A heartfelt thank you to all community members whose bug reports and feature requests have shaped gh-aw!

This page highlights the most active community contributors. For a complete list of all contributors, see the README Community Contributions section.

18 issues reported

• #64443 close-issue: intent-path failures silently fall back to an unreviewed legacy close
• #46925 Expose schema-derived safeoutputs CLI syntax and validate strict labels synchronously
• #46853 Intent-aware mutation descriptions should encourage optional metadata and clearly require strict metadata

11 issues reported

• #41043 engine: copilot never discovers APM-delivered skills (.agents/skills/) — supported, or inline-only?
• #39889 GitHub Enterprise Server (GHES) compatibility
• #39886 gh aw trial is unusable on GitHub Enterprise Server — git clone operations hardcode github.com (ignore GH_HOST)

6 issues reported

• #20515 (Feature Request): allowed-files is an allowlist, not an "additionally allow" list — undocumented and counterintuitive
• #20514 AGENTS.md in protected_files list blocks legitimate modifications
• #20513 protected_path_prefixes overrides allowed-files — no way to allow .github/ files via frontmatter

8 issues reported

• #35682 gh aw add fails to parse valid workflow path when repository name contains multiple hyphens
• #35483 BYOK Azure OpenAI routing fails with 404 or 401 across base URL variants
• #35157 gh aw add rejects a direct workflow file path with a branch ref

23 issues reported

• #29174 Feature: allow expression inputs for safe-output list constraints
• #29173 Feature: parameterize safe-output PR policy fields in workflow_call workflows
• #29172 Feature: parameterize safe-output boolean controls for reusable workflows

13 issues reported

• #64953 Claude engine: pass --strict-mcp-config to avoid a TCP_DENIED for api.anthropic.com on every run
• #62948 Unified 'agent' artifact bundles the agent's scratch dir unconditionally, ballooning re-download cost for every downstream job
• #62942 gh aw audit: single-run mode unconditionally downloads a second 'baseline' run's full artifacts

12 issues reported

• #25717 inputs.* expressions in prompt body not resolved when called via workflow_call
• #20885 Safe-outputs MCP transport silently closes on idle during long agent runs — no outputs produced, workflow reports success
• #19467 Default concurrency group for workflow_dispatch causes concurrent runs to cancel each other

11 issues reported

• #63980 assign-to-agent: add required-labels support (other safe-outputs already have it)
• #63669 shared/pr-diff-data-fetch.md: 3 bugs in the slash-command / cache / error-handling paths
• #56121 dispatch-workflow: omitted ref on command (issue_comment) triggers silently dispatches the default branch, bypassing allowed-refs

25 issues reported

• #64566 gpt-6-astra stopped working with Actions-token auth on Sep 29: reduced catalog and retries exhausted
• #59785 Recompiling with v0.87.10/v0.88.2 drops contents: read from safe_outputs/conclusion jobs that use setup-steps + local composite checkout
• #50740 push_to_pull_request_branch cannot apply HEAD-only filtered bundles

8 issues reported

• #52547 Top-level workflow concurrency group omits queue: max, so push-triggered workflows silently drop queued runs
• #50632 Docs: safe-outputs.jobs custom jobs run once per workflow run, not once per tool call
• #47804 legacy-security: enable emits sudo -E awf but installs awf with --rootless, so the agent fails at startup with sudo: awf: command not found

7 issues reported

• #34980 Use Codex structured outputs for threat detection parsing
• #32446 Codex OpenAI proxy fails because OPENAI_API_KEY is excluded from AWF sandbox
• #31399 labels: filter causes push-triggered runs to fail instead of skip

22 issues reported

• #64311 gh aw --version prints to stderr instead of stdout
• #63472 cache-memory validation marker write fails with EACCES after successful agent run
• #38681 gh aw fix: move-step-run-expressions-to-env-bindings codemod inserts invalid env bindings when GitHub expressions appear in bash comments

8 issues reported

• #56949 Make Copilot SDK tool catalogs match compiled workflow tools
• #56948 Use authoritative AWF AI-credit totals in usage reporting
• #35688 Expression-harvesting pass hoists ${{ ... }} tokens from inside bash # comments into step env, breaking workflow load (regression since v0.76)

5 issues reported

• #66564 Support an explicit strict-mode policy for pull_request_target workflows with fixed external checkouts
• #62680 create_pull_request fails for same-organization fork because head_repo is omitted
• #53654 add_labels: GraphQL intent path silently removes an already-applied label when confidence is below the repo automation threshold

10 issues reported

• #28966 COPILOT_MODEL and GH_AW_INFO_MODEL use different defaults in compiled lock files
• #26486 Compiled lock file requests broader permissions than workflow needs (discussions:write, pull-requests:write)
• #25573 Codemod 'Convert write permissions to read' incorrectly changes id-token: write to read

6 issues reported

• #64050 Repoint the pydantic-ai engine import at pydantic/pydantic-ai
• #59755 Repoint the pydantic-ai catalog entry to pydantic/pydantic-ai-harness and retire the shared copy
• #58340 engine.command skips the AWF firewall install, so the hand-pinned binary drifts from the config gh-aw writes

39 issues reported

• #56145 MCP gateway health timeout races backend startup timeout at 120 seconds
• #56050 add-labels doesn't create labels if missing and there's no option to do this.
• #55468 Proposal: support top-level doclink workflow frontmatter

9 issues reported

• #65173 protected-files exclude unprotects a file name at every depth: no way to allow only the root pyproject.toml
• #65105 conclusion job: collect_usage_artifact_files.sh calls bare node (exit 127) on runners without node on PATH
• #64344 gh-aw.aic/turns/gen_ai.usage.* missing on summary spans under runner.topology: arc-dind (parse_token_usage.cjs hardcodes /tmp/gh-aw, same class as #63717)

5 issues reported

• #57740 Imported steps: run in traversal order, and import cycles in subdirectories are not detected
• #54061 observability.otlp.endpoint with a non-HTTPS URL silently crashes MCP Gateway startup — no compile-time validation or warning
• #52575 Docs still reference copilot-otel.jsonl artifact removed in #32280

6 issues reported

• #63202 [gh-aw-wizard] UI element placement errors
• #48358 DefaultCopilotVersion drifts past compat.json max-agent, forcing a network install on every job and disabling the toolcache path
• #43189 ^Gll: + write-only scope expands to invalid id-token: read in generated lock file

11 issues reported

• #51114 [deep-report] Investigate why the image/container/digest Copilot PR cluster has the lowest merge rate (58.8% vs 74.3% fleet average)
• #38226 [awf-feature-surfacing] AWF surfacing gaps: conditional if: imports, dangerously-disable-sandbox-agent flag, and create_issue body minLength
• #31288 [community-attribution] Workflow execution blocker: sandbox prevents data processing scripts

9 issues reported

• #23643 defect: YAML indentation bug in compiler causes job permissions block to be mis-indented
• #23093 BUG: 'GH_HOST' set with GITHUB_OUTPUT (not env or env-threaded), breaking Process Safe Outputs on GHES
• #23092 BUG: Downstream 'GH_AW_SAFE_OUTPUTS_CONFIG_PATH' and 'GH_AW_SAFE_OUTPUTS_TOOLS_PATH' variables not available as env vars due to GITHUB_OUTPUT-only write

9 issues reported

• #62712 checkout: entry for the workflow's own repo is indistinguishable from $GITHUB_WORKSPACE in the agent prompt
• #54052 copilot/auto has no catalog pricing, so the zero-config default 400s intermittently
• #51843 Cached Copilot CLI activation skips the /usr/local/bin wrapper, so agent spawn fails with ENOENT

14 issues reported

• #50905 safe-outputs checkout auto-detection downgrades contents: write to read
• #43021 SideRepoOps maintenance workflow ignores github-app checkout auth and falls back to unset GH_AW_GITHUB_TOKEN
• #34998 safe_outputs add_comment hard-fails on locked source PR (pr-docs-check recurring failures)

5 issues reported

• #59512 push-to-pull-request-branch omits PR read permission when fallback is disabled
• #59274 report_incomplete leaves workflow green when the agent exits 0
• #58458 docker-sudo-iptables loses setup-ruby PATH before AWF

10 issues reported

• #50835 update_project pages all ProjectV2 items and forces overly broad fine-grained PAT repo access
• #50538 jobs.*.permissions.id-token dropped from compiled lock for safe_outputs and conclusion
• #50282 Safe-outputs allowed-teams ignored and mentions sanitized because of wrong github token

6 issues reported

• #25199 Configurable or documented runs-on for generated agentics maintenance workflow (self-hosted fleets)
• #23485 Generated jobs lack a compile-stable runner override/inheritance mechanism
• #23484 Compiled can omit custom safe-output tools/jobs

5 issues reported

• #30047 Workflow body parameters?
• #29310 Replace repo-memory patch size limit with a rate limit over time
• #28867 Only push repo memory on success

43 issues reported

• #67175 Downstream jobs read needs.activation.outputs.target_repo, but activation does not declare it in most workflows
• #67172 agentics-maintenance.yml sets DEBUG: "*" on the forecast step, flooding logs with HTTP internals
• #67157 on.bots entry for the Copilot coding agent is ignored: bot status check requires a collaborator that does not exist

12 issues reported

• #46499 Treat an empty expression-based engine.model as omitted
• #43924 Allow memory (comment-memory / cache-memory / repo-memory) to be consumed by a deterministic job that runs before the agent, for work-planning
• #43918 Allow frontmatter to augment the needs list of any compiler-generated job

5 issues reported

• #66293 Daily AIC guardrail counts completed v0.91.2 runs as zero
• #65963 Daily AIC guardrail reports fallback estimates for cancelled runs as consumed usage
• #63038 add_labels fails calls with more than 10 labels even when add-labels.max is higher

5 issues reported

• #54404 gh aw update does not pull down the latest upstream skills
• #47418 Bug: Permissions block is not supported in custom jobs
• #38969 Bug: safe-outputs::dispatch-workflow does not support cross repo dispatch

5 issues reported

• #49010 update_project: numeric fields are inferred as SINGLE_SELECT and skipped
• #25687 dispatch_workflow handler does not resolve #temporary_id references in input values
• #23777 gh aw update rewrites local imports: to cross-repo paths that fail at runtime

11 issues reported

• #21205 call-workflow is not wired into the consolidated safe_outputs handler-manager path
• #21074 HTTP safe-outputs server does not register generated call-workflow tools
• #21071 call-workflow generated caller jobs omit required permissions: for reusable workflows

5 issues reported

• #54331 allowed-events should constrain the generated PR review tool schema
• #46847 Safeoutputs backend starts after gateway timeout, remains at zero tools, and workflow reports success
• #38900 Top-level environment: frontmatter is not propagated to the detection job

5 issues reported

• #24930 SARIF upload gives "Resource not accessible by integration" error
• #23940 SARIF upload requires additional git commit references
• #23725 create-code-scanning-alert safe-output doesn't seem to work as it should

8 issues reported

• #62994 Allow workflows to narrow safe-output tool schemas (e.g. require per-item fields for add_labels)
• #57792 Support independently pinned threat-detect artifacts
• #56365 Runtime-imported prompt preserves needs output expression literally

8 issues reported

• #51252 Make Docker sandbox the default runtime on GitHub-hosted runners
• #51124 add-labels safe output fails on pull requests with invalid UpdatePullRequestInput mutation
• #35972 Bump firewall to v0.25.58 and gateway to v0.3.22

8 issues reported

• #45755 OTLP OIDC audience auth: id-token: write missing on activation/conclusion/safe_outputs jobs → "Unable to get ACTIONS_ID_TOKEN_REQUEST_URL"
• #33084 push_repo_memory broken on signed-commit rulesets: ls-remote missing gitAuthEnv (regression from #31478)
• #33074 Compound || expressions in prompt markdown body never substitute at runtime (compiler/runtime env-var naming mismatch)

9 issues reported

• #63987 gh-proxy: search-based gh commands still fail with "malformed version" after #58383
• #63223 Copilot installer may activate a cached CLI older than CopilotWebSearchMinVersion while the lock file grants web_search
• #61580 Slash command followed by CRLF is not activated (activation if: lacks '/cmd\r\n' shape)

10 issues reported

• #53062 create-check-run.target is parsed by the compiler and documented, but rejected by the frontmatter schema
• #41551 copilot-cli: process hangs indefinitely after final safe-output is submitted; MCP gateway SSE streams remain open until action-step timeout
• #38859 zizmor: ignore[<audit>] comments emitted by generators are placed on the wrong line — suppression silently fails (regression from #37586)

13 issues reported

• #56652 Safe-outputs JSON serialization escapes && as \u0026\u0026 and breaks compiled workflows
• #56006 gh aw add omits grader evaluator files from packages
• #54075 gh aw update does not install new includes added to an aw.yml

5 issues reported

• #47765 Compile drops container digest pin: cli-proxy:0.27.11 missing from baked default pin table (v0.81.6)
• #39764 actions-lock.json firewall container pins drift from compiled .lock.yml (never bumped to the CLI's bundled AWF version)
• #38782 logs: all-workflows mode stops pagination when a batch filters to zero (skipped/cancelled-only), silently truncating results in high-CI-volume repos

7 issues reported

• #32271 push_to_pull_request_branch: merge commits blocked by both signed and unsigned push paths
• #32069 safe_outputs: git fetch fails when bundle targets the currently checked-out branch
• #31600 Bundle transport still fails in shallow checkout: git fetch rejects bundle prerequisites

6 issues reported

• #65061 push_to_pull_request_branch: explicit target not consumed; error names the "triggering" default instead
• #65060 run wedges silently on an MCP tool call: no timeout, no classified error, step just ends
• #65059 safe-output transport JSON decode fails with EOF parse error on larger bodies; retry limit exhausted

11 issues reported

• #61490 Copilot harness classifies AWF max_cache_misses_exceeded HTTP 403 as authentication_failed and retries the spent proxy; detection job surfaces nothing
• #61489 Threat detection ignores max-turn-cache-misses; detection always runs at the compile-time default (5)
• #54626 sandbox filesystem.allowWrite grants tool permissions instead of restricting writes (contradicts schema description)

10 issues reported

• #50923 Action-failure expiry does not trigger maintenance workflow generation
• #50922 slash_command job gate rejects leading whitespace accepted by runtime matcher
• #50616 Safe-output artifacts can expose base64 CI trigger tokens

5 issues reported

• #54597 v0.87.2 external threat-detect: detection step lost its timeout-minutes, and its AWF install lost --rootless
• #51383 Agent sandbox enforces an invisible, unconfigurable process ceiling — concurrent JVM builds die with thread-creation failures
• #51248 gh-aw-firewall/{agent,api-proxy,squid} emitted tag-only in v0.86.1 lock files (regression of #43307 / #38561)

30 issues reported

• #33016 Generated locks emit secret-shaped dummy COPILOT_API_KEY value
• #33015 tools.github.allowed-repos cannot express current repository for generated workflows
• #24756 gh-aw treats a comment-based review verdict as successful even when the agent only reported tool failures

7 issues reported

• #61144 How do I select an agent provided by an installed Agent Plugin?
• #55797 Support target-only checkout for MultiRepoOps
• #55775 Support authenticated Agent Plugin installation from private repositories

16 issues reported

• #52161 BUG: on a non-default-branch workflow_dispatch, generate_git_patch bases the patch on the default branch instead of GITHUB_SHA
• #52140 BUG: v0.86.2 does not fix #51433 — --allow-host-service-ports is inert because legacy-security never leaves network-isolation mode (your smoke-service-ports test cannot pass)
• #51433 BUG: services: ports are unreachable from the sandboxed agent — --allow-host-ports is hardcoded and allowHostServicePorts is never emitted

7 issues reported

• #66740 audit: sub-agent attribution is guessed from agent-stdio.log, so real sub-agents and their spend are invisible
• #66716 Safe outputs: blank optional fields (e.g. create_pull_request stack_position: "") get MCP "success" but are rejected by the collector, dropping the output
• #66715 pi engine silently ignores inline sub-agents and their models; agent fakes delegation on the main model

6 issues reported

• #22939 BUG: AWF agent cannot reach Postgres started via services:
• #19640 Bug: gh aw upgrade wraps uses value in quotes, including the inline comment
• #19622 Bug: gh aw upgrade and gh aw compile produce different lock files — toggle endlessly

6 issues reported

• #44951 safe_outputs: support local body file references with strict runtime safeguards
• #44842 SM-IS-01 maxLength exemption missing from body/content fields across most tools — follow-up to #43867
• #43867 create_discussion and create_issue body fields silently capped at 10 KB — missing maxLength to opt out of SM-IS-01 global cap (cf. add_comment)

48 issues reported

• #51723 Skip ripgrep apt install when rg is already available on custom runners
• #51513 upload-asset: concurrent runs race on the shared assets branch (single non-retried push)
• #51373 Copilot engine: spawn /usr/local/bin/copilot ENOENT on tool-cache hit (installer skips wrapper when GITHUB_PATH is set)

28 issues reported

• #66203 Threat detection inherits the main engine's provider env when it runs on a different engine
• #63221 Successful 200 NONE_NONE records produce false firewall blocked-domain warnings
• #62167 claude engine: base-folder restore deletes APM-installed .claude/skills before the agent starts

17 issues reported

• #60021 safe-outputs: find_repo_checkout git-scan fallback cannot see step-cloned repositories inside the container (dubious ownership); error message points at actions/checkout which fails the same way
• #36885 Cache read tokens are reported as 0 in run usage despite cache hits in per-response metadata
• #35446 Sub-agent model selection is ignored and the parent session model is used instead

6 issues reported

• #64021 update-pull-request target from a safe-outputs.needs job output is blanked in the agent config and rejected on workflow_dispatch
• #41039 Sub-agent model: override silently ignored under the Copilot engine
• #39544 Sub-agent model: frontmatter is ignored — sub-agent always runs on parent model

9 issues reported

• #63646 When using Opentelemetry we see the firewall blocked warning
• #60228 Feature Request: Support GH_AW_DEFAULT_OTLP_ENDPOINT as a Secret
• #59213 Request: OTLP empty-secret guard misses Authorization headers with a literal scheme prefix

5 issues reported

• #66424 v0.91.4 MCP gateway docker run drops the gh-aw-mcpg image digest
• #66423 v0.91.4 pin comments "# v9 (source v9.0.0)" fail zizmor ref-version-mismatch
• #65941 shellcheck SC2154 for gh_aw_exit_code in the agent execution step

53 issues reported

• #49424 Non-Copilot stdio/container MCP server env secrets are raw-substituted into gateway JSON config, breaking on quote/backslash characters
• #43846 discussion-task-miner: repo-memory never persists — Step 1/6 write to a subdirectory excluded by the default file-glob
• #39605 Feature: configurable custom OTel resource attributes for observability traces

5 issues reported

• #40156 Don't (incorrectly) assume RUNNER_TOOL_CACHE fallbacks
• #38979 Clean up stale gh-aw containers on self-hosted runners before binding gateway ports
• #35577 engine: expose apiProxy.modelFallback in compiler frontmatter (currently requires lock-file editing to disable middle_power rewrites that break BYOK Azure deployments)

---

Last updated: 2026-10-11 For the complete issue history and all contributors, visit community issues.