From 2914231aac1933fcf7486e30a4b96dc0fd8d45b8 Mon Sep 17 00:00:00 2001 From: Don Syme Date: Sat, 24 Oct 2026 20:40:07 +0300 Subject: [PATCH] Fix remaining native fetch declarations to restore full CI Migrate all fourteen incompatible Copilot CLI samples to existing GitHub, browser and proxy-aware curl tools while preserving network and GitHub permission boundaries. Document both compilation stages and retain restricted shell allowlists. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- README.md | 10 ++++++++++ docs/link-checker.md | 2 +- workflows/accessibility-review.md | 6 +++--- workflows/adhoc-qa.md | 3 ++- workflows/ci-coach.md | 3 ++- workflows/daily-issue-triage.md | 5 +++-- workflows/efficiency-improver.md | 3 ++- workflows/lean-squad.md | 3 +-- workflows/link-checker.md | 7 ++++--- workflows/perf-improver.md | 3 ++- workflows/plan.md | 6 +++--- workflows/pr-fix.md | 4 ++-- workflows/repo-ask.md | 3 +-- workflows/test-improver.md | 3 ++- workflows/update-docs.md | 3 ++- workflows/weekly-research.md | 6 +++--- 16 files changed, 43 insertions(+), 27 deletions(-) diff --git a/README.md b/README.md index 98959fbb..b566dd05 100644 --- a/README.md +++ b/README.md @@ -154,6 +154,16 @@ gh aw update # Update added workflows This automatically updates agent files, applies codemods, updates actions versions, and recompiles all workflows. +The Copilot CLI samples use GitHub read tools and proxy-aware `curl` for external references instead of the unsupported native `web-fetch` tool. The accessibility sample uses its existing Playwright browser. Fetches must respect the configured network allowlist and TLS verification; report blocked requests instead of bypassing these controls. + +To validate changes, run the same checks as CI, including both workflow directories: + +```bash +python3 -m unittest discover -s tests -p 'test_repo_assist_*.py' +gh aw compile --verbose +gh aw compile --workflows-dir workflows --verbose +``` + 📖 [Learn more about GitHub Agentic Workflows](https://github.github.io/gh-aw/) ## 💬 Share Feedback diff --git a/docs/link-checker.md b/docs/link-checker.md index 723eb766..b63bc4c6 100644 --- a/docs/link-checker.md +++ b/docs/link-checker.md @@ -33,7 +33,7 @@ graph LR G --> J[Create PR] ``` -A bash script pre-processes links before the AI agent runs. The agent investigates broken links, tries common variations (www, http vs https), and uses web-fetch to find where content moved. +A bash script pre-processes links before the AI agent runs. The agent investigates broken links, tries common variations (www, http vs https), and uses GitHub read tools or proxy-aware `curl` to find where content moved within the configured network allowlist. Firewall blocks and transient fetch failures are reported rather than cached as permanently unfixable links. ## Usage diff --git a/workflows/accessibility-review.md b/workflows/accessibility-review.md index 96675d41..5bea06bd 100644 --- a/workflows/accessibility-review.md +++ b/workflows/accessibility-review.md @@ -26,7 +26,6 @@ safe-outputs: tools: playwright: - web-fetch: github: toolsets: [all] @@ -54,8 +53,9 @@ with details. Our team uses the Web Content Accessibility Guidelines (WCAG) 2.2. You may refer to these as necessary by browsing to https://www.w3.org/TR/WCAG22/ using -the WebFetch tool. You may also search the internet using WebSearch if you need -additional information about WCAG 2.2. +the Playwright browser tool. Use GitHub read tools for repository references. +Do not bypass the network allowlist or TLS verification; if a reference is blocked, +report it and continue with available verified material. The code of the application has been checked out to the current working directory. diff --git a/workflows/adhoc-qa.md b/workflows/adhoc-qa.md index 67ca78a5..9f85b2dd 100644 --- a/workflows/adhoc-qa.md +++ b/workflows/adhoc-qa.md @@ -46,13 +46,14 @@ safe-outputs: tools: github: toolsets: [all] - web-fetch: bash: true --- # Adhoc QA +Use GitHub read tools for repository content and proxy-aware `curl` through bash for external references. Stay within the configured network allowlist, keep TLS verification enabled, and report blocked requests rather than bypassing the firewall or guessing missing content. + ## Job Description diff --git a/workflows/ci-coach.md b/workflows/ci-coach.md index 06b86799..abe9f930 100644 --- a/workflows/ci-coach.md +++ b/workflows/ci-coach.md @@ -36,7 +36,6 @@ tools: github: toolsets: [default] bash: true - web-fetch: safe-outputs: create-pull-request: @@ -49,6 +48,8 @@ timeout-minutes: 30 # CI Optimization Coach +Use GitHub read tools for repository content and proxy-aware `curl` through bash for external references. Stay within the configured network allowlist, keep TLS verification enabled, and report blocked requests rather than bypassing the firewall or guessing missing content. + You are the CI Optimization Coach, an expert system that analyzes GitHub Actions workflow performance to identify opportunities for optimization, efficiency improvements, and cost reduction. ## Mission diff --git a/workflows/daily-issue-triage.md b/workflows/daily-issue-triage.md index 11713455..9fdd1143 100644 --- a/workflows/daily-issue-triage.md +++ b/workflows/daily-issue-triage.md @@ -31,8 +31,7 @@ safe-outputs: max: 50 tools: - bash: ["cat", "ls", "find", "grep", "head", "tail", "wc"] - web-fetch: + bash: ["cat", "ls", "find", "grep", "head", "tail", "wc", "curl"] github: toolsets: [issues, labels] min-integrity: none @@ -42,6 +41,8 @@ timeout-minutes: 60 # Daily Issue Triage +Use GitHub read tools for repository content and proxy-aware `curl` through bash for external references. Stay within the configured network allowlist, keep TLS verification enabled, and report blocked requests rather than bypassing the firewall or guessing missing content. + You are a batch triage assistant for GitHub issues. Your task is to find untriaged issues in **${{ github.repository }}** and triage them one by one. Your triage comments are written for maintainers reviewing the triage, not for the issue author. diff --git a/workflows/efficiency-improver.md b/workflows/efficiency-improver.md index 74c370f2..90c9ac43 100644 --- a/workflows/efficiency-improver.md +++ b/workflows/efficiency-improver.md @@ -61,7 +61,6 @@ safe-outputs: max: 1 tools: - web-fetch: github: toolsets: [all] bash: true @@ -71,6 +70,8 @@ tools: # Efficiency Improver +Use GitHub read tools for repository content and proxy-aware `curl` through bash for external references. Stay within the configured network allowlist, keep TLS verification enabled, and report blocked requests rather than bypassing the firewall or guessing missing content. + You are **Efficiency Improver** for `${{ github.repository }}`. Your job is to systematically identify and implement **energy efficiency improvements** across all dimensions of the codebase — code, data, network/I/O, and frontend/UI — with the north-star goal of **reducing the energy consumption and computational footprint** of the software. You never merge pull requests yourself; you leave that decision to the human maintainers. diff --git a/workflows/lean-squad.md b/workflows/lean-squad.md index 6c47e5cc..5c4bc9a2 100644 --- a/workflows/lean-squad.md +++ b/workflows/lean-squad.md @@ -50,7 +50,6 @@ checkout: fetch-depth: 0 # fetch full history tools: - web-fetch: github: toolsets: [default] bash: true @@ -658,7 +657,7 @@ formal-verification/ - **Proof tractability**: likely `decide` / routine `simp`+`omega`, or requires substantial proof engineering? - **Approximations needed**: what aspects of the original code can't be directly modelled in Lean (e.g., I/O, side effects, memory layout)? Document these clearly. - **Approach**: enumeration/`decide`, inductive invariant, equational proof, model checking via bounded `decide`? -5. Search the web (`web-fetch`) for Lean 4 FV patterns relevant to the language/domain. Check Mathlib for relevant existing lemmas and automation. +5. Research Lean 4 FV patterns relevant to the language/domain using GitHub read tools and proxy-aware `curl` through bash. Stay within the configured network allowlist, keep TLS verification enabled, and report blocked requests rather than bypassing the firewall or guessing missing content. Check Mathlib for relevant existing lemmas and automation. 6. Create or update `formal-verification/RESEARCH.md` and `formal-verification/TARGETS.md`. If updating, include a section noting how critique feedback was incorporated (e.g., re-prioritised targets, revised approaches, new targets added from gap analysis). Create a PR. 7. Optionally, open an issue summarising the survey and inviting maintainer input on priorities. 8. Update memory with identified targets, approach choices, rationale, and any critique-driven adjustments. diff --git a/workflows/link-checker.md b/workflows/link-checker.md index e015ea96..6f91d058 100644 --- a/workflows/link-checker.md +++ b/workflows/link-checker.md @@ -98,7 +98,7 @@ tools: github: toolsets: [default] cache-memory: true - web-fetch: + bash: ["cat", "curl"] safe-outputs: create-pull-request: @@ -162,7 +162,8 @@ For each broken link found in the test results (but NOT in the unfixable list): - The surrounding documentation 2. **Search for alternatives:** - - Use web-fetch to search for if the content has moved to a new URL + - Use GitHub read tools or proxy-aware `curl` through bash, within the configured network allowlist, to check whether the content has moved to a new URL + - Report firewall blocks or transient fetch failures; do not treat them as proof that content is permanently gone or cache them as unfixable links - Try common alternatives (www vs non-www, http vs https, with/without trailing slash) - Look for redirects or updated documentation - Check if there's an official replacement @@ -208,7 +209,7 @@ Based on your work: - **Preserve context:** When replacing links, make sure the new URL points to equivalent or better content - **Document everything:** Keep the cache memory up to date with unfixable links - **Be selective:** Only add links to the unfixable list if you've genuinely tried to find alternatives -- **Use web-fetch wisely:** Try to fetch the broken URL and check for redirects or alternatives +- **Fetch within the allowlist:** Use proxy-aware `curl` to check redirects or alternatives; do not bypass the firewall or disable TLS verification - **Relative links:** Focus only on HTTP(S) links. Skip relative links and anchors (they're tested differently) ## Example Cache Memory Update diff --git a/workflows/perf-improver.md b/workflows/perf-improver.md index a83275e5..6aecc783 100644 --- a/workflows/perf-improver.md +++ b/workflows/perf-improver.md @@ -70,7 +70,6 @@ safe-outputs: max: 1 tools: - web-fetch: github: toolsets: [all] bash: true @@ -80,6 +79,8 @@ tools: # Perf Improver +Use GitHub read tools for repository content and proxy-aware `curl` through bash for external references. Stay within the configured network allowlist, keep TLS verification enabled, and report blocked requests rather than bypassing the firewall or guessing missing content. + ## Command Mode Take heed of **instructions**: "${{ steps.sanitized.outputs.text }}" diff --git a/workflows/plan.md b/workflows/plan.md index 3b7ab706..796c0a1f 100644 --- a/workflows/plan.md +++ b/workflows/plan.md @@ -23,7 +23,7 @@ safe-outputs: close-older-discussions: true tools: - bash: ["cat", "ls", "find", "grep", "head", "tail", "wc"] + bash: ["cat", "ls", "find", "grep", "head", "tail", "wc", "curl"] github: toolsets: [all] # If in a public repo, setting `lockdown: false` allows @@ -31,13 +31,14 @@ tools: # If in a private repo this has no particular effect. lockdown: false min-integrity: none # This workflow is allowed to examine and comment on any issues - web-fetch: timeout-minutes: 15 --- # Agentic Planner +Use GitHub read tools for repository content and proxy-aware `curl` through bash for external references. Stay within the configured network allowlist, keep TLS verification enabled, and report blocked requests rather than bypassing the firewall or guessing missing content. + ## Job Description Your job is to act as a planner for the GitHub repository ${{ github.repository }}. @@ -60,4 +61,3 @@ Your job is to act as a planner for the GitHub repository ${{ github.repository 3a. Create a discussion with an appropriate title starting with "[plan]" and the current date (e.g., "[plan] 2025-10-10"), using the project plan as the body. - diff --git a/workflows/pr-fix.md b/workflows/pr-fix.md index fa15163e..ea1af3a7 100644 --- a/workflows/pr-fix.md +++ b/workflows/pr-fix.md @@ -17,7 +17,6 @@ permissions: read-all network: defaults tools: - web-fetch: bash: true github: min-integrity: none # This workflow is allowed to examine any PR because it's invoked by a repo maintainer @@ -35,6 +34,8 @@ timeout-minutes: 20 # PR Fix +Use GitHub read tools for repository content and proxy-aware `curl` through bash for external references. Stay within the configured network allowlist, keep TLS verification enabled, and report blocked requests rather than bypassing the firewall or guessing missing content. + You are an AI assistant specialized in fixing pull requests with failing CI checks. Your job is to analyze the failure logs, identify the root cause of the failure, and push a fix to the pull request branch for pull request #${{ github.event.issue.number }} in the repository ${{ github.repository }}. 1. Read the pull request and the comments @@ -57,4 +58,3 @@ You are an AI assistant specialized in fixing pull requests with failing CI chec 9. Add a comment to the pull request summarizing the changes you made and the reason for the fix. - diff --git a/workflows/repo-ask.md b/workflows/repo-ask.md index fb87ef30..78268b76 100644 --- a/workflows/repo-ask.md +++ b/workflows/repo-ask.md @@ -19,7 +19,6 @@ safe-outputs: add-comment: tools: - web-fetch: bash: true github: toolsets: [default, discussions] @@ -31,7 +30,7 @@ timeout-minutes: 20 # Question Answering Researcher -You are an AI assistant specialized in researching and answering questions in the context of a software repository. Your goal is to provide accurate, concise, and relevant answers to user questions by leveraging the tools at your disposal. You can use web search and web fetch to gather information from the internet, and you can run bash commands within the confines of the GitHub Actions virtual machine to inspect the repository, run tests, or perform other tasks. +You are an AI assistant specialized in researching and answering questions in the context of a software repository. Your goal is to provide accurate, concise, and relevant answers to user questions by leveraging the tools at your disposal. Use GitHub read tools for repository content and proxy-aware `curl` through bash for external references. Stay within the configured network allowlist, keep TLS verification enabled, and report blocked requests rather than bypassing the firewall or guessing missing content. You can run bash commands within the confines of the GitHub Actions virtual machine to inspect the repository, run tests, or perform other tasks. You have been invoked in the context of the pull request or issue #${{ github.event.issue.number }} in the repository ${{ github.repository }}. diff --git a/workflows/test-improver.md b/workflows/test-improver.md index 311ebc19..3adafea2 100644 --- a/workflows/test-improver.md +++ b/workflows/test-improver.md @@ -70,7 +70,6 @@ safe-outputs: max: 1 tools: - web-fetch: bash: true github: toolsets: [all] @@ -80,6 +79,8 @@ tools: # Test Improver +Use GitHub read tools for repository content and proxy-aware `curl` through bash for external references. Stay within the configured network allowlist, keep TLS verification enabled, and report blocked requests rather than bypassing the firewall or guessing missing content. + ## Command Mode Take heed of **instructions**: "${{ steps.sanitized.outputs.text }}" diff --git a/workflows/update-docs.md b/workflows/update-docs.md index 8f0669e2..a42667fb 100644 --- a/workflows/update-docs.md +++ b/workflows/update-docs.md @@ -28,7 +28,6 @@ safe-outputs: tools: github: toolsets: [all] - web-fetch: # By default this workflow allows all bash commands within the confine of Github Actions VM bash: true @@ -37,6 +36,8 @@ timeout-minutes: 15 # Update Docs +Use GitHub read tools for repository content and proxy-aware `curl` through bash for external references. Stay within the configured network allowlist, keep TLS verification enabled, and report blocked requests rather than bypassing the firewall or guessing missing content. + ## Job Description diff --git a/workflows/weekly-research.md b/workflows/weekly-research.md index 07d83237..c037a2c6 100644 --- a/workflows/weekly-research.md +++ b/workflows/weekly-research.md @@ -20,11 +20,10 @@ safe-outputs: category: "ideas" tools: - bash: ["cat", "ls", "find", "grep", "head", "tail", "wc"] + bash: ["cat", "ls", "find", "grep", "head", "tail", "wc", "curl"] github: toolsets: [all] min-integrity: none # This workflow is allowed to examine and comment on any issues or PRs - web-fetch: timeout-minutes: 15 @@ -32,6 +31,8 @@ timeout-minutes: 15 # Weekly Research +Use GitHub read tools for repository content and proxy-aware `curl` through bash for external references. Stay within the configured network allowlist, keep TLS verification enabled, and report blocked requests rather than bypassing the firewall or guessing missing content. + ## Job Description Do a deep research investigation in ${{ github.repository }} repository, and the related industry in general. @@ -56,4 +57,3 @@ At the end of the report list write a collapsed section with the following: - All bash commands you executed - All MCP tools you used -