perf: fix 16.5% regression in CompileComplexWorkflow#25067
perf: fix 16.5% regression in CompileComplexWorkflow#25067
Conversation
…void expensive regex on full YAML Agent-Logs-Url: https://github.com/github/gh-aw/sessions/00e76321-c0d1-4d80-8a8e-2016e1a3081e Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
…ne iteration Agent-Logs-Url: https://github.com/github/gh-aw/sessions/00e76321-c0d1-4d80-8a8e-2016e1a3081e Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
There was a problem hiding this comment.
Pull request overview
Improves compilation performance for complex workflows by reducing unnecessary regex work in action reference scanning and avoiding expensive YAML parsing for template-injection validation when unsafe expressions are not present in run: execution contexts.
Changes:
- Optimized
CollectActionReferencesby scanning line-by-line and applying theuses:regex only to candidate lines. - Replaced the prior template-injection fast-path with
hasUnsafeExpressionInRunBlock()to skip fullyaml.Unmarshalunless unsafe expressions occur withinrun:blocks. - Updated compiler validation flow to use the new
run:-scoped pre-check to decide whether parsing is needed.
Show a summary per file
| File | Description |
|---|---|
| pkg/workflow/template_injection_validation.go | Adds hasUnsafeExpressionInRunBlock() and block-scalar detection to skip full YAML parse unless needed. |
| pkg/workflow/redact_secrets.go | Speeds up action reference collection by pre-filtering uses: lines before applying regex. |
| pkg/workflow/compiler.go | Switches template-check gating logic to the new run:-scoped unsafe-expression scan. |
Copilot's findings
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comments suppressed due to low confidence (1)
pkg/workflow/template_injection_validation.go:114
- Block-scalar run forms with trailing inline comments (e.g.
run: | # comment,run: >- # ...) won't be recognized because afterColon includes the comment text, so isBlockScalarIndicator(afterColon) returns false and the scanner never enters the run block. That can incorrectly skip template-injection validation. Consider stripping inline comments / taking the first whitespace-delimited token of afterColon before calling isBlockScalarIndicator.
afterColon := strings.TrimSpace(trimmed[4:])
if isBlockScalarIndicator(afterColon) {
// Block scalar – subsequent indented lines are the run value.
inRunBlock = true
runIndent = indent
} else if afterColon != "" {
- Files reviewed: 3/3 changed files
- Comments generated: 2
| // Look for a "run:" key. It may be a block scalar (run: |) or a plain value. | ||
| if !strings.HasPrefix(trimmed, "run:") { | ||
| continue | ||
| } | ||
| afterColon := strings.TrimSpace(trimmed[4:]) |
There was a problem hiding this comment.
hasUnsafeExpressionInRunBlock only detects lines whose trimmed form begins with "run:". This misses the common GitHub Actions shorthand step form "- run: …" (including "- run: |"), which is used in this repo (e.g. compiler-generated YAML) and will cause needsTemplateCheck to remain false, skipping template-injection validation even when unsafe expressions are present in such steps. Update the scan to treat optional list-item prefixes (e.g., "- ") as part of YAML syntax and still recognize the run key.
This issue also appears on line 109 of the same file.
| // Look for a "run:" key. It may be a block scalar (run: |) or a plain value. | |
| if !strings.HasPrefix(trimmed, "run:") { | |
| continue | |
| } | |
| afterColon := strings.TrimSpace(trimmed[4:]) | |
| // Look for a "run:" key. It may appear directly or after a YAML list-item | |
| // marker ("- "), and may be a block scalar (run: |) or a plain value. | |
| runLine := trimmed | |
| if strings.HasPrefix(runLine, "-") { | |
| afterDash := runLine[1:] | |
| if len(afterDash) > 0 && (afterDash[0] == ' ' || afterDash[0] == '\t') { | |
| runLine = strings.TrimLeft(afterDash, " \t") | |
| } | |
| } | |
| if !strings.HasPrefix(runLine, "run:") { | |
| continue | |
| } | |
| afterColon := strings.TrimSpace(runLine[4:]) |
| // hasUnsafeExpressionInRunBlock performs a fast line-by-line scan to determine whether | ||
| // any unsafe context expression (${{ github.event.* }}, ${{ steps.*.outputs.* }}, | ||
| // ${{ inputs.* }}) appears inside a run: block in the YAML content. | ||
| // | ||
| // This avoids the expensive full yaml.Unmarshal call in the common case where unsafe | ||
| // expressions only appear in safe contexts (env:, if:, group:, concurrency:, etc.). | ||
| // It correctly tracks indentation to detect block scalar (run: |) and | ||
| // single-line (run: some command) run fields. | ||
| func hasUnsafeExpressionInRunBlock(yamlContent string) bool { |
There was a problem hiding this comment.
The new fast-path scanner is now part of the security gate deciding whether to run template-injection validation, but there are no direct unit tests for cases like "- run: echo ${{ github.event.* }}" and "run: | # comment" that would have caught the skip-path bugs. Add focused tests for hasUnsafeExpressionInRunBlock (or for validateNoTemplateInjection behavior that relies on it) covering these YAML variants.
|
@copilot merge main and recompile |
|
@copilot Review comments |
BenchmarkCompileComplexWorkflowregressed from ~10ms to ~11.7ms/op. Profiling identified two hot paths:CollectActionReferences(25% of compile time) andyaml.Unmarshalfor template injection validation (35% of compile time).Changes
CollectActionReferences(redact_secrets.go): ReplacedFindAllStringSubmatchon the full 66KB YAML with astrings.SplitSeqline scan that pre-filters withstrings.Contains(line, "uses:")before applying the per-line regex. Only ~3.6% of lines containuses:, eliminating 96% of the regex work.Template injection pre-check (
template_injection_validation.go,compiler.go): The old fast-pathunsafeContextRegex.MatchString(yamlContent)always triggered for PR workflows (which always have${{ github.event.* }}inenv:sections), unconditionally invokingyaml.Unmarshalon the full YAML. Replaced withhasUnsafeExpressionInRunBlock()— a line-by-line scanner that only returnstruewhen unsafe expressions appear insiderun:blocks (where template injection is actually possible). Since gh-aw never emits bare${{ github.event.* }}inrun:blocks, the expensive parse is now skipped in the common case.isBlockScalarIndicator()correctly handles all YAML block scalar variants (|,>,|-,>-,|+,>+,|2,|2-, etc.).Results
The benchmark now runs well under the historical 10ms baseline.
Warning
Firewall rules blocked me from connecting to one or more addresses (expand for details)
I tried to connect to the following addresses, but was blocked by firewall rules:
https://api.github.com/graphql/usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw GO111MODULE ache/go/1.25.8/x--show-toplevel git rev-�� --show-toplevel go /usr/bin/git -json GO111MODULE tartedAt,updated--show-toplevel git(http block)/usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw git /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel gh /usr/bin/git git(http block)/usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw sRemoteWithRealGrev-parse ache/node/24.14.--show-toplevel git rev-�� --show-toplevel git /usr/bin/git --show-toplevel git ache/node/24.14.--show-toplevel git(http block)https://api.github.com/orgs/test-owner/actions/secrets/usr/bin/gh gh api /orgs/test-owner/actions/secrets --jq .secrets[].name abfc11f840b03ef9GOINSECURE GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/xGO111MODULE env 3822390/b420/_pkGOINSECURE GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)/usr/bin/gh gh api /orgs/test-owner/actions/secrets --jq .secrets[].name --show-toplevel git /usr/bin/git --show-toplevel git /usr/bin/git git rev-�� --show-toplevel git /usr/bin/infocmp --show-toplevel git iptables infocmp(http block)https://api.github.com/repos/actions/ai-inference/git/ref/tags/v1/usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq .object.sha --show-toplevel go /usr/bin/git b/workflows GO111MODULE 64/bin/go git rev-�� --git-dir go /usr/bin/git -json GO111MODULE 64/bin/go /usr/bin/git(http block)/usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq .object.sha --show-toplevel git /usr/bin/git --show-toplevel e/git /usr/bin/git git rev-�� --show-toplevel git /opt/pipx_bin/bash --show-toplevel go /usr/bin/git bash(http block)/usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq .object.sha --git-dir gh /usr/bin/git /repos/actions/cgit --jq 1/x64/bin/node git rev-�� --show-toplevel git(http block)https://api.github.com/repos/actions/checkout/git/ref/tags/v3/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq .object.sha git-upload-pack '/tmp/TestParseDefaultBranchFromtest-logs/run-12345 git-upload-pack '/tmp/TestParseDefaultBranchFromLsRemoteWithRealGitbranch_with_hyphen653344360/0rev-parse /usr/bin/git go1.25.8 -c=4 -nolocalimports git conf�� user.email l /opt/hostedtoolcache/node/24.14.1/x64/bin/node 3822390/b408/_pkgit GO111MODULE 64/bin/go node(http block)/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq .object.sha --show-toplevel /usr/lib/git-core/git-remote-https /usr/bin/git REDACTED go /usr/bin/git git rev-�� --show-toplevel git 14d9774d --show-toplevel go /usr/bin/git git(http block)/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq .object.sha -v git /usr/bin/git --show-toplevel git /usr/bin/git git -C /tmp/TestGuardPolicyBlockedUsersCommaSeparatedCompiledOutput2967528676/001(http block)https://api.github.com/repos/actions/checkout/git/ref/tags/v5/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha g_.a GO111MODULE ck GOINSECURE tants GOMODCACHE go sRem�� 820/001/stabilit.artifacts[].name GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE ortcfg(http block)/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha --get-regexp ^remote\..*\.gh-resolved$ /usr/bin/git -json GO111MODULE 64/bin/go git rev-�� --show-toplevel go /usr/bin/git 2519684456 GO111MODULE ache/go/1.25.8/x--show-toplevel git(http block)/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha --show-toplevel e/git /usr/bin/git vaScript16404510git GO111MODULE 6189752/b283/vet--show-toplevel git rev-�� --show-toplevel go /usr/bin/git -json GO111MODULE /opt/hostedtoolc--show-toplevel git(http block)https://api.github.com/repos/actions/checkout/git/ref/tags/v6/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha --oneline -1 /usr/bin/git --check scripts/**/*.js 64/bin/go git rev-�� --git-dir go /usr/bin/git -json GO111MODULE x_amd64/vet git(http block)/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha /tmp/gh-aw-test-runs/20260407-113051-46859/test-873073947 epo}/actions/runs/4/artifacts /usr/bin/git e scripts/**/*.js 64/bin/go git conf�� user.name Test User /usr/bin/git -json GO111MODULE x_amd64/compile git(http block)/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha --show-toplevel ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile /usr/bin/git 6189752/b070/_pkgit GO111MODULE e/git git rev-�� --show-toplevel e/git /usr/bin/git 1LJ0/rCvM3wOXsX-git tname) /opt/hostedtoolc--show-toplevel git(http block)https://api.github.com/repos/actions/github-script/git/ref/tags/v8/usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha GOSUMDB GOWORK 64/bin/go GOINSECURE GOMOD GOMODCACHE go k/gh�� -json GO111MODULE 64/bin/go GOINSECURE GOMOD erignore go(http block)/usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE sh(http block)/usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha 3822390/b388/_pkGOINSECURE GO111MODULE 64/bin/go GOINSECURE b/gh-aw/pkg/cli GOMODCACHE go env WXsl/-E8RoUa9ej3-test.timeout=10m0s GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE 3822390/b388/imp^remote\..*\.gh-resolved$(http block)https://api.github.com/repos/actions/setup-go/git/ref/tags/v4/usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq .object.sha user.name Test User /usr/bin/git -c=4 -nolocalimports -importcfg git rev-�� --show-toplevel /home/REDACTED/work/gh-aw/gh-aw/pkg/timeutil/format_test.go /usr/bin/git -json GO111MODULE 64/bin/go git(http block)/usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq .object.sha --show-toplevel git 54ec9db2551b255614d9774d --show-toplevel go /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel go /usr/bin/git git(http block)/usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq .object.sha --show-toplevel V8DPkJF/GIcQaFdI-importcfg clusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --show-toplevel git 4ff10edfb002100c--show-toplevel git rev-�� --show-toplevel sed /usr/bin/git /usr/bin/git git /usr/bin/git git(http block)https://api.github.com/repos/actions/setup-node/git/ref/tags/v4/usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq .object.sha -u origin /usr/bin/git --check scripts/**/*.js 64/bin/go git rev-�� --show-toplevel go /usr/bin/git -json GO111MODULE x_amd64/link git(http block)/usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq .object.sha --show-toplevel git /usr/bin/git --show-toplevel go /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel ache/go/1.25.8/xrev-parse /usr/bin/git git(http block)/usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq .object.sha --show-toplevel git /usr/bin/git y-frontmatter.mdgit git /usr/bin/mkdir git comm�� -m Test commit /usr/bin/git 3/001 git x_amd64/vet git(http block)https://api.github.com/repos/actions/upload-artifact/git/ref/tags/v4/usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq .object.sha --noprofile GOPROXY /tmp/go-build1796189752/b411/fileutil.test GOSUMDB GOWORK 64/bin/go /tmp/go-build1796189752/b411/fileutil.test -tes�� -test.paniconexit0(http block)/usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq .object.sha --show-toplevel git /usr/bin/grep heckout/git/ref/git origin /usr/bin/gh grep -c ^From [0-9a-f]\{40\} /tmp/gh-aw/aw-feature-branch.patch /usr/bin/git --paginate repos/{owner}/{rrev-parse /usr/bin/git git(http block)/usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq .object.sha runs/20260407-113432-57372/test-591109813 git /usr/lib/git-core/git l 6516a585 ache/node/24.14.--show-toplevel /usr/lib/git-core/git unpa�� --pack_header=2,3 -q /usr/bin/git nly 64/pkg/tool/linu/tmp/fuzz-process-1241228545.js /usr/bin/git git(http block)https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v0.1.2/usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0.1.2 --jq .object.sha --show-current epo}/actions/runs/12346/artifacts /usr/bin/git e lGitbranch_with_rev-parse 64/bin/go git rev-�� --show-toplevel go /usr/bin/git -json GO111MODULE x_amd64/compile git(http block)/usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0.1.2 --jq .object.sha --show-toplevel git /usr/bin/git --show-toplevel go /usr/bin/git git rev-�� --show-toplevel git(http block)/usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0.1.2 --jq .object.sha --show-toplevel hT50UqE/9k5zS8fxrev-parse /usr/bin/git --show-toplevel git cdde517e992e9f47--show-toplevel git rev-�� --show-toplevel l /usr/bin/git HEAD git x_amd64/link git(http block)https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.0.0/usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq .object.sha k/gh-aw/gh-aw/.github/workflows -trimpath /usr/bin/git -p github.com/githurev-parse -lang=go1.25 git comm�� -m initial commit /usr/bin/git -c=4 -nolocalimports -importcfg git(http block)/usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq .object.sha --show-toplevel git /usr/bin/git --show-toplevel go /usr/bin/gh git rev-�� --show-toplevel gh /usr/bin/git --paginate repos/{owner}/{rrev-parse /usr/bin/git git(http block)/usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq .object.sha /usr/bin/git git /usr/lib/git-core/git --show-toplevel git /usr/bin/git /usr/lib/git-core/git pack�� --all-progress-implied --revs(http block)https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.2.3/usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq .object.sha ithub/workflows/ai-moderator.md GOPROXY /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/vet GOSUMDB GOWORK 64/bin/go /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/vet -ato�� -bool l /usr/bin/git -errorsas -ifaceassert -nilfunc git(http block)/usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq .object.sha --show-toplevel git /usr/bin/mkdir --show-toplevel go /usr/bin/gh mkdir -p /tmp/gh-aw gh /usr/bin/git --paginate repos/{owner}/{rrev-parse /usr/bin/git git(http block)/usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq .object.sha /usr/bin/git l /bin/sh --show-toplevel git ache/go/1.25.8/x--show-toplevel /bin/sh -c git-receive-pack '/tmp/TestParseDefaultBranchFromLsRemoteWithRealGitmaster_branch1196538789/001'git git-receive-pack '/tmp/TestParseDefaultBranchFromLsRemoteWithRealGitmaster_branch1196538789/001'rev-parse /usr/bin/git --show-toplevel nly /usr/bin/git git(http block)https://api.github.com/repos/github/gh-aw/actions/runs/1/artifacts/usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/1/artifacts --jq .artifacts[].name GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env thub/workflows GO111MODULE stants.test GOINSECURE GOMOD GOMODCACHE stants.test(http block)/usr/bin/gh gh run download 1 --dir test-logs/run-1 GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env 2298409650 GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)/usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/1/artifacts --jq .artifacts[].name git /usr/bin/git --show-toplevel node /usr/bin/git git rev-�� --show-toplevel git ache/node/24.14.1/x64/bin/node --show-toplevel git /usr/bin/git node(http block)https://api.github.com/repos/github/gh-aw/actions/runs/12345/artifacts/usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12345/artifacts --jq .artifacts[].name GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env b/workflows ne_constants.go x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile(http block)/usr/bin/gh gh run download 12345 --dir test-logs/run-12345 LsRemoteWithRealGitbranch_with_hyphen653344360/001' 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/pkg/tool/linux_amd64/link GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linuremote.origin.url(http block)/usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12345/artifacts --jq .artifacts[].name git rgo/bin/bash --show-toplevel infocmp /usr/bin/git git rev-�� 3432-57372/test-1757158644/custom/workflows git /opt/hostedtoolcache/node/24.14.1/x64/bin/node --show-toplevel git /usr/bin/gh node(http block)https://api.github.com/repos/github/gh-aw/actions/runs/12346/artifacts/usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12346/artifacts --jq .artifacts[].name mLsRemoteWithRealGitbranch_with_hyphen653344360/001' 64/bin/go GOINSECURE GOMOD GOMODCACHE go env b/workflows GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linuorigin(http block)/usr/bin/gh gh run download 12346 --dir test-logs/run-12346 GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linuremote.origin.url(http block)/usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12346/artifacts --jq .artifacts[].name git nfig/composer/vendor/bin/bash --show-toplevel gh /usr/bin/git git rev-�� /ref/tags/v8 git /opt/hostedtoolcache/node/24.14.1/x64/bin/node --show-toplevel git /usr/bin/infocmp--show-toplevel node(http block)https://api.github.com/repos/github/gh-aw/actions/runs/2/artifacts/usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/2/artifacts --jq .artifacts[].name GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE util.test GOINSECURE GOMOD GOMODCACHE util.test(http block)/usr/bin/gh gh run download 2 --dir test-logs/run-2 GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env 2298409650 go ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)/usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/2/artifacts --jq .artifacts[].name git /usr/bin/git --show-toplevel node /usr/bin/git git rev-�� --show-toplevel git /opt/hostedtoolcache/node/24.14.1/x64/bin/node --show-toplevel git /usr/bin/git node(http block)https://api.github.com/repos/github/gh-aw/actions/runs/3/artifacts/usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/3/artifacts --jq .artifacts[].name GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env l.go l_test.go x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile(http block)/usr/bin/gh gh run download 3 --dir test-logs/run-3 GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)/usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/3/artifacts --jq .artifacts[].name git ache/go/1.25.8/x64/pkg/tool/linux_amd64/link --show-toplevel node /usr/bin/git ache/go/1.25.8/x64/pkg/tool/linux_amd64/link rev-�� 9122883/b411/parser.test git 9122883/b411/importcfg.link --show-toplevel git /usr/bin/git C3c5HHWTCGWHG/sa_PJ1bfEyjNI0nWsuwB/chWebqJ2LcoGLX59IGTc/2ZQVBuIC3c5HHWTCGWHG(http block)https://api.github.com/repos/github/gh-aw/actions/runs/4/artifacts/usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/4/artifacts --jq .artifacts[].name GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env til.go o 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile(http block)/usr/bin/gh gh run download 4 --dir test-logs/run-4 GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env 2298409650 GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)/usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/4/artifacts --jq .artifacts[].name git /usr/bin/git --show-toplevel git /usr/bin/git git rev-�� faultBranchFromLsRemoteWithRealGitmain_branch3259736422/001 faultBranchFromLsRemoteWithRealGitmain_branch3259736422/002/work /opt/hostedtoolcache/node/24.14.1/x64/bin/node --show-toplevel git /usr/bin/git node(http block)https://api.github.com/repos/github/gh-aw/actions/runs/5/artifacts/usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/5/artifacts --jq .artifacts[].name GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile(http block)/usr/bin/gh gh run download 5 --dir test-logs/run-5 GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env 2298409650 GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet(http block)/usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/5/artifacts --jq .artifacts[].name git 9122883/b404/gitutil.test --show-toplevel /opt/hostedtoolcrev-parse /usr/bin/git 9122883/b404/gitutil.test t0 m0s git ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet --show-toplevel git /usr/bin/git ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet(http block)https://api.github.com/repos/github/gh-aw/actions/workflows/usr/bin/gh gh workflow list --json name,state,path b136a0101c461533GOINSECURE GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/xGO111MODULE 9510�� -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)/usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 100 GOMOD GOMODCACHE sh -c npx prettier --c-errorsas GOPROXY 64/bin/go GOSUMDB GOWORK 64/bin/go node(http block)/usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 6 GOMOD GOMODCACHE go env -json GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet(http block)https://api.github.com/repos/github/gh-aw/git/ref/tags/v0.47.4/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v0.47.4 --jq .object.sha --show-toplevel go /usr/bin/git rity1728191266/0git GO111MODULE 64/pkg/tool/linu--show-toplevel git rev-�� --show-toplevel 64/pkg/tool/linux_amd64/link /usr/bin/git ntdrain.test GO111MODULE ortcfg.link git(http block)/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v0.47.4 --jq .object.sha --show-toplevel git /usr/bin/git --show-toplevel /tmp/go-build179rev-parse /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel gh /usr/bin/git git(http block)/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v0.47.4 --jq .object.sha add resolved$ /usr/bin/git ut1666908738/001git git 64/pkg/tool/linu--show-toplevel git rev-�� --git-dir 64/pkg/tool/linumyorg /usr/bin/git --show-toplevel git 64/pkg/tool/linugit-upload-pack 'origin' git(http block)https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.0.0/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq .object.sha edOutput807016572/001 GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet env -json GO111MODULE k GOINSECURE GOMOD GOMODCACHE go(http block)/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq .object.sha --show-toplevel /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/vet /usr/bin/git -bool -buildtags ache/node/24.14.--show-toplevel git rev-�� --show-toplevel /usr/lib/git-core/git /usr/bin/git bility_SameInputgit --auto /usr/bin/git git(http block)/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq .object.sha --show-toplevel git /usr/bin/git --show-toplevel git /usr/bin/git git rev-�� ub/workflows git /usr/bin/gh --show-toplevel git /usr/local/sbin/--show-toplevel gh(http block)https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.2.3/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE sh -c "prettier" --check '**/*.cjs' '*GOINSECURE GOPROXY 64/bin/go GOSUMDB GOWORK 64/bin/go /opt/hostedtoolctest@example.com(http block)/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq .object.sha --show-toplevel git /usr/bin/git --show-toplevel git 54ec9db2551b2556-bool git 9736�� --show-toplevel git /usr/bin/git --show-toplevel git /usr/bin/git git(http block)https://api.github.com/repos/github/gh-aw/git/ref/tags/v2.0.0/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq .object.sha -lWr/pMvCZ1O4tFf-p GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE 3822390/b387/imp-goversion -c che/go-build/81/-c=4 GOPROXY 64/bin/go GOSUMDB GOWORK 64/bin/go /opt/hostedtoolcremote(http block)/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq .object.sha nXB0/duLUpkYj76s-errorsas GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE 3822390/b412/imp-tests -c Gitmain_branch940604893/001' Gitmain_branch940604893/001' 64/bin/go GOSUMDB GOWORK 64/bin/go /opt/hostedtoolcremote.origin.url(http block)/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq .object.sha WXsl/-E8RoUa9ej3-test.timeout=10m0s GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE 3822390/b388/imp^remote\..*\.gh-resolved$ 6048�� 3822390/b388/embedcfg GOPROXY 64/bin/go GOSUMDB GOWORK 64/bin/go /usr/lib/systemd/systemd-executoGO111MODULE(http block)https://api.github.com/repos/github/gh-aw/git/ref/tags/v3.0.0/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq .object.sha gGwF/RYOlu-6iZ7f-s GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE 3822390/b405/imporigin -c che/go-build/d5/d57b711a832dfe81GOINSECURE GOPROXY 64/bin/go GOSUMDB GOWORK run-script/lib/node-gyp-bin/node-json /opt/hostedtoolcache/go/1.25.8/xGO111MODULE(http block)/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq .object.sha --show-toplevel git /usr/bin/git --show-toplevel git 54ec9db2551b2556--show-toplevel git s --show-toplevel git /usr/bin/git --show-toplevel git /usr/bin/git git(http block)https://api.github.com/repos/nonexistent/action/git/ref/tags/v999.999.999/usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq .object.sha edOutput807016572/001 GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet env -json GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)/usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq .object.sha --show-toplevel /tmp/go-build1796189752/b392/agentdrain.test /usr/bin/git sistency_GoAndJagit -test.v=true ache/node/24.14.--show-toplevel git rev-�� --show-toplevel /bin/sh /usr/bin/git bility_SameInputgit git-receive-packrev-parse /usr/bin/git git(http block)/usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq .object.sha --show-toplevel git /usr/bin/git --show-toplevel git /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel git /home/REDACTED/wor--show-toplevel git(http block)https://api.github.com/repos/nonexistent/repo/actions/runs/12345/usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE eutil.test GOINSECURE GOMOD GOMODCACHE eutil.test(http block)/usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion --show-toplevel git /usr/bin/git C3c5HHWTCGWHG/sa_PJ1bfEyjNI0nWsuwB/chWebqJ2LcoGLX59IGTc/2ZQVBuIC3c5HHWTCGWHG js/f�� runs/20260407-113432-57372/test-655447619/.github/workflows git ache/node/24.14.1/x64/bin/node --show-toplevel du /usr/bin/git node(http block)https://api.github.com/repos/owner/repo/actions/workflows/usr/bin/gh gh workflow list --json name,state,path --repo owner/repo -importcfg /tmp/go-build1796189752/b410/importcfg -pack /home/REDACTED/work/gh-aw/gh-aw/pkg/fileutil/fileutil.go /home/REDACTED/work/gh-aw/gh-aw/pkg/fileutil/tar.go env 3822390/b363/_pkGOINSECURE GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)/usr/bin/gh gh workflow list --json name,state,path --repo owner/repo 64/bin/go r code style"; tgo GOMOD GOMODCACHE /sa1 env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)/usr/bin/gh gh workflow list --json name,state,path --repo owner/repo /usr/bin/git --show-toplevel git /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel git ache/go/1.25.8/x-bool git(http block)https://api.github.com/repos/owner/repo/contents/file.md/tmp/go-build1796189752/b396/cli.test /tmp/go-build1796189752/b396/cli.test -test.testlogfile=/tmp/go-build1796189752/b396/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true GOINSECURE GOMOD GOMODCACHE ortcfg env b136a0101c461533GOINSECURE GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/xGO111MODULE(http block)/tmp/go-build1149122883/b224/cli.test /tmp/go-build1149122883/b224/cli.test -test.paniconexit0 -test.timeout=10m0s -test.count=1 rev-�� ithub-script/git/ref/tags/v8 git /usr/bin/git --show-toplevel git 14d9774d git rev-�� --show-toplevel git /usr/bin/git --show-toplevel git /usr/bin/git git(http block)https://api.github.com/repos/test-owner/test-repo/actions/secrets/usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name 56601ca10dd6a081GOINSECURE GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/xGO111MODULE env 3822390/b412/_pkGOINSECURE GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)/usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name --show-toplevel git /usr/bin/git --show-toplevel git /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel git iptables git(http block)If you need me to access, download, or install something from one of these locations, you can either: