Add mention-in-issue and mention-in-pr with sandbox: false

[strawgate]

Otherwise no docker access, which is a requirement in some projects. Add variations, dont replace the existing ones

[github-actions]

1 related issue

• Mention in PR for reviews #55 — Covers the same mention-in-PR workflow area and includes prior changes to mention flow behavior, which could help when adding the new sandbox: false variant.

---

What is this? | From workflow: Duplicate Issue Detector

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

[github-actions]

Adding new mention workflow variants that disable the agent sandbox is the right fix, and it should be implemented as additive -no-sandbox workflows (not replacements) for both issue and PR mentions.

Recommendation

Implement two new reusable workflows and matching trigger examples:

• gh-aw-mention-in-issue-no-sandbox (source + compiled lock + example trigger)
• gh-aw-mention-in-pr-no-sandbox (source + compiled lock + example trigger)

Use gh-aw frontmatter sandbox config (sandbox.agent: false) for the new variants only, while keeping existing mention-in-issue / mention-in-pr unchanged as the safe default.

Findings

1. Current mention workflows do not expose any sandbox toggle input to callers.

   • .github/workflows/gh-aw-mention-in-issue.lock.yml:51-83 (workflow_call.inputs includes model, setup-commands, etc., but no sandbox input)
   • .github/workflows/gh-aw-mention-in-pr.lock.yml:54-80 (same pattern)

2. Current mention source workflows define strict: false but no explicit sandbox frontmatter.

   • .github/workflows/gh-aw-mention-in-issue.md:81
   • .github/workflows/gh-aw-mention-in-pr.md:79

3. Trigger examples are wired only to the current lock workflows.

   • gh-agent-workflows/mention-in-issue/example.yml:18-20
   • gh-agent-workflows/mention-in-pr/example.yml:20-22

4. Dogfood triggers in this repo are also wired only to current variants.

   • .github/workflows/trigger-mention-in-issue.yml:20-24
   • .github/workflows/trigger-mention-in-pr.yml:22-25

5. Discovery/install surfaces currently only list the existing mention workflows.

   • scripts/quick-setup.sh:121-126 (default list)
   • docs/workflows/gh-agent-workflows.md:43-45 (human-coordinated table)
   • mkdocs.yml:22-24 (nav entries)

6. Related history checked:

   • #14 introduced mention workflows (merged)
   • #57 refined mention-in-pr behavior (merged, linked to #55)
   • #220 adjusted mention-in-pr setup behavior (merged)
   • No existing issue/PR was found that already adds sandbox-disabled mention variants.

7. Upstream gh-aw syntax supports explicit sandbox configuration (for the workflow source frontmatter), including disabling agent sandbox via sandbox: { agent: false } (reference: github/gh-aw docs reference/sandbox.md and reference/frontmatter-full.md).

Verification

I ran repository workflow linting to ensure current baseline is healthy:

make lint-workflows

Result: passed (exit code 0), including trigger files for mention workflows:

• .github/workflows/trigger-mention-in-issue.yml
• .github/workflows/trigger-mention-in-pr.yml

I also verified the mention workflow sources/locks contain no sandbox frontmatter field today (only existing defaults), based on direct file inspection listed above.

Detailed Action Plan

1. Add two new workflow source files (do not modify existing behavior):

   • Copy .github/workflows/gh-aw-mention-in-issue.md → .github/workflows/gh-aw-mention-in-issue-no-sandbox.md
   • Copy .github/workflows/gh-aw-mention-in-pr.md → .github/workflows/gh-aw-mention-in-pr-no-sandbox.md
   • In each new file, set frontmatter sandbox config to disable agent sandbox (sandbox.agent: false), keeping all other behavior aligned with original workflow.

2. Add user-facing trigger templates for the new variants:

   • New directories:
     • gh-agent-workflows/mention-in-issue-no-sandbox/
     • gh-agent-workflows/mention-in-pr-no-sandbox/
   • Add README.md, example.yml, and dogfood-with.yml patterned after existing mention workflows, but uses: should target the new *-no-sandbox.lock.yml workflows.

3. Wire dogfood trigger generation:

   • Ensure scripts/dogfood.sh includes new workflow folders so generated triggers appear under .github/workflows/trigger-mention-in-issue-no-sandbox.yml and .github/workflows/trigger-mention-in-pr-no-sandbox.yml.

4. Update docs/navigation/install surfaces:

   • Add both variants to workflow catalog docs and explain security tradeoff (sandbox disabled, broader host capabilities including Docker use-cases).
   • Update mkdocs.yml nav to include the two new workflow pages.
   • Decide whether scripts/quick-setup.sh includes them by default or as opt-in only (recommended opt-in to preserve safer defaults).

5. Compile and validate:

   • Run make compile to generate new lock files.
   • Run make lint (or at minimum make lint-workflows) to confirm all generated triggers and workflow files validate.

6. Safety note in docs/READMEs for new variants:

   • Explicitly document that these are less isolated than default mention workflows and should be used only when host/container access is required.

Related Items

Type	Link	Relevance
Issue	#366	Current request
PR	#14	Introduced mention-in-issue / mention-in-pr workflows
PR	#57	Prior mention-in-pr behavior refinement
PR	#220	Prior mention-in-pr runtime adjustment
File	.github/workflows/gh-aw-mention-in-issue.md:81	Current source has no explicit sandbox config
File	.github/workflows/gh-aw-mention-in-pr.md:79	Current source has no explicit sandbox config
File	gh-agent-workflows/mention-in-issue/example.yml:18-20	Current trigger template wiring
File	gh-agent-workflows/mention-in-pr/example.yml:20-22	Current trigger template wiring
File	scripts/quick-setup.sh:121-126	Default workflow install list
Web	https://github.github.com/gh-aw/reference/sandbox/	Upstream sandbox frontmatter reference

---

What is this? | From workflow: Issue Triage

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.