Skip to content
Merged
5 changes: 5 additions & 0 deletions .changeset/patch-remove-generated-mcp-workdir-field.md

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

5 changes: 5 additions & 0 deletions .changeset/patch-remove-workdir-mcp-config.md

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 0 additions & 1 deletion .github/workflows/agent-performance-analyzer.lock.yml

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 0 additions & 1 deletion .github/workflows/agent-persona-explorer.lock.yml

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 0 additions & 1 deletion .github/workflows/daily-firewall-report.lock.yml

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 0 additions & 1 deletion .github/workflows/daily-observability-report.lock.yml

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 0 additions & 1 deletion .github/workflows/dev-hawk.lock.yml

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 0 additions & 1 deletion .github/workflows/example-workflow-analyzer.lock.yml

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 0 additions & 1 deletion .github/workflows/metrics-collector.lock.yml

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 0 additions & 1 deletion .github/workflows/python-data-charts.lock.yml

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 0 additions & 1 deletion .github/workflows/security-review.lock.yml

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 0 additions & 1 deletion .github/workflows/smoke-copilot.lock.yml

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

4 changes: 0 additions & 4 deletions pkg/workflow/mcp-config-builtin.go
Original file line number Diff line number Diff line change
Expand Up @@ -82,8 +82,6 @@ func renderAgenticWorkflowsMCPConfigWithOptions(yaml *strings.Builder, isLast bo
yaml.WriteString(" \"entrypointArgs\": [\"mcp-server\"],\n")
// Mount gh-aw binary (read-only), workspace (read-write for status/compile), and temp directory (read-write for logs)
yaml.WriteString(" \"mounts\": [\"" + constants.DefaultGhAwMount + "\", \"" + constants.DefaultWorkspaceMount + "\", \"" + constants.DefaultTmpGhAwMount + "\"],\n")
// Set working directory to workspace for proper command execution context
yaml.WriteString(" \"workdir\": \"${{ github.workspace }}\",\n")

// Note: tools field is NOT included here - the converter script adds it back
// for Copilot. This keeps the gateway config compatible with the schema.
Expand Down Expand Up @@ -138,8 +136,6 @@ func renderAgenticWorkflowsMCPConfigTOML(yaml *strings.Builder) {
yaml.WriteString(" entrypointArgs = [\"mcp-server\"]\n")
// Mount gh-aw binary (read-only), workspace (read-write for status/compile), and temp directory (read-write for logs)
yaml.WriteString(" mounts = [\"" + constants.DefaultGhAwMount + "\", \"" + constants.DefaultWorkspaceMount + "\", \"" + constants.DefaultTmpGhAwMount + "\"]\n")
// Set working directory to workspace for proper command execution context
yaml.WriteString(" workdir = \"${{ github.workspace }}\"\n")
// Use env_vars array to reference environment variables instead of embedding secrets
yaml.WriteString(" env_vars = [\"GITHUB_TOKEN\"]\n")
}
3 changes: 0 additions & 3 deletions pkg/workflow/mcp_config_refactor_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -215,7 +215,6 @@ func TestRenderAgenticWorkflowsMCPConfigWithOptions(t *testing.T) {
`"/opt/gh-aw:/opt/gh-aw:ro"`, // gh-aw binary mount (read-only)
`"${{ github.workspace }}:${{ github.workspace }}:rw"`, // workspace mount (read-write)
`"/tmp/gh-aw:/tmp/gh-aw:rw"`, // temp directory mount (read-write)
`"workdir": "${{ github.workspace }}"`, // working directory for command execution
`"GITHUB_TOKEN": "\${GITHUB_TOKEN}"`,
` },`,
},
Expand All @@ -236,7 +235,6 @@ func TestRenderAgenticWorkflowsMCPConfigWithOptions(t *testing.T) {
`"/opt/gh-aw:/opt/gh-aw:ro"`, // gh-aw binary mount (read-only)
`"${{ github.workspace }}:${{ github.workspace }}:rw"`, // workspace mount (read-write)
`"/tmp/gh-aw:/tmp/gh-aw:rw"`, // temp directory mount (read-write)
`"workdir": "${{ github.workspace }}"`, // working directory for command execution
// Security fix: Now uses shell variable instead of GitHub secret expression
`"GITHUB_TOKEN": "$GITHUB_TOKEN"`,
` }`,
Expand Down Expand Up @@ -390,7 +388,6 @@ func TestRenderAgenticWorkflowsMCPConfigTOML(t *testing.T) {
`"/opt/gh-aw:/opt/gh-aw:ro"`, // gh-aw binary mount (read-only)
`"${{ github.workspace }}:${{ github.workspace }}:rw"`, // workspace mount (read-write)
`"/tmp/gh-aw:/tmp/gh-aw:rw"`, // temp directory mount (read-write)
`workdir = "${{ github.workspace }}"`, // working directory for command execution
`env_vars = ["GITHUB_TOKEN"]`,
}

Expand Down
Loading