Replace hardcoded /opt/gh-aw/ paths with GH_AW_HOME env var for self-hosted runner portability#20143
Open
Replace hardcoded /opt/gh-aw/ paths with GH_AW_HOME env var for self-hosted runner portability#20143
/opt/gh-aw/ paths with GH_AW_HOME env var for self-hosted runner portability#20143Conversation
7 tasks
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
|
@copilot keep working |
… portability
- Add GhAwHome, GhAwHomeJS, JsRequireGhAw() helpers to setup_action_paths.go
- Add GhAwHomeDefault constant and update DefaultGhAwMount in constants.go
- Add GH_AW_HOME to job-level env in all compiled jobs (always defaults to /opt/gh-aw)
- Move GH_AW_SAFE_OUTPUTS/CONFIG/TOOLS_PATH from job env to $GITHUB_ENV step
- Replace all hardcoded /opt/gh-aw/ paths with GhAwHome/${GH_AW_HOME} in Go source
- Replace all JS require('/opt/gh-aw/...') with require(process.env.GH_AW_HOME + '...')
- Update setup.sh to derive GH_AW_HOME from destination and export to $GITHUB_ENV
- Update sh/*.sh scripts to use ${GH_AW_HOME:-/opt/gh-aw} fallback syntax
- Remove destination: input from setup action invocations
- Update compiler_safe_outputs_job.go step count for setup step without destination
- Update all test assertions to use new path expressions
- Update wasm golden test fixtures
- Recompile all 166 workflow lock files
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
Done — commit d3ad8f2 completes the full implementation:
Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
Copilot
AI
changed the title
[WIP] Re-implement goal of PR 19744 for current main
Replace hardcoded Mar 9, 2026
/opt/gh-aw/ paths with GH_AW_HOME env var for self-hosted runner portability
Contributor
…ral value bug
The compiled lock files were passing `destination: ${GH_AW_HOME}/actions` to the
setup action, which GitHub Actions treats as a literal string (not a shell variable).
This caused setup.sh to set GH_AW_HOME="${GH_AW_HOME}" (literal), breaking all
require() calls like `require('${GH_AW_HOME}/actions/setup_globals.cjs')`.
Fix: generateSetupStep() no longer emits `with: destination:` — the setup action
defaults to /opt/gh-aw/actions via action.yml, and setup.sh correctly derives
and exports GH_AW_HOME=/opt/gh-aw to $GITHUB_ENV for subsequent steps.
Also removes INPUT_DESTINATION from script mode (setup.sh default is used).
Updates wasm golden files and recompiles all 166 lock files.
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
Fixed in de37c65. The issue was that The fix removes the Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
Contributor
|
🔧 Starting tool validation... Agent Container Smoke Test is checking the agent container tools... |
Contributor
|
🔮 The ancient spirits stir... Smoke Codex awakens to divine this pull request... |
Contributor
|
💥 WHOOSH! Smoke Claude springs into action on this pull request! [Panel 1 begins...] |
Contributor
|
📰 BREAKING: Smoke Copilot is now investigating this pull request. Sources say the story is developing... |
Contributor
…d threat detection steps
The safe_outputs_jobs.go buildGitHubScriptStep/buildGitHubScriptStepWithoutDownload
and threat_detection.go buildSetupScriptRequire were generating JS require() calls
with single-quoted strings: require('${GH_AW_HOME}/actions/...cjs')
In Node.js single-quoted strings are not interpolated, so ${GH_AW_HOME} was
treated as a literal (not the env var), causing MODULE_NOT_FOUND errors.
Fixed by using JsRequireGhAw() helper which produces:
require(process.env.GH_AW_HOME + '/actions/...cjs')
Also updated threat_detection_test.go to assert the correct pattern.
Recompiled all 166 lock files.
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
Fixed in 555d5c7. The root cause was that require('${GH_AW_HOME}/actions/noop.cjs')Node.js doesn't interpolate require(process.env.GH_AW_HOME + '/actions/noop.cjs')Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
Contributor
|
📰 BREAKING: Smoke Copilot is now investigating this pull request. Sources say the story is developing... |
Contributor
|
🎬 THE END — Smoke Claude MISSION: ACCOMPLISHED! The hero saves the day! ✨ |
Contributor
|
🌑 The shadows whisper... Smoke Codex failed. The oracle requires further meditation... |
Contributor
|
✅ All tools validated successfully! Agent Container Smoke Test confirms agent container is ready. |
Contributor
Agent Container Tool Check
Result: 12/12 tools available ✅ Overall Status: PASS
|
Contributor
|
🚦 Smoke Test Results — Run §22858353239 Author:
Overall: ❌ FAIL — Serena MCP tools unavailable
|
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Reviewed PR #20143: replaces all hardcoded /opt/gh-aw/ paths with GH_AW_HOME env var. The approach is clean and consistent — setting GH_AW_HOME at job level with a default of /opt/gh-aw ensures backward compatibility while enabling self-hosted runner portability.
📰 BREAKING: Report filed by Smoke Copilot
| issues: write | ||
| pull-requests: write | ||
| env: | ||
| GH_AW_HOME: /opt/gh-aw |
Contributor
There was a problem hiding this comment.
✅ Good pattern - setting GH_AW_HOME as a job-level env var keeps all path references consistent throughout the job without needing to set it in each individual step.
| "gh-aw": patch | ||
| --- | ||
|
|
||
| Allow gh-aw to derive runtime paths from the new `GH_AW_HOME` environment variable instead of enforcing `/opt/gh-aw`, so self-hosted runners can relocate the installation without recompilation. |
Contributor
There was a problem hiding this comment.
Clear and concise changeset description. This portability improvement will be particularly valuable for organizations running self-hosted runners in containerized or custom environments.
Contributor
|
📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤 |
Contributor
|
Commit pushed:
|
Contributor
Smoke Test Results - Run 22858353205Core Tests: ✅✅✅✅✅✅✅✅✅✅ (all 10 passed) Overall: PARTIAL (test #17 skipped - no safe PR to close)
|
Contributor
There was a problem hiding this comment.
💥 Automated smoke test review - all systems nominal!
💥 [THE END] — Illustrated by Smoke Claude
| @@ -0,0 +1,5 @@ | |||
| --- | |||
Contributor
There was a problem hiding this comment.
Smoke test review comment #1: Changeset file looks good - clearly describes the GH_AW_HOME portability improvement.
| discussions: write | ||
| issues: write | ||
| pull-requests: write | ||
| env: |
Contributor
There was a problem hiding this comment.
Smoke test review comment #2: Adding GH_AW_HOME to the job-level env is the right approach for making all steps inherit this value without repeating it.
Contributor
|
@copilot merge main, make sure that change that adds support in the safe outputs to ignore known safe job tool type is still present. See this failure https://github.com/github/gh-aw/actions/runs/22858353239/job/66306172045#step:6:1 the tool is know and should be ignored. A commit was lost. |
Copilot stopped work on behalf of
pelikhan due to an error
March 9, 2026 15:25
Contributor
|
Hey However, this PR violates the contribution process outlined in CONTRIBUTING.md. Here's what needs to happen: Issues Found🚫 Unauthorized PR from non-core member: CONTRIBUTING.md explicitly states:
While you reference issue #19744 (which was a PR, not an issue with an agentic plan), the contribution guidelines require:
This PR appears to be a reimplementation of closed PR #19744, but was not preceded by an approved agentic plan in an issue. Missing Tests: The PR modifies 247 files including core compiler logic in
For a change of this magnitude (24,913 lines across 247 files, touching path resolution, environment variable handling, and workflow compilation), comprehensive test coverage is essential. Missing Discussion: Issue #19744 was closed, but there's no new issue discussing why this reimplementation was needed or what changed in the approach. What To Do
|
Contributor
|
@copilot See this failure https://github.com/github/gh-aw/actions/runs/22858353239/job/66306172045#step:6:1 the tool is know and should be ignored. A commit was lost |
… job types Merges origin/main into branch. Also adds GH_AW_SAFE_OUTPUT_JOBS to the safe_outputs job env so the handler manager can skip message types handled by custom safe jobs (e.g. send_slack_message), preventing 'No handler loaded' failures when those types appear in agent output. Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
Fixed in f14347f. Merged main and restored the lost feature: 5 workflows with custom safe jobs now emit the env var (e.g., Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
/opt/gh-aw/paths withGH_AW_HOMEenv var for self-hosted runner supportGhAwHome,GhAwHomeJS,GhAwHomeDefault,JsRequireGhAw()tosetup_action_paths.gopkg/constants/constants.go(GhAwHomeDefault,DefaultGhAwMount)compiler_main_job.go- always init env withGH_AW_HOME, move safe output paths to$GITHUB_ENVcompiler_yaml_main_job.go- export env vars via$GITHUB_ENVin create-temp-dir steppkg/workflow/*.gocompiler files - replace hardcoded/opt/gh-aw/withGhAwHome/JsRequireGhAw()GH_AW_HOMEto job-level env in all compiled jobscompiler_yaml_helpers.go- removedestination:from setup stepsafe_outputs_jobs.goandthreat_detection.go- useJsRequireGhAw()in require() callsmaintenance_workflow.go- addmaintenanceRequireScript()helper; all 7 yaml.WriteString blocks had literal" + JsRequireGhAw(...) + "text instead of evaluated Go codecompiler_custom_actions_test.go- test Add workflow: githubnext/agentics/weekly-research #5 now verifiesINPUT_DESTINATIONis NOT set in script modemcp_scripts_generator_test.go- strengthen logDir assertion to check fullprocess.env.GH_AW_HOME + '/mcp-scripts/logs'expressionmcp_setup_generator.go- use${{ env.GH_AW_HOME }}(GitHub Actions expression) instead of${GH_AW_HOME}(shell syntax) in YAMLenv:blocks forGH_AW_SAFE_OUTPUTS_TOOLS_PATHandGH_AW_SAFE_OUTPUTS_CONFIG_PATH; addGhAwHomeExprconstant tosetup_action_paths.gosafe_jobs.go- useGhAwHomeExprforDownloadPathinbuildArtifactDownloadStepssopath:inwith:block uses${{ env.GH_AW_HOME }}(GitHub Actions expression) instead of${GH_AW_HOME}(shell syntax that doesn't expand inwith:blocks)step_order_validation.go- add${GH_AW_HOMEprefix checkactions/setup/setup.sh- deriveGH_AW_HOMEfrom destination, export to$GITHUB_ENVactions/setup/sh/*.sh- replace hardcoded/opt/gh-awwith${GH_AW_HOME:-/opt/gh-aw}compiler_safe_outputs_job.go-buildJobLevelSafeOutputEnvVarsnow setsGH_AW_SAFE_OUTPUT_JOBSto a JSON map of all custom safe job names (fromsafe-outputs.jobs), so the handler manager can skip those message types instead of failing with "No handler loaded" errors (e.g.send_slack_message)origin/maininto branchmake buildandgo test ./pkg/workflow/...- all passmake recompile- all 166 workflows compiled with correct${{ env.GH_AW_HOME }}in env:/path: blocks✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.
Changeset
GH_AW_HOMEto compute runtime paths rather than hardcoding/opt/gh-aw, enabling self-hosted runners to relocate the installation.Warning
The following domains were blocked by the firewall during workflow execution:
ab.chatgpt.comgithub.comTo allow these domains, add them to the
network.allowedlist in your workflow frontmatter:See Network Configuration for more information.
✨ PR Review Safe Output Test - Run 22848901132
Changeset
GH_AW_HOMEto compute runtime paths instead of hardcoding/opt/gh-aw, so self-hosted runners can relocate the runtime.Warning
The following domains were blocked by the firewall during workflow execution:
ab.chatgpt.comcodeload.github.comgithub.comTo allow these domains, add them to the
network.allowedlist in your workflow frontmatter:See Network Configuration for more information.
✨ PR Review Safe Output Test - Run 22858353205