Skip to content

Commit 7720c8f

Browse files
CopilotMossaka
andauthored
docs: Document agent container build/test environment from epic #11970 (#12375)
* Initial plan * Initial plan for build/test environment documentation Co-authored-by: Mossaka <5447827+Mossaka@users.noreply.github.com> * docs: Update sandbox.md with comprehensive build/test environment documentation Co-authored-by: Mossaka <5447827+Mossaka@users.noreply.github.com> * docs: Fix PATH export command in sandbox.md to show proper colon separator Co-authored-by: Mossaka <5447827+Mossaka@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Mossaka <5447827+Mossaka@users.noreply.github.com> Co-authored-by: Jiaxiao Zhou <duibao55328@gmail.com>
1 parent d4c8256 commit 7720c8f

3 files changed

Lines changed: 111 additions & 2 deletions

File tree

docs/src/content/docs/agent-factory-status.mdx

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -75,6 +75,7 @@ These are experimental agentic workflows used by the GitHub Next team to learn,
7575
| [Discussion Task Miner - Code Quality Improvement Agent](https://github.com/githubnext/gh-aw/blob/main/.github/workflows/discussion-task-miner.md) | copilot | [![Discussion Task Miner - Code Quality Improvement Agent](https://github.com/githubnext/gh-aw/actions/workflows/discussion-task-miner.lock.yml/badge.svg)](https://github.com/githubnext/gh-aw/actions/workflows/discussion-task-miner.lock.yml) | - | - |
7676
| [Documentation Noob Tester](https://github.com/githubnext/gh-aw/blob/main/.github/workflows/docs-noob-tester.md) | copilot | [![Documentation Noob Tester](https://github.com/githubnext/gh-aw/actions/workflows/docs-noob-tester.lock.yml/badge.svg)](https://github.com/githubnext/gh-aw/actions/workflows/docs-noob-tester.lock.yml) | - | - |
7777
| [Documentation Unbloat](https://github.com/githubnext/gh-aw/blob/main/.github/workflows/unbloat-docs.md) | claude | [![Documentation Unbloat](https://github.com/githubnext/gh-aw/actions/workflows/unbloat-docs.lock.yml/badge.svg)](https://github.com/githubnext/gh-aw/actions/workflows/unbloat-docs.lock.yml) | - | `/unbloat` |
78+
| [Draft PR Cleanup](https://github.com/githubnext/gh-aw/blob/main/.github/workflows/draft-pr-cleanup.md) | copilot | [![Draft PR Cleanup](https://github.com/githubnext/gh-aw/actions/workflows/draft-pr-cleanup.lock.yml/badge.svg)](https://github.com/githubnext/gh-aw/actions/workflows/draft-pr-cleanup.lock.yml) | - | - |
7879
| [Duplicate Code Detector](https://github.com/githubnext/gh-aw/blob/main/.github/workflows/duplicate-code-detector.md) | codex | [![Duplicate Code Detector](https://github.com/githubnext/gh-aw/actions/workflows/duplicate-code-detector.lock.yml/badge.svg)](https://github.com/githubnext/gh-aw/actions/workflows/duplicate-code-detector.lock.yml) | - | - |
7980
| [Example: Custom Error Patterns](https://github.com/githubnext/gh-aw/blob/main/.github/workflows/example-custom-error-patterns.md) | copilot | [![Example: Custom Error Patterns](https://github.com/githubnext/gh-aw/actions/workflows/example-custom-error-patterns.lock.yml/badge.svg)](https://github.com/githubnext/gh-aw/actions/workflows/example-custom-error-patterns.lock.yml) | - | - |
8081
| [Example: Properly Provisioned Permissions](https://github.com/githubnext/gh-aw/blob/main/.github/workflows/example-permissions-warning.md) | copilot | [![Example: Properly Provisioned Permissions](https://github.com/githubnext/gh-aw/actions/workflows/example-permissions-warning.lock.yml/badge.svg)](https://github.com/githubnext/gh-aw/actions/workflows/example-permissions-warning.lock.yml) | - | - |

docs/src/content/docs/reference/sandbox.md

Lines changed: 93 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
---
22
title: Sandbox Configuration
3-
description: Configure sandbox environments for AI engines including MCP Gateway and Sandbox Runtime (SRT)
3+
description: Configure sandbox environments for AI engines including AWF agent container, mounted tools, runtime environments, and MCP Gateway
44
sidebar:
55
order: 1350
66
---
@@ -85,13 +85,55 @@ AWF automatically mounts several paths from the host into the container to enabl
8585
| Host Path | Container Path | Mode | Purpose |
8686
|-----------|----------------|------|---------|
8787
| `/tmp` | `/tmp` | `rw` | Temporary files and cache |
88+
| `${HOME}/.cache` | `${HOME}/.cache` | `rw` | Build caches (Go, npm, etc.) |
8889
| `${GITHUB_WORKSPACE}` | `${GITHUB_WORKSPACE}` | `rw` | Repository workspace directory |
89-
| `/usr/bin/{date,gh,yq}` | `/usr/bin/{date,gh,yq}` | `ro` | System utilities (date, GitHub CLI, yq) |
90+
| `/opt/hostedtoolcache` | `/opt/hostedtoolcache` | `ro` | Runtimes (Node.js, Python, Go, Ruby, Java) |
91+
| `/opt/gh-aw` | `/opt/gh-aw` | `ro` | Script and configuration files |
9092
| `/usr/local/bin/copilot` | `/usr/local/bin/copilot` | `ro` | Copilot CLI binary |
9193
| `/home/runner/.copilot` | `/home/runner/.copilot` | `rw` | Copilot configuration and state |
9294

9395
These default mounts ensure the agent has access to essential tools and the repository files. Custom mounts specified via `sandbox.agent.mounts` are added alongside these defaults.
9496

97+
#### Mounted System Utilities
98+
99+
AWF mounts common system utilities from the host into the container as read-only binaries. These utilities are frequently used in workflow scripts and are organized by priority:
100+
101+
**Essential Utilities** (most commonly used):
102+
103+
| Utility | Purpose |
104+
|---------|---------|
105+
| `cat` | Display file contents |
106+
| `curl` | HTTP client for API calls |
107+
| `date` | Date/time operations |
108+
| `find` | Locate files by pattern |
109+
| `gh` | GitHub CLI operations |
110+
| `grep` | Pattern matching |
111+
| `jq` | JSON processing |
112+
| `yq` | YAML processing |
113+
114+
**Common Utilities** (frequently used for file operations):
115+
116+
| Utility | Purpose |
117+
|---------|---------|
118+
| `cp` | Copy files |
119+
| `cut` | Extract text columns |
120+
| `diff` | Compare files |
121+
| `head` | Display file start |
122+
| `ls` | List directory contents |
123+
| `mkdir` | Create directories |
124+
| `rm` | Remove files |
125+
| `sed` | Stream text editing |
126+
| `sort` | Sort text lines |
127+
| `tail` | Display file end |
128+
| `wc` | Count lines/words |
129+
| `which` | Locate commands |
130+
131+
All utilities are mounted read-only (`:ro`) from `/usr/bin/` on the host. They execute on the read-write workspace directory inside the container.
132+
133+
> [!TIP]
134+
> Available Utilities
135+
> Run `which jq` or `jq --version` in your workflow to verify utility availability. The agent has access to all mounted utilities without additional setup.
136+
95137
> [!WARNING]
96138
> Docker socket access is not supported for security
97139
> reasons. The agent firewall does not mount
@@ -123,6 +165,55 @@ The following environment variables are mirrored (if they exist on the host):
123165
> Environment Variable Handling
124166
> Variables are only passed to the container if they exist on the host runner. Missing variables are silently ignored, ensuring workflows work across different runner configurations.
125167

168+
#### Runtime Tools (hostedtoolcache)
169+
170+
AWF mounts the `/opt/hostedtoolcache` directory from the GitHub Actions runner, providing access to all runtimes installed via `actions/setup-*` steps. This directory contains pre-installed and dynamically-installed versions of popular development tools.
171+
172+
**Available Runtimes:**
173+
174+
| Runtime | Setup Action | Example Versions |
175+
|---------|-------------|------------------|
176+
| **Node.js** | `actions/setup-node` | 18.x, 20.x, 22.x |
177+
| **Python** | `actions/setup-python` | 3.9, 3.10, 3.11, 3.12, 3.13, 3.14 |
178+
| **Go** | `actions/setup-go` | 1.22.x, 1.23.x, 1.24.x, 1.25.x |
179+
| **Ruby** | `ruby/setup-ruby` | 3.2, 3.3, 3.4 |
180+
| **Java** | `actions/setup-java` | 8, 11, 17, 21, 25 |
181+
182+
**PATH Integration:**
183+
184+
All runtime binaries are automatically added to PATH inside the agent container. The PATH is configured using a dynamic `find` command that discovers all `bin` directories within `/opt/hostedtoolcache`:
185+
186+
```bash
187+
# PATH includes all hostedtoolcache binaries
188+
export PATH="$(find /opt/hostedtoolcache -maxdepth 4 -type d -name bin 2>/dev/null | tr '\n' ':')$PATH"
189+
```
190+
191+
**Version Priority:**
192+
193+
When multiple versions of a runtime are installed, versions configured by `actions/setup-*` take precedence. The agent detects which specific version is active by reading environment variables like `GOROOT`, `JAVA_HOME`, and ensures that version's binaries appear first in PATH.
194+
195+
**Using Runtimes in Workflows:**
196+
197+
```yaml wrap
198+
---
199+
jobs:
200+
setup:
201+
steps:
202+
- uses: actions/setup-go@v5
203+
with:
204+
go-version: '1.25'
205+
- uses: actions/setup-python@v5
206+
with:
207+
python-version: '3.12'
208+
---
209+
210+
Use `go build` or `python3` in your workflow - both are available!
211+
```
212+
213+
> [!TIP]
214+
> Verify Runtime Availability
215+
> Use `node --version`, `python3 --version`, `go version`, or `ruby --version` in your workflow to confirm runtime availability. The agent automatically inherits all runtimes configured by setup actions.
216+
126217
#### Custom AWF Configuration
127218

128219
Use custom commands, arguments, and environment variables to replace the standard AWF installation with a custom setup:

pkg/cli/templates/github-agentic-workflows.md

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -138,6 +138,20 @@ The YAML frontmatter supports these fields:
138138
- Enables searching and retrieving assets associated with this workflow
139139
- Examples: `"workflow-2024-q1"`, `"team-alpha-bot"`, `"security_audit_v2"`
140140

141+
- **`project:`** - GitHub Projects integration configuration (string or object)
142+
- String format: `"https://github.com/orgs/myorg/projects/42"` - Project URL only
143+
- Object format for advanced configuration:
144+
```yaml
145+
project:
146+
url: "https://github.com/orgs/myorg/projects/42" # Required: full project URL
147+
scope: ["owner/repo", "org:name"] # Optional: repositories/organizations workflow can operate on
148+
max-updates: 100 # Optional: max project updates per run (default: 100)
149+
max-status-updates: 1 # Optional: max status updates per run (default: 1)
150+
github-token: ${{ secrets.PROJECTS_PAT }} # Optional: custom token for project operations
151+
```
152+
- When configured, enables project board management operations
153+
- Works with `update-project` safe-output for automated project tracking
154+
141155
- **`secret-masking:`** - Configuration for secret redaction behavior in workflow outputs and artifacts (object)
142156
- `steps:` - Additional secret redaction steps to inject after the built-in secret redaction (array)
143157
- Use this to mask secrets in generated files using custom patterns
@@ -609,6 +623,9 @@ The YAML frontmatter supports these fields:
609623
safe-outputs:
610624
assign-to-agent:
611625
name: "copilot" # Optional: agent name
626+
allowed: [copilot] # Optional: restrict to specific agent names
627+
max: 1 # Optional: max assignments (default: 1)
628+
target: "*" # Optional: "triggering" (default), "*", or number
612629
target-repo: "owner/repo" # Optional: cross-repository
613630
```
614631
Requires PAT with elevated permissions as `GH_AW_AGENT_TOKEN`.

0 commit comments

Comments
 (0)