: Sync github-agentic-workflows.md with v0.35.1 (#9276); Remove dangerous-permissions-write feature flag suggestion from compiler errors (#9275)
GitHub MCP: ✅
File write/read: ✅
Playwright title check: ✅
Cache memory write/read: ✅
safeinputs-gh: ❌ (tool unavailable)
Overall: FAIL

AI generated by Smoke Codex

Initial plan

2110197

Copilot AI assigned Copilot and pelikhan Jan 7, 2026

Copilot started work on behalf of pelikhan January 7, 2026 22:32 View session

Copilot AI and others added 2 commits January 7, 2026 22:54

Recompile all workflows with session file copy step

3ab1346

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Copy copilot session file to logs folder~~ Copy Copilot session state files to agent logs artifact Jan 7, 2026

Copilot AI requested a review from pelikhan January 7, 2026 22:59

Copilot finished work on behalf of pelikhan January 7, 2026 22:59

Copilot started work on behalf of pelikhan January 7, 2026 23:00 View session

Copilot AI changed the title ~~Copy Copilot session state files to agent logs artifact~~ Include Copilot session state files in agent logs artifact Jan 7, 2026

Copilot finished work on behalf of pelikhan January 7, 2026 23:17

Copilot started work on behalf of pelikhan January 7, 2026 23:19 View session

Copilot AI changed the title ~~Include Copilot session state files in agent logs artifact~~ Copy Copilot session state files to logs before secret redaction Jan 7, 2026

Copilot finished work on behalf of pelikhan January 7, 2026 23:32

pelikhan added the smoke label Jan 8, 2026

github-actions bot added the smoke-copilot label Jan 8, 2026

Add changeset for Copilot session file copy [skip-ci]

aa41c82

github-actions bot added the smoke-claude label Jan 8, 2026

github-actions bot added the smoke-copilot-no-firewall label Jan 8, 2026

pelikhan marked this pull request as ready for review January 8, 2026 01:03

Merge branch 'main' into copilot/copy-session-file-to-logs

d84f1f6

pelikhan merged commit 3e01bfd into main Jan 8, 2026
45 checks passed

pelikhan deleted the copilot/copy-session-file-to-logs branch January 8, 2026 01:03

Copy Copilot session state files to logs before secret redaction #9279

Copy Copilot session state files to logs before secret redaction #9279

Uh oh!

Conversation

Copilot AI commented Jan 7, 2026 • edited by agentic-workflows-dev bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Generated Workflow Steps

Changeset

Uh oh!

pelikhan commented Jan 7, 2026

Uh oh!

Copilot AI commented Jan 7, 2026

Uh oh!

pelikhan commented Jan 7, 2026

Uh oh!

Copilot AI commented Jan 7, 2026

Uh oh!

github-actions bot commented Jan 8, 2026 • edited by agentic-workflows-dev bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Jan 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Jan 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Jan 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Jan 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Jan 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Jan 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Jan 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Jan 8, 2026

Smoke Test Results

Uh oh!

github-actions bot commented Jan 8, 2026

Smoke Test Results - Run 20800667277

Uh oh!

github-actions bot commented Jan 8, 2026

Smoke Test Results

Uh oh!

github-actions bot commented Jan 8, 2026

Uh oh!

github-actions bot commented Jan 8, 2026

Smoke Test Results - Claude (Run 20800667305)

Uh oh!

github-actions bot commented Jan 8, 2026

Smoke Test Results - Copilot Engine (No Firewall)

Uh oh!

github-actions bot commented Jan 8, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Copilot AI commented Jan 7, 2026 •

edited by agentic-workflows-dev bot

Loading

github-actions bot commented Jan 8, 2026 •

edited by agentic-workflows-dev bot

Loading

github-actions bot commented Jan 8, 2026 •

edited

Loading

github-actions bot commented Jan 8, 2026 •

edited

Loading

github-actions bot commented Jan 8, 2026 •

edited

Loading

github-actions bot commented Jan 8, 2026 •

edited

Loading

github-actions bot commented Jan 8, 2026 •

edited

Loading

github-actions bot commented Jan 8, 2026 •

edited

Loading

github-actions bot commented Jan 8, 2026 •

edited

Loading