Uh oh!
There was an error while loading. Please reload this page.
fix(copilot): support arbitrary HOME directory, not just /home/runner - #38725
Conversation
✅ PR Code Quality Reviewer completed the code quality review. |
🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅ |
🧪 Test Quality Sentinel completed test quality analysis. |
❌ Design Decision Gate 🏗️ failed to deliver outputs during design decision gate check. |
There was a problem hiding this comment.
Pull request overview
This PR tightens Copilot MCP config path handling so Copilot config/state locations are derived from HOME (keeping GitHub-hosted runner defaults intact), and updates setup/conversion scripts plus generated artifacts to reflect the resolved Copilot MCP config path.
Changes:
- Introduces centralized Copilot path helpers and uses them when rendering Copilot MCP config steps.
- Updates gateway start/conversion scripts (bash + Node) to resolve the Copilot MCP config path via
GH_AW_MCP_CONFIGwith a backward-compatible default. - Regenerates goldens and workflow lockfiles to reflect the new Copilot MCP config path handling.
Show a summary per file
| File | Description |
|---|---|
| pkg/workflow/threat_detection.go | Adjusts detection-job cleanup to remove MCP config artifacts (now parameterized). |
| pkg/workflow/copilot_paths.go | Adds helper functions/constants to derive Copilot config paths from workflow HOME. |
| pkg/workflow/copilot_mcp.go | Uses derived Copilot paths when emitting the MCP config setup step. |
| docs/src/content/docs/reference/self-hosted-runners.md | Documents self-hosted runner considerations for Copilot config placement. |
| actions/setup/sh/start_mcp_gateway.sh | Resolves Copilot config dir from GH_AW_MCP_CONFIG default and uses it for engine detection/fallback write path. |
| actions/setup/sh/install_copilot_cli.sh | Derives Copilot directory from GH_AW_MCP_CONFIG (with default) before ownership repair. |
| actions/setup/sh/install_copilot_cli_test.sh | Adds a shell test asserting install_copilot_cli.sh derives Copilot dir from GH_AW_MCP_CONFIG and avoids runner:runner. |
| actions/setup/sh/convert_gateway_config_copilot.sh | Writes Copilot config to GH_AW_MCP_CONFIG (defaulting to /home/runner/.copilot/mcp-config.json) and ensures parent dir exists. |
| actions/setup/sh/convert_gateway_config_copilot_test.sh | Adds a shell test verifying Copilot converter honors GH_AW_MCP_CONFIG and sets mode 600. |
| actions/setup/js/start_mcp_gateway.cjs | Resolves Copilot MCP config path and uses it for detection/fallback writes with secure permissions. |
| actions/setup/js/convert_gateway_config_shared.cjs | Adds a shared DEFAULT_COPILOT_MCP_CONFIG_PATH constant and a resolver helper. |
| actions/setup/js/convert_gateway_config_copilot.cjs | Writes Copilot config to the resolved GH_AW_MCP_CONFIG path (default fallback). |
| pkg/workflow/testdata/TestWasmGolden_CompileFixtures/with-imports.golden | Updates expected compiled workflow output to export GH_AW_MCP_CONFIG before gateway start. |
| pkg/workflow/testdata/TestWasmGolden_CompileFixtures/smoke-copilot.golden | Same as above for the smoke fixture. |
| pkg/workflow/testdata/TestWasmGolden_CompileFixtures/playwright-cli-mode.golden | Same as above for the Playwright CLI mode fixture. |
| pkg/workflow/testdata/TestWasmGolden_CompileFixtures/basic-copilot.golden | Same as above for the basic Copilot fixture. |
| pkg/workflow/testdata/TestWasmGolden_AllEngines/copilot.golden | Same as above for the all-engines Copilot fixture. |
| .github/workflows/workflow-normalizer.lock.yml | Updates Copilot MCP config export/cleanup paths in the locked workflow. |
| .github/workflows/workflow-health-manager.lock.yml | Updates Copilot MCP config export/cleanup paths in the locked workflow. |
| .github/workflows/workflow-generator.lock.yml | Updates Copilot MCP config export/cleanup paths in the locked workflow. |
| .github/workflows/video-analyzer.lock.yml | Updates Copilot MCP config export/cleanup paths in the locked workflow. |
| .github/workflows/update-astro.lock.yml | Updates Copilot MCP config export/cleanup paths in the locked workflow. |
| .github/workflows/unbloat-docs.lock.yml | Updates Copilot MCP config cleanup path in the locked workflow. |
| .github/workflows/typist.lock.yml | Updates Copilot MCP config cleanup path in the locked workflow. |
| .github/workflows/tidy.lock.yml | Updates Copilot MCP config export/cleanup paths in the locked workflow. |
| .github/workflows/test-workflow.lock.yml | Updates Copilot MCP config export path in the locked workflow. |
| .github/workflows/test-quality-sentinel.lock.yml | Updates Copilot MCP config export/cleanup paths in the locked workflow. |
| .github/workflows/test-project-url-default.lock.yml | Updates Copilot MCP config export/cleanup paths in the locked workflow. |
| .github/workflows/test-dispatcher.lock.yml | Updates Copilot MCP config export/cleanup paths in the locked workflow. |
| .github/workflows/test-create-pr-error-handling.lock.yml | Updates Copilot MCP config cleanup path in the locked workflow. |
| .github/workflows/super-linter.lock.yml | Updates Copilot MCP config export/cleanup paths in the locked workflow. |
| .github/workflows/step-name-alignment.lock.yml | Updates Copilot MCP config cleanup path in the locked workflow. |
| .github/workflows/static-analysis-report.lock.yml | Updates Copilot MCP config cleanup path in the locked workflow. |
| .github/workflows/spec-librarian.lock.yml | Updates Copilot MCP config export/cleanup paths in the locked workflow. |
| .github/workflows/spec-extractor.lock.yml | Updates Copilot MCP config export/cleanup paths in the locked workflow. |
| .github/workflows/spec-enforcer.lock.yml | Updates Copilot MCP config cleanup path in the locked workflow. |
| .github/workflows/smoke-test-tools.lock.yml | Updates Copilot MCP config export/cleanup paths in the locked workflow. |
| .github/workflows/smoke-pi.lock.yml | Updates Copilot MCP config cleanup path in the locked workflow. |
| .github/workflows/smoke-opencode.lock.yml | Updates Copilot MCP config cleanup path in the locked workflow. |
| .github/workflows/smoke-gemini.lock.yml | Updates Copilot MCP config cleanup path in the locked workflow. |
| .github/workflows/smoke-crush.lock.yml | Updates Copilot MCP config cleanup path in the locked workflow. |
| .github/workflows/smoke-copilot-sdk.lock.yml | Updates Copilot MCP config export/cleanup paths in the locked workflow. |
| .github/workflows/smoke-codex.lock.yml | Updates Copilot MCP config cleanup path in the locked workflow. |
| .github/workflows/smoke-claude.lock.yml | Updates Copilot MCP config cleanup path in the locked workflow. |
| .github/workflows/smoke-ci.lock.yml | Updates Copilot MCP config export path in the locked workflow. |
| .github/workflows/smoke-call-workflow.lock.yml | Updates Copilot MCP config cleanup path in the locked workflow. |
| .github/workflows/smoke-antigravity.lock.yml | Updates Copilot MCP config cleanup path in the locked workflow. |
| .github/workflows/smoke-agent-scoped-approved.lock.yml | Updates Copilot MCP config cleanup path in the locked workflow. |
| .github/workflows/smoke-agent-public-none.lock.yml | Updates Copilot MCP config cleanup path in the locked workflow. |
| .github/workflows/smoke-agent-public-approved.lock.yml | Updates Copilot MCP config cleanup path in the locked workflow. |
| .github/workflows/smoke-agent-all-none.lock.yml | Updates Copilot MCP config cleanup path in the locked workflow. |
| .github/workflows/smoke-agent-all-merged.lock.yml | Updates Copilot MCP config cleanup path in the locked workflow. |
| .github/workflows/sergo.lock.yml | Updates Copilot MCP config cleanup path in the locked workflow. |
| .github/workflows/semantic-function-refactor.lock.yml | Updates Copilot MCP config cleanup path in the locked workflow. |
| .github/workflows/security-review.lock.yml | Updates Copilot MCP config export/cleanup paths in the locked workflow. |
| .github/workflows/security-compliance.lock.yml | Updates Copilot MCP config export/cleanup paths in the locked workflow. |
| .github/workflows/scout.lock.yml | Updates Copilot MCP config cleanup path in the locked workflow. |
| .github/workflows/schema-feature-coverage.lock.yml | Updates Copilot MCP config cleanup path in the locked workflow. |
| .github/workflows/schema-consistency-checker.lock.yml | Updates Copilot MCP config cleanup path in the locked workflow. |
| .github/workflows/safe-output-health.lock.yml | Updates Copilot MCP config cleanup path in the locked workflow. |
| .github/workflows/ruflo-backed-task.lock.yml | Updates Copilot MCP config cleanup path in the locked workflow. |
| .github/workflows/research.lock.yml | Updates Copilot MCP config export/cleanup paths in the locked workflow. |
| .github/workflows/repo-tree-map.lock.yml | Updates Copilot MCP config export/cleanup paths in the locked workflow. |
| .github/workflows/release.lock.yml | Updates Copilot MCP config export path in the locked workflow. |
| .github/workflows/refiner.lock.yml | Updates Copilot MCP config export/cleanup paths in the locked workflow. |
| .github/workflows/q.lock.yml | Updates Copilot MCP config export/cleanup paths in the locked workflow. |
| .github/workflows/python-data-charts.lock.yml | Updates Copilot MCP config export/cleanup paths in the locked workflow. |
| .github/workflows/prompt-clustering-analysis.lock.yml | Updates Copilot MCP config cleanup path in the locked workflow. |
| .github/workflows/pr-description-caveman.lock.yml | Updates Copilot MCP config export/cleanup paths in the locked workflow. |
| .github/workflows/plan.lock.yml | Updates Copilot MCP config export/cleanup paths in the locked workflow. |
| .github/workflows/pdf-summary.lock.yml | Updates Copilot MCP config export/cleanup paths in the locked workflow. |
| .github/workflows/outcome-collector.lock.yml | Updates Copilot MCP config export/cleanup paths in the locked workflow. |
| .github/workflows/org-health-report.lock.yml | Updates Copilot MCP config export/cleanup paths in the locked workflow. |
| .github/workflows/objective-impact-report.lock.yml | Updates Copilot MCP config export/cleanup paths in the locked workflow. |
| .github/workflows/necromancer.lock.yml | Updates Copilot MCP config cleanup path in the locked workflow. |
| .github/workflows/metrics-collector.lock.yml | Updates Copilot MCP config export/cleanup paths in the locked workflow. |
| .github/workflows/mergefest.lock.yml | Updates Copilot MCP config export/cleanup paths in the locked workflow. |
| .github/workflows/lockfile-stats.lock.yml | Updates Copilot MCP config cleanup path in the locked workflow. |
| .github/workflows/linter-miner.lock.yml | Updates Copilot MCP config export/cleanup paths in the locked workflow. |
| .github/workflows/lint-monster.lock.yml | Updates Copilot MCP config export/cleanup paths in the locked workflow. |
| .github/workflows/layout-spec-maintainer.lock.yml | Updates Copilot MCP config export/cleanup paths in the locked workflow. |
| .github/workflows/jsweep.lock.yml | Updates Copilot MCP config export/cleanup paths in the locked workflow. |
| .github/workflows/issue-arborist.lock.yml | Updates Copilot MCP config cleanup path in the locked workflow. |
| .github/workflows/instructions-janitor.lock.yml | Updates Copilot MCP config cleanup path in the locked workflow. |
| .github/workflows/hourly-ci-cleaner.lock.yml | Updates Copilot MCP config cleanup path in the locked workflow. |
| .github/workflows/hippo-embed.lock.yml | Updates Copilot MCP config export path in the locked workflow. |
| .github/workflows/grumpy-reviewer.lock.yml | Updates Copilot MCP config cleanup path in the locked workflow. |
| .github/workflows/gpclean.lock.yml | Updates Copilot MCP config export/cleanup paths in the locked workflow. |
| .github/workflows/go-pattern-detector.lock.yml | Updates Copilot MCP config cleanup path in the locked workflow. |
| .github/workflows/go-logger.lock.yml | Updates Copilot MCP config cleanup path in the locked workflow. |
| .github/workflows/go-fan.lock.yml | Updates Copilot MCP config cleanup path in the locked workflow. |
| .github/workflows/github-mcp-tools-report.lock.yml | Updates Copilot MCP config cleanup path in the locked workflow. |
| .github/workflows/github-mcp-structural-analysis.lock.yml | Updates Copilot MCP config cleanup path in the locked workflow. |
| .github/workflows/firewall.lock.yml | Updates Copilot MCP config export path in the locked workflow. |
| .github/workflows/firewall-escape.lock.yml | Updates Copilot MCP config export/cleanup paths in the locked workflow. |
| .github/workflows/example-workflow-analyzer.lock.yml | Updates Copilot MCP config cleanup path in the locked workflow. |
| .github/workflows/example-permissions-warning.lock.yml | Updates Copilot MCP config export path in the locked workflow. |
| .github/workflows/duplicate-code-detector.lock.yml | Updates Copilot MCP config cleanup path in the locked workflow. |
| .github/workflows/docs-noob-tester.lock.yml | Updates Copilot MCP config export path in the locked workflow. |
| .github/workflows/developer-docs-consolidator.lock.yml | Updates Copilot MCP config cleanup path in the locked workflow. |
| .github/workflows/dev.lock.yml | Updates Copilot MCP config cleanup path in the locked workflow. |
| .github/workflows/dev-hawk.lock.yml | Updates Copilot MCP config export/cleanup paths in the locked workflow. |
| .github/workflows/designer-drift-audit.lock.yml | Updates Copilot MCP config export path in the locked workflow. |
| .github/workflows/design-decision-gate.lock.yml | Updates Copilot MCP config cleanup path in the locked workflow. |
| .github/workflows/dependabot-worker.lock.yml | Updates Copilot MCP config export/cleanup paths in the locked workflow. |
| .github/workflows/dependabot-repair.lock.yml | Updates Copilot MCP config export/cleanup paths in the locked workflow. |
| .github/workflows/delight.lock.yml | Updates Copilot MCP config export/cleanup paths in the locked workflow. |
| .github/workflows/deep-report.lock.yml | Updates Copilot MCP config cleanup path in the locked workflow. |
| .github/workflows/daily-windows-terminal-integration-builder.lock.yml | Updates Copilot MCP config export path in the locked workflow. |
| .github/workflows/daily-token-consumption-report.lock.yml | Updates Copilot MCP config cleanup path in the locked workflow. |
| .github/workflows/daily-team-status.lock.yml | Updates Copilot MCP config export/cleanup paths in the locked workflow. |
| .github/workflows/daily-team-evolution-insights.lock.yml | Updates Copilot MCP config cleanup path in the locked workflow. |
| .github/workflows/daily-security-red-team.lock.yml | Updates Copilot MCP config cleanup path in the locked workflow. |
| .github/workflows/daily-safeoutputs-git-simulator.lock.yml | Updates Copilot MCP config cleanup path in the locked workflow. |
| .github/workflows/daily-safe-outputs-conformance.lock.yml | Updates Copilot MCP config cleanup path in the locked workflow. |
| .github/workflows/daily-safe-output-optimizer.lock.yml | Updates Copilot MCP config cleanup path in the locked workflow. |
| .github/workflows/daily-rendering-scripts-verifier.lock.yml | Updates Copilot MCP config cleanup path in the locked workflow. |
| .github/workflows/daily-reliability-review.lock.yml | Updates Copilot MCP config cleanup path in the locked workflow. |
| .github/workflows/daily-observability-report.lock.yml | Updates Copilot MCP config cleanup path in the locked workflow. |
| .github/workflows/daily-news.lock.yml | Updates Copilot MCP config export/cleanup paths in the locked workflow. |
| .github/workflows/daily-multi-device-docs-tester.lock.yml | Updates Copilot MCP config cleanup path in the locked workflow. |
| .github/workflows/daily-model-inventory.lock.yml | Updates Copilot MCP config export path in the locked workflow. |
| .github/workflows/daily-max-ai-credits-test.lock.yml | Updates Copilot MCP config export path in the locked workflow. |
| .github/workflows/daily-malicious-code-scan.lock.yml | Updates Copilot MCP config export path in the locked workflow. |
| .github/workflows/daily-function-namer.lock.yml | Updates Copilot MCP config cleanup path in the locked workflow. |
| .github/workflows/daily-firewall-report.lock.yml | Updates Copilot MCP config export/cleanup paths in the locked workflow. |
| .github/workflows/daily-fact.lock.yml | Updates Copilot MCP config cleanup path in the locked workflow. |
| .github/workflows/daily-doc-updater.lock.yml | Updates Copilot MCP config cleanup path in the locked workflow. |
| .github/workflows/daily-doc-healer.lock.yml | Updates Copilot MCP config cleanup path in the locked workflow. |
| .github/workflows/daily-credit-limit-test.lock.yml | Updates Copilot MCP config export/cleanup paths in the locked workflow. |
| .github/workflows/daily-code-metrics.lock.yml | Updates Copilot MCP config cleanup path in the locked workflow. |
| .github/workflows/daily-choice-test.lock.yml | Updates Copilot MCP config cleanup path in the locked workflow. |
| .github/workflows/daily-caveman-optimizer.lock.yml | Updates Copilot MCP config cleanup path in the locked workflow. |
| .github/workflows/daily-cache-strategy-analyzer.lock.yml | Updates Copilot MCP config cleanup path in the locked workflow. |
| .github/workflows/daily-byok-ollama-test.lock.yml | Updates Copilot MCP config export/cleanup paths in the locked workflow. |
| .github/workflows/daily-awf-spec-compiler-surfacing.lock.yml | Updates Copilot MCP config cleanup path in the locked workflow. |
| .github/workflows/daily-aw-cross-repo-compile-check.lock.yml | Updates Copilot MCP config cleanup path in the locked workflow. |
| .github/workflows/daily-astrostylelite-markdown-spellcheck.lock.yml | Updates Copilot MCP config cleanup path in the locked workflow. |
| .github/workflows/daily-agentrx-trace-optimizer.lock.yml | Updates Copilot MCP config cleanup path in the locked workflow. |
| .github/workflows/craft.lock.yml | Updates Copilot MCP config export/cleanup paths in the locked workflow. |
| .github/workflows/copilot-session-insights.lock.yml | Updates Copilot MCP config cleanup path in the locked workflow. |
| .github/workflows/copilot-opt.lock.yml | Updates Copilot MCP config export/cleanup paths in the locked workflow. |
| .github/workflows/copilot-agent-analysis.lock.yml | Updates Copilot MCP config cleanup path in the locked workflow. |
| .github/workflows/contribution-check.lock.yml | Updates Copilot MCP config export/cleanup paths in the locked workflow. |
| .github/workflows/constraint-solving-potd.lock.yml | Updates Copilot MCP config export/cleanup paths in the locked workflow. |
| .github/workflows/commit-changes-analyzer.lock.yml | Updates Copilot MCP config cleanup path in the locked workflow. |
| .github/workflows/code-simplifier.lock.yml | Updates Copilot MCP config export/cleanup paths in the locked workflow. |
| .github/workflows/cloclo.lock.yml | Updates Copilot MCP config cleanup path in the locked workflow. |
| .github/workflows/cli-version-checker.lock.yml | Updates Copilot MCP config cleanup path in the locked workflow. |
| .github/workflows/claude-code-user-docs-review.lock.yml | Updates Copilot MCP config cleanup path in the locked workflow. |
| .github/workflows/ci-doctor.lock.yml | Updates Copilot MCP config cleanup path in the locked workflow. |
| .github/workflows/ci-coach.lock.yml | Updates Copilot MCP config export/cleanup paths in the locked workflow. |
| .github/workflows/brave.lock.yml | Updates Copilot MCP config export/cleanup paths in the locked workflow. |
| .github/workflows/bot-detection.lock.yml | Updates Copilot MCP config export path in the locked workflow. |
| .github/workflows/blog-auditor.lock.yml | Updates Copilot MCP config cleanup path in the locked workflow. |
| .github/workflows/aw-failure-investigator.lock.yml | Updates Copilot MCP config cleanup path in the locked workflow. |
| .github/workflows/avenger.lock.yml | Updates Copilot MCP config cleanup path in the locked workflow. |
| .github/workflows/audit-workflows.lock.yml | Updates Copilot MCP config cleanup path in the locked workflow. |
| .github/workflows/artifacts-summary.lock.yml | Updates Copilot MCP config export/cleanup paths in the locked workflow. |
| .github/workflows/architecture-guardian.lock.yml | Updates Copilot MCP config export/cleanup paths in the locked workflow. |
| .github/workflows/archie.lock.yml | Updates Copilot MCP config export/cleanup paths in the locked workflow. |
| .github/workflows/approach-validator.lock.yml | Updates Copilot MCP config cleanup path in the locked workflow. |
| .github/workflows/api-consumption-report.lock.yml | Updates Copilot MCP config cleanup path in the locked workflow. |
| .github/workflows/agentic-token-trend-audit.lock.yml | Updates Copilot MCP config export path in the locked workflow. |
| .github/workflows/agentic-token-optimizer.lock.yml | Updates Copilot MCP config export path in the locked workflow. |
| .github/workflows/agentic-token-audit.lock.yml | Updates Copilot MCP config export/cleanup paths in the locked workflow. |
| .github/workflows/ace-editor.lock.yml | Updates Copilot MCP config export path in the locked workflow. |
Copilot's findings
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 262/262 changed files
- Comments generated: 3
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
61d100b to
c4814bbComparepelikhan
commented
Jun 11, 2026
oops sorry i mechanically synched it |
There was a problem hiding this comment.
Two blocking issues need to be resolved before merge.
### Blocking issues
1. Installer step targets the wrong directory on self-hosted runners (install_copilot_cli.sh line 27)
The installer script now derives COPILOT_DIR from GH_AW_MCP_CONFIG, but GH_AW_MCP_CONFIG is not injected into the installer step — that env var only reaches the agent execution step. On a self-hosted runner with HOME=/srv/gha, the installer creates and chowns /home/runner/.copilot (the hardcoded default) while the agent later uses /srv/gha/.copilot. The previous code used "${HOME}/.copilot" which naturally picked up the runner's real home. This regression directly breaks the goal of the PR.
2. Documentation tells users to set engine.env.GH_AW_MCP_CONFIG (self-hosted-runners.md line 179)
The docs were written against the first commit. The second commit (0f61e58) replaced GH_AW_MCP_CONFIG-based override with HOME-based override, but the docs were never updated. Users following this doc will set the wrong key and see no error.
🔎 Code quality review by PR Code Quality Reviewer · 627.9 AIC · ⌖ 14 AIC · ⊞ 16.7K
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
🧪 Test Quality Sentinel Report✅ Test Quality Score: 80/100 — Excellent
📊 Metrics & Test Classification (3 tests analyzed)
Test Classification Details
Language SupportTests analyzed:
Verdict
📖 Understanding Test ClassificationsDesign Tests (High Value) verify what the system does:
Implementation Tests (Low Value) verify how the system does it:
Goal: Shift toward tests that describe the system's behavioral contract — the promises it makes to its users and collaborators. References:§27383667182
|
There was a problem hiding this comment.
Skills-Based Review 🧠
Applied /zoom-out — requesting one change: the lock files need regeneration to match the final Go source.
📋 Key Themes & Findings
Critical: Lock files are stale
The PR contains two rounds of Go source changes:
| Commit | Change |
|---|---|
6ca2901 | Added the conditional guard pattern and regenerated lock files |
0f61e58 | Simplified back to a direct export pattern — but lock files were not regenerated |
As a result, every .lock.yml in this PR emits:
if [ -z"${GH_AW_MCP_CONFIG:-}" ];thenexport GH_AW_MCP_CONFIG=/home/runner/.copilot/mcp-config.json;fi
mkdir -p "$(dirname "${GH_AW_MCP_CONFIG}")"while pkg/workflow/copilot_mcp.go (current HEAD) would generate:
export GH_AW_MCP_CONFIG=/home/runner/.copilot/mcp-config.json
mkdir -p /home/runner/.copilotThis is not cosmetic — the conditional preserves a pre-set GH_AW_MCP_CONFIG, which contradicts the stated goal of stopping GH_AW_MCP_CONFIG from acting as an override. Run make recompile from the branch tip to fix all lock files in one shot.
Positive Highlights
- ✅
copilot_paths.gorefactor is clean — deriving all paths fromHOMEviacopilotHomeForWorkflowmakes the relationship explicit. - ✅ Asserting
XDG_CONFIG_HOMEandGH_AW_MCP_CONFIGafter theengine.envmerge correctly prevents user-supplied values from redirecting config placement. - ✅ The threat-detection cleanup (
rm -f "${GH_AW_MCP_CONFIG:-/home/runner/.copilot/mcp-config.json}") is a well-written safe fallback. - ✅ Test cases for the HOME-override scenario clearly document that a caller-supplied
GH_AW_MCP_CONFIGinengine.envis intentionally ignored.
Warning
Firewall blocked 1 domain
The following domain was blocked by the firewall during workflow execution:
proxy.golang.org
To allow these domains, add them to the
network.allowedlist in your workflow frontmatter:
network:
allowed:
- defaults
- "proxy.golang.org"See Network Configuration for more information.
🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer · 838 AIC · ⌖ 13.4 AIC · ⊞ 27.8K
c4814bb to
a152f15Compare🚀 Smoke AntigravityMISSION COMPLETE! Antigravity has spoken. ✨ |
🚀 Smoke PiMISSION COMPLETE! Pi delivered. 🥧 |
✅ All tools validated successfully! Agent Container Smoke Test confirms agent container is ready. |
🎬 THE END — Smoke ClaudeMISSION: ACCOMPLISHED! The hero saves the day! ✨ |
🌑 The shadows whisper... Smoke Codex failed to deliver outputs. The oracle requires further meditation... |
📰 BREAKING: Smoke Copilot - AOAI (apikey) is now investigating this pull request. Sources say the story is developing... |
📰 BREAKING: Smoke Copilot is now investigating this pull request. Sources say the story is developing... |
Agent Container Tool Check
Result: 12/12 tools available ✅ Overall Status: PASS
|
💥 Smoke Test: Claude — Run 27387269540Core #1-12: ✅ all passed Warning Firewall blocked 6 domainsThe following domains were blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "accounts.google.com"
- "android.clients.google.com"
- "clients2.google.com"
- "contentautofill.googleapis.com"
- "safebrowsingohttpgateway.googleapis.com"
- "www.google.com"See Network Configuration for more information.
|
There was a problem hiding this comment.
💥 Automated smoke test review - all systems nominal!
Warning
Firewall blocked 6 domains
The following domains were blocked by the firewall during workflow execution:
accounts.google.comandroid.clients.google.comclients2.google.comcontentautofill.googleapis.comsafebrowsingohttpgateway.googleapis.comwww.google.com
To allow these domains, add them to the
network.allowedlist in your workflow frontmatter:
network:
allowed:
- defaults
- "accounts.google.com"
- "android.clients.google.com"
- "clients2.google.com"
- "contentautofill.googleapis.com"
- "safebrowsingohttpgateway.googleapis.com"
- "www.google.com"See Network Configuration for more information.
💥 [THE END] — Illustrated by Smoke Claude · 65.2 AIC · ⌖ 25.6 AIC · ⊞ 8.1K
Comments that could not be inline-anchored
.changeset/patch-copilot-home-expansion-self-hosted-runners.md:5
Nice clear changeset entry explaining the HOME-based path resolution and the expected mechanical lock-file diffs. 👍
.github/skills/http-mcp-headers/SKILL.md:9
Consider linking to the relevant copilot engine source so readers can jump straight to the implementation.
zarenner
commented
Jun 12, 2026
This PR is still missing some fixes for |
Smoke test status: FAIL\n✅ PR reads; Serena; Playwright; file write; bash verify; build; comment memory; cache memory; issue field\n❌ web-fetch tool unavailable\nOverall: FAIL Warning Firewall blocked 6 domainsThe following domains were blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "accounts.google.com"
- "android.clients.google.com"
- "clients2.google.com"
- "contentautofill.googleapis.com"
- "safebrowsingohttpgateway.googleapis.com"
- "www.google.com"See Network Configuration for more information.
|
Comment MemoryNote This comment is managed by comment memory.It stores persistent context for this thread in the code block at the top of this comment. Warning Firewall blocked 6 domainsThe following domains were blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "accounts.google.com"
- "android.clients.google.com"
- "clients2.google.com"
- "contentautofill.googleapis.com"
- "safebrowsingohttpgateway.googleapis.com"
- "www.google.com"See Network Configuration for more information.
|
Smoke tests:
|
Smoke test: fix(copilot): support arbitrary HOME directory, not just /home/runner Warning Firewall blocked 6 domainsThe following domains were blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "accounts.google.com"
- "android.clients.google.com"
- "clients2.google.com"
- "contentautofill.googleapis.com"
- "safebrowsingohttpgateway.googleapis.com"
- "www.google.com"See Network Configuration for more information.
|
zarenner
commented
Jun 12, 2026
Smoke Copilot looking good with $HOME changes, merging. Will continue to hunt additional |
Problem
The Copilot engine generator hard-coded
/home/runner/.copilot(andXDG_CONFIG_HOME=/home/runner) in several places. This breaks workflows on self-hosted, containerized, or rootless runners where$HOMEis not/home/runner(e.g./home/actions,/root,/var/lib/runner). On those runners the Copilot CLI would either fail to find its config or write it into the wrong place, depending on how~was resolved.Additionally, two of the affected paths were emitted into the YAML
env:block, where GitHub Actions does not shell-expand values. That meant any$HOME-based value put there would be passed to the agent as the literal string$HOME/..., not the resolved path — so the fix isn't just "search/replace/home/runnerwith$HOME"; it also requires moving certain vars out of YAMLenv:and into therun:script where the shell does expand.Scope
Affects only the
copilotengine (other engines already use${{ runner.temp }}/${{ github.workspace }}paths that GitHub Actions resolves at YAML-eval time). The shared MCP gateway dispatcher (used by all engines) only consultsHOMEwhen actually writing the Copilot fallback config — non-Copilot engines do not gain a newHOMEdependency.Changes
Go compiler (pkg/workflow/)
mkdir -p $HOME/.copilotand MCPconfigPathuse$HOME.copilotSettingsPath→$HOME/.copilot/settings.json.$HOMEexpands at trap-fire time, not at trap-definition time.buildCopilotMCPConfigExport()emitsexport XDG_CONFIG_HOME="$HOME"(always) andexport GH_AW_MCP_CONFIG="$HOME/.copilot/mcp-config.json"(when MCP servers are configured) from the run script. These used to live in the YAMLenv:block where shell expansion does not happen.$HOME.Runtime scripts
resolveCopilotConfigPaths()helper (lazily called only when writing the Copilot fallback config, so non-Copilot engines do not requireHOME).detectEngineType()helper extracted for testability; only consultsHOMEwhen auto-detecting Copilot via~/.copilot.resolveCopilotConfigOutputPath()helper computes the output path fromprocess.env.HOME.$HOMEchanges (these.shfiles are not currently invoked by the generated workflow, but kept consistent with the.cjscounterparts). Both validateHOMEbefore any$HOME/.copilotwrite so an unsetHOMEfails loudly rather than writing to/.copilot.start_mcp_gateway.shengine auto-detection uses-d "$HOME/.copilot"(the directory test) rather than-fso it actually matches.Lock files
All 245 generated
.lock.ymlfiles in.github/workflows/recompiled to use the new$HOME-based shell snippets (see commit "Recompile lock files for $HOME-based Copilot config paths").Tests
New Go test file: pkg/workflow/copilot_home_expansion_test.go
Two categories:
String-level pins on the helpers so a regression to a hard-coded
/home/runnerflips a focused test rather than only the broader goldens:TestCopilotSettingsPath_UsesHomeNotLiteralRunnerTestBuildCopilotSettingsSetup_UsesHomeExpansion(with and without sudo chown)TestBuildCopilotSettingsCleanupTrap_SingleQuotedSoHomeExpandsAtTrapFireTestBuildCopilotMCPConfigExport_{NoMCPServers,WithMCPServers}(github / safe-outputs / custom MCP tool triggers)TestCopilotMCPRenderer_UsesHomeForConfigPathTestGetExecutionSteps_NoLiteralHomeRunner— broad guard that no Copilot step emits/home/runner/.copilot,XDG_CONFIG_HOME: /home/run, orGH_AW_MCP_CONFIG: /home/r(scoped to those patterns so the AWF tool-cache mount/home/runner/work/_tool, governed byRUNNER_TOOL_CACHEand out of scope here, is allowed).Bash integration tests that actually execute the generated snippets under a fresh environment with different
HOMEvalues (/home/runner,/home/actions,/root,/var/lib/actions runnerwith a space,/home/runner-2.x) to confirm:$HOMEexpands as expected.HOMEcontaining spaces and other special chars.EXITtrap fires and uses the runtimeHOME, not the trap-definition-timeHOME(TestBashIntegration_TrapFiresWithRuntimeHome).GH_AW_MCP_CONFIGis unset when there are no MCP servers.New JS tests (vitest)
resolveCopilotConfigOutputPathacross the sameHOMEmatrix, plus the unset/empty branches.resolveCopilotConfigPathstests plusdetectEngineTypetests covering: explicit non-copilot engine (no HOME needed), auto-detect codex (no HOME needed), and HOME-scoped copilot auto-detection.All 28 vitest tests pass; targeted Go test suite passes locally.
Golden files
Regenerated:
pkg/workflow/testdata/TestWasmGolden_AllEngines/copilot.goldenpkg/workflow/testdata/TestWasmGolden_CompileFixtures/{basic-copilot,playwright-cli-mode,smoke-copilot,with-imports}.goldenpkg/workflow/testdata/wasm_golden/WasmBinary/*.goldenLock files (
*.lock.yml) in user repos will see mechanical diffs on their nextgh aw compile. No codemod is needed — the affected text only appears in compiler output (not user-authored markdown). Behavior on standard GitHub-hosted runners (HOME=/home/runner) is unchanged.Why $HOME and not a fallback like
${HOME:-/home/runner}Other gh-aw generators (
mcp_setup_generator.gofor theghextension dir, the copilot session-state copy script, the codex engine config) already rely on bare$HOMEwith no fallback.HOMEis a standard POSIX environment variable inherited from the runner's parent process and passed through to shell steps. Adding a fallback only here would be inconsistent; if$HOMEis genuinely missing the workflow has bigger pre-existing problems than this one path. The JS helpers (resolveCopilotConfigPaths/resolveCopilotConfigOutputPath) and the.shscripts do throw a clear error ifHOMEis unset (and only check it when actually about to write a Copilot path), so the failure is loud rather than a silent wrong-path write, and non-Copilot engines are unaffected.Changeset
.changeset/patch-copilot-home-expansion-self-hosted-runners.md (patch).
ADR
ADR: ADR-38725: Resolve Copilot Config Paths from $HOME
Changeset
✨ PR Review Safe Output Test - Run 27387269540
Warning
Firewall blocked 6 domains
The following domains were blocked by the firewall during workflow execution:
accounts.google.comandroid.clients.google.comclients2.google.comcontentautofill.googleapis.comsafebrowsingohttpgateway.googleapis.comwww.google.comSee Network Configuration for more information.