Fix Copilot CLI path in AWF sandboxes by Copilot · Pull Request #50908 · github/gh-aw

Copilot · 2026-08-06T15:55:00Z

Summary

resolve the activated Copilot CLI from PATH after installation
stage it at ${RUNNER_TEMP}/gh-aw/bin/copilot, inside the directory mounted into AWF
use that mounted path for Docker, gVisor, docker-sbx, ARC/DinD, evals, and threat detection
preserve direct execution and custom engine.command behavior
add focused regression coverage and regenerate affected workflow lock files

Stage the activated Copilot CLI under the RUNNER_TEMP directory mounted into every AWF execution environment, including Docker, gVisor, docker-sbx, and ARC/DinD. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: e35bd500-badf-49f1-a01d-7cbf6d96d2a2

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: e35bd500-badf-49f1-a01d-7cbf6d96d2a2

Copilot

Pull request overview

Fixes AWF Copilot CLI resolution by staging the activated executable under the sandbox-mounted runner directory.

Changes:

Resolves Copilot from PATH and uses the mounted staged path.
Adds sandbox, evals, threat-detection, and custom-command regression tests.
Regenerates affected workflow lock files.

Show a summary per file

File	Description
`pkg/workflow/copilot_engine_execution.go`	Implements Copilot path resolution and staging.
`pkg/workflow/copilot_engine_test.go`	Tests AWF runtimes and custom commands.
`pkg/workflow/evals_steps_test.go`	Tests evals staging behavior.
`pkg/workflow/threat_detection_test.go`	Tests detection staging behavior.
`.github/workflows/workflow-normalizer.lock.yml`	Regenerates staged CLI invocation.
`.github/workflows/video-analyzer.lock.yml`	Regenerates staged CLI invocation.
`.github/workflows/update-astro.lock.yml`	Regenerates staged CLI invocation.
`.github/workflows/unbloat-docs.lock.yml`	Regenerates staged CLI invocation.
`.github/workflows/super-linter.lock.yml`	Regenerates staged CLI invocation.
`.github/workflows/spec-enforcer.lock.yml`	Regenerates staged CLI invocation.
`.github/workflows/smoke-test-tools.lock.yml`	Regenerates staged CLI invocation.
`.github/workflows/smoke-pi.lock.yml`	Regenerates staged CLI invocation.
`.github/workflows/smoke-create-cross-repo-pr.lock.yml`	Regenerates staged CLI invocation.
`.github/workflows/smoke-copilot-small.lock.yml`	Regenerates staged CLI invocation.
`.github/workflows/smoke-copilot-sdk.lock.yml`	Regenerates SDK CLI invocation.
`.github/workflows/skillet.lock.yml`	Regenerates staged CLI invocation.
`.github/workflows/sighthound-security-scan.lock.yml`	Regenerates staged CLI invocation.
`.github/workflows/schema-consistency-checker.lock.yml`	Regenerates staged CLI invocation.
`.github/workflows/repo-tree-map.lock.yml`	Regenerates staged CLI invocation.
`.github/workflows/pr-nitpick-reviewer.lock.yml`	Regenerates SDK and detection invocations.
`.github/workflows/pr-description-caveman.lock.yml`	Regenerates staged CLI invocation.
`.github/workflows/poem-bot.lock.yml`	Regenerates detection invocation.
`.github/workflows/pdf-summary.lock.yml`	Regenerates SDK and detection invocations.
`.github/workflows/notion-issue-summary.lock.yml`	Regenerates staged CLI invocation.
`.github/workflows/mattpocock-skills-reviewer.lock.yml`	Regenerates staged CLI invocation.
`.github/workflows/lint-monster.lock.yml`	Regenerates detection invocation.
`.github/workflows/impeccable-skills-reviewer.lock.yml`	Regenerates staged CLI invocation.
`.github/workflows/github-remote-mcp-auth-test.lock.yml`	Regenerates staged CLI invocation.
`.github/workflows/firewall.lock.yml`	Regenerates SDK CLI invocation.
`.github/workflows/example-permissions-warning.lock.yml`	Regenerates staged CLI invocation.
`.github/workflows/example-failure-category-filter.lock.yml`	Regenerates agent and detection invocations.
`.github/workflows/eslint-monster.lock.yml`	Regenerates detection invocation.
`.github/workflows/daily-testify-uber-super-expert.lock.yml`	Regenerates SDK CLI invocation.
`.github/workflows/daily-team-status.lock.yml`	Regenerates agent and detection invocations.
`.github/workflows/daily-model-resolution.lock.yml`	Regenerates SDK CLI invocation.
`.github/workflows/daily-max-ai-credits-test.lock.yml`	Regenerates staged CLI invocation.
`.github/workflows/daily-formal-spec-verifier.lock.yml`	Regenerates SDK CLI invocation.
`.github/workflows/daily-credit-limit-test.lock.yml`	Regenerates staged CLI invocation.
`.github/workflows/daily-cli-tools-tester.lock.yml`	Regenerates agent and evals invocations.
`.github/workflows/daily-byok-ollama-test.lock.yml`	Regenerates staged CLI invocation.
`.github/workflows/bot-detection.lock.yml`	Regenerates agent and evals invocations.
`.github/workflows/architecture-guardian.lock.yml`	Regenerates SDK agent and evals invocations.
`.github/workflows/agentic-token-trend-audit.lock.yml`	Regenerates agent and evals invocations.
`.github/workflows/ace-editor.lock.yml`	Regenerates agent and evals invocations.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 109/178 changed files
Comments generated: 1
Review effort level: Balanced

@@ -122,6 +122,18 @@ const nodePathSetupCommand = `GH_AW_NPM_GLOBAL_ROOT="$(npm root -g 2>/dev/null |
 const nodeRuntimeResolutionCommand = `GH_AW_NODE_EXEC="${GH_AW_NODE_BIN:-}"; if [ -z "$GH_AW_NODE_EXEC" ] || [ ! -x "$GH_AW_NODE_EXEC" ]; then GH_AW_NODE_EXEC="$(command -v node 2>/dev/null || true)"; fi; if [ -z "$GH_AW_NODE_EXEC" ]; then echo "node runtime missing on this runner — check runtimes.node in workflow YAML" >&2; exit 127; fi; ` + nodePathSetupCommand + `; "$GH_AW_NODE_EXEC"`
 const nodePathSetupCommandForCopilotSDK = `GH_AW_WORKSPACE_NODE_MODULES="${GITHUB_WORKSPACE:-$PWD}/node_modules"; if [ -d "$GH_AW_WORKSPACE_NODE_MODULES" ]; then export NODE_PATH="${GH_AW_WORKSPACE_NODE_MODULES}${NODE_PATH:+:${NODE_PATH}}"; fi; ` + nodePathSetupCommand
 const nodeRuntimeResolutionCommandForCopilotSDK = `GH_AW_NODE_EXEC="${GH_AW_NODE_BIN:-}"; if [ -z "$GH_AW_NODE_EXEC" ] || [ ! -x "$GH_AW_NODE_EXEC" ]; then GH_AW_NODE_EXEC="$(command -v node 2>/dev/null || true)"; fi; if [ -z "$GH_AW_NODE_EXEC" ]; then echo "node runtime missing on this runner — check runtimes.node in workflow YAML" >&2; exit 127; fi; ` + nodePathSetupCommandForCopilotSDK + `; "$GH_AW_NODE_EXEC"`
+const copilotBinaryPathSetup = `GH_AW_COPILOT_SRC="$(command -v copilot 2>/dev/null || true)"


lpcox · 2026-08-06T17:17:23Z

@copilot address review feedback

lpcox · 2026-08-06T17:41:08Z

@copilot run pr-finisher skill

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

github-actions · 2026-08-06T19:19:02Z

⚠️ Security scanning failed for Test Quality Sentinel. Review the logs for details.

No test files were added or modified in this PR. Test Quality Sentinel skipped.

github-actions

Review: Fix Copilot CLI path in AWF sandboxes

The core implementation looks correct — resolving the activated copilot binary from PATH via command -v, staging it at ${RUNNER_TEMP}/gh-aw/bin/copilot, and referencing that mounted path for Docker/gVisor/docker-sbx/evals is the right approach. The guard for empty/non-executable binary (exit 127) and the ARC/DinD exclusion at line 489 are both correctly handled.

One existing issue (already flagged in review comments) needs to be resolved before merge: the WASM golden file pkg/workflow/testdata/TestWasmGolden_AllEngines/copilot.golden still references the hardcoded /usr/local/bin/copilot path at line 546 instead of the new staged ${RUNNER_TEMP}/gh-aw/bin/copilot. The WASM golden snapshots need to be regenerated to reflect the updated compiler output.

🧵 Reviewed using Impeccable skills by Impeccable Skills Reviewer · sonnet46 · 68.7 AIC · ⊞ 5.3K

github-actions · 2026-08-07T04:17:07Z

🎉 This pull request is included in a new release.

Release: v0.86.0

…sandboxes (#2884) * fix(ci): upgrade gh-aw to v0.86.2 to restore Copilot CLI path in AWF sandboxes Root cause of #2854: the gh-aw v0.85.4 compiler hardcoded the Copilot CLI invocation path as `/usr/local/bin/copilot` inside the AWF sandbox harness, but the Copilot CLI is actually installed into the GitHub Actions hosted toolcache and staged elsewhere. This caused every `agent` job (code-review, security-analyst, issue-triage, release-impact-advisor, retro-facilitator, self-healing-ci) to fail with `spawn /usr/local/bin/copilot ENOENT`, which in turn blocks the merge-eligibility gate's "automated review required for current head" condition (#2838) on every PR. Upstream gh-aw fixed this in PR github/gh-aw#50908 ("Fix Copilot CLI path in AWF sandboxes"), included starting v0.86.0. This change upgrades the gh-aw CLI extension from v0.85.4 to v0.86.2 (latest stable) and recompiles all affected `.lock.yml` workflows via `gh aw compile`, replacing the hardcoded path with the dynamic `${RUNNER_TEMP}/gh-aw/bin/copilot` resolution. Recompile also picked up companion version bumps as part of the same gh-aw release: `gh-aw-actions/setup` v0.86.2, `gh-aw-mcpg` v0.4.9, and `github-mcp-server` v1.9.0. Fixes #2854 Relates to #2838 * fix(ci): sync base-coat lock templates and update version-pin tests for gh-aw v0.86.2 - Copy the recompiled .github/workflows/*.lock.yml files to their .github/base-coat/workflows/ template counterparts so the workflow-copilot-auth-contract.ps1 and issue-triage-lock-refresh-tests.ps1 identity checks pass (these enforce runtime == distributed template). - Update tests/issue-triage-lock-refresh-tests.ps1 stale-version assertions from gh-aw v0.85.4 to v0.86.2 (compiler_version, setup action SHA, GH_AW_INFO_CLI_VERSION, gh-aw-mcpg digest) to match the version bump in #2884. Verified locally: issue-triage-lock-refresh-tests.ps1, workflow-code-review-agent-contract.ps1, and workflow-copilot-auth-contract.ps1 all pass. * test(lock-refresh): assert staged copilot path in issue-triage workflow Co-authored-by: ibuyspy <231939073+ibuyspy@users.noreply.github.com> --------- Co-authored-by: Copilot <copilot@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: ibuyspy <231939073+ibuyspy@users.noreply.github.com>

Initial plan

9ab6005

Copilot AI assigned Copilot and lpcox Aug 6, 2026

Copilot started work on behalf of lpcox August 6, 2026 15:59 View session

Copilot AI linked an issue Aug 6, 2026 that may be closed by this pull request

AWF fails when Copilot CLI is activated from toolcache #50906

Closed

Copilot stopped work on behalf of lpcox due to an error August 6, 2026 16:08
The operation was cancelled.

Copilot AI requested a review from lpcox August 6, 2026 16:08

lpcox added 2 commits August 6, 2026 09:47

Merge origin/main into Copilot CLI path fix

e16e73b

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: e35bd500-badf-49f1-a01d-7cbf6d96d2a2

lpcox changed the title ~~[WIP] Fix AWF execution failure when Copilot CLI is activated~~ Fix Copilot CLI path in AWF sandboxes Aug 6, 2026

lpcox marked this pull request as ready for review August 6, 2026 16:53

Copilot AI balanced review requested due to automatic review settings August 6, 2026 16:53

Copilot started reviewing on behalf of lpcox August 6, 2026 17:04 View session

Copilot AI reviewed Aug 6, 2026

View reviewed changes

Copilot stopped work on behalf of lpcox due to an error August 6, 2026 17:38
The job was not acquired by a runner even after multiple attempts.

lpcox added the smoke label Aug 6, 2026

Copilot started work on behalf of lpcox August 6, 2026 18:10 View session

Update Copilot WASM golden files

e6a9c28

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot finished work on behalf of lpcox August 6, 2026 18:26

lpcox merged commit 2ee0f78 into main Aug 6, 2026

lpcox deleted the copilot/fix-awf-copilot-cli-activation branch August 6, 2026 18:26

github-actions Bot reviewed Aug 6, 2026

View reviewed changes

This was referenced Aug 7, 2026

PR Documentation Check fails to create docs PRs for release branches microsoft/aspire#19054

Open

Work around gh-aw cached Copilot path microsoft/aspire#19109

Merged

bradygaster mentioned this pull request Aug 7, 2026

feat(gh-aw): ship Squad modes with verified consumer bootstrap (#1613-#1618) bradygaster/squad#1622

Merged

xirzec mentioned this pull request Aug 11, 2026

Fix Copilot CLI path in agentic workflows Azure/azure-rest-api-specs#45411

Merged

jamesadevine mentioned this pull request Aug 14, 2026

fix(workflows): stage Copilot CLI in AWF runs githubnext/ado-aw#1908

Merged

IEvangelist mentioned this pull request Aug 17, 2026

Update agentic workflows to gh-aw v0.86.2 microsoft/aspire#19436

Closed

14 tasks

Navigation Menu

Uh oh!

Fix Copilot CLI path in AWF sandboxes - #50908

Fix Copilot CLI path in AWF sandboxes#50908
lpcox merged 4 commits into
mainfrom
copilot/fix-awf-copilot-cli-activation

Copilot AI commented Aug 6, 2026 •

edited by lpcox

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

lpcox commented Aug 6, 2026

Uh oh!

lpcox commented Aug 6, 2026

Uh oh!

github-actions Bot commented Aug 6, 2026 •

edited

Loading

Uh oh!

github-actions Bot left a comment

Uh oh!

github-actions Bot commented Aug 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

Copilot AI commented Aug 6, 2026 • edited by lpcox Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

lpcox commented Aug 6, 2026

Uh oh!

lpcox commented Aug 6, 2026

Uh oh!

github-actions Bot commented Aug 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Review: Fix Copilot CLI path in AWF sandboxes

Uh oh!

github-actions Bot commented Aug 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Aug 6, 2026 •

edited by lpcox

Loading

github-actions Bot commented Aug 6, 2026 •

edited

Loading