Skip to content

Comments

Route model to engine via native CLI environment variables#17296

Merged
pelikhan merged 6 commits intomainfrom
copilot/add-model-env-var
Feb 20, 2026
Merged

Route model to engine via native CLI environment variables#17296
pelikhan merged 6 commits intomainfrom
copilot/add-model-env-var

Conversation

Copy link
Contributor

Copilot AI commented Feb 20, 2026

  • Add ModelEnvVarProvider interface to agentic_engine.go with GetModelEnvVarName() string
  • Add default GetModelEnvVarName() returning "" to BaseEngine
  • Add ModelEnvVarProvider to CodingAgentEngine composite interface
  • Add ClaudeCLIModelEnvVar = "ANTHROPIC_MODEL" and GeminiCLIModelEnvVar = "GEMINI_MODEL" constants
  • Implement GetModelEnvVarName() on CopilotEngineCOPILOT_MODEL
  • Implement GetModelEnvVarName() on ClaudeEngineANTHROPIC_MODEL
  • Implement GetModelEnvVarName() on CodexEngine"" (no native env var)
  • Implement GetModelEnvVarName() on GeminiEngineGEMINI_MODEL
  • Copilot engine: ALL model configs set COPILOT_MODEL env var; no --model flag
  • Claude engine: ALL model configs set ANTHROPIC_MODEL env var; no --model flag
  • Gemini engine: ALL model configs set GEMINI_MODEL env var; no --model flag
  • Codex engine: ALL model configs route through GH_AW_MODEL_*_CODEX with shell expansion
  • Update all affected tests
  • Merge main and recompile all 153 workflow files
Original prompt

This section details on the original issue you should resolve

<issue_title>Provide model to engine as an env var</issue_title>
<issue_description>right now the model is provided to the engine directly --model gpt-5.3-codex :

copilot --add-dir /tmp/ --add-dir /tmp/gh-aw/ --add-dir /tmp/gh-aw/agent/ --log-level all --log-dir /tmp/gh-aw/sandbox/agent/logs/ --disable-builtin-mcps --model gpt-5.3-codex --allow-tool 'shell(cat)' --allow-tool 'shell(grep)' --allow-tool 'shell(head)' --allow-tool 'shell(jq)' --allow-tool 'shell(ls)' --allow-tool 'shell(tail)' --allow-tool 'shell(wc)' --share /tmp/gh-aw/sandbox/agent/logs/conversation.md --prompt "$COPILOT_CLI_INSTRUCTION" 2>&1 | tee /tmp/gh-aw/threat-detection/detection.log

Ideally the model would be used to populate an environment variable and then the env var used in the call.

Otherwise if you try to make the model a variable or a workflow_call input, the variable syntax ends up in the shell command directly and the compiler refuses to compile it (due to prompt injection validation)

Copilot doesnt accept the model as an env var directly, so you'd still need to reference the env var in the shell command.</issue_description>

Comments on the Issue (you are @copilot in this section)


💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

…ed (#issue)

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copilot AI changed the title [WIP] Provide model to engine as an environment variable Support GitHub Actions expressions as model value in engine config Feb 20, 2026
@pelikhan
Copy link
Contributor

@copilot you need to use the env var support by copilot-cli

…opilot engine

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copy link
Contributor Author

Copilot AI commented Feb 20, 2026

@copilot you need to use the env var support by copilot-cli

Updated in 844f237. When model is a GitHub Actions expression (e.g. ${{ inputs.model }}), the Copilot engine now sets the native COPILOT_MODEL env var that the Copilot CLI reads directly — no --model flag in the shell command needed. A CopilotCLIModelEnvVar = "COPILOT_MODEL" constant was added to pkg/constants.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

  • https://api.github.com/graphql
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw (http block)
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw -buildtags ode-gyp-bin/node--verify node js/f�� -nilfunc ffae10471b2c1a8c0a953478 nfig/composer/vendor/bin/bash --show-toplevel -tests /usr/bin/git sh (http block)
  • https://api.github.com/repos/actions/ai-inference/git/ref/tags/v1
    • Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq .object.sha (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq .object.sha --show-toplevel rtcfg ache/node/24.13.0/x64/bin/node g/workflow/featugit g/workflow/imporrev-parse ache/go/1.25.0/x--show-toplevel git _inc�� *.json&#39; &#39;!../../../pkg/workflow/js/**/*.json&#39; --ignore-path ../../../.prettierignore ache/go/1.25.0/x64/pkg/tool/linux_amd64/vet ache/node/24.13.0/x64/bin/node cgroup2 --noheadings /opt/hostedtoolc--show-toplevel git (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v3
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq .object.sha (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq .object.sha --show-toplevel 64/pkg/tool/linux_amd64/vet odules/npm/node_modules/@npmcli/run-script/lib/node-gyp-bin/node (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v4 --jq .object.sha (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v4 --jq .object.sha --noprofile (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v4 --jq .object.sha kflow/model_env_vars_test.go ache/go/1.25.0/x64/pkg/tool/linux_amd64/vet de/node/bin/sh copilot/add-modegit (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v5
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha get --local ache/go/1.25.0/x64/pkg/tool/linux_amd64/vet credential.userngit (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha -unreachable=false /tmp/go-build829157794/b136/vet.cfg 157794/b323/vet.cfg (http block)
  • https://api.github.com/repos/actions/github-script/git/ref/tags/v8
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha --noprofile (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha --show-toplevel ache/go/1.25.0/x64/pkg/tool/linu-ifaceassert /usr/bin/git se 157794/b050/vet.rev-parse cfg git rev-�� */*.ts&#39; &#39;**/*.json&#39; --ignore-path ../../../.prettierignore ache/go/1.25.0/x-10 tions/setup/node_modules/.bin/sh se 157794/b214/vet.rev-parse ache/go/1.25.0/x--show-toplevel git (http block)
  • https://api.github.com/repos/actions/setup-go/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq .object.sha (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq .object.sha kflow/model_env_vars_test.go ache/go/1.25.0/x64/pkg/tool/linux_amd64/vet /usr/bin/git se 157794/b046/vet.rev-parse cfg git rev-�� */*.ts&#39; &#39;**/*.json&#39; --ignore-path ../../../.prettierignore ache/go/1.25.0/x64/pkg/tool/linux_amd64/vet 0/x64/lib/node_modules/npm/node_modules/@npmcli/run-script/lib/node-gyp-bin/sh se 157794/b208/vet.rev-parse ache/go/1.25.0/x--show-toplevel git (http block)
  • https://api.github.com/repos/actions/setup-node/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq .object.sha (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq .object.sha kflow/model_env_vars_test.go ache/go/1.25.0/x64/pkg/tool/linux_amd64/vet /usr/bin/git se 157794/b038/vet.rev-parse cfg git rev-�� */*.ts&#39; &#39;**/*.json&#39; --ignore-path ../../../.prettierignore ache/go/1.25.0/x--auto ache/node/24.13.0/x64/bin/node se 157794/b210/vet.rev-parse ache/go/1.25.0/x--show-toplevel git (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq .object.sha (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq .object.sha --show-toplevel x_amd64/vet e/git (http block)
  • https://api.github.com/repos/nonexistent/action/git/ref/tags/v999.999.999
    • Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq .object.sha (http block)
    • Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq .object.sha --show-toplevel x_amd64/vet /usr/bin/git (http block)

If you need me to access, download, or install something from one of these locations, you can either:

@pelikhan
Copy link
Contributor

@copilot extend the agentic engine interface to provide the name of the model environment variable. In that case, the compiler should set the variable to the model id.

Research and apply to Anthropic Claude, OpenAI Codex, GitHub Copilot CLI

…vars for Copilot, Claude, and Gemini

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copy link
Contributor Author

Copilot AI commented Feb 20, 2026

@copilot extend the agentic engine interface to provide the name of the model environment variable. In that case, the compiler should set the variable to the model id.

Research and apply to Anthropic...

Done in 2ab9ffc. Added ModelEnvVarProvider interface to CodingAgentEngine with GetModelEnvVarName() string:

  • CopilotCOPILOT_MODEL (already supported by Copilot CLI)
  • ClaudeANTHROPIC_MODEL (supported by Claude Code CLI)
  • GeminiGEMINI_MODEL (supported by Gemini CLI)
  • Codex"" (no native model env var; routes through GH_AW_MODEL_*_CODEX with shell expansion)

For engines with a native env var, model is now always set as an env var (both static values and GitHub Actions expressions), removing the need to embed --model in the shell command. The BaseEngine default returns "" so custom engines are unaffected.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

  • https://api.github.com/graphql
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw (http block)
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw /tmp/go-build330show-ref 7543673/b275/vet--verify git _inc�� --show-toplevel /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/vet nfig/composer/vendor/bin/bash -bool -buildtags /opt/hostedtoolc--show-toplevel git (http block)
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw git /usr/bin/git bash --no�� --noprofile git nfig/composer/vendor/bin/bash --show-toplevel git /usr/bin/git bash (http block)
  • https://api.github.com/repos/actions/ai-inference/git/ref/tags/v1
    • Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq .object.sha --noprofile (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq .object.sha HEAD bash 0/x64/bin/node --noprofile (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq .object.sha --show-toplevel git cal/bin/bash --show-toplevel /opt/hostedtoolcrev-parse /opt/hostedtoolc--show-toplevel git rev-�� PIC_MODEL go nfig/composer/vendor/bin/bash 64/bin/bash /opt/hostedtoolcrev-parse /opt/hostedtoolc--show-toplevel node (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v3
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq .object.sha --noprofile (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq .object.sha --show-toplevel x_amd64/vet e/git 1 (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq .object.sha --show-toplevel git 0/x64/bin/node --show-toplevel ache/go/1.25.0/xrev-parse /usr/bin/git git js --show-toplevel git /usr/bin/git --show-toplevel ache/go/1.25.0/xrev-parse ache/node/24.13.--show-toplevel git (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v4 --jq .object.sha --noprofile .cfg 64/pkg/tool/linux_amd64/vet g (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v4 --jq .object.sha --noprofile .cfg stAgentic (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v4 --jq .object.sha -unreachable=false /tmp/go-build3307543673/b098/vet.cfg /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/vet (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v5
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha get --local bash user.name (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha --noprofile (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha -unreachable=false /tmp/go-build3307543673/b230/vet.cfg /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/vet (http block)
  • https://api.github.com/repos/actions/github-script/git/ref/tags/v8
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha --noprofile .cfg 64/pkg/tool/linux_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha -unreachable=false /tmp/go-build3307543673/b088/vet.cfg /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha (http block)
  • https://api.github.com/repos/actions/setup-go/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq .object.sha --noprofile .cfg 64/pkg/tool/linux_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq .object.sha (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq .object.sha --show-toplevel git ache/node/24.13.0/x64/bin/node --show-toplevel ache/go/1.25.0/xrev-parse ache/go/1.25.0/x--show-toplevel git _lab�� --show-toplevel ache/go/1.25.0/x64/pkg/tool/linux_amd64/compile /usr/bin/git --show-toplevel /opt/hostedtoolcrev-parse /opt/hostedtoolc--show-toplevel git (http block)
  • https://api.github.com/repos/actions/setup-node/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq .object.sha --noprofile (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq .object.sha (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq .object.sha --show-toplevel git 0/x64/bin/bash --show-toplevel ache/go/1.25.0/xrev-parse ache/go/1.25.0/x--show-toplevel git _inc�� --show-toplevel git /usr/bin/git --show-toplevel /opt/hostedtoolcrev-parse /opt/hostedtoolc--show-toplevel git (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq .object.sha get --global /usr/local/bin/git http.https://git/opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq .object.sha --show-toplevel /systemd-executo-buildtags /usr/bin/git --local credential.usernjs/fuzz_mentions_harness.cjs p/bin/bash git rev-�� --show-toplevel git /usr/bin/git copilot/add-modenode (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq .object.sha --show-toplevel git /usr/bin/git --show-toplevel 64/pkg/tool/linu--norc /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel 64/pkg/tool/linu-15 0/x64/bin/node git (http block)
  • https://api.github.com/repos/nonexistent/action/git/ref/tags/v999.999.999
    • Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq .object.sha get --global ndor/bin/bash http.https://git/opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq .object.sha --show-toplevel /sadc /usr/bin/git --local credential.usernjs/fuzz_mentions_harness.cjs 64/pkg/tool/linu-nilfunc git 3002�� --show-toplevel 64/pkg/tool/linu-tests /usr/bin/git copilot/add-modenode (http block)
    • Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq .object.sha --show-toplevel git /usr/bin/git --show-toplevel Fa/rKqIaSuAQnYo2--norc /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel 64/pkg/tool/linu-V=full 0/x64/bin/node git (http block)

If you need me to access, download, or install something from one of these locations, you can either:

Copilot AI changed the title Support GitHub Actions expressions as model value in engine config Route model to engine via native CLI environment variables Feb 20, 2026
@pelikhan pelikhan added the smoke label Feb 20, 2026
@github-actions
Copy link
Contributor

github-actions bot commented Feb 20, 2026

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

@github-actions
Copy link
Contributor

github-actions bot commented Feb 20, 2026

🎬 THE ENDSmoke Claude MISSION: ACCOMPLISHED! The hero saves the day! ✨

@github-actions
Copy link
Contributor

📰 BREAKING: Smoke Copilot is now investigating this pull request. Sources say the story is developing...

@github-actions
Copy link
Contributor

🧪 Smoke Temporary ID is now testing temporary ID functionality...

@github-actions
Copy link
Contributor

🧪 Smoke Project is now testing project operations...

@pelikhan pelikhan marked this pull request as ready for review February 20, 2026 23:16
Copilot AI review requested due to automatic review settings February 20, 2026 23:16
@github-actions
Copy link
Contributor

Smoke Project completed successfully. All project operations validated.

@pelikhan
Copy link
Contributor

Add @copilot, merge main, and recompile.

@github-actions
Copy link
Contributor

Smoke test results for @pelikhan and @Copilot:

Test Result
GitHub MCP (merged PRs)
Safe Inputs GH CLI
Serena MCP
Playwright
File Writing
Bash Tool
Discussion Interaction
Build gh-aw
Discussion Creation
Workflow Dispatch
PR Review

Overall: ⚠️ PARTIAL PASS (Serena MCP unavailable)

Run: https://github.com/github/gh-aw/actions/runs/22244922259

📰 BREAKING: Report filed by Smoke Copilot

Copy link
Contributor

@github-actions github-actions bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reviewed PR #17296 "Route model to engine via native CLI environment variables". The approach of using native CLI environment variables (COPILOT_MODEL, ANTHROPIC_MODEL, GEMINI_MODEL) is clean and avoids template injection issues. The ModelEnvVarProvider interface is well-structured with good defaults via BaseEngine. Build passes ✅.

📰 BREAKING: Report filed by Smoke Copilot


// ClaudeCLIModelEnvVar is the native environment variable name supported by the Claude Code CLI
// for selecting the model. Setting this env var is equivalent to passing --model to the CLI.
ClaudeCLIModelEnvVar = "ANTHROPIC_MODEL"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good use of named constants for the native CLI env vars. This makes it easy to update them in one place if the CLIs change their env var names in the future.

// GetModelEnvVarName returns the name of the native environment variable the CLI
// uses for model selection (e.g., "COPILOT_MODEL", "ANTHROPIC_MODEL", "GEMINI_MODEL").
// Returns an empty string if the engine does not support a native model env var.
GetModelEnvVarName() string
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The ModelEnvVarProvider interface is clean and well-documented. One suggestion: consider adding a note in the interface doc that returning "" means the engine relies on the existing GH_AW_MODEL_* environment variable fallback, to clarify the contract for future implementors.

Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Routes engine model selection through environment variables to avoid embedding GitHub Actions expressions in shell commands (preventing template injection validation failures) and to leverage engines’ native model env var support.

Changes:

  • Added ModelEnvVarProvider to the CodingAgentEngine composite interface, with a default no-op implementation on BaseEngine.
  • Updated Copilot/Claude/Gemini engines to set native model env vars (COPILOT_MODEL, ANTHROPIC_MODEL, GEMINI_MODEL) when engine.model is configured; Codex continues using GH_AW_* env vars + shell expansion.
  • Updated/added tests to assert model is provided via env vars and not embedded as --model ... in commands for engines that support native env vars.

Reviewed changes

Copilot reviewed 13 out of 13 changed files in this pull request and generated 2 comments.

Show a summary per file
File Description
pkg/workflow/agentic_engine.go Adds ModelEnvVarProvider interface and composes it into CodingAgentEngine; provides BaseEngine default.
pkg/constants/constants.go Introduces constants for native CLI model env var names.
pkg/workflow/copilot_engine.go Implements GetModelEnvVarName() for Copilot.
pkg/workflow/copilot_engine_execution.go Switches Copilot model handling to native env var when configured; keeps GH_AW_* fallback + shell expansion when not configured.
pkg/workflow/claude_engine.go Switches Claude model handling to native env var when configured; keeps GH_AW_* fallback + shell expansion when not configured.
pkg/workflow/codex_engine.go Routes configured model through GH_AW_* env vars consistently, always using shell expansion for -c model=....
pkg/workflow/gemini_engine.go Switches configured model to GEMINI_MODEL; retains GH_AW_* env var fallback (but currently does not apply it to the command).
pkg/workflow/threat_detection_test.go Updates detection test expectations to look for env var model wiring (not --model).
pkg/workflow/model_env_vars_test.go Adds coverage for explicit/expression models using env vars and for GetModelEnvVarName().
pkg/workflow/gemini_engine_test.go Updates model test to assert GEMINI_MODEL is set and --model is not embedded.
pkg/workflow/engine_config_test.go Updates expectations around model propagation (env var vs CLI flag).
pkg/workflow/claude_engine_test.go Updates model assertions to env var wiring.
pkg/workflow/claude_engine_network_test.go Updates network-permissions tests to check env var model wiring.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment on lines +174 to +176
// Model is passed via the native GEMINI_MODEL env var (not as a --model flag)
assert.Contains(t, stepContent, "GEMINI_MODEL: gemini-1.5-pro", "Should set GEMINI_MODEL env var")
assert.NotContains(t, stepContent, "--model gemini-1.5-pro", "Should not embed model in command")
Copy link

Copilot AI Feb 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The tests verify that GH_AW_MODEL_AGENT_GEMINI / GH_AW_MODEL_DETECTION_GEMINI appear in the step YAML, but they don’t assert that those env vars actually affect the executed command. Given the current implementation, it’s possible for these vars to be present yet unused.

Add an assertion for the unconfigured-model case that the step either sets GEMINI_MODEL from the GH_AW vars or conditionally adds a --model argument based on GH_AW_MODEL_*_GEMINI (matching the intended behavior described in the PR).

Copilot uses AI. Check for mistakes.
Comment on lines +175 to 180
// Model is always passed via the native GEMINI_MODEL environment variable when configured.
// This avoids embedding the value directly in the shell command (which fails template injection
// validation for GitHub Actions expressions like ${{ inputs.model }}).
// Fallback for unconfigured model uses GH_AW_MODEL_AGENT_GEMINI with shell expansion.
modelConfigured := workflowData.EngineConfig != nil && workflowData.EngineConfig.Model != ""

Copy link

Copilot AI Feb 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In the unconfigured-model path, Gemini sets GH_AW_MODEL_AGENT_GEMINI / GH_AW_MODEL_DETECTION_GEMINI in env, but the generated geminiCommand never references those variables (no conditional --model shell expansion, and GEMINI_MODEL is only set when modelConfigured). As a result, setting GH_AW_MODEL_*_GEMINI will not actually change the model used by the Gemini CLI.

Update the command/env logic so the fallback env var influences execution (e.g., either set GEMINI_MODEL from the GH_AW vars when not explicitly configured, or append a conditional --model "$GH_AW_MODEL_*_GEMINI" segment to geminiCommand).

Copilot uses AI. Check for mistakes.
@github-actions
Copy link
Contributor

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

@github-actions
Copy link
Contributor

Smoke test results:
PR titles: Fix safe output documentation errors in agent instructions; Fix validation consistency across all safe output types
GitHub MCP: ✅
Serena MCP (activate+find_symbol): ✅
Playwright (GitHub title): ✅
File write: ✅
Bash cat: ✅
Build: ✅
Overall: PASS

🔮 The oracle has spoken through Smoke Codex

Copilot AI and others added 2 commits February 20, 2026 23:23
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copy link
Contributor Author

Copilot AI commented Feb 20, 2026

Add @copilot, merge main, and recompile.

Done in 2a2313c. Merged main and recompiled all 153 workflow files.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

  • https://api.github.com/graphql
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw (http block)
  • https://api.github.com/repos/actions/ai-inference/git/ref/tags/v1
    • Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq .object.sha k/gh-aw/gh-aw/.github/workflows .cfg 64/pkg/tool/linux_amd64/vet (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/11bd71901bbe5b1630ceea73d27597364c9af683
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/11bd71901bbe5b1630ceea73d27597364c9af683 --jq .object.sha (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v3
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq .object.sha (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v4 --jq .object.sha ithub/workflows (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v4 --jq .object.sha /home/REDACTED/work/gh-aw/gh-aw/.github/workflows rev-parse /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/vet (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v5
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha /home/REDACTED/work/gh-aw/gh-aw/.github/workflows config ache/go/1.25.0/x64/pkg/tool/linux_amd64/vet remote.origin.urgit (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha -unreachable=false /tmp/go-build3406489530/b045/vet.cfg 6489530/b300/vet.cfg (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v6
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha (http block)
  • https://api.github.com/repos/actions/github-script/git/ref/tags/v7
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v7 --jq .object.sha (http block)
  • https://api.github.com/repos/actions/github-script/git/ref/tags/v8
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha -aw/git/ref/tags/a70c5eada06553e-p --auto me: String!) { repository(owne-lang=go1.25 --detach (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha -v --reset /home/REDACTED/.config/composer/vendor/bin/bash 2ab9ffc0585077c9git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha se 6489530/b074/vet.cfg /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/vet (http block)
  • https://api.github.com/repos/actions/setup-go/git/ref/tags/4dc6199c7b1a012772edbd06daecab0f50c9053c
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/4dc6199c7b1a012772edbd06daecab0f50c9053c --jq .object.sha (http block)
  • https://api.github.com/repos/actions/setup-go/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq .object.sha ithub/workflows nternal/testdeps/deps.go 64/pkg/tool/linux_amd64/vet --keep=fetch-pacgit --pack_header=2,rev-parse (http block)
  • https://api.github.com/repos/actions/setup-go/git/ref/tags/v5
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v5 --jq .object.sha (http block)
  • https://api.github.com/repos/actions/setup-go/git/ref/tags/v6
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v6 --jq .object.sha (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v6 --jq .object.sha -c=4 -nolocalimports -importcfg /tmp/go-build4280192276/b062/importcfg -pack /home/REDACTED/work/gh-aw/gh-aw/pkg/cli/access_log.go /home/REDACTED/work/gh-aw/gh-aw/pkg/cli/actionlint.go (http block)
  • https://api.github.com/repos/actions/setup-node/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq .object.sha k/gh-aw/gh-aw/.github/workflows REDACTED 64/pkg/tool/linux_amd64/vet (http block)
  • https://api.github.com/repos/actions/setup-node/git/ref/tags/v6
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v6 --jq .object.sha (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v6 --jq .object.sha -c=4 -nolocalimports -importcfg /tmp/go-build4280192276/b279/importcfg -embedcfg /tmp/go-build4280192276/b279/embedcfg -pack (http block)
  • https://api.github.com/repos/anchore/sbom-action/git/ref/tags/v0
    • Triggering command: /usr/bin/gh gh api /repos/anchore/sbom-action/git/ref/tags/v0 --jq .object.sha (http block)
  • https://api.github.com/repos/docker/build-push-action/git/ref/tags/v6
    • Triggering command: /usr/bin/gh gh api /repos/docker/build-push-action/git/ref/tags/v6 --jq .object.sha (http block)
  • https://api.github.com/repos/docker/login-action/git/ref/tags/v3
    • Triggering command: /usr/bin/gh gh api /repos/docker/login-action/git/ref/tags/v3 --jq .object.sha (http block)
  • https://api.github.com/repos/docker/metadata-action/git/ref/tags/v5
    • Triggering command: /usr/bin/gh gh api /repos/docker/metadata-action/git/ref/tags/v5 --jq .object.sha (http block)
  • https://api.github.com/repos/docker/setup-buildx-action/git/ref/tags/v3
    • Triggering command: /usr/bin/gh gh api /repos/docker/setup-buildx-action/git/ref/tags/v3 --jq .object.sha /gh-aw (http block)
    • Triggering command: /usr/bin/gh gh api /repos/docker/setup-buildx-action/git/ref/tags/v3 --jq .object.sha (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/a70c5eada06553e3510ac27f2c3bda9d3705bccb
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/a70c5eada06553e3510ac27f2c3bda9d3705bccb --jq .object.sha (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq .object.sha (http block)
  • https://api.github.com/repos/githubnext/agentics/git/ref/tags/
    • Triggering command: /usr/bin/gh gh api /repos/githubnext/agentics/git/ref/tags/# --jq .object.sha (http block)
  • https://api.github.com/repos/nonexistent/action/git/ref/tags/v999.999.999
    • Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq .object.sha (http block)

If you need me to access, download, or install something from one of these locations, you can either:

@pelikhan pelikhan merged commit 5fbd199 into main Feb 20, 2026
82 checks passed
@pelikhan pelikhan deleted the copilot/add-model-env-var branch February 20, 2026 23:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Provide model to engine as an env var

2 participants