aw-failure-investigator.lock.yml

# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"877cbfd584ee20273d7779ea2f3f3a05ea68921613e261610334067d6466645a","body_hash":"1640c2486a54bb5e0ff004e586142923ad9e3ce1773fcbe128bab7a4749f8da4","strict":true,"agent_id":"claude","engine_versions":{"claude":"2.1.245"}}
# gh-aw-manifest: {"version":1,"secrets":["ANTHROPIC_API_KEY","COPILOT_GITHUB_TOKEN","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GH_AW_OTEL_GRAFANA_AUTHORIZATION","GH_AW_OTEL_GRAFANA_ENDPOINT","GH_AW_OTEL_SENTRY_AUTHORIZATION","GH_AW_OTEL_SENTRY_ENDPOINT","GITHUB_TOKEN"],"actions":[{"repo":"actions/cache","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/cache/restore","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/cache/save","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/checkout","sha":"3d3c42e5aac5ba805825da76410c181273ba90b1","version":"v7.0.1"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-go","sha":"b7ad1dad31e06c5925ef5d2fc7ad053ef454303e","version":"v7.0.0"},{"repo":"actions/setup-node","sha":"820762786026740c76f36085b0efc47a31fe5020","version":"v7.0.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"},{"repo":"docker/build-push-action","sha":"53b7df96c91f9c12dcc8a07bcb9ccacbed38856a","version":"v7.3.0"},{"repo":"docker/setup-buildx-action","sha":"37fe631027851001ddb9b187196cc803df7f5f0e","version":"v4.3.0"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.28.7","digest":"sha256:40a1e30b1b8d70642d4292485146cd5af612730d7a6a2e12706ddd13df375059","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.28.7@sha256:40a1e30b1b8d70642d4292485146cd5af612730d7a6a2e12706ddd13df375059"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.28.7","digest":"sha256:4f209dd4cbc74d47a6c7379956143de293429d1b1b2fb2647776cdcbf65836a1","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.28.7@sha256:4f209dd4cbc74d47a6c7379956143de293429d1b1b2fb2647776cdcbf65836a1"},{"image":"ghcr.io/github/gh-aw-firewall/cli-proxy:0.28.7","digest":"sha256:ebc8758c9b085ca244234e3e3ee22300d150095f9bfe7312ca8a61c5acb34a78","pinned_image":"ghcr.io/github/gh-aw-firewall/cli-proxy:0.28.7@sha256:ebc8758c9b085ca244234e3e3ee22300d150095f9bfe7312ca8a61c5acb34a78"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.28.7","digest":"sha256:fb362a08d4d2f0da6c036e3f5d3b2fd87931e857fec3ca4a241cd2f2b61131f9","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.28.7@sha256:fb362a08d4d2f0da6c036e3f5d3b2fd87931e857fec3ca4a241cd2f2b61131f9"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.4.10","digest":"sha256:08bb5fa417aed94b40a14e2b7b3ae457531a5f22b143a32fe58317139d9b8f42","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.4.10@sha256:08bb5fa417aed94b40a14e2b7b3ae457531a5f22b143a32fe58317139d9b8f42"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:bac2192f6374d6262116399b34fc5e143d576f82719e90a18261cae7480f4d4e","pinned_image":"ghcr.io/github/gh-aw-node@sha256:bac2192f6374d6262116399b34fc5e143d576f82719e90a18261cae7480f4d4e"},{"image":"ghcr.io/github/github-mcp-server:v1.10.1","digest":"sha256:1817b57d43916532dc002bdc5f344d639bd9fb54a9148d42168458f7c3280567","pinned_image":"ghcr.io/github/github-mcp-server:v1.10.1@sha256:1817b57d43916532dc002bdc5f344d639bd9fb54a9148d42168458f7c3280567"}],"mcp_servers":[{"name":"agenticworkflows","tools":["*"]},{"name":"safeoutputs","tools":["create_issue","link_sub_issue","missing_data","missing_tool","noop","update_issue"]}]}
# This file was automatically generated by gh-aw. DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md
#
#    ___                   _   _
#   / _ \                 | | (_)
#  | |_| | __ _  ___ _ __ | |_ _  ___
#  |  _  |/ _` |/ _ \ '_ \| __| |/ __|
#  | | | | (_| |  __/ | | | |_| | (__
#  \_| |_/\__, |\___|_| |_|\__|_|\___|
#          __/ |
#  _    _ |___/
# | |  | |                / _| |
# | |  | | ___ _ __ _  __| |_| | _____      ____
# | |/\| |/ _ \ '__| |/ /|  _| |/ _ \ \ /\ / / ___|
# \  /\  / (_) | | | | ( | | | | (_) \ V  V /\__ \
#  \/  \/ \___/|_| |_|\_\|_| |_|\___/ \_/\_/ |___/
#
#
# To update this file, edit the corresponding .md file and run:
#   gh aw compile
# Not all edits will cause changes to this file.
#
# For more information: https://github.github.com/gh-aw/introduction/overview/
#
# Investigates [aw] failures from the last 6 hours, correlates with open agentic-workflows issues, closes fixed issues, and opens focused fix sub-issues when needed
#
# Resolved workflow manifest:
#   Imports:
#     - shared/default-ai-credits-pricing.md
#     - shared/graders/recurrence-determinism.md
#     - shared/graders/recurrence-laminarity.md
#     - shared/graders/state-revisit-probability-rep.md
#     - shared/graders.md
#     - shared/meta-analysis-base.md
#     - shared/otlp.md
#     - shared/reporting.md
#
# Secrets used:
#   - ANTHROPIC_API_KEY
#   - COPILOT_GITHUB_TOKEN
#   - GH_AW_GITHUB_MCP_SERVER_TOKEN
#   - GH_AW_GITHUB_TOKEN
#   - GH_AW_OTEL_GRAFANA_AUTHORIZATION
#   - GH_AW_OTEL_GRAFANA_ENDPOINT
#   - GH_AW_OTEL_SENTRY_AUTHORIZATION
#   - GH_AW_OTEL_SENTRY_ENDPOINT
#   - GITHUB_TOKEN
#
# Custom actions used:
#   - actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
#   - actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
#   - actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
#   - actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
#   - actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
#   - actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
#   - actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 (source v9)
#   - actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
#   - actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
#   - actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
#   - docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
#   - docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
#
# Container images used:
#   - ghcr.io/github/gh-aw-firewall/agent:0.28.7@sha256:40a1e30b1b8d70642d4292485146cd5af612730d7a6a2e12706ddd13df375059
#   - ghcr.io/github/gh-aw-firewall/api-proxy:0.28.7@sha256:4f209dd4cbc74d47a6c7379956143de293429d1b1b2fb2647776cdcbf65836a1
#   - ghcr.io/github/gh-aw-firewall/cli-proxy:0.28.7@sha256:ebc8758c9b085ca244234e3e3ee22300d150095f9bfe7312ca8a61c5acb34a78
#   - ghcr.io/github/gh-aw-firewall/squid:0.28.7@sha256:fb362a08d4d2f0da6c036e3f5d3b2fd87931e857fec3ca4a241cd2f2b61131f9
#   - ghcr.io/github/gh-aw-mcpg:v0.4.10@sha256:08bb5fa417aed94b40a14e2b7b3ae457531a5f22b143a32fe58317139d9b8f42
#   - ghcr.io/github/gh-aw-node@sha256:bac2192f6374d6262116399b34fc5e143d576f82719e90a18261cae7480f4d4e
#   - ghcr.io/github/github-mcp-server:v1.10.1@sha256:1817b57d43916532dc002bdc5f344d639bd9fb54a9148d42168458f7c3280567

name: "[aw] Failure Investigator (6h)"
on:
  schedule:
    - cron: "43 */6 * * *"  # Friendly format: every 6h (scattered)
  workflow_dispatch:
    inputs:
      aw_context:
        default: ""
        description: "Agent caller context (used internally by Agentic Workflows)."
        required: false
        type: string

permissions: {}

concurrency:
  group: "gh-aw-${{ github.workflow }}"
  queue: max

run-name: "[aw] Failure Investigator (6h)"

env:
  OTEL_EXPORTER_OTLP_ENDPOINT: ${{ secrets.GH_AW_OTEL_SENTRY_ENDPOINT }}
  OTEL_SERVICE_NAME: gh-aw.aw-failure-investigator
  OTEL_RESOURCE_ATTRIBUTES: 'gh-aw.workflow.name=%5Baw%5D%20Failure%20Investigator%20%286h%29,gh-aw.repository=${{ github.repository }},gh-aw.run.id=${{ github.run_id }},github.run_id=${{ github.run_id }},gh-aw.engine.id=claude'
  OTEL_EXPORTER_OTLP_HEADERS: x-sentry-auth=${{ secrets.GH_AW_OTEL_SENTRY_AUTHORIZATION }}
  GH_AW_OTLP_ALL_HEADERS: x-sentry-auth=${{ secrets.GH_AW_OTEL_SENTRY_AUTHORIZATION }},Authorization=${{ secrets.GH_AW_OTEL_GRAFANA_AUTHORIZATION }}
  GH_AW_OTLP_ENDPOINTS: '[{"url":"${{ secrets.GH_AW_OTEL_SENTRY_ENDPOINT }}","headers":"x-sentry-auth=${{ secrets.GH_AW_OTEL_SENTRY_AUTHORIZATION }}"},{"url":"${{ secrets.GH_AW_OTEL_GRAFANA_ENDPOINT }}","headers":"Authorization=${{ secrets.GH_AW_OTEL_GRAFANA_AUTHORIZATION }}"}]'

# Cache configuration from frontmatter was processed and added to the main job steps

jobs:
  activation:
    runs-on: ubuntu-slim
    permissions:
      actions: read
      contents: read
    env:
      GH_AW_MAX_DAILY_AI_CREDITS: "10000"
      GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }}
    outputs:
      comment_id: ""
      comment_repo: ""
      daily_ai_credits_exceeded: ${{ steps.daily-effective-workflow-guardrail.outputs.daily_ai_credits_exceeded == 'true' }}
      daily_ai_credits_guardrail_status: ${{ steps.daily-effective-workflow-guardrail.outputs.daily_ai_credits_guardrail_status || '' }}
      daily_ai_credits_threshold: ${{ steps.daily-effective-workflow-guardrail.outputs.daily_ai_credits_threshold || '' }}
      daily_ai_credits_total_effective_tokens: ${{ steps.daily-effective-workflow-guardrail.outputs.daily_ai_credits_total_effective_tokens || '' }}
      engine_id: ${{ steps.generate_aw_info.outputs.engine_id }}
      experiments: ${{ steps.pick-experiment.outputs.experiments }}
      lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }}
      model: ${{ steps.generate_aw_info.outputs.model }}
      oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }}
      secret_verification_result: ${{ steps.validate-secret.outputs.verification_result }}
      setup-parent-span-id: ${{ steps.setup.outputs.parent-span-id || steps.setup.outputs.span-id }}
      setup-span-id: ${{ steps.setup.outputs.span-id }}
      setup-trace-id: ${{ steps.setup.outputs.trace-id }}
      stale_lock_file_failed: ${{ steps.check-lock-file.outputs.stale_lock_file_failed == 'true' }}
      tone_variant: ${{ steps.pick-experiment.outputs.tone_variant }}
    steps:
      - name: Checkout actions folder
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          repository: github/gh-aw
          sparse-checkout: |
            actions
          clean: false
          persist-credentials: false
      - name: Setup Scripts
        id: setup
        uses: ./actions/setup
        with:
          destination: ${{ runner.temp }}/gh-aw/actions
          job-name: ${{ github.job }}
          safe-output-artifact-client: ${{ env.GH_AW_MAX_DAILY_AI_CREDITS != '' }}
        env:
          GH_AW_SETUP_WORKFLOW_NAME: "[aw] Failure Investigator (6h)"
          GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/aw-failure-investigator.lock.yml@${{ github.ref }}
          GH_AW_INFO_VERSION: "2.1.245"
          GH_AW_INFO_AWF_VERSION: "v0.28.7"
          GH_AW_INFO_ENGINE_ID: "claude"
      - name: Mask OTLP telemetry headers
        run: bash "${RUNNER_TEMP}/gh-aw/actions/mask_otlp_headers.sh"
      - name: Generate agentic run info
        id: generate_aw_info
        env:
          GH_AW_INFO_ENGINE_ID: "claude"
          GH_AW_INFO_ENGINE_NAME: "Claude Code"
          GH_AW_INFO_MODEL: ${{ vars.GH_AW_MODEL_AGENT_CLAUDE || vars.GH_AW_DEFAULT_MODEL_CLAUDE || 'agent' }}
          GH_AW_INFO_VERSION: "2.1.245"
          GH_AW_INFO_AGENT_VERSION: "2.1.245"
          GH_AW_INFO_WORKFLOW_NAME: "[aw] Failure Investigator (6h)"
          GH_AW_INFO_EXPERIMENTAL: "false"
          GH_AW_INFO_SUPPORTS_TOOLS_ALLOWLIST: "true"
          GH_AW_INFO_STAGED: "false"
          GH_AW_INFO_ALLOWED_DOMAINS: '["*.grafana.net","*.sentry.io","defaults"]'
          GH_AW_INFO_FIREWALL_ENABLED: "true"
          GH_AW_INFO_AWF_VERSION: "v0.28.7"
          GH_AW_INFO_AWMG_VERSION: ""
          GH_AW_INFO_FIREWALL_TYPE: "squid"
          GH_AW_INFO_AGENT_RUNTIME: "gvisor"
          GH_AW_INFO_FRONTMATTER_EMOJI: "🔍"
          GH_AW_COMPILED_STRICT: "true"
          GH_AW_INFO_FEATURES: '{"gh-aw-detection":true}'
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          script: |
            const path = require('path');
            const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
            const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
            setupGlobals(core, github, context, exec, io, getOctokit);
            const { main } = require(path.join(actionsDir, 'generate_aw_info.cjs'));
            await main(core, context);
      - name: Restore daily AIC usage cache
        id: restore-daily-aic-cache
        if: ${{ env.GH_AW_MAX_DAILY_AI_CREDITS != '' }}
        continue-on-error: true
        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          key: agentic-workflow-usage-awfailureinvestigator-${{ github.run_id }}
          restore-keys: agentic-workflow-usage-awfailureinvestigator-
          path: /tmp/gh-aw/agentic-workflow-usage-cache.jsonl
      - name: Restore daily AIC usage cache (artifact fallback)
        id: restore-daily-aic-cache-fallback
        if: ${{ env.GH_AW_MAX_DAILY_AI_CREDITS != '' }}
        continue-on-error: true
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          GH_AW_RESTORE_DAILY_AIC_CACHE_HIT: ${{ steps.restore-daily-aic-cache.outputs.cache-hit }}
          GH_AW_RESTORE_DAILY_AIC_CACHE_MATCHED_KEY: ${{ steps.restore-daily-aic-cache.outputs.cache-matched-key }}
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const path = require('path');
            const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
            const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
            setupGlobals(core, github, context, exec, io, getOctokit);
            const { main } = require(path.join(actionsDir, 'restore_aic_usage_cache_fallback.cjs'));
            await main();
      - name: Check daily workflow token guardrail
        id: daily-effective-workflow-guardrail
        if: ${{ env.GH_AW_MAX_DAILY_AI_CREDITS != '' }}
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          GH_AW_WORKFLOW_NAME: "[aw] Failure Investigator (6h)"
          GH_AW_WORKFLOW_ID: "aw-failure-investigator"
          GH_AW_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
          GH_AW_WORKFLOW_DISPATCH_AW_CONTEXT: ${{ github.event.inputs.aw_context || '' }}
          GH_AW_HAS_SLASH_COMMAND: "false"
          GH_AW_HAS_LABEL_COMMAND: "false"
          GH_AW_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GH_AW_MAX_DAILY_AI_CREDITS: "10000"
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const path = require('path');
            const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
            const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
            setupGlobals(core, github, context, exec, io, getOctokit);
            const { main } = require(path.join(actionsDir, 'check_daily_aic_workflow_guardrail.cjs'));
            await main();
      - name: Validate ANTHROPIC_API_KEY secret
        id: validate-secret
        run: bash "${RUNNER_TEMP}/gh-aw/actions/validate_multi_secret.sh" ANTHROPIC_API_KEY 'Claude Code' https://github.github.com/gh-aw/reference/engines/#anthropic-claude-code
        env:
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
      - name: Check for OAuth tokens
        id: check-oauth-tokens
        run: bash "${RUNNER_TEMP}/gh-aw/actions/check_oauth_tokens.sh"
        env:
          COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
          GH_AW_GITHUB_TOKEN: ${{ secrets.GH_AW_GITHUB_TOKEN }}
          GH_AW_GITHUB_MCP_SERVER_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN }}
      - name: Checkout .github and .agents folders
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          sparse-checkout: |
            .github
            .agents
            actions/setup
            .claude
            .codex
            .gemini
            .pi
          sparse-checkout-cone-mode: true
          fetch-depth: 1
      - name: Save agent config folders for base branch restoration
        env:
          GH_AW_AGENT_FOLDERS: ".agents .claude .github"
          GH_AW_AGENT_FILES: "AGENTS.md CLAUDE.md"
        run: |
          bash "${RUNNER_TEMP}/gh-aw/actions/save_base_github_folders.sh"
      - name: Check workflow lock file
        id: check-lock-file
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          GH_AW_WORKFLOW_FILE: "aw-failure-investigator.lock.yml"
          GH_AW_CONTEXT_WORKFLOW_REF: "${{ github.workflow_ref }}"
        with:
          script: |
            const path = require('path');
            const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
            const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
            setupGlobals(core, github, context, exec, io, getOctokit);
            const { main } = require(path.join(actionsDir, 'check_workflow_timestamp_api.cjs'));
            await main();
      - name: Log runtime features
        if: ${{ contains(toJSON(vars), '"GH_AW_RUNTIME_FEATURES":') }}
        run: bash "${RUNNER_TEMP}/gh-aw/actions/log_runtime_features_summary.sh"
      - name: Restore experiment state from git
        id: restore-experiment-state
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          GH_AW_EXPERIMENT_STATE_FILE: /tmp/gh-aw/experiments/state.jsonl
          GH_AW_EXPERIMENT_STATE_DIR: /tmp/gh-aw/experiments
          GH_AW_EXPERIMENT_BRANCH: experiments/awfailureinvestigator
        with:
          script: |
            const path = require('path');
            const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
            const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
            setupGlobals(core, github, context, exec, io, getOctokit);
            const { main } = require(path.join(actionsDir, 'load_experiment_state_from_repo.cjs'));
            await main();
      - name: Pick experiment variants
        id: pick-experiment
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          GH_AW_EXPERIMENT_SPEC: '{"tone_variant":{"variants":["clinical","assertive","narrative"],"description":"Tests whether report tone (clinical/assertive/narrative) affects output efficiency and engineer engagement on failure investigation issues","hypothesis":"H0: no change in output_length_chars across tone variants. H1: assertive tone produces shorter, more actionable outputs than clinical or narrative, with equivalent or better sub-issue quality.","metric":"output_length_chars","secondary_metrics":["issue_creation_rate","sub_issue_link_count","run_duration_seconds"],"guardrail_metrics":[{"name":"run_success_rate","threshold":"\u003e=0.85"}],"min_samples":50,"weight":[34,33,33],"issue":36105,"start_date":"2026-05-31","analysis_type":"mann_whitney","tags":["tone","output-quality","triage"]}}'
          GH_AW_EXPERIMENT_STATE_FILE: /tmp/gh-aw/experiments/state.jsonl
          GH_AW_EXPERIMENT_STATE_DIR: /tmp/gh-aw/experiments
          GH_AW_HARNESS_VERSION: 877cbfd584ee20273d7779ea2f3f3a05ea68921613e261610334067d6466645a:1640c2486a54bb5e0ff004e586142923ad9e3ce1773fcbe128bab7a4749f8da4
        with:
          script: |
            const path = require('path');
            const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
            const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
            setupGlobals(core, github, context, exec, io, getOctokit);
            const { main } = require(path.join(actionsDir, 'pick_experiment.cjs'));
            await main();
      - name: Upload experiment artifact
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: awfailureinvestigator-experiment
          path: /tmp/gh-aw/experiments
          if-no-files-found: ignore
          retention-days: 30
      - name: Create prompt with built-in context
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          GH_AW_ACTIONS_DIR: ${{ runner.temp }}/gh-aw/actions
          GH_AW_PROMPT: ${{ runner.temp }}/gh-aw/aw-prompts/prompt.txt
          GH_AW_SAFE_OUTPUTS: ${{ runner.temp }}/gh-aw/safeoutputs/outputs.jsonl
          GH_AW_PROMPT_CONFIG: "{\"items\":[{\"content_env\":\"GH_AW_PROMPT_CONTENT_0000\"},{\"file\":\"xpia.md\"},{\"file\":\"temp_folder_prompt.md\"},{\"file\":\"markdown.md\"},{\"file\":\"safe_outputs_prompt.md\"},{\"content_env\":\"GH_AW_PROMPT_CONTENT_0001\"},{\"content_env\":\"GH_AW_PROMPT_CONTENT_0002\"},{\"file\":\"mcp_cli_tools_with_safeoutputs_prompt.md\"},{\"content_env\":\"GH_AW_PROMPT_CONTENT_0003\"},{\"file\":\"cli_proxy_with_safeoutputs_prompt.md\"},{\"content_env\":\"GH_AW_PROMPT_CONTENT_0004\"},{\"content_env\":\"GH_AW_PROMPT_CONTENT_0005\"},{\"content_env\":\"GH_AW_PROMPT_CONTENT_0006\"},{\"content_env\":\"GH_AW_PROMPT_CONTENT_0007\"},{\"content_env\":\"GH_AW_PROMPT_CONTENT_0008\"},{\"content_env\":\"GH_AW_PROMPT_CONTENT_0009\"},{\"content_env\":\"GH_AW_PROMPT_CONTENT_0010\"},{\"content_env\":\"GH_AW_PROMPT_CONTENT_0011\"},{\"content_env\":\"GH_AW_PROMPT_CONTENT_0012\"},{\"content_env\":\"GH_AW_PROMPT_CONTENT_0013\"}]}"
          GH_AW_EXPERIMENTS_TONE_VARIANT: ${{ steps.pick-experiment.outputs.tone_variant }}
          GH_AW_EXPR_1A3A194A: ${{ github.event.discussion.number || (fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_type == 'discussion' && fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_number) }}
          GH_AW_EXPR_463A214A: ${{ github.event.pull_request.number || (fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_type == 'pull_request' && fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_number) }}
          GH_AW_EXPR_802A9F6A: ${{ github.event.issue.number || (fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_type == 'issue' && fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_number) }}
          GH_AW_EXPR_FF1D34CE: ${{ github.event.comment.id || fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').comment_id }}
          GH_AW_GITHUB_ACTOR: ${{ github.actor }}
          GH_AW_GITHUB_REPOSITORY: ${{ github.repository }}
          GH_AW_GITHUB_RUN_ID: ${{ github.run_id }}
          GH_AW_GITHUB_WORKSPACE: ${{ github.workspace }}
          GH_AW_PROMPT_CONTENT_0000: "<system>\n"
          GH_AW_PROMPT_CONTENT_0001: "<safe-output-tools>\nTools: create_issue(max:2), update_issue(max:10), link_sub_issue(max:10), missing_tool, missing_data, noop\n"
          GH_AW_PROMPT_CONTENT_0002: "</safe-output-tools>\n"
          GH_AW_PROMPT_CONTENT_0003: "<github-context>\nThe following GitHub context information is available for this workflow:\n{{#if github.actor}}\n- **actor**: __GH_AW_GITHUB_ACTOR__\n{{/if}}\n{{#if github.repository}}\n- **repository**: __GH_AW_GITHUB_REPOSITORY__\n{{/if}}\n{{#if github.workspace}}\n- **workspace**: __GH_AW_GITHUB_WORKSPACE__\n{{/if}}\n{{#if github.event.issue.number || (github.aw.context.item_type == 'issue' && github.aw.context.item_number)}}\n- **issue-number**: #__GH_AW_EXPR_802A9F6A__\n{{/if}}\n{{#if github.event.discussion.number || (github.aw.context.item_type == 'discussion' && github.aw.context.item_number)}}\n- **discussion-number**: #__GH_AW_EXPR_1A3A194A__\n{{/if}}\n{{#if github.event.pull_request.number || (github.aw.context.item_type == 'pull_request' && github.aw.context.item_number)}}\n- **pull-request-number**: #__GH_AW_EXPR_463A214A__\n{{/if}}\n{{#if github.event.comment.id || github.aw.context.comment_id}}\n- **comment-id**: __GH_AW_EXPR_FF1D34CE__\n{{/if}}\n{{#if github.run_id}}\n- **workflow-run-id**: __GH_AW_GITHUB_RUN_ID__\n{{/if}}\n</github-context>\n\n"
          GH_AW_PROMPT_CONTENT_0004: "</system>\n"
          GH_AW_PROMPT_CONTENT_0005: "**IMPORTANT**: When analyzing agentic workflows, use the `agentic-workflows` tool to read workflow files.\n"
          GH_AW_PROMPT_CONTENT_0006: "{{#runtime-import .github/workflows/shared/reporting.md}}\n"
          GH_AW_PROMPT_CONTENT_0007: "{{#runtime-import .github/workflows/shared/otlp.md}}\n"
          GH_AW_PROMPT_CONTENT_0008: "{{#runtime-import .github/workflows/shared/default-ai-credits-pricing.md}}\n"
          GH_AW_PROMPT_CONTENT_0009: "{{#runtime-import .github/workflows/shared/graders.md}}\n"
          GH_AW_PROMPT_CONTENT_0010: "{{#runtime-import .github/workflows/shared/graders/state-revisit-probability-rep.md}}\n"
          GH_AW_PROMPT_CONTENT_0011: "{{#runtime-import .github/workflows/shared/graders/recurrence-determinism.md}}\n"
          GH_AW_PROMPT_CONTENT_0012: "{{#runtime-import .github/workflows/shared/graders/recurrence-laminarity.md}}\n"
          GH_AW_PROMPT_CONTENT_0013: "{{#runtime-import .github/workflows/aw-failure-investigator.md}}\n"
        with:
          script: |
            const { setupGlobals } = require(process.env.GH_AW_ACTIONS_DIR + '/setup_globals.cjs');
            setupGlobals(core, github, context, exec, io, getOctokit);
            const { main } = require(process.env.GH_AW_ACTIONS_DIR + '/create_prompt.cjs');
            await main(core);
      - name: Interpolate variables and render templates
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          GH_AW_PROMPT: ${{ runner.temp }}/gh-aw/aw-prompts/prompt.txt
          GH_AW_ENGINE_ID: "claude"
          GH_AW_GITHUB_REPOSITORY: ${{ github.repository }}
          GH_AW_EXPERIMENTS_TONE_VARIANT: ${{ steps.pick-experiment.outputs.tone_variant }}
        with:
          script: |
            const path = require('path');
            const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
            const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
            setupGlobals(core, github, context, exec, io, getOctokit);
            const { main } = require(path.join(actionsDir, 'interpolate_prompt.cjs'));
            await main();
      - name: Substitute placeholders
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          GH_AW_PROMPT: ${{ runner.temp }}/gh-aw/aw-prompts/prompt.txt
          GH_AW_EXPERIMENTS_TONE_VARIANT: ${{ steps.pick-experiment.outputs.tone_variant }}
          GH_AW_EXPR_1A3A194A: ${{ github.event.discussion.number || (fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_type == 'discussion' && fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_number) }}
          GH_AW_EXPR_463A214A: ${{ github.event.pull_request.number || (fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_type == 'pull_request' && fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_number) }}
          GH_AW_EXPR_802A9F6A: ${{ github.event.issue.number || (fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_type == 'issue' && fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_number) }}
          GH_AW_EXPR_FF1D34CE: ${{ github.event.comment.id || fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').comment_id }}
          GH_AW_GITHUB_ACTOR: ${{ github.actor }}
          GH_AW_GITHUB_REPOSITORY: ${{ github.repository }}
          GH_AW_GITHUB_RUN_ID: ${{ github.run_id }}
          GH_AW_GITHUB_WORKSPACE: ${{ github.workspace }}
          GH_AW_MCP_CLI_SERVERS_LIST: "- `agenticworkflows` — run `agenticworkflows --help` to see available tools\n- `safeoutputs` — run `safeoutputs --help` to see available tools"
        with:
          script: |
            const path = require('path');
            const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
            const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
            setupGlobals(core, github, context, exec, io, getOctokit);

            const substitutePlaceholders = require(path.join(actionsDir, 'substitute_placeholders.cjs'));

            // Call the substitution function
            return await substitutePlaceholders({
              file: process.env.GH_AW_PROMPT,
              substitutions: {
                GH_AW_EXPERIMENTS_TONE_VARIANT: process.env.GH_AW_EXPERIMENTS_TONE_VARIANT,
                GH_AW_EXPR_1A3A194A: process.env.GH_AW_EXPR_1A3A194A,
                GH_AW_EXPR_463A214A: process.env.GH_AW_EXPR_463A214A,
                GH_AW_EXPR_802A9F6A: process.env.GH_AW_EXPR_802A9F6A,
                GH_AW_EXPR_FF1D34CE: process.env.GH_AW_EXPR_FF1D34CE,
                GH_AW_GITHUB_ACTOR: process.env.GH_AW_GITHUB_ACTOR,
                GH_AW_GITHUB_REPOSITORY: process.env.GH_AW_GITHUB_REPOSITORY,
                GH_AW_GITHUB_RUN_ID: process.env.GH_AW_GITHUB_RUN_ID,
                GH_AW_GITHUB_WORKSPACE: process.env.GH_AW_GITHUB_WORKSPACE,
                GH_AW_MCP_CLI_SERVERS_LIST: process.env.GH_AW_MCP_CLI_SERVERS_LIST
              }
            });
      - name: Validate prompt placeholders
        env:
          GH_AW_PROMPT: ${{ runner.temp }}/gh-aw/aw-prompts/prompt.txt
        run: |
          bash "${RUNNER_TEMP}/gh-aw/actions/validate_prompt_placeholders.sh"
      - name: Print prompt
        env:
          GH_AW_PROMPT: ${{ runner.temp }}/gh-aw/aw-prompts/prompt.txt
        run: |
          bash "${RUNNER_TEMP}/gh-aw/actions/print_prompt_summary.sh"
      - name: Stage prompt files for artifact upload
        run: |
          mkdir -p /tmp/gh-aw/aw-prompts
          cp -a "${RUNNER_TEMP}/gh-aw/aw-prompts/." /tmp/gh-aw/aw-prompts/
      - name: Upload activation artifact
        if: success() || failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: activation
          include-hidden-files: true
          path: |
            /tmp/gh-aw/aw_info.json
            /tmp/gh-aw/models.json
            /tmp/gh-aw/aw-prompts/prompt.txt
            /tmp/gh-aw/aw-prompts/prompt-template.txt
            /tmp/gh-aw/aw-prompts/prompt-import-tree.json
            /tmp/gh-aw/github_rate_limits.jsonl
            /tmp/gh-aw/base
            /tmp/gh-aw/.claude/agents
            /tmp/gh-aw/.claude/skills
          if-no-files-found: ignore
          retention-days: 1

  agent:
    needs: activation
    if: needs.activation.outputs.daily_ai_credits_exceeded != 'true'
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      issues: read
      pull-requests: read
    concurrency:
      group: "gh-aw-claude-${{ github.workflow }}"
      queue: max
    timeout-minutes: 60
    env:
      DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
      GH_AW_ASSETS_ALLOWED_EXTS: ""
      GH_AW_ASSETS_BRANCH: ""
      GH_AW_ASSETS_MAX_SIZE_KB: 0
      GH_AW_MCP_LOG_DIR: /tmp/gh-aw/mcp-logs/safeoutputs
      GH_AW_PROJECT_UTC: "-08:00"
      GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }}
      GH_AW_WORKFLOW_ID_SANITIZED: awfailureinvestigator
    outputs:
      agentic_engine_timeout: ${{ steps.detect-agent-errors.outputs.agentic_engine_timeout || 'false' }}
      ai_credits_rate_limit_error: ${{ steps.parse-mcp-gateway.outputs.ai_credits_rate_limit_error || 'false' }}
      aic: ${{ steps.parse-mcp-gateway.outputs.aic }}
      ambient_context: ${{ steps.parse-mcp-gateway.outputs.ambient_context }}
      checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
      effective_tokens: ${{ steps.parse-mcp-gateway.outputs.effective_tokens }}
      has_patch: ${{ steps.collect_output.outputs.has_patch }}
      http_400_response_error: ${{ steps.detect-agent-errors.outputs.http_400_response_error || 'false' }}
      inference_access_error: ${{ steps.detect-agent-errors.outputs.inference_access_error || 'false' }}
      invocation_cap_exceeded: ${{ steps.detect-agent-errors.outputs.invocation_cap_exceeded || 'false' }}
      max_cache_misses_exceeded: ${{ steps.detect-agent-errors.outputs.max_cache_misses_exceeded || 'false' }}
      mcp_policy_error: ${{ steps.detect-agent-errors.outputs.mcp_policy_error || 'false' }}
      missing_model_pricing_error: ${{ steps.detect-agent-errors.outputs.missing_model_pricing_error || 'false' }}
      missing_model_pricing_model_name: ${{ steps.detect-agent-errors.outputs.missing_model_pricing_model_name || '' }}
      model: ${{ needs.activation.outputs.model }}
      model_not_supported_error: ${{ steps.detect-agent-errors.outputs.model_not_supported_error || 'false' }}
      output: ${{ steps.collect_output.outputs.output }}
      output_types: ${{ steps.collect_output.outputs.output_types }}
      setup-parent-span-id: ${{ steps.setup.outputs.parent-span-id || steps.setup.outputs.span-id }}
      setup-span-id: ${{ steps.setup.outputs.span-id }}
      setup-trace-id: ${{ steps.setup.outputs.trace-id }}
      shell_expansion_guard_rejected: ${{ steps.detect-agent-errors.outputs.shell_expansion_guard_rejected || 'false' }}
      unknown_model_ai_credits: ${{ steps.parse-mcp-gateway.outputs.unknown_model_ai_credits || 'false' }}
    steps:
      - name: Checkout actions folder
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          repository: github/gh-aw
          sparse-checkout: |
            actions
          clean: false
          persist-credentials: false
      - name: Setup Scripts
        id: setup
        uses: ./actions/setup
        with:
          destination: ${{ runner.temp }}/gh-aw/actions
          job-name: ${{ github.job }}
          trace-id: ${{ needs.activation.outputs.setup-trace-id }}
          parent-span-id: ${{ needs.activation.outputs.setup-parent-span-id || needs.activation.outputs.setup-span-id }}
        env:
          GH_AW_SETUP_WORKFLOW_NAME: "[aw] Failure Investigator (6h)"
          GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/aw-failure-investigator.lock.yml@${{ github.ref }}
          GH_AW_INFO_VERSION: "2.1.245"
          GH_AW_INFO_AWF_VERSION: "v0.28.7"
          GH_AW_INFO_ENGINE_ID: "claude"
      - name: Set runtime paths
        id: set-runtime-paths
        run: |
          if [ -z "${RUNNER_TOOL_CACHE:-}" ]; then
            echo "RUNNER_TOOL_CACHE=${{ runner.tool_cache }}" >> "$GITHUB_ENV"
          fi
          {
            echo "GH_AW_SAFE_OUTPUTS=${RUNNER_TEMP}/gh-aw/safeoutputs/outputs.jsonl"
            echo "GH_AW_SAFE_OUTPUTS_CONFIG_PATH=${RUNNER_TEMP}/gh-aw/safeoutputs/config.json"
            echo "GH_AW_SAFE_OUTPUTS_TOOLS_PATH=${RUNNER_TEMP}/gh-aw/safeoutputs/tools.json"
          } >> "$GITHUB_OUTPUT"
      - name: Mask OTLP telemetry headers
        run: bash "${RUNNER_TEMP}/gh-aw/actions/mask_otlp_headers.sh"
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Setup Go for CLI build
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod
          cache: true
      - name: Build gh-aw CLI
        run: |
          echo "Building gh-aw CLI for linux/amd64..."
          mkdir -p dist
          VERSION=$(git describe --tags --always --dirty)
          CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build \
            -ldflags "-s -w -X main.version=${VERSION}" \
            -o dist/gh-aw-linux-amd64 \
            ./cmd/gh-aw
          # Copy binary to root for direct execution in user-defined steps
          cp dist/gh-aw-linux-amd64 ./gh-aw
          chmod +x ./gh-aw
          echo "✓ Built gh-aw CLI successfully"
      - name: Setup Docker Buildx
        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
      - name: Build gh-aw Docker image
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
        with:
          context: .
          platforms: linux/amd64
          push: false
          load: true
          tags: localhost/gh-aw:dev
          build-args: |
            BINARY=dist/gh-aw-linux-amd64
      - name: Create gh-aw temp directory
        run: bash "${RUNNER_TEMP}/gh-aw/actions/create_gh_aw_tmp_dir.sh"
      - name: Configure gh CLI for GitHub Enterprise
        run: bash "${RUNNER_TEMP}/gh-aw/actions/configure_gh_for_ghe.sh"
        env:
          GH_TOKEN: ${{ github.token }}
      - name: Download activation artifact
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: activation
          path: /tmp/gh-aw
      - env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        name: Deterministic pre-fetch for failure analysis
        run: "set -euo pipefail\nmkdir -p /tmp/gh-aw/agent/failure-investigator\npython3 - <<'PY'\nimport json\nimport os\nimport re\nimport subprocess\nfrom datetime import datetime, timedelta, timezone\nfrom pathlib import Path\nfrom urllib.parse import urlencode\n\nREPO = os.environ[\"GITHUB_REPOSITORY\"]\nOUT = \"/tmp/gh-aw/agent/failure-investigator/prefetch.json\"\nTRACKER_ID = \"aw-failure-investigator\"\nLOOKBACK_HOURS = 6\nFAILURE_CONCLUSIONS = {\"failure\", \"timed_out\", \"startup_failure\"}\nMAX_DISCOVERY_PAGES = 20\n# Capture this many lines around a fault marker, or from the tail if none exists.\nMAX_LOG_TAIL_LINES = 50\nFAULT_MARKER = re.compile(\n    r\"\\b(?:error|panic|exception|traceback|fatal|abort|segfault|coredump)\\b|\"\n    r\"(?:process|command).*(?:failed|exit code)|(?:exit code|non-zero exit)\",\n    re.IGNORECASE,\n)\n# Deep-dive budget: investigate at most this many distinct failed runs.\nMAX_FAILURES_TO_DETAIL = 5\nAGENTIC_WORKFLOW_PATHS = {\n    f\".github/workflows/{path.name}\"\n    for path in Path(\".github/workflows\").glob(\"*.lock.yml\")\n}\n\ndef cmd_display(args):\n    return \" \".join(args)\n\ndef run_json(args):\n    try:\n        out = subprocess.check_output(args, text=True, stderr=subprocess.STDOUT)\n        return json.loads(out)\n    except subprocess.CalledProcessError as error:\n        print(f\"Warning: command failed: {cmd_display(args)}\")\n        print(error.output)\n        return None\n    except json.JSONDecodeError as error:\n        print(f\"Warning: non-JSON output from command: {cmd_display(args)} ({error})\")\n        return None\n    except OSError as error:\n        print(f\"Warning: could not execute command: {cmd_display(args)} ({error})\")\n        return None\n\ndef run_text(args):\n    try:\n        return subprocess.check_output(args, text=True, stderr=subprocess.STDOUT)\n    except subprocess.CalledProcessError as error:\n        print(f\"Warning: command failed: {cmd_display(args)}\")\n        print(error.output)\n        return \"\"\n    except OSError as error:\n        print(f\"Warning: could not execute command: {cmd_display(args)} ({error})\")\n        return \"\"\n\ndef run_api_json(endpoint, params):\n    query = urlencode(params)\n    return run_json([\"gh\", \"api\", f\"{endpoint}?{query}\"])\n\ndef is_failure_conclusion(conclusion):\n    return (conclusion or \"\").lower() in FAILURE_CONCLUSIONS\n\ndef normalize_workflow_path(path):\n    return (path or \"\").split(\"@\", 1)[0]\n\ndef is_agentic_workflow_path(path):\n    workflow_path = normalize_workflow_path(path)\n    if AGENTIC_WORKFLOW_PATHS:\n        return workflow_path in AGENTIC_WORKFLOW_PATHS\n    print(\"Warning: no local .lock.yml workflows found; falling back to workflow path suffix matching\")\n    return workflow_path.endswith(\".lock.yml\")\n\ndef capture_error_window(log_text):\n    lines = log_text.splitlines()\n    marker_index = next(\n        (index for index in range(len(lines) - 1, -1, -1) if FAULT_MARKER.search(lines[index])),\n        None,\n    )\n    if marker_index is None:\n        captured_lines = lines[-MAX_LOG_TAIL_LINES:]\n    else:\n        start = max(0, min(marker_index - MAX_LOG_TAIL_LINES // 2, len(lines) - MAX_LOG_TAIL_LINES))\n        end = min(len(lines), start + MAX_LOG_TAIL_LINES)\n        captured_lines = lines[start:end]\n    has_fault_marker = any(FAULT_MARKER.search(line) for line in captured_lines)\n    return captured_lines, has_fault_marker\n\ndef isoformat_z(dt):\n    return dt.astimezone(timezone.utc).replace(microsecond=0).isoformat().replace(\"+00:00\", \"Z\")\n\ndef list_failed_agentic_runs():\n    created_since = isoformat_z(datetime.now(timezone.utc) - timedelta(hours=LOOKBACK_HOURS))\n    page = 1\n    failed_runs = []\n\n    while True:\n        response = run_api_json(\n            f\"repos/{REPO}/actions/runs\",\n            {\n                \"exclude_pull_requests\": \"true\",\n                \"status\": \"completed\",\n                \"created\": f\">={created_since}\",\n                \"per_page\": \"100\",\n                \"page\": str(page),\n            },\n        ) or {}\n        workflow_runs = response.get(\"workflow_runs\") or []\n        if not workflow_runs:\n            break\n\n        for run in workflow_runs:\n            workflow_path = normalize_workflow_path(run.get(\"path\"))\n            if not is_agentic_workflow_path(workflow_path):\n                continue\n            if not is_failure_conclusion(run.get(\"conclusion\")):\n                continue\n\n            failed_runs.append(\n                {\n                    \"run_id\": run.get(\"id\"),\n                    \"workflow_name\": run.get(\"name\"),\n                    \"workflow_path\": workflow_path,\n                    \"created_at\": run.get(\"created_at\"),\n                    \"status\": run.get(\"status\"),\n                    \"conclusion\": run.get(\"conclusion\"),\n                    \"url\": run.get(\"html_url\"),\n                }\n            )\n\n        if len(workflow_runs) < 100:\n            break\n        if page >= MAX_DISCOVERY_PAGES:\n            print(f\"Warning: reached pagination cap ({MAX_DISCOVERY_PAGES} pages) while listing workflow runs\")\n            break\n        page += 1\n\n    failed_runs.sort(key=lambda run: run.get(\"created_at\") or \"\", reverse=True)\n    return failed_runs\n\nfailed_runs = list_failed_agentic_runs()\n\n# Cap the number of runs to detail so the payload stays compact.\nfailure_details = []\nfor run in failed_runs[:MAX_FAILURES_TO_DETAIL]:\n    run_id = run.get(\"run_id\")\n    if not run_id:\n        continue\n\n    run_view = run_json(\n        [\n            \"gh\",\n            \"run\",\n            \"view\",\n            str(run_id),\n            \"--repo\",\n            REPO,\n            \"--json\",\n            \"databaseId,url,name,workflowName,createdAt,conclusion,status,jobs\",\n        ]\n    )\n    if not run_view:\n        continue\n\n    failed_job_names = []\n    failed_steps = []\n    truncated_error_logs = []\n    agent_job_conclusion = None\n    for job in run_view.get(\"jobs\", []):\n        job_name = job.get(\"name\")\n        job_conclusion = (job.get(\"conclusion\") or \"\").lower()\n        if (job_name or \"\").lower() == \"agent\":\n            agent_job_conclusion = job_conclusion or None\n\n        if is_failure_conclusion(job_conclusion):\n            if job_name:\n                failed_job_names.append(job_name)\n            for step in job.get(\"steps\", []):\n                if is_failure_conclusion(step.get(\"conclusion\")):\n                    failed_steps.append(\n                        {\n                            \"job_id\": job.get(\"databaseId\"),\n                            \"job_name\": job_name,\n                            \"step_name\": step.get(\"name\"),\n                        }\n                    )\n\n            job_id = job.get(\"databaseId\")\n            if job_id:\n                log_text = run_text(\n                    [\n                        \"gh\",\n                        \"run\",\n                        \"view\",\n                        str(run_id),\n                        \"--repo\",\n                        REPO,\n                        \"--job\",\n                        str(job_id),\n                        \"--log\",\n                    ]\n                )\n                if log_text:\n                    tail_lines, has_fault_marker = capture_error_window(log_text)\n                    truncated_error_logs.append(\n                        {\n                            \"job_id\": job_id,\n                            \"job_name\": job_name,\n                            \"line_count\": len(tail_lines),\n                            \"tail_lines\": \"\\n\".join(tail_lines),\n                            \"capture_likely_missed_fault\": not has_fault_marker,\n                        }\n                    )\n\n    failure_details.append(\n        {\n            \"run_id\": run_id,\n            \"workflow_name\": run_view.get(\"workflowName\") or run_view.get(\"name\"),\n            \"workflow_path\": run.get(\"workflow_path\"),\n            \"url\": run_view.get(\"url\"),\n            \"created_at\": run_view.get(\"createdAt\"),\n            \"status\": run_view.get(\"status\"),\n            \"conclusion\": run_view.get(\"conclusion\"),\n            \"failed_job_names\": sorted(set(failed_job_names)),\n            \"agent_job_conclusion\": agent_job_conclusion,\n            \"failed_steps\": failed_steps,\n            \"truncated_error_logs\": truncated_error_logs,\n        }\n    )\n\nexisting_tracking_issues = run_json(\n    [\n        \"gh\",\n        \"issue\",\n        \"list\",\n        \"--repo\",\n        REPO,\n        \"--state\",\n        \"open\",\n        \"--search\",\n        f\"gh-aw-tracker-id: {TRACKER_ID}\",\n        \"--limit\",\n        \"100\",\n        \"--json\",\n        \"number,title,state,url,labels,createdAt,updatedAt\",\n    ]\n) or []\n\npayload = {\n    \"generated_at\": datetime.now(timezone.utc).isoformat(),\n    \"repository\": REPO,\n    \"lookback_window\": f\"{LOOKBACK_HOURS}h\",\n    \"failed_run_ids\": [run.get(\"run_id\") for run in failed_runs if run.get(\"run_id\")],\n    \"failures\": failure_details,\n    \"existing_tracking_issues\": existing_tracking_issues,\n}\n\nwith open(OUT, \"w\", encoding=\"utf-8\") as f:\n    json.dump(payload, f, indent=2)\n    f.write(\"\\n\")\n\nprint(f\"Wrote deterministic prefetch payload to {OUT}\")\nprint(f\"Failed runs in payload: {len(payload['failed_run_ids'])}\")\nprint(f\"Existing tracking issues in payload: {len(existing_tracking_issues)}\")\nPY"

      # Cache configuration from frontmatter processed below
      - name: Failure investigator prefetch
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          key: aw-failure-investigator-prefetch-${{ github.run_id }}
          path: /tmp/gh-aw/agent/failure-investigator
      - name: Configure Git credentials
        env:
          GITHUB_REPOSITORY: ${{ github.repository }}
          GITHUB_SERVER_URL: ${{ github.server_url }}
          GITHUB_TOKEN: ${{ github.token }}
        run: bash "${RUNNER_TEMP}/gh-aw/actions/configure_git_credentials.sh"
      - name: Checkout PR branch
        id: checkout-pr
        if: |
          github.event.pull_request || github.event.issue.pull_request || github.event_name == 'workflow_dispatch' && fromJSON(github.event.inputs.aw_context || '{}').item_type == 'pull_request'
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          GH_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
        with:
          github-token: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
          script: |
            const path = require('path');
            const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
            const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
            setupGlobals(core, github, context, exec, io, getOctokit);
            const { main } = require(path.join(actionsDir, 'checkout_pr_branch.cjs'));
            await main();
      - name: Setup Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: '24'
          package-manager-cache: false
      - name: Install gVisor (runsc)
        # runner-guard:ignore RGS-012 -- pinned release, SHA-512 verified artifacts, download-only step (no outbound secret transmission).
        run: bash "${RUNNER_TEMP}/gh-aw/actions/sudo_gvisor_install.sh" 20250707.0
      - name: Install AWF binary
        run: bash "${RUNNER_TEMP}/gh-aw/actions/install_awf_binary.sh" v0.28.7 --rootless
      - name: Install Claude Code CLI
        run: npm install -g @anthropic-ai/claude-code@2.1.245
      - name: Determine automatic lockdown mode for GitHub MCP Server
        id: determine-automatic-lockdown
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 (source v9)
        env:
          GH_AW_GITHUB_TOKEN: ${{ secrets.GH_AW_GITHUB_TOKEN }}
          GH_AW_GITHUB_MCP_SERVER_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN }}
        with:
          script: |
            const path = require('path');
            const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
            const determineAutomaticLockdown = require(path.join(actionsDir, 'determine_automatic_lockdown.cjs'));
            await determineAutomaticLockdown(github, context, core);
      - name: Restore agent config folders from base branch
        if: steps.checkout-pr.outcome == 'success'
        env:
          GH_AW_AGENT_FOLDERS: ".agents .claude .github"
          GH_AW_AGENT_FILES: "AGENTS.md CLAUDE.md"
        run: bash "${RUNNER_TEMP}/gh-aw/actions/restore_base_github_folders.sh"
      - name: Restore inline sub-agents from activation artifact
        env:
          GH_AW_SUB_AGENT_DIR: ".claude/agents"
          GH_AW_SUB_AGENT_EXT: ".md"
        run: bash "${RUNNER_TEMP}/gh-aw/actions/restore_inline_sub_agents.sh"
      - name: Restore inline skills from activation artifact
        env:
          GH_AW_SKILL_DIR: ".claude/skills"
        run: bash "${RUNNER_TEMP}/gh-aw/actions/restore_inline_skills.sh"
      - name: Download container images
        run: bash "${RUNNER_TEMP}/gh-aw/actions/download_docker_images.sh" ghcr.io/github/gh-aw-firewall/agent:0.28.7@sha256:40a1e30b1b8d70642d4292485146cd5af612730d7a6a2e12706ddd13df375059 ghcr.io/github/gh-aw-firewall/api-proxy:0.28.7@sha256:4f209dd4cbc74d47a6c7379956143de293429d1b1b2fb2647776cdcbf65836a1 ghcr.io/github/gh-aw-firewall/cli-proxy:0.28.7@sha256:ebc8758c9b085ca244234e3e3ee22300d150095f9bfe7312ca8a61c5acb34a78 ghcr.io/github/gh-aw-firewall/squid:0.28.7@sha256:fb362a08d4d2f0da6c036e3f5d3b2fd87931e857fec3ca4a241cd2f2b61131f9 ghcr.io/github/gh-aw-mcpg:v0.4.10@sha256:08bb5fa417aed94b40a14e2b7b3ae457531a5f22b143a32fe58317139d9b8f42 ghcr.io/github/gh-aw-node@sha256:bac2192f6374d6262116399b34fc5e143d576f82719e90a18261cae7480f4d4e ghcr.io/github/github-mcp-server:v1.10.1@sha256:1817b57d43916532dc002bdc5f344d639bd9fb54a9148d42168458f7c3280567
      - name: Build and install gh-aw CLI from source
        run: |
          gh extension remove aw || true
          make build
          gh extension install .
          gh aw version
        env:
          GH_TOKEN: ${{ github.token }}
      - name: Copy gh-aw binary for MCP Server
        run: |
          bash "${RUNNER_TEMP}/gh-aw/actions/copy_gh_aw_binary_for_mcp.sh"
      - name: Prepare Safe Outputs Directories
        run: |
          mkdir -p "${RUNNER_TEMP}/gh-aw/safeoutputs"
          mkdir -p /tmp/gh-aw/safeoutputs
          mkdir -p /tmp/gh-aw/mcp-logs/safeoutputs
      - name: Generate Safe Outputs Config
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          GH_AW_FILE_ROOT: "${{ runner.temp }}/gh-aw"
          GH_AW_FILE_CONFIG: "{\"files\":[{\"path\":\"safeoutputs/config.json\",\"content_env\":\"GH_AW_SAFE_OUTPUTS_CONFIG\"}]}"
          GH_AW_SAFE_OUTPUTS_CONFIG: "{\"create_issue\":{\"expires\":168,\"group\":true,\"labels\":[\"agentic-workflows\",\"automation\",\"cookie\"],\"max\":2,\"title_prefix\":\"[aw-failures] \"},\"create_report_incomplete_issue\":{},\"link_sub_issue\":{\"max\":10},\"missing_data\":{},\"missing_tool\":{},\"noop\":{\"max\":1,\"report-as-issue\":\"true\"},\"report_incomplete\":{},\"update_issue\":{\"allow_body\":true,\"max\":10,\"target\":\"*\"}}"
        with:
          script: |
            const path = require('path');
            const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
            const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
            setupGlobals(core, github, context, exec, io, getOctokit);
            const { main } = require(path.join(actionsDir, 'create_files.cjs'));
            await main();
      - name: Generate Safe Outputs Tools
        env:
          GH_AW_TOOLS_META_JSON: |
            {
              "description_suffixes": {
                "create_issue": " CONSTRAINTS: Maximum 2 issue(s) can be created. Title will be prefixed with \"[aw-failures] \". Labels [\"agentic-workflows\" \"automation\" \"cookie\"] will be automatically added.",
                "link_sub_issue": " CONSTRAINTS: Maximum 10 sub-issue link(s) can be created.",
                "update_issue": " CONSTRAINTS: Maximum 10 issue(s) can be updated. Target: *."
              },
              "repo_params": {},
              "dynamic_tools": []
            }
          GH_AW_VALIDATION_JSON: |
            {
              "create_issue": {
                "defaultMax": 1,
                "fields": {
                  "blocked_by": {},
                  "body": {
                    "required": true,
                    "type": "string",
                    "sanitize": true,
                    "maxLength": 65000,
                    "minLength": 20
                  },
                  "fields": {
                    "type": "array"
                  },
                  "labels": {
                    "type": "array",
                    "itemType": "string",
                    "itemSanitize": true,
                    "itemMaxLength": 128
                  },
                  "parent": {
                    "issueOrPRNumber": true
                  },
                  "repo": {
                    "type": "string",
                    "maxLength": 256
                  },
                  "temporary_id": {
                    "type": "string"
                  },
                  "title": {
                    "required": true,
                    "type": "string",
                    "sanitize": true,
                    "maxLength": 128
                  }
                }
              },
              "link_sub_issue": {
                "defaultMax": 5,
                "fields": {
                  "parent_issue_number": {
                    "required": true,
                    "issueNumberOrTemporaryId": true
                  },
                  "repo": {
                    "type": "string",
                    "maxLength": 256
                  },
                  "sub_issue_number": {
                    "required": true,
                    "issueNumberOrTemporaryId": true
                  }
                },
                "customValidation": "parentAndSubDifferent"
              },
              "missing_data": {
                "defaultMax": 20,
                "fields": {
                  "alternatives": {
                    "type": "string",
                    "sanitize": true,
                    "maxLength": 256
                  },
                  "context": {
                    "type": "string",
                    "sanitize": true,
                    "maxLength": 256
                  },
                  "data_type": {
                    "type": "string",
                    "sanitize": true,
                    "maxLength": 128
                  },
                  "reason": {
                    "type": "string",
                    "sanitize": true,
                    "maxLength": 256
                  }
                }
              },
              "missing_tool": {
                "defaultMax": 20,
                "fields": {
                  "alternatives": {
                    "type": "string",
                    "sanitize": true,
                    "maxLength": 512
                  },
                  "reason": {
                    "required": true,
                    "type": "string",
                    "sanitize": true,
                    "maxLength": 256
                  },
                  "tool": {
                    "type": "string",
                    "sanitize": true,
                    "maxLength": 128
                  }
                }
              },
              "noop": {
                "defaultMax": 1,
                "fields": {
                  "message": {
                    "required": true,
                    "type": "string",
                    "sanitize": true,
                    "maxLength": 65000
                  }
                }
              },
              "report_incomplete": {
                "defaultMax": 5,
                "fields": {
                  "details": {
                    "type": "string",
                    "sanitize": true,
                    "maxLength": 65000
                  },
                  "reason": {
                    "required": true,
                    "type": "string",
                    "sanitize": true,
                    "maxLength": 1024
                  }
                }
              },
              "update_issue": {
                "defaultMax": 1,
                "fields": {
                  "assignees": {
                    "type": "array",
                    "itemType": "string",
                    "itemSanitize": true,
                    "itemMaxLength": 39
                  },
                  "body": {
                    "type": "string",
                    "sanitize": true,
                    "maxLength": 65000
                  },
                  "issue_number": {
                    "issueOrPRNumber": true
                  },
                  "labels": {
                    "type": "array"
                  },
                  "milestone": {
                    "optionalPositiveInteger": true
                  },
                  "operation": {
                    "type": "string",
                    "enum": [
                      "replace",
                      "append",
                      "prepend",
                      "replace-island"
                    ]
                  },
                  "repo": {
                    "type": "string",
                    "maxLength": 256
                  },
                  "status": {
                    "type": "string",
                    "enum": [
                      "open",
                      "closed"
                    ]
                  },
                  "title": {
                    "type": "string",
                    "sanitize": true,
                    "maxLength": 128
                  }
                },
                "customValidation": "requiresOneOf:status,title,body,labels,assignees,milestone"
              }
            }
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          script: |
            const path = require('path');
            const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
            const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
            setupGlobals(core, github, context, exec, io, getOctokit);
            const { main } = require(path.join(actionsDir, 'generate_safe_outputs_tools.cjs'));
            await main();
      - name: Start MCP Gateway
        id: start-mcp-gateway
        env:
          GH_AW_POLICY_ALLOW_CREATE_PULL_REQUEST: ${{ vars.GH_AW_POLICY_ALLOW_CREATE_PULL_REQUEST || 'true' }}
          GH_AW_SAFE_OUTPUTS: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS }}
          GH_AW_SAFE_OUTPUTS_CONFIG_PATH: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS_CONFIG_PATH }}
          GH_AW_SAFE_OUTPUTS_TOOLS_PATH: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS_TOOLS_PATH }}
          GH_AW_SINK_VISIBILITY: ${{ steps.determine-automatic-lockdown.outputs.visibility }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -eo pipefail
          mkdir -p "${RUNNER_TEMP}/gh-aw/mcp-config"
          if [ -n "${GITHUB_EVENT_PATH:-}" ] && [ -r "${GITHUB_EVENT_PATH}" ]; then
            GH_AW_SAFEOUTPUTS_EVENT_PATH="${RUNNER_TEMP}/gh-aw/safeoutputs/github_event.json"
            cp "${GITHUB_EVENT_PATH}" "${GH_AW_SAFEOUTPUTS_EVENT_PATH}"
            export GITHUB_EVENT_PATH="${GH_AW_SAFEOUTPUTS_EVENT_PATH}"
          fi

          # Export gateway environment variables for MCP config and gateway script
          export MCP_GATEWAY_PORT="8080"
          export MCP_GATEWAY_DOMAIN="awmg-mcpg"
          export MCP_GATEWAY_HOST_DOMAIN="localhost"
          MCP_GATEWAY_API_KEY=$(openssl rand -base64 45 | tr -d '/+=')
          echo "::add-mask::${MCP_GATEWAY_API_KEY}"
          export MCP_GATEWAY_API_KEY
          export MCP_GATEWAY_PAYLOAD_DIR="/tmp/gh-aw/mcp-payloads"
          mkdir -p "${MCP_GATEWAY_PAYLOAD_DIR}"
          export MCP_GATEWAY_PAYLOAD_SIZE_THRESHOLD="524288"
          export MCP_GATEWAY_ALLOWED_MOUNT_ROOTS="${GITHUB_WORKSPACE}:rw,${RUNNER_TEMP}/gh-aw:ro,${RUNNER_TEMP}/gh-aw/safeoutputs:rw,/opt:ro,/tmp:rw,/usr/bin/gh:ro"
          export DEBUG="*"

          export GH_AW_ENGINE="claude"
          export GH_AW_MCP_CLI_SERVERS='["agenticworkflows","safeoutputs"]'
          MCP_GATEWAY_UID=$(id -u 2>/dev/null || echo '0')
          MCP_GATEWAY_GID=$(id -g 2>/dev/null || echo '0')
          source "${RUNNER_TEMP}/gh-aw/actions/resolve_docker_socket_gid.sh"
          export MCP_GATEWAY_DOCKER_COMMAND='docker run -i --rm --network bridge -p 127.0.0.1:'"${MCP_GATEWAY_PORT}"':'"${MCP_GATEWAY_PORT}"' --name awmg-mcpg --add-host host.docker.internal:host-gateway --user '"${MCP_GATEWAY_UID}"':'"${MCP_GATEWAY_GID}"' --group-add '"${DOCKER_SOCK_GID}"' -v '"${DOCKER_SOCK_PATH}"':/var/run/docker.sock -e MCP_GATEWAY_PORT -e MCP_GATEWAY_DOMAIN -e MCP_GATEWAY_API_KEY -e MCP_GATEWAY_PAYLOAD_DIR -e MCP_GATEWAY_PAYLOAD_SIZE_THRESHOLD -e DOCKER_HOST=unix:///var/run/docker.sock -e DEBUG -e MCP_GATEWAY_LOG_DIR -e GH_AW_MCP_LOG_DIR -e GH_AW_SAFE_OUTPUTS -e GH_AW_SAFE_OUTPUTS_CONFIG_PATH -e GH_AW_SAFE_OUTPUTS_TOOLS_PATH -e GH_AW_POLICY_ALLOW_CREATE_PULL_REQUEST -e GH_AW_ASSETS_BRANCH -e GH_AW_ASSETS_MAX_SIZE_KB -e GH_AW_ASSETS_ALLOWED_EXTS -e DEFAULT_BRANCH -e GITHUB_MCP_SERVER_TOKEN -e GITHUB_MCP_GUARD_MIN_INTEGRITY -e GITHUB_MCP_GUARD_REPOS -e GH_AW_SINK_VISIBILITY -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e GITHUB_SHA -e GITHUB_WORKSPACE -e GITHUB_TOKEN -e GITHUB_RUN_ID -e GITHUB_RUN_NUMBER -e GITHUB_RUN_ATTEMPT -e GITHUB_JOB -e GITHUB_ACTION -e GITHUB_EVENT_NAME -e GITHUB_EVENT_PATH -e GITHUB_ACTOR -e GITHUB_ACTOR_ID -e GITHUB_TRIGGERING_ACTOR -e GITHUB_WORKFLOW -e GITHUB_WORKFLOW_REF -e GITHUB_WORKFLOW_SHA -e GITHUB_REF -e GITHUB_REF_NAME -e GITHUB_REF_TYPE -e GITHUB_HEAD_REF -e GITHUB_BASE_REF -e RUNNER_TEMP -e RUNNER_TOOL_CACHE -e MCP_GATEWAY_ALLOWED_MOUNT_ROOTS -e GITHUB_AW_OTEL_TRACE_ID -e GITHUB_AW_OTEL_PARENT_SPAN_ID -e OTEL_EXPORTER_OTLP_HEADERS -v /tmp/gh-aw/mcp-payloads:/tmp/gh-aw/mcp-payloads:rw -v /opt:/opt:ro -v /tmp:/tmp:rw -v '"${GITHUB_WORKSPACE}"':'"${GITHUB_WORKSPACE}"':rw -v '"${RUNNER_TEMP}"'/gh-aw/safeoutputs:'"${RUNNER_TEMP}"'/gh-aw/safeoutputs:rw ghcr.io/github/gh-aw-mcpg:v0.4.10'

          GH_AW_NODE=$(which node 2>/dev/null || command -v node 2>/dev/null || echo node)
          cat << GH_AW_MCP_CONFIG_cc7cd4505e7f3adb_EOF | "$GH_AW_NODE" "${RUNNER_TEMP}/gh-aw/actions/start_mcp_gateway.cjs"
          {
            "mcpServers": {
              "agenticworkflows": {
                "container": "localhost/gh-aw:dev",
                "mounts": ["\${GITHUB_WORKSPACE}:\${GITHUB_WORKSPACE}:rw", "/tmp/gh-aw:/tmp/gh-aw:rw"],
                "args": ["--network", "host", "-w", "\${GITHUB_WORKSPACE}"],
                "env": {
                  "DEBUG": "*",
                  "GITHUB_TOKEN": "\${GITHUB_TOKEN}",
                  "GITHUB_ACTOR": "\${GITHUB_ACTOR}",
                  "GITHUB_REPOSITORY": "\${GITHUB_REPOSITORY}"
                },
                "guard-policies": {
                  "write-sink": {
                    "accept": [
                      "*"
                    ],
                    "sink-visibility": "${GH_AW_SINK_VISIBILITY}"
                  }
                }
              },
              "safeoutputs": {
                "container": "ghcr.io/github/gh-aw-node",
                "mounts": ["\${GITHUB_WORKSPACE}:\${GITHUB_WORKSPACE}:rw", "${RUNNER_TEMP}/gh-aw/safeoutputs:${RUNNER_TEMP}/gh-aw/safeoutputs:rw", "/tmp/gh-aw:/tmp/gh-aw:rw"],
                "args": ["-w", "\${GITHUB_WORKSPACE}"],
                "entrypoint": "sh",
                "entrypointArgs": ["-c", "sh ${RUNNER_TEMP}/gh-aw/safeoutputs/start_safe_outputs_mcp.sh"],
                "env": {
                  "DEBUG": "*",
                  "DEFAULT_BRANCH": "\${DEFAULT_BRANCH}",
                  "GH_AW_ASSETS_ALLOWED_EXTS": "\${GH_AW_ASSETS_ALLOWED_EXTS}",
                  "GH_AW_ASSETS_BRANCH": "\${GH_AW_ASSETS_BRANCH}",
                  "GH_AW_ASSETS_MAX_SIZE_KB": "\${GH_AW_ASSETS_MAX_SIZE_KB}",
                  "GH_AW_MCP_LOG_DIR": "\${GH_AW_MCP_LOG_DIR}",
                  "GH_AW_SAFE_OUTPUTS": "\${GH_AW_SAFE_OUTPUTS}",
                  "GH_AW_SAFE_OUTPUTS_CONFIG_PATH": "\${GH_AW_SAFE_OUTPUTS_CONFIG_PATH}",
                  "GH_AW_SAFE_OUTPUTS_TOOLS_PATH": "\${GH_AW_SAFE_OUTPUTS_TOOLS_PATH}",
                  "GH_AW_POLICY_ALLOW_CREATE_PULL_REQUEST": "\${GH_AW_POLICY_ALLOW_CREATE_PULL_REQUEST}",
                  "GITHUB_EVENT_NAME": "\${GITHUB_EVENT_NAME}",
                  "GITHUB_EVENT_PATH": "\${GITHUB_EVENT_PATH}",
                  "GITHUB_REPOSITORY": "\${GITHUB_REPOSITORY}",
                  "GITHUB_SHA": "\${GITHUB_SHA}",
                  "GITHUB_TOKEN": "\${GITHUB_TOKEN}",
                  "GITHUB_WORKSPACE": "\${GITHUB_WORKSPACE}",
                  "RUNNER_TEMP": "\${RUNNER_TEMP}"
                },
                "guard-policies": {
                  "write-sink": {
                    "accept": [
                      "*"
                    ],
                    "sink-visibility": "${GH_AW_SINK_VISIBILITY}"
                  }
                }
              }
            },
            "gateway": {
              "port": $MCP_GATEWAY_PORT,
              "domain": "${MCP_GATEWAY_DOMAIN}",
              "apiKey": "${MCP_GATEWAY_API_KEY}",
              "payloadDir": "${MCP_GATEWAY_PAYLOAD_DIR}",
              "startupTimeout": 120,
              "opentelemetry": {
                "endpoint": "${OTEL_EXPORTER_OTLP_ENDPOINT}",
                "traceId": "${GITHUB_AW_OTEL_TRACE_ID}",
                "spanId": "${GITHUB_AW_OTEL_PARENT_SPAN_ID}"
              }
            }
          }
          GH_AW_MCP_CONFIG_cc7cd4505e7f3adb_EOF
      - name: Mount MCP servers as CLIs
        id: mount-mcp-clis
        continue-on-error: true
        env:
          MCP_GATEWAY_API_KEY: ${{ steps.start-mcp-gateway.outputs.gateway-api-key }}
          MCP_GATEWAY_DOMAIN: ${{ steps.start-mcp-gateway.outputs.gateway-domain }}
          MCP_GATEWAY_PORT: ${{ steps.start-mcp-gateway.outputs.gateway-port }}
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          script: |
            const path = require('path');
            const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
            const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
            setupGlobals(core, github, context, exec, io);
            const { main } = require(path.join(actionsDir, 'mount_mcp_as_cli.cjs'));
            await main();
      - name: Clean credentials
        continue-on-error: true
        run: bash "${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh"
      - name: Audit pre-agent workspace
        id: pre_agent_audit
        continue-on-error: true
        run: bash "${RUNNER_TEMP}/gh-aw/actions/audit_pre_agent_workspace.sh"
      - name: Start CLI Proxy
        env:
          GH_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
          GITHUB_SERVER_URL: ${{ github.server_url }}
          GITHUB_API_URL: ${{ github.api_url }}
          GH_HOST: ${{ env.GH_HOST }}
          GITHUB_HOST: ${{ env.GITHUB_HOST }}
          GITHUB_ENTERPRISE_HOST: ${{ env.GITHUB_ENTERPRISE_HOST }}
          GITHUB_GRAPHQL_URL: ${{ env.GITHUB_GRAPHQL_URL }}
          GITHUB_COPILOT_BASE_URL: ${{ env.GITHUB_COPILOT_BASE_URL }}
          GH_AW_NETWORK_ISOLATION: 'true'
          CLI_PROXY_POLICY: '{"allow-only":{"repos":"${{ steps.determine-automatic-lockdown.outputs.repos }}","min-integrity":"${{ steps.determine-automatic-lockdown.outputs.min_integrity }}"}}'
          CLI_PROXY_IMAGE: 'ghcr.io/github/gh-aw-mcpg:v0.4.10'
        run: |
          bash "${RUNNER_TEMP}/gh-aw/actions/start_cli_proxy.sh"
      - name: Execute Claude Code CLI
        id: agentic_execution
        # Allowed tools (sorted):
        # - Bash
        # - BashOutput
        # - Edit
        # - Edit(/tmp/*)
        # - ExitPlanMode
        # - Glob
        # - Grep
        # - KillBash
        # - LS
        # - MultiEdit
        # - MultiEdit(/tmp/*)
        # - NotebookEdit
        # - NotebookRead
        # - Read
        # - Read(/tmp/*)
        # - Task
        # - TodoWrite
        # - Write
        # - Write(/tmp/*)
        # - mcp__agenticworkflows
        # - mcp__github__actions_get
        # - mcp__github__actions_list
        # - mcp__github__get_code_scanning_alert
        # - mcp__github__get_commit
        # - mcp__github__get_dependabot_alert
        # - mcp__github__get_discussion
        # - mcp__github__get_discussion_comments
        # - mcp__github__get_file_contents
        # - mcp__github__get_job_logs
        # - mcp__github__get_label
        # - mcp__github__get_latest_release
        # - mcp__github__get_me
        # - mcp__github__get_notification_details
        # - mcp__github__get_pull_request
        # - mcp__github__get_pull_request_comments
        # - mcp__github__get_pull_request_diff
        # - mcp__github__get_pull_request_files
        # - mcp__github__get_pull_request_review_comments
        # - mcp__github__get_pull_request_reviews
        # - mcp__github__get_pull_request_status
        # - mcp__github__get_release_by_tag
        # - mcp__github__get_secret_scanning_alert
        # - mcp__github__get_tag
        # - mcp__github__issue_read
        # - mcp__github__list_branches
        # - mcp__github__list_code_scanning_alerts
        # - mcp__github__list_commits
        # - mcp__github__list_dependabot_alerts
        # - mcp__github__list_discussion_categories
        # - mcp__github__list_discussions
        # - mcp__github__list_issue_types
        # - mcp__github__list_issues
        # - mcp__github__list_label
        # - mcp__github__list_notifications
        # - mcp__github__list_pull_requests
        # - mcp__github__list_releases
        # - mcp__github__list_secret_scanning_alerts
        # - mcp__github__list_starred_repositories
        # - mcp__github__list_tags
        # - mcp__github__pull_request_read
        # - mcp__github__search_code
        # - mcp__github__search_issues
        # - mcp__github__search_orgs
        # - mcp__github__search_pull_requests
        # - mcp__github__search_repositories
        # - mcp__github__search_users
        # - mcp__safeoutputs
        timeout-minutes: 60
        run: |
          set -o pipefail
          trap 'gh_aw_exit_code=$?; mkdir -p /tmp/gh-aw >/dev/null 2>&1 || true; printf "%s" "$gh_aw_exit_code" > /tmp/gh-aw/agent_execution_exit_code.txt || true; if [ "$gh_aw_exit_code" -ne 0 ]; then echo "::error::Agent execution exited with code $gh_aw_exit_code"; fi' EXIT
          printf '%s' "$(date +%s%3N)" > /tmp/gh-aw/agent_cli_start_ms.txt
          mkdir -p /tmp/gh-aw/agent/ && (umask 177 && touch /tmp/gh-aw/agent/claude-debug.log) && touch /tmp/gh-aw/agent-step-summary.md
          (umask 177 && touch /tmp/gh-aw/agent-stdio.log)
          GH_AW_MAX_AI_CREDITS="${{ vars.GH_AW_DEFAULT_MAX_AI_CREDITS || '1000' }}"
          printf '%s\n' "{\"\$schema\":\"https://github.com/github/gh-aw-firewall/releases/download/v0.28.7/awf-config.schema.json\",\"network\":{\"allowDomains\":[\"*.githubusercontent.com\",\"*.grafana.net\",\"*.sentry.io\",\"anthropic.com\",\"api.anthropic.com\",\"api.github.com\",\"api.snapcraft.io\",\"archive.ubuntu.com\",\"azure.archive.ubuntu.com\",\"cdn.playwright.dev\",\"codeload.github.com\",\"crl.geotrust.com\",\"crl.globalsign.com\",\"crl.identrust.com\",\"crl.sectigo.com\",\"crl.thawte.com\",\"crl.usertrust.com\",\"crl.verisign.com\",\"crl3.digicert.com\",\"crl4.digicert.com\",\"crls.ssl.com\",\"ghcr.io\",\"github-cloud.githubusercontent.com\",\"github-cloud.s3.amazonaws.com\",\"github.com\",\"host.docker.internal\",\"json-schema.org\",\"json.schemastore.org\",\"keyserver.ubuntu.com\",\"lfs.github.com\",\"objects.githubusercontent.com\",\"ocsp.digicert.com\",\"ocsp.geotrust.com\",\"ocsp.globalsign.com\",\"ocsp.identrust.com\",\"ocsp.sectigo.com\",\"ocsp.ssl.com\",\"ocsp.thawte.com\",\"ocsp.usertrust.com\",\"ocsp.verisign.com\",\"packagecloud.io\",\"packages.cloud.google.com\",\"packages.microsoft.com\",\"playwright.download.prss.microsoft.com\",\"ppa.launchpad.net\",\"raw.githubusercontent.com\",\"s.symcb.com\",\"s.symcd.com\",\"security.ubuntu.com\",\"sentry.io\",\"statsig.anthropic.com\",\"ts-crl.ws.symantec.com\",\"ts-ocsp.ws.symantec.com\",\"www.googleapis.com\"],\"isolation\":true,\"topologyAttach\":[\"awmg-mcpg\",\"awmg-cli-proxy\"]},\"apiProxy\":{\"enabled\":true,\"enableTokenSteering\":true,\"maxRuns\":500,\"maxAiCredits\":${GH_AW_MAX_AI_CREDITS},\"maxCacheMisses\":5,\"defaultAiCreditsPricing\":{\"input\":5,\"output\":25},\"models\":{\"agent\":[\"sonnet-6x\",\"gpt-5.4\",\"gpt-5.5\",\"gpt-5.6\",\"gpt-5.3\",\"gemini-pro\",\"any\"],\"antigravity\":[\"copilot/antigravity*\",\"google/antigravity*\",\"gemini/antigravity*\"],\"any\":[\"copilot/*\",\"anthropic/*\",\"openai/*\",\"google/*\",\"gemini/*\"],\"auto\":[\"copilot/auto\",\"large\"],\"claude\":[\"agent\"],\"codex\":[\"agent\"],\"coding\":[\"copilot/gpt-5*codex*\",\"openai/gpt-5*codex*\",\"gpt-5-codex\",\"kimi\"],\"computer-use\":[\"copilot/*computer-use*\",\"google/*computer-use*\",\"gemini/*computer-use*\",\"openai/*computer-use*\"],\"copilot\":[\"agent\"],\"deep-research\":[\"copilot/deep-research*\",\"copilot/o3-deep-research*\",\"copilot/o4-mini-deep-research*\",\"google/deep-research*\",\"gemini/deep-research*\",\"openai/o3-deep-research*\",\"openai/o4-mini-deep-research*\"],\"detection\":[\"small\"],\"evals\":[\"small\"],\"fable\":[\"copilot/*fable*\",\"anthropic/*fable*\"],\"gemini\":[\"agent\"],\"gemini-3-flash\":[\"copilot/gemini-3*flash*\",\"google/gemini-3*flash*\",\"gemini/gemini-3*flash*\"],\"gemini-3-pro\":[\"copilot/gemini-3*pro*\",\"google/gemini-3*pro*\",\"google/nano-banana*\",\"gemini/gemini-3*pro*\"],\"gemini-3.1-flash\":[\"copilot/gemini-3.1*flash*\",\"google/gemini-3.1*flash*\",\"gemini/gemini-3.1*flash*\"],\"gemini-3.1-pro\":[\"copilot/gemini-3.1*pro*\",\"google/gemini-3.1*pro*\",\"gemini/gemini-3.1*pro*\"],\"gemini-3.5-flash\":[\"copilot/gemini-3.5*flash*\",\"google/gemini-3.5*flash*\",\"gemini/gemini-3.5*flash*\"],\"gemini-3.6-flash\":[\"copilot/gemini-3.6*flash*\",\"google/gemini-3.6*flash*\",\"gemini/gemini-3.6*flash*\"],\"gemini-3.7-flash\":[\"copilot/gemini-3.7*flash*\",\"google/gemini-3.7*flash*\",\"gemini/gemini-3.7*flash*\"],\"gemini-flash\":[\"copilot/gemini-*flash*\",\"google/gemini-*flash*\",\"gemini/gemini-*flash*\"],\"gemini-flash-lite\":[\"copilot/gemini-*flash*lite*\",\"google/gemini-*flash*lite*\",\"gemini/gemini-*flash*lite*\"],\"gemini-omni\":[\"copilot/gemini-omni*\",\"google/gemini-omni*\",\"gemini/gemini-omni*\"],\"gemini-pro\":[\"copilot/gemini-*pro*\",\"google/gemini-*pro*\",\"gemini/gemini-*pro*\"],\"gemma\":[\"copilot/gemma*\",\"google/gemma*\",\"gemini/gemma*\"],\"gpt-5\":[\"copilot/gpt-5*\",\"openai/gpt-5*\"],\"gpt-5-codex\":[\"copilot/gpt-5*codex*\",\"openai/gpt-5*codex*\"],\"gpt-5-mini\":[\"copilot/gpt-5*mini*\",\"openai/gpt-5*mini*\"],\"gpt-5-nano\":[\"copilot/gpt-5*nano*\",\"openai/gpt-5*nano*\"],\"gpt-5-pro\":[\"copilot/gpt-5*pro*\",\"openai/gpt-5*pro*\"],\"gpt-5.1\":[\"copilot/gpt-5.1*\",\"openai/gpt-5.1*\"],\"gpt-5.2\":[\"copilot/gpt-5.2*\",\"openai/gpt-5.2*\"],\"gpt-5.3\":[\"copilot/gpt-5.3*\",\"openai/gpt-5.3*\"],\"gpt-5.4\":[\"copilot/gpt-5.4*\",\"openai/gpt-5.4*\"],\"gpt-5.5\":[\"copilot/gpt-5.5*\",\"openai/gpt-5.5*\"],\"gpt-5.6\":[\"copilot/gpt-5.6*\",\"openai/gpt-5.6*\"],\"grok\":[\"copilot/*grok*\",\"openai/*grok*\"],\"haiku\":[\"copilot/*haiku*\",\"anthropic/*haiku*\"],\"image-generation\":[\"copilot/gpt-image*\",\"openai/gpt-image*\",\"openai/chatgpt-image*\",\"copilot/gemini-*image*\",\"google/gemini-*image*\",\"gemini/gemini-*image*\",\"google/imagen*\"],\"kimi\":[\"copilot/kimi*\",\"openai/kimi*\"],\"kiwi\":[\"copilot/kiwi*\",\"openai/kiwi*\"],\"large\":[\"sonnet\",\"gpt-5-pro\",\"gpt-5\",\"gemini-pro\"],\"lyria\":[\"google/lyria*\",\"gemini/lyria*\",\"copilot/lyria*\"],\"mai-code\":[\"copilot/MAI-Code*\",\"copilot/mai-code*\",\"openai/MAI-Code*\"],\"mai-code-1-flash-picker\":[\"copilot/MAI-Code-1-Flash-picker*\",\"copilot/mai-code-1-flash-picker*\",\"openai/MAI-Code-1-Flash-picker*\"],\"mini\":[\"haiku\",\"gpt-5-mini\",\"gpt-5-nano\",\"gemini-flash-lite\"],\"nano-banana\":[\"copilot/nano-banana*\",\"google/nano-banana*\",\"gemini/nano-banana*\"],\"opus\":[\"copilot/*opus*\",\"anthropic/*opus*\"],\"opusplan\":[\"opus?effort=high\"],\"raptor-mini\":[\"copilot/raptor*\",\"openai/raptor*\"],\"reasoning\":[\"copilot/o1*\",\"copilot/o3*\",\"copilot/o4*\",\"openai/o1*\",\"openai/o3*\",\"openai/o4*\"],\"robotics\":[\"copilot/*robotics*\",\"google/*robotics*\",\"gemini/*robotics*\"],\"small\":[\"mini\"],\"small-agent\":[\"haiku\",\"gpt-5-mini\",\"gemini-flash\"],\"sonnet\":[\"copilot/*sonnet*\",\"anthropic/*sonnet*\"],\"sonnet-6x\":[\"copilot/*sonnet-4.5*\",\"copilot/*sonnet-4.6*\",\"copilot/*sonnet-5*\",\"copilot/*sonnet-4-5-*\",\"anthropic/*sonnet-4-5-*\",\"copilot/*sonnet-4-6*\",\"anthropic/*sonnet-4-6*\",\"anthropic/*sonnet-5*\"],\"summarization\":[\"haiku\",\"gpt-5-mini\",\"gemini-flash-lite\",\"mini\"],\"veo\":[\"google/veo*\",\"gemini/veo*\"],\"vision\":[\"copilot/gemini-*image*\",\"google/gemini-*image*\",\"gemini/gemini-*image*\",\"copilot/gemini-*flash*\",\"google/gemini-*flash*\",\"gemini/gemini-*flash*\"]}},\"container\":{\"imageTag\":\"0.28.7,squid=sha256:fb362a08d4d2f0da6c036e3f5d3b2fd87931e857fec3ca4a241cd2f2b61131f9,agent=sha256:40a1e30b1b8d70642d4292485146cd5af612730d7a6a2e12706ddd13df375059,api-proxy=sha256:4f209dd4cbc74d47a6c7379956143de293429d1b1b2fb2647776cdcbf65836a1,cli-proxy=sha256:ebc8758c9b085ca244234e3e3ee22300d150095f9bfe7312ca8a61c5acb34a78\",\"containerRuntime\":\"gvisor\"},\"logging\":{\"proxyLogsDir\":\"/tmp/gh-aw/sandbox/firewall/logs\",\"auditDir\":\"/tmp/gh-aw/sandbox/firewall/audit\"}}" > "${RUNNER_TEMP}/gh-aw/awf-config.json"
          cp "${RUNNER_TEMP}/gh-aw/awf-config.json" /tmp/gh-aw/awf-config.json
          export GH_AW_MODELS_JSON_PATH="/tmp/gh-aw/models.json"
          GH_AW_DOCKER_HOST=""
          if [[ "${DOCKER_HOST:-}" =~ ^tcp:// ]]; then
            GH_AW_DOCKER_HOST="${DOCKER_HOST}"
          fi
          if [[ "${DOCKER_HOST:-}" =~ ^tcp:// ]]; then
            GH_AW_CHROOT_BINARIES_SOURCE_PATH="${RUNNER_TEMP}/gh-aw" GH_AW_CHROOT_IDENTITY_HOME="${RUNNER_TEMP}/gh-aw/home" node "${RUNNER_TEMP}/gh-aw/actions/patch_awf_chroot_config.cjs"
          fi
          GH_AW_TOOL_CACHE_MOUNT=""
          GH_AW_TOOL_CACHE="${RUNNER_TOOL_CACHE:?RUNNER_TOOL_CACHE must be set}"
          if [ -d "$GH_AW_TOOL_CACHE" ]; then
            if [[ "$GH_AW_TOOL_CACHE" != /opt/* ]]; then
              GH_AW_TOOL_CACHE_MOUNT="$GH_AW_TOOL_CACHE:$GH_AW_TOOL_CACHE:ro"
            fi
          fi
          # shellcheck disable=SC1003,SC2016,SC2086
          awf --config "${RUNNER_TEMP}/gh-aw/awf-config.json" --container-workdir "${GITHUB_WORKSPACE}" --mount "${RUNNER_TEMP}/gh-aw:${RUNNER_TEMP}/gh-aw:ro" --mount "${RUNNER_TEMP}/gh-aw:/host${RUNNER_TEMP}/gh-aw:ro" ${GH_AW_TOOL_CACHE_MOUNT:+--mount "$GH_AW_TOOL_CACHE_MOUNT"} ${GH_AW_DOCKER_HOST:+--docker-host "$GH_AW_DOCKER_HOST"} --tty --env-all --exclude-env ACTIONS_ID_TOKEN_REQUEST_TOKEN --exclude-env ACTIONS_ID_TOKEN_REQUEST_URL --exclude-env ANTHROPIC_API_KEY --exclude-env GH_TOKEN --exclude-env GITHUB_MCP_SERVER_TOKEN --exclude-env MCP_GATEWAY_API_KEY --mount /tmp/gh-aw:/tmp/gh-aw:rw --log-level info --skip-pull --difc-proxy-host awmg-cli-proxy:18443 --difc-proxy-ca-cert /tmp/gh-aw/difc-proxy-tls/ca.crt \
            -- /bin/bash -c 'set +o histexpand; export PATH="${RUNNER_TEMP}/gh-aw/mcp-cli/bin:$PATH" && : "${RUNNER_TOOL_CACHE:?RUNNER_TOOL_CACHE must be set}"; GH_AW_TOOL_CACHE="$RUNNER_TOOL_CACHE"; export PATH="$(find "$GH_AW_TOOL_CACHE" -maxdepth 5 -type d -name bin 2>/dev/null | tr '\''\n'\'' '\'':'\'')$PATH"; [ -n "$GOROOT" ] && export PATH="$GOROOT/bin:$PATH" || true; [ -n "$ERLANG_HOME" ] && export PATH="$ERLANG_HOME/bin:$PATH" || true && GH_AW_NODE_EXEC="${GH_AW_NODE_BIN:-}"; if [ -z "$GH_AW_NODE_EXEC" ] || [ ! -x "$GH_AW_NODE_EXEC" ]; then GH_AW_NODE_EXEC="$(command -v node 2>/dev/null || true)"; fi; if [ -z "$GH_AW_NODE_EXEC" ]; then echo "node runtime missing on this runner — check runtimes.node in workflow YAML" >&2; exit 127; fi; GH_AW_NPM_GLOBAL_ROOT="$(npm root -g 2>/dev/null || true)"; if [ -n "$GH_AW_NPM_GLOBAL_ROOT" ]; then export NODE_PATH="${GH_AW_NPM_GLOBAL_ROOT}${NODE_PATH:+:${NODE_PATH}}"; fi; "$GH_AW_NODE_EXEC" ${RUNNER_TEMP}/gh-aw/actions/claude_harness.cjs claude --print --no-chrome --allowed-tools '\''Bash,BashOutput,Edit,Edit(/tmp/*),ExitPlanMode,Glob,Grep,KillBash,LS,MultiEdit,MultiEdit(/tmp/*),NotebookEdit,NotebookRead,Read,Read(/tmp/*),Task,TodoWrite,Write,Write(/tmp/*),mcp__agenticworkflows,mcp__github__actions_get,mcp__github__actions_list,mcp__github__get_code_scanning_alert,mcp__github__get_commit,mcp__github__get_dependabot_alert,mcp__github__get_discussion,mcp__github__get_discussion_comments,mcp__github__get_file_contents,mcp__github__get_job_logs,mcp__github__get_label,mcp__github__get_latest_release,mcp__github__get_me,mcp__github__get_notification_details,mcp__github__get_pull_request,mcp__github__get_pull_request_comments,mcp__github__get_pull_request_diff,mcp__github__get_pull_request_files,mcp__github__get_pull_request_review_comments,mcp__github__get_pull_request_reviews,mcp__github__get_pull_request_status,mcp__github__get_release_by_tag,mcp__github__get_secret_scanning_alert,mcp__github__get_tag,mcp__github__issue_read,mcp__github__list_branches,mcp__github__list_code_scanning_alerts,mcp__github__list_commits,mcp__github__list_dependabot_alerts,mcp__github__list_discussion_categories,mcp__github__list_discussions,mcp__github__list_issue_types,mcp__github__list_issues,mcp__github__list_label,mcp__github__list_notifications,mcp__github__list_pull_requests,mcp__github__list_releases,mcp__github__list_secret_scanning_alerts,mcp__github__list_starred_repositories,mcp__github__list_tags,mcp__github__pull_request_read,mcp__github__search_code,mcp__github__search_issues,mcp__github__search_orgs,mcp__github__search_pull_requests,mcp__github__search_repositories,mcp__github__search_users,mcp__safeoutputs'\'' --debug-file /tmp/gh-aw/agent/claude-debug.log --verbose --permission-mode acceptEdits --output-format stream-json --mcp-config "${RUNNER_TEMP}/gh-aw/mcp-config/mcp-servers.json" --prompt-file /tmp/gh-aw/aw-prompts/prompt.txt${GH_AW_MODEL_AGENT_CLAUDE:+ --model "$GH_AW_MODEL_AGENT_CLAUDE"}' 2>&1 | tee -a /tmp/gh-aw/agent-stdio.log
        env:
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
          ANTHROPIC_MAX_RETRIES: 0
          BASH_DEFAULT_TIMEOUT_MS: 60000
          BASH_MAX_TIMEOUT_MS: 60000
          CLAUDE_CODE_DISABLE_FAST_MODE: 1
          DISABLE_BUG_COMMAND: 1
          DISABLE_ERROR_REPORTING: 1
          DISABLE_TELEMETRY: 1
          GH_AW_LLM_PROVIDER: anthropic
          GH_AW_MAX_TURNS: ${{ vars.GH_AW_DEFAULT_MAX_TURNS || '' }}
          GH_AW_MCP_CONFIG: ${{ runner.temp }}/gh-aw/mcp-config/mcp-servers.json
          GH_AW_MODEL_AGENT_CLAUDE: ${{ vars.GH_AW_MODEL_AGENT_CLAUDE || vars.GH_AW_DEFAULT_MODEL_CLAUDE || 'claude-sonnet-5' }}
          GH_AW_PHASE: agent
          GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
          GH_AW_SAFE_OUTPUTS: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS }}
          GH_AW_VERSION: dev
          GH_TOKEN: ${{ secrets.GH_AW_GITHUB_TOKEN || github.token }}
          GITHUB_AW: true
          GITHUB_STEP_SUMMARY: /tmp/gh-aw/agent-step-summary.md
          GITHUB_WORKSPACE: ${{ github.workspace }}
          GIT_AUTHOR_EMAIL: github-actions[bot]@users.noreply.github.com
          GIT_AUTHOR_NAME: github-actions[bot]
          GIT_COMMITTER_EMAIL: github-actions[bot]@users.noreply.github.com
          GIT_COMMITTER_NAME: github-actions[bot]
          MCP_TIMEOUT: 120000
          MCP_TOOL_TIMEOUT: 60000
          RUNNER_TEMP: ${{ runner.temp }}
          TRACEPARENT: ${{ env.GITHUB_AW_OTEL_TRACE_ID != '' && env.GITHUB_AW_OTEL_PARENT_SPAN_ID != '' && format('00-{0}-{1}-01', env.GITHUB_AW_OTEL_TRACE_ID, env.GITHUB_AW_OTEL_PARENT_SPAN_ID) || '' }}
      - name: Stop CLI Proxy
        if: always()
        continue-on-error: true
        run: bash "${RUNNER_TEMP}/gh-aw/actions/stop_cli_proxy.sh"
      - name: Detect agent errors
        if: always()
        id: detect-agent-errors
        continue-on-error: true
        env:
          GH_AW_AGENTIC_EXECUTION_OUTCOME: ${{ steps.agentic_execution.outcome }}
          GH_AW_ENGINE_STEP_TIMEOUT_MINUTES: 60
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          script: |
            const path = require('path');
            const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
            const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
            setupGlobals(core, github, context, exec, io, getOctokit);
            const { main } = require(path.join(actionsDir, 'detect_agent_errors.cjs'));
            await main();
      - name: Configure Git credentials
        env:
          GITHUB_REPOSITORY: ${{ github.repository }}
          GITHUB_SERVER_URL: ${{ github.server_url }}
          GITHUB_TOKEN: ${{ github.token }}
        run: bash "${RUNNER_TEMP}/gh-aw/actions/configure_git_credentials.sh"
      - name: Stop MCP Gateway
        if: always()
        continue-on-error: true
        env:
          MCP_GATEWAY_PORT: ${{ steps.start-mcp-gateway.outputs.gateway-port }}
          MCP_GATEWAY_API_KEY: ${{ steps.start-mcp-gateway.outputs.gateway-api-key }}
          GATEWAY_PID: ${{ steps.start-mcp-gateway.outputs.gateway-pid }}
        run: |
          bash "${RUNNER_TEMP}/gh-aw/actions/stop_mcp_gateway.sh" "$GATEWAY_PID"
      - name: Redact secrets in logs
        if: always()
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          script: |
            const path = require('path');
            const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
            const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
            setupGlobals(core, github, context, exec, io, getOctokit);
            const { main } = require(path.join(actionsDir, 'redact_secrets.cjs'));
            await main();
        env:
          GH_AW_SECRET_NAMES: 'ANTHROPIC_API_KEY,GH_AW_GITHUB_MCP_SERVER_TOKEN,GH_AW_GITHUB_TOKEN,GITHUB_TOKEN'
          SECRET_ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
          SECRET_GH_AW_GITHUB_MCP_SERVER_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN }}
          SECRET_GH_AW_GITHUB_TOKEN: ${{ secrets.GH_AW_GITHUB_TOKEN }}
          SECRET_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: Append agent step summary
        if: always()
        run: bash "${RUNNER_TEMP}/gh-aw/actions/append_agent_step_summary.sh"
      - name: Copy Safe Outputs
        if: always()
        env:
          GH_AW_SAFE_OUTPUTS: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS }}
        run: |
          mkdir -p /tmp/gh-aw
          cp "$GH_AW_SAFE_OUTPUTS" /tmp/gh-aw/safeoutputs.jsonl 2>/dev/null || true
      - name: Ingest agent output
        id: collect_output
        if: always()
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          GH_AW_SAFE_OUTPUTS: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS }}
          GH_AW_ALLOWED_DOMAINS: "*.githubusercontent.com,*.grafana.net,*.sentry.io,anthropic.com,api.anthropic.com,api.github.com,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,cdn.playwright.dev,codeload.github.com,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,ghcr.io,github-cloud.githubusercontent.com,github-cloud.s3.amazonaws.com,github.com,host.docker.internal,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,lfs.github.com,objects.githubusercontent.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,playwright.download.prss.microsoft.com,ppa.launchpad.net,raw.githubusercontent.com,s.symcb.com,s.symcd.com,security.ubuntu.com,sentry.io,statsig.anthropic.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com,www.googleapis.com"
          GITHUB_SERVER_URL: ${{ github.server_url }}
          GITHUB_API_URL: ${{ github.api_url }}
        with:
          script: |
            const path = require('path');
            const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
            const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
            setupGlobals(core, github, context, exec, io, getOctokit);
            const { main } = require(path.join(actionsDir, 'collect_ndjson_output.cjs'));
            await main();
      - name: Parse agent logs for step summary
        if: always()
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          GH_AW_AGENT_OUTPUT: /tmp/gh-aw/agent-stdio.log
          GH_AW_SAFE_OUTPUTS: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS }}
        with:
          script: |
            const path = require('path');
            const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
            const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
            setupGlobals(core, github, context, exec, io, getOctokit);
            const { main } = require(path.join(actionsDir, 'parse_claude_log.cjs'));
            await main();
      - name: Parse MCP Gateway logs for step summary
        if: always()
        id: parse-mcp-gateway
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          script: |
            const path = require('path');
            const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
            const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
            setupGlobals(core, github, context, exec, io, getOctokit);
            const { main } = require(path.join(actionsDir, 'parse_mcp_gateway_log.cjs'));
            await main();
      - name: Print firewall logs
        if: always()
        continue-on-error: true
        env:
          AWF_LOGS_DIR: /tmp/gh-aw/sandbox/firewall/logs
        run: bash "${RUNNER_TEMP}/gh-aw/actions/print_firewall_logs.sh" --rootless
      - name: Parse token usage for step summary
        if: always()
        continue-on-error: true
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          script: |
            const path = require('path');
            const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
            const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
            setupGlobals(core, github, context, exec, io, getOctokit);
            const { main } = require(path.join(actionsDir, 'parse_token_usage.cjs'));
            await main();
      - name: Print AWF reflect summary
        if: always()
        continue-on-error: true
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          script: |
            const path = require('path');
            const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
            const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
            setupGlobals(core, github, context, exec, io, getOctokit);
            const { main } = require(path.join(actionsDir, 'awf_reflect_summary.cjs'));
            await main();
      - name: Generate observability summary
        if: always()
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          script: |
            const path = require('path');
            const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
            const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
            setupGlobals(core, github, context, exec, io, getOctokit);
            const { main } = require(path.join(actionsDir, 'generate_observability_summary.cjs'));
            await main(core);
      - name: Run graders
        if: always()
        continue-on-error: true
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          script: |
            const path = require('path');
            const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
            const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
            setupGlobals(core, github, context, exec, io, getOctokit);
            const { main } = require(path.join(actionsDir, 'trace_graders.cjs'));
            await main('eyJ2ZXJzaW9uIjoxLCJncmFkZXJzIjpbeyJpZCI6InJlY3VycmVuY2UtZGV0ZXJtaW5pc20iLCJuYW1lIjoiUmVjdXJyZW5jZSBEZXRlcm1pbmlzbSAoUlFBIERFVCkiLCJzb3VyY2UiOiJpbmxpbmUiLCJlbmFibGVkIjp0cnVlLCJ1bml0IjoicmF0aW8iLCJkaXJlY3Rpb24iOiJsb3dlcl9pc19iZXR0ZXIiLCJtYXgiOjEsIm1pbiI6MCwiZGlnZXN0IjoiNDQ3YTE3MzVkYmVhNmE4OWQ4ZWI0ZDc3MmI1NTFmOWJhZDQ2NzU3MmJiMjQzNWE1ZTVmY2MzNjNiZWJhNjRhYyJ9LHsiaWQiOiJyZWN1cnJlbmNlLWxhbWluYXJpdHkiLCJuYW1lIjoiUmVjdXJyZW5jZSBMYW1pbmFyaXR5IChSUUEgTEFNKSIsInNvdXJjZSI6ImlubGluZSIsImVuYWJsZWQiOnRydWUsInVuaXQiOiJyYXRpbyIsImRpcmVjdGlvbiI6Imxvd2VyX2lzX2JldHRlciIsIm1heCI6MSwibWluIjowLCJkaWdlc3QiOiIyNTQ2YmNlNWJjYWQ0NWNkMjk4NTMxNTQxMzQyYTg0YTMzMTUzYTFmNDE4YWEzNDdiM2Y5MTA4ZTk2ZTc2NjViIn0seyJpZCI6InN0YXRlLXJldmlzaXQtcHJvYmFiaWxpdHktcmVwIiwibmFtZSI6IlN0YXRlIFJldmlzaXQgUHJvYmFiaWxpdHkgUkVQIiwic291cmNlIjoiaW5saW5lIiwiZW5hYmxlZCI6dHJ1ZSwidW5pdCI6InJhdGlvIiwiZGlyZWN0aW9uIjoibG93ZXJfaXNfYmV0dGVyIiwibWF4IjoxLCJtaW4iOjAsImRpZ2VzdCI6IjVkZTc5ZjU3Mzg4NzA1Yjg1NmQwODcxYTkwMGQ4NjhmOWFmNTkzZjAzNDc4NDNlYTdhZjM1YzMxMjAxNjBmMzUifV19', 'W3siaWQiOiJyZWN1cnJlbmNlLWRldGVybWluaXNtIiwic2NyaXB0IjoiY29uc3QgaXNSZWNvcmQgPSB2YWx1ZSA9XHUwMDNlIHZhbHVlICE9PSBudWxsIFx1MDAyNlx1MDAyNiB0eXBlb2YgdmFsdWUgPT09IFwib2JqZWN0XCIgXHUwMDI2XHUwMDI2ICFBcnJheS5pc0FycmF5KHZhbHVlKTtcbmNvbnN0IGNhbmRpZGF0ZXMgPSBbXG4gIHRyYWNlLnRyYWplY3RvcnlJUixcbiAgdHJhY2UudHJhamVjdG9yeUlyLFxuICB0cmFjZS5pcixcbiAgaXNSZWNvcmQodHJhY2UuYWdlbnRPdXRwdXQpID8gdHJhY2UuYWdlbnRPdXRwdXQudHJhamVjdG9yeUlSIDogbnVsbCxcbiAgaXNSZWNvcmQodHJhY2UuYWdlbnRPdXRwdXQpID8gdHJhY2UuYWdlbnRPdXRwdXQudHJhamVjdG9yeUlyIDogbnVsbCxcbiAgaXNSZWNvcmQodHJhY2UuYWdlbnRPdXRwdXQpID8gdHJhY2UuYWdlbnRPdXRwdXQudHJhamVjdG9yeSA6IG51bGwsXG4gIGlzUmVjb3JkKHRyYWNlLmFnZW50T3V0cHV0KSA/IHRyYWNlLmFnZW50T3V0cHV0IDogbnVsbCxcbl0uZmlsdGVyKGlzUmVjb3JkKTtcblxubGV0IHN0YXRlcyA9IFtdO1xubGV0IGV2ZW50cyA9IFtdO1xuZm9yIChjb25zdCBjYW5kaWRhdGUgb2YgY2FuZGlkYXRlcykge1xuICBpZiAoQXJyYXkuaXNBcnJheShjYW5kaWRhdGUuc3RhdGVzKSkge1xuICAgIHN0YXRlcyA9IGNhbmRpZGF0ZS5zdGF0ZXM7XG4gICAgZXZlbnRzID0gQXJyYXkuaXNBcnJheShjYW5kaWRhdGUuZXZlbnRzKSA/IGNhbmRpZGF0ZS5ldmVudHMgOiBbXTtcbiAgICBicmVhaztcbiAgfVxufVxuXG5jb25zdCBldmVudE9yZGVyID0gbmV3IE1hcCgpO1xuZm9yIChsZXQgaSA9IDA7IGkgXHUwMDNjIGV2ZW50cy5sZW5ndGg7IGkgKz0gMSkge1xuICBjb25zdCBldmVudCA9IGV2ZW50c1tpXTtcbiAgaWYgKCFpc1JlY29yZChldmVudCkpIGNvbnRpbnVlO1xuICBjb25zdCBpbmRleCA9IE51bWJlcihldmVudC5pbmRleCk7XG4gIGlmIChOdW1iZXIuaXNGaW5pdGUoaW5kZXgpKSBldmVudE9yZGVyLnNldChpbmRleCwgaSk7XG59XG5cbi8vIEJ1aWxkIHRoZSBvcmRlcmVkIGNhbm9uaWNhbCBzdGF0ZS1pZCBzZXF1ZW5jZSAob25lIGVudHJ5IHBlciB2aXNpdCxcbi8vIGluIGV4ZWN1dGlvbiBvcmRlciksIHNhbWUgbm9ybWFsaXphdGlvbiBhcyBzdGF0ZS1yZXZpc2l0LXByb2JhYmlsaXR5LXJlcC5cbmNvbnN0IG9yZGVyZWQgPSBzdGF0ZXMubWFwKChzdGF0ZSwgcG9zaXRpb24pID1cdTAwM2Uge1xuICBpZiAodHlwZW9mIHN0YXRlID09PSBcInN0cmluZ1wiKSByZXR1cm4geyBpZDogc3RhdGUsIG9yZGVyOiBwb3NpdGlvbiB9O1xuICBpZiAoIWlzUmVjb3JkKHN0YXRlKSB8fCB0eXBlb2Ygc3RhdGUuaWQgIT09IFwic3RyaW5nXCIgfHwgc3RhdGUuaWQgPT09IFwiXCIpIHJldHVybiBudWxsO1xuICBjb25zdCBmaXJzdEV2ZW50SW5kZXggPSBOdW1iZXIoc3RhdGUuZmlyc3RFdmVudEluZGV4KTtcbiAgY29uc3QgaGFzRmlyc3RFdmVudEluZGV4ID0gTnVtYmVyLmlzRmluaXRlKGZpcnN0RXZlbnRJbmRleCk7XG4gIGNvbnN0IGV2ZW50UG9zaXRpb24gPSBoYXNGaXJzdEV2ZW50SW5kZXggXHUwMDI2XHUwMDI2IGV2ZW50T3JkZXIuaGFzKGZpcnN0RXZlbnRJbmRleCkgPyBldmVudE9yZGVyLmdldChmaXJzdEV2ZW50SW5kZXgpIDogbnVsbDtcbiAgY29uc3Qgb3JkZXIgPSBldmVudFBvc2l0aW9uICE9PSBudWxsID8gZXZlbnRQb3NpdGlvbiA6IGhhc0ZpcnN0RXZlbnRJbmRleCA/IGZpcnN0RXZlbnRJbmRleCA6IHBvc2l0aW9uO1xuICByZXR1cm4geyBpZDogc3RhdGUuaWQsIG9yZGVyIH07XG59KS5maWx0ZXIoZW50cnkgPVx1MDAzZSBlbnRyeSAhPT0gbnVsbCkuc29ydCgoYSwgYikgPVx1MDAzZSBhLm9yZGVyIC0gYi5vcmRlcik7XG5cbmNvbnN0IHNlcXVlbmNlID0gb3JkZXJlZC5tYXAoZW50cnkgPVx1MDAzZSBlbnRyeS5pZCk7XG5jb25zdCBuID0gc2VxdWVuY2UubGVuZ3RoO1xuaWYgKG4gXHUwMDNjIDQpIHtcbiAgcmV0dXJuIHsgdmFsdWU6IDAsIHVuaXQ6IFwicmF0aW9cIiwgcGFzc2VkOiBudWxsLCBtZXNzYWdlOiBcIm5vdCBhcHBsaWNhYmxlOiBmZXdlciB0aGFuIGZvdXIgY2Fub25pY2FsIHN0YXRlIHZpc2l0c1wiIH07XG59XG5cbi8vIFJlY3VycmVuY2UgbWF0cml4IFJbaV1bal0gPSAxIGlmZiBzZXF1ZW5jZVtpXSA9PT0gc2VxdWVuY2Vbal0gYW5kIGkgIT09IGpcbi8vICh0aGUgbWFpbiBkaWFnb25hbCAvIGxpbmUgb2YgaWRlbnRpdHkgaXMgZXhjbHVkZWQgYnkgZGVmaW5pdGlvbikuXG4vLyBEaWFnb25hbCBsaW5lIG1pbmltdW0gbGVuZ3RoIGZvciBSUUEgREVULlxuY29uc3QgbG1pbiA9IDI7XG5sZXQgdG90YWxSZWN1cnJlbnRQb2ludHMgPSAwO1xubGV0IGRpYWdvbmFsUG9pbnRzID0gMDtcbmNvbnN0IGRpYWdvbmFsTGluZUxlbmd0aHMgPSBbXTtcblxuLy8gV2FsayBldmVyeSBkaWFnb25hbCBvZmZzZXQgZCA9IGogLSBpIChkICE9IDApLCBzY2FubmluZyBlYWNoIGRpYWdvbmFsXG4vLyBvbmNlIGFuZCBncm91cGluZyBjb25zZWN1dGl2ZSByZWN1cnJlbnQgcG9pbnRzIGludG8gbGluZSBsZW5ndGhzLlxuZm9yIChsZXQgZCA9IDE7IGQgXHUwMDNjIG47IGQgKz0gMSkge1xuICBsZXQgcnVuTGVuZ3RoID0gMDtcbiAgZm9yIChsZXQgaSA9IDA7IGkgKyBkIFx1MDAzYyBuOyBpICs9IDEpIHtcbiAgICBjb25zdCBqID0gaSArIGQ7XG4gICAgY29uc3QgcmVjdXJyZW50ID0gc2VxdWVuY2VbaV0gPT09IHNlcXVlbmNlW2pdO1xuICAgIGlmIChyZWN1cnJlbnQpIHtcbiAgICAgIHRvdGFsUmVjdXJyZW50UG9pbnRzICs9IDI7IC8vIHN5bW1ldHJpYzogKGksaikgYW5kIChqLGkpXG4gICAgICBydW5MZW5ndGggKz0gMTtcbiAgICB9IGVsc2Uge1xuICAgICAgaWYgKHJ1bkxlbmd0aCBcdTAwM2UgMCkgZGlhZ29uYWxMaW5lTGVuZ3Rocy5wdXNoKHJ1bkxlbmd0aCk7XG4gICAgICBydW5MZW5ndGggPSAwO1xuICAgIH1cbiAgfVxuICBpZiAocnVuTGVuZ3RoIFx1MDAzZSAwKSBkaWFnb25hbExpbmVMZW5ndGhzLnB1c2gocnVuTGVuZ3RoKTtcbn1cblxuZm9yIChjb25zdCBsZW5ndGggb2YgZGlhZ29uYWxMaW5lTGVuZ3Rocykge1xuICBpZiAobGVuZ3RoIFx1MDAzZT0gbG1pbikgZGlhZ29uYWxQb2ludHMgKz0gbGVuZ3RoICogMjsgLy8gc3ltbWV0cmljIGNvbnRyaWJ1dGlvblxufVxuXG5pZiAodG90YWxSZWN1cnJlbnRQb2ludHMgPT09IDApIHtcbiAgcmV0dXJuIHtcbiAgICB2YWx1ZTogMCxcbiAgICB1bml0OiBcInJhdGlvXCIsXG4gICAgZGV0YWlsczogYG5vIHJlY3VycmVudCBzdGF0ZSBwYWlycyBmb3VuZCBhY3Jvc3MgJHtufSBzdGF0ZSB2aXNpdHM7IERFVCBpcyB2YWN1b3VzbHkgMGAsXG4gIH07XG59XG5cbmNvbnN0IGRldCA9IGhlbHBlcnMucmF0aW8oZGlhZ29uYWxQb2ludHMsIHRvdGFsUmVjdXJyZW50UG9pbnRzKTtcbmNvbnN0IGxvbmdMaW5lcyA9IGRpYWdvbmFsTGluZUxlbmd0aHMuZmlsdGVyKGxlbmd0aCA9XHUwMDNlIGxlbmd0aCBcdTAwM2U9IGxtaW4pLnNvcnQoKGEsIGIpID1cdTAwM2UgYiAtIGEpLnNsaWNlKDAsIDUpO1xucmV0dXJuIHtcbiAgdmFsdWU6IGRldCxcbiAgdW5pdDogXCJyYXRpb1wiLFxuICBkZXRhaWxzOiBgdmlzaXRzPSR7bn0gcmVjdXJyZW50UG9pbnRzPSR7dG90YWxSZWN1cnJlbnRQb2ludHN9IGRpYWdvbmFsUG9pbnRzPSR7ZGlhZ29uYWxQb2ludHN9IGxtaW49JHtsbWlufSR7bG9uZ0xpbmVzLmxlbmd0aCA9PT0gMCA/IFwiXCIgOiBgOyBsb25nZXN0IGRpYWdvbmFsIGxpbmVzOiAke2xvbmdMaW5lcy5qb2luKFwiLCBcIil9YH1gLFxufTsifSx7ImlkIjoicmVjdXJyZW5jZS1sYW1pbmFyaXR5Iiwic2NyaXB0IjoiY29uc3QgaXNSZWNvcmQgPSB2YWx1ZSA9XHUwMDNlIHZhbHVlICE9PSBudWxsIFx1MDAyNlx1MDAyNiB0eXBlb2YgdmFsdWUgPT09IFwib2JqZWN0XCIgXHUwMDI2XHUwMDI2ICFBcnJheS5pc0FycmF5KHZhbHVlKTtcbmNvbnN0IGNhbmRpZGF0ZXMgPSBbXG4gIHRyYWNlLnRyYWplY3RvcnlJUixcbiAgdHJhY2UudHJhamVjdG9yeUlyLFxuICB0cmFjZS5pcixcbiAgaXNSZWNvcmQodHJhY2UuYWdlbnRPdXRwdXQpID8gdHJhY2UuYWdlbnRPdXRwdXQudHJhamVjdG9yeUlSIDogbnVsbCxcbiAgaXNSZWNvcmQodHJhY2UuYWdlbnRPdXRwdXQpID8gdHJhY2UuYWdlbnRPdXRwdXQudHJhamVjdG9yeUlyIDogbnVsbCxcbiAgaXNSZWNvcmQodHJhY2UuYWdlbnRPdXRwdXQpID8gdHJhY2UuYWdlbnRPdXRwdXQudHJhamVjdG9yeSA6IG51bGwsXG4gIGlzUmVjb3JkKHRyYWNlLmFnZW50T3V0cHV0KSA/IHRyYWNlLmFnZW50T3V0cHV0IDogbnVsbCxcbl0uZmlsdGVyKGlzUmVjb3JkKTtcblxubGV0IHN0YXRlcyA9IFtdO1xubGV0IGV2ZW50cyA9IFtdO1xuZm9yIChjb25zdCBjYW5kaWRhdGUgb2YgY2FuZGlkYXRlcykge1xuICBpZiAoQXJyYXkuaXNBcnJheShjYW5kaWRhdGUuc3RhdGVzKSkge1xuICAgIHN0YXRlcyA9IGNhbmRpZGF0ZS5zdGF0ZXM7XG4gICAgZXZlbnRzID0gQXJyYXkuaXNBcnJheShjYW5kaWRhdGUuZXZlbnRzKSA/IGNhbmRpZGF0ZS5ldmVudHMgOiBbXTtcbiAgICBicmVhaztcbiAgfVxufVxuXG5jb25zdCBldmVudE9yZGVyID0gbmV3IE1hcCgpO1xuZm9yIChsZXQgaSA9IDA7IGkgXHUwMDNjIGV2ZW50cy5sZW5ndGg7IGkgKz0gMSkge1xuICBjb25zdCBldmVudCA9IGV2ZW50c1tpXTtcbiAgaWYgKCFpc1JlY29yZChldmVudCkpIGNvbnRpbnVlO1xuICBjb25zdCBpbmRleCA9IE51bWJlcihldmVudC5pbmRleCk7XG4gIGlmIChOdW1iZXIuaXNGaW5pdGUoaW5kZXgpKSBldmVudE9yZGVyLnNldChpbmRleCwgaSk7XG59XG5cbi8vIEJ1aWxkIHRoZSBvcmRlcmVkIGNhbm9uaWNhbCBzdGF0ZS1pZCBzZXF1ZW5jZSAob25lIGVudHJ5IHBlciB2aXNpdCxcbi8vIGluIGV4ZWN1dGlvbiBvcmRlciksIHNhbWUgbm9ybWFsaXphdGlvbiBhcyByZWN1cnJlbmNlLWRldGVybWluaXNtLlxuY29uc3Qgb3JkZXJlZCA9IHN0YXRlcy5tYXAoKHN0YXRlLCBwb3NpdGlvbikgPVx1MDAzZSB7XG4gIGlmICh0eXBlb2Ygc3RhdGUgPT09IFwic3RyaW5nXCIpIHJldHVybiB7IGlkOiBzdGF0ZSwgb3JkZXI6IHBvc2l0aW9uIH07XG4gIGlmICghaXNSZWNvcmQoc3RhdGUpIHx8IHR5cGVvZiBzdGF0ZS5pZCAhPT0gXCJzdHJpbmdcIiB8fCBzdGF0ZS5pZCA9PT0gXCJcIikgcmV0dXJuIG51bGw7XG4gIGNvbnN0IGZpcnN0RXZlbnRJbmRleCA9IE51bWJlcihzdGF0ZS5maXJzdEV2ZW50SW5kZXgpO1xuICBjb25zdCBoYXNGaXJzdEV2ZW50SW5kZXggPSBOdW1iZXIuaXNGaW5pdGUoZmlyc3RFdmVudEluZGV4KTtcbiAgY29uc3QgZXZlbnRQb3NpdGlvbiA9IGhhc0ZpcnN0RXZlbnRJbmRleCBcdTAwMjZcdTAwMjYgZXZlbnRPcmRlci5oYXMoZmlyc3RFdmVudEluZGV4KSA/IGV2ZW50T3JkZXIuZ2V0KGZpcnN0RXZlbnRJbmRleCkgOiBudWxsO1xuICBjb25zdCBvcmRlciA9IGV2ZW50UG9zaXRpb24gIT09IG51bGwgPyBldmVudFBvc2l0aW9uIDogaGFzRmlyc3RFdmVudEluZGV4ID8gZmlyc3RFdmVudEluZGV4IDogcG9zaXRpb247XG4gIHJldHVybiB7IGlkOiBzdGF0ZS5pZCwgb3JkZXIgfTtcbn0pLmZpbHRlcihlbnRyeSA9XHUwMDNlIGVudHJ5ICE9PSBudWxsKS5zb3J0KChhLCBiKSA9XHUwMDNlIGEub3JkZXIgLSBiLm9yZGVyKTtcblxuY29uc3Qgc2VxdWVuY2UgPSBvcmRlcmVkLm1hcChlbnRyeSA9XHUwMDNlIGVudHJ5LmlkKTtcbmNvbnN0IG4gPSBzZXF1ZW5jZS5sZW5ndGg7XG5pZiAobiBcdTAwM2MgNCkge1xuICByZXR1cm4geyB2YWx1ZTogMCwgdW5pdDogXCJyYXRpb1wiLCBwYXNzZWQ6IG51bGwsIG1lc3NhZ2U6IFwibm90IGFwcGxpY2FibGU6IGZld2VyIHRoYW4gZm91ciBjYW5vbmljYWwgc3RhdGUgdmlzaXRzXCIgfTtcbn1cblxuLy8gUmVjdXJyZW5jZSBtYXRyaXggUltpXVtqXSA9IDEgaWZmIHNlcXVlbmNlW2ldID09PSBzZXF1ZW5jZVtqXSBhbmQgaSAhPT0galxuLy8gKHRoZSBtYWluIGRpYWdvbmFsIC8gbGluZSBvZiBpZGVudGl0eSBpcyBleGNsdWRlZCBieSBkZWZpbml0aW9uKS5cbi8vIFZlcnRpY2FsIGxpbmUgbWluaW11bSBsZW5ndGggZm9yIFJRQSBMQU0uXG5jb25zdCB2bWluID0gMjtcbmxldCB0b3RhbFJlY3VycmVudFBvaW50cyA9IDA7XG5sZXQgdmVydGljYWxQb2ludHMgPSAwO1xuY29uc3QgdmVydGljYWxMaW5lTGVuZ3RocyA9IFtdO1xuXG4vLyBTY2FuIGV2ZXJ5IGNvbHVtbiBqIG9uY2UsIGdyb3VwaW5nIGNvbnNlY3V0aXZlIHJlY3VycmVudCByb3dzIGkgaW50b1xuLy8gdmVydGljYWwgbGluZSBsZW5ndGhzLiBTY2FubmluZyBhbGwgY29sdW1ucyB2aXNpdHMgZXZlcnkgKm9yZGVyZWQqXG4vLyByZWN1cnJlbnQgcGFpciBleGFjdGx5IG9uY2UsIHNvIGVhY2ggdW5vcmRlcmVkIHBhaXIge2ksIGp9IGNvdW50c1xuLy8gdHdpY2Ug4oCUIHRoZSBzYW1lIG9yZGVyZWQtcGFpciBjb252ZW50aW9uIHJlY3VycmVuY2UtZGV0ZXJtaW5pc20gdXNlcyxcbi8vIGFuZCBpdCBhcHBsaWVzIHRvIGJvdGggdGhlIG51bWVyYXRvciBhbmQgdGhlIGRlbm9taW5hdG9yLlxuZm9yIChsZXQgaiA9IDA7IGogXHUwMDNjIG47IGogKz0gMSkge1xuICBsZXQgcnVuTGVuZ3RoID0gMDtcbiAgZm9yIChsZXQgaSA9IDA7IGkgXHUwMDNjIG47IGkgKz0gMSkge1xuICAgIGNvbnN0IHJlY3VycmVudCA9IGkgIT09IGogXHUwMDI2XHUwMDI2IHNlcXVlbmNlW2ldID09PSBzZXF1ZW5jZVtqXTtcbiAgICBpZiAocmVjdXJyZW50KSB7XG4gICAgICB0b3RhbFJlY3VycmVudFBvaW50cyArPSAxO1xuICAgICAgcnVuTGVuZ3RoICs9IDE7XG4gICAgfSBlbHNlIHtcbiAgICAgIGlmIChydW5MZW5ndGggXHUwMDNlIDApIHZlcnRpY2FsTGluZUxlbmd0aHMucHVzaChydW5MZW5ndGgpO1xuICAgICAgcnVuTGVuZ3RoID0gMDtcbiAgICB9XG4gIH1cbiAgaWYgKHJ1bkxlbmd0aCBcdTAwM2UgMCkgdmVydGljYWxMaW5lTGVuZ3Rocy5wdXNoKHJ1bkxlbmd0aCk7XG59XG5cbmZvciAoY29uc3QgbGVuZ3RoIG9mIHZlcnRpY2FsTGluZUxlbmd0aHMpIHtcbiAgaWYgKGxlbmd0aCBcdTAwM2U9IHZtaW4pIHZlcnRpY2FsUG9pbnRzICs9IGxlbmd0aDtcbn1cblxuaWYgKHRvdGFsUmVjdXJyZW50UG9pbnRzID09PSAwKSB7XG4gIHJldHVybiB7XG4gICAgdmFsdWU6IDAsXG4gICAgdW5pdDogXCJyYXRpb1wiLFxuICAgIGRldGFpbHM6IGBubyByZWN1cnJlbnQgc3RhdGUgcGFpcnMgZm91bmQgYWNyb3NzICR7bn0gc3RhdGUgdmlzaXRzOyBMQU0gaXMgdmFjdW91c2x5IDBgLFxuICB9O1xufVxuXG5jb25zdCBsYW0gPSBoZWxwZXJzLnJhdGlvKHZlcnRpY2FsUG9pbnRzLCB0b3RhbFJlY3VycmVudFBvaW50cyk7XG5jb25zdCBsb25nTGluZXMgPSB2ZXJ0aWNhbExpbmVMZW5ndGhzLmZpbHRlcihsZW5ndGggPVx1MDAzZSBsZW5ndGggXHUwMDNlPSB2bWluKS5zb3J0KChhLCBiKSA9XHUwMDNlIGIgLSBhKS5zbGljZSgwLCA1KTtcbnJldHVybiB7XG4gIHZhbHVlOiBsYW0sXG4gIHVuaXQ6IFwicmF0aW9cIixcbiAgZGV0YWlsczogYHZpc2l0cz0ke259IHJlY3VycmVudFBvaW50cz0ke3RvdGFsUmVjdXJyZW50UG9pbnRzfSB2ZXJ0aWNhbFBvaW50cz0ke3ZlcnRpY2FsUG9pbnRzfSB2bWluPSR7dm1pbn0ke2xvbmdMaW5lcy5sZW5ndGggPT09IDAgPyBcIlwiIDogYDsgbG9uZ2VzdCB2ZXJ0aWNhbCBsaW5lczogJHtsb25nTGluZXMuam9pbihcIiwgXCIpfWB9YCxcbn07In0seyJpZCI6InN0YXRlLXJldmlzaXQtcHJvYmFiaWxpdHktcmVwIiwic2NyaXB0IjoiY29uc3QgaXNSZWNvcmQgPSB2YWx1ZSA9XHUwMDNlIHZhbHVlICE9PSBudWxsIFx1MDAyNlx1MDAyNiB0eXBlb2YgdmFsdWUgPT09IFwib2JqZWN0XCIgXHUwMDI2XHUwMDI2ICFBcnJheS5pc0FycmF5KHZhbHVlKTtcbmNvbnN0IGNhbmRpZGF0ZXMgPSBbXG4gIHRyYWNlLnRyYWplY3RvcnlJUixcbiAgdHJhY2UudHJhamVjdG9yeUlyLFxuICB0cmFjZS5pcixcbiAgaXNSZWNvcmQodHJhY2UuYWdlbnRPdXRwdXQpID8gdHJhY2UuYWdlbnRPdXRwdXQudHJhamVjdG9yeUlSIDogbnVsbCxcbiAgaXNSZWNvcmQodHJhY2UuYWdlbnRPdXRwdXQpID8gdHJhY2UuYWdlbnRPdXRwdXQudHJhamVjdG9yeUlyIDogbnVsbCxcbiAgaXNSZWNvcmQodHJhY2UuYWdlbnRPdXRwdXQpID8gdHJhY2UuYWdlbnRPdXRwdXQudHJhamVjdG9yeSA6IG51bGwsXG4gIGlzUmVjb3JkKHRyYWNlLmFnZW50T3V0cHV0KSA/IHRyYWNlLmFnZW50T3V0cHV0IDogbnVsbCxcbl0uZmlsdGVyKGlzUmVjb3JkKTtcblxubGV0IHN0YXRlcyA9IFtdO1xubGV0IGV2ZW50cyA9IFtdO1xuZm9yIChjb25zdCBjYW5kaWRhdGUgb2YgY2FuZGlkYXRlcykge1xuICBpZiAoQXJyYXkuaXNBcnJheShjYW5kaWRhdGUuc3RhdGVzKSkge1xuICAgIHN0YXRlcyA9IGNhbmRpZGF0ZS5zdGF0ZXM7XG4gICAgZXZlbnRzID0gQXJyYXkuaXNBcnJheShjYW5kaWRhdGUuZXZlbnRzKSA/IGNhbmRpZGF0ZS5ldmVudHMgOiBbXTtcbiAgICBicmVhaztcbiAgfVxufVxuXG5jb25zdCBldmVudE9yZGVyID0gbmV3IE1hcCgpO1xuZm9yIChsZXQgaSA9IDA7IGkgXHUwMDNjIGV2ZW50cy5sZW5ndGg7IGkgKz0gMSkge1xuICBjb25zdCBldmVudCA9IGV2ZW50c1tpXTtcbiAgaWYgKCFpc1JlY29yZChldmVudCkpIGNvbnRpbnVlO1xuICBjb25zdCBpbmRleCA9IE51bWJlcihldmVudC5pbmRleCk7XG4gIGlmIChOdW1iZXIuaXNGaW5pdGUoaW5kZXgpKSBldmVudE9yZGVyLnNldChpbmRleCwgaSk7XG59XG5cbmNvbnN0IG9yZGVyZWQgPSBzdGF0ZXMubWFwKChzdGF0ZSwgcG9zaXRpb24pID1cdTAwM2Uge1xuICBpZiAodHlwZW9mIHN0YXRlID09PSBcInN0cmluZ1wiKSByZXR1cm4geyBpZDogc3RhdGUsIG9yZGVyOiBwb3NpdGlvbiwgZXZlbnRJbmRleDogbnVsbCB9O1xuICBpZiAoIWlzUmVjb3JkKHN0YXRlKSB8fCB0eXBlb2Ygc3RhdGUuaWQgIT09IFwic3RyaW5nXCIgfHwgc3RhdGUuaWQgPT09IFwiXCIpIHJldHVybiBudWxsO1xuICBjb25zdCBmaXJzdEV2ZW50SW5kZXggPSBOdW1iZXIoc3RhdGUuZmlyc3RFdmVudEluZGV4KTtcbiAgY29uc3QgaGFzRmlyc3RFdmVudEluZGV4ID0gTnVtYmVyLmlzRmluaXRlKGZpcnN0RXZlbnRJbmRleCk7XG4gIGNvbnN0IGV2ZW50UG9zaXRpb24gPSBoYXNGaXJzdEV2ZW50SW5kZXggXHUwMDI2XHUwMDI2IGV2ZW50T3JkZXIuaGFzKGZpcnN0RXZlbnRJbmRleCkgPyBldmVudE9yZGVyLmdldChmaXJzdEV2ZW50SW5kZXgpIDogbnVsbDtcbiAgY29uc3Qgb3JkZXIgPSBldmVudFBvc2l0aW9uICE9PSBudWxsID8gZXZlbnRQb3NpdGlvbiA6IGhhc0ZpcnN0RXZlbnRJbmRleCA/IGZpcnN0RXZlbnRJbmRleCA6IHBvc2l0aW9uO1xuICByZXR1cm4geyBpZDogc3RhdGUuaWQsIG9yZGVyLCBldmVudEluZGV4OiBoYXNGaXJzdEV2ZW50SW5kZXggPyBmaXJzdEV2ZW50SW5kZXggOiBudWxsIH07XG59KS5maWx0ZXIoZW50cnkgPVx1MDAzZSBlbnRyeSAhPT0gbnVsbCkuc29ydCgoYSwgYikgPVx1MDAzZSBhLm9yZGVyIC0gYi5vcmRlcik7XG5cbmNvbnN0IHZpc2l0ZWQgPSBvcmRlcmVkLmxlbmd0aDtcbmlmICh2aXNpdGVkIFx1MDAzYyAyKSB7XG4gIHJldHVybiB7IHZhbHVlOiAwLCB1bml0OiBcInJhdGlvXCIsIHBhc3NlZDogbnVsbCwgbWVzc2FnZTogXCJub3QgYXBwbGljYWJsZTogZmV3ZXIgdGhhbiB0d28gc3RhdGUgdmlzaXRzXCIgfTtcbn1cblxuY29uc3Qgc2VlbiA9IG5ldyBTZXQoKTtcbmNvbnN0IHJlcGVhdGVkID0gW107XG5mb3IgKGNvbnN0IGVudHJ5IG9mIG9yZGVyZWQpIHtcbiAgaWYgKHNlZW4uaGFzKGVudHJ5LmlkKSBcdTAwMjZcdTAwMjYgcmVwZWF0ZWQubGVuZ3RoIFx1MDAzYyA1KSB7XG4gICAgcmVwZWF0ZWQucHVzaChlbnRyeS5ldmVudEluZGV4ID09PSBudWxsID8gZW50cnkuaWQgOiBgJHtlbnRyeS5pZH0gYXQgZXZlbnQgJHtlbnRyeS5ldmVudEluZGV4fWApO1xuICB9XG4gIHNlZW4uYWRkKGVudHJ5LmlkKTtcbn1cbmNvbnN0IGRpc3RpbmN0ID0gc2Vlbi5zaXplO1xuY29uc3QgcmV2aXNpdHMgPSB2aXNpdGVkIC0gZGlzdGluY3Q7XG5yZXR1cm4ge1xuICB2YWx1ZTogaGVscGVycy5yYXRpbyhyZXZpc2l0cywgdmlzaXRlZCksXG4gIHVuaXQ6IFwicmF0aW9cIixcbiAgZGV0YWlsczogYHZpc2l0ZWQ9JHt2aXNpdGVkfSBkaXN0aW5jdD0ke2Rpc3RpbmN0fSByZXZpc2l0cz0ke3JldmlzaXRzfSR7cmVwZWF0ZWQubGVuZ3RoID09PSAwID8gXCJcIiA6IGA7IHJlcGVhdGVkIHN0YXRlczogJHtyZXBlYXRlZC5qb2luKFwiLCBcIil9YH1gLFxufTsifV0=');
      - name: Redact grader outputs
        if: always()
        continue-on-error: true
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          script: |
            const path = require('path');
            const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
            const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
            setupGlobals(core, github, context, exec, io, getOctokit);
            const { redactFilesInDir } = require(path.join(actionsDir, 'redact_secrets.cjs'));
            await redactFilesInDir('/tmp/gh-aw/agent/graders');
        env:
          GH_AW_SECRET_NAMES: 'ANTHROPIC_API_KEY,GH_AW_GITHUB_MCP_SERVER_TOKEN,GH_AW_GITHUB_TOKEN,GITHUB_TOKEN'
          SECRET_ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
          SECRET_GH_AW_GITHUB_MCP_SERVER_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN }}
          SECRET_GH_AW_GITHUB_TOKEN: ${{ secrets.GH_AW_GITHUB_TOKEN }}
          SECRET_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: Write agent output placeholder if missing
        if: always()
        run: |
          if [ ! -f /tmp/gh-aw/agent_output.json ]; then
            echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
          fi
      # Small dedicated copy of the agent output so safe-output processing
      # survives a failed or timed-out upload of the larger agent artifact
      - name: Upload agent output fallback artifact
        if: always()
        continue-on-error: true
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: agent-output-fallback
          path: |
            /tmp/gh-aw/agent_output.json
            /tmp/gh-aw/safeoutputs.jsonl
            /tmp/gh-aw/agent/graders/grader_manifest.json
            /tmp/gh-aw/agent/graders/grader_results.json
          if-no-files-found: ignore
      - name: Upload agent artifacts
        if: always()
        continue-on-error: true
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: agent
          path: |
            /tmp/gh-aw/aw-prompts/prompt.txt
            /tmp/gh-aw/mcp-logs/
            /tmp/gh-aw/agent_usage.json
            /tmp/gh-aw/agent-stdio.log
            /tmp/gh-aw/pre-agent-audit.txt
            /tmp/gh-aw/agent/
            /tmp/gh-aw/github_rate_limits.jsonl
            /tmp/gh-aw/otel.jsonl
            /tmp/gh-aw/otlp-export-errors.jsonl
            /tmp/gh-aw/agent/graders/grader_manifest.json
            /tmp/gh-aw/agent/graders/grader_results.json
            /tmp/gh-aw/safeoutputs.jsonl
            /tmp/gh-aw/agent_output.json
            /tmp/gh-aw/aw-*.patch
            /tmp/gh-aw/aw-*.bundle
            /tmp/gh-aw/awf-config.json
            /tmp/gh-aw/sandbox/firewall/logs/
            /tmp/gh-aw/sandbox/firewall/audit/
            /tmp/gh-aw/sandbox/firewall/awf-reflect.json
          if-no-files-found: ignore

  conclusion:
    needs:
      - activation
      - agent
      - detection
      - evals
      - push_evals_state
      - push_experiments_state
      - safe_outputs
    if: >
      always() && (needs.agent.result != 'skipped' || needs.activation.outputs.lockdown_check_failed == 'true' ||
      needs.activation.outputs.oauth_token_check_failed == 'true' || needs.activation.outputs.stale_lock_file_failed == 'true' ||
      needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
    runs-on: ubuntu-slim
    permissions:
      actions: read
      issues: write
    concurrency:
      group: "gh-aw-conclusion-aw-failure-investigator"
      cancel-in-progress: false
      queue: max
    env:
      GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }}
    outputs:
      incomplete_count: ${{ steps.report_incomplete.outputs.incomplete_count }}
      noop_message: ${{ steps.noop.outputs.noop_message }}
      tools_reported: ${{ steps.missing_tool.outputs.tools_reported }}
      total_count: ${{ steps.missing_tool.outputs.total_count }}
    steps:
      - name: Checkout actions folder
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          repository: github/gh-aw
          sparse-checkout: |
            actions
          clean: false
          persist-credentials: false
      - name: Setup Scripts
        id: setup
        uses: ./actions/setup
        with:
          destination: ${{ runner.temp }}/gh-aw/actions
          job-name: ${{ github.job }}
          trace-id: ${{ needs.activation.outputs.setup-trace-id }}
          parent-span-id: ${{ needs.activation.outputs.setup-parent-span-id || needs.activation.outputs.setup-span-id }}
        env:
          GH_AW_SETUP_WORKFLOW_NAME: "[aw] Failure Investigator (6h)"
          GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/aw-failure-investigator.lock.yml@${{ github.ref }}
          GH_AW_INFO_VERSION: "2.1.245"
          GH_AW_INFO_AWF_VERSION: "v0.28.7"
          GH_AW_INFO_ENGINE_ID: "claude"
      - name: Download agent output artifact
        id: download-agent-output
        continue-on-error: true
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: "{agent,agent-output-fallback}"
          merge-multiple: true
          path: /tmp/gh-aw/
      - name: Setup agent output environment variable
        id: setup-agent-output-env
        if: steps.download-agent-output.outcome == 'success'
        run: |
          mkdir -p /tmp/gh-aw/
          find "/tmp/gh-aw/" -type f -print
          if [ -f "/tmp/gh-aw/agent_output.json" ]; then
            echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT"
          fi
      - name: Download detection artifact
        id: download-detection-artifact
        continue-on-error: true
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: detection
          path: /tmp/gh-aw/threat-detection/
      - name: Download Safe Outputs Items Manifest
        id: download-safe-outputs-manifest
        if: always()
        continue-on-error: true
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: safe-outputs-items
          merge-multiple: true
          path: /tmp/gh-aw/
      - name: Download evals artifact
        id: download-evals-artifact
        if: always()
        continue-on-error: true
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: evals
          merge-multiple: true
          path: /tmp/gh-aw/evals/
      - name: Collect usage artifact files
        if: always()
        continue-on-error: true
        run: bash "${RUNNER_TEMP}/gh-aw/actions/collect_usage_artifact_files.sh"
      - name: Upload usage artifact
        if: always()
        continue-on-error: true
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: usage
          path: |
            /tmp/gh-aw/usage/aw_info.json
            /tmp/gh-aw/usage/aw-info.jsonl
            /tmp/gh-aw/usage/agent_usage.json
            /tmp/gh-aw/usage/agent_usage.jsonl
            /tmp/gh-aw/usage/detection_usage.jsonl
            /tmp/gh-aw/usage/evals.jsonl
            /tmp/gh-aw/usage/github_rate_limits.jsonl
            /tmp/gh-aw/usage/agent/token_usage.jsonl
            /tmp/gh-aw/usage/detection/token_usage.jsonl
            /tmp/gh-aw/usage/activity/summary.json
          if-no-files-found: ignore
      - name: Restore daily AIC usage cache
        id: restore-daily-aic-cache-conclusion
        if: always()
        continue-on-error: true
        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          key: agentic-workflow-usage-awfailureinvestigator-${{ github.run_id }}
          restore-keys: agentic-workflow-usage-awfailureinvestigator-
          path: /tmp/gh-aw/agentic-workflow-usage-cache.jsonl
      - name: Write daily AIC usage cache entry
        id: write-daily-aic-cache
        if: always()
        continue-on-error: true
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          github-token: ${{ github.token }}
          script: |
            const path = require('path');
            const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
            const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
            setupGlobals(core, github, context);
            const { main } = require(path.join(actionsDir, 'write_daily_aic_usage_cache.cjs'));
            await main();
      - name: Save daily AIC usage cache
        id: save-daily-aic-cache
        if: always()
        continue-on-error: true
        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          key: agentic-workflow-usage-awfailureinvestigator-${{ github.run_id }}
          path: /tmp/gh-aw/agentic-workflow-usage-cache.jsonl
      - name: Upload daily AIC usage cache artifact
        id: upload-daily-aic-cache
        if: always()
        continue-on-error: true
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: aic-usage-cache
          path: /tmp/gh-aw/agentic-workflow-usage-cache.jsonl
          if-no-files-found: ignore
          retention-days: 7
      - name: Process no-op messages
        id: noop
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }}
          GH_AW_NOOP_MAX: "1"
          GH_AW_WORKFLOW_NAME: "[aw] Failure Investigator (6h)"
          GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/${{ github.repository }}/blob/${{ github.ref_name }}/.github/workflows/aw-failure-investigator.md"
          GH_AW_TRACKER_ID: "aw-failure-investigator"
          GH_AW_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
          GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }}
          GH_AW_NOOP_REPORT_AS_ISSUE: "true"
          GH_AW_AIC: ${{ needs.agent.outputs.aic }}
          GH_AW_THREAT_DETECTION_AIC: ${{ needs.detection.outputs.aic }}
          GH_AW_EVALS_AIC: ${{ needs.evals.outputs.aic }}
          GH_AW_AMBIENT_CONTEXT: ${{ needs.agent.outputs.ambient_context }}
          GH_AW_WORKFLOW_ID: "aw-failure-investigator"
        with:
          github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
          script: |
            const path = require('path');
            const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
            const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
            setupGlobals(core, github, context, exec, io, getOctokit);
            const { main } = require(path.join(actionsDir, 'handle_noop_message.cjs'));
            await main();
      - name: Log detection run
        id: detection_runs
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }}
          GH_AW_WORKFLOW_NAME: "[aw] Failure Investigator (6h)"
          GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/${{ github.repository }}/blob/${{ github.ref_name }}/.github/workflows/aw-failure-investigator.md"
          GH_AW_TRACKER_ID: "aw-failure-investigator"
          GH_AW_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
          GH_AW_DETECTION_CONCLUSION: ${{ needs.detection.outputs.detection_conclusion }}
          GH_AW_DETECTION_REASON: ${{ needs.detection.outputs.detection_reason }}
        with:
          github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
          script: |
            const path = require('path');
            const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
            const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
            setupGlobals(core, github, context, exec, io, getOctokit);
            const { main } = require(path.join(actionsDir, 'handle_detection_runs.cjs'));
            await main();
      - name: Record missing tool
        id: missing_tool
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }}
          GH_AW_MISSING_TOOL_CREATE_ISSUE: "true"
          GH_AW_WORKFLOW_NAME: "[aw] Failure Investigator (6h)"
          GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/${{ github.repository }}/blob/${{ github.ref_name }}/.github/workflows/aw-failure-investigator.md"
          GH_AW_TRACKER_ID: "aw-failure-investigator"
        with:
          github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
          script: |
            const path = require('path');
            const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
            const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
            setupGlobals(core, github, context, exec, io, getOctokit);
            const { main } = require(path.join(actionsDir, 'missing_tool.cjs'));
            await main();
      - name: Record incomplete
        id: report_incomplete
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }}
          GH_AW_REPORT_INCOMPLETE_CREATE_ISSUE: "true"
          GH_AW_WORKFLOW_NAME: "[aw] Failure Investigator (6h)"
          GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/${{ github.repository }}/blob/${{ github.ref_name }}/.github/workflows/aw-failure-investigator.md"
          GH_AW_TRACKER_ID: "aw-failure-investigator"
        with:
          github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
          script: |
            const path = require('path');
            const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
            const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
            setupGlobals(core, github, context, exec, io, getOctokit);
            const { main } = require(path.join(actionsDir, 'report_incomplete_handler.cjs'));
            await main();
      - name: Handle agent failure
        id: handle_agent_failure
        if: always()
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }}
          GH_AW_WORKFLOW_NAME: "[aw] Failure Investigator (6h)"
          GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/${{ github.repository }}/blob/${{ github.ref_name }}/.github/workflows/aw-failure-investigator.md"
          GH_AW_TRACKER_ID: "aw-failure-investigator"
          GH_AW_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
          GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }}
          GH_AW_WORKFLOW_ID: "aw-failure-investigator"
          GH_AW_ACTION_FAILURE_ISSUE_EXPIRES_HOURS: "12"
          GH_AW_ENGINE_ID: "claude"
          GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
          GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
          GH_AW_EFFECTIVE_TOKENS: ${{ needs.agent.outputs.effective_tokens || '' }}
          GH_AW_AI_CREDITS_RATE_LIMIT_ERROR: ${{ needs.agent.outputs.ai_credits_rate_limit_error || 'false' }}
          GH_AW_UNKNOWN_MODEL_AI_CREDITS: ${{ needs.agent.outputs.unknown_model_ai_credits || 'false' }}
          GH_AW_AIC: ${{ needs.agent.outputs.aic }}
          GH_AW_THREAT_DETECTION_AIC: ${{ needs.detection.outputs.aic }}
          GH_AW_EVALS_AIC: ${{ needs.evals.outputs.aic }}
          GH_AW_MAX_AI_CREDITS: ${{ vars.GH_AW_DEFAULT_MAX_AI_CREDITS || '1000' }}
          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
          GH_AW_MCP_POLICY_ERROR: ${{ needs.agent.outputs.mcp_policy_error }}
          GH_AW_AGENTIC_ENGINE_TIMEOUT: ${{ needs.agent.outputs.agentic_engine_timeout }}
          GH_AW_MODEL_NOT_SUPPORTED_ERROR: ${{ needs.agent.outputs.model_not_supported_error }}
          GH_AW_HTTP_400_RESPONSE_ERROR: ${{ needs.agent.outputs.http_400_response_error }}
          GH_AW_MAX_CACHE_MISSES_EXCEEDED: ${{ needs.agent.outputs.max_cache_misses_exceeded }}
          GH_AW_MISSING_MODEL_PRICING_ERROR: ${{ needs.agent.outputs.missing_model_pricing_error }}
          GH_AW_MISSING_MODEL_PRICING_MODEL_NAME: ${{ needs.agent.outputs.missing_model_pricing_model_name }}
          GH_AW_SHELL_EXPANSION_GUARD_REJECTED: ${{ needs.agent.outputs.shell_expansion_guard_rejected }}
          GH_AW_ENGINE_API_HOSTS: "api.anthropic.com"
          GH_AW_LOCKDOWN_CHECK_FAILED: ${{ needs.activation.outputs.lockdown_check_failed }}
          GH_AW_OAUTH_TOKEN_CHECK_FAILED: ${{ needs.activation.outputs.oauth_token_check_failed }}
          GH_AW_STALE_LOCK_FILE_FAILED: ${{ needs.activation.outputs.stale_lock_file_failed }}
          GH_AW_DAILY_AI_CREDITS_EXCEEDED: ${{ needs.activation.outputs.daily_ai_credits_exceeded }}
          GH_AW_DAILY_AI_CREDITS_TOTAL_EFFECTIVE_TOKENS: ${{ needs.activation.outputs.daily_ai_credits_total_effective_tokens }}
          GH_AW_DAILY_AI_CREDITS_THRESHOLD: ${{ needs.activation.outputs.daily_ai_credits_threshold }}
          GH_AW_GROUP_REPORTS: "false"
          GH_AW_FAILURE_REPORT_AS_ISSUE: "true"
          GH_AW_MISSING_TOOL_REPORT_AS_FAILURE: "true"
          GH_AW_MISSING_DATA_REPORT_AS_FAILURE: "true"
          GH_AW_TIMEOUT_MINUTES: "60"
        with:
          github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
          script: |
            const path = require('path');
            const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
            const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
            setupGlobals(core, github, context, exec, io, getOctokit);
            const { main } = require(path.join(actionsDir, 'handle_agent_failure.cjs'));
            await main();
      - name: Report failed jobs
        id: report_failed_jobs
        if: always()
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }}
          GH_AW_WORKFLOW_NAME: "[aw] Failure Investigator (6h)"
          GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/${{ github.repository }}/blob/${{ github.ref_name }}/.github/workflows/aw-failure-investigator.md"
          GH_AW_TRACKER_ID: "aw-failure-investigator"
          GH_AW_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
          GH_AW_REPORT_FAILED_JOBS: "true"
        with:
          github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
          script: |
            const path = require('path');
            const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
            const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
            setupGlobals(core, github, context, exec, io, getOctokit);
            const { main } = require(path.join(actionsDir, 'report_failed_jobs.cjs'));
            await main();

  detection:
    needs:
      - activation
      - agent
    if: always() && needs.agent.result != 'skipped'
    runs-on: ubuntu-latest
    permissions:
      contents: read
    timeout-minutes: 10
    env:
      GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }}
    outputs:
      aic: ${{ steps.parse_detection_token_usage.outputs.aic }}
      detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
      detection_reason: ${{ steps.detection_conclusion.outputs.reason }}
      detection_success: ${{ steps.detection_conclusion.outputs.success }}
    steps:
      - name: Checkout actions folder
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          repository: github/gh-aw
          sparse-checkout: |
            actions
          clean: false
          persist-credentials: false
      - name: Setup Scripts
        id: setup
        uses: ./actions/setup
        with:
          destination: ${{ runner.temp }}/gh-aw/actions
          job-name: ${{ github.job }}
          trace-id: ${{ needs.activation.outputs.setup-trace-id }}
          parent-span-id: ${{ needs.activation.outputs.setup-parent-span-id || needs.activation.outputs.setup-span-id }}
        env:
          GH_AW_SETUP_WORKFLOW_NAME: "[aw] Failure Investigator (6h)"
          GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/aw-failure-investigator.lock.yml@${{ github.ref }}
          GH_AW_INFO_VERSION: "2.1.245"
          GH_AW_INFO_AWF_VERSION: "v0.28.7"
          GH_AW_INFO_ENGINE_ID: "claude"
      - name: Download activation artifact
        continue-on-error: true
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: activation
          path: /tmp/gh-aw
      - name: Download agent output artifact
        id: download-agent-output
        continue-on-error: true
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: "{agent,agent-output-fallback}"
          merge-multiple: true
          path: /tmp/gh-aw/
      - name: Setup agent output environment variable
        id: setup-agent-output-env
        if: steps.download-agent-output.outcome == 'success'
        run: |
          mkdir -p /tmp/gh-aw/
          find "/tmp/gh-aw/" -type f -print
          if [ -f "/tmp/gh-aw/agent_output.json" ]; then
            echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT"
          fi
      - name: Download experiment artifact
        continue-on-error: true
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: awfailureinvestigator-experiment
          path: /tmp/gh-aw/experiments/
      - name: Checkout repository for patch context
        if: needs.agent.outputs.has_patch == 'true'
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      # --- Threat Detection ---
      - name: Clean stale firewall files from agent artifact
        run: |
          rm -rf /tmp/gh-aw/sandbox/firewall/logs
          rm -rf /tmp/gh-aw/sandbox/firewall/audit
      - name: Download container images
        run: bash "${RUNNER_TEMP}/gh-aw/actions/download_docker_images.sh" ghcr.io/github/gh-aw-firewall/agent:0.28.7@sha256:40a1e30b1b8d70642d4292485146cd5af612730d7a6a2e12706ddd13df375059 ghcr.io/github/gh-aw-firewall/api-proxy:0.28.7@sha256:4f209dd4cbc74d47a6c7379956143de293429d1b1b2fb2647776cdcbf65836a1 ghcr.io/github/gh-aw-firewall/squid:0.28.7@sha256:fb362a08d4d2f0da6c036e3f5d3b2fd87931e857fec3ca4a241cd2f2b61131f9
      - name: Check if detection needed
        id: detection_guard
        if: always()
        env:
          OUTPUT_TYPES: ${{ needs.agent.outputs.output_types }}
          HAS_PATCH: ${{ needs.agent.outputs.has_patch }}
        run: |
          if [[ -n "$OUTPUT_TYPES" || "$HAS_PATCH" == "true" ]]; then
            echo "run_detection=true" >> "$GITHUB_OUTPUT"
            echo "Detection will run: output_types=$OUTPUT_TYPES, has_patch=$HAS_PATCH"
          else
            echo "run_detection=false" >> "$GITHUB_OUTPUT"
            echo "Detection skipped: no agent outputs or patches to analyze"
          fi
      - name: Clear MCP Config for detection
        if: always() && steps.detection_guard.outputs.run_detection == 'true'
        run: |
          rm -f "${RUNNER_TEMP}/gh-aw/mcp-config/mcp-servers.json"
          rm -f "$HOME/.copilot/mcp-config.json"
          rm -f "$GITHUB_WORKSPACE/.gemini/settings.json"
      - name: Prepare threat detection files
        if: always() && steps.detection_guard.outputs.run_detection == 'true'
        run: |
          bash "${RUNNER_TEMP}/gh-aw/actions/prepare_threat_detection_files.sh"
      - name: Setup threat detection
        if: always() && steps.detection_guard.outputs.run_detection == 'true'
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          WORKFLOW_NAME: "[aw] Failure Investigator (6h)"
          WORKFLOW_DESCRIPTION: "Investigates [aw] failures from the last 6 hours, correlates with open agentic-workflows issues, closes fixed issues, and opens focused fix sub-issues when needed"
          HAS_PATCH: ${{ needs.agent.outputs.has_patch }}
          GH_AW_DETECTION_CONTINUE_ON_ERROR: "true"
          GH_AW_DETECTION_SKIP_PROMPT_SUMMARY: "true"
        with:
          script: |
            const path = require('path');
            const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
            const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
            setupGlobals(core, github, context, exec, io, getOctokit);
            const { main } = require(path.join(actionsDir, 'setup_threat_detection.cjs'));
            await main();
      - name: Ensure threat-detection directory and log
        if: always() && steps.detection_guard.outputs.run_detection == 'true'
        run: |
          mkdir -p /tmp/gh-aw/threat-detection
          touch /tmp/gh-aw/threat-detection/detection.log
      - name: Install AWF binary
        run: bash "${RUNNER_TEMP}/gh-aw/actions/install_awf_binary.sh" v0.28.7 --rootless
      - name: Setup Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: '24'
          package-manager-cache: false
      - name: Install Claude Code CLI
        run: npm install -g @anthropic-ai/claude-code@2.1.245
      - name: Install threat-detect binary
        if: always() && steps.detection_guard.outputs.run_detection == 'true'
        continue-on-error: true
        run: |
          bash "${RUNNER_TEMP}/gh-aw/actions/install_threat_detect_binary.sh" v0.4.12
      - name: Execute threat detection with AWF
        id: detection_agentic_execution
        if: always() && steps.detection_guard.outputs.run_detection == 'true'
        continue-on-error: true
        timeout-minutes: 10
        env:
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
          ANTHROPIC_MODEL: detection
          BASH_DEFAULT_TIMEOUT_MS: 60000
          BASH_MAX_TIMEOUT_MS: 60000
          CLAUDE_CODE_DISABLE_FAST_MODE: 1
          DISABLE_BUG_COMMAND: 1
          DISABLE_ERROR_REPORTING: 1
          DISABLE_TELEMETRY: 1
          GH_AW_HARNESS_MAX_RETRIES: 0
          GH_AW_LLM_PROVIDER: anthropic
          GH_AW_MAX_TURNS: ${{ vars.GH_AW_DEFAULT_MAX_TURNS || '' }}
          GH_AW_PHASE: detection
          GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
          GH_AW_VERSION: dev
          GITHUB_AW: true
          GITHUB_STEP_SUMMARY: /tmp/gh-aw/agent-step-summary.md
          GITHUB_WORKSPACE: ${{ github.workspace }}
          GIT_AUTHOR_EMAIL: github-actions[bot]@users.noreply.github.com
          GIT_AUTHOR_NAME: github-actions[bot]
          GIT_COMMITTER_EMAIL: github-actions[bot]@users.noreply.github.com
          GIT_COMMITTER_NAME: github-actions[bot]
          MCP_TIMEOUT: 120000
          MCP_TOOL_TIMEOUT: 60000
          RUNNER_TEMP: ${{ runner.temp }}
          TRACEPARENT: ${{ env.GITHUB_AW_OTEL_TRACE_ID != '' && env.GITHUB_AW_OTEL_PARENT_SPAN_ID != '' && format('00-{0}-{1}-01', env.GITHUB_AW_OTEL_TRACE_ID, env.GITHUB_AW_OTEL_PARENT_SPAN_ID) || '' }}
          WORKFLOW_NAME: "[aw] Failure Investigator (6h)"
          WORKFLOW_DESCRIPTION: "Investigates [aw] failures from the last 6 hours, correlates with open agentic-workflows issues, closes fixed issues, and opens focused fix sub-issues when needed"
          HAS_PATCH: ${{ needs.agent.outputs.has_patch }}
          GH_AW_DETECTION_CONTINUE_ON_ERROR: "true"
        run: |
          set -o pipefail
          printf '%s' "$(date +%s%3N)" > /tmp/gh-aw/agent_cli_start_ms.txt
          (umask 177 && touch /tmp/gh-aw/threat-detection/detection.log)
          GH_AW_MAX_AI_CREDITS="${{ vars.GH_AW_DEFAULT_DETECTION_MAX_AI_CREDITS || '400' }}"
          printf '%s\n' "{\"\$schema\":\"https://github.com/github/gh-aw-firewall/releases/download/v0.28.7/awf-config.schema.json\",\"network\":{\"allowDomains\":[\"*.githubusercontent.com\",\"anthropic.com\",\"api.anthropic.com\",\"api.github.com\",\"api.snapcraft.io\",\"archive.ubuntu.com\",\"azure.archive.ubuntu.com\",\"cdn.playwright.dev\",\"codeload.github.com\",\"crl.geotrust.com\",\"crl.globalsign.com\",\"crl.identrust.com\",\"crl.sectigo.com\",\"crl.thawte.com\",\"crl.usertrust.com\",\"crl.verisign.com\",\"crl3.digicert.com\",\"crl4.digicert.com\",\"crls.ssl.com\",\"ghcr.io\",\"github-cloud.githubusercontent.com\",\"github-cloud.s3.amazonaws.com\",\"github.com\",\"host.docker.internal\",\"json-schema.org\",\"json.schemastore.org\",\"keyserver.ubuntu.com\",\"lfs.github.com\",\"objects.githubusercontent.com\",\"ocsp.digicert.com\",\"ocsp.geotrust.com\",\"ocsp.globalsign.com\",\"ocsp.identrust.com\",\"ocsp.sectigo.com\",\"ocsp.ssl.com\",\"ocsp.thawte.com\",\"ocsp.usertrust.com\",\"ocsp.verisign.com\",\"packagecloud.io\",\"packages.cloud.google.com\",\"packages.microsoft.com\",\"playwright.download.prss.microsoft.com\",\"ppa.launchpad.net\",\"raw.githubusercontent.com\",\"s.symcb.com\",\"s.symcd.com\",\"security.ubuntu.com\",\"sentry.io\",\"statsig.anthropic.com\",\"ts-crl.ws.symantec.com\",\"ts-ocsp.ws.symantec.com\"]},\"apiProxy\":{\"enabled\":true,\"enableTokenSteering\":true,\"maxRuns\":500,\"maxAiCredits\":${GH_AW_MAX_AI_CREDITS},\"maxCacheMisses\":5,\"defaultAiCreditsPricing\":{\"input\":5,\"output\":25},\"models\":{\"agent\":[\"sonnet-6x\",\"gpt-5.4\",\"gpt-5.5\",\"gpt-5.6\",\"gpt-5.3\",\"gemini-pro\",\"any\"],\"antigravity\":[\"copilot/antigravity*\",\"google/antigravity*\",\"gemini/antigravity*\"],\"any\":[\"copilot/*\",\"anthropic/*\",\"openai/*\",\"google/*\",\"gemini/*\"],\"auto\":[\"copilot/auto\",\"large\"],\"claude\":[\"agent\"],\"codex\":[\"agent\"],\"coding\":[\"copilot/gpt-5*codex*\",\"openai/gpt-5*codex*\",\"gpt-5-codex\",\"kimi\"],\"computer-use\":[\"copilot/*computer-use*\",\"google/*computer-use*\",\"gemini/*computer-use*\",\"openai/*computer-use*\"],\"copilot\":[\"agent\"],\"deep-research\":[\"copilot/deep-research*\",\"copilot/o3-deep-research*\",\"copilot/o4-mini-deep-research*\",\"google/deep-research*\",\"gemini/deep-research*\",\"openai/o3-deep-research*\",\"openai/o4-mini-deep-research*\"],\"detection\":[\"small\"],\"evals\":[\"small\"],\"fable\":[\"copilot/*fable*\",\"anthropic/*fable*\"],\"gemini\":[\"agent\"],\"gemini-3-flash\":[\"copilot/gemini-3*flash*\",\"google/gemini-3*flash*\",\"gemini/gemini-3*flash*\"],\"gemini-3-pro\":[\"copilot/gemini-3*pro*\",\"google/gemini-3*pro*\",\"google/nano-banana*\",\"gemini/gemini-3*pro*\"],\"gemini-3.1-flash\":[\"copilot/gemini-3.1*flash*\",\"google/gemini-3.1*flash*\",\"gemini/gemini-3.1*flash*\"],\"gemini-3.1-pro\":[\"copilot/gemini-3.1*pro*\",\"google/gemini-3.1*pro*\",\"gemini/gemini-3.1*pro*\"],\"gemini-3.5-flash\":[\"copilot/gemini-3.5*flash*\",\"google/gemini-3.5*flash*\",\"gemini/gemini-3.5*flash*\"],\"gemini-3.6-flash\":[\"copilot/gemini-3.6*flash*\",\"google/gemini-3.6*flash*\",\"gemini/gemini-3.6*flash*\"],\"gemini-3.7-flash\":[\"copilot/gemini-3.7*flash*\",\"google/gemini-3.7*flash*\",\"gemini/gemini-3.7*flash*\"],\"gemini-flash\":[\"copilot/gemini-*flash*\",\"google/gemini-*flash*\",\"gemini/gemini-*flash*\"],\"gemini-flash-lite\":[\"copilot/gemini-*flash*lite*\",\"google/gemini-*flash*lite*\",\"gemini/gemini-*flash*lite*\"],\"gemini-omni\":[\"copilot/gemini-omni*\",\"google/gemini-omni*\",\"gemini/gemini-omni*\"],\"gemini-pro\":[\"copilot/gemini-*pro*\",\"google/gemini-*pro*\",\"gemini/gemini-*pro*\"],\"gemma\":[\"copilot/gemma*\",\"google/gemma*\",\"gemini/gemma*\"],\"gpt-5\":[\"copilot/gpt-5*\",\"openai/gpt-5*\"],\"gpt-5-codex\":[\"copilot/gpt-5*codex*\",\"openai/gpt-5*codex*\"],\"gpt-5-mini\":[\"copilot/gpt-5*mini*\",\"openai/gpt-5*mini*\"],\"gpt-5-nano\":[\"copilot/gpt-5*nano*\",\"openai/gpt-5*nano*\"],\"gpt-5-pro\":[\"copilot/gpt-5*pro*\",\"openai/gpt-5*pro*\"],\"gpt-5.1\":[\"copilot/gpt-5.1*\",\"openai/gpt-5.1*\"],\"gpt-5.2\":[\"copilot/gpt-5.2*\",\"openai/gpt-5.2*\"],\"gpt-5.3\":[\"copilot/gpt-5.3*\",\"openai/gpt-5.3*\"],\"gpt-5.4\":[\"copilot/gpt-5.4*\",\"openai/gpt-5.4*\"],\"gpt-5.5\":[\"copilot/gpt-5.5*\",\"openai/gpt-5.5*\"],\"gpt-5.6\":[\"copilot/gpt-5.6*\",\"openai/gpt-5.6*\"],\"grok\":[\"copilot/*grok*\",\"openai/*grok*\"],\"haiku\":[\"copilot/*haiku*\",\"anthropic/*haiku*\"],\"image-generation\":[\"copilot/gpt-image*\",\"openai/gpt-image*\",\"openai/chatgpt-image*\",\"copilot/gemini-*image*\",\"google/gemini-*image*\",\"gemini/gemini-*image*\",\"google/imagen*\"],\"kimi\":[\"copilot/kimi*\",\"openai/kimi*\"],\"kiwi\":[\"copilot/kiwi*\",\"openai/kiwi*\"],\"large\":[\"sonnet\",\"gpt-5-pro\",\"gpt-5\",\"gemini-pro\"],\"lyria\":[\"google/lyria*\",\"gemini/lyria*\",\"copilot/lyria*\"],\"mai-code\":[\"copilot/MAI-Code*\",\"copilot/mai-code*\",\"openai/MAI-Code*\"],\"mai-code-1-flash-picker\":[\"copilot/MAI-Code-1-Flash-picker*\",\"copilot/mai-code-1-flash-picker*\",\"openai/MAI-Code-1-Flash-picker*\"],\"mini\":[\"haiku\",\"gpt-5-mini\",\"gpt-5-nano\",\"gemini-flash-lite\"],\"nano-banana\":[\"copilot/nano-banana*\",\"google/nano-banana*\",\"gemini/nano-banana*\"],\"opus\":[\"copilot/*opus*\",\"anthropic/*opus*\"],\"opusplan\":[\"opus?effort=high\"],\"raptor-mini\":[\"copilot/raptor*\",\"openai/raptor*\"],\"reasoning\":[\"copilot/o1*\",\"copilot/o3*\",\"copilot/o4*\",\"openai/o1*\",\"openai/o3*\",\"openai/o4*\"],\"robotics\":[\"copilot/*robotics*\",\"google/*robotics*\",\"gemini/*robotics*\"],\"small\":[\"mini\"],\"small-agent\":[\"haiku\",\"gpt-5-mini\",\"gemini-flash\"],\"sonnet\":[\"copilot/*sonnet*\",\"anthropic/*sonnet*\"],\"sonnet-6x\":[\"copilot/*sonnet-4.5*\",\"copilot/*sonnet-4.6*\",\"copilot/*sonnet-5*\",\"copilot/*sonnet-4-5-*\",\"anthropic/*sonnet-4-5-*\",\"copilot/*sonnet-4-6*\",\"anthropic/*sonnet-4-6*\",\"anthropic/*sonnet-5*\"],\"summarization\":[\"haiku\",\"gpt-5-mini\",\"gemini-flash-lite\",\"mini\"],\"veo\":[\"google/veo*\",\"gemini/veo*\"],\"vision\":[\"copilot/gemini-*image*\",\"google/gemini-*image*\",\"gemini/gemini-*image*\",\"copilot/gemini-*flash*\",\"google/gemini-*flash*\",\"gemini/gemini-*flash*\"]}},\"container\":{\"imageTag\":\"0.28.7,squid=sha256:fb362a08d4d2f0da6c036e3f5d3b2fd87931e857fec3ca4a241cd2f2b61131f9,agent=sha256:40a1e30b1b8d70642d4292485146cd5af612730d7a6a2e12706ddd13df375059,api-proxy=sha256:4f209dd4cbc74d47a6c7379956143de293429d1b1b2fb2647776cdcbf65836a1,cli-proxy=sha256:ebc8758c9b085ca244234e3e3ee22300d150095f9bfe7312ca8a61c5acb34a78\"},\"logging\":{\"proxyLogsDir\":\"/tmp/gh-aw/sandbox/firewall/logs\",\"auditDir\":\"/tmp/gh-aw/sandbox/firewall/audit\"}}" > "${RUNNER_TEMP}/gh-aw/awf-config.json"
          cp "${RUNNER_TEMP}/gh-aw/awf-config.json" /tmp/gh-aw/awf-config.json
          export GH_AW_MODELS_JSON_PATH="/tmp/gh-aw/models.json"
          GH_AW_DOCKER_HOST=""
          if [[ "${DOCKER_HOST:-}" =~ ^tcp:// ]]; then
            GH_AW_DOCKER_HOST="${DOCKER_HOST}"
          fi
          if [[ "${DOCKER_HOST:-}" =~ ^tcp:// ]]; then
            _GH_AW_CHROOT_JSON=$(jq -c --arg src "${RUNNER_TEMP}/gh-aw" --arg user "$(id -un)" --argjson uid "$(id -u)" --argjson gid "$(id -g)" --arg home "${RUNNER_TEMP}/gh-aw/home" '.chroot={"binariesSourcePath":$src,"identity":{"user":$user,"uid":$uid,"gid":$gid,"home":$home}}' "${RUNNER_TEMP}/gh-aw/awf-config.json") || { echo "chroot config patch failed" >&2; exit 1; }
            printf '%s\n' "$_GH_AW_CHROOT_JSON" > "${RUNNER_TEMP}/gh-aw/awf-config.json"
          fi
          GH_AW_TOOL_CACHE_MOUNT=""
          GH_AW_TOOL_CACHE="${RUNNER_TOOL_CACHE:?RUNNER_TOOL_CACHE must be set}"
          if [ -d "$GH_AW_TOOL_CACHE" ]; then
            if [[ "$GH_AW_TOOL_CACHE" != /opt/* ]]; then
              GH_AW_TOOL_CACHE_MOUNT="$GH_AW_TOOL_CACHE:$GH_AW_TOOL_CACHE:ro"
            fi
          fi
          # shellcheck disable=SC1003,SC2016,SC2086
          awf --config "${RUNNER_TEMP}/gh-aw/awf-config.json" --container-workdir "${GITHUB_WORKSPACE}" --mount "${RUNNER_TEMP}/gh-aw:${RUNNER_TEMP}/gh-aw:ro" --mount "${RUNNER_TEMP}/gh-aw:/host${RUNNER_TEMP}/gh-aw:ro" ${GH_AW_TOOL_CACHE_MOUNT:+--mount "$GH_AW_TOOL_CACHE_MOUNT"} ${GH_AW_DOCKER_HOST:+--docker-host "$GH_AW_DOCKER_HOST"} --env-all --exclude-env ACTIONS_ID_TOKEN_REQUEST_TOKEN --exclude-env ACTIONS_ID_TOKEN_REQUEST_URL --exclude-env ANTHROPIC_API_KEY --mount /tmp/gh-aw:/tmp/gh-aw:rw --mount /tmp/gh-aw/threat-detection:/tmp/gh-aw/threat-detection:rw --log-level info --skip-pull \
            -- /bin/bash -c 'set +o histexpand; : "${RUNNER_TOOL_CACHE:?RUNNER_TOOL_CACHE must be set}"; GH_AW_TOOL_CACHE="$RUNNER_TOOL_CACHE"; export PATH="$(find "$GH_AW_TOOL_CACHE" -maxdepth 5 -type d -name bin 2>/dev/null | tr '\''\n'\'' '\'':'\'')$PATH"; [ -n "$GOROOT" ] && export PATH="$GOROOT/bin:$PATH" || true; [ -n "$ERLANG_HOME" ] && export PATH="$ERLANG_HOME/bin:$PATH" || true && threat-detect --engine claude --output /tmp/gh-aw/threat-detection/detection_result.json /tmp/gh-aw/threat-detection' 2>&1 | tee -a /tmp/gh-aw/threat-detection/detection.log
      - name: Render detection log
        if: always() && steps.detection_guard.outputs.run_detection == 'true'
        continue-on-error: true
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          script: |
            const path = require('path');
            const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
            const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
            setupGlobals(core, github, context, exec, io, getOctokit);
            const { main } = require(path.join(actionsDir, 'render_detection_log.cjs'));
            await main();
      - name: Copy detection firewall logs
        if: always() && steps.detection_guard.outputs.run_detection == 'true'
        continue-on-error: true
        run: |
          mkdir -p /tmp/gh-aw/threat-detection/sandbox/firewall
          if [ -d /tmp/gh-aw/sandbox/firewall/logs ]; then mkdir -p /tmp/gh-aw/threat-detection/sandbox/firewall/logs && cp -r /tmp/gh-aw/sandbox/firewall/logs/. /tmp/gh-aw/threat-detection/sandbox/firewall/logs/; fi
          if [ -d /tmp/gh-aw/sandbox/firewall/audit ]; then mkdir -p /tmp/gh-aw/threat-detection/sandbox/firewall/audit && cp -r /tmp/gh-aw/sandbox/firewall/audit/. /tmp/gh-aw/threat-detection/sandbox/firewall/audit/; fi
      - name: Upload threat detection artifact
        if: always() && steps.detection_guard.outputs.run_detection == 'true'
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: detection
          path: |
            /tmp/gh-aw/threat-detection/detection_result.json
            /tmp/gh-aw/threat-detection/sandbox/firewall/logs/
            /tmp/gh-aw/threat-detection/sandbox/firewall/audit/
          if-no-files-found: ignore
      - name: Parse threat detection token usage for step summary
        id: parse_detection_token_usage
        if: always()
        continue-on-error: true
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          GH_AW_TOKEN_USAGE_SUMMARY_TITLE: Threat Detection Token Usage
        with:
          script: |
            const path = require('path');
            const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
            const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
            setupGlobals(core, github, context, exec, io, getOctokit);
            const { main } = require(path.join(actionsDir, 'parse_token_usage.cjs'));
            await main();
      - name: Conclude threat detection
        id: detection_conclusion
        if: always()
        continue-on-error: true
        env:
          RUN_DETECTION: ${{ steps.detection_guard.outputs.run_detection }}
          DETECTION_AGENTIC_EXECUTION_OUTCOME: ${{ steps.detection_agentic_execution.outcome }}
          GH_AW_DETECTION_CONTINUE_ON_ERROR: "true"
        run: |
          bash "${RUNNER_TEMP}/gh-aw/actions/conclude_threat_detection.sh" /tmp/gh-aw/threat-detection/detection_result.json

  evals:
    needs:
      - activation
      - agent
      - detection
    if: always() && needs.agent.result == 'success'
    runs-on: ubuntu-latest
    permissions:
      contents: read
    env:
      GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }}
    outputs:
      aic: ${{ steps.parse-mcp-gateway.outputs.aic }}
    steps:
      - name: Checkout actions folder
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          repository: github/gh-aw
          sparse-checkout: |
            actions
          clean: false
          persist-credentials: false
      - name: Setup Scripts
        id: setup
        uses: ./actions/setup
        with:
          destination: ${{ runner.temp }}/gh-aw/actions
          job-name: ${{ github.job }}
          trace-id: ${{ needs.activation.outputs.setup-trace-id }}
          parent-span-id: ${{ needs.activation.outputs.setup-parent-span-id || needs.activation.outputs.setup-span-id }}
        env:
          GH_AW_SETUP_WORKFLOW_NAME: "[aw] Failure Investigator (6h)"
          GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/aw-failure-investigator.lock.yml@${{ github.ref }}
          GH_AW_INFO_VERSION: "2.1.245"
          GH_AW_INFO_AWF_VERSION: "v0.28.7"
          GH_AW_INFO_ENGINE_ID: "claude"
      - name: Download agent output artifact
        id: download-agent-output
        continue-on-error: true
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: "{agent,agent-output-fallback}"
          merge-multiple: true
          path: /tmp/gh-aw/
      - name: Setup agent output environment variable
        id: setup-agent-output-env
        if: steps.download-agent-output.outcome == 'success'
        run: |
          mkdir -p /tmp/gh-aw/
          find "/tmp/gh-aw/" -type f -print
          if [ -f "/tmp/gh-aw/agent_output.json" ]; then
            echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT"
          fi
      - name: Download experiment artifact
        continue-on-error: true
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: awfailureinvestigator-experiment
          path: /tmp/gh-aw/experiments/
      # --- BinEval Evaluations ---
      - name: Clean stale firewall files from agent artifact
        run: |
          rm -rf /tmp/gh-aw/sandbox/firewall/logs
          rm -rf /tmp/gh-aw/sandbox/firewall/audit
      - name: Download container images
        run: bash "${RUNNER_TEMP}/gh-aw/actions/download_docker_images.sh" ghcr.io/github/gh-aw-firewall/agent:0.28.7@sha256:40a1e30b1b8d70642d4292485146cd5af612730d7a6a2e12706ddd13df375059 ghcr.io/github/gh-aw-firewall/api-proxy:0.28.7@sha256:4f209dd4cbc74d47a6c7379956143de293429d1b1b2fb2647776cdcbf65836a1 ghcr.io/github/gh-aw-firewall/squid:0.28.7@sha256:fb362a08d4d2f0da6c036e3f5d3b2fd87931e857fec3ca4a241cd2f2b61131f9
      - name: Prepare evals files
        run: |
          mkdir -p /tmp/gh-aw/evals
          cp /tmp/gh-aw/agent_output.json /tmp/gh-aw/evals/agent_output.json 2>/dev/null || true
          cp /tmp/gh-aw/aw-prompts/prompt.txt /tmp/gh-aw/evals/prompt.txt 2>/dev/null || true
          ls -la /tmp/gh-aw/evals/ 2>/dev/null || true
      - name: Setup BinEval evaluations
        if: always()
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          GH_AW_EVALS_QUESTIONS: '[{"id":"failures_investigated","question":"Did the agent investigate agentic workflow failures from the last 6 hours and produce findings?"},{"id":"issues_created_or_closed","question":"Were fix sub-issues created for unresolved failures, or were resolved tracking issues closed?"}]'
          GH_AW_EVALS_MODEL: "evals"
          GH_AW_EVALS_PHASE: setup
        with:
          script: |
            const path = require('path');
            const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
            const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
            setupGlobals(core, github, context, exec, io, getOctokit);
            const { main } = require(path.join(actionsDir, 'run_evals.cjs'));
            await main();
      - name: Ensure evals directory and log
        run: |
          mkdir -p /tmp/gh-aw/evals
          touch /tmp/gh-aw/evals/evals.log
      - name: Setup Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: '24'
          package-manager-cache: false
      - name: Install AWF binary
        run: bash "${RUNNER_TEMP}/gh-aw/actions/install_awf_binary.sh" v0.28.7 --rootless
      - name: Install Claude Code CLI
        run: npm install -g @anthropic-ai/claude-code@2.1.245
      - name: Execute Claude Code CLI
        if: always()
        continue-on-error: true
        id: evals_agentic_execution
        # Allowed tools (sorted):
        # - Bash
        # - BashOutput
        # - Edit(/tmp/*)
        # - ExitPlanMode
        # - Glob
        # - Grep
        # - KillBash
        # - LS
        # - MultiEdit(/tmp/*)
        # - NotebookRead
        # - Read
        # - Read(/tmp/*)
        # - Task
        # - TodoWrite
        # - Write(/tmp/*)
        timeout-minutes: 60
        run: |
          set -o pipefail
          trap 'gh_aw_exit_code=$?; mkdir -p /tmp/gh-aw >/dev/null 2>&1 || true; printf "%s" "$gh_aw_exit_code" > /tmp/gh-aw/agent_execution_exit_code.txt || true; if [ "$gh_aw_exit_code" -ne 0 ]; then echo "::error::Agent execution exited with code $gh_aw_exit_code"; fi' EXIT
          printf '%s' "$(date +%s%3N)" > /tmp/gh-aw/agent_cli_start_ms.txt
          mkdir -p /tmp/gh-aw/agent/ && (umask 177 && touch /tmp/gh-aw/agent/claude-debug.log) && touch /tmp/gh-aw/agent-step-summary.md
          (umask 177 && touch /tmp/gh-aw/evals/evals.log)
          GH_AW_MAX_AI_CREDITS="${{ vars.GH_AW_DEFAULT_EVALS_MAX_AI_CREDITS || '400' }}"
          printf '%s\n' "{\"\$schema\":\"https://github.com/github/gh-aw-firewall/releases/download/v0.28.7/awf-config.schema.json\",\"network\":{\"allowDomains\":[\"*.githubusercontent.com\",\"anthropic.com\",\"api.anthropic.com\",\"api.github.com\",\"api.snapcraft.io\",\"archive.ubuntu.com\",\"azure.archive.ubuntu.com\",\"cdn.playwright.dev\",\"codeload.github.com\",\"crl.geotrust.com\",\"crl.globalsign.com\",\"crl.identrust.com\",\"crl.sectigo.com\",\"crl.thawte.com\",\"crl.usertrust.com\",\"crl.verisign.com\",\"crl3.digicert.com\",\"crl4.digicert.com\",\"crls.ssl.com\",\"ghcr.io\",\"github-cloud.githubusercontent.com\",\"github-cloud.s3.amazonaws.com\",\"github.com\",\"host.docker.internal\",\"json-schema.org\",\"json.schemastore.org\",\"keyserver.ubuntu.com\",\"lfs.github.com\",\"objects.githubusercontent.com\",\"ocsp.digicert.com\",\"ocsp.geotrust.com\",\"ocsp.globalsign.com\",\"ocsp.identrust.com\",\"ocsp.sectigo.com\",\"ocsp.ssl.com\",\"ocsp.thawte.com\",\"ocsp.usertrust.com\",\"ocsp.verisign.com\",\"packagecloud.io\",\"packages.cloud.google.com\",\"packages.microsoft.com\",\"playwright.download.prss.microsoft.com\",\"ppa.launchpad.net\",\"raw.githubusercontent.com\",\"s.symcb.com\",\"s.symcd.com\",\"security.ubuntu.com\",\"sentry.io\",\"statsig.anthropic.com\",\"ts-crl.ws.symantec.com\",\"ts-ocsp.ws.symantec.com\"]},\"apiProxy\":{\"enabled\":true,\"enableTokenSteering\":true,\"maxRuns\":500,\"maxAiCredits\":${GH_AW_MAX_AI_CREDITS},\"maxCacheMisses\":5,\"models\":{\"agent\":[\"sonnet-6x\",\"gpt-5.4\",\"gpt-5.5\",\"gpt-5.6\",\"gpt-5.3\",\"gemini-pro\",\"any\"],\"antigravity\":[\"copilot/antigravity*\",\"google/antigravity*\",\"gemini/antigravity*\"],\"any\":[\"copilot/*\",\"anthropic/*\",\"openai/*\",\"google/*\",\"gemini/*\"],\"auto\":[\"copilot/auto\",\"large\"],\"claude\":[\"agent\"],\"codex\":[\"agent\"],\"coding\":[\"copilot/gpt-5*codex*\",\"openai/gpt-5*codex*\",\"gpt-5-codex\",\"kimi\"],\"computer-use\":[\"copilot/*computer-use*\",\"google/*computer-use*\",\"gemini/*computer-use*\",\"openai/*computer-use*\"],\"copilot\":[\"agent\"],\"deep-research\":[\"copilot/deep-research*\",\"copilot/o3-deep-research*\",\"copilot/o4-mini-deep-research*\",\"google/deep-research*\",\"gemini/deep-research*\",\"openai/o3-deep-research*\",\"openai/o4-mini-deep-research*\"],\"detection\":[\"small\"],\"evals\":[\"small\"],\"fable\":[\"copilot/*fable*\",\"anthropic/*fable*\"],\"gemini\":[\"agent\"],\"gemini-3-flash\":[\"copilot/gemini-3*flash*\",\"google/gemini-3*flash*\",\"gemini/gemini-3*flash*\"],\"gemini-3-pro\":[\"copilot/gemini-3*pro*\",\"google/gemini-3*pro*\",\"google/nano-banana*\",\"gemini/gemini-3*pro*\"],\"gemini-3.1-flash\":[\"copilot/gemini-3.1*flash*\",\"google/gemini-3.1*flash*\",\"gemini/gemini-3.1*flash*\"],\"gemini-3.1-pro\":[\"copilot/gemini-3.1*pro*\",\"google/gemini-3.1*pro*\",\"gemini/gemini-3.1*pro*\"],\"gemini-3.5-flash\":[\"copilot/gemini-3.5*flash*\",\"google/gemini-3.5*flash*\",\"gemini/gemini-3.5*flash*\"],\"gemini-3.6-flash\":[\"copilot/gemini-3.6*flash*\",\"google/gemini-3.6*flash*\",\"gemini/gemini-3.6*flash*\"],\"gemini-3.7-flash\":[\"copilot/gemini-3.7*flash*\",\"google/gemini-3.7*flash*\",\"gemini/gemini-3.7*flash*\"],\"gemini-flash\":[\"copilot/gemini-*flash*\",\"google/gemini-*flash*\",\"gemini/gemini-*flash*\"],\"gemini-flash-lite\":[\"copilot/gemini-*flash*lite*\",\"google/gemini-*flash*lite*\",\"gemini/gemini-*flash*lite*\"],\"gemini-omni\":[\"copilot/gemini-omni*\",\"google/gemini-omni*\",\"gemini/gemini-omni*\"],\"gemini-pro\":[\"copilot/gemini-*pro*\",\"google/gemini-*pro*\",\"gemini/gemini-*pro*\"],\"gemma\":[\"copilot/gemma*\",\"google/gemma*\",\"gemini/gemma*\"],\"gpt-5\":[\"copilot/gpt-5*\",\"openai/gpt-5*\"],\"gpt-5-codex\":[\"copilot/gpt-5*codex*\",\"openai/gpt-5*codex*\"],\"gpt-5-mini\":[\"copilot/gpt-5*mini*\",\"openai/gpt-5*mini*\"],\"gpt-5-nano\":[\"copilot/gpt-5*nano*\",\"openai/gpt-5*nano*\"],\"gpt-5-pro\":[\"copilot/gpt-5*pro*\",\"openai/gpt-5*pro*\"],\"gpt-5.1\":[\"copilot/gpt-5.1*\",\"openai/gpt-5.1*\"],\"gpt-5.2\":[\"copilot/gpt-5.2*\",\"openai/gpt-5.2*\"],\"gpt-5.3\":[\"copilot/gpt-5.3*\",\"openai/gpt-5.3*\"],\"gpt-5.4\":[\"copilot/gpt-5.4*\",\"openai/gpt-5.4*\"],\"gpt-5.5\":[\"copilot/gpt-5.5*\",\"openai/gpt-5.5*\"],\"gpt-5.6\":[\"copilot/gpt-5.6*\",\"openai/gpt-5.6*\"],\"grok\":[\"copilot/*grok*\",\"openai/*grok*\"],\"haiku\":[\"copilot/*haiku*\",\"anthropic/*haiku*\"],\"image-generation\":[\"copilot/gpt-image*\",\"openai/gpt-image*\",\"openai/chatgpt-image*\",\"copilot/gemini-*image*\",\"google/gemini-*image*\",\"gemini/gemini-*image*\",\"google/imagen*\"],\"kimi\":[\"copilot/kimi*\",\"openai/kimi*\"],\"kiwi\":[\"copilot/kiwi*\",\"openai/kiwi*\"],\"large\":[\"sonnet\",\"gpt-5-pro\",\"gpt-5\",\"gemini-pro\"],\"lyria\":[\"google/lyria*\",\"gemini/lyria*\",\"copilot/lyria*\"],\"mai-code\":[\"copilot/MAI-Code*\",\"copilot/mai-code*\",\"openai/MAI-Code*\"],\"mai-code-1-flash-picker\":[\"copilot/MAI-Code-1-Flash-picker*\",\"copilot/mai-code-1-flash-picker*\",\"openai/MAI-Code-1-Flash-picker*\"],\"mini\":[\"haiku\",\"gpt-5-mini\",\"gpt-5-nano\",\"gemini-flash-lite\"],\"nano-banana\":[\"copilot/nano-banana*\",\"google/nano-banana*\",\"gemini/nano-banana*\"],\"opus\":[\"copilot/*opus*\",\"anthropic/*opus*\"],\"opusplan\":[\"opus?effort=high\"],\"raptor-mini\":[\"copilot/raptor*\",\"openai/raptor*\"],\"reasoning\":[\"copilot/o1*\",\"copilot/o3*\",\"copilot/o4*\",\"openai/o1*\",\"openai/o3*\",\"openai/o4*\"],\"robotics\":[\"copilot/*robotics*\",\"google/*robotics*\",\"gemini/*robotics*\"],\"small\":[\"mini\"],\"small-agent\":[\"haiku\",\"gpt-5-mini\",\"gemini-flash\"],\"sonnet\":[\"copilot/*sonnet*\",\"anthropic/*sonnet*\"],\"sonnet-6x\":[\"copilot/*sonnet-4.5*\",\"copilot/*sonnet-4.6*\",\"copilot/*sonnet-5*\",\"copilot/*sonnet-4-5-*\",\"anthropic/*sonnet-4-5-*\",\"copilot/*sonnet-4-6*\",\"anthropic/*sonnet-4-6*\",\"anthropic/*sonnet-5*\"],\"summarization\":[\"haiku\",\"gpt-5-mini\",\"gemini-flash-lite\",\"mini\"],\"veo\":[\"google/veo*\",\"gemini/veo*\"],\"vision\":[\"copilot/gemini-*image*\",\"google/gemini-*image*\",\"gemini/gemini-*image*\",\"copilot/gemini-*flash*\",\"google/gemini-*flash*\",\"gemini/gemini-*flash*\"]}},\"container\":{\"imageTag\":\"0.28.7,squid=sha256:fb362a08d4d2f0da6c036e3f5d3b2fd87931e857fec3ca4a241cd2f2b61131f9,agent=sha256:40a1e30b1b8d70642d4292485146cd5af612730d7a6a2e12706ddd13df375059,api-proxy=sha256:4f209dd4cbc74d47a6c7379956143de293429d1b1b2fb2647776cdcbf65836a1,cli-proxy=sha256:ebc8758c9b085ca244234e3e3ee22300d150095f9bfe7312ca8a61c5acb34a78\"},\"logging\":{\"proxyLogsDir\":\"/tmp/gh-aw/sandbox/firewall/logs\",\"auditDir\":\"/tmp/gh-aw/sandbox/firewall/audit\"}}" > "${RUNNER_TEMP}/gh-aw/awf-config.json"
          cp "${RUNNER_TEMP}/gh-aw/awf-config.json" /tmp/gh-aw/awf-config.json
          export GH_AW_MODELS_JSON_PATH="/tmp/gh-aw/models.json"
          GH_AW_DOCKER_HOST=""
          if [[ "${DOCKER_HOST:-}" =~ ^tcp:// ]]; then
            GH_AW_DOCKER_HOST="${DOCKER_HOST}"
          fi
          if [[ "${DOCKER_HOST:-}" =~ ^tcp:// ]]; then
            GH_AW_CHROOT_BINARIES_SOURCE_PATH="${RUNNER_TEMP}/gh-aw" GH_AW_CHROOT_IDENTITY_HOME="${RUNNER_TEMP}/gh-aw/home" node "${RUNNER_TEMP}/gh-aw/actions/patch_awf_chroot_config.cjs"
          fi
          GH_AW_TOOL_CACHE_MOUNT=""
          GH_AW_TOOL_CACHE="${RUNNER_TOOL_CACHE:?RUNNER_TOOL_CACHE must be set}"
          if [ -d "$GH_AW_TOOL_CACHE" ]; then
            if [[ "$GH_AW_TOOL_CACHE" != /opt/* ]]; then
              GH_AW_TOOL_CACHE_MOUNT="$GH_AW_TOOL_CACHE:$GH_AW_TOOL_CACHE:ro"
            fi
          fi
          # shellcheck disable=SC1003,SC2016,SC2086
          awf --config "${RUNNER_TEMP}/gh-aw/awf-config.json" --container-workdir "${GITHUB_WORKSPACE}" --mount "${RUNNER_TEMP}/gh-aw:${RUNNER_TEMP}/gh-aw:ro" --mount "${RUNNER_TEMP}/gh-aw:/host${RUNNER_TEMP}/gh-aw:ro" ${GH_AW_TOOL_CACHE_MOUNT:+--mount "$GH_AW_TOOL_CACHE_MOUNT"} ${GH_AW_DOCKER_HOST:+--docker-host "$GH_AW_DOCKER_HOST"} --tty --env-all --exclude-env ACTIONS_ID_TOKEN_REQUEST_TOKEN --exclude-env ACTIONS_ID_TOKEN_REQUEST_URL --exclude-env ANTHROPIC_API_KEY --mount /tmp/gh-aw:/tmp/gh-aw:rw --log-level info --skip-pull \
            -- /bin/bash -c 'set +o histexpand; : "${RUNNER_TOOL_CACHE:?RUNNER_TOOL_CACHE must be set}"; GH_AW_TOOL_CACHE="$RUNNER_TOOL_CACHE"; export PATH="$(find "$GH_AW_TOOL_CACHE" -maxdepth 5 -type d -name bin 2>/dev/null | tr '\''\n'\'' '\'':'\'')$PATH"; [ -n "$GOROOT" ] && export PATH="$GOROOT/bin:$PATH" || true; [ -n "$ERLANG_HOME" ] && export PATH="$ERLANG_HOME/bin:$PATH" || true && GH_AW_NODE_EXEC="${GH_AW_NODE_BIN:-}"; if [ -z "$GH_AW_NODE_EXEC" ] || [ ! -x "$GH_AW_NODE_EXEC" ]; then GH_AW_NODE_EXEC="$(command -v node 2>/dev/null || true)"; fi; if [ -z "$GH_AW_NODE_EXEC" ]; then echo "node runtime missing on this runner — check runtimes.node in workflow YAML" >&2; exit 127; fi; GH_AW_NPM_GLOBAL_ROOT="$(npm root -g 2>/dev/null || true)"; if [ -n "$GH_AW_NPM_GLOBAL_ROOT" ]; then export NODE_PATH="${GH_AW_NPM_GLOBAL_ROOT}${NODE_PATH:+:${NODE_PATH}}"; fi; "$GH_AW_NODE_EXEC" ${RUNNER_TEMP}/gh-aw/actions/claude_harness.cjs claude --print --no-chrome --allowed-tools '\''Bash,BashOutput,Edit(/tmp/*),ExitPlanMode,Glob,Grep,KillBash,LS,MultiEdit(/tmp/*),NotebookRead,Read,Read(/tmp/*),Task,TodoWrite,Write(/tmp/*)'\'' --debug-file /tmp/gh-aw/agent/claude-debug.log --verbose --permission-mode acceptEdits --output-format stream-json --prompt-file /tmp/gh-aw/aw-prompts/prompt.txt' 2>&1 | tee -a /tmp/gh-aw/evals/evals.log
        env:
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
          ANTHROPIC_MAX_RETRIES: 0
          ANTHROPIC_MODEL: evals
          BASH_DEFAULT_TIMEOUT_MS: 60000
          BASH_MAX_TIMEOUT_MS: 60000
          CLAUDE_CODE_DISABLE_FAST_MODE: 1
          DISABLE_BUG_COMMAND: 1
          DISABLE_ERROR_REPORTING: 1
          DISABLE_TELEMETRY: 1
          GH_AW_LLM_PROVIDER: anthropic
          GH_AW_MAX_TURNS: ${{ vars.GH_AW_DEFAULT_MAX_TURNS || '' }}
          GH_AW_PHASE: evals
          GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
          GH_AW_VERSION: dev
          GITHUB_AW: true
          GITHUB_STEP_SUMMARY: /tmp/gh-aw/agent-step-summary.md
          GITHUB_WORKSPACE: ${{ github.workspace }}
          GIT_AUTHOR_EMAIL: github-actions[bot]@users.noreply.github.com
          GIT_AUTHOR_NAME: github-actions[bot]
          GIT_COMMITTER_EMAIL: github-actions[bot]@users.noreply.github.com
          GIT_COMMITTER_NAME: github-actions[bot]
          MCP_TIMEOUT: 120000
          MCP_TOOL_TIMEOUT: 60000
          RUNNER_TEMP: ${{ runner.temp }}
          TRACEPARENT: ${{ env.GITHUB_AW_OTEL_TRACE_ID != '' && env.GITHUB_AW_OTEL_PARENT_SPAN_ID != '' && format('00-{0}-{1}-01', env.GITHUB_AW_OTEL_TRACE_ID, env.GITHUB_AW_OTEL_PARENT_SPAN_ID) || '' }}
      - name: Parse MCP Gateway logs for step summary
        if: always()
        id: parse-mcp-gateway
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          script: |
            const path = require('path');
            const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
            const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
            setupGlobals(core, github, context, exec, io, getOctokit);
            const { main } = require(path.join(actionsDir, 'parse_mcp_gateway_log.cjs'));
            await main();
      - name: Parse BinEval results
        if: always()
        continue-on-error: true
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          GH_AW_EVALS_QUESTIONS: '[{"id":"failures_investigated","question":"Did the agent investigate agentic workflow failures from the last 6 hours and produce findings?"},{"id":"issues_created_or_closed","question":"Were fix sub-issues created for unresolved failures, or were resolved tracking issues closed?"}]'
          GH_AW_EVALS_MODEL: "evals"
          GH_AW_EVALS_PHASE: parse
          GITHUB_RUN_ID: ${{ github.run_id }}
        with:
          script: |
            const path = require('path');
            const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
            const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
            setupGlobals(core, github, context, exec, io, getOctokit);
            const { main } = require(path.join(actionsDir, 'run_evals.cjs'));
            await main();
      - name: Redact secrets in evals results
        id: redact_evals_results
        if: always()
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          script: |
            const path = require('path');
            const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
            const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
            setupGlobals(core, github, context, exec, io, getOctokit);
            const { main } = require(path.join(actionsDir, 'redact_evals_results.cjs'));
            await main();
      - name: Render evals results to step summary
        if: steps.redact_evals_results.outcome == 'success'
        continue-on-error: true
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          script: |
            const path = require('path');
            const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
            const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
            setupGlobals(core, github, context, exec, io, getOctokit);
            const { main } = require(path.join(actionsDir, 'render_evals_summary.cjs'));
            await main();
      - name: Upload evals results
        if: steps.redact_evals_results.outcome == 'success'
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: evals
          path: /tmp/gh-aw/evals.jsonl
          if-no-files-found: ignore
      - name: Restore actions folder
        if: always()
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          repository: github/gh-aw
          sparse-checkout: |
            actions/setup
          sparse-checkout-cone-mode: true
          clean: false
          persist-credentials: false

  push_evals_state:
    needs:
      - activation
      - evals
    if: always() && (!cancelled()) && needs.evals.result != 'skipped'
    runs-on: ubuntu-slim
    permissions:
      contents: write
    env:
      GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }}
    steps:
      - name: Checkout actions folder
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          repository: github/gh-aw
          sparse-checkout: |
            actions
          clean: false
          persist-credentials: false
      - name: Setup Scripts
        id: setup
        uses: ./actions/setup
        with:
          destination: ${{ runner.temp }}/gh-aw/actions
          job-name: ${{ github.job }}
          trace-id: ${{ needs.activation.outputs.setup-trace-id }}
          parent-span-id: ${{ needs.activation.outputs.setup-parent-span-id || needs.activation.outputs.setup-span-id }}
        env:
          GH_AW_SETUP_WORKFLOW_NAME: "[aw] Failure Investigator (6h)"
          GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/aw-failure-investigator.lock.yml@${{ github.ref }}
          GH_AW_INFO_VERSION: "2.1.245"
          GH_AW_INFO_AWF_VERSION: "v0.28.7"
          GH_AW_INFO_ENGINE_ID: "claude"
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          sparse-checkout: .
      - name: Configure Git credentials
        env:
          GITHUB_REPOSITORY: ${{ github.repository }}
          GITHUB_SERVER_URL: ${{ github.server_url }}
          GITHUB_TOKEN: ${{ github.token }}
        run: bash "${RUNNER_TEMP}/gh-aw/actions/configure_git_credentials.sh"
      - name: Download evals artifact
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        continue-on-error: true
        with:
          pattern: evals
          merge-multiple: true
          path: /tmp/gh-aw/evals-state
      - name: Push evals results to git
        id: push_evals_state
        if: always()
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          GH_TOKEN: ${{ github.token }}
          GITHUB_RUN_ID: ${{ github.run_id }}
          GITHUB_SERVER_URL: ${{ github.server_url }}
          GH_AW_STATE_DIR: /tmp/gh-aw/evals-state
          GH_AW_STATE_BRANCH: evals/awfailureinvestigator
          GH_AW_STATE_FILES: evals.jsonl
          GH_AW_STATE_LABEL: evals results
        with:
          script: |
            const path = require('path');
            const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
            const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
            setupGlobals(core, github, context, exec, io, getOctokit);
            const { main } = require(path.join(actionsDir, 'push_experiment_state.cjs'));
            await main();
      - name: Restore actions folder
        if: always()
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          repository: github/gh-aw
          sparse-checkout: |
            actions/setup
          sparse-checkout-cone-mode: true
          clean: false
          persist-credentials: false

  push_experiments_state:
    needs: activation
    if: always() && (!cancelled()) && needs.activation.result == 'success'
    runs-on: ubuntu-slim
    permissions:
      contents: write
    env:
      GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }}
    steps:
      - name: Checkout actions folder
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          repository: github/gh-aw
          sparse-checkout: |
            actions
          clean: false
          persist-credentials: false
      - name: Setup Scripts
        id: setup
        uses: ./actions/setup
        with:
          destination: ${{ runner.temp }}/gh-aw/actions
          job-name: ${{ github.job }}
          trace-id: ${{ needs.activation.outputs.setup-trace-id }}
          parent-span-id: ${{ needs.activation.outputs.setup-parent-span-id || needs.activation.outputs.setup-span-id }}
        env:
          GH_AW_SETUP_WORKFLOW_NAME: "[aw] Failure Investigator (6h)"
          GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/aw-failure-investigator.lock.yml@${{ github.ref }}
          GH_AW_INFO_VERSION: "2.1.245"
          GH_AW_INFO_AWF_VERSION: "v0.28.7"
          GH_AW_INFO_ENGINE_ID: "claude"
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          sparse-checkout: .
      - name: Configure Git credentials
        env:
          GITHUB_REPOSITORY: ${{ github.repository }}
          GITHUB_SERVER_URL: ${{ github.server_url }}
          GITHUB_TOKEN: ${{ github.token }}
        run: bash "${RUNNER_TEMP}/gh-aw/actions/configure_git_credentials.sh"
      - name: Download experiment artifact
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        continue-on-error: true
        with:
          pattern: awfailureinvestigator-experiment
          merge-multiple: true
          path: /tmp/gh-aw/experiments
      - name: Push experiment state to git
        id: push_experiments_state
        if: always()
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          GH_TOKEN: ${{ github.token }}
          GITHUB_RUN_ID: ${{ github.run_id }}
          GITHUB_SERVER_URL: ${{ github.server_url }}
          GH_AW_EXPERIMENT_STATE_DIR: /tmp/gh-aw/experiments
          GH_AW_EXPERIMENT_BRANCH: experiments/awfailureinvestigator
        with:
          script: |
            const path = require('path');
            const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
            const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
            setupGlobals(core, github, context, exec, io, getOctokit);
            const { main } = require(path.join(actionsDir, 'push_experiment_state.cjs'));
            await main();
      - name: Restore actions folder
        if: always()
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          repository: github/gh-aw
          sparse-checkout: |
            actions/setup
          sparse-checkout-cone-mode: true
          clean: false
          persist-credentials: false

  safe_outputs:
    needs:
      - activation
      - agent
      - detection
    if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
    runs-on: ubuntu-slim
    permissions:
      issues: write
    timeout-minutes: 45
    env:
      GH_AW_AGENT_AIC: ${{ needs.agent.outputs.aic }}
      GH_AW_AIC: ${{ needs.agent.outputs.aic }}
      GH_AW_AMBIENT_CONTEXT: ${{ needs.agent.outputs.ambient_context }}
      GH_AW_CALLER_WORKFLOW_ID: "${{ github.repository }}/aw-failure-investigator"
      GH_AW_DETECTION_CONCLUSION: ${{ needs.detection.outputs.detection_conclusion }}
      GH_AW_DETECTION_REASON: ${{ needs.detection.outputs.detection_reason }}
      GH_AW_EFFECTIVE_TOKENS: ${{ needs.agent.outputs.effective_tokens }}
      GH_AW_ENGINE_ID: "claude"
      GH_AW_ENGINE_MODEL: ${{ needs.agent.outputs.model }}
      GH_AW_PROJECT_UTC: "-08:00"
      GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }}
      GH_AW_THREAT_DETECTION_AIC: ${{ needs.detection.outputs.aic }}
      GH_AW_TRACKER_ID: "aw-failure-investigator"
      GH_AW_WORKFLOW_EMOJI: "🔍"
      GH_AW_WORKFLOW_ID: "aw-failure-investigator"
      GH_AW_WORKFLOW_NAME: "[aw] Failure Investigator (6h)"
      GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/${{ github.repository }}/blob/${{ github.ref_name }}/.github/workflows/aw-failure-investigator.md"
    outputs:
      code_push_failure_count: ${{ steps.process_safe_outputs.outputs.code_push_failure_count }}
      code_push_failure_errors: ${{ steps.process_safe_outputs.outputs.code_push_failure_errors }}
      create_discussion_error_count: ${{ steps.process_safe_outputs.outputs.create_discussion_error_count }}
      create_discussion_errors: ${{ steps.process_safe_outputs.outputs.create_discussion_errors }}
      created_issue_number: ${{ steps.process_safe_outputs.outputs.created_issue_number }}
      created_issue_url: ${{ steps.process_safe_outputs.outputs.created_issue_url }}
      process_safe_outputs_items_applied: ${{ steps.process_safe_outputs.outputs.items_applied }}
      process_safe_outputs_items_cancelled: ${{ steps.process_safe_outputs.outputs.items_cancelled }}
      process_safe_outputs_items_deferred: ${{ steps.process_safe_outputs.outputs.items_deferred }}
      process_safe_outputs_items_failed: ${{ steps.process_safe_outputs.outputs.items_failed }}
      process_safe_outputs_items_skipped: ${{ steps.process_safe_outputs.outputs.items_skipped }}
      process_safe_outputs_items_succeeded: ${{ steps.process_safe_outputs.outputs.items_succeeded }}
      process_safe_outputs_items_warnings: ${{ steps.process_safe_outputs.outputs.items_warnings }}
      process_safe_outputs_processed_count: ${{ steps.process_safe_outputs.outputs.processed_count }}
      process_safe_outputs_status: ${{ steps.process_safe_outputs.outputs.status }}
      process_safe_outputs_temporary_id_map: ${{ steps.process_safe_outputs.outputs.temporary_id_map }}
    steps:
      - name: Checkout actions folder
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          repository: github/gh-aw
          sparse-checkout: |
            actions
          clean: false
          persist-credentials: false
      - name: Setup Scripts
        id: setup
        uses: ./actions/setup
        with:
          destination: ${{ runner.temp }}/gh-aw/actions
          job-name: ${{ github.job }}
          trace-id: ${{ needs.activation.outputs.setup-trace-id }}
          parent-span-id: ${{ needs.activation.outputs.setup-parent-span-id || needs.activation.outputs.setup-span-id }}
        env:
          GH_AW_SETUP_WORKFLOW_NAME: "[aw] Failure Investigator (6h)"
          GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/aw-failure-investigator.lock.yml@${{ github.ref }}
          GH_AW_INFO_VERSION: "2.1.245"
          GH_AW_INFO_AWF_VERSION: "v0.28.7"
          GH_AW_INFO_ENGINE_ID: "claude"
      - name: Mask OTLP telemetry headers
        run: bash "${RUNNER_TEMP}/gh-aw/actions/mask_otlp_headers.sh"
      - name: Download agent output artifact
        id: download-agent-output
        continue-on-error: true
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: "{agent,agent-output-fallback}"
          merge-multiple: true
          path: /tmp/gh-aw/
      - name: Setup agent output environment variable
        id: setup-agent-output-env
        if: steps.download-agent-output.outcome == 'success'
        run: |
          mkdir -p /tmp/gh-aw/
          find "/tmp/gh-aw/" -type f -print
          if [ -f "/tmp/gh-aw/agent_output.json" ]; then
            echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT"
          fi
      - name: Configure GH_HOST for enterprise compatibility
        id: ghes-host-config
        shell: bash
        run: | # zizmor: ignore[github-env] - GITHUB_SERVER_URL is set by GitHub Actions, not user input.
          # Derive GH_HOST from GITHUB_SERVER_URL so the gh CLI targets the correct
          # GitHub instance (GHES/GHEC). On github.com this is a harmless no-op.
          GH_HOST="${GITHUB_SERVER_URL#https://}"
          GH_HOST="${GH_HOST#http://}"
          echo "GH_HOST=${GH_HOST}" >> "$GITHUB_ENV"
      - name: Process Safe Outputs
        id: process_safe_outputs
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }}
          GH_AW_COMMENT_ID: ${{ needs.activation.outputs.comment_id }}
          GH_AW_ALLOWED_DOMAINS: "*.githubusercontent.com,*.grafana.net,*.sentry.io,anthropic.com,api.anthropic.com,api.github.com,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,cdn.playwright.dev,codeload.github.com,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,ghcr.io,github-cloud.githubusercontent.com,github-cloud.s3.amazonaws.com,github.com,host.docker.internal,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,lfs.github.com,objects.githubusercontent.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,playwright.download.prss.microsoft.com,ppa.launchpad.net,raw.githubusercontent.com,s.symcb.com,s.symcd.com,security.ubuntu.com,sentry.io,statsig.anthropic.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com,www.googleapis.com"
          GITHUB_SERVER_URL: ${{ github.server_url }}
          GITHUB_API_URL: ${{ github.api_url }}
          GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"create_issue\":{\"expires\":168,\"group\":true,\"labels\":[\"agentic-workflows\",\"automation\",\"cookie\"],\"max\":2,\"title_prefix\":\"[aw-failures] \"},\"create_report_incomplete_issue\":{},\"link_sub_issue\":{\"max\":10},\"missing_data\":{},\"missing_tool\":{},\"noop\":{\"max\":1,\"report-as-issue\":\"true\"},\"report_incomplete\":{},\"update_issue\":{\"allow_body\":true,\"max\":10,\"target\":\"*\"}}"
        with:
          github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
          script: |
            const path = require('path');
            const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
            const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
            setupGlobals(core, github, context, exec, io, getOctokit);
            const { main } = require(path.join(actionsDir, 'process_safe_outputs.cjs'));
            await main();
      - name: Upload Safe Outputs Items
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: safe-outputs-items
          path: |
            /tmp/gh-aw/safe-output-items.jsonl
            /tmp/gh-aw/temporary-id-map.json
            /tmp/gh-aw/safe-output-errors.json
          if-no-files-found: ignore