Support custom AWF installation path in firewall configuration

[Copilot]

Adds support for specifying a custom AWF binary path in the firewall configuration, bypassing the default GitHub release download.

Usage

network:
allowed:
- defaultsfirewall:
path: /custom/path/to/awf # Absolute path# orpath: bin/awf # Relative to GITHUB_WORKSPACElog-level: info

Changes

• FirewallConfig struct (pkg/workflow/firewall.go): Added Path field
• JSON schema (pkg/parser/schemas/main_workflow_schema.json): Added path property to firewall object
• Frontmatter extraction (pkg/workflow/frontmatter_extraction.go): Extract path from firewall config
• Copilot engine (pkg/workflow/copilot_engine.go):
  • resolveAWFPath() - resolves absolute paths as-is, relative paths against ${GITHUB_WORKSPACE}
  • getAWFBinaryPath() - returns custom path or default awf
  • generateAWFPathValidationStep() - creates step to verify binary exists and is executable
  • Modified GetInstallationSteps() to emit validation step instead of install step when path is set
  • Modified GetExecutionSteps() to use dynamic binary path

Behavior

Config	Installation Step	Execution
No path	Downloads AWF from GitHub releases	Uses awf from PATH
path: /abs/path	Validates binary exists	Uses /abs/path
path: rel/path	Validates binary exists	Uses ${GITHUB_WORKSPACE}/rel/path

When path is specified, the version field is ignored.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/user
  • Triggering command: /usr/bin/gh gh api user --jq .login (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

you are tasked to support custom awf installation path in agentic workflow frontmatter configurations, allowing users to bypass the default GitHub release download mechanism and use their own AWF binaries.

Recommended Approach

User-Facing Syntax

network:
allowed:
- defaults
- nodefirewall:
path: /custom/path/to/awf # Absolute or relative pathlog-level: info

Path resolution rules:

• Paths starting with / are treated as absolute paths
• Other paths are treated as relative to ${GITHUB_WORKSPACE} (repository root)
• When path is specified, AWF download is skipped
• The version field is ignored when path is provided

Implementation Steps

1. Data Structure Changes

File: pkg/workflow/firewall.go (line ~16)

Add Path field to FirewallConfig struct:

typeFirewallConfigstruct {
Enabledbool`yaml:"enabled,omitempty"`Versionstring`yaml:"version,omitempty"`Args []string`yaml:"args,omitempty"`LogLevelstring`yaml:"log_level,omitempty"`CleanupScriptstring`yaml:"cleanup_script,omitempty"`Pathstring`yaml:"path,omitempty"`// NEW: Custom AWF binary path
}

2. Schema Updates

File: pkg/parser/schemas/main_workflow_schema.json (line ~1670)

Add path property to firewall object schema:

"path": {
"type": "string",
"description": "Custom path to AWF binary. When specified, skips downloading AWF from GitHub releases. Supports absolute paths or paths relative to GITHUB_WORKSPACE."
}

3. Frontmatter Extraction

File: pkg/workflow/frontmatter_extraction.go (after line 686)

Add path extraction in extractFirewallConfig:

// Extract path if presentifpath, hasPath:=firewallObj["path"]; hasPath {
ifpathStr, ok:=path.(string); ok {
config.Path=pathStr
}
}

4. Core Logic Changes

File: pkg/workflow/copilot_engine.go

4.1 Modify GetInstallationSteps (lines 64-76)

Change from unconditional AWF installation to conditional:

// Add AWF installation or validation stepsifisFirewallEnabled(workflowData) {
firewallConfig:=getFirewallConfig(workflowData)
iffirewallConfig==nil||firewallConfig.Path=="" {
// Default: Download and install AWF from GitHub releasesvarawfVersionstringiffirewallConfig!=nil {
awfVersion=firewallConfig.Version
}
awfInstall:=generateAWFInstallationStep(awfVersion)
steps=append(steps, awfInstall)
} else {
// Custom path: Validate the binary exists and is executablevalidationStep:=generateAWFPathValidationStep(firewallConfig.Path)
steps=append(steps, validationStep)
}
}

4.2 Add New Helper Functions (after line 867)

Function: generateAWFPathValidationStep

Creates a validation step to verify custom AWF binary:

funcgenerateAWFPathValidationStep(customPathstring) GitHubActionStep {
resolvedPath:=resolveAWFPath(customPath)
stepLines:= []string{
" - name: Validate custom AWF binary",
" run: |",
fmt.Sprintf(" echo \"Validating custom AWF binary at: %s\"", resolvedPath),
fmt.Sprintf(" if [ ! -f %s ]; then", shellEscapeArg(resolvedPath)),
fmt.Sprintf(" echo \"Error: AWF binary not found at %s\"", resolvedPath),
" exit 1",
" fi",
fmt.Sprintf(" if [ ! -x %s ]; then", shellEscapeArg(resolvedPath)),
fmt.Sprintf(" echo \"Error: AWF binary at %s is not executable\"", resolvedPath),
" exit 1",
" fi",
fmt.Sprintf(" %s --version", shellEscapeArg(resolvedPath)),
}
returnGitHubActionStep(stepLines)
}

Function: resolveAWFPath

Handles path resolution for absolute and relative paths:

funcresolveAWFPath(customPathstring) string {
ifcustomPath=="" {
return"/usr/local/bin/awf"
}
ifstrings.HasPrefix(customPath, "/") {
returncustomPath// Absolute path
}
// Relative path - resolve against GITHUB_WORKSPACEreturnfmt.Sprintf("${GITHUB_WORKSPACE}/%s", customPath)
}

Function: getAWFBinaryPath

Returns appropriate AWF binary path for execution:

funcgetAWFBinaryPath(firewallConfig*FirewallConfig) string {
iffirewallConfig!=nil&&firewallConfig.Path!="" {
returnresolveAWFPath(firewallConfig.Path)
}
return"awf"// Default (in PATH from installation step)
}

4.3 Update GetExecutionSteps (line 256)

Change from hardcoded awf to dynamic path:

// Get AWF binary path (custom or default)awfBinary:=getAWFBinaryPath(firewallConfig)
// Build AWF commandcommand=fmt.Sprintf(`set -o pipefailsudo -E %s %s \ -- %s \ 2>&1 | tee %s`,
shellEscapeArg(awfBinary),
shellJoinA...</details><!--STARTCOPILOTCODINGAGENTTIPS-->---
✨ LetCopilotcodingagent [setthingsupforyou](https://github.com/githubnext/gh-aw/issues/new?title=✨+Set+up+Copilot+instructions&body=Configure%20instructions%20for%20this%20repository%20as%20documented%20in%20%5BBest%20practices%20for%20Copilot%20coding%20agent%20in%20your%20repository%5D%28https://gh.io/copilot-coding-agent-tips%29%2E%0A%0A%3COnboard%20this%20repo%3E&assignees=copilot) — coding agent works faster and does higher quality work when set up for your repo.---
## Changeset-**Type**: patch-**Description**: SupportcustomAWFinstallationpathinfirewallconfiguration; validatesandusesuser-providedAWFbinarywhen `network.firewall.path` isset, skippingAWFdownloadandignoring `version` when `path` isspecified.
>AIgeneratedby [ChangesetGenerator](https://github.com/githubnext/gh-aw/actions/runs/19879115553)------
## SmokeTestSummary**Timestamp**: 2025-12-03T01:25:07Z**Status**: PASSAllCopilotenginetestsvalidatedsuccessfully (GitHubMCP, fileI/O, bash, playwright)
>AIgeneratedby [SmokeCopilotNoFirewall](https://github.com/githubnext/gh-aw/actions/runs/19879115603)

[github-actions]

🤖 SYSTEM_INIT: Smoke Copilot No Firewall ACTIVATED. PROCESSING pull request. ALL SUBSYSTEMS ONLINE.

[github-actions]

📰 BREAKING: Smoke Copilot is now investigating this pull request. Sources say the story is developing...

[github-actions]

📰 BREAKING: Smoke Copilot Playwright is now investigating this pull request. Sources say the story is developing...

[github-actions]

🔮 The ancient spirits stir... Smoke Codex awakens to divine this pull request...

[github-actions]

🎉 Yo ho ho! Changeset Generator found the treasure and completed successfully! ⚓💰

[github-actions]

💥 WHOOSH!Smoke Claude springs into action on this pull request! [Panel 1 begins...]

[github-actions]

Smoke Test Results

Last 2 Merged PRs:

• Convert embedded custom agents to prompt file format #5337: Convert embedded custom agents to prompt file format
• Migrate workflow commands (run, status, logs, audit) to RunE #5329: Migrate workflow commands (run, status, logs, audit) to RunE

Test Results:

• ✅ GitHub MCP Testing
• ✅ File Writing Testing
• ✅ Bash Tool Testing

Overall Status: PASS

📰 BREAKING: Report filed by Smoke Copilot fer issue #5339 🗺️

[github-actions]

Smoke Test Results - Copilot Engine (No Firewall)

Test timestamp: 2025-12-03T01:25:07Z

• ✅ GitHub MCP: Migrate workflow commands (run, status, logs, audit) to RunE #5329, Convert embedded custom agents to prompt file format #5337
• ✅ File Writing: Created test file successfully
• ✅ Bash Tool: Verified file content
• ✅ Playwright: GitHub homepage loaded, title verified

Overall Status: PASS

🤖 DIAGNOSTIC REPORT GENERATED BY Smoke Copilot No Firewall fer issue #5339 🗺️

[github-actions]

Smoke Test Results (Claude)

Last 2 Merged PRs:

• Migrate workflow commands (run, status, logs, audit) to RunE #5329: Migrate workflow commands to RunE
• Add safe output for assigning users to issues #5333: Add safe output for assigning users to issues

Test Results:

• ✅ GitHub MCP: Retrieved PR titles
• ✅ File Writing: Created test file successfully
• ✅ Bash Tool: Verified file contents
• ✅ Playwright MCP: Navigated to GitHub, title verified

Overall Status: PASS

💥 [THE END] — Illustrated by Smoke Claude fer issue #5339 🗺️

[github-actions]

Recent merged PRs:
Migrate workflow commands (run, status, logs, audit) to RunE
Convert embedded custom agents to prompt file format
✅ GitHub MCP review
✅ File write
✅ File read (cat)
✅ Playwright title contains GitHub
Overall: PASS

🔮 The oracle has spoken through Smoke Codex fer issue #5339 🗺️

[github-actions]

Smoke Test Results

✅ Playwright MCP: Navigate to https://github.com and verify title contains "GitHub"

Overall Status: PASS

📰 BREAKING: Report filed by Smoke Copilot Playwright fer issue #5339 🗺️