diff --git a/.github/workflows/avenger.lock.yml b/.github/workflows/avenger.lock.yml index 092aada6f01..3d6eb6ec67f 100644 --- a/.github/workflows/avenger.lock.yml +++ b/.github/workflows/avenger.lock.yml @@ -1,5 +1,5 @@ # gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"6807590fb97b42c0858f3b0e068f5f2b823e6d3a5a873b1a1652f5658361eb44","body_hash":"e5fd04fe008ba327d939d9aee395ffb802836e30fd1f3772ca36984bdd1478f4","strict":true,"agent_id":"claude","agent_model":"claude-haiku-4.5","engine_versions":{"claude":"2.1.210"}} -# gh-aw-manifest: {"version":1,"secrets":["ANTHROPIC_API_KEY","COPILOT_GITHUB_TOKEN","GH_AW_CI_TRIGGER_TOKEN","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GH_AW_OTEL_GRAFANA_AUTHORIZATION","GH_AW_OTEL_GRAFANA_ENDPOINT","GH_AW_OTEL_SENTRY_AUTHORIZATION","GH_AW_OTEL_SENTRY_ENDPOINT","GITHUB_TOKEN"],"actions":[{"repo":"actions/cache/restore","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/cache/save","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/checkout","sha":"9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0","version":"9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-go","sha":"b7ad1dad31e06c5925ef5d2fc7ad053ef454303e","version":"v7.0.0"},{"repo":"actions/setup-node","sha":"820762786026740c76f36085b0efc47a31fe5020","version":"v7.0.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.27.35","digest":"sha256:2202f63e8650b2b8b0d38033b44a05387b2b71ad3e690c4d23a34786f5462aed","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.27.35@sha256:2202f63e8650b2b8b0d38033b44a05387b2b71ad3e690c4d23a34786f5462aed"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.35","digest":"sha256:755b79d0dfda82bd6b43a208d68666721e504110c5d342a4eeb199802644ff04","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.35@sha256:755b79d0dfda82bd6b43a208d68666721e504110c5d342a4eeb199802644ff04"},{"image":"ghcr.io/github/gh-aw-firewall/cli-proxy:0.27.35","digest":"sha256:fe83cd274636efa9de3f456e2b078fae137328b9bb6ee4986ae510acaef0cec5","pinned_image":"ghcr.io/github/gh-aw-firewall/cli-proxy:0.27.35@sha256:fe83cd274636efa9de3f456e2b078fae137328b9bb6ee4986ae510acaef0cec5"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.27.35","digest":"sha256:f69282ec7b1326ba53891c399cf5b10475c0d3ccf4e1519b33d234a5427b57d3","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.27.35@sha256:f69282ec7b1326ba53891c399cf5b10475c0d3ccf4e1519b33d234a5427b57d3"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.4.1","digest":"sha256:ad2a979c2cd8b50098e84938ca9c9c1580eb8e91526f101a90adfba7859b2c32","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.4.1@sha256:ad2a979c2cd8b50098e84938ca9c9c1580eb8e91526f101a90adfba7859b2c32"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b","pinned_image":"ghcr.io/github/gh-aw-node@sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b"},{"image":"ghcr.io/github/github-mcp-server:v1.6.0","digest":"sha256:2b0c48b070f61e9d3969269ead600f62d00fb237b60ac849ef3d166ee7de9ad3","pinned_image":"ghcr.io/github/github-mcp-server:v1.6.0@sha256:2b0c48b070f61e9d3969269ead600f62d00fb237b60ac849ef3d166ee7de9ad3"}]} +# gh-aw-manifest: {"version":1,"secrets":["ANTHROPIC_API_KEY","COPILOT_GITHUB_TOKEN","GH_AW_CI_TRIGGER_TOKEN","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GH_AW_OTEL_GRAFANA_AUTHORIZATION","GH_AW_OTEL_GRAFANA_ENDPOINT","GH_AW_OTEL_SENTRY_AUTHORIZATION","GH_AW_OTEL_SENTRY_ENDPOINT","GITHUB_TOKEN"],"actions":[{"repo":"actions/cache/restore","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/cache/save","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/checkout","sha":"9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0","version":"v7.0.0"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-go","sha":"b7ad1dad31e06c5925ef5d2fc7ad053ef454303e","version":"v7.0.0"},{"repo":"actions/setup-node","sha":"820762786026740c76f36085b0efc47a31fe5020","version":"v7.0.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.27.35","digest":"sha256:2202f63e8650b2b8b0d38033b44a05387b2b71ad3e690c4d23a34786f5462aed","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.27.35@sha256:2202f63e8650b2b8b0d38033b44a05387b2b71ad3e690c4d23a34786f5462aed"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.35","digest":"sha256:755b79d0dfda82bd6b43a208d68666721e504110c5d342a4eeb199802644ff04","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.35@sha256:755b79d0dfda82bd6b43a208d68666721e504110c5d342a4eeb199802644ff04"},{"image":"ghcr.io/github/gh-aw-firewall/cli-proxy:0.27.35","digest":"sha256:fe83cd274636efa9de3f456e2b078fae137328b9bb6ee4986ae510acaef0cec5","pinned_image":"ghcr.io/github/gh-aw-firewall/cli-proxy:0.27.35@sha256:fe83cd274636efa9de3f456e2b078fae137328b9bb6ee4986ae510acaef0cec5"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.27.35","digest":"sha256:f69282ec7b1326ba53891c399cf5b10475c0d3ccf4e1519b33d234a5427b57d3","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.27.35@sha256:f69282ec7b1326ba53891c399cf5b10475c0d3ccf4e1519b33d234a5427b57d3"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.4.1","digest":"sha256:ad2a979c2cd8b50098e84938ca9c9c1580eb8e91526f101a90adfba7859b2c32","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.4.1@sha256:ad2a979c2cd8b50098e84938ca9c9c1580eb8e91526f101a90adfba7859b2c32"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b","pinned_image":"ghcr.io/github/gh-aw-node@sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b"},{"image":"ghcr.io/github/github-mcp-server:v1.6.0","digest":"sha256:2b0c48b070f61e9d3969269ead600f62d00fb237b60ac849ef3d166ee7de9ad3","pinned_image":"ghcr.io/github/github-mcp-server:v1.6.0@sha256:2b0c48b070f61e9d3969269ead600f62d00fb237b60ac849ef3d166ee7de9ad3"}]} # This file was automatically generated by gh-aw. DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md # # ___ _ _ @@ -44,7 +44,6 @@ # Custom actions used: # - actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 # - actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 -# - actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # 9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # - actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 # - actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 # - actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 @@ -1146,7 +1145,7 @@ jobs: GH_HOST="${GH_HOST#http://}" echo "GH_HOST=${GH_HOST}" >> "$GITHUB_ENV" - name: Checkout repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # 9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false - name: Check last CI workflow run status on main branch diff --git a/.github/workflows/hourly-ci-cleaner.lock.yml b/.github/workflows/hourly-ci-cleaner.lock.yml index 7fbc3953765..4c96d7c4a51 100644 --- a/.github/workflows/hourly-ci-cleaner.lock.yml +++ b/.github/workflows/hourly-ci-cleaner.lock.yml @@ -1,5 +1,5 @@ # gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"8b86cc12904088cf1b7630e0faa28299f64081df184a028b6293cb4f8bfdd07d","body_hash":"8eb6f8fd1e8e3d63cfd268226d09333129d49634435ae9a3c88debb099521ed5","strict":true,"agent_id":"claude","engine_versions":{"claude":"2.1.210"}} -# gh-aw-manifest: {"version":1,"secrets":["ANTHROPIC_API_KEY","COPILOT_GITHUB_TOKEN","GH_AW_CI_TRIGGER_TOKEN","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GH_AW_OTEL_GRAFANA_AUTHORIZATION","GH_AW_OTEL_GRAFANA_ENDPOINT","GH_AW_OTEL_SENTRY_AUTHORIZATION","GH_AW_OTEL_SENTRY_ENDPOINT","GITHUB_TOKEN"],"actions":[{"repo":"actions/cache/restore","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/cache/save","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/checkout","sha":"9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0","version":"9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-go","sha":"b7ad1dad31e06c5925ef5d2fc7ad053ef454303e","version":"v7.0.0"},{"repo":"actions/setup-node","sha":"820762786026740c76f36085b0efc47a31fe5020","version":"v7.0.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.27.35","digest":"sha256:2202f63e8650b2b8b0d38033b44a05387b2b71ad3e690c4d23a34786f5462aed","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.27.35@sha256:2202f63e8650b2b8b0d38033b44a05387b2b71ad3e690c4d23a34786f5462aed"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.35","digest":"sha256:755b79d0dfda82bd6b43a208d68666721e504110c5d342a4eeb199802644ff04","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.35@sha256:755b79d0dfda82bd6b43a208d68666721e504110c5d342a4eeb199802644ff04"},{"image":"ghcr.io/github/gh-aw-firewall/cli-proxy:0.27.35","digest":"sha256:fe83cd274636efa9de3f456e2b078fae137328b9bb6ee4986ae510acaef0cec5","pinned_image":"ghcr.io/github/gh-aw-firewall/cli-proxy:0.27.35@sha256:fe83cd274636efa9de3f456e2b078fae137328b9bb6ee4986ae510acaef0cec5"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.27.35","digest":"sha256:f69282ec7b1326ba53891c399cf5b10475c0d3ccf4e1519b33d234a5427b57d3","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.27.35@sha256:f69282ec7b1326ba53891c399cf5b10475c0d3ccf4e1519b33d234a5427b57d3"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.4.1","digest":"sha256:ad2a979c2cd8b50098e84938ca9c9c1580eb8e91526f101a90adfba7859b2c32","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.4.1@sha256:ad2a979c2cd8b50098e84938ca9c9c1580eb8e91526f101a90adfba7859b2c32"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b","pinned_image":"ghcr.io/github/gh-aw-node@sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b"},{"image":"ghcr.io/github/github-mcp-server:v1.6.0","digest":"sha256:2b0c48b070f61e9d3969269ead600f62d00fb237b60ac849ef3d166ee7de9ad3","pinned_image":"ghcr.io/github/github-mcp-server:v1.6.0@sha256:2b0c48b070f61e9d3969269ead600f62d00fb237b60ac849ef3d166ee7de9ad3"}]} +# gh-aw-manifest: {"version":1,"secrets":["ANTHROPIC_API_KEY","COPILOT_GITHUB_TOKEN","GH_AW_CI_TRIGGER_TOKEN","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GH_AW_OTEL_GRAFANA_AUTHORIZATION","GH_AW_OTEL_GRAFANA_ENDPOINT","GH_AW_OTEL_SENTRY_AUTHORIZATION","GH_AW_OTEL_SENTRY_ENDPOINT","GITHUB_TOKEN"],"actions":[{"repo":"actions/cache/restore","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/cache/save","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/checkout","sha":"9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0","version":"v7.0.0"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-go","sha":"b7ad1dad31e06c5925ef5d2fc7ad053ef454303e","version":"v7.0.0"},{"repo":"actions/setup-node","sha":"820762786026740c76f36085b0efc47a31fe5020","version":"v7.0.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.27.35","digest":"sha256:2202f63e8650b2b8b0d38033b44a05387b2b71ad3e690c4d23a34786f5462aed","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.27.35@sha256:2202f63e8650b2b8b0d38033b44a05387b2b71ad3e690c4d23a34786f5462aed"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.35","digest":"sha256:755b79d0dfda82bd6b43a208d68666721e504110c5d342a4eeb199802644ff04","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.35@sha256:755b79d0dfda82bd6b43a208d68666721e504110c5d342a4eeb199802644ff04"},{"image":"ghcr.io/github/gh-aw-firewall/cli-proxy:0.27.35","digest":"sha256:fe83cd274636efa9de3f456e2b078fae137328b9bb6ee4986ae510acaef0cec5","pinned_image":"ghcr.io/github/gh-aw-firewall/cli-proxy:0.27.35@sha256:fe83cd274636efa9de3f456e2b078fae137328b9bb6ee4986ae510acaef0cec5"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.27.35","digest":"sha256:f69282ec7b1326ba53891c399cf5b10475c0d3ccf4e1519b33d234a5427b57d3","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.27.35@sha256:f69282ec7b1326ba53891c399cf5b10475c0d3ccf4e1519b33d234a5427b57d3"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.4.1","digest":"sha256:ad2a979c2cd8b50098e84938ca9c9c1580eb8e91526f101a90adfba7859b2c32","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.4.1@sha256:ad2a979c2cd8b50098e84938ca9c9c1580eb8e91526f101a90adfba7859b2c32"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b","pinned_image":"ghcr.io/github/gh-aw-node@sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b"},{"image":"ghcr.io/github/github-mcp-server:v1.6.0","digest":"sha256:2b0c48b070f61e9d3969269ead600f62d00fb237b60ac849ef3d166ee7de9ad3","pinned_image":"ghcr.io/github/github-mcp-server:v1.6.0@sha256:2b0c48b070f61e9d3969269ead600f62d00fb237b60ac849ef3d166ee7de9ad3"}]} # This file was automatically generated by gh-aw. DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md # # ___ _ _ @@ -45,7 +45,6 @@ # Custom actions used: # - actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 # - actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 -# - actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # 9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # - actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 # - actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 # - actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 @@ -1153,7 +1152,7 @@ jobs: GH_HOST="${GH_HOST#http://}" echo "GH_HOST=${GH_HOST}" >> "$GITHUB_ENV" - name: Checkout repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # 9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false - name: Check last CI workflow run status on main branch diff --git a/.github/workflows/release.lock.yml b/.github/workflows/release.lock.yml index 279d407502e..b670dfbb32e 100644 --- a/.github/workflows/release.lock.yml +++ b/.github/workflows/release.lock.yml @@ -1,5 +1,5 @@ # gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"2d6e82aec6fea9061e1ef1cbb085324e6ed6c079230d70bbbb96611bb18cf7cf","body_hash":"646353d7bb4e5523bc85349c2cce38188190095a303f83cc95961ff145a47043","strict":true,"agent_id":"copilot","engine_versions":{"copilot":"1.0.70"}} -# gh-aw-manifest: {"version":1,"secrets":["COPILOT_GITHUB_TOKEN","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GH_AW_OTEL_GRAFANA_AUTHORIZATION","GH_AW_OTEL_GRAFANA_ENDPOINT","GH_AW_OTEL_SENTRY_AUTHORIZATION","GH_AW_OTEL_SENTRY_ENDPOINT","GITHUB_TOKEN"],"actions":[{"repo":"actions/cache/restore","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/cache/save","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/checkout","sha":"9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0","version":"v7.0.0"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-go","sha":"b7ad1dad31e06c5925ef5d2fc7ad053ef454303e","version":"b7ad1dad31e06c5925ef5d2fc7ad053ef454303e"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"},{"repo":"anchore/sbom-action","sha":"e22c389904149dbc22b58101806040fa8d37a610","version":"v0.24.0"},{"repo":"docker/build-push-action","sha":"53b7df96c91f9c12dcc8a07bcb9ccacbed38856a","version":"v7.3.0"},{"repo":"docker/login-action","sha":"af1e73f918a031802d376d3c8bbc3fe56130a9b0","version":"v4.4.0"},{"repo":"docker/metadata-action","sha":"dc802804100637a589fabce1cb79ff13a1411302","version":"v6.2.0"},{"repo":"docker/setup-buildx-action","sha":"bb05f3f5519dd87d3ba754cc423b652a5edd6d2c","version":"v4.2.0"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.27.35","digest":"sha256:2202f63e8650b2b8b0d38033b44a05387b2b71ad3e690c4d23a34786f5462aed","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.27.35@sha256:2202f63e8650b2b8b0d38033b44a05387b2b71ad3e690c4d23a34786f5462aed"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.35","digest":"sha256:755b79d0dfda82bd6b43a208d68666721e504110c5d342a4eeb199802644ff04","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.35@sha256:755b79d0dfda82bd6b43a208d68666721e504110c5d342a4eeb199802644ff04"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.27.35","digest":"sha256:f69282ec7b1326ba53891c399cf5b10475c0d3ccf4e1519b33d234a5427b57d3","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.27.35@sha256:f69282ec7b1326ba53891c399cf5b10475c0d3ccf4e1519b33d234a5427b57d3"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.4.1","digest":"sha256:ad2a979c2cd8b50098e84938ca9c9c1580eb8e91526f101a90adfba7859b2c32","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.4.1@sha256:ad2a979c2cd8b50098e84938ca9c9c1580eb8e91526f101a90adfba7859b2c32"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b","pinned_image":"ghcr.io/github/gh-aw-node@sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b"},{"image":"ghcr.io/github/github-mcp-server:v1.6.0","digest":"sha256:2b0c48b070f61e9d3969269ead600f62d00fb237b60ac849ef3d166ee7de9ad3","pinned_image":"ghcr.io/github/github-mcp-server:v1.6.0@sha256:2b0c48b070f61e9d3969269ead600f62d00fb237b60ac849ef3d166ee7de9ad3"}]} +# gh-aw-manifest: {"version":1,"secrets":["COPILOT_GITHUB_TOKEN","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GH_AW_OTEL_GRAFANA_AUTHORIZATION","GH_AW_OTEL_GRAFANA_ENDPOINT","GH_AW_OTEL_SENTRY_AUTHORIZATION","GH_AW_OTEL_SENTRY_ENDPOINT","GITHUB_TOKEN"],"actions":[{"repo":"actions/cache/restore","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/cache/save","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/checkout","sha":"9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0","version":"v7.0.0"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-go","sha":"b7ad1dad31e06c5925ef5d2fc7ad053ef454303e","version":"v7.0.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"},{"repo":"anchore/sbom-action","sha":"e22c389904149dbc22b58101806040fa8d37a610","version":"v0.24.0"},{"repo":"docker/build-push-action","sha":"53b7df96c91f9c12dcc8a07bcb9ccacbed38856a","version":"v7.3.0"},{"repo":"docker/login-action","sha":"af1e73f918a031802d376d3c8bbc3fe56130a9b0","version":"v4.4.0"},{"repo":"docker/metadata-action","sha":"dc802804100637a589fabce1cb79ff13a1411302","version":"v6.2.0"},{"repo":"docker/setup-buildx-action","sha":"bb05f3f5519dd87d3ba754cc423b652a5edd6d2c","version":"v4.2.0"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.27.35","digest":"sha256:2202f63e8650b2b8b0d38033b44a05387b2b71ad3e690c4d23a34786f5462aed","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.27.35@sha256:2202f63e8650b2b8b0d38033b44a05387b2b71ad3e690c4d23a34786f5462aed"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.35","digest":"sha256:755b79d0dfda82bd6b43a208d68666721e504110c5d342a4eeb199802644ff04","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.35@sha256:755b79d0dfda82bd6b43a208d68666721e504110c5d342a4eeb199802644ff04"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.27.35","digest":"sha256:f69282ec7b1326ba53891c399cf5b10475c0d3ccf4e1519b33d234a5427b57d3","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.27.35@sha256:f69282ec7b1326ba53891c399cf5b10475c0d3ccf4e1519b33d234a5427b57d3"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.4.1","digest":"sha256:ad2a979c2cd8b50098e84938ca9c9c1580eb8e91526f101a90adfba7859b2c32","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.4.1@sha256:ad2a979c2cd8b50098e84938ca9c9c1580eb8e91526f101a90adfba7859b2c32"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b","pinned_image":"ghcr.io/github/gh-aw-node@sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b"},{"image":"ghcr.io/github/github-mcp-server:v1.6.0","digest":"sha256:2b0c48b070f61e9d3969269ead600f62d00fb237b60ac849ef3d166ee7de9ad3","pinned_image":"ghcr.io/github/github-mcp-server:v1.6.0@sha256:2b0c48b070f61e9d3969269ead600f62d00fb237b60ac849ef3d166ee7de9ad3"}]} # This file was automatically generated by gh-aw. DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md # # ___ _ _ @@ -47,7 +47,7 @@ # - actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 # - actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 # - actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 (source v9) -# - actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # b7ad1dad31e06c5925ef5d2fc7ad053ef454303e +# - actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 # - actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 # - anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0 # - docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 @@ -1949,7 +1949,7 @@ jobs: env: RELEASE_TAG: ${{ needs.config.outputs.release_tag }} - name: Setup Go - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # b7ad1dad31e06c5925ef5d2fc7ad053ef454303e + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: cache: false go-version-file: go.mod diff --git a/.github/workflows/skillet.lock.yml b/.github/workflows/skillet.lock.yml index 8d7320c75be..81a6ce1825b 100644 --- a/.github/workflows/skillet.lock.yml +++ b/.github/workflows/skillet.lock.yml @@ -1,5 +1,5 @@ # gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"2b7791e73899163b45a0881db45f5747495a6a7dbd2dc4e17f3f31af4ecf6898","body_hash":"ff6f6b1fbf4788ce998b5ddca9ed8f907259189ec1db98a5cd9768e4e0ed2f50","strict":true,"agent_id":"copilot","engine_versions":{"copilot":"1.0.70"}} -# gh-aw-manifest: {"version":1,"secrets":["COPILOT_GITHUB_TOKEN","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GH_AW_OTEL_GRAFANA_AUTHORIZATION","GH_AW_OTEL_GRAFANA_ENDPOINT","GH_AW_OTEL_SENTRY_AUTHORIZATION","GH_AW_OTEL_SENTRY_ENDPOINT","GITHUB_TOKEN"],"actions":[{"repo":"actions/cache/restore","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/cache/save","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/checkout","sha":"9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0","version":"9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"3a2844b7e9c422d3c10d287c895573f7108da1b3"},{"repo":"actions/setup-node","sha":"820762786026740c76f36085b0efc47a31fe5020","version":"v7.0.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.27.35","digest":"sha256:2202f63e8650b2b8b0d38033b44a05387b2b71ad3e690c4d23a34786f5462aed","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.27.35@sha256:2202f63e8650b2b8b0d38033b44a05387b2b71ad3e690c4d23a34786f5462aed"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.35","digest":"sha256:755b79d0dfda82bd6b43a208d68666721e504110c5d342a4eeb199802644ff04","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.35@sha256:755b79d0dfda82bd6b43a208d68666721e504110c5d342a4eeb199802644ff04"},{"image":"ghcr.io/github/gh-aw-firewall/cli-proxy:0.27.35","digest":"sha256:fe83cd274636efa9de3f456e2b078fae137328b9bb6ee4986ae510acaef0cec5","pinned_image":"ghcr.io/github/gh-aw-firewall/cli-proxy:0.27.35@sha256:fe83cd274636efa9de3f456e2b078fae137328b9bb6ee4986ae510acaef0cec5"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.27.35","digest":"sha256:f69282ec7b1326ba53891c399cf5b10475c0d3ccf4e1519b33d234a5427b57d3","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.27.35@sha256:f69282ec7b1326ba53891c399cf5b10475c0d3ccf4e1519b33d234a5427b57d3"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.4.1","digest":"sha256:ad2a979c2cd8b50098e84938ca9c9c1580eb8e91526f101a90adfba7859b2c32","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.4.1@sha256:ad2a979c2cd8b50098e84938ca9c9c1580eb8e91526f101a90adfba7859b2c32"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b","pinned_image":"ghcr.io/github/gh-aw-node@sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b"},{"image":"ghcr.io/github/github-mcp-server:v1.6.0","digest":"sha256:2b0c48b070f61e9d3969269ead600f62d00fb237b60ac849ef3d166ee7de9ad3","pinned_image":"ghcr.io/github/github-mcp-server:v1.6.0@sha256:2b0c48b070f61e9d3969269ead600f62d00fb237b60ac849ef3d166ee7de9ad3"}]} +# gh-aw-manifest: {"version":1,"secrets":["COPILOT_GITHUB_TOKEN","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GH_AW_OTEL_GRAFANA_AUTHORIZATION","GH_AW_OTEL_GRAFANA_ENDPOINT","GH_AW_OTEL_SENTRY_AUTHORIZATION","GH_AW_OTEL_SENTRY_ENDPOINT","GITHUB_TOKEN"],"actions":[{"repo":"actions/cache/restore","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/cache/save","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/checkout","sha":"9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0","version":"v7.0.0"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"3a2844b7e9c422d3c10d287c895573f7108da1b3"},{"repo":"actions/setup-node","sha":"820762786026740c76f36085b0efc47a31fe5020","version":"v7.0.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.27.35","digest":"sha256:2202f63e8650b2b8b0d38033b44a05387b2b71ad3e690c4d23a34786f5462aed","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.27.35@sha256:2202f63e8650b2b8b0d38033b44a05387b2b71ad3e690c4d23a34786f5462aed"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.35","digest":"sha256:755b79d0dfda82bd6b43a208d68666721e504110c5d342a4eeb199802644ff04","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.35@sha256:755b79d0dfda82bd6b43a208d68666721e504110c5d342a4eeb199802644ff04"},{"image":"ghcr.io/github/gh-aw-firewall/cli-proxy:0.27.35","digest":"sha256:fe83cd274636efa9de3f456e2b078fae137328b9bb6ee4986ae510acaef0cec5","pinned_image":"ghcr.io/github/gh-aw-firewall/cli-proxy:0.27.35@sha256:fe83cd274636efa9de3f456e2b078fae137328b9bb6ee4986ae510acaef0cec5"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.27.35","digest":"sha256:f69282ec7b1326ba53891c399cf5b10475c0d3ccf4e1519b33d234a5427b57d3","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.27.35@sha256:f69282ec7b1326ba53891c399cf5b10475c0d3ccf4e1519b33d234a5427b57d3"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.4.1","digest":"sha256:ad2a979c2cd8b50098e84938ca9c9c1580eb8e91526f101a90adfba7859b2c32","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.4.1@sha256:ad2a979c2cd8b50098e84938ca9c9c1580eb8e91526f101a90adfba7859b2c32"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b","pinned_image":"ghcr.io/github/gh-aw-node@sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b"},{"image":"ghcr.io/github/github-mcp-server:v1.6.0","digest":"sha256:2b0c48b070f61e9d3969269ead600f62d00fb237b60ac849ef3d166ee7de9ad3","pinned_image":"ghcr.io/github/github-mcp-server:v1.6.0@sha256:2b0c48b070f61e9d3969269ead600f62d00fb237b60ac849ef3d166ee7de9ad3"}]} # This file was automatically generated by gh-aw. DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md # # ___ _ _ @@ -45,7 +45,6 @@ # Custom actions used: # - actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 # - actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 -# - actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # 9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # - actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 # - actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 # - actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 @@ -1728,7 +1727,7 @@ jobs: GH_AW_INFO_AWF_VERSION: "v0.27.35" GH_AW_INFO_ENGINE_ID: "copilot" - name: Checkout skills directory - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # 9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false sparse-checkout: | diff --git a/actions/setup/js/action_setup_otlp.cjs b/actions/setup/js/action_setup_otlp.cjs index 04c80d3bf5d..bd4d764159b 100644 --- a/actions/setup/js/action_setup_otlp.cjs +++ b/actions/setup/js/action_setup_otlp.cjs @@ -40,8 +40,12 @@ const { getActionInput } = require("./action_input_utils.cjs"); */ function writeEnvLine(filePath, key, value, logLabel, fileLabel) { if (!filePath || !value) return; - appendFileSync(filePath, `${key}=${value}\n`); - console.log(`[otlp] ${logLabel} written to ${fileLabel}`); + try { + appendFileSync(filePath, `${key}=${value}\n`); + console.log(`[otlp] ${logLabel} written to ${fileLabel}`); + } catch { + /* ignore */ + } } /** diff --git a/actions/setup/js/apply_safe_outputs_replay.cjs b/actions/setup/js/apply_safe_outputs_replay.cjs index 72b68fa52e4..6882074d5ae 100644 --- a/actions/setup/js/apply_safe_outputs_replay.cjs +++ b/actions/setup/js/apply_safe_outputs_replay.cjs @@ -70,7 +70,11 @@ function parseRunUrl(runUrl) { async function downloadAgentArtifact(runId, destDir, repoSlug) { core.info(`Downloading agent artifact from run ${runId}...`); - fs.mkdirSync(destDir, { recursive: true }); + try { + fs.mkdirSync(destDir, { recursive: true }); + } catch (err) { + throw new Error(`Failed to create directory ${destDir}: ${String(err)}`, { cause: err }); + } const args = ["run", "download", runId, "--name", "agent", "--dir", destDir]; if (repoSlug) { @@ -99,7 +103,12 @@ async function downloadAgentArtifact(runId, destDir, repoSlug) { * @returns {Object} Handler config keyed by normalized type name */ function buildHandlerConfigFromOutput(agentOutputFile) { - const content = fs.readFileSync(agentOutputFile, "utf8"); + let content; + try { + content = fs.readFileSync(agentOutputFile, "utf8"); + } catch (err) { + throw new Error(`Failed to read file ${agentOutputFile}: ${String(err)}`, { cause: err }); + } let validatedOutput; try { validatedOutput = JSON.parse(content); diff --git a/actions/setup/js/apply_samples.cjs b/actions/setup/js/apply_samples.cjs index 55f9b74ad21..10d2a91b1ab 100644 --- a/actions/setup/js/apply_samples.cjs +++ b/actions/setup/js/apply_samples.cjs @@ -403,7 +403,11 @@ async function preStagePatch(entry, index, workspace) { // Write patch to a temp file and apply it. const tmpPatch = path.join(os.tmpdir(), `gh-aw-sample-${index + 1}.patch`); - fs.writeFileSync(tmpPatch, patch.endsWith("\n") ? patch : patch + "\n"); + try { + fs.writeFileSync(tmpPatch, patch.endsWith("\n") ? patch : patch + "\n"); + } catch (err) { + throw new Error(`Failed to write file ${tmpPatch}: ${String(err)}`, { cause: err }); + } try { runGit(["apply", "--whitespace=nowarn", tmpPatch], repoCwd); } catch (err) { @@ -539,7 +543,11 @@ function writeSyntheticStdioLog(logPath, sampleCount) { }), "", ]; - fs.appendFileSync(logPath, lines.join("\n")); + try { + fs.appendFileSync(logPath, lines.join("\n")); + } catch { + /* ignore */ + } } async function main() { diff --git a/actions/setup/js/artifact_client.cjs b/actions/setup/js/artifact_client.cjs index ebeb9dd872d..cb6b51f4a4b 100644 --- a/actions/setup/js/artifact_client.cjs +++ b/actions/setup/js/artifact_client.cjs @@ -291,7 +291,11 @@ class DefaultArtifactClient { } const destination = options.path || process.env.GITHUB_WORKSPACE || process.cwd(); - fs.mkdirSync(destination, { recursive: true }); + try { + fs.mkdirSync(destination, { recursive: true }); + } catch (err) { + throw new Error(`Failed to create directory ${destination}: ${String(err)}`, { cause: err }); + } const apiUrl = new URL(`/repos/${findBy.repositoryOwner}/${findBy.repositoryName}/actions/artifacts/${artifactId}/zip`, process.env.GITHUB_API_URL || "https://api.github.com"); const redirectResponse = await fetch(apiUrl.toString(), { diff --git a/actions/setup/js/build_checkout_manifest.cjs b/actions/setup/js/build_checkout_manifest.cjs index 3db58ce5c0d..e1d21aa5f9a 100644 --- a/actions/setup/js/build_checkout_manifest.cjs +++ b/actions/setup/js/build_checkout_manifest.cjs @@ -97,7 +97,11 @@ function buildCheckoutManifest(entries, options = {}) { // $RUNNER_TEMP/gh-aw that is bind-mounted into the containerized safe-outputs // MCP server, which is where the manifest is read by findRepoCheckout. const manifestDir = path.join(runnerTemp, "gh-aw", "safeoutputs"); - fs.mkdirSync(manifestDir, { recursive: true }); + try { + fs.mkdirSync(manifestDir, { recursive: true }); + } catch (err) { + throw new Error(`Failed to create directory ${manifestDir}: ${String(err)}`, { cause: err }); + } const manifestPath = path.join(manifestDir, "checkout-manifest.json"); const manifest = {}; core.info(`checkout-manifest: building manifest for ${entries.length} checkout entries`); @@ -127,7 +131,11 @@ function buildCheckoutManifest(entries, options = {}) { core.info(`checkout-manifest: ${repository} -> path=${checkoutPath} default_branch=${defaultBranch || ""}`); } - fs.writeFileSync(manifestPath, JSON.stringify(manifest, null, 2) + "\n", "utf8"); + try { + fs.writeFileSync(manifestPath, JSON.stringify(manifest, null, 2) + "\n", "utf8"); + } catch (err) { + throw new Error(`Failed to write file ${manifestPath}: ${String(err)}`, { cause: err }); + } core.info(`checkout-manifest written to ${manifestPath}`); return { manifestPath, manifest }; } diff --git a/actions/setup/js/check_workflow_recompile_needed.cjs b/actions/setup/js/check_workflow_recompile_needed.cjs index 1e6a07e7abb..580c5b22565 100644 --- a/actions/setup/js/check_workflow_recompile_needed.cjs +++ b/actions/setup/js/check_workflow_recompile_needed.cjs @@ -107,7 +107,12 @@ async function filterFilesNeedingUpdate(comparisonRef, changedFiles, workspaceDi const filesToUpdate = []; for (const file of changedFiles) { const workingTreePath = `${workspaceDir}/${file}`; - const workingTreeContent = fs.readFileSync(workingTreePath, "utf8"); + let workingTreeContent; + try { + workingTreeContent = fs.readFileSync(workingTreePath, "utf8"); + } catch (err) { + throw new Error(`Failed to read file ${workingTreePath}: ${String(err)}`, { cause: err }); + } const { stdout, exitCode } = await exec.getExecOutput("git", ["show", `${comparisonRef}:${file}`], { ignoreReturnCode: true, }); diff --git a/actions/setup/js/convert_gateway_config_shared.cjs b/actions/setup/js/convert_gateway_config_shared.cjs index ea61e33a5b5..1f079aa7b5f 100644 --- a/actions/setup/js/convert_gateway_config_shared.cjs +++ b/actions/setup/js/convert_gateway_config_shared.cjs @@ -154,9 +154,13 @@ function logServerStats(servers, includedCount) { * @param {string} output */ function writeSecureOutput(outputPath, output) { - fs.mkdirSync(path.dirname(outputPath), { recursive: true }); - fs.writeFileSync(outputPath, output, { mode: 0o600 }); - fs.chmodSync(outputPath, 0o600); + try { + fs.mkdirSync(path.dirname(outputPath), { recursive: true }); + fs.writeFileSync(outputPath, output, { mode: 0o600 }); + fs.chmodSync(outputPath, 0o600); + } catch (err) { + throw new Error(`Failed to write file ${outputPath}: ${String(err)}`, { cause: err }); + } } module.exports = { diff --git a/actions/setup/js/copilot_harness.cjs b/actions/setup/js/copilot_harness.cjs index 8a89c90530b..8e946149a7d 100644 --- a/actions/setup/js/copilot_harness.cjs +++ b/actions/setup/js/copilot_harness.cjs @@ -659,7 +659,11 @@ function writeCopilotOutputs(results) { `model_not_supported_error=${results.modelNotSupportedError}`, `http_400_response_error=${results.http400ResponseError}`, ]; - fs.appendFileSync(outputFile, lines.join("\n") + "\n"); + try { + fs.appendFileSync(outputFile, lines.join("\n") + "\n"); + } catch { + /* ignore */ + } } /** diff --git a/actions/setup/js/create_code_scanning_alert.cjs b/actions/setup/js/create_code_scanning_alert.cjs index 0cd8f43871a..e93c6e7fc9f 100644 --- a/actions/setup/js/create_code_scanning_alert.cjs +++ b/actions/setup/js/create_code_scanning_alert.cjs @@ -86,7 +86,11 @@ async function main(config = {}) { ], }; - fs.writeFileSync(sarifFilePath, JSON.stringify(sarifContent, null, 2)); + try { + fs.writeFileSync(sarifFilePath, JSON.stringify(sarifContent, null, 2)); + } catch (err) { + throw new Error(`Failed to write file ${sarifFilePath}: ${String(err)}`, { cause: err }); + } core.info(`✓ Updated SARIF file with ${validFindings.length} finding(s): ${sarifFilePath}`); } diff --git a/actions/setup/js/create_pull_request.cjs b/actions/setup/js/create_pull_request.cjs index 2be8568300e..e51f74db950 100644 --- a/actions/setup/js/create_pull_request.cjs +++ b/actions/setup/js/create_pull_request.cjs @@ -1143,7 +1143,11 @@ async function main(config = {}) { let patchContent = ""; let isEmpty = true; if (hasPatchFile) { - patchContent = fs.readFileSync(patchFilePath, "utf8"); + try { + patchContent = fs.readFileSync(patchFilePath, "utf8"); + } catch (err) { + throw new Error(`Failed to read file ${patchFilePath}: ${String(err)}`, { cause: err }); + } isEmpty = !patchContent || !patchContent.trim(); } @@ -1341,7 +1345,12 @@ async function main(config = {}) { } if (patchFilePath && fs.existsSync(patchFilePath)) { - const patchStats = fs.readFileSync(patchFilePath, "utf8"); + let patchStats; + try { + patchStats = fs.readFileSync(patchFilePath, "utf8"); + } catch (err) { + throw new Error(`Failed to read file ${patchFilePath}: ${String(err)}`, { cause: err }); + } if (patchStats.trim()) { summaryContent += `**Changes:** Patch file exists with ${patchStats.split("\n").length} lines\n\n`; summaryContent += `
Show patch preview\n\n\`\`\`diff\n${patchStats.slice(0, 2000)}${patchStats.length > 2000 ? "\n... (truncated)" : ""}\n\`\`\`\n\n
\n\n`; @@ -1841,7 +1850,11 @@ gh pr create --title '${title}' --base ${baseBranch} --head ${getPullRequestHead patchContent = replaceTemporaryIdReferencesInPatch(patchContent, tempIdMap, itemRepo); if (patchContent !== originalPatchContent) { core.info("Resolved temporary ID references in patch content"); - fs.writeFileSync(patchFilePath, patchContent, "utf8"); + try { + fs.writeFileSync(patchFilePath, patchContent, "utf8"); + } catch (err) { + throw new Error(`Failed to write file ${patchFilePath}: ${String(err)}`, { cause: err }); + } } } @@ -2075,7 +2088,12 @@ gh pr create --title '${title}' --base ${baseBranch} --head ${getPullRequestHead // Read patch content for preview let patchPreview = ""; if (patchFilePath && fs.existsSync(patchFilePath)) { - const patchContent = fs.readFileSync(patchFilePath, "utf8"); + let patchContent; + try { + patchContent = fs.readFileSync(patchFilePath, "utf8"); + } catch (err) { + throw new Error(`Failed to read file ${patchFilePath}: ${String(err)}`, { cause: err }); + } patchPreview = generatePatchPreview(patchContent); } @@ -2586,7 +2604,12 @@ ${patchPreview}`; // Read patch content for preview let patchPreview = ""; if (patchFilePath && fs.existsSync(patchFilePath)) { - const patchContent = fs.readFileSync(patchFilePath, "utf8"); + let patchContent; + try { + patchContent = fs.readFileSync(patchFilePath, "utf8"); + } catch (err) { + throw new Error(`Failed to read file ${patchFilePath}: ${String(err)}`, { cause: err }); + } patchPreview = generatePatchPreview(patchContent); } @@ -2646,7 +2669,12 @@ ${patchPreview}`; // Read patch content for preview let patchPreview = ""; if (patchFilePath && fs.existsSync(patchFilePath)) { - const patchContent = fs.readFileSync(patchFilePath, "utf8"); + let patchContent; + try { + patchContent = fs.readFileSync(patchFilePath, "utf8"); + } catch (err) { + throw new Error(`Failed to read file ${patchFilePath}: ${String(err)}`, { cause: err }); + } patchPreview = generatePatchPreview(patchContent); } diff --git a/actions/setup/js/daily_aic_workflow_helpers.cjs b/actions/setup/js/daily_aic_workflow_helpers.cjs index 0cc9460a53c..ec1f314f6e0 100644 --- a/actions/setup/js/daily_aic_workflow_helpers.cjs +++ b/actions/setup/js/daily_aic_workflow_helpers.cjs @@ -138,7 +138,12 @@ function sumAICFromUsageJSONLFiles(filePaths) { continue; } - const content = fs.readFileSync(filePath, "utf8"); + let content; + try { + content = fs.readFileSync(filePath, "utf8"); + } catch (err) { + throw new Error(`Failed to read file ${filePath}: ${String(err)}`, { cause: err }); + } if (!content.trim()) { continue; } diff --git a/actions/setup/js/detect_agent_errors.cjs b/actions/setup/js/detect_agent_errors.cjs index 96417afc973..0394d1e9b52 100644 --- a/actions/setup/js/detect_agent_errors.cjs +++ b/actions/setup/js/detect_agent_errors.cjs @@ -175,14 +175,22 @@ function writeOutputs(results) { } const lines = buildOutputLines(results); - fs.appendFileSync(outputFile, lines.join("\n") + "\n"); + try { + fs.appendFileSync(outputFile, lines.join("\n") + "\n"); + } catch (err) { + process.stderr.write(`[detect-agent-errors] Failed to write to GITHUB_OUTPUT: ${String(err)}\n`); + } } function main() { let logContent = ""; if (fs.existsSync(LOG_FILE)) { - logContent = fs.readFileSync(LOG_FILE, "utf8"); + try { + logContent = fs.readFileSync(LOG_FILE, "utf8"); + } catch (err) { + throw new Error(`Failed to read file ${LOG_FILE}: ${String(err)}`, { cause: err }); + } } else { process.stderr.write(`[detect-agent-errors] Log file not found: ${LOG_FILE}\n`); } diff --git a/actions/setup/js/evaluate_outcomes.cjs b/actions/setup/js/evaluate_outcomes.cjs index ce1815e61f9..2211644e97c 100644 --- a/actions/setup/js/evaluate_outcomes.cjs +++ b/actions/setup/js/evaluate_outcomes.cjs @@ -145,8 +145,16 @@ function readJSONL(filePath) { */ function writeJSONAtomic(filePath, data) { const tmp = filePath + ".tmp"; - fs.writeFileSync(tmp, JSON.stringify(data, null, 2) + "\n"); - fs.renameSync(tmp, filePath); + try { + fs.writeFileSync(tmp, JSON.stringify(data, null, 2) + "\n"); + } catch (err) { + throw new Error(`Failed to write file ${tmp}: ${String(err)}`, { cause: err }); + } + try { + fs.renameSync(tmp, filePath); + } catch (err) { + throw new Error(`Failed to rename file ${tmp} to ${filePath}: ${String(err)}`, { cause: err }); + } } /** @@ -2035,8 +2043,12 @@ function main() { } // Ensure directories exist - fs.mkdirSync(CACHE_DIR, { recursive: true }); - fs.mkdirSync(OUTCOMES_DIR, { recursive: true }); + try { + fs.mkdirSync(CACHE_DIR, { recursive: true }); + fs.mkdirSync(OUTCOMES_DIR, { recursive: true }); + } catch (err) { + throw new Error(`Failed to create evaluation directories: ${String(err)}`, { cause: err }); + } // Load seen-runs cache const seenIds = new Set(readJSON(SEEN_FILE, [])); @@ -2077,7 +2089,11 @@ function main() { const resolutionTimes = []; // Clear the evaluations file - fs.writeFileSync(EVAL_JSONL, ""); + try { + fs.writeFileSync(EVAL_JSONL, ""); + } catch (err) { + throw new Error(`Failed to write file ${EVAL_JSONL}: ${String(err)}`, { cause: err }); + } /** @type {number[]} */ const evaluatedIds = []; @@ -2118,23 +2134,27 @@ function main() { // Write noop entries for (const n of noops) { const normalized = normalizeOutcome("noop", n.type || ""); - fs.appendFileSync( - EVAL_JSONL, - JSON.stringify({ - type: n.type, - url: "", - repo, - result: "noop", - outcome_status: normalized.outcome_status, - evidence_strength: normalized.evidence_strength, - signal: normalized.signal, - detail: n.type, - workflow, - run_id: runId, - timestamp: "", - event, - }) + "\n" - ); + try { + fs.appendFileSync( + EVAL_JSONL, + JSON.stringify({ + type: n.type, + url: "", + repo, + result: "noop", + outcome_status: normalized.outcome_status, + evidence_strength: normalized.evidence_strength, + signal: normalized.signal, + detail: n.type, + workflow, + run_id: runId, + timestamp: "", + event, + }) + "\n" + ); + } catch (err) { + throw new Error(`Failed to append to file ${EVAL_JSONL}: ${String(err)}`, { cause: err }); + } } if (runItems === 0) { @@ -2190,34 +2210,38 @@ function main() { resolutionTimes.push(evalResult.resolution_sec); } - fs.appendFileSync( - EVAL_JSONL, - JSON.stringify({ - type: item.type || "", - url: item.url || "", - repo: item.repo || repo, - result: evalResult.result, - outcome_status: normalized.outcome_status, - evidence_strength: normalized.evidence_strength, - signal: normalized.signal, - detail: evalResult.detail, - workflow, - run_id: runId, - timestamp: item.timestamp || "", - event, - resolution_sec: evalResult.resolution_sec, - pending_age_sec: evalResult.pending_age_sec, - review_comments: evalResult.review_comments, - changed_files: evalResult.changed_files, - additions: evalResult.additions, - deletions: evalResult.deletions, - reactions_total: evalResult.reactions_total, - reactions_positive: evalResult.reactions_positive, - reactions_negative: evalResult.reactions_negative, - comments: evalResult.comments, - zero_touch: evalResult.zero_touch || false, - }) + "\n" - ); + try { + fs.appendFileSync( + EVAL_JSONL, + JSON.stringify({ + type: item.type || "", + url: item.url || "", + repo: item.repo || repo, + result: evalResult.result, + outcome_status: normalized.outcome_status, + evidence_strength: normalized.evidence_strength, + signal: normalized.signal, + detail: evalResult.detail, + workflow, + run_id: runId, + timestamp: item.timestamp || "", + event, + resolution_sec: evalResult.resolution_sec, + pending_age_sec: evalResult.pending_age_sec, + review_comments: evalResult.review_comments, + changed_files: evalResult.changed_files, + additions: evalResult.additions, + deletions: evalResult.deletions, + reactions_total: evalResult.reactions_total, + reactions_positive: evalResult.reactions_positive, + reactions_negative: evalResult.reactions_negative, + comments: evalResult.comments, + zero_touch: evalResult.zero_touch || false, + }) + "\n" + ); + } catch (err) { + throw new Error(`Failed to append to file ${EVAL_JSONL}: ${String(err)}`, { cause: err }); + } } // Save per-run data diff --git a/actions/setup/js/extract_inline_skills.cjs b/actions/setup/js/extract_inline_skills.cjs index aab04ca7509..c588c76ab6d 100644 --- a/actions/setup/js/extract_inline_skills.cjs +++ b/actions/setup/js/extract_inline_skills.cjs @@ -224,14 +224,26 @@ function writeInlineSkills(content, workspaceDir, skillsBaseDir, engineId) { const skillsDir = path.join(baseDir, dir); core.info(`[extractInlineSkills] Engine: "${engineId || "(default)"}" → dir="${dir}" ext="${ext}"`); core.info(`[extractInlineSkills] Writing ${skills.length} skill(s) to: ${skillsDir}`); - fs.mkdirSync(skillsDir, { recursive: true }); + try { + fs.mkdirSync(skillsDir, { recursive: true }); + } catch (err) { + throw new Error(`Failed to create directory ${skillsDir}: ${String(err)}`, { cause: err }); + } for (const skill of skills) { const skillPath = path.join(skillsDir, skill.name + ext); - fs.mkdirSync(path.dirname(skillPath), { recursive: true }); + try { + fs.mkdirSync(path.dirname(skillPath), { recursive: true }); + } catch (err) { + throw new Error(`Failed to create directory ${path.dirname(skillPath)}: ${String(err)}`, { cause: err }); + } const filteredContent = filterInlineSkillFrontmatter(skill.content, skill.name); const skillContent = filteredContent.endsWith("\n") ? filteredContent : filteredContent + "\n"; - fs.writeFileSync(skillPath, skillContent, "utf8"); + try { + fs.writeFileSync(skillPath, skillContent, "utf8"); + } catch (err) { + throw new Error(`Failed to write file ${skillPath}: ${String(err)}`, { cause: err }); + } core.info(`[extractInlineSkills] Written skill: ${skillPath} (${skillContent.length} bytes)`); } diff --git a/actions/setup/js/extract_inline_sub_agents.cjs b/actions/setup/js/extract_inline_sub_agents.cjs index 1c7c55eaf5e..03c31e45771 100644 --- a/actions/setup/js/extract_inline_sub_agents.cjs +++ b/actions/setup/js/extract_inline_sub_agents.cjs @@ -166,13 +166,21 @@ function writeInlineSubAgents(content, workspaceDir, agentsBaseDir, engineId) { const agentsDir = path.join(baseDir, dir); core.info(`[extractInlineSubAgents] Engine: "${engineId || "(default)"}" → dir="${dir}" ext="${ext}"`); core.info(`[extractInlineSubAgents] Writing ${agents.length} sub-agent(s) to: ${agentsDir}`); - fs.mkdirSync(agentsDir, { recursive: true }); + try { + fs.mkdirSync(agentsDir, { recursive: true }); + } catch (err) { + throw new Error(`Failed to create directory ${agentsDir}: ${String(err)}`, { cause: err }); + } for (const agent of agents) { const agentPath = path.join(agentsDir, agent.name + ext); const filteredContent = preserveSubAgentFrontmatter(agent.content); const agentContent = filteredContent.endsWith("\n") ? filteredContent : filteredContent + "\n"; - fs.writeFileSync(agentPath, agentContent, "utf8"); + try { + fs.writeFileSync(agentPath, agentContent, "utf8"); + } catch (err) { + throw new Error(`Failed to write file ${agentPath}: ${String(err)}`, { cause: err }); + } core.info(`[extractInlineSubAgents] Written sub-agent: ${agentPath} (${agentContent.length} bytes)`); } diff --git a/actions/setup/js/frontmatter_hash_pure.cjs b/actions/setup/js/frontmatter_hash_pure.cjs index 8ad8c09e0a4..e8d6d383ee1 100644 --- a/actions/setup/js/frontmatter_hash_pure.cjs +++ b/actions/setup/js/frontmatter_hash_pure.cjs @@ -23,7 +23,11 @@ const MAX_SYMLINK_DEPTH = 5; * @returns {Promise} File content */ async function defaultFileReader(filePath) { - return fs.readFileSync(filePath, "utf8"); + try { + return fs.readFileSync(filePath, "utf8"); + } catch (err) { + throw new Error(`Failed to read file ${filePath}: ${String(err)}`, { cause: err }); + } } /** diff --git a/actions/setup/js/gateway_difc_filtered.cjs b/actions/setup/js/gateway_difc_filtered.cjs index 234a8f1071e..9fab24c92a3 100644 --- a/actions/setup/js/gateway_difc_filtered.cjs +++ b/actions/setup/js/gateway_difc_filtered.cjs @@ -127,7 +127,12 @@ function generateDifcFilteredSection(filteredEvents) { section += `>\n`; const promptsDir = process.env.GH_AW_PROMPTS_DIR || `${process.env.RUNNER_TEMP}/gh-aw/prompts`; const remediationPath = `${promptsDir}/integrity_filter_remediation.md`; - const remediationText = fs.readFileSync(remediationPath, "utf8"); + let remediationText; + try { + remediationText = fs.readFileSync(remediationPath, "utf8"); + } catch (err) { + throw new Error(`Failed to read file ${remediationPath}: ${String(err)}`, { cause: err }); + } for (const line of remediationText.trimEnd().split("\n")) { section += line ? `> ${line}\n` : `>\n`; } diff --git a/actions/setup/js/generate_aw_info.cjs b/actions/setup/js/generate_aw_info.cjs index 08113b95dbe..a8d266a0328 100644 --- a/actions/setup/js/generate_aw_info.cjs +++ b/actions/setup/js/generate_aw_info.cjs @@ -165,10 +165,18 @@ async function main(core, ctx) { } // Write to /tmp/gh-aw directory to avoid inclusion in PR - fs.mkdirSync(TMP_GH_AW_PATH, { recursive: true }); + try { + fs.mkdirSync(TMP_GH_AW_PATH, { recursive: true }); + } catch (err) { + throw new Error(`Failed to create directory ${TMP_GH_AW_PATH}: ${String(err)}`, { cause: err }); + } writeMergedModelsJSON(core); const tmpPath = TMP_GH_AW_PATH + "/aw_info.json"; - fs.writeFileSync(tmpPath, JSON.stringify(awInfo, null, 2)); + try { + fs.writeFileSync(tmpPath, JSON.stringify(awInfo, null, 2)); + } catch (err) { + throw new Error(`Failed to write file ${tmpPath}: ${String(err)}`, { cause: err }); + } if (awInfo.staged) { logStagedPreviewInfo("Generating workflow info in staged mode — no changes applied"); diff --git a/actions/setup/js/generate_git_bundle.cjs b/actions/setup/js/generate_git_bundle.cjs index 50aeb78bd4b..0bbc207e696 100644 --- a/actions/setup/js/generate_git_bundle.cjs +++ b/actions/setup/js/generate_git_bundle.cjs @@ -128,7 +128,11 @@ async function generateGitBundle(branchName, baseBranch, options = {}) { // Ensure /tmp/gh-aw directory exists const bundleDir = path.dirname(bundlePath); if (!fs.existsSync(bundleDir)) { - fs.mkdirSync(bundleDir, { recursive: true }); + try { + fs.mkdirSync(bundleDir, { recursive: true }); + } catch (err) { + throw new Error(`Failed to create directory ${bundleDir}: ${String(err)}`, { cause: err }); + } } let bundleGenerated = false; diff --git a/actions/setup/js/generate_git_patch.cjs b/actions/setup/js/generate_git_patch.cjs index 807d06ad95a..4bdb89de323 100644 --- a/actions/setup/js/generate_git_patch.cjs +++ b/actions/setup/js/generate_git_patch.cjs @@ -124,7 +124,11 @@ async function generateGitPatch(branchName, baseBranch, options = {}) { // Ensure /tmp/gh-aw directory exists const patchDir = path.dirname(patchPath); if (!fs.existsSync(patchDir)) { - fs.mkdirSync(patchDir, { recursive: true }); + try { + fs.mkdirSync(patchDir, { recursive: true }); + } catch (err) { + throw new Error(`Failed to create directory ${patchDir}: ${String(err)}`, { cause: err }); + } } let patchGenerated = false; @@ -469,7 +473,12 @@ async function generateGitPatch(branchName, baseBranch, options = {}) { // Check if patch was generated and has content if (patchGenerated && fs.existsSync(patchPath)) { - const patchContent = fs.readFileSync(patchPath, "utf8"); + let patchContent; + try { + patchContent = fs.readFileSync(patchPath, "utf8"); + } catch (err) { + throw new Error(`Failed to read file ${patchPath}: ${String(err)}`, { cause: err }); + } const patchSize = Buffer.byteLength(patchContent, "utf8"); const patchLines = patchContent.split("\n").length; diff --git a/actions/setup/js/generate_observability_summary.cjs b/actions/setup/js/generate_observability_summary.cjs index 2d217751a6e..680a56440dc 100644 --- a/actions/setup/js/generate_observability_summary.cjs +++ b/actions/setup/js/generate_observability_summary.cjs @@ -29,7 +29,13 @@ function countBlockedRequests() { continue; } - const lines = fs.readFileSync(path, "utf8").split("\n"); + let fileContent; + try { + fileContent = fs.readFileSync(path, "utf8"); + } catch (err) { + throw new Error(`Failed to read file ${path}: ${String(err)}`, { cause: err }); + } + const lines = fileContent.split("\n"); for (const raw of lines) { const line = raw.trim(); if (!line) continue; diff --git a/actions/setup/js/generate_safe_outputs_tools.cjs b/actions/setup/js/generate_safe_outputs_tools.cjs index fd6d61f6ad2..d331b8ee9b6 100644 --- a/actions/setup/js/generate_safe_outputs_tools.cjs +++ b/actions/setup/js/generate_safe_outputs_tools.cjs @@ -133,11 +133,19 @@ async function main() { // Write JSON payloads from env vars if provided (replaces heredoc-based file writing) if (process.env.GH_AW_TOOLS_META_JSON) { - fs.writeFileSync(toolsMetaPath, process.env.GH_AW_TOOLS_META_JSON); + try { + fs.writeFileSync(toolsMetaPath, process.env.GH_AW_TOOLS_META_JSON); + } catch (err) { + throw new Error(`Failed to write file ${toolsMetaPath}: ${String(err)}`, { cause: err }); + } } if (process.env.GH_AW_VALIDATION_JSON) { const validationPath = path.join(path.dirname(configPath), "validation.json"); - fs.writeFileSync(validationPath, process.env.GH_AW_VALIDATION_JSON); + try { + fs.writeFileSync(validationPath, process.env.GH_AW_VALIDATION_JSON); + } catch (err) { + throw new Error(`Failed to write file ${validationPath}: ${String(err)}`, { cause: err }); + } } // Load all source tools from the actions folder @@ -250,7 +258,11 @@ async function main() { const allFilteredTools = [...filteredTools, ...dynamicTools]; // Write the result to the output path - fs.writeFileSync(outputPath, JSON.stringify(allFilteredTools, null, 2)); + try { + fs.writeFileSync(outputPath, JSON.stringify(allFilteredTools, null, 2)); + } catch (err) { + throw new Error(`Failed to write file ${outputPath}: ${String(err)}`, { cause: err }); + } const debugEnabled = process.env.DEBUG === "*" || (process.env.DEBUG || "").includes("safe_outputs"); if (debugEnabled) { diff --git a/actions/setup/js/generate_usage_activity_summary.cjs b/actions/setup/js/generate_usage_activity_summary.cjs index 58136adf567..b10a2a0e0b6 100644 --- a/actions/setup/js/generate_usage_activity_summary.cjs +++ b/actions/setup/js/generate_usage_activity_summary.cjs @@ -463,7 +463,11 @@ function main() { // Write summary to file const outputPath = "/tmp/gh-aw/usage/activity/summary.json"; - fs.writeFileSync(outputPath, JSON.stringify(summary, null, 2), "utf-8"); + try { + fs.writeFileSync(outputPath, JSON.stringify(summary, null, 2), "utf-8"); + } catch (err) { + throw new Error(`Failed to write file ${outputPath}: ${String(err)}`, { cause: err }); + } console.log(outputPath); } diff --git a/actions/setup/js/github_rate_limit_logger.cjs b/actions/setup/js/github_rate_limit_logger.cjs index 11293052966..10bdc87e3e2 100644 --- a/actions/setup/js/github_rate_limit_logger.cjs +++ b/actions/setup/js/github_rate_limit_logger.cjs @@ -41,7 +41,11 @@ const { GITHUB_RATE_LIMITS_JSONL_PATH } = require("./constants.cjs"); function ensureDir(filePath) { const dir = path.dirname(filePath); if (!fs.existsSync(dir)) { - fs.mkdirSync(dir, { recursive: true }); + try { + fs.mkdirSync(dir, { recursive: true }); + } catch (err) { + throw new Error(`Failed to create directory ${dir}: ${String(err)}`, { cause: err }); + } } } diff --git a/actions/setup/js/handle_agent_failure.cjs b/actions/setup/js/handle_agent_failure.cjs index 09d0c14b9cd..a66e58d29fb 100644 --- a/actions/setup/js/handle_agent_failure.cjs +++ b/actions/setup/js/handle_agent_failure.cjs @@ -1475,7 +1475,12 @@ function buildToolDenialsExceededContext(events, workflowId) { const recentToolCallsList = Array.isArray(latestEvent.recentToolCalls) && latestEvent.recentToolCalls.length > 0 ? latestEvent.recentToolCalls.map(toolCall => `- \`${toolCall}\``).join("\n") : "- _No tool calls captured_"; const templatePath = getPromptPath("tool_denials_exceeded_context.md"); - const template = fs.readFileSync(templatePath, "utf8"); + let template; + try { + template = fs.readFileSync(templatePath, "utf8"); + } catch (err) { + throw new Error(`Failed to read file ${templatePath}: ${String(err)}`, { cause: err }); + } return ( "\n" + renderTemplate(template, { @@ -1641,7 +1646,12 @@ function buildInferenceAccessErrorContext(hasInferenceAccessError) { } const templatePath = getPromptPath("inference_access_error.md"); - const template = fs.readFileSync(templatePath, "utf8"); + let template; + try { + template = fs.readFileSync(templatePath, "utf8"); + } catch (err) { + throw new Error(`Failed to read file ${templatePath}: ${String(err)}`, { cause: err }); + } return "\n" + template; } @@ -1874,7 +1884,12 @@ function buildLockdownCheckFailedContext(hasLockdownCheckFailed) { } const templatePath = getPromptPath("lockdown_check_failed.md"); - const template = fs.readFileSync(templatePath, "utf8"); + let template; + try { + template = fs.readFileSync(templatePath, "utf8"); + } catch (err) { + throw new Error(`Failed to read file ${templatePath}: ${String(err)}`, { cause: err }); + } return "\n" + template; } @@ -1892,7 +1907,12 @@ function buildOAuthTokenCheckFailedContext(hasOAuthTokenCheckFailed, runUrl) { } const templatePath = getPromptPath("oauth_token_check_failed.md"); - const template = fs.readFileSync(templatePath, "utf8"); + let template; + try { + template = fs.readFileSync(templatePath, "utf8"); + } catch (err) { + throw new Error(`Failed to read file ${templatePath}: ${String(err)}`, { cause: err }); + } return "\n" + renderTemplate(template, { run_url: runUrl }); } @@ -1909,7 +1929,12 @@ function buildStaleLockFileFailedContext(hasStaleLockFileFailed) { } const templatePath = getPromptPath("stale_lock_file_failed.md"); - const template = fs.readFileSync(templatePath, "utf8"); + let template; + try { + template = fs.readFileSync(templatePath, "utf8"); + } catch (err) { + throw new Error(`Failed to read file ${templatePath}: ${String(err)}`, { cause: err }); + } return "\n" + template; } diff --git a/actions/setup/js/handle_detection_runs.cjs b/actions/setup/js/handle_detection_runs.cjs index 7aa31469bf0..9aba6fbc2bd 100644 --- a/actions/setup/js/handle_detection_runs.cjs +++ b/actions/setup/js/handle_detection_runs.cjs @@ -45,7 +45,12 @@ async function ensureDetectionRunsIssue() { // Load template from file const templatePath = getPromptPath("detection_runs_issue.md"); - const parentBodyContent = fs.readFileSync(templatePath, "utf8"); + let parentBodyContent; + try { + parentBodyContent = fs.readFileSync(templatePath, "utf8"); + } catch (err) { + throw new Error(`Failed to read file ${templatePath}: ${String(err)}`, { cause: err }); + } const parentBody = generateFooterWithExpiration({ footerText: parentBodyContent, diff --git a/actions/setup/js/handle_noop_message.cjs b/actions/setup/js/handle_noop_message.cjs index f43c7929d39..d435e3fd2cb 100644 --- a/actions/setup/js/handle_noop_message.cjs +++ b/actions/setup/js/handle_noop_message.cjs @@ -49,7 +49,12 @@ async function ensureAgentRunsIssue() { // Load template from file const templatePath = getPromptPath("noop_runs_issue.md"); - const parentBodyContent = fs.readFileSync(templatePath, "utf8"); + let parentBodyContent; + try { + parentBodyContent = fs.readFileSync(templatePath, "utf8"); + } catch (err) { + throw new Error(`Failed to read file ${templatePath}: ${String(err)}`, { cause: err }); + } const parentBody = generateFooterWithExpiration({ footerText: parentBodyContent, diff --git a/actions/setup/js/install_frontmatter_skills.cjs b/actions/setup/js/install_frontmatter_skills.cjs index 42f41093b26..bf52b4826a9 100644 --- a/actions/setup/js/install_frontmatter_skills.cjs +++ b/actions/setup/js/install_frontmatter_skills.cjs @@ -146,7 +146,11 @@ async function main() { const skills = parseSkillSpecs(process.env.GH_AW_FRONTMATTER_SKILLS || ""); const skillsDst = path.join("/tmp/gh-aw", skillDir); - fs.mkdirSync(skillsDst, { recursive: true }); + try { + fs.mkdirSync(skillsDst, { recursive: true }); + } catch (err) { + throw new Error(`Failed to create directory ${skillsDst}: ${String(err)}`, { cause: err }); + } core.info(`Installing frontmatter skills to ${skillsDst}`); if (skillInstallAgent) { diff --git a/actions/setup/js/load_experiment_state_from_repo.cjs b/actions/setup/js/load_experiment_state_from_repo.cjs index fbb78bbafbe..d73cc234ac7 100644 --- a/actions/setup/js/load_experiment_state_from_repo.cjs +++ b/actions/setup/js/load_experiment_state_from_repo.cjs @@ -116,7 +116,11 @@ async function main() { const validationResult = validateInputs(branch, owner, repo, repository); if (!validationResult.valid) { core.warning(`${validationResult.error} – starting with empty experiment state`); - fs.mkdirSync(stateDir, { recursive: true }); + try { + fs.mkdirSync(stateDir, { recursive: true }); + } catch (err) { + throw new Error(`Failed to create directory ${stateDir}: ${String(err)}`, { cause: err }); + } return; } @@ -136,7 +140,11 @@ async function main() { } // Ensure the directory exists regardless of whether we fetched the file. - fs.mkdirSync(stateDir, { recursive: true }); + try { + fs.mkdirSync(stateDir, { recursive: true }); + } catch (err) { + throw new Error(`Failed to create directory ${stateDir}: ${String(err)}`, { cause: err }); + } if (content === null) { core.info(`No experiment state found in branch "${branch}" – starting with empty state`); @@ -160,7 +168,11 @@ async function main() { return; } - fs.writeFileSync(stateFile, content, "utf8"); + try { + fs.writeFileSync(stateFile, content, "utf8"); + } catch (err) { + throw new Error(`Failed to write file ${stateFile}: ${String(err)}`, { cause: err }); + } core.info(`Experiment state written to ${stateFile}`); } diff --git a/actions/setup/js/mcp_handler_shell.cjs b/actions/setup/js/mcp_handler_shell.cjs index 90fe5bdcb91..dc870a61177 100644 --- a/actions/setup/js/mcp_handler_shell.cjs +++ b/actions/setup/js/mcp_handler_shell.cjs @@ -61,7 +61,11 @@ function createShellHandler(server, toolName, scriptPath, timeoutSeconds = 60) { server.debug(` [${toolName}] Output file: ${outputFile}`); // Create the output file (empty) - fs.writeFileSync(outputFile, ""); + try { + fs.writeFileSync(outputFile, ""); + } catch (err) { + throw new Error(`Failed to write file ${outputFile}: ${String(err)}`, { cause: err }); + } return executeProcess({ server, diff --git a/actions/setup/js/mcp_scripts_config_loader.cjs b/actions/setup/js/mcp_scripts_config_loader.cjs index ee0c638fa35..6b03c688772 100644 --- a/actions/setup/js/mcp_scripts_config_loader.cjs +++ b/actions/setup/js/mcp_scripts_config_loader.cjs @@ -40,7 +40,12 @@ function loadConfig(configPath) { throw new Error(`${ERR_SYSTEM}: Configuration file not found: ${configPath}`); } - const configContent = fs.readFileSync(configPath, "utf-8"); + let configContent; + try { + configContent = fs.readFileSync(configPath, "utf-8"); + } catch (err) { + throw new Error(`Failed to read file ${configPath}: ${String(err)}`, { cause: err }); + } let config; try { config = JSON.parse(configContent); diff --git a/actions/setup/js/merge_frontmatter_models.cjs b/actions/setup/js/merge_frontmatter_models.cjs index 41d7082c29b..28798f3e592 100644 --- a/actions/setup/js/merge_frontmatter_models.cjs +++ b/actions/setup/js/merge_frontmatter_models.cjs @@ -116,7 +116,11 @@ function writeMergedModelsJSON(core) { const merged = Object.keys(overlay).length > 0 ? mergeModelCosts(base, overlay) : base; - fs.writeFileSync(MERGED_MODELS_JSON_PATH, JSON.stringify(merged), "utf8"); + try { + fs.writeFileSync(MERGED_MODELS_JSON_PATH, JSON.stringify(merged), "utf8"); + } catch (err) { + throw new Error(`Failed to write file ${MERGED_MODELS_JSON_PATH}: ${String(err)}`, { cause: err }); + } core.info(`Generated merged models.json at: ${MERGED_MODELS_JSON_PATH}`); } diff --git a/actions/setup/js/merge_remote_agent_github_folder.cjs b/actions/setup/js/merge_remote_agent_github_folder.cjs index d9ce358fbfd..c28b3b66bb0 100644 --- a/actions/setup/js/merge_remote_agent_github_folder.cjs +++ b/actions/setup/js/merge_remote_agent_github_folder.cjs @@ -257,8 +257,14 @@ function mergeGithubFolder(sourcePath, destPath) { // Check if destination file exists if (pathExists(destFile)) { // Compare file contents - const sourceContent = fs.readFileSync(sourceFile); - const destContent = fs.readFileSync(destFile); + let sourceContent; + let destContent; + try { + sourceContent = fs.readFileSync(sourceFile); + destContent = fs.readFileSync(destFile); + } catch (err) { + throw new Error(`Failed to read file for merge conflict detection: ${String(err)}`, { cause: err }); + } if (!sourceContent.equals(destContent)) { conflicts.push(relativePath); @@ -270,7 +276,11 @@ function mergeGithubFolder(sourcePath, destPath) { // Copy file to destination const destDir = path.dirname(destFile); if (!pathExists(destDir)) { - fs.mkdirSync(destDir, { recursive: true }); + try { + fs.mkdirSync(destDir, { recursive: true }); + } catch (err) { + throw new Error(`Failed to create directory ${destDir}: ${String(err)}`, { cause: err }); + } coreObj.info(`Created directory: ${path.relative(destPath, destDir)}`); } @@ -319,7 +329,11 @@ async function mergeRepositoryGithubFolder(owner, repo, ref, workspace) { // Ensure destination .github folder exists if (!pathExists(destGithubFolder)) { - fs.mkdirSync(destGithubFolder, { recursive: true }); + try { + fs.mkdirSync(destGithubFolder, { recursive: true }); + } catch (err) { + throw new Error(`Failed to create directory ${destGithubFolder}: ${String(err)}`, { cause: err }); + } coreObj.info("Created .github folder in workspace"); } diff --git a/actions/setup/js/messages_core.cjs b/actions/setup/js/messages_core.cjs index 73e163aa8d4..1203f513713 100644 --- a/actions/setup/js/messages_core.cjs +++ b/actions/setup/js/messages_core.cjs @@ -139,7 +139,12 @@ function getPromptPath(name) { * @returns {string} Rendered template with placeholders replaced */ function renderTemplateFromFile(templatePath, context) { - const template = fs.readFileSync(templatePath, "utf8"); + let template; + try { + template = fs.readFileSync(templatePath, "utf8"); + } catch (err) { + throw new Error(`Failed to read file ${templatePath}: ${String(err)}`, { cause: err }); + } return renderTemplate(template, context); } diff --git a/actions/setup/js/mount_mcp_as_cli.cjs b/actions/setup/js/mount_mcp_as_cli.cjs index 39d5a440cac..8f978d88bea 100644 --- a/actions/setup/js/mount_mcp_as_cli.cjs +++ b/actions/setup/js/mount_mcp_as_cli.cjs @@ -401,8 +401,12 @@ async function main() { core.info(`Found ${servers.length} server(s) in manifest to mount as CLI tools`); - fs.mkdirSync(CLI_BIN_DIR, { recursive: true }); - fs.mkdirSync(TOOLS_DIR, { recursive: true }); + try { + fs.mkdirSync(CLI_BIN_DIR, { recursive: true }); + fs.mkdirSync(TOOLS_DIR, { recursive: true }); + } catch (err) { + throw new Error(`Failed to create MCP CLI directories: ${String(err)}`, { cause: err }); + } // The bridge script lives alongside mount_mcp_as_cli.cjs in the setup actions directory. // It is accessible inside the AWF sandbox because ${RUNNER_TEMP}/gh-aw is mounted read-only. diff --git a/actions/setup/js/parse_mcp_gateway_log.cjs b/actions/setup/js/parse_mcp_gateway_log.cjs index 8145f880d5e..427ade7fd17 100644 --- a/actions/setup/js/parse_mcp_gateway_log.cjs +++ b/actions/setup/js/parse_mcp_gateway_log.cjs @@ -205,7 +205,12 @@ async function writeStepSummaryWithTokenUsage(coreObj) { if (!fs.existsSync(TOKEN_USAGE_PATH)) { coreObj.debug(`No token-usage.jsonl found at: ${TOKEN_USAGE_PATH}`); } else { - const content = fs.readFileSync(TOKEN_USAGE_PATH, "utf8"); + let content; + try { + content = fs.readFileSync(TOKEN_USAGE_PATH, "utf8"); + } catch (err) { + throw new Error(`Failed to read file ${TOKEN_USAGE_PATH}: ${String(err)}`, { cause: err }); + } if (content?.trim()) { coreObj.info(`Found token-usage.jsonl (${content.length} bytes)`); const parsedSummary = parseTokenUsageJsonl(content); diff --git a/actions/setup/js/parse_token_usage.cjs b/actions/setup/js/parse_token_usage.cjs index 9b9ddd5cf31..2e71f2b8052 100644 --- a/actions/setup/js/parse_token_usage.cjs +++ b/actions/setup/js/parse_token_usage.cjs @@ -136,7 +136,11 @@ async function appendStepSummarySection(title, markdown) { const section = buildStepSummarySection(title, markdown); const summaryPath = process.env.GITHUB_STEP_SUMMARY; if (summaryPath) { - fs.appendFileSync(summaryPath, section, "utf8"); + try { + fs.appendFileSync(summaryPath, section, "utf8"); + } catch { + /* ignore */ + } return; } diff --git a/actions/setup/js/patch_awf_chroot_config.cjs b/actions/setup/js/patch_awf_chroot_config.cjs index 79a8d96a5cf..b215fc3c9f2 100644 --- a/actions/setup/js/patch_awf_chroot_config.cjs +++ b/actions/setup/js/patch_awf_chroot_config.cjs @@ -43,8 +43,12 @@ function patchAWFChrootConfig(options = {}) { }; const output = `${JSON.stringify(config)}\n`; - fs.writeFileSync(configPath, output); - fs.writeFileSync(artifactConfigPath, output); + try { + fs.writeFileSync(configPath, output); + fs.writeFileSync(artifactConfigPath, output); + } catch (err) { + throw new Error(`Failed to write chroot config: ${String(err)}`, { cause: err }); + } return output; } diff --git a/actions/setup/js/pick_experiment.cjs b/actions/setup/js/pick_experiment.cjs index f0613a0e6f4..b425c28bb31 100644 --- a/actions/setup/js/pick_experiment.cjs +++ b/actions/setup/js/pick_experiment.cjs @@ -117,8 +117,12 @@ function loadState(stateFile) { */ function saveState(stateFile, state) { const dir = path.dirname(stateFile); - fs.mkdirSync(dir, { recursive: true }); - fs.writeFileSync(stateFile, JSON.stringify(state, null, 2) + "\n", "utf8"); + try { + fs.mkdirSync(dir, { recursive: true }); + fs.writeFileSync(stateFile, JSON.stringify(state, null, 2) + "\n", "utf8"); + } catch (err) { + throw new Error(`Failed to persist experiment state ${stateFile}: ${String(err)}`, { cause: err }); + } } /** @@ -384,7 +388,11 @@ async function main() { } // Ensure the state directory exists so that the cache-save step can find it. - fs.mkdirSync(stateDir, { recursive: true }); + try { + fs.mkdirSync(stateDir, { recursive: true }); + } catch (err) { + throw new Error(`Failed to create directory ${stateDir}: ${String(err)}`, { cause: err }); + } const state = loadState(stateFile); @@ -452,7 +460,11 @@ async function main() { // Only written when at least one experiment was successfully assigned. if (Object.keys(assignments).length > 0) { const assignmentsFile = path.join(stateDir, "assignments.json"); - fs.writeFileSync(assignmentsFile, JSON.stringify(assignments, null, 2) + "\n", "utf8"); + try { + fs.writeFileSync(assignmentsFile, JSON.stringify(assignments, null, 2) + "\n", "utf8"); + } catch (err) { + throw new Error(`Failed to write file ${assignmentsFile}: ${String(err)}`, { cause: err }); + } core.info(`Experiment assignments written to ${assignmentsFile}`); // Emit OTEL resource attributes so every span in this run carries the diff --git a/actions/setup/js/push_repo_memory.cjs b/actions/setup/js/push_repo_memory.cjs index 261f06829e5..d08de0f42e5 100644 --- a/actions/setup/js/push_repo_memory.cjs +++ b/actions/setup/js/push_repo_memory.cjs @@ -84,7 +84,12 @@ async function main() { /** @param {string} absPath */ function tryParseJSONFile(absPath) { - const raw = fs.readFileSync(absPath, "utf8"); + let raw; + try { + raw = fs.readFileSync(absPath, "utf8"); + } catch (err) { + throw new Error(`Failed to read file ${absPath}: ${String(err)}`, { cause: err }); + } if (!raw.trim()) { throw new Error(`Empty JSON file: ${absPath}`); } diff --git a/actions/setup/js/push_to_pull_request_branch.cjs b/actions/setup/js/push_to_pull_request_branch.cjs index 2dee8698930..3e38f3055fd 100644 --- a/actions/setup/js/push_to_pull_request_branch.cjs +++ b/actions/setup/js/push_to_pull_request_branch.cjs @@ -430,7 +430,12 @@ async function main(config = {}) { } } - let patchContent = fs.readFileSync(patchFilePath, "utf8"); + let patchContent; + try { + patchContent = fs.readFileSync(patchFilePath, "utf8"); + } catch (err) { + throw new Error(`Failed to read file ${patchFilePath}: ${String(err)}`, { cause: err }); + } // Check for actual error conditions if (patchContent.includes("Failed to generate patch")) { @@ -563,7 +568,12 @@ async function main(config = {}) { } if (patchFilePath && fs.existsSync(patchFilePath)) { - const patchStats = fs.readFileSync(patchFilePath, "utf8"); + let patchStats; + try { + patchStats = fs.readFileSync(patchFilePath, "utf8"); + } catch (err) { + throw new Error(`Failed to read file ${patchFilePath}: ${String(err)}`, { cause: err }); + } if (patchStats.trim()) { content += `**Changes:** Patch file exists with ${patchStats.split("\n").length} lines\n\n`; content += `
Show patch preview\n\n\`\`\`diff\n${patchStats.slice(0, 2000)}${patchStats.length > 2000 ? "\n... (truncated)" : ""}\n\`\`\`\n\n
\n\n`; diff --git a/actions/setup/js/redact_evals_results.cjs b/actions/setup/js/redact_evals_results.cjs index d7a0a15d7ba..06b8caf829e 100644 --- a/actions/setup/js/redact_evals_results.cjs +++ b/actions/setup/js/redact_evals_results.cjs @@ -29,7 +29,12 @@ function verifyRedaction() { return; } - const content = fs.readFileSync(EVALS_OUTPUT_PATH, "utf8"); + let content; + try { + content = fs.readFileSync(EVALS_OUTPUT_PATH, "utf8"); + } catch (err) { + throw new Error(`Failed to read file ${EVALS_OUTPUT_PATH}: ${String(err)}`, { cause: err }); + } const secretValues = getSecretValues(); const lingeringRedactions = redactBuiltInPatterns(content).redactionCount + redactSecrets(content, secretValues).redactionCount; diff --git a/actions/setup/js/run_evals.cjs b/actions/setup/js/run_evals.cjs index 75a86b17de6..f41af3a012e 100644 --- a/actions/setup/js/run_evals.cjs +++ b/actions/setup/js/run_evals.cjs @@ -70,14 +70,22 @@ async function setupMain() { return; } - fs.mkdirSync(EVALS_DIR, { recursive: true }); + try { + fs.mkdirSync(EVALS_DIR, { recursive: true }); + } catch (err) { + throw new Error(`Failed to create directory ${EVALS_DIR}: ${String(err)}`, { cause: err }); + } // Load agent output for evaluation context const agentOutputPath = path.join(EVALS_DIR, AGENT_OUTPUT_FILENAME); let agentOutputContent = ""; if (fs.existsSync(agentOutputPath)) { const stats = fs.statSync(agentOutputPath); - agentOutputContent = fs.readFileSync(agentOutputPath, "utf-8"); + try { + agentOutputContent = fs.readFileSync(agentOutputPath, "utf-8"); + } catch (err) { + throw new Error(`Failed to read file ${agentOutputPath}: ${String(err)}`, { cause: err }); + } core.info(`Agent output loaded: ${agentOutputPath} (${stats.size} bytes)`); } else { core.warning(`Agent output not found at ${agentOutputPath}. ` + "Ensure the agent artifact includes agent_output.json. " + "Evaluation will proceed without agent context."); @@ -85,8 +93,12 @@ async function setupMain() { const prompt = buildEvalPrompt(questions, agentOutputContent); - fs.mkdirSync("/tmp/gh-aw/aw-prompts", { recursive: true }); - fs.writeFileSync("/tmp/gh-aw/aw-prompts/prompt.txt", prompt); + try { + fs.mkdirSync("/tmp/gh-aw/aw-prompts", { recursive: true }); + fs.writeFileSync("/tmp/gh-aw/aw-prompts/prompt.txt", prompt); + } catch (err) { + throw new Error(`Failed to prepare eval prompt file: ${String(err)}`, { cause: err }); + } core.exportVariable("GH_AW_PROMPT", "/tmp/gh-aw/aw-prompts/prompt.txt"); core.info(`BinEval setup complete: wrote prompt with ${questions.length} question(s)`); @@ -121,11 +133,20 @@ async function parseMain() { if (!fs.existsSync(EVALS_LOG_PATH)) { core.warning(`Evals log not found at ${EVALS_LOG_PATH}; no results written`); - fs.writeFileSync(EVALS_OUTPUT_PATH, ""); + try { + fs.writeFileSync(EVALS_OUTPUT_PATH, ""); + } catch (err) { + throw new Error(`Failed to write file ${EVALS_OUTPUT_PATH}: ${String(err)}`, { cause: err }); + } return; } - const logContent = fs.readFileSync(EVALS_LOG_PATH, "utf-8"); + let logContent; + try { + logContent = fs.readFileSync(EVALS_LOG_PATH, "utf-8"); + } catch (err) { + throw new Error(`Failed to read file ${EVALS_LOG_PATH}: ${String(err)}`, { cause: err }); + } core.info(`Parsing evals log: ${EVALS_LOG_PATH} (${logContent.length} bytes)`); // Build a search corpus that includes both raw log lines AND any assistant text @@ -165,7 +186,11 @@ async function parseMain() { // Write JSONL — one JSON object per line const jsonlLines = results.map(r => JSON.stringify(r)); - fs.writeFileSync(EVALS_OUTPUT_PATH, jsonlLines.join("\n") + (jsonlLines.length > 0 ? "\n" : "")); + try { + fs.writeFileSync(EVALS_OUTPUT_PATH, jsonlLines.join("\n") + (jsonlLines.length > 0 ? "\n" : "")); + } catch (err) { + throw new Error(`Failed to write file ${EVALS_OUTPUT_PATH}: ${String(err)}`, { cause: err }); + } core.info(`BinEval results written to ${EVALS_OUTPUT_PATH} (${results.length} record(s))`); // Step summary rendering is handled by the dedicated render_evals_summary.cjs step // that runs after secret redaction, so the published summary is always redacted. diff --git a/actions/setup/js/runtime_import.cjs b/actions/setup/js/runtime_import.cjs index 591a7723201..64617ef149d 100644 --- a/actions/setup/js/runtime_import.cjs +++ b/actions/setup/js/runtime_import.cjs @@ -665,7 +665,11 @@ function hasGitHubActionsMacros(content) { async function fetchUrlContent(url, cacheDir) { // Create cache directory if it doesn't exist if (!fs.existsSync(cacheDir)) { - fs.mkdirSync(cacheDir, { recursive: true }); + try { + fs.mkdirSync(cacheDir, { recursive: true }); + } catch (err) { + throw new Error(`Failed to create directory ${cacheDir}: ${String(err)}`, { cause: err }); + } } // Generate cache filename from URL (hash it for safety) @@ -681,7 +685,11 @@ async function fetchUrlContent(url, cacheDir) { if (ageInMs < oneHourInMs) { core.info(`Using cached content for URL: ${url}`); - return fs.readFileSync(cacheFile, "utf8"); + try { + return fs.readFileSync(cacheFile, "utf8"); + } catch (err) { + throw new Error(`Failed to read file ${cacheFile}: ${String(err)}`, { cause: err }); + } } } @@ -705,7 +713,12 @@ async function fetchUrlContent(url, cacheDir) { res.on("end", () => { // Cache the content - fs.writeFileSync(cacheFile, data, "utf8"); + try { + fs.writeFileSync(cacheFile, data, "utf8"); + } catch (err) { + reject(new Error(`Failed to write file ${cacheFile}: ${String(err)}`, { cause: err })); + return; + } resolve(data); }); }) @@ -1036,7 +1049,12 @@ async function processRuntimeImport(filepathOrUrl, optional, workspaceDir, start } // Read the file - let content = fs.readFileSync(normalizedPath, "utf8"); + let content; + try { + content = fs.readFileSync(normalizedPath, "utf8"); + } catch (err) { + throw new Error(`Failed to read file ${normalizedPath}: ${String(err)}`, { cause: err }); + } // If line range is specified, extract those lines first (before other processing) if (startLine !== undefined || endLine !== undefined) { diff --git a/actions/setup/js/safe_outputs_config.cjs b/actions/setup/js/safe_outputs_config.cjs index 13555c9ae06..b50eba4f2a9 100644 --- a/actions/setup/js/safe_outputs_config.cjs +++ b/actions/setup/js/safe_outputs_config.cjs @@ -70,7 +70,11 @@ function loadConfig(server) { const outputDir = path.dirname(outputFile); if (!fs.existsSync(outputDir)) { server.debug(`Creating output directory: ${outputDir}`); - fs.mkdirSync(outputDir, { recursive: true }); + try { + fs.mkdirSync(outputDir, { recursive: true }); + } catch (err) { + throw new Error(`Failed to create directory ${outputDir}: ${String(err)}`, { cause: err }); + } } return { diff --git a/actions/setup/js/safe_outputs_handlers.cjs b/actions/setup/js/safe_outputs_handlers.cjs index cdb53d7de71..b05eb98f4cb 100644 --- a/actions/setup/js/safe_outputs_handlers.cjs +++ b/actions/setup/js/safe_outputs_handlers.cjs @@ -493,11 +493,20 @@ function createHandlers(server, appendSafeOutput, config = {}) { // the artifact-upload step), matching the same pattern used by upload_artifact. const assetsDir = path.join(process.env.RUNNER_TEMP || "/tmp", "gh-aw", "safeoutputs", "assets"); if (!fs.existsSync(assetsDir)) { - fs.mkdirSync(assetsDir, { recursive: true }); + try { + fs.mkdirSync(assetsDir, { recursive: true }); + } catch (err) { + throw new Error(`Failed to create directory ${assetsDir}: ${String(err)}`, { cause: err }); + } } // Read file and compute hash - const fileContent = fs.readFileSync(filePath); + let fileContent; + try { + fileContent = fs.readFileSync(filePath); + } catch (err) { + throw new Error(`Failed to read file ${filePath}: ${String(err)}`, { cause: err }); + } const sha = crypto.createHash("sha256").update(fileContent).digest("hex"); // Extract filename and extension @@ -2030,7 +2039,11 @@ function createHandlers(server, appendSafeOutput, config = {}) { */ function copyDirectoryRecursive(srcDir, destDir) { if (!fs.existsSync(destDir)) { - fs.mkdirSync(destDir, { recursive: true }); + try { + fs.mkdirSync(destDir, { recursive: true }); + } catch (err) { + throw new Error(`Failed to create directory ${destDir}: ${String(err)}`, { cause: err }); + } } for (const ent of fs.readdirSync(srcDir, { withFileTypes: true })) { const srcPath = path.join(srcDir, ent.name); @@ -2089,7 +2102,11 @@ function createHandlers(server, appendSafeOutput, config = {}) { const stagingDir = path.join(process.env.RUNNER_TEMP || "/tmp", "gh-aw", "safeoutputs", "upload-artifacts"); if (!fs.existsSync(stagingDir)) { - fs.mkdirSync(stagingDir, { recursive: true }); + try { + fs.mkdirSync(stagingDir, { recursive: true }); + } catch (err) { + throw new Error(`Failed to create directory ${stagingDir}: ${String(err)}`, { cause: err }); + } } const destName = path.basename(filePath); diff --git a/actions/setup/js/safe_outputs_tools_loader.cjs b/actions/setup/js/safe_outputs_tools_loader.cjs index a9e235b68b8..540f1a2955a 100644 --- a/actions/setup/js/safe_outputs_tools_loader.cjs +++ b/actions/setup/js/safe_outputs_tools_loader.cjs @@ -347,7 +347,11 @@ function registerDynamicTools(server, tools, config, outputFile, registerTool, n // Write the entry to the output file in JSONL format // CRITICAL: Use JSON.stringify WITHOUT formatting parameters for JSONL format // Each entry must be on a single line, followed by a newline character - fs.appendFileSync(outputFile, `${JSON.stringify(entry)}\n`); + try { + fs.appendFileSync(outputFile, `${JSON.stringify(entry)}\n`); + } catch (err) { + throw new Error(`Failed to append to file ${outputFile}: ${String(err)}`, { cause: err }); + } // Use output from safe-job config if available const outputText = jobConfig?.output ?? `Safe-job '${configKey}' executed successfully with arguments: ${JSON.stringify(args)}`; diff --git a/actions/setup/js/sanitize_content_core.cjs b/actions/setup/js/sanitize_content_core.cjs index e41eab47378..48a5ff77cb1 100644 --- a/actions/setup/js/sanitize_content_core.cjs +++ b/actions/setup/js/sanitize_content_core.cjs @@ -61,11 +61,19 @@ function writeRedactedDomainsLog(filePath) { // Ensure directory exists const dir = path.dirname(targetPath); if (!fs.existsSync(dir)) { - fs.mkdirSync(dir, { recursive: true }); + try { + fs.mkdirSync(dir, { recursive: true }); + } catch (err) { + throw new Error(`Failed to create directory ${dir}: ${String(err)}`, { cause: err }); + } } // Write domains to file, one per line - fs.writeFileSync(targetPath, redactedDomains.join("\n") + "\n"); + try { + fs.writeFileSync(targetPath, redactedDomains.join("\n") + "\n"); + } catch (err) { + throw new Error(`Failed to write file ${targetPath}: ${String(err)}`, { cause: err }); + } return targetPath; } diff --git a/actions/setup/js/sanitize_output.cjs b/actions/setup/js/sanitize_output.cjs index 4b07e46f65a..2076662866a 100644 --- a/actions/setup/js/sanitize_output.cjs +++ b/actions/setup/js/sanitize_output.cjs @@ -23,7 +23,12 @@ async function main() { return; } - const outputContent = fs.readFileSync(outputFile, "utf8"); + let outputContent; + try { + outputContent = fs.readFileSync(outputFile, "utf8"); + } catch (err) { + throw new Error(`Failed to read file ${outputFile}: ${String(err)}`, { cause: err }); + } if (outputContent.trim() === "") { core.info("Output file is empty"); core.setOutput("output", ""); diff --git a/actions/setup/js/setup_comment_memory_files.cjs b/actions/setup/js/setup_comment_memory_files.cjs index ba2e6a075fd..40bbc060285 100644 --- a/actions/setup/js/setup_comment_memory_files.cjs +++ b/actions/setup/js/setup_comment_memory_files.cjs @@ -139,11 +139,19 @@ async function collectCommentMemoryFiles(githubClient, commentMemoryConfig) { } } - fs.mkdirSync(COMMENT_MEMORY_DIR, { recursive: true }); + try { + fs.mkdirSync(COMMENT_MEMORY_DIR, { recursive: true }); + } catch (err) { + throw new Error(`Failed to create directory ${COMMENT_MEMORY_DIR}: ${String(err)}`, { cause: err }); + } const writtenFiles = []; for (const [memoryId, content] of memoryMap.entries()) { const filePath = path.join(COMMENT_MEMORY_DIR, `${memoryId}.md`); - fs.writeFileSync(filePath, `${content}\n`); + try { + fs.writeFileSync(filePath, `${content}\n`); + } catch (err) { + throw new Error(`Failed to write file ${filePath}: ${String(err)}`, { cause: err }); + } writtenFiles.push(filePath); } @@ -168,7 +176,12 @@ ${fileList} ${COMMENT_MEMORY_PROMPT_END_MARKER}`; - let promptContent = fs.readFileSync(PROMPT_PATH, "utf8"); + let promptContent; + try { + promptContent = fs.readFileSync(PROMPT_PATH, "utf8"); + } catch (err) { + throw new Error(`Failed to read file ${PROMPT_PATH}: ${String(err)}`, { cause: err }); + } const start = promptContent.indexOf(COMMENT_MEMORY_PROMPT_START_MARKER); const end = promptContent.indexOf(COMMENT_MEMORY_PROMPT_END_MARKER); if (start >= 0 && end > start) { @@ -177,7 +190,11 @@ ${COMMENT_MEMORY_PROMPT_END_MARKER}`; } else { promptContent = `${promptContent.trimEnd()}\n\n${injectedBlock}\n`; } - fs.writeFileSync(PROMPT_PATH, promptContent); + try { + fs.writeFileSync(PROMPT_PATH, promptContent); + } catch (err) { + throw new Error(`Failed to write file ${PROMPT_PATH}: ${String(err)}`, { cause: err }); + } core.info("comment_memory setup: injected comment-memory prompt guidance"); } diff --git a/actions/setup/js/setup_threat_detection.cjs b/actions/setup/js/setup_threat_detection.cjs index 74add44a919..8b7eb8e8391 100644 --- a/actions/setup/js/setup_threat_detection.cjs +++ b/actions/setup/js/setup_threat_detection.cjs @@ -30,7 +30,12 @@ async function main() { core.setFailed(`${ERR_VALIDATION}: Threat detection template not found at: ${templatePath}`); return; } - const templateContent = fs.readFileSync(templatePath, "utf-8"); + let templateContent; + try { + templateContent = fs.readFileSync(templatePath, "utf-8"); + } catch (err) { + throw new Error(`Failed to read file ${templatePath}: ${String(err)}`, { cause: err }); + } // Check if prompt file exists (soft check; detection can continue with fallback context) // The agent artifact is downloaded to /tmp/gh-aw/threat-detection/ // GitHub Actions preserves the directory structure from the uploaded artifact @@ -128,8 +133,12 @@ async function main() { } // Write prompt file - fs.mkdirSync("/tmp/gh-aw/aw-prompts", { recursive: true }); - fs.writeFileSync("/tmp/gh-aw/aw-prompts/prompt.txt", promptContent); + try { + fs.mkdirSync("/tmp/gh-aw/aw-prompts", { recursive: true }); + fs.writeFileSync("/tmp/gh-aw/aw-prompts/prompt.txt", promptContent); + } catch (err) { + throw new Error(`Failed to prepare threat detection prompt file: ${String(err)}`, { cause: err }); + } core.exportVariable("GH_AW_PROMPT", "/tmp/gh-aw/aw-prompts/prompt.txt"); // Note: creation of /tmp/gh-aw/threat-detection and detection.log is handled by a separate shell step diff --git a/actions/setup/js/start_mcp_gateway.cjs b/actions/setup/js/start_mcp_gateway.cjs index 10c87233c31..9dfa6853be2 100644 --- a/actions/setup/js/start_mcp_gateway.cjs +++ b/actions/setup/js/start_mcp_gateway.cjs @@ -340,14 +340,26 @@ async function main() { const configDir = path.join(runnerTemp || "/tmp", "gh-aw/mcp-config"); const cliDir = path.join(runnerTemp || "/tmp", "gh-aw/mcp-cli"); - fs.mkdirSync("/tmp/gh-aw/mcp-logs", { recursive: true }); + try { + fs.mkdirSync("/tmp/gh-aw/mcp-logs", { recursive: true }); + } catch (err) { + throw new Error(`Failed to create directory /tmp/gh-aw/mcp-logs: ${String(err)}`, { cause: err }); + } // Symlink attack prevention on the config directory assertNotSymlink(configDir); - fs.mkdirSync(configDir, { recursive: true }); + try { + fs.mkdirSync(configDir, { recursive: true }); + } catch (err) { + throw new Error(`Failed to create directory ${configDir}: ${String(err)}`, { cause: err }); + } // Post-creation check assertNotSymlink(configDir); - fs.chmodSync(configDir, 0o700); + try { + fs.chmodSync(configDir, 0o700); + } catch (err) { + throw new Error(`Failed to set permissions on ${configDir}: ${String(err)}`, { cause: err }); + } // ----------------------------------------------------------------------- // Validate container syntax @@ -378,7 +390,12 @@ async function main() { core.info("Reading MCP configuration from stdin..."); const configReadStart = nowMs(); - const mcpConfig = fs.readFileSync(0, "utf8"); // fd 0 = stdin + let mcpConfig; + try { + mcpConfig = fs.readFileSync(0, "utf8"); // fd 0 = stdin + } catch (err) { + throw new Error(`Failed to read MCP configuration from stdin: ${String(err)}`, { cause: err }); + } printTiming(configReadStart, "Configuration read from stdin"); core.info(""); @@ -741,7 +758,11 @@ async function main() { } // Restrict permissions - fs.chmodSync(outputPath, 0o600); + try { + fs.chmodSync(outputPath, 0o600); + } catch (err) { + throw new Error(`Failed to set permissions on ${outputPath}: ${String(err)}`, { cause: err }); + } // Check for error payload let gatewayOutput; @@ -812,7 +833,11 @@ async function main() { core.info(`No agent-specific converter found for engine: ${engineType}`); core.info("Using gateway output directly"); // Default fallback – copy to most common location, filtering CLI-mounted servers - fs.mkdirSync(copilotConfigDir, { recursive: true }); + try { + fs.mkdirSync(copilotConfigDir, { recursive: true }); + } catch (err) { + throw new Error(`Failed to create directory ${copilotConfigDir}: ${String(err)}`, { cause: err }); + } const cliServersRaw = process.env.GH_AW_MCP_CLI_SERVERS; if (cliServersRaw) { try { @@ -830,12 +855,26 @@ async function main() { } catch { core.error("ERROR: Failed to filter CLI-mounted servers from agent MCP config"); core.info("Falling back to unfiltered config"); - fs.copyFileSync(outputPath, copilotConfigFile); + try { + fs.copyFileSync(outputPath, copilotConfigFile); + } catch (err) { + throw new Error(`Failed to copy file ${outputPath} to ${copilotConfigFile}: ${String(err)}`, { cause: err }); + } } } else { - fs.copyFileSync(outputPath, copilotConfigFile); + try { + fs.copyFileSync(outputPath, copilotConfigFile); + } catch (err) { + throw new Error(`Failed to copy file ${outputPath} to ${copilotConfigFile}: ${String(err)}`, { cause: err }); + } + } + let copilotConfigContent; + try { + copilotConfigContent = fs.readFileSync(copilotConfigFile, "utf8"); + } catch (err) { + throw new Error(`Failed to read file ${copilotConfigFile}: ${String(err)}`, { cause: err }); } - core.info(fs.readFileSync(copilotConfigFile, "utf8")); + core.info(copilotConfigContent); } printTiming(configConvertStart, "Configuration conversion"); core.info(""); @@ -876,7 +915,11 @@ async function main() { // Save CLI manifest for mount_mcp_as_cli.cjs // ----------------------------------------------------------------------- core.info("Saving MCP CLI manifest..."); - fs.mkdirSync(cliDir, { recursive: true }); + try { + fs.mkdirSync(cliDir, { recursive: true }); + } catch (err) { + throw new Error(`Failed to create directory ${cliDir}: ${String(err)}`, { cause: err }); + } try { const gwOut = JSON.parse(fs.readFileSync(outputPath, "utf8")); @@ -937,7 +980,11 @@ async function main() { // ----------------------------------------------------------------------- if (githubOutput) { const outputs = [`gateway-pid=${gatewayPid}`, `gateway-port=${gatewayPort}`, `gateway-api-key=${apiKey}`, `gateway-domain=${gatewayDomain}`].join("\n"); - fs.appendFileSync(githubOutput, outputs + "\n"); + try { + fs.appendFileSync(githubOutput, outputs + "\n"); + } catch { + /* ignore */ + } } } diff --git a/actions/setup/js/unified_timeline.cjs b/actions/setup/js/unified_timeline.cjs index eb349b0c1e6..cc07976eed2 100644 --- a/actions/setup/js/unified_timeline.cjs +++ b/actions/setup/js/unified_timeline.cjs @@ -211,9 +211,17 @@ function collectGatewayEvents(opts = {}) { let isRpc = false; if (fs.existsSync(gwPath)) { - content = fs.readFileSync(gwPath, "utf8"); + try { + content = fs.readFileSync(gwPath, "utf8"); + } catch (err) { + throw new Error(`Failed to read file ${gwPath}: ${String(err)}`, { cause: err }); + } } else if (fs.existsSync(rpcPath)) { - content = fs.readFileSync(rpcPath, "utf8"); + try { + content = fs.readFileSync(rpcPath, "utf8"); + } catch (err) { + throw new Error(`Failed to read file ${rpcPath}: ${String(err)}`, { cause: err }); + } isRpc = true; } else { return []; @@ -294,7 +302,12 @@ function collectFirewallEvents(opts = {}) { if (!fs.existsSync(auditPath)) return []; - const content = fs.readFileSync(auditPath, "utf8"); + let content; + try { + content = fs.readFileSync(auditPath, "utf8"); + } catch (err) { + throw new Error(`Failed to read file ${auditPath}: ${String(err)}`, { cause: err }); + } const events = []; for (const entry of parseJsonl(content)) { @@ -372,7 +385,12 @@ function collectAgentEvents(opts = {}) { } if (!eventsPath || !fs.existsSync(eventsPath)) return []; - const content = fs.readFileSync(eventsPath, "utf8"); + let content; + try { + content = fs.readFileSync(eventsPath, "utf8"); + } catch (err) { + throw new Error(`Failed to read file ${eventsPath}: ${String(err)}`, { cause: err }); + } const events = []; let turnIndex = 0; diff --git a/actions/setup/js/upload_artifact.cjs b/actions/setup/js/upload_artifact.cjs index 32e6433b635..c2b141cf3aa 100644 --- a/actions/setup/js/upload_artifact.cjs +++ b/actions/setup/js/upload_artifact.cjs @@ -174,8 +174,16 @@ function copySingleFileToStaging(sourcePath, destRelPath) { if (!stat.isFile()) { return { error: `not a regular file: ${sourcePath}` }; } - fs.mkdirSync(path.dirname(destPath), { recursive: true }); - fs.copyFileSync(sourcePath, destPath); + try { + fs.mkdirSync(path.dirname(destPath), { recursive: true }); + } catch (err) { + throw new Error(`Failed to create directory ${path.dirname(destPath)}: ${String(err)}`, { cause: err }); + } + try { + fs.copyFileSync(sourcePath, destPath); + } catch (err) { + throw new Error(`Failed to copy file ${sourcePath} to ${destPath}: ${String(err)}`, { cause: err }); + } return { error: null }; } diff --git a/actions/setup/js/write_large_content_to_file.cjs b/actions/setup/js/write_large_content_to_file.cjs index 44f1b11f752..f8e6a6aec9c 100644 --- a/actions/setup/js/write_large_content_to_file.cjs +++ b/actions/setup/js/write_large_content_to_file.cjs @@ -15,7 +15,11 @@ const { generateCompactSchema } = require("./generate_compact_schema.cjs"); function writeLargeContentToFile(content) { const logsDir = "/tmp/gh-aw/safeoutputs"; - fs.mkdirSync(logsDir, { recursive: true }); + try { + fs.mkdirSync(logsDir, { recursive: true }); + } catch (err) { + throw new Error(`Failed to create directory ${logsDir}: ${String(err)}`, { cause: err }); + } // Generate SHA256 hash of content const hash = crypto.createHash("sha256").update(content).digest("hex"); @@ -24,7 +28,11 @@ function writeLargeContentToFile(content) { const filename = `${hash}.json`; const filepath = path.join(logsDir, filename); - fs.writeFileSync(filepath, content, "utf8"); + try { + fs.writeFileSync(filepath, content, "utf8"); + } catch (err) { + throw new Error(`Failed to write file ${filepath}: ${String(err)}`, { cause: err }); + } const description = generateCompactSchema(content);