Skip to content

Document sandbox and GitHub access profiles - #53283

Closed
lpcox wants to merge 4 commits into
mainfrom
lpcox-document-security-profiles
Closed

Document sandbox and GitHub access profiles#53283
lpcox wants to merge 4 commits into
mainfrom
lpcox-document-security-profiles

Conversation

@lpcox

@lpcoxlpcox commented Aug 17, 2026

Copy link
Copy Markdown
Collaborator

Summary

  • add canonical, decision-oriented security profile references for users and workflow-authoring agents
  • distinguish sandbox runtime profiles, GitHub access modes, MCP exposure mode, and the internal host policy proxy
  • document effective defaults, runner prerequisites, host/service connectivity, runtime-install, Cloud Hypervisor, Pi/non-MCP engines, integrity reactions, migrations, and invalid combinations
  • update creator, updater, designer, syntax, runtime, GitHub MCP, optimization, release, and subagent guidance so agents do not emit removed fields or pair CLI GitHub access with MCP-only fields
  • align Starlight sandbox, runtime, GitHub tools, integrity, engine, frontmatter, glossary, architecture, and upgrade documentation

This PR is stacked on #53236 and targets lpcox-simplify-github-access.

Validation

  • make agent-report-progress
  • node --test scripts/generate-schema-docs.test.js
  • node scripts/generate-schema-docs.js (no generated frontmatter drift)
  • cd docs && ./node_modules/.bin/astro build
  • stale removed-value and invalid-combination searches across .github/aw and docs/src/content/docs

No workflow lock files changed.


Generated by 👨‍🍳 PR Sous Chef · gpt54 · 7.29 AIC · ⌖ 7.25 AIC · ⊞ 8.8K ·
Comment /souschef to run again

CopilotAI balanced review requested due to automatic review settings August 17, 2026 03:40
@github-actions

Copy link
Copy Markdown
Contributor

Visual Regression Check — Unable to Complete

I attempted to capture screenshots (mobile 375x812, tablet 768x1024, desktop 1440x900) and accessibility snapshots of (host.docker.internal/redacted) for this PR, but every navigation attempt returned HTTP 403 Forbidden from the Playwright browser sandbox, even though the workflow reported the docs server as ready.

PageViewportScreenshot status
Home (/gh-aw/)Mobile (375x812)error - 403 Forbidden
Home (/gh-aw/)Tablet (768x1024)not attempted (blocked earlier)
Home (/gh-aw/)Desktop (1440x900)not attempted (blocked earlier)

No visual diffs or accessibility findings could be produced as a result. This appears to be a network/firewall restriction preventing the browser tool from reaching host.docker.internal:4321. Recommend verifying the Playwright browser egress allowlist permits that host/port.

Warning

Firewall blocked 6 domains

The following domains were blocked by the firewall during workflow execution:

  • accounts.google.com
  • android.clients.google.com
  • clients2.google.com
  • host.docker.internal
  • www.google.com
  • www.gstatic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
allowed:
- defaults
- "accounts.google.com"
- "android.clients.google.com"
- "clients2.google.com"
- "host.docker.internal"
- "www.google.com"
- "www.gstatic.com"

See Network Configuration for more information.

Generated by 👁️ Visual Regression Checker for #53283 · auto · 29.5 AIC · ⌖ 2.2 AIC · ⊞ 7K ·

CopilotAI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Documents canonical sandbox, GitHub access, and MCP exposure profiles across user and workflow-authoring guidance.

Changes:

  • Adds security profile references and compatibility matrices.
  • Updates runtime, engine, migration, and authoring guidance.
  • Aligns examples and release notes with canonical access modes.
Show a summary per file
FileDescription
docs/src/content/docs/reference/tools.mdClarifies MCP exposure mode.
docs/src/content/docs/reference/security-profiles.mdAdds the user-facing profile matrix.
docs/src/content/docs/reference/sandbox.mdLinks runtime compatibility guidance.
docs/src/content/docs/reference/integrity.mdDocuments integrity access constraints.
docs/src/content/docs/reference/glossary.mdDefines access and exposure modes.
docs/src/content/docs/reference/github-tools.mdUpdates GitHub mode guidance.
docs/src/content/docs/reference/frontmatter.mdLinks profile selection guidance.
docs/src/content/docs/reference/engines.mdClarifies Pi tool exposure.
docs/src/content/docs/reference/agent-runtimes.mdExpands runtime compatibility details.
docs/src/content/docs/introduction/architecture.mdxSeparates runtime and access concepts.
docs/src/content/docs/guides/upgrading.mdAdds migration mappings.
docs/src/content/docs/examples/maintaining-repos.mdUpdates integrity terminology.
docs/src/content/docs/engines/pi.mdDocuments derived CLI modes.
docs/astro.config.mjsAdds security profiles navigation.
.github/aw/upgrade-agentic-workflows.mdUpdates MCP migration example.
.github/aw/update-agentic-workflow.mdAdds profile-aware update guidance.
.github/aw/token-optimization.mdRemoves invalid CLI toolsets.
.github/aw/syntax-tools-imports.mdDocuments access and exposure syntax.
.github/aw/syntax-agentic.mdUpdates runtime and integrity constraints.
.github/aw/subagents.mdSeparates MCP wrappers from gh.
.github/aw/security-profiles.mdAdds canonical agent guidance.
.github/aw/release-workflow.mdUpdates release tool guidance.
.github/aw/mcp-clis.mdClarifies MCP CLI semantics.
.github/aw/github-mcp-server.mdCorrects local MCP behavior.
.github/aw/github-agentic-workflows.mdUpdates workflow defaults.
.github/aw/designer.mdPrevents CLI/MCP field mixing.
.github/aw/designer-mappings.mdRefines tool-selection mappings.
.github/aw/create-agentic-workflow.mdAdds profile-aware creation guidance.
.github/aw/agent-runtime-instructions.mdUpdates runtime provisioning guidance.
.changeset/patch-document-security-profiles.mdRecords documentation changes.
.changeset/github-access-mode-homogeneous.mdCorrects warning behavior notes.

Review details

  • Files reviewed: 31/31 changed files
  • Comments generated: 11
  • Review effort level: Balanced

| --- | --- | --- |
| `sandbox.agent.runtime` | Agent isolation, AWF privileges, and host/service connectivity | How GitHub APIs are exposed |
| `tools.github.mode` | GitHub access through the `gh` CLI or a GitHub MCP server | How non-GitHub MCP servers are exposed |
| `tools.mcp-mode` | Whether MCP servers, including a selected GitHub MCP server, are exposed as native MCP tools or CLI wrappers | GitHub transport or sandbox isolation |

## MCP exposure profile

`tools.mcp-mode: cli` exposes user-facing MCP servers as CLI wrappers on `PATH`, including the GitHub MCP server when `mcp-local` or `mcp-remote` is selected. It does not select `tools.github.mode: cli` and does not turn the GitHub MCP server into the authenticated `gh` CLI. Leave `tools.mcp-mode` omitted, or set it to `default`, for native MCP exposure.

For MCP-capable engines, an omitted mode resolves to `mcp-local` for backward compatibility. New workflows should select `cli` explicitly unless they need GitHub MCP tools. `features.integrity-reactions: true` resolves an omitted mode to `cli`. Engines without native MCP support, including Pi, automatically derive both `tools.github.mode: cli` and `tools.mcp-mode: cli`; do not set an MCP GitHub mode for them.

The fields `toolsets` and `allowed` configure either GitHub MCP mode; `version` and `args` configure only `mcp-local`. All four are ignored with an explicit `tools.github.mode: cli` and produce a compiler warning. Policy fields such as `allowed-repos`, `min-integrity`, `github-token`, and `github-app` remain meaningful in every GitHub access mode.
### GitHub Access Mode (`tools.github.mode`)

A `tools.github` field that controls how the agent accesses GitHub APIs. Three canonical values are supported: `cli` (recommended default — pre-authenticated `gh` CLI, no MCP server registered, token never exposed to the agent container; replaces the deprecated `features.cli-proxy: true`), `mcp-local` (Docker-based GitHub MCP server, for workflows that need MCP-only fields), and `mcp-remote` (hosted GitHub MCP server at `api.githubcopilot.com`; requires additional authentication). The legacy values `gh-proxy` (= `cli`), `local` (= `mcp-local`), and `remote` (= `mcp-remote`) are still accepted for backward compatibility and migrated by `gh aw fix`. See [GitHub Tools Reference](/gh-aw/reference/github-tools/).
A `tools.github` field that selects GitHub API access through the pre-authenticated `gh` CLI (`cli`), a local Docker GitHub MCP server (`mcp-local`), or the hosted GitHub MCP service (`mcp-remote`). This selector is independent from the sandbox runtime and `tools.mcp-mode`. Legacy values are accepted only for migration. See [Security Profile Selection](/gh-aw/reference/security-profiles/) and [GitHub Tools Reference](/gh-aw/reference/github-tools/).

Workflows that use GitHub Actions `services:` with published ports remain reachable from the agent sandbox only when `sandbox.agent.runtime: docker-sudo-iptables` is set; recompiling regenerates the `--allow-host-service-ports` value used to reach those services.

GitHub access values are also normalized: `gh-proxy` becomes `cli`, and `local` or `remote` become `mcp-local` or `mcp-remote`. The removed `features.cli-proxy` flag migrates to `tools.github.mode: cli`, while `tools.cli-proxy` migrates to the distinct `tools.mcp-mode: cli` MCP exposure setting. Review the [security profile matrix](/gh-aw/reference/security-profiles/) before combining migrated fields.
Comment thread.github/aw/security-profiles.md Outdated

For MCP-capable engines, omitted `tools.github.mode` resolves to `mcp-local`. Select `cli` explicitly for new CLI-based workflows. Engines without MCP support, including Pi, automatically derive `tools.github.mode: cli` and `tools.mcp-mode: cli`; do not select an MCP mode for them.

`toolsets` and `allowed` apply to either GitHub MCP mode; `version` and `args` apply only to `mcp-local`. Do not combine them with explicit `mode: cli`; the compiler ignores them with a warning. `allowed-repos`, `min-integrity`, `github-token`, and `github-app` remain meaningful in all modes.
Comment thread.github/aw/mcp-clis.md Outdated

MCP CLI exposes mounted MCP servers as shell commands on `PATH`. Enabled by `tools.mcp-mode: cli`.

This is an MCP exposure setting, not GitHub access. It can wrap a selected GitHub MCP server but does not provide the authenticated `gh` CLI. Configure `tools.github.mode` separately; see [security-profiles.md](security-profiles.md).
Comment thread.github/aw/release-workflow.md Outdated
- **The `release` job must output `release_id`** — the agent needs the database ID to reference the correct release
- **Pre-fetch all data in `steps:`** before the agent runs; write compact JSON to `/tmp/gh-aw/agent/release-data/`
- **Include `tools.mcp-mode: cli`** in the agent `tools:` block to allow `gh` and `jq` use inside the sandbox
- **Include `tools.github.mode: cli`** for authenticated `gh` access; use `tools.mcp-mode: cli` to expose selected MCP servers as CLI wrappers
Comment thread.github/aw/security-profiles.md Outdated
| --- | --- |
| `sandbox.agent.runtime` | Agent isolation, AWF privilege, and host/service access |
| `tools.github.mode` | GitHub access through `gh` or a GitHub MCP server |
| `tools.mcp-mode` | Native MCP exposure versus CLI wrappers for MCP servers, including a selected GitHub MCP server |
Comment thread.github/aw/syntax-tools-imports.md Outdated
- `timeout:` - Per-operation timeout in seconds for all tool and MCP calls (integer or expression, default: 60 s for all engines).
- `startup-timeout:` - Timeout in seconds for MCP server initialization (integer or expression, default: 120).
- `mcp-mode:` - MCP server mounting mode (string, default: `"default"`). Set to `"cli"` to mount each user-facing MCP serveras a standalone CLI tool on `PATH` so the agent can call MCP servers via shell (e.g. `github issue_read --method get ...`). The legacy `cli-proxy: true` is accepted for backward compatibility and migrated by `gh aw fix`.
- `mcp-mode:` - MCP exposure mode (string, default: `"default"`). Set to `"cli"` to mount each user-facing MCP server, including a selected GitHub MCP server, as a standalone CLI tool on `PATH`. This is distinct from `tools.github.mode`, does not select GitHub access, and does not provide the authenticated `gh` CLI. The legacy `cli-proxy: true` is accepted for backward compatibility and migrated by `gh aw fix`.
@gh-aw-bot

Copy link
Copy Markdown
Collaborator

@copilot this PR is ready for the next finishing pass.

Please address these items, newest first:

  • Review the visual regression report and either fix the blocked browser access path or document why the check is expected to fail in this environment.
  • Refresh the branch with the latest base changes.
  • Run the pr-finisher skill after the fixes and summarize the outcome.

Run: https://github.com/github/gh-aw/actions/runs/31996014734

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 13.7 AIC · ⌖ 5.77 AIC · ⊞ 8.8K ·
Comment /souschef to run again

@github-actions

Copy link
Copy Markdown
Contributor

Hey @lpcox 👋 — thanks for documenting the security profiles and GitHub access modes! This is a comprehensive update that clarifies important defaults, runner prerequisites, and migration paths.

A few suggestions to strengthen this:

  • Add validation tests — while the PR includes manual validation steps (schema generation, Astro build, searches), consider adding automated checks or a test file documenting the validation commands so future reviewers can reproduce the validation easily.
  • Document breaking changes — the changelog entries reference removed fields and invalid combinations. A migration guide in the PR description or a link to upgrade docs would help users understand the impact.

The documentation updates are focused and well-structured. If you'd like to automate the validation, you could assign this prompt to your agent:

Create a test or validation script that:
1. Runs the schema documentation generation (node scripts/generate-schema-docs.js)
2. Verifies no generated frontmatter drift
3. Runs the Astro build for docs (cd docs && ./node_modules/.bin/astro build)
4. Document these steps in a comment or test file so reviewers can validate

Generated by ✅ Contribution Check · auto · 44.3 AIC · ⌖ 3.27 AIC · ⊞ 9.1K ·

@gh-aw-bot

Copy link
Copy Markdown
Collaborator

@copilot this PR is ready for the next finishing pass.

Please address these items, newest first:

  • Review the visual regression report and either fix the blocked browser access path or document why the check is expected to fail in this environment.
  • Refresh the branch with the latest base changes.
  • Run the pr-finisher skill after the fixes and summarize the outcome.

Run: https://github.com/github/gh-aw/actions/runs/31997601784

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 18 AIC · ⌖ 6.85 AIC · ⊞ 8.8K ·
Comment /souschef to run again

CopilotAI commented Aug 17, 2026

Copy link
Copy Markdown
Contributor

@copilot this PR is ready for the next finishing pass.

Please address these items, newest first:...

Fixed in 9bd0b8258d: the visual workflow now uses docker-sudo-iptables with host port 4321 allowed, and its lock file was recompiled. The branch was unshallowed/fetched and is already based on the latest stacked-base SHA (a7368c2). PR-finisher validation passed fmt, lint, unit/full tests, strict compile/actionlint, review, and secret scan; the final aggregate gate remains blocked only by three pre-existing stale-lock failures on the base PR.

CopilotAI commented Aug 17, 2026

Copy link
Copy Markdown
Contributor

@copilot this PR is ready for the next finishing pass.

Please address these items, newest first:...

Addressed in b1171bef9f: the branch now includes stacked-base 3dc2e26, and the browser-access fix remains configured via docker-sudo-iptables with host port 4321. PR-finisher passed fmt, lint, impacted/full Go tests, workflow recompilation, stale-lock validation, and code review. The latest visual check is awaiting workflow approval rather than failing; the prior visual run passed. The Sous Chef run failed only because its update-branch safe output cannot update stacked PRs.

@gh-aw-bot

Copy link
Copy Markdown
Collaborator

@copilot this PR is ready for the next finishing pass.

Please address these items, newest first:

  • Refresh the branch with the latest base changes.
  • Run the pr-finisher skill after the fixes and summarize the outcome.

Run: https://github.com/github/gh-aw/actions/runs/32004940993

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 10.2 AIC · ⌖ 7.82 AIC · ⊞ 8.8K ·
Comment /souschef to run again

CopilotAI commented Aug 17, 2026

Copy link
Copy Markdown
Contributor

@copilot this PR is ready for the next finishing pass.

Please address these items, newest first:...

Completed in 275ed92344. The branch was already current with stacked base 3dc2e26 (6 ahead, 0 behind). PR-finisher passed fmt, lint, impacted/full tests, workflow recompilation, aggregate validation, code review, secret scanning, and the Markdown-only CodeQL assessment. The full suite also caught and fixed the missing generated security-profiles.md skill route. CI on the new agent-pushed HEAD now needs a maintainer re-trigger/approval.

@gh-aw-bot

Copy link
Copy Markdown
Collaborator

@copilot this PR is ready for the next finishing pass.

Please refresh the branch with the latest base changes if needed, rerun the pr-finisher skill, and summarize the maintainer action still required. The latest agent reply says the new agent-pushed HEAD now only needs maintainer re-trigger/approval for CI.

Run: https://github.com/github/gh-aw/actions/runs/32019589269

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 3.78 AIC · ⌖ 7.22 AIC · ⊞ 8.8K ·
Comment /souschef to run again

CopilotAI commented Aug 17, 2026

Copy link
Copy Markdown
Contributor

@copilot this PR is ready for the next finishing pass.

Please refresh the branch with the latest base changes if needed, rerun the pr-finisher skill, and summarize the maintainer action still requi...

Completed in 62ebba29a1. The branch is current with stacked base 3dc2e26 (8 ahead, 0 behind), and PR-finisher passed fmt, lint, impacted/full tests, recompilation, aggregate validation, review, secret scanning, and the Markdown-only CodeQL assessment. Maintainer action: approve/re-trigger CI for the agent-pushed HEAD; GitHub also still shows 11 older Copilot review threads unresolved.

@gh-aw-bot

Copy link
Copy Markdown
Collaborator

@copilot this PR is ready for the next finishing pass.

Please address these items, newest first:

Run: https://github.com/github/gh-aw/actions/runs/32026520939

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 8.49 AIC · ⌖ 4.53 AIC · ⊞ 4.5K ·
Comment /souschef to run again

CopilotAI commented Aug 17, 2026

Copy link
Copy Markdown
Contributor

@copilot this PR is ready for the next finishing pass.

Please address these items, newest first:...

Addressed all 11 review findings in a988ce9 and refreshed the branch to stacked base cf3c40f. PR-finisher validation passed schema tests, docs build/link validation, fmt/lint, impacted unit tests, the full short-mode Go suite, workflow recompilation, automated review, secret scanning, and CodeQL’s docs-only assessment. The review comments are now outdated but remain formally unresolved because the available PR tooling does not expose thread resolution. Maintainer action: resolve those outdated threads and approve/re-trigger CI for the agent-pushed HEAD.

@gh-aw-bot

Copy link
Copy Markdown
Collaborator

@copilot this PR looks ready for the next maintainer-visible pass.

Please address these items, newest first:

Run: https://github.com/github/gh-aw/actions/runs/32030687603

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 7.61 AIC · ⌖ 5.75 AIC · ⊞ 8.8K ·
Comment /souschef to run again

CopilotAI commented Aug 17, 2026

Copy link
Copy Markdown
Contributor

@copilot this PR looks ready for the next maintainer-visible pass.

Please address these items, newest first:...

Fixed the stale-lock CI false positive in 4ad85fc751 and restored the generated security-profile skill route in ec4d42a1ab. The branch is current with stacked base cf3c40f; PR-finisher passed fmt, lint, full tests, recompilation, aggregate validation, review, secret scanning, and CodeQL assessment. Maintainer action remains: resolve the 11 outdated review threads and re-trigger/approve CI for the agent-pushed HEAD.

@gh-aw-bot

Copy link
Copy Markdown
Collaborator

@copilot this branch is currently conflicting with main. Please run make merge-main to resolve the conflicts, then continue with the pr-finisher skill before handing back to a maintainer.

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 18.7 AIC · ⌖ 7.77 AIC · ⊞ 8.8K ·
Comment /souschef to run again

CopilotAI commented Aug 17, 2026

Copy link
Copy Markdown
Contributor

@copilot this branch is currently conflicting with main. Please run make merge-main to resolve the conflicts, then continue with the pr-finisher skill before handing back to a maintainer.

Gen...

Resolved in ad2b647090 and refreshed the latest stacked base in 4befae235c. PR-finisher validation passed fmt, lint, impacted/full tests, recompilation, aggregate validation, review, and secret scanning; CodeQL timed out without returning alerts. Maintainer action remains to re-trigger/approve CI and resolve the 11 outdated review threads.

@gh-aw-bot

Copy link
Copy Markdown
Collaborator

@copilot this branch is currently conflicting with main. Please run make merge-main to resolve the conflicts, then continue with the pr-finisher skill before handing back to a maintainer.

Run: https://github.com/github/gh-aw/actions/runs/32043948991

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 10.3 AIC · ⌖ 6.79 AIC · ⊞ 8.8K ·
Comment /souschef to run again

CopilotAI commented Aug 17, 2026

Copy link
Copy Markdown
Contributor

@copilot this branch is currently conflicting with main. Please run make merge-main to resolve the conflicts, then continue with the pr-finisher skill before handing back to a maintainer.

_Run:...

Resolved the main conflicts in 620cf2d7ee and refreshed the latest stacked base in 4107b5673f. PR-finisher passed fmt, lint, full tests, recompilation, aggregate validation, review, and secret scanning; CodeQL timed out without returning alerts. Maintainer action remains to re-trigger/approve CI for the agent-pushed HEAD and resolve the 11 outdated review threads.

lpcoxand others added 3 commits August 17, 2026 10:26
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>
Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>
@lpcox
lpcoxforce-pushed the lpcox-document-security-profiles branch from 4107b56 to cb469eeCompareAugust 17, 2026 17:28
@lpcox
lpcox changed the base branch from lpcox-simplify-github-access to mainAugust 17, 2026 18:07
@gh-aw-bot

Copy link
Copy Markdown
Collaborator

@copilot this PR is ready for the next finishing pass.

Please address these items, newest first:

  • Refresh the branch with the latest base changes.
  • Run the skill after the fixes and summarize the outcome.

Run: https://github.com/github/gh-aw/actions/runs/32052943209

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 7.29 AIC · ⌖ 7.25 AIC · ⊞ 8.8K ·
Comment /souschef to run again

Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants

@lpcox@gh-aw-bot