Skip to content

feat: propagate experiment assignments in agent context to workflow_call and dispatch#29762

Closed
Copilot wants to merge 8 commits intomainfrom
copilot/ensure-experiments-values-agent-context
Closed

feat: propagate experiment assignments in agent context to workflow_call and dispatch#29762
Copilot wants to merge 8 commits intomainfrom
copilot/ensure-experiments-values-agent-context

Conversation

Copy link
Copy Markdown
Contributor

Copilot AI commented May 2, 2026

Summary

Ensures that experiment variant assignments are included in the aw_context when a workflow dispatches or calls another workflow, and that the called workflow resolves its experiments from the combination of the parent's context and its own local experiment configuration.

Problem

When a workflow with experiments dispatches or calls another workflow, each workflow independently picks its own experiment variants. This means the same user interaction could experience different variants at different stages of the workflow chain, breaking A/B experiment consistency.

Changes

JavaScript (actions/setup/js/)

  • aw_context.cjs: Added experiments field to buildAwContext() - a JSON string of current experiment assignments from GH_AW_EXPERIMENTS_JSON env var. Stored as primitive string to preserve the flat-object constraint on aw_context.

  • call_workflow.cjs: Embeds aw_context (serialized as a JSON string) directly inside the call_workflow_payload JSON alongside the agent's message inputs. This propagates caller metadata and experiment assignments to called workflows without requiring a new workflow_call input declaration.

  • pick_experiment.cjs: Added parseParentExperimentAssignments() that reads GH_AW_EXPERIMENT_CONTEXT env var to extract parent workflow's experiment assignments. For each local experiment whose name matches a parent assignment (and the variant is valid), the parent's variant is reused without updating state counters. Local-only experiments are picked normally.

  • generate_aw_info.cjs: Added fallback to GH_AW_INPUT_AW_CONTEXT env var for workflow_call workflows, since ctx.payload.inputs is not populated for workflow_call triggers.

Go (pkg/workflow/)

  • compiler_yaml.go: Passes GH_AW_INPUT_AW_CONTEXT: ${{ fromJSON(inputs.payload || '{}').aw_context || '' }} in the generate_aw_info step for workflow_call workflows, extracting the embedded aw_context from the payload.

  • compiler_experiments.go: Sets GH_AW_EXPERIMENT_CONTEXT using a combined expression that handles both triggers transparently: ${{ inputs.aw_context || fromJSON(inputs.payload || '{}').aw_context || '' }}. For workflow_dispatch, inputs.aw_context is used directly; for workflow_call, the aw_context is extracted from the payload.

  • compiler_safe_outputs_steps.go: Adds GH_AW_EXPERIMENTS_JSON: ${{ needs.activation.outputs.experiments || '' }} env var to the safe_outputs handler step (when experiments are configured) so buildAwContext() can include them when building aw_context for dispatch/call.

Tests

  • pkg/workflow/compiler_aw_context_test.go - Tests for injectAwContextIntoOnYAML (dispatch injection only)
  • actions/setup/js/pick_experiment.test.cjs - Tests for parseParentExperimentAssignments and context inheritance behavior
  • actions/setup/js/dispatch_workflow.test.cjs - Tests for experiments field in aw_context
  • actions/setup/js/call_workflow.test.cjs - Tests verifying aw_context is embedded in the call payload and that experiment assignments are propagated

Behavior

Dispatch flow: Parent picks experiments → experiments included in aw_context sent to dispatched workflow → dispatched workflow's pick_experiment inherits parent variants for matching experiment names.

Call flow: Parent picks experiments → aw_context (with experiments) embedded inside call_workflow_payload JSON → compiler-generated call-* job passes the payload to the called workflow → called workflow's pick_experiment extracts aw_context from fromJSON(inputs.payload).aw_context and inherits parent variants.

Combination logic: Experiments in both parent context and local spec → use parent's variant (no state update). Experiments only in local spec → pick normally (state updated). Parent experiments not in local spec → ignored.

Copilot AI and others added 3 commits May 2, 2026 11:30
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
…all and dispatch

- Add `experiments` field to `buildAwContext()` in aw_context.cjs, sourced from
  `GH_AW_EXPERIMENTS_JSON` env var (JSON string of name→variant assignments)
- Inject `aw_context` as a workflow_call trigger input (mirroring the existing
  workflow_dispatch injection) via new `injectAwContextIntoWorkflowCallYAML`
- Pass `GH_AW_EXPERIMENTS_JSON` env var to the safe_outputs handler step so
  buildAwContext has access to current experiment assignments
- Expose `call_workflow_aw_context` as a safe_outputs job output
- Forward `aw_context` in the `with:` block of compiler-generated call-* fan-out jobs
- Pass `GH_AW_EXPERIMENT_CONTEXT` env var to the pick-experiment step so it can
  inherit parent experiment assignments via `${{ inputs.aw_context || '' }}`
- Update `pick_experiment.cjs` to read parent context from `GH_AW_EXPERIMENT_CONTEXT`:
  inherited variants reuse the parent's selection without updating state counters;
  local-only experiments are picked normally; invalid inherited variants fall through
- Update `generate_aw_info.cjs` to also check `GH_AW_INPUT_AW_CONTEXT` env var for
  workflow_call workflows (workflow_call inputs are not in ctx.payload.inputs)
- Pass `GH_AW_INPUT_AW_CONTEXT` env var in the generate_aw_info step for workflow_call
- Add `parseParentExperimentAssignments` exported for testing
- Add tests: compiler_aw_context_test.go, updated dispatch/call/pick_experiment tests
- Recompile all lock files to include new changes

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/80e7104a-6d75-4f0a-b864-98dd1bb21dc0

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
- Use Object.hasOwn() instead of Object.prototype.hasOwnProperty.call()
- Log warnings for non-string experiment values in parseParentExperimentAssignments
- Extract reservedCallWorkflowInputs map for centralized reserved input tracking
- Update test to verify warning emission for non-string values

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/80e7104a-6d75-4f0a-b864-98dd1bb21dc0

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copilot AI requested a review from pelikhan May 2, 2026 11:45
@pelikhan pelikhan marked this pull request as ready for review May 2, 2026 11:57
Copilot AI review requested due to automatic review settings May 2, 2026 11:57
@pelikhan
Copy link
Copy Markdown
Collaborator

pelikhan commented May 2, 2026

@copilot merge main and recompile

Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR ensures A/B experiment variant assignments are propagated through chained Agentic Workflows by embedding experiment assignments into aw_context and teaching called/dispatched workflows to inherit compatible parent assignments rather than re-picking.

Changes:

  • Add experiments (JSON string) to aw_context and propagate it through dispatch_workflow and call_workflow flows.
  • Inject aw_context as a workflow_call input and forward it through compiler-generated call-* fan-out jobs.
  • Update experiment picking to inherit parent assignments when valid, plus add tests for inheritance + propagation.
Show a summary per file
File Description
pkg/workflow/compiler_yaml.go Injects aw_context into workflow_call triggers and passes GH_AW_INPUT_AW_CONTEXT to generate_aw_info.
pkg/workflow/compiler_safe_outputs_steps.go Exposes GH_AW_EXPERIMENTS_JSON to handlers so aw_context can include experiment assignments.
pkg/workflow/compiler_safe_outputs_job.go Exposes call_workflow_aw_context as a safe_outputs job output.
pkg/workflow/compiler_safe_output_jobs.go Forwards aw_context into uses: call-* jobs and centralizes reserved workflow_call inputs.
pkg/workflow/compiler_experiments.go Passes parent aw_context into pick-experiment for inheritance via GH_AW_EXPERIMENT_CONTEXT.
pkg/workflow/compiler_aw_context.go Adds workflow_call injection helper to declare aw_context as an input.
pkg/workflow/compiler_aw_context_test.go Adds unit tests for workflow_call aw_context injection behavior.
actions/setup/js/aw_context.cjs Adds experiments field (string) to the generated aw_context.
actions/setup/js/call_workflow.cjs Adds call_workflow_aw_context output so fan-out jobs can forward context.
actions/setup/js/generate_aw_info.cjs Adds workflow_call fallback env var for aw_context (GH_AW_INPUT_AW_CONTEXT).
actions/setup/js/pick_experiment.cjs Adds parsing of parent experiment assignments and inheritance logic.
actions/setup/js/pick_experiment.test.cjs Adds tests for parent assignment parsing and inheritance behavior.
actions/setup/js/dispatch_workflow.test.cjs Verifies experiments is present in dispatched aw_context.
actions/setup/js/call_workflow.test.cjs Verifies call_workflow_aw_context output and experiment propagation.
.github/workflows/*.lock.yml Updates compiled workflows to include the new injected input/env/output wiring.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

  • Files reviewed: 19/19 changed files
  • Comments generated: 2

Comment thread pkg/workflow/compiler_aw_context.go Outdated
Comment on lines +178 to +194
// Look for an "inputs:" key directly inside workflow_call (at wcIndent+2 depth).
// Only the first non-empty, non-comment line after wcLineIdx matters.
inputsLineIdx := -1
for i := wcLineIdx + 1; i < len(lines); i++ {
stripped := strings.TrimLeft(lines[i], " \t")
if stripped == "" || strings.HasPrefix(stripped, "#") {
continue
}
lineIndent := len(lines[i]) - len(stripped)
if lineIndent <= wcIndent {
break // left workflow_call block entirely
}
if strings.HasPrefix(stripped, "inputs:") {
inputsLineIdx = i
}
break // only inspect the first substantive child key
}
Comment on lines +51 to +86
{
name: "workflow_call with existing inputs – aw_context added first",
input: `on:
workflow_call:
inputs:
payload:
type: string
required: false`,
wantSubs: []string{
AwContextInputName + ":",
"payload:",
"type: string",
},
},
{
name: "idempotent – aw_context not duplicated on second call",
input: `on:
workflow_call:
inputs:
aw_context:
default: ""
type: string`,
// No duplicate should be added
wantSubs: []string{AwContextInputName + ":"},
},
{
name: "both workflow_dispatch and workflow_call – both injected",
input: `on:
workflow_dispatch:
workflow_call:`,
wantSubs: []string{
"workflow_dispatch:",
"workflow_call:",
},
},
}
@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented May 2, 2026

🧪 Test Quality Sentinel Report

Test Quality Score: 86/100

Excellent test quality

Metric Value
New/modified tests analyzed 17
✅ Design tests (behavioral contracts) 17 (100%)
⚠️ Implementation tests (low value) 0 (0%)
Tests with error/edge cases 15 (88%)
Duplicate test clusters 0
Test inflation detected YES (call_workflow.test.cjs 51 vs 4 prod lines; pick_experiment.test.cjs 164 vs 75 prod lines)
🚨 Coding-guideline violations None

Test Classification Details

View all 17 test classifications
Test File Classification Notes
"should set call_workflow_aw_context output with aw_context JSON" call_workflow.test.cjs ✅ Design Verifies output name, valid JSON, required fields incl. experiments
"should include experiment assignments in call_workflow_aw_context when GH_AW_EXPERIMENTS_JSON is set" call_workflow.test.cjs ✅ Design Verifies env-var propagation to output; env teardown present
"returns empty object when env var is not set" pick_experiment.test.cjs ✅ Design Edge case: absent env var
"returns empty object when env var is empty string" pick_experiment.test.cjs ✅ Design Edge case: empty string
"returns empty object when env var is invalid JSON" pick_experiment.test.cjs ✅ Design Edge case: parse error recovery
"returns empty object when aw_context has no experiments field" pick_experiment.test.cjs ✅ Design Edge case: missing key
"returns empty object when experiments field is empty string" pick_experiment.test.cjs ✅ Design Edge case: empty nested field
"returns empty object when experiments field is invalid JSON" pick_experiment.test.cjs ✅ Design Edge case: nested parse error
"returns parsed assignments from valid aw_context" pick_experiment.test.cjs ✅ Design Happy path with full context
"filters out non-string experiment values and emits warnings" pick_experiment.test.cjs ✅ Design Validates type filtering + warning side-effects
"uses parent assignment when variant is in local spec" pick_experiment.test.cjs ✅ Design Verifies inheritance + state NOT updated
"picks normally when parent assignment is not in local spec's variants" pick_experiment.test.cjs ✅ Design Verifies fallback picking + state IS updated
"mixes inherited and locally-picked experiments" pick_experiment.test.cjs ✅ Design Complex mixed-mode behavior with state assertions
"inherited variants appear in the experiments JSON output" pick_experiment.test.cjs ✅ Design End-to-end output contract
TestInjectAwContextIntoWorkflowCallYAML compiler_aw_context_test.go ✅ Design Table-driven (6 rows): no-injection, bare call, null, existing inputs, idempotent, combined triggers
TestInjectAwContextIntoWorkflowCallYAML_Idempotent compiler_aw_context_test.go ✅ Design Idempotency invariant; asserts exact count of injected key
TestInjectAwContextIntoWorkflowCallYAML_PreservesExisting compiler_aw_context_test.go ✅ Design Non-destructive injection preserves existing inputs

Notes

Test inflation flag (informational): call_workflow.test.cjs added 51 test lines versus 4 production lines in call_workflow.cjs. The 12:1 ratio triggers the mechanical inflation check, but the context explains it: the production logic was spread across aw_context.cjs (+7 lines) and other files while the tests consolidate end-to-end coverage in one place. The tests are genuinely high-value — this is not padding.

dispatch_workflow.test.cjs: Only 1 assertion was added to an existing test (expect(awContext).toHaveProperty("experiments")). This is a contract extension to an already-designed test; it is not counted as a separate new test.

Go tests — assertion messages: All assert.* calls in compiler_aw_context_test.go include descriptive message arguments ✅.

Go tests — build tags: compiler_aw_context_test.go correctly opens with //go:build !integration on line 1 ✅.


Language Support

Tests analyzed:

  • 🐹 Go (*_test.go): 3 test functions (1 table-driven with 6 rows) — unit (//go:build !integration)
  • 🟨 JavaScript (*.test.cjs): 14 tests (vitest)

Verdict

Check passed. 0% of new tests are implementation tests (threshold: 30%). The suite covers all error paths for the new parseParentExperimentAssignments function, validates experiment propagation end-to-end in both JS handlers, and enforces Go-level idempotency and non-destructive injection invariants.


📖 Understanding Test Classifications

Design Tests (High Value) verify what the system does:

  • Assert on observable outputs, return values, or state changes
  • Cover error paths and boundary conditions
  • Would catch a behavioral regression if deleted
  • Remain valid even after internal refactoring

Implementation Tests (Low Value) verify how the system does it:

  • Assert on internal function calls (mocking internals)
  • Only test the happy path with typical inputs
  • Break during legitimate refactoring even when behavior is correct
  • Give false assurance: they pass even when the system is wrong

Goal: Shift toward tests that describe the system's behavioral contract — the promises it makes to its users and collaborators.

🧪 Test quality analysis by Test Quality Sentinel · ● 877.2K ·

Copy link
Copy Markdown
Contributor

@github-actions github-actions Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ Test Quality Sentinel: 86/100. Test quality is excellent — 0% of new tests are implementation tests (threshold: 30%). All 17 new/modified tests verify behavioral contracts with strong error-path and edge-case coverage.

…flow chains

Auto-generated by Design Decision Gate (run 25251362027).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented May 2, 2026

Commit pushed: 0026ca9

🏗️ ADR gate enforced by Design Decision Gate 🏗️

Copilot AI and others added 2 commits May 2, 2026 12:06
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/gh-aw/sessions/7094efcd-a959-40fd-b0fb-a0a77e6f49f1

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copy link
Copy Markdown
Contributor Author

Copilot AI commented May 2, 2026

@copilot merge main and recompile

Done — merged main and recompiled in e38e7ba.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

  • https://api.github.com/graphql
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw (http block)
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw -pack /home/REDACTED/work/gh-aw/gh-aw/pkg/constants/constants.go /home/REDACTED/work/gh-aw/gh-aw/pkg/constants/engine_constants.go (http block)
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw -embedcfg /tmp/go-build300534927/b345/embedcfg -pack (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v6
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv hZ7LJkpCV --get repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv --local --get bin/bash (http block)
  • https://api.github.com/repos/actions/download-artifact/git/ref/tags/v8
    • Triggering command: /usr/bin/gh gh api /repos/actions/download-artifact/git/ref/tags/v8 --jq [.object.sha, .object.type] | @tsv json (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/download-artifact/git/ref/tags/v8 --jq [.object.sha, .object.type] | @tsv .version=5f84572-dirty&#34; -o gh-aw ./cmd/gh-aw (http block)
    • Triggering command: `/usr/bin/gh gh api /repos/actions/download-artifact/git/ref/tags/v8 --jq [.object.sha, .object.type] | @TSV /home/REDACTED/work/gh-aw/gh-aw/.github/workflows config $name) {
      hasDiscussionsEnabled
      }
      } remote.origin.urgh s-agent-context ock.yml /usr/bin/gh api ithub/workflows n and recompile workflows

Agent-Logs-Url: REDACTED ache/uv/0.11.8/x86_64/bash -f owner=github -f infocmp` (http block)

  • https://api.github.com/repos/actions/github-script/git/ref/tags/v9
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv ACCEPT (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv INVALID,NEW -j DROP (http block)
  • https://api.github.com/repos/actions/setup-node/git/ref/tags/v6
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv ithub/workflows --get g_.a (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv --noprofile (http block)
  • https://api.github.com/repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b
    • Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq [.object.sha, .object.type] | @tsv (http block)
    • Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq [.object.sha, .object.type] | @tsv /ref/tags/v9 (http block)
    • Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq [.object.sha, .object.type] | @tsv ithub/workflows --jq kflows/daily-safe-outputs-conformance.lock.yml (http block)
  • https://api.github.com/repos/docker/metadata-action/git/ref/tags/v6
    • Triggering command: /usr/bin/gh gh api /repos/docker/metadata-action/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv (http block)
    • Triggering command: /usr/bin/gh gh api /repos/docker/metadata-action/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv /home/REDACTED/worremote.origin.url erena-mcp-server:latest 64/bin/bash remote.origin.ur/usr/bin/gh (http block)
    • Triggering command: /usr/bin/gh gh api /repos/docker/metadata-action/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv /repos/actions/github-script/git/ref/tags/v9 --jq /usr/bin/git (http block)
  • https://api.github.com/repos/docker/setup-buildx-action/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/docker/setup-buildx-action/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv (http block)
    • Triggering command: /usr/bin/gh gh api /repos/docker/setup-buildx-action/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv k/gh-aw/gh-aw/.github/workflows (http block)
    • Triggering command: /usr/bin/gh gh api /repos/docker/setup-buildx-action/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv /home/REDACTED/work/gh-aw/gh-aw/.gremote.origin.url rev-parse /usr/bin/git (http block)
  • https://api.github.com/repos/github/gh-aw
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw --jq .default_branch ithub/workflows --local ock.yml user.name (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw --jq .default_branch ithub/workflows config ock.yml remote.origin.urgit (http block)

If you need me to access, download, or install something from one of these locations, you can either:

@pelikhan
Copy link
Copy Markdown
Collaborator

pelikhan commented May 2, 2026

@copilot review changes, keep things minimal. The context should be integrated in the payload, not additional args

Copilot AI and others added 2 commits May 2, 2026 15:57
…te workflow_call input

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/8d4ba1dd-fe13-4f99-b570-8a66ed4809bd

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copy link
Copy Markdown
Contributor Author

Copilot AI commented May 2, 2026

@copilot review changes, keep things minimal. The context should be integrated in the payload, not additional args

Done in 1b8486e. Removed injectAwContextIntoWorkflowCallYAML and the separate call_workflow_aw_context output. Instead, call_workflow.cjs embeds aw_context inside the existing call_workflow_payload JSON (alongside the agent's message inputs). The called workflow's pick-experiment step reads it via fromJSON(inputs.payload || '{}').aw_context — no new workflow_call inputs required.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

  • https://api.github.com/graphql
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw (http block)
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw journal-or-kmsg (http block)
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw %H %ct %D (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v6
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv te &#39;**/*.cjs&#39; &#39;**/*.ts&#39; &#39;**/*.json&#39; --ignore-pat-f (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv k/gh-aw/gh-aw/.g-f **/*.cjs repository(owne-f **/*.json --ignore-path ../../../.pretti--noprofile sh -c k/gh-aw/gh-aw/.github/workflows (http block)
  • https://api.github.com/repos/actions/download-artifact/git/ref/tags/v8
    • Triggering command: /usr/bin/gh gh api /repos/actions/download-artifact/git/ref/tags/v8 --jq [.object.sha, .object.type] | @tsv *.json&#39; &#39;!../../../pkg/workflow/js/**/*.json&#39; --ignore-path ../../../.prettierignore origin $name) { hasDiscussionsEnabled } } (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/download-artifact/git/ref/tags/v8 --jq [.object.sha, .object.type] | @tsv *.json&#39; &#39;!../../../pkg/workflow/js/**/*.json&#39; --ignore-path ../../../.prettierignore origin ache/uv/0.11.8/x86_64/bash (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/download-artifact/git/ref/tags/v8 --jq [.object.sha, .object.type] | @tsv inspect mcp/memory $name) { hasDiscussionsEnabled } } (http block)
  • https://api.github.com/repos/actions/github-script/git/ref/tags/v9
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv -c=4 -nolocalimports -importcfg /tmp/go-build4025453215/b345/importcfg -embedcfg /tmp/go-build4025453215/b345/embedcfg -pack (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv ignore-path ../../../.prettierignore ame tnet/tools/git (http block)
  • https://api.github.com/repos/actions/github-script/git/ref/tags/v9.0.0
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9.0.0 --jq [.object.sha, .object.type] | @tsv k/gh-aw/gh-aw git itors-health-check.lock.yml /home/REDACTED/worinfocmp show $name) { hasxterm-color gh api k/gh-aw/gh-aw --jq (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9.0.0 --jq [.object.sha, .object.type] | @tsv /home/REDACTED/work/gh-aw/gh-aw/.github/workflows rev-parse 86_64/bash ithub/workflows git /usr/bin/gh docker imag�� inspect ghcr.io/github/serena-mcp-server:latest /usr/bin/git graphql erena-mcp-serverrev-parse /usr/bin/git git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9.0.0 --jq [.object.sha, .object.type] | @tsv k/gh-aw/gh-aw/.github/workflows --jq (http block)
  • https://api.github.com/repos/actions/setup-go/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv ithub/workflows show /usr/bin/git /home/REDACTED/worgit :latest /usr/bin/gh git -C k/gh-aw/gh-aw/.github/workflows config /usr/bin/git remote.origin.urgh -f bject.type] | @t/repos/actions/github-script/git/ref/tags/v9 git (http block)
  • https://api.github.com/repos/actions/setup-node/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv ithub/workflows rev-parse ndor/bin/bash ithub/workflows --jq kflows/example-w/repos/actions/github-script/git/ref/tags/v9 infocmp -1 ithub-script/git/ref/tags/v9 git bject.type] | @tsv /home/REDACTED/worgit config -alignment.lock.--show-toplevel infocmp (http block)
  • https://api.github.com/repos/actions/setup-node/git/ref/tags/v6
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv ithub/workflows (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv k/gh-aw/gh-aw **/*.cjs kflows/claude-code-user-docs-review.lock.yml **/*.json --ignore-path ../../../.pretti--noprofile sh -c /ref/tags/v9 (http block)
  • https://api.github.com/repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b
    • Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq [.object.sha, .object.type] | @tsv re --log-level=error --local /node committer.name (http block)
    • Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq [.object.sha, .object.type] | @tsv get --local 1/x64/bin/bash committer.email (http block)
    • Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq [.object.sha, .object.type] | @tsv xterm-color (http block)
  • https://api.github.com/repos/docker/metadata-action/git/ref/tags/v6
    • Triggering command: /usr/bin/gh gh api /repos/docker/metadata-action/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv --noprofile (http block)
    • Triggering command: /usr/bin/gh gh api /repos/docker/metadata-action/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv k/gh-aw/gh-aw/.gremote.origin.url --jq /usr/bin/docker l (http block)
    • Triggering command: /usr/bin/gh gh api /repos/docker/metadata-action/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv xterm-color bash 1/x64/bin/bash ../pkg/workflow/git (http block)
  • https://api.github.com/repos/docker/setup-buildx-action/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/docker/setup-buildx-action/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --noprofile (http block)
    • Triggering command: /usr/bin/gh gh api /repos/docker/setup-buildx-action/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv graphql -call.lock.yml /usr/bin/docker -f owner=github -f docker imag�� ithub-script/git/ref/tags/v9 mcp/ast-grep:latest bject.type] | @tsv --noprofile (http block)
    • Triggering command: /usr/bin/gh gh api /repos/docker/setup-buildx-action/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv /home/REDACTED/work/gh-aw/gh-aw/.github/workflows erena-mcp-server:latest 86_64/bash ../pkg/workflow/gh (http block)
  • https://api.github.com/repos/github/gh-aw
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw --jq .default_branch ithub/workflows c ock.yml - (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw --jq .default_branch ithub/workflows bash ock.yml --noprofile (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw --jq .default_branch ithub/workflows go ock.yml r GO111MODULE 64/bin/go /opt/hostedtoolcshow k/gh�� ithub/workflows on rkflow/js/**/*.json /../../.prettiergit erignore dataset sh (http block)
  • invalid.example.invalid
    • Triggering command: /usr/lib/git-core/git-remote-https origin https://invalid.example.invalid/nonexistent-repo.git (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

@pelikhan pelikhan closed this May 2, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants