Harden Copilot CLI and Cloud Hypervisor compatibility by Copilot · Pull Request #69162 · github/gh-aw

Copilot · 2026-10-16T00:11:01Z

Copilot workflows could compile with CLI versions that lacked the harness-required --session-id flag, while Cloud Hypervisor could make aw_info.json read-only during model verification.

Copilot CLI compatibility
- Enforce feature minimum 1.0.35 for pinned and dynamically resolved CLI versions.
- Reject incompatible explicit pins during installation.
```
GH_AW_COPILOT_MIN_VERSION: 1.0.35
```
Cloud Hypervisor filesystem contract
- Automatically allow Copilot workflows to write /tmp/gh-aw/aw_info.json.
- Exclude file entries from generated mkdir -p preparation.
Regression coverage
- Add installer, sandbox, AWF command, configuration, and golden fixture coverage for pinned versions and Cloud Hypervisor behavior.

Fixes Copilot workflow compatibility regressions with pinned CLI versions and Cloud Hypervisor metadata writes #69161

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot

🟡 Changes recommended

Cached CLI selection can still bypass the required feature minimum.

2 open findings

What changed in this PR

Hardens gh-aw’s generated Copilot workflows against incompatible CLI versions and read-only metadata under Cloud Hypervisor.

Changes:

Emits the Copilot CLI feature minimum of 1.0.35.
Makes runtime metadata writable and excludes it from directory preparation.
Updates regression assertions, golden fixtures, and release notes.

File	Description
`pkg/workflow/testdata/TestWasmGolden_CompileFixtures/with-imports.golden`	Records installer minimum.
`pkg/workflow/testdata/TestWasmGolden_CompileFixtures/smoke-copilot.golden`	Records installer minimum.
`pkg/workflow/testdata/TestWasmGolden_CompileFixtures/playwright-cli-mode.golden`	Records installer minimum.
`pkg/workflow/testdata/TestWasmGolden_CompileFixtures/basic-copilot.golden`	Records installer minimum.
`pkg/workflow/testdata/TestWasmGolden_AllEngines/copilot.golden`	Records installer minimum.
`pkg/workflow/sandbox.go`	Adds metadata write permission.
`pkg/workflow/sandbox_test.go`	Updates expected write permissions.
`pkg/workflow/copilot_installer.go`	Passes minimum for explicit versions.
`pkg/workflow/copilot_installer_test.go`	Checks emitted minimum.
`pkg/workflow/copilot_engine_installation.go`	Supplies required feature minimum.
`pkg/workflow/cloud_hypervisor_test.go`	Adds metadata policy assertions.
`pkg/workflow/awf_command_builder.go`	Excludes metadata from mkdir targets.
`pkg/constants/version_constants.go`	Defines session-selector minimum.
`pkg/constants/constants.go`	Defines runtime metadata path.
`.changeset/patch-copilot-session-id-compatibility.md`	Documents compatibility patch.

🧠 Review effort: Max

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

Copilot · 2026-10-16T07:22:37Z

 	// /workspace already exists (checked out by actions/checkout) and must not be mkdir'd.
 	assert.NotContains(t, command, `mkdir -p "${GITHUB_WORKSPACE}"`+"\n")
 	assert.Contains(t, command, `mkdir -p "${GITHUB_WORKSPACE}/.awf-home" "/tmp/gh-aw/agent"`)
+	assert.NotContains(t, command, constants.AwInfoPath)


Covered in c2443410: the test includes constants.AwInfoPath, checks it is absent only from the mkdir script, and confirms it remains in the generated AWF configuration. Confirmed again after merging main in 1fc08e9.

Copilot · 2026-10-16T07:22:36Z

 	rootless := isArcDindTopology(workflowData)
 	compiledVersion := workflowData.CompiledVersion
-	npmSteps := generateCopilotInstallerSteps(copilotVersion, "Install GitHub Copilot CLI", rootless, compiledVersion, "", getNVXGuestLibc(workflowData))
+	npmSteps := generateCopilotInstallerSteps(copilotVersion, "Install GitHub Copilot CLI", rootless, compiledVersion, string(constants.CopilotSessionIDMinVersion), getNVXGuestLibc(workflowData))


Covered in c2443410: the effective minimum is passed to cached CLI selection even for latest, with regression coverage for obsolete-only and compatible caches. The regression passes after merging main in 1fc08e9.

lpcox · 2026-10-16T01:19:50Z

@copilot address review feedback

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot · 2026-10-16T01:32:58Z

@copilot address review feedback

Addressed both findings in c244341: explicit latest cache lookup now enforces the feature minimum, with regressions for obsolete-only and compatible caches; the Hypervisor test now includes aw_info.json, excludes it only from mkdir preparation, and verifies it remains in AWF configuration. Targeted tests, impacted Go tests, build, linters, secret scan, and read-only review passed. The full gate remains blocked by pre-existing workflow-lock drift; CodeQL skipped analysis due to its database size limit.

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

gh-aw-bot · 2026-10-16T04:59:54Z

PR Review Items

Review thread on pkg/workflow/cloud_hypervisor_test.go (line 163)
- The fixture never includes constants.AwInfoPath, and BuildAWFCommand does not apply sandbox defaults, so this assertion passes even if the new file exclusion is removed. Add the metadata path before building the command and check its absence only from the mkdir script; it must remain present in the generated AWF configuration.
- View comment
Review thread on pkg/workflow/copilot_engine_installation.go (line 151)
- engine.version: latest, including an expression resolving to latest, still bypasses this minimum. actions/setup/sh/install_copilot_cli.sh skips numeric validation for latest and calls find_cached_copilot_bin with an empty minimum. With only CLI 1.0.34 cached, it selects that binary despite GH_AW_COPILOT_MIN_VERSION=1.0.35, leaving the harness's unsupported --session-id failure unresolved. Apply the feature floor before the latest cache lookup and add an installer regression case.
- View comment

Next Steps

Update the branch with make merge-main and address the review feedback above.

Sous-chef state: a12fc54c1696c0f8f82efdd7caf589ec42f6d33f1731637f844ccc43612b0015

Generated by 👨‍🍳 PR Sous Chef · pi · haiku45 · 6.26 AIC · ⌖ 6.94 AIC · ⊞ 1.1K · ◷
_{Comment /souschef to run again}

gh-aw-bot · 2026-10-16T06:57:39Z

@copilot address the following outstanding work in one pass:

Update this branch with the latest main using make merge-main, resolving any conflicts and preserving the intended changes.
Review (pkg/workflow/cloud_hypervisor_test.go:163): The fixture never includes constants.AwInfoPath, and BuildAWFCommand does not apply sandbox defaults, so this assertion passes even if the new file exclusion is removed. Add the metadata path before building the command and check its absence only from the mkdir script; it must remain present in the generated AWF configuration. - Harden Copilot CLI and Cloud Hypervisor compatibility #69162 (comment)
Review (pkg/workflow/copilot_engine_installation.go:151): engine.version: latest, including an expression resolving to latest, still bypasses this minimum. actions/setup/sh/install_copilot_cli.sh skips numeric validation for latest and calls find_cached_copilot_bin with an empty minimum. With only CLI 1.0.34 cached, it selects that binary despite GH_AW_COPILOT_MIN_VERSION=1.0.35, leaving the harness's unsupported --session-id failure unresolved. Apply the feature floor before the latest cache lookup and add an installer regression case. - Harden Copilot CLI and Cloud Hypervisor compatibility #69162 (comment)

Push the necessary fixes, reply to each listed review thread and resolve it when addressed. Ignore feedback already answered or resolved. Use the pr-finisher skill and stop when only human review or CI remains; do not trigger CI.

Sous-chef head: 26a6d4f
Sous-chef work: 208e170c3ad6e171f401cbca83b4655c12b4b9779ccee5a22e1ee7fc1f2b85ad 415fbc038b60e9ca562f9fcb768169ba9ddfeea8b2115c40bc50daf2fd50df0d
Sous-chef state: a12fc54c1696c0f8f82efdd7caf589ec42f6d33f1731637f844ccc43612b0015

Generated by 👨‍🍳 PR Sous Chef · pi · haiku45 · 5.04 AIC · ⌖ 6.97 AIC · ⊞ 1.1K · ◷
_{Comment /souschef to run again}

…orkflow-compatibility Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

pelikhan · 2026-10-16T12:13:15Z

An agent should not have to write aw_info.json

pelikhan · 2026-10-16T16:38:10Z

@copilot An agent should not have to write aw_info.json

…orkflow-compatibility Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-10-16T17:04:13Z

@copilot address the following outstanding work in one pass:

Update this branch with the latest main using make merge-main, resolving any conflicts and preserving the intended changes....

Merged latest main with make merge-main in c9cae91. The latest-cache minimum fix remains covered and passing; both listed review threads already have substantive replies. In c29fcdd, applied the maintainer's newer direction: model metadata is persisted by the runner, not made writable to the agent. Build, lint, focused and impacted tests pass; the full gate remains blocked by unrelated workflow-lock drift. CI was not triggered. Existing threads could not be marked resolved with the available authenticated tools.

@copilot An agent should not have to write aw_info.json

Fixed in c29fcdd. The harness now records model observations in its writable logs directory; only the runner post-step updates aw_info.json. Removed the Cloud Hypervisor metadata write grant and mkdir exception, and regenerated both affected workflows. Read-only metadata regressions pass, along with 531 focused JavaScript tests and targeted Go tests.

Initial plan

d330bd7

Copilot AI assigned Copilot and lpcox Oct 16, 2026

Copilot AI linked an issue Oct 16, 2026 that may be closed by this pull request

Copilot workflow compatibility regressions with pinned CLI versions and Cloud Hypervisor metadata writes #69161

Open

Copilot started work on behalf of lpcox October 16, 2026 00:11

View session

Copilot AI and others added 2 commits October 16, 2026 00:22

Fix Copilot runtime compatibility contracts

ee8d4f9

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Update Copilot compatibility regressions

9fe4657

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Fix Copilot workflow compatibility with pinned CLI versions~~ Harden Copilot CLI and Cloud Hypervisor compatibility Oct 16, 2026

Copilot finished work on behalf of lpcox October 16, 2026 00:32

Copilot AI requested a review from lpcox October 16, 2026 00:32

lpcox marked this pull request as ready for review October 16, 2026 00:32

Copilot AI max review requested due to automatic review settings October 16, 2026 00:32

Copilot started reviewing on behalf of lpcox October 16, 2026 00:33

View session

Copilot AI reviewed Oct 16, 2026

View reviewed changes

Copilot started work on behalf of lpcox October 16, 2026 01:20

View session

Enforce Copilot minimum for latest cache lookup

c244341

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Apply remaining changes

26a6d4f

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot finished work on behalf of lpcox October 16, 2026 01:33

pelikhan mentioned this pull request Oct 16, 2026

fix: refresh PR Sous Chef metadata through scoped GraphQL #69229

Merged

This was referenced Oct 16, 2026

[pr-sous-chef] PR Sous Chef: Run Summary #69243

Closed

[PR Triage Report] PR triage report: app/github-copilot batch (2026-10-16) #69284

Closed

Copilot started work on behalf of gh-aw-bot October 16, 2026 06:58

View session

Merge remote-tracking branch 'origin/main' into copilot/fix-copilot-w…

1fc08e9

…orkflow-compatibility Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot finished work on behalf of gh-aw-bot October 16, 2026 07:23

Copilot AI requested a review from gh-aw-bot October 16, 2026 07:23

github-actions Bot mentioned this pull request Oct 16, 2026

[Contribution Check Report] Contribution Check — 2026-10-16 #69241

Closed

Copilot started work on behalf of pelikhan October 16, 2026 16:39

View session

Copilot AI and others added 2 commits October 16, 2026 16:46

Merge remote-tracking branch 'origin/main' into copilot/fix-copilot-w…

c9cae91

…orkflow-compatibility Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Keep Copilot model metadata writes on the runner

c29fcdd

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan October 16, 2026 17:05

Copilot AI requested a review from pelikhan October 16, 2026 17:05

github-actions Bot mentioned this pull request Oct 17, 2026

[PR Triage Report] 2026-10-17 #69573

Open

Navigation Menu

Repository navigation

Harden Copilot CLI and Cloud Hypervisor compatibility - #69162

Harden Copilot CLI and Cloud Hypervisor compatibility#69162
lpcox with Copilot wants to merge 8 commits into
mainfrom
copilot/fix-copilot-workflow-compatibility

Copilot AI commented Oct 16, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Oct 16, 2026

Uh oh!

Copilot AI Oct 16, 2026

Uh oh!

lpcox commented Oct 16, 2026

Uh oh!

Copilot AI commented Oct 16, 2026

Uh oh!

gh-aw-bot commented Oct 16, 2026

Uh oh!

gh-aw-bot commented Oct 16, 2026

Uh oh!

pelikhan commented Oct 16, 2026

Uh oh!

pelikhan commented Oct 16, 2026

Uh oh!

Copilot AI commented Oct 16, 2026 •

edited

Loading

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

Copilot AI commented Oct 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Copilot AI Oct 16, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 16, 2026

Choose a reason for hiding this comment

Uh oh!

lpcox commented Oct 16, 2026

Uh oh!

Copilot AI commented Oct 16, 2026

Uh oh!

gh-aw-bot commented Oct 16, 2026

PR Review Items

Next Steps

Uh oh!

gh-aw-bot commented Oct 16, 2026

Uh oh!

pelikhan commented Oct 16, 2026

Uh oh!

pelikhan commented Oct 16, 2026

Uh oh!

Copilot AI commented Oct 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Copilot AI commented Oct 16, 2026 •

edited

Loading

Copilot AI commented Oct 16, 2026 •

edited

Loading