From 0db7e4065bac59978ef8bbb2ce4d120d22ba7884 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Sat, 3 Jan 2026 23:03:37 +0000 Subject: [PATCH 1/7] Initial plan From 489f96a4919f78b1c02b01c6d0132e3208ae537d Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Sat, 3 Jan 2026 23:16:47 +0000 Subject: [PATCH 2/7] Rename detect-repo-visibility to determine-automatic-lockdown with custom token requirement Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> --- ...y.cjs => determine_automatic_lockdown.cjs} | 22 ++++--- ... => determine_automatic_lockdown.test.cjs} | 29 ++++----- .../github_lockdown_autodetect_test.go | 62 +++++++++++++------ pkg/workflow/mcp_renderer.go | 26 +++++--- pkg/workflow/mcp_servers.go | 35 ++++++++--- 5 files changed, 114 insertions(+), 60 deletions(-) rename actions/setup/js/{detect_repo_visibility.cjs => determine_automatic_lockdown.cjs} (64%) rename actions/setup/js/{detect_repo_visibility.test.cjs => determine_automatic_lockdown.test.cjs} (73%) diff --git a/actions/setup/js/detect_repo_visibility.cjs b/actions/setup/js/determine_automatic_lockdown.cjs similarity index 64% rename from actions/setup/js/detect_repo_visibility.cjs rename to actions/setup/js/determine_automatic_lockdown.cjs index 607978a678..c75f34c147 100644 --- a/actions/setup/js/detect_repo_visibility.cjs +++ b/actions/setup/js/determine_automatic_lockdown.cjs @@ -2,7 +2,10 @@ /// /** - * Detects repository visibility and sets lockdown mode for GitHub MCP server. + * Determines automatic lockdown mode for GitHub MCP server based on repository visibility. + * + * This function only applies when a custom GitHub MCP server token is defined + * (GH_AW_GITHUB_MCP_SERVER_TOKEN) and for public repositories. * * For public repositories, lockdown mode should be enabled (true) to prevent * the GitHub token from accessing private repositories, which could leak @@ -16,12 +19,12 @@ * @param {any} core - GitHub Actions core library * @returns {Promise} */ -async function detectRepoVisibility(github, context, core) { +async function determineAutomaticLockdown(github, context, core) { try { - core.info("Detecting repository visibility for GitHub MCP lockdown configuration"); + core.info("Determining automatic lockdown mode for GitHub MCP server"); const { owner, repo } = context.repo; - core.info(`Checking visibility for repository: ${owner}/${repo}`); + core.info(`Checking repository: ${owner}/${repo}`); // Fetch repository information const { data: repository } = await github.rest.repos.get({ @@ -39,21 +42,24 @@ async function detectRepoVisibility(github, context, core) { // Public repos should have lockdown enabled to prevent token from accessing private repos const shouldLockdown = !isPrivate; - core.info(`Setting GitHub MCP lockdown: ${shouldLockdown}`); + core.info(`Automatic lockdown mode determined: ${shouldLockdown}`); core.setOutput("lockdown", shouldLockdown.toString()); core.setOutput("visibility", visibility); if (shouldLockdown) { + core.info("Automatic lockdown mode enabled for public repository"); core.warning("GitHub MCP lockdown mode enabled for public repository. " + "This prevents the GitHub token from accessing private repositories."); + } else { + core.info("Automatic lockdown mode disabled for private/internal repository"); } } catch (error) { const errorMessage = error instanceof Error ? error.message : String(error); - core.error(`Failed to detect repository visibility: ${errorMessage}`); + core.error(`Failed to determine automatic lockdown mode: ${errorMessage}`); // Default to lockdown mode for safety core.setOutput("lockdown", "true"); core.setOutput("visibility", "unknown"); - core.warning("Failed to detect repository visibility. Defaulting to lockdown mode for security."); + core.warning("Failed to determine repository visibility. Defaulting to lockdown mode for security."); } } -module.exports = detectRepoVisibility; +module.exports = determineAutomaticLockdown; diff --git a/actions/setup/js/detect_repo_visibility.test.cjs b/actions/setup/js/determine_automatic_lockdown.test.cjs similarity index 73% rename from actions/setup/js/detect_repo_visibility.test.cjs rename to actions/setup/js/determine_automatic_lockdown.test.cjs index 37e4a55a96..75df08b24d 100644 --- a/actions/setup/js/detect_repo_visibility.test.cjs +++ b/actions/setup/js/determine_automatic_lockdown.test.cjs @@ -1,10 +1,10 @@ import { describe, it, expect, beforeEach, vi } from "vitest"; -describe("detect_repo_visibility", () => { +describe("determine_automatic_lockdown", () => { let mockContext; let mockGithub; let mockCore; - let detectRepoVisibility; + let determineAutomaticLockdown; beforeEach(async () => { vi.resetModules(); @@ -35,7 +35,7 @@ describe("detect_repo_visibility", () => { }; // Import the module - detectRepoVisibility = (await import("./detect_repo_visibility.cjs")).default; + determineAutomaticLockdown = (await import("./determine_automatic_lockdown.cjs")).default; }); it("should set lockdown to true for public repository", async () => { @@ -46,7 +46,7 @@ describe("detect_repo_visibility", () => { }, }); - await detectRepoVisibility(mockGithub, mockContext, mockCore); + await determineAutomaticLockdown(mockGithub, mockContext, mockCore); expect(mockGithub.rest.repos.get).toHaveBeenCalledWith({ owner: "test-owner", @@ -65,7 +65,7 @@ describe("detect_repo_visibility", () => { }, }); - await detectRepoVisibility(mockGithub, mockContext, mockCore); + await determineAutomaticLockdown(mockGithub, mockContext, mockCore); expect(mockGithub.rest.repos.get).toHaveBeenCalledWith({ owner: "test-owner", @@ -84,7 +84,7 @@ describe("detect_repo_visibility", () => { }, }); - await detectRepoVisibility(mockGithub, mockContext, mockCore); + await determineAutomaticLockdown(mockGithub, mockContext, mockCore); expect(mockCore.setOutput).toHaveBeenCalledWith("lockdown", "false"); expect(mockCore.setOutput).toHaveBeenCalledWith("visibility", "internal"); @@ -94,12 +94,12 @@ describe("detect_repo_visibility", () => { const error = new Error("API request failed"); mockGithub.rest.repos.get.mockRejectedValue(error); - await detectRepoVisibility(mockGithub, mockContext, mockCore); + await determineAutomaticLockdown(mockGithub, mockContext, mockCore); - expect(mockCore.error).toHaveBeenCalledWith("Failed to detect repository visibility: API request failed"); + expect(mockCore.error).toHaveBeenCalledWith("Failed to determine automatic lockdown mode: API request failed"); expect(mockCore.setOutput).toHaveBeenCalledWith("lockdown", "true"); expect(mockCore.setOutput).toHaveBeenCalledWith("visibility", "unknown"); - expect(mockCore.warning).toHaveBeenCalledWith(expect.stringContaining("Failed to detect repository visibility")); + expect(mockCore.warning).toHaveBeenCalledWith(expect.stringContaining("Failed to determine repository visibility")); }); it("should infer visibility from private field when visibility field is missing", async () => { @@ -110,7 +110,7 @@ describe("detect_repo_visibility", () => { }, }); - await detectRepoVisibility(mockGithub, mockContext, mockCore); + await determineAutomaticLockdown(mockGithub, mockContext, mockCore); expect(mockCore.setOutput).toHaveBeenCalledWith("lockdown", "true"); expect(mockCore.setOutput).toHaveBeenCalledWith("visibility", "public"); @@ -124,12 +124,13 @@ describe("detect_repo_visibility", () => { }, }); - await detectRepoVisibility(mockGithub, mockContext, mockCore); + await determineAutomaticLockdown(mockGithub, mockContext, mockCore); - expect(mockCore.info).toHaveBeenCalledWith("Detecting repository visibility for GitHub MCP lockdown configuration"); - expect(mockCore.info).toHaveBeenCalledWith("Checking visibility for repository: test-owner/test-repo"); + expect(mockCore.info).toHaveBeenCalledWith("Determining automatic lockdown mode for GitHub MCP server"); + expect(mockCore.info).toHaveBeenCalledWith("Checking repository: test-owner/test-repo"); expect(mockCore.info).toHaveBeenCalledWith("Repository visibility: public"); expect(mockCore.info).toHaveBeenCalledWith("Repository is private: false"); - expect(mockCore.info).toHaveBeenCalledWith("Setting GitHub MCP lockdown: true"); + expect(mockCore.info).toHaveBeenCalledWith("Automatic lockdown mode determined: true"); + expect(mockCore.info).toHaveBeenCalledWith("Automatic lockdown mode enabled for public repository"); }); }); diff --git a/pkg/workflow/github_lockdown_autodetect_test.go b/pkg/workflow/github_lockdown_autodetect_test.go index 922146be51..3c7036a55f 100644 --- a/pkg/workflow/github_lockdown_autodetect_test.go +++ b/pkg/workflow/github_lockdown_autodetect_test.go @@ -16,26 +16,46 @@ func TestGitHubLockdownAutodetection(t *testing.T) { description string }{ { - name: "Auto-detection enabled when lockdown not specified", + name: "Auto-determination enabled when lockdown not specified and custom token defined", workflow: `--- on: issues engine: copilot tools: github: mode: local + github-token: ${{ secrets.CUSTOM_TOKEN }} toolsets: [default] --- # Test Workflow -Test automatic lockdown detection. +Test automatic lockdown determination with custom token. `, expectedDetectStep: true, expectedLockdown: "auto", - description: "When lockdown is not specified, detection step should be added and lockdown should use step output", + description: "When lockdown is not specified and custom token is defined, determination step should be added", }, { - name: "No auto-detection when lockdown explicitly set to true", + name: "No auto-determination when no custom token", + workflow: `--- +on: issues +engine: copilot +tools: + github: + mode: local + toolsets: [default] +--- + +# Test Workflow + +Test without custom token - should not add determination step. +`, + expectedDetectStep: false, + expectedLockdown: "false", + description: "When no custom token is defined, no determination step should be added", + }, + { + name: "No auto-determination when lockdown explicitly set to true", workflow: `--- on: issues engine: copilot @@ -43,6 +63,7 @@ tools: github: mode: local lockdown: true + github-token: ${{ secrets.CUSTOM_TOKEN }} toolsets: [default] --- @@ -52,10 +73,10 @@ Test with explicit lockdown enabled. `, expectedDetectStep: false, expectedLockdown: "true", - description: "When lockdown is explicitly true, no detection step and lockdown should be hardcoded", + description: "When lockdown is explicitly true, no determination step and lockdown should be hardcoded", }, { - name: "No auto-detection when lockdown explicitly set to false", + name: "No auto-determination when lockdown explicitly set to false", workflow: `--- on: issues engine: copilot @@ -63,6 +84,7 @@ tools: github: mode: local lockdown: false + github-token: ${{ secrets.CUSTOM_TOKEN }} toolsets: [default] --- @@ -72,26 +94,27 @@ Test with explicit lockdown disabled. `, expectedDetectStep: false, expectedLockdown: "false", - description: "When lockdown is explicitly false, no detection step and no lockdown setting", + description: "When lockdown is explicitly false, no determination step and no lockdown setting", }, { - name: "Auto-detection with remote mode", + name: "Auto-determination with remote mode and custom token", workflow: `--- on: issues engine: copilot tools: github: mode: remote + github-token: ${{ secrets.CUSTOM_TOKEN }} toolsets: [default] --- # Test Workflow -Test auto-detection with remote GitHub MCP. +Test auto-determination with remote GitHub MCP and custom token. `, expectedDetectStep: true, expectedLockdown: "auto", - description: "Auto-detection should work with remote mode too", + description: "Auto-determination should work with remote mode when custom token is defined", }, } @@ -125,9 +148,9 @@ Test auto-detection with remote GitHub MCP. yaml := string(lockContent) // Check if detection step is present - detectStepPresent := strings.Contains(yaml, "Detect repository visibility for GitHub MCP lockdown") && - strings.Contains(yaml, "detect-repo-visibility") && - strings.Contains(yaml, "detect_repo_visibility.cjs") + detectStepPresent := strings.Contains(yaml, "Determine automatic lockdown mode for GitHub MCP server") && + strings.Contains(yaml, "determine-automatic-lockdown") && + strings.Contains(yaml, "determine_automatic_lockdown.cjs") if detectStepPresent != tt.expectedDetectStep { t.Errorf("%s: Detection step presence = %v, want %v", tt.description, detectStepPresent, tt.expectedDetectStep) @@ -137,7 +160,7 @@ Test auto-detection with remote GitHub MCP. switch tt.expectedLockdown { case "auto": // Should use step output expression - if !strings.Contains(yaml, "steps.detect-repo-visibility.outputs.lockdown") { + if !strings.Contains(yaml, "steps.determine-automatic-lockdown.outputs.lockdown") { t.Errorf("%s: Expected lockdown to use step output expression", tt.description) } case "true": @@ -164,12 +187,13 @@ engine: claude tools: github: mode: local + github-token: ${{ secrets.CUSTOM_TOKEN }} toolsets: [default] --- # Test Workflow -Test automatic lockdown detection with Claude. +Test automatic lockdown determination with Claude and custom token. ` // Create temporary directory for test @@ -200,15 +224,15 @@ Test automatic lockdown detection with Claude. yaml := string(lockContent) // Check if detection step is present - detectStepPresent := strings.Contains(yaml, "Detect repository visibility for GitHub MCP lockdown") && - strings.Contains(yaml, "detect-repo-visibility") + detectStepPresent := strings.Contains(yaml, "Determine automatic lockdown mode for GitHub MCP server") && + strings.Contains(yaml, "determine-automatic-lockdown") if !detectStepPresent { - t.Error("Detection step should be present for Claude engine") + t.Error("Determination step should be present for Claude engine with custom token") } // Check if lockdown uses step output expression - if !strings.Contains(yaml, "steps.detect-repo-visibility.outputs.lockdown") { + if !strings.Contains(yaml, "steps.determine-automatic-lockdown.outputs.lockdown") { t.Error("Expected lockdown to use step output expression for Claude engine") } } diff --git a/pkg/workflow/mcp_renderer.go b/pkg/workflow/mcp_renderer.go index 38f9a2a8d5..a4d245ac53 100644 --- a/pkg/workflow/mcp_renderer.go +++ b/pkg/workflow/mcp_renderer.go @@ -45,7 +45,15 @@ func (r *MCPConfigRendererUnified) RenderGitHubMCP(yaml *strings.Builder, github // Get lockdown value - use detected value if lockdown wasn't explicitly set lockdown := getGitHubLockdown(githubTool) - if !hasGitHubLockdownExplicitlySet(githubTool) { + + // Check if automatic lockdown determination step will be generated + // This requires: lockdown not explicitly set AND custom token configured + customGitHubToken := getGitHubToken(githubTool) + toplevelToken := workflowData.GitHubToken + hasCustomToken := customGitHubToken != "" || toplevelToken != "" + shouldUseStepOutput := !hasGitHubLockdownExplicitlySet(githubTool) && hasCustomToken + + if shouldUseStepOutput { // Use the detected lockdown value from the step output // This will be evaluated at runtime based on repository visibility lockdown = true // This is a placeholder - actual value comes from step output @@ -53,8 +61,8 @@ func (r *MCPConfigRendererUnified) RenderGitHubMCP(yaml *strings.Builder, github toolsets := getGitHubToolsets(githubTool) - mcpRendererLog.Printf("Rendering GitHub MCP: type=%s, read_only=%t, lockdown=%t (explicit=%t), toolsets=%v, format=%s", - githubType, readOnly, lockdown, hasGitHubLockdownExplicitlySet(githubTool), toolsets, r.options.Format) + mcpRendererLog.Printf("Rendering GitHub MCP: type=%s, read_only=%t, lockdown=%t (explicit=%t, custom_token=%t, use_step=%t), toolsets=%v, format=%s", + githubType, readOnly, lockdown, hasGitHubLockdownExplicitlySet(githubTool), hasCustomToken, shouldUseStepOutput, toolsets, r.options.Format) if r.options.Format == "toml" { r.renderGitHubTOML(yaml, githubTool, workflowData) @@ -76,7 +84,7 @@ func (r *MCPConfigRendererUnified) RenderGitHubMCP(yaml *strings.Builder, github RenderGitHubMCPRemoteConfig(yaml, GitHubMCPRemoteOptions{ ReadOnly: readOnly, Lockdown: lockdown, - LockdownFromStep: !hasGitHubLockdownExplicitlySet(githubTool), + LockdownFromStep: shouldUseStepOutput, Toolsets: toolsets, AuthorizationValue: authValue, IncludeToolsField: r.options.IncludeCopilotFields, @@ -91,7 +99,7 @@ func (r *MCPConfigRendererUnified) RenderGitHubMCP(yaml *strings.Builder, github RenderGitHubMCPDockerConfig(yaml, GitHubMCPDockerOptions{ ReadOnly: readOnly, Lockdown: lockdown, - LockdownFromStep: !hasGitHubLockdownExplicitlySet(githubTool), + LockdownFromStep: shouldUseStepOutput, Toolsets: toolsets, DockerImageVersion: githubDockerImageVersion, CustomArgs: customArgs, @@ -481,9 +489,9 @@ func RenderGitHubMCPDockerConfig(yaml *strings.Builder, options GitHubMCPDockerO } if options.LockdownFromStep { - // Use lockdown value from step output (detected based on repository visibility) + // Use lockdown value from step output (determined based on repository visibility) yaml.WriteString(" \"-e\",\n") - yaml.WriteString(" \"GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}\",\n") + yaml.WriteString(" \"GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}\",\n") } else if options.Lockdown { // Use explicit lockdown value from configuration yaml.WriteString(" \"-e\",\n") @@ -579,8 +587,8 @@ func RenderGitHubMCPRemoteConfig(yaml *strings.Builder, options GitHubMCPRemoteO // Add X-MCP-Lockdown header if lockdown mode is enabled if options.LockdownFromStep { - // Use lockdown value from step output (detected based on repository visibility) - headers["X-MCP-Lockdown"] = "${{ steps.detect-repo-visibility.outputs.lockdown }}" + // Use lockdown value from step output (determined based on repository visibility) + headers["X-MCP-Lockdown"] = "${{ steps.determine-automatic-lockdown.outputs.lockdown }}" } else if options.Lockdown { // Use explicit lockdown value from configuration headers["X-MCP-Lockdown"] = "true" diff --git a/pkg/workflow/mcp_servers.go b/pkg/workflow/mcp_servers.go index d86bfa423d..b30e994dfd 100644 --- a/pkg/workflow/mcp_servers.go +++ b/pkg/workflow/mcp_servers.go @@ -770,10 +770,12 @@ func replaceExpressionsInPlaywrightArgs(args []string, expressions map[string]st return strings.Split(replaced, "\n") } -// generateGitHubMCPLockdownDetectionStep generates a step to detect repository visibility -// and set the lockdown mode accordingly. This step is only added when: +// generateGitHubMCPLockdownDetectionStep generates a step to determine automatic lockdown mode +// for GitHub MCP server based on repository visibility. This step is only added when: // - GitHub tool is enabled AND -// - lockdown field is not explicitly specified in the workflow configuration +// - lockdown field is not explicitly specified in the workflow configuration AND +// - A custom GitHub MCP server token is defined (GH_AW_GITHUB_MCP_SERVER_TOKEN exists) AND +// - Repository is public func (c *Compiler) generateGitHubMCPLockdownDetectionStep(yaml *strings.Builder, data *WorkflowData) { // Check if GitHub tool is present githubTool, hasGitHub := data.Tools["github"] @@ -783,11 +785,24 @@ func (c *Compiler) generateGitHubMCPLockdownDetectionStep(yaml *strings.Builder, // Check if lockdown is already explicitly set if hasGitHubLockdownExplicitlySet(githubTool) { - mcpServersLog.Print("Lockdown explicitly set in workflow, skipping auto-detection") + mcpServersLog.Print("Lockdown explicitly set in workflow, skipping automatic lockdown determination") return } - mcpServersLog.Print("Generating GitHub MCP lockdown auto-detection step") + // Check if custom GitHub MCP server token is defined + // The step only applies when GH_AW_GITHUB_MCP_SERVER_TOKEN is explicitly configured + customGitHubToken := getGitHubToken(githubTool) + toplevelToken := data.GitHubToken + + // Determine if a custom token is being used (not the default fallback) + hasCustomToken := customGitHubToken != "" || toplevelToken != "" + + if !hasCustomToken { + mcpServersLog.Print("No custom GitHub MCP server token defined, skipping automatic lockdown determination") + return + } + + mcpServersLog.Print("Generating automatic lockdown determination step for GitHub MCP server") // Resolve the latest version of actions/github-script actionRepo := "actions/github-script" @@ -800,12 +815,12 @@ func (c *Compiler) generateGitHubMCPLockdownDetectionStep(yaml *strings.Builder, pinnedAction = fmt.Sprintf("%s@%s", actionRepo, actionVersion) } - // Generate the step using the detect_repo_visibility.cjs action - yaml.WriteString(" - name: Detect repository visibility for GitHub MCP lockdown\n") - yaml.WriteString(" id: detect-repo-visibility\n") + // Generate the step using the determine_automatic_lockdown.cjs action + yaml.WriteString(" - name: Determine automatic lockdown mode for GitHub MCP server\n") + yaml.WriteString(" id: determine-automatic-lockdown\n") fmt.Fprintf(yaml, " uses: %s\n", pinnedAction) yaml.WriteString(" with:\n") yaml.WriteString(" script: |\n") - yaml.WriteString(" const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs');\n") - yaml.WriteString(" await detectRepoVisibility(github, context, core);\n") + yaml.WriteString(" const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs');\n") + yaml.WriteString(" await determineAutomaticLockdown(github, context, core);\n") } From 43c5bbe989203c734147f2acc805b49d484dda1d Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Sat, 3 Jan 2026 23:20:49 +0000 Subject: [PATCH 3/7] Fix nil pointer dereference in mcp_renderer.go Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> --- .../agent-performance-analyzer.lock.yml | 9 --- .github/workflows/ai-moderator.lock.yml | 9 --- .github/workflows/archie.lock.yml | 9 --- .github/workflows/artifacts-summary.lock.yml | 9 --- .github/workflows/audit-workflows.lock.yml | 9 --- .github/workflows/blog-auditor.lock.yml | 9 --- .github/workflows/brave.lock.yml | 9 --- .../breaking-change-checker.lock.yml | 9 --- .github/workflows/campaign-generator.lock.yml | 9 --- .github/workflows/campaign-manager.lock.yml | 8 --- .github/workflows/changeset.lock.yml | 7 --- .github/workflows/ci-coach.lock.yml | 9 --- .github/workflows/ci-doctor.lock.yml | 9 --- .../cli-consistency-checker.lock.yml | 9 --- .../workflows/cli-version-checker.lock.yml | 9 --- .github/workflows/cloclo.lock.yml | 9 --- .../commit-changes-analyzer.lock.yml | 9 --- .../workflows/copilot-agent-analysis.lock.yml | 9 --- .../copilot-pr-nlp-analysis.lock.yml | 9 --- .../copilot-pr-prompt-analysis.lock.yml | 9 --- .../copilot-session-insights.lock.yml | 9 --- .github/workflows/craft.lock.yml | 9 --- .../daily-assign-issue-to-user.lock.yml | 22 ------- .github/workflows/daily-choice-test.lock.yml | 9 --- .../workflows/daily-cli-performance.lock.yml | 9 --- .github/workflows/daily-code-metrics.lock.yml | 9 --- .../daily-copilot-token-report.lock.yml | 9 --- .github/workflows/daily-doc-updater.lock.yml | 9 --- .github/workflows/daily-fact.lock.yml | 7 --- .github/workflows/daily-file-diet.lock.yml | 9 --- .../workflows/daily-firewall-report.lock.yml | 9 --- .../workflows/daily-issues-report.lock.yml | 7 --- .../daily-malicious-code-scan.lock.yml | 60 ------------------- .../daily-multi-device-docs-tester.lock.yml | 9 --- .github/workflows/daily-news.lock.yml | 9 --- .../daily-performance-summary.lock.yml | 7 --- .../workflows/daily-repo-chronicle.lock.yml | 9 --- .github/workflows/daily-team-status.lock.yml | 9 --- .../workflows/daily-workflow-updater.lock.yml | 9 --- .github/workflows/deep-report.lock.yml | 7 --- .../workflows/dependabot-go-checker.lock.yml | 9 --- .github/workflows/dev-hawk.lock.yml | 9 --- .github/workflows/dev.lock.yml | 9 --- .../developer-docs-consolidator.lock.yml | 9 --- .github/workflows/dictation-prompt.lock.yml | 9 --- .github/workflows/docs-noob-tester.lock.yml | 9 --- ...ty-maintenance-project67.campaign.lock.yml | 9 --- .../duplicate-code-detector.lock.yml | 7 --- .../example-custom-error-patterns.lock.yml | 9 --- .../example-permissions-warning.lock.yml | 9 --- .../example-workflow-analyzer.lock.yml | 9 --- .github/workflows/firewall-escape.lock.yml | 9 --- .github/workflows/firewall.lock.yml | 9 --- .../github-mcp-structural-analysis.lock.yml | 9 --- .../github-mcp-tools-report.lock.yml | 8 --- .../workflows/glossary-maintainer.lock.yml | 9 --- .github/workflows/go-fan.lock.yml | 9 --- ...size-reduction-project64.campaign.lock.yml | 9 --- .github/workflows/go-logger.lock.yml | 9 --- .../workflows/go-pattern-detector.lock.yml | 9 --- .github/workflows/grumpy-reviewer.lock.yml | 9 --- .github/workflows/hourly-ci-cleaner.lock.yml | 9 --- .../workflows/human-ai-collaboration.lock.yml | 9 --- .github/workflows/incident-response.lock.yml | 9 --- .../workflows/instructions-janitor.lock.yml | 9 --- .github/workflows/intelligence.lock.yml | 9 --- .github/workflows/issue-arborist.lock.yml | 7 --- .github/workflows/issue-classifier.lock.yml | 9 --- .github/workflows/issue-monster.lock.yml | 9 --- .../issue-template-optimizer.lock.yml | 9 --- .github/workflows/issue-triage-agent.lock.yml | 9 --- .github/workflows/jsweep.lock.yml | 9 --- .../workflows/layout-spec-maintainer.lock.yml | 9 --- .github/workflows/lockfile-stats.lock.yml | 9 --- .github/workflows/mcp-inspector.lock.yml | 9 --- .github/workflows/mergefest.lock.yml | 9 --- .github/workflows/metrics-collector.lock.yml | 8 --- .../workflows/notion-issue-summary.lock.yml | 9 --- .github/workflows/org-wide-rollout.lock.yml | 9 --- .github/workflows/pdf-summary.lock.yml | 9 --- .github/workflows/plan.lock.yml | 9 --- ...ayground-org-project-update-issue.lock.yml | 10 ++-- .../playground-snapshots-refresh.lock.yml | 9 --- .github/workflows/poem-bot.lock.yml | 9 --- .github/workflows/portfolio-analyst.lock.yml | 9 --- .../workflows/pr-nitpick-reviewer.lock.yml | 9 --- .../prompt-clustering-analysis.lock.yml | 9 --- .github/workflows/python-data-charts.lock.yml | 9 --- .github/workflows/q.lock.yml | 9 --- .github/workflows/release.lock.yml | 9 --- .github/workflows/repo-tree-map.lock.yml | 9 --- .../repository-quality-improver.lock.yml | 9 --- .github/workflows/research.lock.yml | 9 --- .github/workflows/safe-output-health.lock.yml | 9 --- .../schema-consistency-checker.lock.yml | 8 --- .github/workflows/scout.lock.yml | 9 --- .../workflows/security-compliance.lock.yml | 9 --- .github/workflows/security-fix-pr.lock.yml | 9 --- .../semantic-function-refactor.lock.yml | 9 --- .../workflows/slide-deck-maintainer.lock.yml | 9 --- .github/workflows/smoke-claude.lock.yml | 9 --- .../workflows/smoke-codex-firewall.lock.yml | 7 --- .github/workflows/smoke-codex.lock.yml | 7 --- .../smoke-copilot-no-firewall.lock.yml | 9 --- .../smoke-copilot-playwright.lock.yml | 9 --- .github/workflows/smoke-copilot.lock.yml | 9 --- .github/workflows/smoke-detector.lock.yml | 9 --- .../smoke-srt-custom-config.lock.yml | 9 --- .github/workflows/smoke-srt.lock.yml | 9 --- .github/workflows/spec-kit-execute.lock.yml | 8 --- .github/workflows/spec-kit-executor.lock.yml | 9 --- .github/workflows/speckit-dispatcher.lock.yml | 9 --- .../workflows/static-analysis-report.lock.yml | 9 --- .github/workflows/sub-issue-closer.lock.yml | 9 --- .github/workflows/super-linter.lock.yml | 9 --- .../workflows/technical-doc-writer.lock.yml | 9 --- .github/workflows/terminal-stylist.lock.yml | 9 --- .github/workflows/tidy.lock.yml | 9 --- .github/workflows/typist.lock.yml | 9 --- .github/workflows/unbloat-docs.lock.yml | 9 --- .github/workflows/video-analyzer.lock.yml | 9 --- .../workflows/weekly-issue-summary.lock.yml | 9 --- .github/workflows/workflow-generator.lock.yml | 9 --- .../workflow-health-manager.lock.yml | 9 --- pkg/workflow/mcp_renderer.go | 5 +- 125 files changed, 9 insertions(+), 1154 deletions(-) diff --git a/.github/workflows/agent-performance-analyzer.lock.yml b/.github/workflows/agent-performance-analyzer.lock.yml index ff4dd388f0..879edffbd8 100644 --- a/.github/workflows/agent-performance-analyzer.lock.yml +++ b/.github/workflows/agent-performance-analyzer.lock.yml @@ -166,13 +166,6 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Install gh-aw extension @@ -472,8 +465,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests,actions", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/ai-moderator.lock.yml b/.github/workflows/ai-moderator.lock.yml index 38cd4fe484..1a9d2cc689 100644 --- a/.github/workflows/ai-moderator.lock.yml +++ b/.github/workflows/ai-moderator.lock.yml @@ -171,13 +171,6 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -360,8 +353,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/archie.lock.yml b/.github/workflows/archie.lock.yml index a54d3d3819..b476ab4540 100644 --- a/.github/workflows/archie.lock.yml +++ b/.github/workflows/archie.lock.yml @@ -209,13 +209,6 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -367,8 +360,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/artifacts-summary.lock.yml b/.github/workflows/artifacts-summary.lock.yml index f6b02297c5..279dd457bc 100644 --- a/.github/workflows/artifacts-summary.lock.yml +++ b/.github/workflows/artifacts-summary.lock.yml @@ -154,13 +154,6 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -328,8 +321,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=actions,repos", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/audit-workflows.lock.yml b/.github/workflows/audit-workflows.lock.yml index 841f577163..66c245043c 100644 --- a/.github/workflows/audit-workflows.lock.yml +++ b/.github/workflows/audit-workflows.lock.yml @@ -223,13 +223,6 @@ jobs: awf --version - name: Install Claude Code CLI run: npm install -g --silent @anthropic-ai/claude-code@2.0.76 - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -428,8 +421,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/blog-auditor.lock.yml b/.github/workflows/blog-auditor.lock.yml index c96e8d88c0..4eaac30861 100644 --- a/.github/workflows/blog-auditor.lock.yml +++ b/.github/workflows/blog-auditor.lock.yml @@ -150,13 +150,6 @@ jobs: awf --version - name: Install Claude Code CLI run: npm install -g --silent @anthropic-ai/claude-code@2.0.76 - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 mcr.microsoft.com/playwright/mcp - name: Write Safe Outputs Config @@ -322,8 +315,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/brave.lock.yml b/.github/workflows/brave.lock.yml index 6a32436a17..05b8d02efc 100644 --- a/.github/workflows/brave.lock.yml +++ b/.github/workflows/brave.lock.yml @@ -187,13 +187,6 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh docker.io/mcp/brave-search ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -363,8 +356,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/breaking-change-checker.lock.yml b/.github/workflows/breaking-change-checker.lock.yml index 9d225adead..37c6e37230 100644 --- a/.github/workflows/breaking-change-checker.lock.yml +++ b/.github/workflows/breaking-change-checker.lock.yml @@ -151,13 +151,6 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -346,8 +339,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=repos", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/campaign-generator.lock.yml b/.github/workflows/campaign-generator.lock.yml index f56043ffe8..cc73c365d5 100644 --- a/.github/workflows/campaign-generator.lock.yml +++ b/.github/workflows/campaign-generator.lock.yml @@ -166,13 +166,6 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -385,8 +378,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/campaign-manager.lock.yml b/.github/workflows/campaign-manager.lock.yml index fcee11da11..1044e5dd73 100644 --- a/.github/workflows/campaign-manager.lock.yml +++ b/.github/workflows/campaign-manager.lock.yml @@ -166,13 +166,6 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Write Safe Outputs Config run: | mkdir -p /tmp/gh-aw/safeoutputs @@ -529,7 +522,6 @@ jobs: "url": "https://api.githubcopilot.com/mcp/", "headers": { "Authorization": "Bearer \${GITHUB_PERSONAL_ACCESS_TOKEN}", - "X-MCP-Lockdown": "${{ steps.detect-repo-visibility.outputs.lockdown }}", "X-MCP-Readonly": "true", "X-MCP-Toolsets": "context,repos,issues,pull_requests,actions,projects" }, diff --git a/.github/workflows/changeset.lock.yml b/.github/workflows/changeset.lock.yml index 1bcb7eb2cd..6dc71486e8 100644 --- a/.github/workflows/changeset.lock.yml +++ b/.github/workflows/changeset.lock.yml @@ -191,13 +191,6 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config diff --git a/.github/workflows/ci-coach.lock.yml b/.github/workflows/ci-coach.lock.yml index 2dfb210ca5..24f6b3df37 100644 --- a/.github/workflows/ci-coach.lock.yml +++ b/.github/workflows/ci-coach.lock.yml @@ -207,13 +207,6 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -391,8 +384,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/ci-doctor.lock.yml b/.github/workflows/ci-doctor.lock.yml index 33184ca027..daeb654fe0 100644 --- a/.github/workflows/ci-doctor.lock.yml +++ b/.github/workflows/ci-doctor.lock.yml @@ -179,13 +179,6 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 mcp/fetch - name: Write Safe Outputs Config @@ -410,8 +403,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/cli-consistency-checker.lock.yml b/.github/workflows/cli-consistency-checker.lock.yml index 94abcbfdce..310808a8a4 100644 --- a/.github/workflows/cli-consistency-checker.lock.yml +++ b/.github/workflows/cli-consistency-checker.lock.yml @@ -152,13 +152,6 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 mcp/fetch - name: Write Safe Outputs Config @@ -347,8 +340,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/cli-version-checker.lock.yml b/.github/workflows/cli-version-checker.lock.yml index 1985b2c19e..03d0c57c5e 100644 --- a/.github/workflows/cli-version-checker.lock.yml +++ b/.github/workflows/cli-version-checker.lock.yml @@ -164,13 +164,6 @@ jobs: awf --version - name: Install Claude Code CLI run: npm install -g --silent @anthropic-ai/claude-code@2.0.76 - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -357,8 +350,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/cloclo.lock.yml b/.github/workflows/cloclo.lock.yml index 39ce9ea267..c408c44bea 100644 --- a/.github/workflows/cloclo.lock.yml +++ b/.github/workflows/cloclo.lock.yml @@ -257,13 +257,6 @@ jobs: awf --version - name: Install Claude Code CLI run: npm install -g --silent @anthropic-ai/claude-code@2.0.76 - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 mcr.microsoft.com/playwright/mcp - name: Write Safe Outputs Config @@ -479,8 +472,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/commit-changes-analyzer.lock.yml b/.github/workflows/commit-changes-analyzer.lock.yml index bddc32aed2..3512b6bc66 100644 --- a/.github/workflows/commit-changes-analyzer.lock.yml +++ b/.github/workflows/commit-changes-analyzer.lock.yml @@ -152,13 +152,6 @@ jobs: awf --version - name: Install Claude Code CLI run: npm install -g --silent @anthropic-ai/claude-code@2.0.76 - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -324,8 +317,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/copilot-agent-analysis.lock.yml b/.github/workflows/copilot-agent-analysis.lock.yml index 2a6b40e154..e3a811cb6b 100644 --- a/.github/workflows/copilot-agent-analysis.lock.yml +++ b/.github/workflows/copilot-agent-analysis.lock.yml @@ -183,13 +183,6 @@ jobs: awf --version - name: Install Claude Code CLI run: npm install -g --silent @anthropic-ai/claude-code@2.0.76 - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -355,8 +348,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/copilot-pr-nlp-analysis.lock.yml b/.github/workflows/copilot-pr-nlp-analysis.lock.yml index 74993be5c1..d6a500e3ff 100644 --- a/.github/workflows/copilot-pr-nlp-analysis.lock.yml +++ b/.github/workflows/copilot-pr-nlp-analysis.lock.yml @@ -220,13 +220,6 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -423,8 +416,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/copilot-pr-prompt-analysis.lock.yml b/.github/workflows/copilot-pr-prompt-analysis.lock.yml index 10182b7125..2f596dbc99 100644 --- a/.github/workflows/copilot-pr-prompt-analysis.lock.yml +++ b/.github/workflows/copilot-pr-prompt-analysis.lock.yml @@ -188,13 +188,6 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -362,8 +355,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/copilot-session-insights.lock.yml b/.github/workflows/copilot-session-insights.lock.yml index d9cfce74b3..ff12c05a70 100644 --- a/.github/workflows/copilot-session-insights.lock.yml +++ b/.github/workflows/copilot-session-insights.lock.yml @@ -209,13 +209,6 @@ jobs: awf --version - name: Install Claude Code CLI run: npm install -g --silent @anthropic-ai/claude-code@2.0.76 - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -410,8 +403,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/craft.lock.yml b/.github/workflows/craft.lock.yml index a29644ad67..cf7e688698 100644 --- a/.github/workflows/craft.lock.yml +++ b/.github/workflows/craft.lock.yml @@ -188,13 +188,6 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -394,8 +387,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/daily-assign-issue-to-user.lock.yml b/.github/workflows/daily-assign-issue-to-user.lock.yml index 890cb01ba6..1bf67fb2d5 100644 --- a/.github/workflows/daily-assign-issue-to-user.lock.yml +++ b/.github/workflows/daily-assign-issue-to-user.lock.yml @@ -150,13 +150,6 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -357,8 +350,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=issues,pull_requests,repos", "ghcr.io/github/github-mcp-server:v0.26.3" ], @@ -1049,17 +1040,4 @@ jobs: setupGlobals(core, github, context, exec, io); const { main } = require('/tmp/gh-aw/actions/safe_output_handler_manager.cjs'); await main(); - - name: Assign To User - id: assign_to_user - if: ((!cancelled()) && (needs.agent.result != 'skipped')) && (contains(needs.agent.outputs.output_types, 'assign_to_user')) - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - env: - GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }} - with: - github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} - script: | - const { setupGlobals } = require('/tmp/gh-aw/actions/setup_globals.cjs'); - setupGlobals(core, github, context, exec, io); - const { main } = require('/tmp/gh-aw/actions/assign_to_user.cjs'); - await main(); diff --git a/.github/workflows/daily-choice-test.lock.yml b/.github/workflows/daily-choice-test.lock.yml index d5e72e20f0..598eaf1008 100644 --- a/.github/workflows/daily-choice-test.lock.yml +++ b/.github/workflows/daily-choice-test.lock.yml @@ -143,13 +143,6 @@ jobs: awf --version - name: Install Claude Code CLI run: npm install -g --silent @anthropic-ai/claude-code@2.0.76 - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -294,8 +287,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/daily-cli-performance.lock.yml b/.github/workflows/daily-cli-performance.lock.yml index f2c84ee005..23a7017a94 100644 --- a/.github/workflows/daily-cli-performance.lock.yml +++ b/.github/workflows/daily-cli-performance.lock.yml @@ -164,13 +164,6 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -395,8 +388,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/daily-code-metrics.lock.yml b/.github/workflows/daily-code-metrics.lock.yml index 2ef671e069..ed5366d5b1 100644 --- a/.github/workflows/daily-code-metrics.lock.yml +++ b/.github/workflows/daily-code-metrics.lock.yml @@ -198,13 +198,6 @@ jobs: awf --version - name: Install Claude Code CLI run: npm install -g --silent @anthropic-ai/claude-code@2.0.76 - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -399,8 +392,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/daily-copilot-token-report.lock.yml b/.github/workflows/daily-copilot-token-report.lock.yml index 8336eb5376..015fe2efec 100644 --- a/.github/workflows/daily-copilot-token-report.lock.yml +++ b/.github/workflows/daily-copilot-token-report.lock.yml @@ -218,13 +218,6 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -421,8 +414,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/daily-doc-updater.lock.yml b/.github/workflows/daily-doc-updater.lock.yml index 0d5bd9e5d2..ca80fad12d 100644 --- a/.github/workflows/daily-doc-updater.lock.yml +++ b/.github/workflows/daily-doc-updater.lock.yml @@ -157,13 +157,6 @@ jobs: awf --version - name: Install Claude Code CLI run: npm install -g --silent @anthropic-ai/claude-code@2.0.76 - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -339,8 +332,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/daily-fact.lock.yml b/.github/workflows/daily-fact.lock.yml index 5d19274066..2707568422 100644 --- a/.github/workflows/daily-fact.lock.yml +++ b/.github/workflows/daily-fact.lock.yml @@ -137,13 +137,6 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config diff --git a/.github/workflows/daily-file-diet.lock.yml b/.github/workflows/daily-file-diet.lock.yml index 2408a6e9f2..d0e082a562 100644 --- a/.github/workflows/daily-file-diet.lock.yml +++ b/.github/workflows/daily-file-diet.lock.yml @@ -218,13 +218,6 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -442,8 +435,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/daily-firewall-report.lock.yml b/.github/workflows/daily-firewall-report.lock.yml index 8bfcb6fdff..89853799a2 100644 --- a/.github/workflows/daily-firewall-report.lock.yml +++ b/.github/workflows/daily-firewall-report.lock.yml @@ -221,13 +221,6 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -441,8 +434,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests,actions", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/daily-issues-report.lock.yml b/.github/workflows/daily-issues-report.lock.yml index 3375b6cff7..a5e28c42b2 100644 --- a/.github/workflows/daily-issues-report.lock.yml +++ b/.github/workflows/daily-issues-report.lock.yml @@ -204,13 +204,6 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config diff --git a/.github/workflows/daily-malicious-code-scan.lock.yml b/.github/workflows/daily-malicious-code-scan.lock.yml index 63d31c8cfb..3b17064fea 100644 --- a/.github/workflows/daily-malicious-code-scan.lock.yml +++ b/.github/workflows/daily-malicious-code-scan.lock.yml @@ -151,13 +151,6 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -366,8 +359,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=repos,code_security", "ghcr.io/github/github-mcp-server:v0.26.3" ], @@ -1047,7 +1038,6 @@ jobs: needs: - activation - agent - - safe_outputs if: (always()) && (needs.agent.result != 'skipped') runs-on: ubuntu-slim permissions: @@ -1140,53 +1130,3 @@ jobs: const { main } = require('/tmp/gh-aw/actions/notify_comment_error.cjs'); await main(); - safe_outputs: - needs: agent - if: (!cancelled()) && (needs.agent.result != 'skipped') - runs-on: ubuntu-slim - permissions: - contents: read - security-events: write - timeout-minutes: 15 - env: - GH_AW_ENGINE_ID: "copilot" - GH_AW_TRACKER_ID: "malicious-code-scan" - GH_AW_WORKFLOW_ID: "daily-malicious-code-scan" - GH_AW_WORKFLOW_NAME: "Daily Malicious Code Scan Agent" - steps: - - name: Checkout actions folder - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 - with: - sparse-checkout: | - actions - persist-credentials: false - - name: Setup Scripts - uses: ./actions/setup - with: - destination: /tmp/gh-aw/actions - - name: Download agent output artifact - continue-on-error: true - uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0 - with: - name: agent-output - path: /tmp/gh-aw/safeoutputs/ - - name: Setup agent output environment variable - run: | - mkdir -p /tmp/gh-aw/safeoutputs/ - find "/tmp/gh-aw/safeoutputs/" -type f -print - echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/safeoutputs/agent_output.json" >> "$GITHUB_ENV" - - name: Create Code Scanning Alert - id: create_code_scanning_alert - if: ((!cancelled()) && (needs.agent.result != 'skipped')) && (contains(needs.agent.outputs.output_types, 'create_code_scanning_alert')) - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - env: - GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }} - GH_AW_WORKFLOW_FILENAME: "daily-malicious-code-scan" - with: - github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} - script: | - const { setupGlobals } = require('/tmp/gh-aw/actions/setup_globals.cjs'); - setupGlobals(core, github, context, exec, io); - const { main } = require('/tmp/gh-aw/actions/create_code_scanning_alert.cjs'); - await main(); - diff --git a/.github/workflows/daily-multi-device-docs-tester.lock.yml b/.github/workflows/daily-multi-device-docs-tester.lock.yml index 3e4b8042f8..b4f2709b24 100644 --- a/.github/workflows/daily-multi-device-docs-tester.lock.yml +++ b/.github/workflows/daily-multi-device-docs-tester.lock.yml @@ -154,13 +154,6 @@ jobs: awf --version - name: Install Claude Code CLI run: npm install -g --silent @anthropic-ai/claude-code@2.0.76 - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 mcr.microsoft.com/playwright/mcp - name: Write Safe Outputs Config @@ -376,8 +369,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/daily-news.lock.yml b/.github/workflows/daily-news.lock.yml index 23f89393a3..64be36d712 100644 --- a/.github/workflows/daily-news.lock.yml +++ b/.github/workflows/daily-news.lock.yml @@ -216,13 +216,6 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 mcp/fetch - name: Write Safe Outputs Config @@ -419,8 +412,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/daily-performance-summary.lock.yml b/.github/workflows/daily-performance-summary.lock.yml index 70d4a9385a..3112a72ae2 100644 --- a/.github/workflows/daily-performance-summary.lock.yml +++ b/.github/workflows/daily-performance-summary.lock.yml @@ -194,13 +194,6 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config diff --git a/.github/workflows/daily-repo-chronicle.lock.yml b/.github/workflows/daily-repo-chronicle.lock.yml index 36dc7101dd..e37330451d 100644 --- a/.github/workflows/daily-repo-chronicle.lock.yml +++ b/.github/workflows/daily-repo-chronicle.lock.yml @@ -195,13 +195,6 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -398,8 +391,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests,discussions", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/daily-team-status.lock.yml b/.github/workflows/daily-team-status.lock.yml index 0d87c822ec..7694eaadb8 100644 --- a/.github/workflows/daily-team-status.lock.yml +++ b/.github/workflows/daily-team-status.lock.yml @@ -164,13 +164,6 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -359,8 +352,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/daily-workflow-updater.lock.yml b/.github/workflows/daily-workflow-updater.lock.yml index e8ee60cb04..5daef56ef5 100644 --- a/.github/workflows/daily-workflow-updater.lock.yml +++ b/.github/workflows/daily-workflow-updater.lock.yml @@ -151,13 +151,6 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -335,8 +328,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/deep-report.lock.yml b/.github/workflows/deep-report.lock.yml index dd6c9342c6..4bc9d64757 100644 --- a/.github/workflows/deep-report.lock.yml +++ b/.github/workflows/deep-report.lock.yml @@ -205,13 +205,6 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config diff --git a/.github/workflows/dependabot-go-checker.lock.yml b/.github/workflows/dependabot-go-checker.lock.yml index ae85d03eae..aed4babd1f 100644 --- a/.github/workflows/dependabot-go-checker.lock.yml +++ b/.github/workflows/dependabot-go-checker.lock.yml @@ -154,13 +154,6 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 mcp/fetch - name: Write Safe Outputs Config @@ -387,8 +380,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests,dependabot", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/dev-hawk.lock.yml b/.github/workflows/dev-hawk.lock.yml index 837b7e88d8..8029d8f25c 100644 --- a/.github/workflows/dev-hawk.lock.yml +++ b/.github/workflows/dev-hawk.lock.yml @@ -181,13 +181,6 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -356,8 +349,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=pull_requests,actions,repos", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/dev.lock.yml b/.github/workflows/dev.lock.yml index 8531a30e1b..94d5c7c40f 100644 --- a/.github/workflows/dev.lock.yml +++ b/.github/workflows/dev.lock.yml @@ -151,13 +151,6 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -309,8 +302,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=issues", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/developer-docs-consolidator.lock.yml b/.github/workflows/developer-docs-consolidator.lock.yml index ff7c7d4cbc..7c89bad533 100644 --- a/.github/workflows/developer-docs-consolidator.lock.yml +++ b/.github/workflows/developer-docs-consolidator.lock.yml @@ -176,13 +176,6 @@ jobs: awf --version - name: Install Claude Code CLI run: npm install -g --silent @anthropic-ai/claude-code@2.0.76 - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -410,8 +403,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/dictation-prompt.lock.yml b/.github/workflows/dictation-prompt.lock.yml index 6a21550d7d..c38d1948d7 100644 --- a/.github/workflows/dictation-prompt.lock.yml +++ b/.github/workflows/dictation-prompt.lock.yml @@ -154,13 +154,6 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -338,8 +331,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/docs-noob-tester.lock.yml b/.github/workflows/docs-noob-tester.lock.yml index 4ccca64858..28c45b5e33 100644 --- a/.github/workflows/docs-noob-tester.lock.yml +++ b/.github/workflows/docs-noob-tester.lock.yml @@ -154,13 +154,6 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 mcr.microsoft.com/playwright/mcp - name: Write Safe Outputs Config @@ -357,8 +350,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/docs-quality-maintenance-project67.campaign.lock.yml b/.github/workflows/docs-quality-maintenance-project67.campaign.lock.yml index 66880d8eb6..227b4046d1 100644 --- a/.github/workflows/docs-quality-maintenance-project67.campaign.lock.yml +++ b/.github/workflows/docs-quality-maintenance-project67.campaign.lock.yml @@ -164,13 +164,6 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -411,8 +404,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests,actions,code_security", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/duplicate-code-detector.lock.yml b/.github/workflows/duplicate-code-detector.lock.yml index d426b172b6..f2ed42529d 100644 --- a/.github/workflows/duplicate-code-detector.lock.yml +++ b/.github/workflows/duplicate-code-detector.lock.yml @@ -158,13 +158,6 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config diff --git a/.github/workflows/example-custom-error-patterns.lock.yml b/.github/workflows/example-custom-error-patterns.lock.yml index db9a822402..bd241a394d 100644 --- a/.github/workflows/example-custom-error-patterns.lock.yml +++ b/.github/workflows/example-custom-error-patterns.lock.yml @@ -137,13 +137,6 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Setup MCPs @@ -167,8 +160,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/example-permissions-warning.lock.yml b/.github/workflows/example-permissions-warning.lock.yml index e3264fe1ab..47db6a10cb 100644 --- a/.github/workflows/example-permissions-warning.lock.yml +++ b/.github/workflows/example-permissions-warning.lock.yml @@ -140,13 +140,6 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Setup MCPs @@ -168,8 +161,6 @@ jobs: "-e", "GITHUB_PERSONAL_ACCESS_TOKEN", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/example-workflow-analyzer.lock.yml b/.github/workflows/example-workflow-analyzer.lock.yml index 4c7227cd87..c905a64de6 100644 --- a/.github/workflows/example-workflow-analyzer.lock.yml +++ b/.github/workflows/example-workflow-analyzer.lock.yml @@ -152,13 +152,6 @@ jobs: awf --version - name: Install Claude Code CLI run: npm install -g --silent @anthropic-ai/claude-code@2.0.76 - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Install gh-aw extension @@ -345,8 +338,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests,actions", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/firewall-escape.lock.yml b/.github/workflows/firewall-escape.lock.yml index 7f60bddaf9..c299c14b62 100644 --- a/.github/workflows/firewall-escape.lock.yml +++ b/.github/workflows/firewall-escape.lock.yml @@ -164,13 +164,6 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 mcp/fetch - name: Setup MCPs @@ -194,8 +187,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/firewall.lock.yml b/.github/workflows/firewall.lock.yml index ca3a187f8a..66e1377353 100644 --- a/.github/workflows/firewall.lock.yml +++ b/.github/workflows/firewall.lock.yml @@ -140,13 +140,6 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 mcp/fetch - name: Setup MCPs @@ -170,8 +163,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/github-mcp-structural-analysis.lock.yml b/.github/workflows/github-mcp-structural-analysis.lock.yml index edada08964..07a70546c7 100644 --- a/.github/workflows/github-mcp-structural-analysis.lock.yml +++ b/.github/workflows/github-mcp-structural-analysis.lock.yml @@ -193,13 +193,6 @@ jobs: awf --version - name: Install Claude Code CLI run: npm install -g --silent @anthropic-ai/claude-code@2.0.76 - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -394,8 +387,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=all", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/github-mcp-tools-report.lock.yml b/.github/workflows/github-mcp-tools-report.lock.yml index 23c837ab38..3e9178c7a4 100644 --- a/.github/workflows/github-mcp-tools-report.lock.yml +++ b/.github/workflows/github-mcp-tools-report.lock.yml @@ -167,13 +167,6 @@ jobs: awf --version - name: Install Claude Code CLI run: npm install -g --silent @anthropic-ai/claude-code@2.0.76 - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Write Safe Outputs Config run: | mkdir -p /tmp/gh-aw/safeoutputs @@ -393,7 +386,6 @@ jobs: "url": "https://api.githubcopilot.com/mcp/", "headers": { "Authorization": "Bearer $GITHUB_MCP_SERVER_TOKEN", - "X-MCP-Lockdown": "${{ steps.detect-repo-visibility.outputs.lockdown }}", "X-MCP-Readonly": "true", "X-MCP-Toolsets": "all" } diff --git a/.github/workflows/glossary-maintainer.lock.yml b/.github/workflows/glossary-maintainer.lock.yml index fcc2beb563..aa988d223d 100644 --- a/.github/workflows/glossary-maintainer.lock.yml +++ b/.github/workflows/glossary-maintainer.lock.yml @@ -180,13 +180,6 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -364,8 +357,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/go-fan.lock.yml b/.github/workflows/go-fan.lock.yml index ec73494087..39131e7a3a 100644 --- a/.github/workflows/go-fan.lock.yml +++ b/.github/workflows/go-fan.lock.yml @@ -174,13 +174,6 @@ jobs: awf --version - name: Install Claude Code CLI run: npm install -g --silent @anthropic-ai/claude-code@2.0.76 - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -346,8 +339,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/go-file-size-reduction-project64.campaign.lock.yml b/.github/workflows/go-file-size-reduction-project64.campaign.lock.yml index c809c65289..0d3586e36e 100644 --- a/.github/workflows/go-file-size-reduction-project64.campaign.lock.yml +++ b/.github/workflows/go-file-size-reduction-project64.campaign.lock.yml @@ -164,13 +164,6 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -411,8 +404,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests,actions,code_security", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/go-logger.lock.yml b/.github/workflows/go-logger.lock.yml index 9ad67482a4..175379368d 100644 --- a/.github/workflows/go-logger.lock.yml +++ b/.github/workflows/go-logger.lock.yml @@ -173,13 +173,6 @@ jobs: awf --version - name: Install Claude Code CLI run: npm install -g --silent @anthropic-ai/claude-code@2.0.76 - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -355,8 +348,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/go-pattern-detector.lock.yml b/.github/workflows/go-pattern-detector.lock.yml index 30be7db4f7..4d7afc81b0 100644 --- a/.github/workflows/go-pattern-detector.lock.yml +++ b/.github/workflows/go-pattern-detector.lock.yml @@ -152,13 +152,6 @@ jobs: awf --version - name: Install Claude Code CLI run: npm install -g --silent @anthropic-ai/claude-code@2.0.76 - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 mcp/ast-grep:latest - name: Write Safe Outputs Config @@ -355,8 +348,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/grumpy-reviewer.lock.yml b/.github/workflows/grumpy-reviewer.lock.yml index 97228b34a9..2a2ed4de9a 100644 --- a/.github/workflows/grumpy-reviewer.lock.yml +++ b/.github/workflows/grumpy-reviewer.lock.yml @@ -197,13 +197,6 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -430,8 +423,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=pull_requests,repos", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/hourly-ci-cleaner.lock.yml b/.github/workflows/hourly-ci-cleaner.lock.yml index 00ec880503..c55a784c37 100644 --- a/.github/workflows/hourly-ci-cleaner.lock.yml +++ b/.github/workflows/hourly-ci-cleaner.lock.yml @@ -181,13 +181,6 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -365,8 +358,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/human-ai-collaboration.lock.yml b/.github/workflows/human-ai-collaboration.lock.yml index 9dd691a26c..660d3d7542 100644 --- a/.github/workflows/human-ai-collaboration.lock.yml +++ b/.github/workflows/human-ai-collaboration.lock.yml @@ -160,13 +160,6 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -355,8 +348,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=repos,issues,search", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/incident-response.lock.yml b/.github/workflows/incident-response.lock.yml index 834fe74f54..6811420e9a 100644 --- a/.github/workflows/incident-response.lock.yml +++ b/.github/workflows/incident-response.lock.yml @@ -175,13 +175,6 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -507,8 +500,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=repos,issues,pull_requests,search", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/instructions-janitor.lock.yml b/.github/workflows/instructions-janitor.lock.yml index 8f894db014..2e0d9e8408 100644 --- a/.github/workflows/instructions-janitor.lock.yml +++ b/.github/workflows/instructions-janitor.lock.yml @@ -157,13 +157,6 @@ jobs: awf --version - name: Install Claude Code CLI run: npm install -g --silent @anthropic-ai/claude-code@2.0.76 - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -339,8 +332,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/intelligence.lock.yml b/.github/workflows/intelligence.lock.yml index 7bc242509a..19f9cb34a0 100644 --- a/.github/workflows/intelligence.lock.yml +++ b/.github/workflows/intelligence.lock.yml @@ -210,13 +210,6 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -434,8 +427,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=repos,issues,search", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/issue-arborist.lock.yml b/.github/workflows/issue-arborist.lock.yml index 258800fe73..5130de8fa6 100644 --- a/.github/workflows/issue-arborist.lock.yml +++ b/.github/workflows/issue-arborist.lock.yml @@ -156,13 +156,6 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config diff --git a/.github/workflows/issue-classifier.lock.yml b/.github/workflows/issue-classifier.lock.yml index 213e632b39..932e429fa1 100644 --- a/.github/workflows/issue-classifier.lock.yml +++ b/.github/workflows/issue-classifier.lock.yml @@ -159,13 +159,6 @@ jobs: setupGlobals(core, github, context, exec, io); const { main } = require('/tmp/gh-aw/actions/checkout_pr_branch.cjs'); await main(); - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -318,8 +311,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/issue-monster.lock.yml b/.github/workflows/issue-monster.lock.yml index 64dfec6f21..bfe39d3ef9 100644 --- a/.github/workflows/issue-monster.lock.yml +++ b/.github/workflows/issue-monster.lock.yml @@ -161,13 +161,6 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -357,8 +350,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/issue-template-optimizer.lock.yml b/.github/workflows/issue-template-optimizer.lock.yml index 155569bb59..fbc5389228 100644 --- a/.github/workflows/issue-template-optimizer.lock.yml +++ b/.github/workflows/issue-template-optimizer.lock.yml @@ -163,13 +163,6 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -347,8 +340,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/issue-triage-agent.lock.yml b/.github/workflows/issue-triage-agent.lock.yml index 0dbc02052a..8f366dac28 100644 --- a/.github/workflows/issue-triage-agent.lock.yml +++ b/.github/workflows/issue-triage-agent.lock.yml @@ -129,13 +129,6 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -326,8 +319,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=issues,labels", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/jsweep.lock.yml b/.github/workflows/jsweep.lock.yml index 16f6e074d8..e6d35f0cb4 100644 --- a/.github/workflows/jsweep.lock.yml +++ b/.github/workflows/jsweep.lock.yml @@ -177,13 +177,6 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -361,8 +354,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/layout-spec-maintainer.lock.yml b/.github/workflows/layout-spec-maintainer.lock.yml index acc4eeadb0..d989737f14 100644 --- a/.github/workflows/layout-spec-maintainer.lock.yml +++ b/.github/workflows/layout-spec-maintainer.lock.yml @@ -153,13 +153,6 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -337,8 +330,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/lockfile-stats.lock.yml b/.github/workflows/lockfile-stats.lock.yml index 73f5031818..d1f02216c9 100644 --- a/.github/workflows/lockfile-stats.lock.yml +++ b/.github/workflows/lockfile-stats.lock.yml @@ -161,13 +161,6 @@ jobs: awf --version - name: Install Claude Code CLI run: npm install -g --silent @anthropic-ai/claude-code@2.0.76 - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -333,8 +326,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/mcp-inspector.lock.yml b/.github/workflows/mcp-inspector.lock.yml index 030ce6d4b3..6ddee84039 100644 --- a/.github/workflows/mcp-inspector.lock.yml +++ b/.github/workflows/mcp-inspector.lock.yml @@ -213,13 +213,6 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh docker.io/mcp/brave-search ghcr.io/github/github-mcp-server:v0.26.3 mcp/arxiv-mcp-server mcp/ast-grep:latest mcp/context7 mcp/memory mcp/notion - name: Write Safe Outputs Config @@ -549,8 +542,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/mergefest.lock.yml b/.github/workflows/mergefest.lock.yml index 5995bb4024..3c6b744c42 100644 --- a/.github/workflows/mergefest.lock.yml +++ b/.github/workflows/mergefest.lock.yml @@ -175,13 +175,6 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -345,8 +338,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=pull_requests,repos", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/metrics-collector.lock.yml b/.github/workflows/metrics-collector.lock.yml index 61d5cdd5a1..d32aea3a79 100644 --- a/.github/workflows/metrics-collector.lock.yml +++ b/.github/workflows/metrics-collector.lock.yml @@ -158,13 +158,6 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Install gh-aw extension env: GH_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} @@ -202,7 +195,6 @@ jobs: "url": "https://api.githubcopilot.com/mcp/", "headers": { "Authorization": "Bearer \${GITHUB_PERSONAL_ACCESS_TOKEN}", - "X-MCP-Lockdown": "${{ steps.detect-repo-visibility.outputs.lockdown }}", "X-MCP-Readonly": "true", "X-MCP-Toolsets": "context,repos,issues,pull_requests" }, diff --git a/.github/workflows/notion-issue-summary.lock.yml b/.github/workflows/notion-issue-summary.lock.yml index 186973ccf8..f00f329695 100644 --- a/.github/workflows/notion-issue-summary.lock.yml +++ b/.github/workflows/notion-issue-summary.lock.yml @@ -157,13 +157,6 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 mcp/notion - name: Write Safe Outputs Config @@ -296,8 +289,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/org-wide-rollout.lock.yml b/.github/workflows/org-wide-rollout.lock.yml index 3cd5faf810..1c8934baa1 100644 --- a/.github/workflows/org-wide-rollout.lock.yml +++ b/.github/workflows/org-wide-rollout.lock.yml @@ -182,13 +182,6 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -514,8 +507,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=repos,issues,pull_requests,search", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/pdf-summary.lock.yml b/.github/workflows/pdf-summary.lock.yml index 96b6e75d77..9914bc6a81 100644 --- a/.github/workflows/pdf-summary.lock.yml +++ b/.github/workflows/pdf-summary.lock.yml @@ -223,13 +223,6 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -381,8 +374,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/plan.lock.yml b/.github/workflows/plan.lock.yml index 995c345fed..57c0195093 100644 --- a/.github/workflows/plan.lock.yml +++ b/.github/workflows/plan.lock.yml @@ -188,13 +188,6 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -440,8 +433,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests,discussions", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/playground-org-project-update-issue.lock.yml b/.github/workflows/playground-org-project-update-issue.lock.yml index 88dc686db3..e31c44a342 100644 --- a/.github/workflows/playground-org-project-update-issue.lock.yml +++ b/.github/workflows/playground-org-project-update-issue.lock.yml @@ -148,13 +148,13 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 with: script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -359,7 +359,7 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests,projects", "ghcr.io/github/github-mcp-server:v0.26.3" diff --git a/.github/workflows/playground-snapshots-refresh.lock.yml b/.github/workflows/playground-snapshots-refresh.lock.yml index 750a1a2ad9..f79a9c8075 100644 --- a/.github/workflows/playground-snapshots-refresh.lock.yml +++ b/.github/workflows/playground-snapshots-refresh.lock.yml @@ -166,13 +166,6 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -350,8 +343,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/poem-bot.lock.yml b/.github/workflows/poem-bot.lock.yml index 66d574cf8d..0dc75f31c8 100644 --- a/.github/workflows/poem-bot.lock.yml +++ b/.github/workflows/poem-bot.lock.yml @@ -205,13 +205,6 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -894,8 +887,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/portfolio-analyst.lock.yml b/.github/workflows/portfolio-analyst.lock.yml index da3265932a..40a2020548 100644 --- a/.github/workflows/portfolio-analyst.lock.yml +++ b/.github/workflows/portfolio-analyst.lock.yml @@ -221,13 +221,6 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -431,8 +424,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/pr-nitpick-reviewer.lock.yml b/.github/workflows/pr-nitpick-reviewer.lock.yml index 6b60964348..30df67b6ea 100644 --- a/.github/workflows/pr-nitpick-reviewer.lock.yml +++ b/.github/workflows/pr-nitpick-reviewer.lock.yml @@ -216,13 +216,6 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -501,8 +494,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=pull_requests,repos", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/prompt-clustering-analysis.lock.yml b/.github/workflows/prompt-clustering-analysis.lock.yml index 7c9dae381c..1f461bf977 100644 --- a/.github/workflows/prompt-clustering-analysis.lock.yml +++ b/.github/workflows/prompt-clustering-analysis.lock.yml @@ -235,13 +235,6 @@ jobs: awf --version - name: Install Claude Code CLI run: npm install -g --silent @anthropic-ai/claude-code@2.0.76 - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -411,8 +404,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=repos,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/python-data-charts.lock.yml b/.github/workflows/python-data-charts.lock.yml index 864157e84d..662da1e642 100644 --- a/.github/workflows/python-data-charts.lock.yml +++ b/.github/workflows/python-data-charts.lock.yml @@ -193,13 +193,6 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Install gh-aw extension @@ -419,8 +412,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/q.lock.yml b/.github/workflows/q.lock.yml index af798b6cc1..12e65c18c1 100644 --- a/.github/workflows/q.lock.yml +++ b/.github/workflows/q.lock.yml @@ -254,13 +254,6 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -481,8 +474,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests,actions,discussions", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/release.lock.yml b/.github/workflows/release.lock.yml index 1579e10e7b..d01ec36f36 100644 --- a/.github/workflows/release.lock.yml +++ b/.github/workflows/release.lock.yml @@ -161,13 +161,6 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -340,8 +333,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/repo-tree-map.lock.yml b/.github/workflows/repo-tree-map.lock.yml index 9b9d64a137..7a14cb0236 100644 --- a/.github/workflows/repo-tree-map.lock.yml +++ b/.github/workflows/repo-tree-map.lock.yml @@ -155,13 +155,6 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -329,8 +322,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/repository-quality-improver.lock.yml b/.github/workflows/repository-quality-improver.lock.yml index c592f036b1..5346d50ca5 100644 --- a/.github/workflows/repository-quality-improver.lock.yml +++ b/.github/workflows/repository-quality-improver.lock.yml @@ -181,13 +181,6 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -355,8 +348,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/research.lock.yml b/.github/workflows/research.lock.yml index 1b1dce1c5a..4375865397 100644 --- a/.github/workflows/research.lock.yml +++ b/.github/workflows/research.lock.yml @@ -158,13 +158,6 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -332,8 +325,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/safe-output-health.lock.yml b/.github/workflows/safe-output-health.lock.yml index fac1e5f338..dd7b81af64 100644 --- a/.github/workflows/safe-output-health.lock.yml +++ b/.github/workflows/safe-output-health.lock.yml @@ -187,13 +187,6 @@ jobs: awf --version - name: Install Claude Code CLI run: npm install -g --silent @anthropic-ai/claude-code@2.0.76 - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -363,8 +356,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/schema-consistency-checker.lock.yml b/.github/workflows/schema-consistency-checker.lock.yml index 4db38711db..7f42db4803 100644 --- a/.github/workflows/schema-consistency-checker.lock.yml +++ b/.github/workflows/schema-consistency-checker.lock.yml @@ -165,13 +165,6 @@ jobs: awf --version - name: Install Claude Code CLI run: npm install -g --silent @anthropic-ai/claude-code@2.0.76 - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Write Safe Outputs Config run: | mkdir -p /tmp/gh-aw/safeoutputs @@ -329,7 +322,6 @@ jobs: "url": "https://api.githubcopilot.com/mcp/", "headers": { "Authorization": "Bearer $GITHUB_MCP_SERVER_TOKEN", - "X-MCP-Lockdown": "${{ steps.detect-repo-visibility.outputs.lockdown }}", "X-MCP-Readonly": "true", "X-MCP-Toolsets": "context,repos,issues,pull_requests,discussions" } diff --git a/.github/workflows/scout.lock.yml b/.github/workflows/scout.lock.yml index 95420adf21..9d8fc0f164 100644 --- a/.github/workflows/scout.lock.yml +++ b/.github/workflows/scout.lock.yml @@ -246,13 +246,6 @@ jobs: awf --version - name: Install Claude Code CLI run: npm install -g --silent @anthropic-ai/claude-code@2.0.76 - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 mcp/arxiv-mcp-server mcp/context7 - name: Write Safe Outputs Config @@ -431,8 +424,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/security-compliance.lock.yml b/.github/workflows/security-compliance.lock.yml index 0a399a92f4..94a64aef5f 100644 --- a/.github/workflows/security-compliance.lock.yml +++ b/.github/workflows/security-compliance.lock.yml @@ -165,13 +165,6 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -360,8 +353,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=repos,search,code_security", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/security-fix-pr.lock.yml b/.github/workflows/security-fix-pr.lock.yml index 1805f4b51f..d5ea207e94 100644 --- a/.github/workflows/security-fix-pr.lock.yml +++ b/.github/workflows/security-fix-pr.lock.yml @@ -165,13 +165,6 @@ jobs: awf --version - name: Install Claude Code CLI run: npm install -g --silent @anthropic-ai/claude-code@2.0.76 - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -347,8 +340,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=context,repos,code_security,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/semantic-function-refactor.lock.yml b/.github/workflows/semantic-function-refactor.lock.yml index 27b0224ce0..f04041eda7 100644 --- a/.github/workflows/semantic-function-refactor.lock.yml +++ b/.github/workflows/semantic-function-refactor.lock.yml @@ -150,13 +150,6 @@ jobs: awf --version - name: Install Claude Code CLI run: npm install -g --silent @anthropic-ai/claude-code@2.0.76 - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -381,8 +374,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/slide-deck-maintainer.lock.yml b/.github/workflows/slide-deck-maintainer.lock.yml index f1f58c0366..6df4d3f52b 100644 --- a/.github/workflows/slide-deck-maintainer.lock.yml +++ b/.github/workflows/slide-deck-maintainer.lock.yml @@ -180,13 +180,6 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 mcr.microsoft.com/playwright/mcp - name: Write Safe Outputs Config @@ -364,8 +357,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/smoke-claude.lock.yml b/.github/workflows/smoke-claude.lock.yml index 9e295b1d70..b0dc525745 100644 --- a/.github/workflows/smoke-claude.lock.yml +++ b/.github/workflows/smoke-claude.lock.yml @@ -199,13 +199,6 @@ jobs: awf --version - name: Install Claude Code CLI run: npm install -g --silent @anthropic-ai/claude-code@2.0.76 - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 mcr.microsoft.com/playwright/mcp - name: Write Safe Outputs Config @@ -467,8 +460,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=repos,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/smoke-codex-firewall.lock.yml b/.github/workflows/smoke-codex-firewall.lock.yml index 80ebac68d7..655e95bf39 100644 --- a/.github/workflows/smoke-codex-firewall.lock.yml +++ b/.github/workflows/smoke-codex-firewall.lock.yml @@ -172,13 +172,6 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config diff --git a/.github/workflows/smoke-codex.lock.yml b/.github/workflows/smoke-codex.lock.yml index 45c3a285fb..5fe1a6a65d 100644 --- a/.github/workflows/smoke-codex.lock.yml +++ b/.github/workflows/smoke-codex.lock.yml @@ -195,13 +195,6 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 mcr.microsoft.com/playwright/mcp - name: Write Safe Outputs Config diff --git a/.github/workflows/smoke-copilot-no-firewall.lock.yml b/.github/workflows/smoke-copilot-no-firewall.lock.yml index dbaf06b365..0e0c49af91 100644 --- a/.github/workflows/smoke-copilot-no-firewall.lock.yml +++ b/.github/workflows/smoke-copilot-no-firewall.lock.yml @@ -187,13 +187,6 @@ jobs: # Verify installation copilot --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 mcr.microsoft.com/playwright/mcp - name: Write Safe Outputs Config @@ -480,8 +473,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/smoke-copilot-playwright.lock.yml b/.github/workflows/smoke-copilot-playwright.lock.yml index a7c56b7a62..cfa64978d2 100644 --- a/.github/workflows/smoke-copilot-playwright.lock.yml +++ b/.github/workflows/smoke-copilot-playwright.lock.yml @@ -207,13 +207,6 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 mcr.microsoft.com/playwright/mcp - name: Write Safe Outputs Config @@ -573,8 +566,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/smoke-copilot.lock.yml b/.github/workflows/smoke-copilot.lock.yml index f5532c18fa..f6a98ac50f 100644 --- a/.github/workflows/smoke-copilot.lock.yml +++ b/.github/workflows/smoke-copilot.lock.yml @@ -188,13 +188,6 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -458,8 +451,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/smoke-detector.lock.yml b/.github/workflows/smoke-detector.lock.yml index a246ad159d..a6256336f2 100644 --- a/.github/workflows/smoke-detector.lock.yml +++ b/.github/workflows/smoke-detector.lock.yml @@ -223,13 +223,6 @@ jobs: awf --version - name: Install Claude Code CLI run: npm install -g --silent @anthropic-ai/claude-code@2.0.76 - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -456,8 +449,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests,actions", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/smoke-srt-custom-config.lock.yml b/.github/workflows/smoke-srt-custom-config.lock.yml index e599e97f5c..802e7c1398 100644 --- a/.github/workflows/smoke-srt-custom-config.lock.yml +++ b/.github/workflows/smoke-srt-custom-config.lock.yml @@ -148,13 +148,6 @@ jobs: echo "Sandbox Runtime installed successfully" - name: Install GitHub Copilot CLI run: npm install --silent @github/copilot@0.0.374 - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Setup MCPs @@ -178,8 +171,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/smoke-srt.lock.yml b/.github/workflows/smoke-srt.lock.yml index c7198e9195..acdeee5f40 100644 --- a/.github/workflows/smoke-srt.lock.yml +++ b/.github/workflows/smoke-srt.lock.yml @@ -164,13 +164,6 @@ jobs: echo "Sandbox Runtime installed successfully" - name: Install GitHub Copilot CLI run: npm install --silent @github/copilot@0.0.374 - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -286,8 +279,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/spec-kit-execute.lock.yml b/.github/workflows/spec-kit-execute.lock.yml index 0c2b29ee7c..ee5410ff2a 100644 --- a/.github/workflows/spec-kit-execute.lock.yml +++ b/.github/workflows/spec-kit-execute.lock.yml @@ -170,13 +170,6 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Write Safe Outputs Config run: | mkdir -p /tmp/gh-aw/safeoutputs @@ -345,7 +338,6 @@ jobs: "url": "https://api.githubcopilot.com/mcp/", "headers": { "Authorization": "Bearer \${GITHUB_PERSONAL_ACCESS_TOKEN}", - "X-MCP-Lockdown": "${{ steps.detect-repo-visibility.outputs.lockdown }}", "X-MCP-Readonly": "true", "X-MCP-Toolsets": "context,repos,issues,pull_requests" }, diff --git a/.github/workflows/spec-kit-executor.lock.yml b/.github/workflows/spec-kit-executor.lock.yml index 4a65d6f29a..338f7e2975 100644 --- a/.github/workflows/spec-kit-executor.lock.yml +++ b/.github/workflows/spec-kit-executor.lock.yml @@ -171,13 +171,6 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -355,8 +348,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/speckit-dispatcher.lock.yml b/.github/workflows/speckit-dispatcher.lock.yml index 821ffec06f..f7cb1927e6 100644 --- a/.github/workflows/speckit-dispatcher.lock.yml +++ b/.github/workflows/speckit-dispatcher.lock.yml @@ -210,13 +210,6 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -483,8 +476,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/static-analysis-report.lock.yml b/.github/workflows/static-analysis-report.lock.yml index 2d04ebaae9..2f4d955ee5 100644 --- a/.github/workflows/static-analysis-report.lock.yml +++ b/.github/workflows/static-analysis-report.lock.yml @@ -186,13 +186,6 @@ jobs: awf --version - name: Install Claude Code CLI run: npm install -g --silent @anthropic-ai/claude-code@2.0.76 - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -362,8 +355,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests,actions", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/sub-issue-closer.lock.yml b/.github/workflows/sub-issue-closer.lock.yml index c674bea9c9..5be72517b0 100644 --- a/.github/workflows/sub-issue-closer.lock.yml +++ b/.github/workflows/sub-issue-closer.lock.yml @@ -149,13 +149,6 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -366,8 +359,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=issues", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/super-linter.lock.yml b/.github/workflows/super-linter.lock.yml index 541b0fb374..3e27601745 100644 --- a/.github/workflows/super-linter.lock.yml +++ b/.github/workflows/super-linter.lock.yml @@ -175,13 +175,6 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -370,8 +363,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/technical-doc-writer.lock.yml b/.github/workflows/technical-doc-writer.lock.yml index 96455ee8e6..20b3c715cf 100644 --- a/.github/workflows/technical-doc-writer.lock.yml +++ b/.github/workflows/technical-doc-writer.lock.yml @@ -190,13 +190,6 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -439,8 +432,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/terminal-stylist.lock.yml b/.github/workflows/terminal-stylist.lock.yml index d5a72974aa..6f84bbdbc3 100644 --- a/.github/workflows/terminal-stylist.lock.yml +++ b/.github/workflows/terminal-stylist.lock.yml @@ -159,13 +159,6 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -333,8 +326,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=repos", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/tidy.lock.yml b/.github/workflows/tidy.lock.yml index 060d926abb..0c9a42262e 100644 --- a/.github/workflows/tidy.lock.yml +++ b/.github/workflows/tidy.lock.yml @@ -198,13 +198,6 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -430,8 +423,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/typist.lock.yml b/.github/workflows/typist.lock.yml index 1d3ca7195d..6c5f0821c3 100644 --- a/.github/workflows/typist.lock.yml +++ b/.github/workflows/typist.lock.yml @@ -161,13 +161,6 @@ jobs: awf --version - name: Install Claude Code CLI run: npm install -g --silent @anthropic-ai/claude-code@2.0.76 - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -333,8 +326,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/unbloat-docs.lock.yml b/.github/workflows/unbloat-docs.lock.yml index 95df4d15f0..268306b960 100644 --- a/.github/workflows/unbloat-docs.lock.yml +++ b/.github/workflows/unbloat-docs.lock.yml @@ -206,13 +206,6 @@ jobs: awf --version - name: Install Claude Code CLI run: npm install -g --silent @anthropic-ai/claude-code@2.0.76 - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 mcr.microsoft.com/playwright/mcp - name: Write Safe Outputs Config @@ -453,8 +446,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/video-analyzer.lock.yml b/.github/workflows/video-analyzer.lock.yml index 6f1c9ca2fb..7db0340be9 100644 --- a/.github/workflows/video-analyzer.lock.yml +++ b/.github/workflows/video-analyzer.lock.yml @@ -165,13 +165,6 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -360,8 +353,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/weekly-issue-summary.lock.yml b/.github/workflows/weekly-issue-summary.lock.yml index f4fb4b2505..1f3cc6aea3 100644 --- a/.github/workflows/weekly-issue-summary.lock.yml +++ b/.github/workflows/weekly-issue-summary.lock.yml @@ -173,13 +173,6 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -376,8 +369,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=issues", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/workflow-generator.lock.yml b/.github/workflows/workflow-generator.lock.yml index 9e01ce8070..1ddf9e31ae 100644 --- a/.github/workflows/workflow-generator.lock.yml +++ b/.github/workflows/workflow-generator.lock.yml @@ -164,13 +164,6 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -383,8 +376,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/workflow-health-manager.lock.yml b/.github/workflows/workflow-health-manager.lock.yml index 1a9dd738a6..d6782ba4cd 100644 --- a/.github/workflows/workflow-health-manager.lock.yml +++ b/.github/workflows/workflow-health-manager.lock.yml @@ -164,13 +164,6 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version - - name: Detect repository visibility for GitHub MCP lockdown - id: detect-repo-visibility - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const detectRepoVisibility = require('/tmp/gh-aw/actions/detect_repo_visibility.cjs'); - await detectRepoVisibility(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -454,8 +447,6 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", - "GITHUB_LOCKDOWN_MODE=${{ steps.detect-repo-visibility.outputs.lockdown == 'true' && '1' || '0' }}", - "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests,actions", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/pkg/workflow/mcp_renderer.go b/pkg/workflow/mcp_renderer.go index a4d245ac53..fc5a699031 100644 --- a/pkg/workflow/mcp_renderer.go +++ b/pkg/workflow/mcp_renderer.go @@ -49,7 +49,10 @@ func (r *MCPConfigRendererUnified) RenderGitHubMCP(yaml *strings.Builder, github // Check if automatic lockdown determination step will be generated // This requires: lockdown not explicitly set AND custom token configured customGitHubToken := getGitHubToken(githubTool) - toplevelToken := workflowData.GitHubToken + var toplevelToken string + if workflowData != nil { + toplevelToken = workflowData.GitHubToken + } hasCustomToken := customGitHubToken != "" || toplevelToken != "" shouldUseStepOutput := !hasGitHubLockdownExplicitlySet(githubTool) && hasCustomToken From b9c13983e58d7bf464d7f128c9382abc12a6d58f Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Sat, 3 Jan 2026 23:29:01 +0000 Subject: [PATCH 4/7] Rename detect-repo-visibility to determine-automatic-lockdown and require custom token Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> --- pkg/workflow/mcp_renderer.go | 4 ++-- pkg/workflow/mcp_servers.go | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/pkg/workflow/mcp_renderer.go b/pkg/workflow/mcp_renderer.go index fc5a699031..5c2e3d8520 100644 --- a/pkg/workflow/mcp_renderer.go +++ b/pkg/workflow/mcp_renderer.go @@ -45,7 +45,7 @@ func (r *MCPConfigRendererUnified) RenderGitHubMCP(yaml *strings.Builder, github // Get lockdown value - use detected value if lockdown wasn't explicitly set lockdown := getGitHubLockdown(githubTool) - + // Check if automatic lockdown determination step will be generated // This requires: lockdown not explicitly set AND custom token configured customGitHubToken := getGitHubToken(githubTool) @@ -55,7 +55,7 @@ func (r *MCPConfigRendererUnified) RenderGitHubMCP(yaml *strings.Builder, github } hasCustomToken := customGitHubToken != "" || toplevelToken != "" shouldUseStepOutput := !hasGitHubLockdownExplicitlySet(githubTool) && hasCustomToken - + if shouldUseStepOutput { // Use the detected lockdown value from the step output // This will be evaluated at runtime based on repository visibility diff --git a/pkg/workflow/mcp_servers.go b/pkg/workflow/mcp_servers.go index b30e994dfd..f8c82557d8 100644 --- a/pkg/workflow/mcp_servers.go +++ b/pkg/workflow/mcp_servers.go @@ -793,10 +793,10 @@ func (c *Compiler) generateGitHubMCPLockdownDetectionStep(yaml *strings.Builder, // The step only applies when GH_AW_GITHUB_MCP_SERVER_TOKEN is explicitly configured customGitHubToken := getGitHubToken(githubTool) toplevelToken := data.GitHubToken - + // Determine if a custom token is being used (not the default fallback) hasCustomToken := customGitHubToken != "" || toplevelToken != "" - + if !hasCustomToken { mcpServersLog.Print("No custom GitHub MCP server token defined, skipping automatic lockdown determination") return From c79b157ff69ee68beb4332886eaae0a5a9133af9 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Sun, 4 Jan 2026 00:36:37 +0000 Subject: [PATCH 5/7] Add runtime if condition for custom token check in determination step Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> --- .../github_lockdown_autodetect_test.go | 57 ++++++++----------- pkg/workflow/mcp_renderer.go | 14 ++--- pkg/workflow/mcp_servers.go | 22 ++----- 3 files changed, 34 insertions(+), 59 deletions(-) diff --git a/pkg/workflow/github_lockdown_autodetect_test.go b/pkg/workflow/github_lockdown_autodetect_test.go index 3c7036a55f..afd66dc6ff 100644 --- a/pkg/workflow/github_lockdown_autodetect_test.go +++ b/pkg/workflow/github_lockdown_autodetect_test.go @@ -13,46 +13,28 @@ func TestGitHubLockdownAutodetection(t *testing.T) { workflow string expectedDetectStep bool expectedLockdown string // "auto" means use step output expression, "true" means hardcoded true, "false" means not present + expectIfCondition bool // true if step should have if: condition description string }{ { - name: "Auto-determination enabled when lockdown not specified and custom token defined", + name: "Auto-determination enabled when lockdown not specified", workflow: `--- on: issues engine: copilot tools: github: mode: local - github-token: ${{ secrets.CUSTOM_TOKEN }} toolsets: [default] --- # Test Workflow -Test automatic lockdown determination with custom token. +Test automatic lockdown determination. `, expectedDetectStep: true, expectedLockdown: "auto", - description: "When lockdown is not specified and custom token is defined, determination step should be added", - }, - { - name: "No auto-determination when no custom token", - workflow: `--- -on: issues -engine: copilot -tools: - github: - mode: local - toolsets: [default] ---- - -# Test Workflow - -Test without custom token - should not add determination step. -`, - expectedDetectStep: false, - expectedLockdown: "false", - description: "When no custom token is defined, no determination step should be added", + expectIfCondition: true, + description: "When lockdown is not specified, determination step should be added with if condition", }, { name: "No auto-determination when lockdown explicitly set to true", @@ -63,7 +45,6 @@ tools: github: mode: local lockdown: true - github-token: ${{ secrets.CUSTOM_TOKEN }} toolsets: [default] --- @@ -73,6 +54,7 @@ Test with explicit lockdown enabled. `, expectedDetectStep: false, expectedLockdown: "true", + expectIfCondition: false, description: "When lockdown is explicitly true, no determination step and lockdown should be hardcoded", }, { @@ -84,7 +66,6 @@ tools: github: mode: local lockdown: false - github-token: ${{ secrets.CUSTOM_TOKEN }} toolsets: [default] --- @@ -94,27 +75,28 @@ Test with explicit lockdown disabled. `, expectedDetectStep: false, expectedLockdown: "false", + expectIfCondition: false, description: "When lockdown is explicitly false, no determination step and no lockdown setting", }, { - name: "Auto-determination with remote mode and custom token", + name: "Auto-determination with remote mode", workflow: `--- on: issues engine: copilot tools: github: mode: remote - github-token: ${{ secrets.CUSTOM_TOKEN }} toolsets: [default] --- # Test Workflow -Test auto-determination with remote GitHub MCP and custom token. +Test auto-determination with remote GitHub MCP. `, expectedDetectStep: true, expectedLockdown: "auto", - description: "Auto-determination should work with remote mode when custom token is defined", + expectIfCondition: true, + description: "Auto-determination should work with remote mode", }, } @@ -156,6 +138,13 @@ Test auto-determination with remote GitHub MCP and custom token. t.Errorf("%s: Detection step presence = %v, want %v", tt.description, detectStepPresent, tt.expectedDetectStep) } + // Check if the step has the if condition when expected + if tt.expectIfCondition && detectStepPresent { + if !strings.Contains(yaml, "if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != ''") { + t.Errorf("%s: Expected if condition for GH_AW_GITHUB_MCP_SERVER_TOKEN", tt.description) + } + } + // Check lockdown configuration based on expected value switch tt.expectedLockdown { case "auto": @@ -187,13 +176,12 @@ engine: claude tools: github: mode: local - github-token: ${{ secrets.CUSTOM_TOKEN }} toolsets: [default] --- # Test Workflow -Test automatic lockdown determination with Claude and custom token. +Test automatic lockdown determination with Claude. ` // Create temporary directory for test @@ -228,7 +216,12 @@ Test automatic lockdown determination with Claude and custom token. strings.Contains(yaml, "determine-automatic-lockdown") if !detectStepPresent { - t.Error("Determination step should be present for Claude engine with custom token") + t.Error("Determination step should be present for Claude engine") + } + + // Check if the step has the if condition + if !strings.Contains(yaml, "if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != ''") { + t.Error("Expected if condition for GH_AW_GITHUB_MCP_SERVER_TOKEN in determination step") } // Check if lockdown uses step output expression diff --git a/pkg/workflow/mcp_renderer.go b/pkg/workflow/mcp_renderer.go index 5c2e3d8520..51fca136bc 100644 --- a/pkg/workflow/mcp_renderer.go +++ b/pkg/workflow/mcp_renderer.go @@ -47,14 +47,8 @@ func (r *MCPConfigRendererUnified) RenderGitHubMCP(yaml *strings.Builder, github lockdown := getGitHubLockdown(githubTool) // Check if automatic lockdown determination step will be generated - // This requires: lockdown not explicitly set AND custom token configured - customGitHubToken := getGitHubToken(githubTool) - var toplevelToken string - if workflowData != nil { - toplevelToken = workflowData.GitHubToken - } - hasCustomToken := customGitHubToken != "" || toplevelToken != "" - shouldUseStepOutput := !hasGitHubLockdownExplicitlySet(githubTool) && hasCustomToken + // The step is always generated when lockdown is not explicitly set + shouldUseStepOutput := !hasGitHubLockdownExplicitlySet(githubTool) if shouldUseStepOutput { // Use the detected lockdown value from the step output @@ -64,8 +58,8 @@ func (r *MCPConfigRendererUnified) RenderGitHubMCP(yaml *strings.Builder, github toolsets := getGitHubToolsets(githubTool) - mcpRendererLog.Printf("Rendering GitHub MCP: type=%s, read_only=%t, lockdown=%t (explicit=%t, custom_token=%t, use_step=%t), toolsets=%v, format=%s", - githubType, readOnly, lockdown, hasGitHubLockdownExplicitlySet(githubTool), hasCustomToken, shouldUseStepOutput, toolsets, r.options.Format) + mcpRendererLog.Printf("Rendering GitHub MCP: type=%s, read_only=%t, lockdown=%t (explicit=%t, use_step=%t), toolsets=%v, format=%s", + githubType, readOnly, lockdown, hasGitHubLockdownExplicitlySet(githubTool), shouldUseStepOutput, toolsets, r.options.Format) if r.options.Format == "toml" { r.renderGitHubTOML(yaml, githubTool, workflowData) diff --git a/pkg/workflow/mcp_servers.go b/pkg/workflow/mcp_servers.go index f8c82557d8..11a2baef8c 100644 --- a/pkg/workflow/mcp_servers.go +++ b/pkg/workflow/mcp_servers.go @@ -771,11 +771,10 @@ func replaceExpressionsInPlaywrightArgs(args []string, expressions map[string]st } // generateGitHubMCPLockdownDetectionStep generates a step to determine automatic lockdown mode -// for GitHub MCP server based on repository visibility. This step is only added when: +// for GitHub MCP server based on repository visibility. This step is added when: // - GitHub tool is enabled AND -// - lockdown field is not explicitly specified in the workflow configuration AND -// - A custom GitHub MCP server token is defined (GH_AW_GITHUB_MCP_SERVER_TOKEN exists) AND -// - Repository is public +// - lockdown field is not explicitly specified in the workflow configuration +// The step includes a runtime condition that only executes if GH_AW_GITHUB_MCP_SERVER_TOKEN is defined func (c *Compiler) generateGitHubMCPLockdownDetectionStep(yaml *strings.Builder, data *WorkflowData) { // Check if GitHub tool is present githubTool, hasGitHub := data.Tools["github"] @@ -789,19 +788,6 @@ func (c *Compiler) generateGitHubMCPLockdownDetectionStep(yaml *strings.Builder, return } - // Check if custom GitHub MCP server token is defined - // The step only applies when GH_AW_GITHUB_MCP_SERVER_TOKEN is explicitly configured - customGitHubToken := getGitHubToken(githubTool) - toplevelToken := data.GitHubToken - - // Determine if a custom token is being used (not the default fallback) - hasCustomToken := customGitHubToken != "" || toplevelToken != "" - - if !hasCustomToken { - mcpServersLog.Print("No custom GitHub MCP server token defined, skipping automatic lockdown determination") - return - } - mcpServersLog.Print("Generating automatic lockdown determination step for GitHub MCP server") // Resolve the latest version of actions/github-script @@ -816,8 +802,10 @@ func (c *Compiler) generateGitHubMCPLockdownDetectionStep(yaml *strings.Builder, } // Generate the step using the determine_automatic_lockdown.cjs action + // The step only runs if GH_AW_GITHUB_MCP_SERVER_TOKEN secret is defined yaml.WriteString(" - name: Determine automatic lockdown mode for GitHub MCP server\n") yaml.WriteString(" id: determine-automatic-lockdown\n") + yaml.WriteString(" if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != ''\n") fmt.Fprintf(yaml, " uses: %s\n", pinnedAction) yaml.WriteString(" with:\n") yaml.WriteString(" script: |\n") From 9a63cbd987c041d2f7ea4363107ea23d5f11486a Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Sun, 4 Jan 2026 00:40:16 +0000 Subject: [PATCH 6/7] Recompile workflows with runtime if condition Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> --- .github/workflows/agent-performance-analyzer.lock.yml | 10 ++++++++++ .github/workflows/ai-moderator.lock.yml | 10 ++++++++++ .github/workflows/archie.lock.yml | 10 ++++++++++ .github/workflows/artifacts-summary.lock.yml | 10 ++++++++++ .github/workflows/audit-workflows.lock.yml | 10 ++++++++++ .github/workflows/blog-auditor.lock.yml | 10 ++++++++++ .github/workflows/brave.lock.yml | 10 ++++++++++ .github/workflows/breaking-change-checker.lock.yml | 10 ++++++++++ .github/workflows/campaign-generator.lock.yml | 10 ++++++++++ .github/workflows/campaign-manager.lock.yml | 9 +++++++++ .github/workflows/changeset.lock.yml | 8 ++++++++ .github/workflows/ci-coach.lock.yml | 10 ++++++++++ .github/workflows/ci-doctor.lock.yml | 10 ++++++++++ .github/workflows/cli-consistency-checker.lock.yml | 10 ++++++++++ .github/workflows/cli-version-checker.lock.yml | 10 ++++++++++ .github/workflows/cloclo.lock.yml | 10 ++++++++++ .github/workflows/commit-changes-analyzer.lock.yml | 10 ++++++++++ .github/workflows/copilot-agent-analysis.lock.yml | 10 ++++++++++ .github/workflows/copilot-pr-nlp-analysis.lock.yml | 10 ++++++++++ .github/workflows/copilot-pr-prompt-analysis.lock.yml | 10 ++++++++++ .github/workflows/copilot-session-insights.lock.yml | 10 ++++++++++ .github/workflows/craft.lock.yml | 10 ++++++++++ .github/workflows/daily-assign-issue-to-user.lock.yml | 10 ++++++++++ .github/workflows/daily-choice-test.lock.yml | 10 ++++++++++ .github/workflows/daily-cli-performance.lock.yml | 10 ++++++++++ .github/workflows/daily-code-metrics.lock.yml | 10 ++++++++++ .github/workflows/daily-copilot-token-report.lock.yml | 10 ++++++++++ .github/workflows/daily-doc-updater.lock.yml | 10 ++++++++++ .github/workflows/daily-fact.lock.yml | 8 ++++++++ .github/workflows/daily-file-diet.lock.yml | 10 ++++++++++ .github/workflows/daily-firewall-report.lock.yml | 10 ++++++++++ .github/workflows/daily-issues-report.lock.yml | 8 ++++++++ .github/workflows/daily-malicious-code-scan.lock.yml | 10 ++++++++++ .../workflows/daily-multi-device-docs-tester.lock.yml | 10 ++++++++++ .github/workflows/daily-news.lock.yml | 10 ++++++++++ .github/workflows/daily-performance-summary.lock.yml | 8 ++++++++ .github/workflows/daily-repo-chronicle.lock.yml | 10 ++++++++++ .github/workflows/daily-team-status.lock.yml | 10 ++++++++++ .github/workflows/daily-workflow-updater.lock.yml | 10 ++++++++++ .github/workflows/deep-report.lock.yml | 8 ++++++++ .github/workflows/dependabot-go-checker.lock.yml | 10 ++++++++++ .github/workflows/dev-hawk.lock.yml | 10 ++++++++++ .github/workflows/dev.lock.yml | 10 ++++++++++ .github/workflows/developer-docs-consolidator.lock.yml | 10 ++++++++++ .github/workflows/dictation-prompt.lock.yml | 10 ++++++++++ .github/workflows/docs-noob-tester.lock.yml | 10 ++++++++++ ...ocs-quality-maintenance-project67.campaign.lock.yml | 10 ++++++++++ .github/workflows/duplicate-code-detector.lock.yml | 8 ++++++++ .../workflows/example-custom-error-patterns.lock.yml | 10 ++++++++++ .github/workflows/example-permissions-warning.lock.yml | 10 ++++++++++ .github/workflows/example-workflow-analyzer.lock.yml | 10 ++++++++++ .github/workflows/firewall-escape.lock.yml | 10 ++++++++++ .github/workflows/firewall.lock.yml | 10 ++++++++++ .../workflows/github-mcp-structural-analysis.lock.yml | 10 ++++++++++ .github/workflows/github-mcp-tools-report.lock.yml | 9 +++++++++ .github/workflows/glossary-maintainer.lock.yml | 10 ++++++++++ .github/workflows/go-fan.lock.yml | 10 ++++++++++ .../go-file-size-reduction-project64.campaign.lock.yml | 10 ++++++++++ .github/workflows/go-logger.lock.yml | 10 ++++++++++ .github/workflows/go-pattern-detector.lock.yml | 10 ++++++++++ .github/workflows/grumpy-reviewer.lock.yml | 10 ++++++++++ .github/workflows/hourly-ci-cleaner.lock.yml | 10 ++++++++++ .github/workflows/human-ai-collaboration.lock.yml | 10 ++++++++++ .github/workflows/incident-response.lock.yml | 10 ++++++++++ .github/workflows/instructions-janitor.lock.yml | 10 ++++++++++ .github/workflows/intelligence.lock.yml | 10 ++++++++++ .github/workflows/issue-arborist.lock.yml | 8 ++++++++ .github/workflows/issue-classifier.lock.yml | 10 ++++++++++ .github/workflows/issue-monster.lock.yml | 10 ++++++++++ .github/workflows/issue-template-optimizer.lock.yml | 10 ++++++++++ .github/workflows/issue-triage-agent.lock.yml | 10 ++++++++++ .github/workflows/jsweep.lock.yml | 10 ++++++++++ .github/workflows/layout-spec-maintainer.lock.yml | 10 ++++++++++ .github/workflows/lockfile-stats.lock.yml | 10 ++++++++++ .github/workflows/mcp-inspector.lock.yml | 10 ++++++++++ .github/workflows/mergefest.lock.yml | 10 ++++++++++ .github/workflows/metrics-collector.lock.yml | 9 +++++++++ .github/workflows/notion-issue-summary.lock.yml | 10 ++++++++++ .github/workflows/org-wide-rollout.lock.yml | 10 ++++++++++ .github/workflows/pdf-summary.lock.yml | 10 ++++++++++ .github/workflows/plan.lock.yml | 10 ++++++++++ .../playground-org-project-update-issue.lock.yml | 1 + .../workflows/playground-snapshots-refresh.lock.yml | 10 ++++++++++ .github/workflows/poem-bot.lock.yml | 10 ++++++++++ .github/workflows/portfolio-analyst.lock.yml | 10 ++++++++++ .github/workflows/pr-nitpick-reviewer.lock.yml | 10 ++++++++++ .github/workflows/prompt-clustering-analysis.lock.yml | 10 ++++++++++ .github/workflows/python-data-charts.lock.yml | 10 ++++++++++ .github/workflows/q.lock.yml | 10 ++++++++++ .github/workflows/release.lock.yml | 10 ++++++++++ .github/workflows/repo-tree-map.lock.yml | 10 ++++++++++ .github/workflows/repository-quality-improver.lock.yml | 10 ++++++++++ .github/workflows/research.lock.yml | 10 ++++++++++ .github/workflows/safe-output-health.lock.yml | 10 ++++++++++ .github/workflows/schema-consistency-checker.lock.yml | 9 +++++++++ .github/workflows/scout.lock.yml | 10 ++++++++++ .github/workflows/security-compliance.lock.yml | 10 ++++++++++ .github/workflows/security-fix-pr.lock.yml | 10 ++++++++++ .github/workflows/semantic-function-refactor.lock.yml | 10 ++++++++++ .github/workflows/slide-deck-maintainer.lock.yml | 10 ++++++++++ .github/workflows/smoke-claude.lock.yml | 10 ++++++++++ .github/workflows/smoke-codex-firewall.lock.yml | 8 ++++++++ .github/workflows/smoke-codex.lock.yml | 8 ++++++++ .github/workflows/smoke-copilot-no-firewall.lock.yml | 10 ++++++++++ .github/workflows/smoke-copilot-playwright.lock.yml | 10 ++++++++++ .github/workflows/smoke-copilot.lock.yml | 10 ++++++++++ .github/workflows/smoke-detector.lock.yml | 10 ++++++++++ .github/workflows/smoke-srt-custom-config.lock.yml | 10 ++++++++++ .github/workflows/smoke-srt.lock.yml | 10 ++++++++++ .github/workflows/spec-kit-execute.lock.yml | 9 +++++++++ .github/workflows/spec-kit-executor.lock.yml | 10 ++++++++++ .github/workflows/speckit-dispatcher.lock.yml | 10 ++++++++++ .github/workflows/static-analysis-report.lock.yml | 10 ++++++++++ .github/workflows/sub-issue-closer.lock.yml | 10 ++++++++++ .github/workflows/super-linter.lock.yml | 10 ++++++++++ .github/workflows/technical-doc-writer.lock.yml | 10 ++++++++++ .github/workflows/terminal-stylist.lock.yml | 10 ++++++++++ .github/workflows/tidy.lock.yml | 10 ++++++++++ .github/workflows/typist.lock.yml | 10 ++++++++++ .github/workflows/unbloat-docs.lock.yml | 10 ++++++++++ .github/workflows/video-analyzer.lock.yml | 10 ++++++++++ .github/workflows/weekly-issue-summary.lock.yml | 10 ++++++++++ .github/workflows/workflow-generator.lock.yml | 10 ++++++++++ .github/workflows/workflow-health-manager.lock.yml | 10 ++++++++++ 124 files changed, 1208 insertions(+) diff --git a/.github/workflows/agent-performance-analyzer.lock.yml b/.github/workflows/agent-performance-analyzer.lock.yml index 879edffbd8..28e48e9636 100644 --- a/.github/workflows/agent-performance-analyzer.lock.yml +++ b/.github/workflows/agent-performance-analyzer.lock.yml @@ -166,6 +166,14 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Install gh-aw extension @@ -465,6 +473,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests,actions", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/ai-moderator.lock.yml b/.github/workflows/ai-moderator.lock.yml index 1a9d2cc689..0d94e1a7f8 100644 --- a/.github/workflows/ai-moderator.lock.yml +++ b/.github/workflows/ai-moderator.lock.yml @@ -171,6 +171,14 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -353,6 +361,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/archie.lock.yml b/.github/workflows/archie.lock.yml index b476ab4540..02261e762d 100644 --- a/.github/workflows/archie.lock.yml +++ b/.github/workflows/archie.lock.yml @@ -209,6 +209,14 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -360,6 +368,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/artifacts-summary.lock.yml b/.github/workflows/artifacts-summary.lock.yml index 279dd457bc..8c93bd7c65 100644 --- a/.github/workflows/artifacts-summary.lock.yml +++ b/.github/workflows/artifacts-summary.lock.yml @@ -154,6 +154,14 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -321,6 +329,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=actions,repos", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/audit-workflows.lock.yml b/.github/workflows/audit-workflows.lock.yml index 66c245043c..23d80f9d7d 100644 --- a/.github/workflows/audit-workflows.lock.yml +++ b/.github/workflows/audit-workflows.lock.yml @@ -223,6 +223,14 @@ jobs: awf --version - name: Install Claude Code CLI run: npm install -g --silent @anthropic-ai/claude-code@2.0.76 + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -421,6 +429,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/blog-auditor.lock.yml b/.github/workflows/blog-auditor.lock.yml index 4eaac30861..dd6de7fe68 100644 --- a/.github/workflows/blog-auditor.lock.yml +++ b/.github/workflows/blog-auditor.lock.yml @@ -150,6 +150,14 @@ jobs: awf --version - name: Install Claude Code CLI run: npm install -g --silent @anthropic-ai/claude-code@2.0.76 + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 mcr.microsoft.com/playwright/mcp - name: Write Safe Outputs Config @@ -315,6 +323,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/brave.lock.yml b/.github/workflows/brave.lock.yml index 05b8d02efc..27b9a34075 100644 --- a/.github/workflows/brave.lock.yml +++ b/.github/workflows/brave.lock.yml @@ -187,6 +187,14 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh docker.io/mcp/brave-search ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -356,6 +364,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/breaking-change-checker.lock.yml b/.github/workflows/breaking-change-checker.lock.yml index 37c6e37230..e0c89e2857 100644 --- a/.github/workflows/breaking-change-checker.lock.yml +++ b/.github/workflows/breaking-change-checker.lock.yml @@ -151,6 +151,14 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -339,6 +347,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=repos", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/campaign-generator.lock.yml b/.github/workflows/campaign-generator.lock.yml index cc73c365d5..3140a2c47b 100644 --- a/.github/workflows/campaign-generator.lock.yml +++ b/.github/workflows/campaign-generator.lock.yml @@ -166,6 +166,14 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -378,6 +386,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/campaign-manager.lock.yml b/.github/workflows/campaign-manager.lock.yml index 1044e5dd73..dac0ae6190 100644 --- a/.github/workflows/campaign-manager.lock.yml +++ b/.github/workflows/campaign-manager.lock.yml @@ -166,6 +166,14 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Write Safe Outputs Config run: | mkdir -p /tmp/gh-aw/safeoutputs @@ -522,6 +530,7 @@ jobs: "url": "https://api.githubcopilot.com/mcp/", "headers": { "Authorization": "Bearer \${GITHUB_PERSONAL_ACCESS_TOKEN}", + "X-MCP-Lockdown": "${{ steps.determine-automatic-lockdown.outputs.lockdown }}", "X-MCP-Readonly": "true", "X-MCP-Toolsets": "context,repos,issues,pull_requests,actions,projects" }, diff --git a/.github/workflows/changeset.lock.yml b/.github/workflows/changeset.lock.yml index 6dc71486e8..ab0c72b863 100644 --- a/.github/workflows/changeset.lock.yml +++ b/.github/workflows/changeset.lock.yml @@ -191,6 +191,14 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config diff --git a/.github/workflows/ci-coach.lock.yml b/.github/workflows/ci-coach.lock.yml index 24f6b3df37..9c9c79a769 100644 --- a/.github/workflows/ci-coach.lock.yml +++ b/.github/workflows/ci-coach.lock.yml @@ -207,6 +207,14 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -384,6 +392,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/ci-doctor.lock.yml b/.github/workflows/ci-doctor.lock.yml index daeb654fe0..193dd22aac 100644 --- a/.github/workflows/ci-doctor.lock.yml +++ b/.github/workflows/ci-doctor.lock.yml @@ -179,6 +179,14 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 mcp/fetch - name: Write Safe Outputs Config @@ -403,6 +411,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/cli-consistency-checker.lock.yml b/.github/workflows/cli-consistency-checker.lock.yml index 310808a8a4..4ba6921e01 100644 --- a/.github/workflows/cli-consistency-checker.lock.yml +++ b/.github/workflows/cli-consistency-checker.lock.yml @@ -152,6 +152,14 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 mcp/fetch - name: Write Safe Outputs Config @@ -340,6 +348,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/cli-version-checker.lock.yml b/.github/workflows/cli-version-checker.lock.yml index 03d0c57c5e..65e1aae92d 100644 --- a/.github/workflows/cli-version-checker.lock.yml +++ b/.github/workflows/cli-version-checker.lock.yml @@ -164,6 +164,14 @@ jobs: awf --version - name: Install Claude Code CLI run: npm install -g --silent @anthropic-ai/claude-code@2.0.76 + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -350,6 +358,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/cloclo.lock.yml b/.github/workflows/cloclo.lock.yml index c408c44bea..5d75545aa1 100644 --- a/.github/workflows/cloclo.lock.yml +++ b/.github/workflows/cloclo.lock.yml @@ -257,6 +257,14 @@ jobs: awf --version - name: Install Claude Code CLI run: npm install -g --silent @anthropic-ai/claude-code@2.0.76 + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 mcr.microsoft.com/playwright/mcp - name: Write Safe Outputs Config @@ -472,6 +480,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/commit-changes-analyzer.lock.yml b/.github/workflows/commit-changes-analyzer.lock.yml index 3512b6bc66..334a756dd4 100644 --- a/.github/workflows/commit-changes-analyzer.lock.yml +++ b/.github/workflows/commit-changes-analyzer.lock.yml @@ -152,6 +152,14 @@ jobs: awf --version - name: Install Claude Code CLI run: npm install -g --silent @anthropic-ai/claude-code@2.0.76 + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -317,6 +325,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/copilot-agent-analysis.lock.yml b/.github/workflows/copilot-agent-analysis.lock.yml index e3a811cb6b..ec669fa7b2 100644 --- a/.github/workflows/copilot-agent-analysis.lock.yml +++ b/.github/workflows/copilot-agent-analysis.lock.yml @@ -183,6 +183,14 @@ jobs: awf --version - name: Install Claude Code CLI run: npm install -g --silent @anthropic-ai/claude-code@2.0.76 + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -348,6 +356,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/copilot-pr-nlp-analysis.lock.yml b/.github/workflows/copilot-pr-nlp-analysis.lock.yml index d6a500e3ff..53b5993a26 100644 --- a/.github/workflows/copilot-pr-nlp-analysis.lock.yml +++ b/.github/workflows/copilot-pr-nlp-analysis.lock.yml @@ -220,6 +220,14 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -416,6 +424,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/copilot-pr-prompt-analysis.lock.yml b/.github/workflows/copilot-pr-prompt-analysis.lock.yml index 2f596dbc99..adc333460e 100644 --- a/.github/workflows/copilot-pr-prompt-analysis.lock.yml +++ b/.github/workflows/copilot-pr-prompt-analysis.lock.yml @@ -188,6 +188,14 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -355,6 +363,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/copilot-session-insights.lock.yml b/.github/workflows/copilot-session-insights.lock.yml index ff12c05a70..a0741144b2 100644 --- a/.github/workflows/copilot-session-insights.lock.yml +++ b/.github/workflows/copilot-session-insights.lock.yml @@ -209,6 +209,14 @@ jobs: awf --version - name: Install Claude Code CLI run: npm install -g --silent @anthropic-ai/claude-code@2.0.76 + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -403,6 +411,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/craft.lock.yml b/.github/workflows/craft.lock.yml index cf7e688698..b86523d99d 100644 --- a/.github/workflows/craft.lock.yml +++ b/.github/workflows/craft.lock.yml @@ -188,6 +188,14 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -387,6 +395,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/daily-assign-issue-to-user.lock.yml b/.github/workflows/daily-assign-issue-to-user.lock.yml index 1bf67fb2d5..b690b5acb1 100644 --- a/.github/workflows/daily-assign-issue-to-user.lock.yml +++ b/.github/workflows/daily-assign-issue-to-user.lock.yml @@ -150,6 +150,14 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -350,6 +358,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=issues,pull_requests,repos", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/daily-choice-test.lock.yml b/.github/workflows/daily-choice-test.lock.yml index 598eaf1008..7205aa7312 100644 --- a/.github/workflows/daily-choice-test.lock.yml +++ b/.github/workflows/daily-choice-test.lock.yml @@ -143,6 +143,14 @@ jobs: awf --version - name: Install Claude Code CLI run: npm install -g --silent @anthropic-ai/claude-code@2.0.76 + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -287,6 +295,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/daily-cli-performance.lock.yml b/.github/workflows/daily-cli-performance.lock.yml index 23a7017a94..ac60fc6a03 100644 --- a/.github/workflows/daily-cli-performance.lock.yml +++ b/.github/workflows/daily-cli-performance.lock.yml @@ -164,6 +164,14 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -388,6 +396,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/daily-code-metrics.lock.yml b/.github/workflows/daily-code-metrics.lock.yml index ed5366d5b1..5ce9c7bd3d 100644 --- a/.github/workflows/daily-code-metrics.lock.yml +++ b/.github/workflows/daily-code-metrics.lock.yml @@ -198,6 +198,14 @@ jobs: awf --version - name: Install Claude Code CLI run: npm install -g --silent @anthropic-ai/claude-code@2.0.76 + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -392,6 +400,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/daily-copilot-token-report.lock.yml b/.github/workflows/daily-copilot-token-report.lock.yml index 015fe2efec..9c7f6d3ab9 100644 --- a/.github/workflows/daily-copilot-token-report.lock.yml +++ b/.github/workflows/daily-copilot-token-report.lock.yml @@ -218,6 +218,14 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -414,6 +422,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/daily-doc-updater.lock.yml b/.github/workflows/daily-doc-updater.lock.yml index ca80fad12d..a64ff60fed 100644 --- a/.github/workflows/daily-doc-updater.lock.yml +++ b/.github/workflows/daily-doc-updater.lock.yml @@ -157,6 +157,14 @@ jobs: awf --version - name: Install Claude Code CLI run: npm install -g --silent @anthropic-ai/claude-code@2.0.76 + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -332,6 +340,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/daily-fact.lock.yml b/.github/workflows/daily-fact.lock.yml index 2707568422..8937cce110 100644 --- a/.github/workflows/daily-fact.lock.yml +++ b/.github/workflows/daily-fact.lock.yml @@ -137,6 +137,14 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config diff --git a/.github/workflows/daily-file-diet.lock.yml b/.github/workflows/daily-file-diet.lock.yml index d0e082a562..6b7cea8cb6 100644 --- a/.github/workflows/daily-file-diet.lock.yml +++ b/.github/workflows/daily-file-diet.lock.yml @@ -218,6 +218,14 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -435,6 +443,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/daily-firewall-report.lock.yml b/.github/workflows/daily-firewall-report.lock.yml index 89853799a2..14c51d0710 100644 --- a/.github/workflows/daily-firewall-report.lock.yml +++ b/.github/workflows/daily-firewall-report.lock.yml @@ -221,6 +221,14 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -434,6 +442,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests,actions", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/daily-issues-report.lock.yml b/.github/workflows/daily-issues-report.lock.yml index a5e28c42b2..e330e66e8a 100644 --- a/.github/workflows/daily-issues-report.lock.yml +++ b/.github/workflows/daily-issues-report.lock.yml @@ -204,6 +204,14 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config diff --git a/.github/workflows/daily-malicious-code-scan.lock.yml b/.github/workflows/daily-malicious-code-scan.lock.yml index 3b17064fea..ed58d3a48d 100644 --- a/.github/workflows/daily-malicious-code-scan.lock.yml +++ b/.github/workflows/daily-malicious-code-scan.lock.yml @@ -151,6 +151,14 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -359,6 +367,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=repos,code_security", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/daily-multi-device-docs-tester.lock.yml b/.github/workflows/daily-multi-device-docs-tester.lock.yml index b4f2709b24..5069f030af 100644 --- a/.github/workflows/daily-multi-device-docs-tester.lock.yml +++ b/.github/workflows/daily-multi-device-docs-tester.lock.yml @@ -154,6 +154,14 @@ jobs: awf --version - name: Install Claude Code CLI run: npm install -g --silent @anthropic-ai/claude-code@2.0.76 + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 mcr.microsoft.com/playwright/mcp - name: Write Safe Outputs Config @@ -369,6 +377,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/daily-news.lock.yml b/.github/workflows/daily-news.lock.yml index 64be36d712..1bd711bcf8 100644 --- a/.github/workflows/daily-news.lock.yml +++ b/.github/workflows/daily-news.lock.yml @@ -216,6 +216,14 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 mcp/fetch - name: Write Safe Outputs Config @@ -412,6 +420,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/daily-performance-summary.lock.yml b/.github/workflows/daily-performance-summary.lock.yml index 3112a72ae2..63e2dec8bf 100644 --- a/.github/workflows/daily-performance-summary.lock.yml +++ b/.github/workflows/daily-performance-summary.lock.yml @@ -194,6 +194,14 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config diff --git a/.github/workflows/daily-repo-chronicle.lock.yml b/.github/workflows/daily-repo-chronicle.lock.yml index e37330451d..ff0473929b 100644 --- a/.github/workflows/daily-repo-chronicle.lock.yml +++ b/.github/workflows/daily-repo-chronicle.lock.yml @@ -195,6 +195,14 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -391,6 +399,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests,discussions", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/daily-team-status.lock.yml b/.github/workflows/daily-team-status.lock.yml index 7694eaadb8..0d26cead69 100644 --- a/.github/workflows/daily-team-status.lock.yml +++ b/.github/workflows/daily-team-status.lock.yml @@ -164,6 +164,14 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -352,6 +360,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/daily-workflow-updater.lock.yml b/.github/workflows/daily-workflow-updater.lock.yml index 5daef56ef5..b06325f891 100644 --- a/.github/workflows/daily-workflow-updater.lock.yml +++ b/.github/workflows/daily-workflow-updater.lock.yml @@ -151,6 +151,14 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -328,6 +336,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/deep-report.lock.yml b/.github/workflows/deep-report.lock.yml index 4bc9d64757..7ef1feb144 100644 --- a/.github/workflows/deep-report.lock.yml +++ b/.github/workflows/deep-report.lock.yml @@ -205,6 +205,14 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config diff --git a/.github/workflows/dependabot-go-checker.lock.yml b/.github/workflows/dependabot-go-checker.lock.yml index aed4babd1f..affe20e73a 100644 --- a/.github/workflows/dependabot-go-checker.lock.yml +++ b/.github/workflows/dependabot-go-checker.lock.yml @@ -154,6 +154,14 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 mcp/fetch - name: Write Safe Outputs Config @@ -380,6 +388,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests,dependabot", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/dev-hawk.lock.yml b/.github/workflows/dev-hawk.lock.yml index 8029d8f25c..e110a1c88f 100644 --- a/.github/workflows/dev-hawk.lock.yml +++ b/.github/workflows/dev-hawk.lock.yml @@ -181,6 +181,14 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -349,6 +357,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=pull_requests,actions,repos", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/dev.lock.yml b/.github/workflows/dev.lock.yml index 94d5c7c40f..625409cd04 100644 --- a/.github/workflows/dev.lock.yml +++ b/.github/workflows/dev.lock.yml @@ -151,6 +151,14 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -302,6 +310,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=issues", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/developer-docs-consolidator.lock.yml b/.github/workflows/developer-docs-consolidator.lock.yml index 7c89bad533..c3336c60a3 100644 --- a/.github/workflows/developer-docs-consolidator.lock.yml +++ b/.github/workflows/developer-docs-consolidator.lock.yml @@ -176,6 +176,14 @@ jobs: awf --version - name: Install Claude Code CLI run: npm install -g --silent @anthropic-ai/claude-code@2.0.76 + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -403,6 +411,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/dictation-prompt.lock.yml b/.github/workflows/dictation-prompt.lock.yml index c38d1948d7..2f61778085 100644 --- a/.github/workflows/dictation-prompt.lock.yml +++ b/.github/workflows/dictation-prompt.lock.yml @@ -154,6 +154,14 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -331,6 +339,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/docs-noob-tester.lock.yml b/.github/workflows/docs-noob-tester.lock.yml index 28c45b5e33..4351cd6947 100644 --- a/.github/workflows/docs-noob-tester.lock.yml +++ b/.github/workflows/docs-noob-tester.lock.yml @@ -154,6 +154,14 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 mcr.microsoft.com/playwright/mcp - name: Write Safe Outputs Config @@ -350,6 +358,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/docs-quality-maintenance-project67.campaign.lock.yml b/.github/workflows/docs-quality-maintenance-project67.campaign.lock.yml index 227b4046d1..459b36879c 100644 --- a/.github/workflows/docs-quality-maintenance-project67.campaign.lock.yml +++ b/.github/workflows/docs-quality-maintenance-project67.campaign.lock.yml @@ -164,6 +164,14 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -404,6 +412,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests,actions,code_security", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/duplicate-code-detector.lock.yml b/.github/workflows/duplicate-code-detector.lock.yml index f2ed42529d..5984ef408a 100644 --- a/.github/workflows/duplicate-code-detector.lock.yml +++ b/.github/workflows/duplicate-code-detector.lock.yml @@ -158,6 +158,14 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config diff --git a/.github/workflows/example-custom-error-patterns.lock.yml b/.github/workflows/example-custom-error-patterns.lock.yml index bd241a394d..ea4b416967 100644 --- a/.github/workflows/example-custom-error-patterns.lock.yml +++ b/.github/workflows/example-custom-error-patterns.lock.yml @@ -137,6 +137,14 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Setup MCPs @@ -160,6 +168,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/example-permissions-warning.lock.yml b/.github/workflows/example-permissions-warning.lock.yml index 47db6a10cb..46047bca0a 100644 --- a/.github/workflows/example-permissions-warning.lock.yml +++ b/.github/workflows/example-permissions-warning.lock.yml @@ -140,6 +140,14 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Setup MCPs @@ -161,6 +169,8 @@ jobs: "-e", "GITHUB_PERSONAL_ACCESS_TOKEN", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/example-workflow-analyzer.lock.yml b/.github/workflows/example-workflow-analyzer.lock.yml index c905a64de6..d661e540a2 100644 --- a/.github/workflows/example-workflow-analyzer.lock.yml +++ b/.github/workflows/example-workflow-analyzer.lock.yml @@ -152,6 +152,14 @@ jobs: awf --version - name: Install Claude Code CLI run: npm install -g --silent @anthropic-ai/claude-code@2.0.76 + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Install gh-aw extension @@ -338,6 +346,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests,actions", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/firewall-escape.lock.yml b/.github/workflows/firewall-escape.lock.yml index c299c14b62..39f855b033 100644 --- a/.github/workflows/firewall-escape.lock.yml +++ b/.github/workflows/firewall-escape.lock.yml @@ -164,6 +164,14 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 mcp/fetch - name: Setup MCPs @@ -187,6 +195,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/firewall.lock.yml b/.github/workflows/firewall.lock.yml index 66e1377353..476ef67454 100644 --- a/.github/workflows/firewall.lock.yml +++ b/.github/workflows/firewall.lock.yml @@ -140,6 +140,14 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 mcp/fetch - name: Setup MCPs @@ -163,6 +171,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/github-mcp-structural-analysis.lock.yml b/.github/workflows/github-mcp-structural-analysis.lock.yml index 07a70546c7..38d790c4ab 100644 --- a/.github/workflows/github-mcp-structural-analysis.lock.yml +++ b/.github/workflows/github-mcp-structural-analysis.lock.yml @@ -193,6 +193,14 @@ jobs: awf --version - name: Install Claude Code CLI run: npm install -g --silent @anthropic-ai/claude-code@2.0.76 + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -387,6 +395,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=all", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/github-mcp-tools-report.lock.yml b/.github/workflows/github-mcp-tools-report.lock.yml index 3e9178c7a4..18618b5eaf 100644 --- a/.github/workflows/github-mcp-tools-report.lock.yml +++ b/.github/workflows/github-mcp-tools-report.lock.yml @@ -167,6 +167,14 @@ jobs: awf --version - name: Install Claude Code CLI run: npm install -g --silent @anthropic-ai/claude-code@2.0.76 + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Write Safe Outputs Config run: | mkdir -p /tmp/gh-aw/safeoutputs @@ -386,6 +394,7 @@ jobs: "url": "https://api.githubcopilot.com/mcp/", "headers": { "Authorization": "Bearer $GITHUB_MCP_SERVER_TOKEN", + "X-MCP-Lockdown": "${{ steps.determine-automatic-lockdown.outputs.lockdown }}", "X-MCP-Readonly": "true", "X-MCP-Toolsets": "all" } diff --git a/.github/workflows/glossary-maintainer.lock.yml b/.github/workflows/glossary-maintainer.lock.yml index aa988d223d..525ad8dd90 100644 --- a/.github/workflows/glossary-maintainer.lock.yml +++ b/.github/workflows/glossary-maintainer.lock.yml @@ -180,6 +180,14 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -357,6 +365,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/go-fan.lock.yml b/.github/workflows/go-fan.lock.yml index 39131e7a3a..7280c5a9f0 100644 --- a/.github/workflows/go-fan.lock.yml +++ b/.github/workflows/go-fan.lock.yml @@ -174,6 +174,14 @@ jobs: awf --version - name: Install Claude Code CLI run: npm install -g --silent @anthropic-ai/claude-code@2.0.76 + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -339,6 +347,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/go-file-size-reduction-project64.campaign.lock.yml b/.github/workflows/go-file-size-reduction-project64.campaign.lock.yml index 0d3586e36e..a0e66832b4 100644 --- a/.github/workflows/go-file-size-reduction-project64.campaign.lock.yml +++ b/.github/workflows/go-file-size-reduction-project64.campaign.lock.yml @@ -164,6 +164,14 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -404,6 +412,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests,actions,code_security", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/go-logger.lock.yml b/.github/workflows/go-logger.lock.yml index 175379368d..78e8403837 100644 --- a/.github/workflows/go-logger.lock.yml +++ b/.github/workflows/go-logger.lock.yml @@ -173,6 +173,14 @@ jobs: awf --version - name: Install Claude Code CLI run: npm install -g --silent @anthropic-ai/claude-code@2.0.76 + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -348,6 +356,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/go-pattern-detector.lock.yml b/.github/workflows/go-pattern-detector.lock.yml index 4d7afc81b0..50a0d5ac0d 100644 --- a/.github/workflows/go-pattern-detector.lock.yml +++ b/.github/workflows/go-pattern-detector.lock.yml @@ -152,6 +152,14 @@ jobs: awf --version - name: Install Claude Code CLI run: npm install -g --silent @anthropic-ai/claude-code@2.0.76 + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 mcp/ast-grep:latest - name: Write Safe Outputs Config @@ -348,6 +356,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/grumpy-reviewer.lock.yml b/.github/workflows/grumpy-reviewer.lock.yml index 2a2ed4de9a..f447eda801 100644 --- a/.github/workflows/grumpy-reviewer.lock.yml +++ b/.github/workflows/grumpy-reviewer.lock.yml @@ -197,6 +197,14 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -423,6 +431,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=pull_requests,repos", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/hourly-ci-cleaner.lock.yml b/.github/workflows/hourly-ci-cleaner.lock.yml index c55a784c37..24a5c33a03 100644 --- a/.github/workflows/hourly-ci-cleaner.lock.yml +++ b/.github/workflows/hourly-ci-cleaner.lock.yml @@ -181,6 +181,14 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -358,6 +366,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/human-ai-collaboration.lock.yml b/.github/workflows/human-ai-collaboration.lock.yml index 660d3d7542..dbbce3b1f4 100644 --- a/.github/workflows/human-ai-collaboration.lock.yml +++ b/.github/workflows/human-ai-collaboration.lock.yml @@ -160,6 +160,14 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -348,6 +356,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=repos,issues,search", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/incident-response.lock.yml b/.github/workflows/incident-response.lock.yml index 6811420e9a..8b3d4709f9 100644 --- a/.github/workflows/incident-response.lock.yml +++ b/.github/workflows/incident-response.lock.yml @@ -175,6 +175,14 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -500,6 +508,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=repos,issues,pull_requests,search", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/instructions-janitor.lock.yml b/.github/workflows/instructions-janitor.lock.yml index 2e0d9e8408..89ecf25494 100644 --- a/.github/workflows/instructions-janitor.lock.yml +++ b/.github/workflows/instructions-janitor.lock.yml @@ -157,6 +157,14 @@ jobs: awf --version - name: Install Claude Code CLI run: npm install -g --silent @anthropic-ai/claude-code@2.0.76 + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -332,6 +340,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/intelligence.lock.yml b/.github/workflows/intelligence.lock.yml index 19f9cb34a0..357ed38ca0 100644 --- a/.github/workflows/intelligence.lock.yml +++ b/.github/workflows/intelligence.lock.yml @@ -210,6 +210,14 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -427,6 +435,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=repos,issues,search", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/issue-arborist.lock.yml b/.github/workflows/issue-arborist.lock.yml index 5130de8fa6..d39405b7ee 100644 --- a/.github/workflows/issue-arborist.lock.yml +++ b/.github/workflows/issue-arborist.lock.yml @@ -156,6 +156,14 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config diff --git a/.github/workflows/issue-classifier.lock.yml b/.github/workflows/issue-classifier.lock.yml index 932e429fa1..eccd353835 100644 --- a/.github/workflows/issue-classifier.lock.yml +++ b/.github/workflows/issue-classifier.lock.yml @@ -159,6 +159,14 @@ jobs: setupGlobals(core, github, context, exec, io); const { main } = require('/tmp/gh-aw/actions/checkout_pr_branch.cjs'); await main(); + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -311,6 +319,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/issue-monster.lock.yml b/.github/workflows/issue-monster.lock.yml index bfe39d3ef9..131809c93f 100644 --- a/.github/workflows/issue-monster.lock.yml +++ b/.github/workflows/issue-monster.lock.yml @@ -161,6 +161,14 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -350,6 +358,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/issue-template-optimizer.lock.yml b/.github/workflows/issue-template-optimizer.lock.yml index fbc5389228..19783c1868 100644 --- a/.github/workflows/issue-template-optimizer.lock.yml +++ b/.github/workflows/issue-template-optimizer.lock.yml @@ -163,6 +163,14 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -340,6 +348,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/issue-triage-agent.lock.yml b/.github/workflows/issue-triage-agent.lock.yml index 8f366dac28..4b465bf06f 100644 --- a/.github/workflows/issue-triage-agent.lock.yml +++ b/.github/workflows/issue-triage-agent.lock.yml @@ -129,6 +129,14 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -319,6 +327,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=issues,labels", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/jsweep.lock.yml b/.github/workflows/jsweep.lock.yml index e6d35f0cb4..d3bbee5e36 100644 --- a/.github/workflows/jsweep.lock.yml +++ b/.github/workflows/jsweep.lock.yml @@ -177,6 +177,14 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -354,6 +362,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/layout-spec-maintainer.lock.yml b/.github/workflows/layout-spec-maintainer.lock.yml index d989737f14..2ade2a98a6 100644 --- a/.github/workflows/layout-spec-maintainer.lock.yml +++ b/.github/workflows/layout-spec-maintainer.lock.yml @@ -153,6 +153,14 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -330,6 +338,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/lockfile-stats.lock.yml b/.github/workflows/lockfile-stats.lock.yml index d1f02216c9..3a8f90eea1 100644 --- a/.github/workflows/lockfile-stats.lock.yml +++ b/.github/workflows/lockfile-stats.lock.yml @@ -161,6 +161,14 @@ jobs: awf --version - name: Install Claude Code CLI run: npm install -g --silent @anthropic-ai/claude-code@2.0.76 + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -326,6 +334,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/mcp-inspector.lock.yml b/.github/workflows/mcp-inspector.lock.yml index 6ddee84039..e777c1526f 100644 --- a/.github/workflows/mcp-inspector.lock.yml +++ b/.github/workflows/mcp-inspector.lock.yml @@ -213,6 +213,14 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh docker.io/mcp/brave-search ghcr.io/github/github-mcp-server:v0.26.3 mcp/arxiv-mcp-server mcp/ast-grep:latest mcp/context7 mcp/memory mcp/notion - name: Write Safe Outputs Config @@ -542,6 +550,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/mergefest.lock.yml b/.github/workflows/mergefest.lock.yml index 3c6b744c42..24f824671d 100644 --- a/.github/workflows/mergefest.lock.yml +++ b/.github/workflows/mergefest.lock.yml @@ -175,6 +175,14 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -338,6 +346,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=pull_requests,repos", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/metrics-collector.lock.yml b/.github/workflows/metrics-collector.lock.yml index d32aea3a79..ff328b9f11 100644 --- a/.github/workflows/metrics-collector.lock.yml +++ b/.github/workflows/metrics-collector.lock.yml @@ -158,6 +158,14 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Install gh-aw extension env: GH_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} @@ -195,6 +203,7 @@ jobs: "url": "https://api.githubcopilot.com/mcp/", "headers": { "Authorization": "Bearer \${GITHUB_PERSONAL_ACCESS_TOKEN}", + "X-MCP-Lockdown": "${{ steps.determine-automatic-lockdown.outputs.lockdown }}", "X-MCP-Readonly": "true", "X-MCP-Toolsets": "context,repos,issues,pull_requests" }, diff --git a/.github/workflows/notion-issue-summary.lock.yml b/.github/workflows/notion-issue-summary.lock.yml index f00f329695..aeb3d7378d 100644 --- a/.github/workflows/notion-issue-summary.lock.yml +++ b/.github/workflows/notion-issue-summary.lock.yml @@ -157,6 +157,14 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 mcp/notion - name: Write Safe Outputs Config @@ -289,6 +297,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/org-wide-rollout.lock.yml b/.github/workflows/org-wide-rollout.lock.yml index 1c8934baa1..206195a6f1 100644 --- a/.github/workflows/org-wide-rollout.lock.yml +++ b/.github/workflows/org-wide-rollout.lock.yml @@ -182,6 +182,14 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -507,6 +515,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=repos,issues,pull_requests,search", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/pdf-summary.lock.yml b/.github/workflows/pdf-summary.lock.yml index 9914bc6a81..dc3d80b0bb 100644 --- a/.github/workflows/pdf-summary.lock.yml +++ b/.github/workflows/pdf-summary.lock.yml @@ -223,6 +223,14 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -374,6 +382,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/plan.lock.yml b/.github/workflows/plan.lock.yml index 57c0195093..4c27f1f342 100644 --- a/.github/workflows/plan.lock.yml +++ b/.github/workflows/plan.lock.yml @@ -188,6 +188,14 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -433,6 +441,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests,discussions", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/playground-org-project-update-issue.lock.yml b/.github/workflows/playground-org-project-update-issue.lock.yml index e31c44a342..f540cea07a 100644 --- a/.github/workflows/playground-org-project-update-issue.lock.yml +++ b/.github/workflows/playground-org-project-update-issue.lock.yml @@ -150,6 +150,7 @@ jobs: awf --version - name: Determine automatic lockdown mode for GitHub MCP server id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 with: script: | diff --git a/.github/workflows/playground-snapshots-refresh.lock.yml b/.github/workflows/playground-snapshots-refresh.lock.yml index f79a9c8075..e89508bbc5 100644 --- a/.github/workflows/playground-snapshots-refresh.lock.yml +++ b/.github/workflows/playground-snapshots-refresh.lock.yml @@ -166,6 +166,14 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -343,6 +351,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/poem-bot.lock.yml b/.github/workflows/poem-bot.lock.yml index 0dc75f31c8..e7e7884d76 100644 --- a/.github/workflows/poem-bot.lock.yml +++ b/.github/workflows/poem-bot.lock.yml @@ -205,6 +205,14 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -887,6 +895,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/portfolio-analyst.lock.yml b/.github/workflows/portfolio-analyst.lock.yml index 40a2020548..7a6aeb07fa 100644 --- a/.github/workflows/portfolio-analyst.lock.yml +++ b/.github/workflows/portfolio-analyst.lock.yml @@ -221,6 +221,14 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -424,6 +432,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/pr-nitpick-reviewer.lock.yml b/.github/workflows/pr-nitpick-reviewer.lock.yml index 30df67b6ea..3d3f05b23e 100644 --- a/.github/workflows/pr-nitpick-reviewer.lock.yml +++ b/.github/workflows/pr-nitpick-reviewer.lock.yml @@ -216,6 +216,14 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -494,6 +502,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=pull_requests,repos", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/prompt-clustering-analysis.lock.yml b/.github/workflows/prompt-clustering-analysis.lock.yml index 1f461bf977..4324a57e17 100644 --- a/.github/workflows/prompt-clustering-analysis.lock.yml +++ b/.github/workflows/prompt-clustering-analysis.lock.yml @@ -235,6 +235,14 @@ jobs: awf --version - name: Install Claude Code CLI run: npm install -g --silent @anthropic-ai/claude-code@2.0.76 + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -404,6 +412,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=repos,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/python-data-charts.lock.yml b/.github/workflows/python-data-charts.lock.yml index 662da1e642..9c0166633d 100644 --- a/.github/workflows/python-data-charts.lock.yml +++ b/.github/workflows/python-data-charts.lock.yml @@ -193,6 +193,14 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Install gh-aw extension @@ -412,6 +420,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/q.lock.yml b/.github/workflows/q.lock.yml index 12e65c18c1..4eadfc3ec2 100644 --- a/.github/workflows/q.lock.yml +++ b/.github/workflows/q.lock.yml @@ -254,6 +254,14 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -474,6 +482,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests,actions,discussions", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/release.lock.yml b/.github/workflows/release.lock.yml index d01ec36f36..cbea20cd0d 100644 --- a/.github/workflows/release.lock.yml +++ b/.github/workflows/release.lock.yml @@ -161,6 +161,14 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -333,6 +341,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/repo-tree-map.lock.yml b/.github/workflows/repo-tree-map.lock.yml index 7a14cb0236..a25bdfb683 100644 --- a/.github/workflows/repo-tree-map.lock.yml +++ b/.github/workflows/repo-tree-map.lock.yml @@ -155,6 +155,14 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -322,6 +330,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/repository-quality-improver.lock.yml b/.github/workflows/repository-quality-improver.lock.yml index 5346d50ca5..bc5c51590d 100644 --- a/.github/workflows/repository-quality-improver.lock.yml +++ b/.github/workflows/repository-quality-improver.lock.yml @@ -181,6 +181,14 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -348,6 +356,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/research.lock.yml b/.github/workflows/research.lock.yml index 4375865397..65a03b8162 100644 --- a/.github/workflows/research.lock.yml +++ b/.github/workflows/research.lock.yml @@ -158,6 +158,14 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -325,6 +333,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/safe-output-health.lock.yml b/.github/workflows/safe-output-health.lock.yml index dd7b81af64..4196d3690d 100644 --- a/.github/workflows/safe-output-health.lock.yml +++ b/.github/workflows/safe-output-health.lock.yml @@ -187,6 +187,14 @@ jobs: awf --version - name: Install Claude Code CLI run: npm install -g --silent @anthropic-ai/claude-code@2.0.76 + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -356,6 +364,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/schema-consistency-checker.lock.yml b/.github/workflows/schema-consistency-checker.lock.yml index 7f42db4803..05b9d41eb1 100644 --- a/.github/workflows/schema-consistency-checker.lock.yml +++ b/.github/workflows/schema-consistency-checker.lock.yml @@ -165,6 +165,14 @@ jobs: awf --version - name: Install Claude Code CLI run: npm install -g --silent @anthropic-ai/claude-code@2.0.76 + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Write Safe Outputs Config run: | mkdir -p /tmp/gh-aw/safeoutputs @@ -322,6 +330,7 @@ jobs: "url": "https://api.githubcopilot.com/mcp/", "headers": { "Authorization": "Bearer $GITHUB_MCP_SERVER_TOKEN", + "X-MCP-Lockdown": "${{ steps.determine-automatic-lockdown.outputs.lockdown }}", "X-MCP-Readonly": "true", "X-MCP-Toolsets": "context,repos,issues,pull_requests,discussions" } diff --git a/.github/workflows/scout.lock.yml b/.github/workflows/scout.lock.yml index 9d8fc0f164..4538b5270e 100644 --- a/.github/workflows/scout.lock.yml +++ b/.github/workflows/scout.lock.yml @@ -246,6 +246,14 @@ jobs: awf --version - name: Install Claude Code CLI run: npm install -g --silent @anthropic-ai/claude-code@2.0.76 + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 mcp/arxiv-mcp-server mcp/context7 - name: Write Safe Outputs Config @@ -424,6 +432,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/security-compliance.lock.yml b/.github/workflows/security-compliance.lock.yml index 94a64aef5f..204bdba9ec 100644 --- a/.github/workflows/security-compliance.lock.yml +++ b/.github/workflows/security-compliance.lock.yml @@ -165,6 +165,14 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -353,6 +361,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=repos,search,code_security", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/security-fix-pr.lock.yml b/.github/workflows/security-fix-pr.lock.yml index d5ea207e94..0effbcc82e 100644 --- a/.github/workflows/security-fix-pr.lock.yml +++ b/.github/workflows/security-fix-pr.lock.yml @@ -165,6 +165,14 @@ jobs: awf --version - name: Install Claude Code CLI run: npm install -g --silent @anthropic-ai/claude-code@2.0.76 + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -340,6 +348,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=context,repos,code_security,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/semantic-function-refactor.lock.yml b/.github/workflows/semantic-function-refactor.lock.yml index f04041eda7..1075084e3b 100644 --- a/.github/workflows/semantic-function-refactor.lock.yml +++ b/.github/workflows/semantic-function-refactor.lock.yml @@ -150,6 +150,14 @@ jobs: awf --version - name: Install Claude Code CLI run: npm install -g --silent @anthropic-ai/claude-code@2.0.76 + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -374,6 +382,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/slide-deck-maintainer.lock.yml b/.github/workflows/slide-deck-maintainer.lock.yml index 6df4d3f52b..7a3643ba4c 100644 --- a/.github/workflows/slide-deck-maintainer.lock.yml +++ b/.github/workflows/slide-deck-maintainer.lock.yml @@ -180,6 +180,14 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 mcr.microsoft.com/playwright/mcp - name: Write Safe Outputs Config @@ -357,6 +365,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/smoke-claude.lock.yml b/.github/workflows/smoke-claude.lock.yml index b0dc525745..b3a3f34c24 100644 --- a/.github/workflows/smoke-claude.lock.yml +++ b/.github/workflows/smoke-claude.lock.yml @@ -199,6 +199,14 @@ jobs: awf --version - name: Install Claude Code CLI run: npm install -g --silent @anthropic-ai/claude-code@2.0.76 + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 mcr.microsoft.com/playwright/mcp - name: Write Safe Outputs Config @@ -460,6 +468,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=repos,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/smoke-codex-firewall.lock.yml b/.github/workflows/smoke-codex-firewall.lock.yml index 655e95bf39..8b4ae9ca5f 100644 --- a/.github/workflows/smoke-codex-firewall.lock.yml +++ b/.github/workflows/smoke-codex-firewall.lock.yml @@ -172,6 +172,14 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config diff --git a/.github/workflows/smoke-codex.lock.yml b/.github/workflows/smoke-codex.lock.yml index 5fe1a6a65d..f6cfc6a287 100644 --- a/.github/workflows/smoke-codex.lock.yml +++ b/.github/workflows/smoke-codex.lock.yml @@ -195,6 +195,14 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 mcr.microsoft.com/playwright/mcp - name: Write Safe Outputs Config diff --git a/.github/workflows/smoke-copilot-no-firewall.lock.yml b/.github/workflows/smoke-copilot-no-firewall.lock.yml index 0e0c49af91..c78f6bab11 100644 --- a/.github/workflows/smoke-copilot-no-firewall.lock.yml +++ b/.github/workflows/smoke-copilot-no-firewall.lock.yml @@ -187,6 +187,14 @@ jobs: # Verify installation copilot --version + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 mcr.microsoft.com/playwright/mcp - name: Write Safe Outputs Config @@ -473,6 +481,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/smoke-copilot-playwright.lock.yml b/.github/workflows/smoke-copilot-playwright.lock.yml index cfa64978d2..126ec0142b 100644 --- a/.github/workflows/smoke-copilot-playwright.lock.yml +++ b/.github/workflows/smoke-copilot-playwright.lock.yml @@ -207,6 +207,14 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 mcr.microsoft.com/playwright/mcp - name: Write Safe Outputs Config @@ -566,6 +574,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/smoke-copilot.lock.yml b/.github/workflows/smoke-copilot.lock.yml index f6a98ac50f..b92969da4c 100644 --- a/.github/workflows/smoke-copilot.lock.yml +++ b/.github/workflows/smoke-copilot.lock.yml @@ -188,6 +188,14 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -451,6 +459,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/smoke-detector.lock.yml b/.github/workflows/smoke-detector.lock.yml index a6256336f2..7f1be928b3 100644 --- a/.github/workflows/smoke-detector.lock.yml +++ b/.github/workflows/smoke-detector.lock.yml @@ -223,6 +223,14 @@ jobs: awf --version - name: Install Claude Code CLI run: npm install -g --silent @anthropic-ai/claude-code@2.0.76 + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -449,6 +457,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests,actions", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/smoke-srt-custom-config.lock.yml b/.github/workflows/smoke-srt-custom-config.lock.yml index 802e7c1398..728ef9e877 100644 --- a/.github/workflows/smoke-srt-custom-config.lock.yml +++ b/.github/workflows/smoke-srt-custom-config.lock.yml @@ -148,6 +148,14 @@ jobs: echo "Sandbox Runtime installed successfully" - name: Install GitHub Copilot CLI run: npm install --silent @github/copilot@0.0.374 + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Setup MCPs @@ -171,6 +179,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/smoke-srt.lock.yml b/.github/workflows/smoke-srt.lock.yml index acdeee5f40..265af4a637 100644 --- a/.github/workflows/smoke-srt.lock.yml +++ b/.github/workflows/smoke-srt.lock.yml @@ -164,6 +164,14 @@ jobs: echo "Sandbox Runtime installed successfully" - name: Install GitHub Copilot CLI run: npm install --silent @github/copilot@0.0.374 + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -279,6 +287,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/spec-kit-execute.lock.yml b/.github/workflows/spec-kit-execute.lock.yml index ee5410ff2a..c58c3cde80 100644 --- a/.github/workflows/spec-kit-execute.lock.yml +++ b/.github/workflows/spec-kit-execute.lock.yml @@ -170,6 +170,14 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Write Safe Outputs Config run: | mkdir -p /tmp/gh-aw/safeoutputs @@ -338,6 +346,7 @@ jobs: "url": "https://api.githubcopilot.com/mcp/", "headers": { "Authorization": "Bearer \${GITHUB_PERSONAL_ACCESS_TOKEN}", + "X-MCP-Lockdown": "${{ steps.determine-automatic-lockdown.outputs.lockdown }}", "X-MCP-Readonly": "true", "X-MCP-Toolsets": "context,repos,issues,pull_requests" }, diff --git a/.github/workflows/spec-kit-executor.lock.yml b/.github/workflows/spec-kit-executor.lock.yml index 338f7e2975..87a7aefd82 100644 --- a/.github/workflows/spec-kit-executor.lock.yml +++ b/.github/workflows/spec-kit-executor.lock.yml @@ -171,6 +171,14 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -348,6 +356,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/speckit-dispatcher.lock.yml b/.github/workflows/speckit-dispatcher.lock.yml index f7cb1927e6..0754d066b7 100644 --- a/.github/workflows/speckit-dispatcher.lock.yml +++ b/.github/workflows/speckit-dispatcher.lock.yml @@ -210,6 +210,14 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -476,6 +484,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/static-analysis-report.lock.yml b/.github/workflows/static-analysis-report.lock.yml index 2f4d955ee5..cd0455cad8 100644 --- a/.github/workflows/static-analysis-report.lock.yml +++ b/.github/workflows/static-analysis-report.lock.yml @@ -186,6 +186,14 @@ jobs: awf --version - name: Install Claude Code CLI run: npm install -g --silent @anthropic-ai/claude-code@2.0.76 + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -355,6 +363,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests,actions", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/sub-issue-closer.lock.yml b/.github/workflows/sub-issue-closer.lock.yml index 5be72517b0..2ce9f6306b 100644 --- a/.github/workflows/sub-issue-closer.lock.yml +++ b/.github/workflows/sub-issue-closer.lock.yml @@ -149,6 +149,14 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -359,6 +367,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=issues", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/super-linter.lock.yml b/.github/workflows/super-linter.lock.yml index 3e27601745..e9b2bfcbed 100644 --- a/.github/workflows/super-linter.lock.yml +++ b/.github/workflows/super-linter.lock.yml @@ -175,6 +175,14 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -363,6 +371,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/technical-doc-writer.lock.yml b/.github/workflows/technical-doc-writer.lock.yml index 20b3c715cf..173350bad5 100644 --- a/.github/workflows/technical-doc-writer.lock.yml +++ b/.github/workflows/technical-doc-writer.lock.yml @@ -190,6 +190,14 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -432,6 +440,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/terminal-stylist.lock.yml b/.github/workflows/terminal-stylist.lock.yml index 6f84bbdbc3..da00715ef3 100644 --- a/.github/workflows/terminal-stylist.lock.yml +++ b/.github/workflows/terminal-stylist.lock.yml @@ -159,6 +159,14 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -326,6 +334,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=repos", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/tidy.lock.yml b/.github/workflows/tidy.lock.yml index 0c9a42262e..b2bc58335f 100644 --- a/.github/workflows/tidy.lock.yml +++ b/.github/workflows/tidy.lock.yml @@ -198,6 +198,14 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -423,6 +431,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/typist.lock.yml b/.github/workflows/typist.lock.yml index 6c5f0821c3..fcbba1b64a 100644 --- a/.github/workflows/typist.lock.yml +++ b/.github/workflows/typist.lock.yml @@ -161,6 +161,14 @@ jobs: awf --version - name: Install Claude Code CLI run: npm install -g --silent @anthropic-ai/claude-code@2.0.76 + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -326,6 +334,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/unbloat-docs.lock.yml b/.github/workflows/unbloat-docs.lock.yml index 268306b960..3fff8c8da6 100644 --- a/.github/workflows/unbloat-docs.lock.yml +++ b/.github/workflows/unbloat-docs.lock.yml @@ -206,6 +206,14 @@ jobs: awf --version - name: Install Claude Code CLI run: npm install -g --silent @anthropic-ai/claude-code@2.0.76 + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 mcr.microsoft.com/playwright/mcp - name: Write Safe Outputs Config @@ -446,6 +454,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/video-analyzer.lock.yml b/.github/workflows/video-analyzer.lock.yml index 7db0340be9..739d33b7af 100644 --- a/.github/workflows/video-analyzer.lock.yml +++ b/.github/workflows/video-analyzer.lock.yml @@ -165,6 +165,14 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -353,6 +361,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/weekly-issue-summary.lock.yml b/.github/workflows/weekly-issue-summary.lock.yml index 1f3cc6aea3..a12803902f 100644 --- a/.github/workflows/weekly-issue-summary.lock.yml +++ b/.github/workflows/weekly-issue-summary.lock.yml @@ -173,6 +173,14 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -369,6 +377,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=issues", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/workflow-generator.lock.yml b/.github/workflows/workflow-generator.lock.yml index 1ddf9e31ae..f0e88251a8 100644 --- a/.github/workflows/workflow-generator.lock.yml +++ b/.github/workflows/workflow-generator.lock.yml @@ -164,6 +164,14 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -376,6 +384,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests", "ghcr.io/github/github-mcp-server:v0.26.3" ], diff --git a/.github/workflows/workflow-health-manager.lock.yml b/.github/workflows/workflow-health-manager.lock.yml index d6782ba4cd..760f01a230 100644 --- a/.github/workflows/workflow-health-manager.lock.yml +++ b/.github/workflows/workflow-health-manager.lock.yml @@ -164,6 +164,14 @@ jobs: curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.7.0 bash which awf awf --version + - name: Determine automatic lockdown mode for GitHub MCP server + id: determine-automatic-lockdown + if: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN != '' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); + await determineAutomaticLockdown(github, context, core); - name: Downloading container images run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.26.3 - name: Write Safe Outputs Config @@ -447,6 +455,8 @@ jobs: "-e", "GITHUB_READ_ONLY=1", "-e", + "GITHUB_LOCKDOWN_MODE=${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}", + "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests,actions", "ghcr.io/github/github-mcp-server:v0.26.3" ], From 3b8861f120d8a5c4d2e3de71853ba40989c6ab7f Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Sun, 4 Jan 2026 00:45:46 +0000 Subject: [PATCH 7/7] Update documentation for automatic lockdown determination Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> --- docs/src/content/docs/guides/security.md | 20 +++++++++++--------- docs/src/content/docs/reference/tools.md | 10 +++++----- 2 files changed, 16 insertions(+), 14 deletions(-) diff --git a/docs/src/content/docs/guides/security.md b/docs/src/content/docs/guides/security.md index ef54d0822b..81c0b63e74 100644 --- a/docs/src/content/docs/guides/security.md +++ b/docs/src/content/docs/guides/security.md @@ -250,23 +250,25 @@ The compiler generates per-tool Squid proxies; MCP egress is forced through ipta #### Automatic GitHub Lockdown on Public Repositories -When using the GitHub MCP tool in public repositories, lockdown mode is **automatically enabled by default** to prevent accidental data leakage. This security feature restricts the GitHub token from accessing private repositories, ensuring that workflows running in public repositories cannot inadvertently expose sensitive information. +When using the GitHub MCP tool with a custom token (`GH_AW_GITHUB_MCP_SERVER_TOKEN`), lockdown mode is **automatically determined based on repository visibility** to prevent accidental data leakage. This security feature restricts the GitHub token from accessing private repositories when running in public repositories. -**How Automatic Detection Works:** +**How Automatic Determination Works:** -The system automatically detects repository visibility at workflow runtime: +When `GH_AW_GITHUB_MCP_SERVER_TOKEN` is defined, the system automatically determines lockdown mode at workflow runtime based on repository visibility: - **Public repositories**: Lockdown mode is automatically enabled. The GitHub MCP server limits surfaced content to items authored by users with push access to the repository. - **Private/internal repositories**: Lockdown mode is automatically disabled since there's no risk of exposing private repository access. - **Detection failure**: If repository visibility cannot be determined, the system defaults to lockdown mode for maximum security. -**No Configuration Required:** +**When using default `GITHUB_TOKEN`**: Automatic determination is skipped and lockdown defaults to disabled (no restriction). + +**Minimal Configuration:** ```yaml wrap tools: github: - # Lockdown is automatically enabled for public repos - # No explicit configuration needed + # Lockdown is automatically determined for public repos + # when GH_AW_GITHUB_MCP_SERVER_TOKEN is defined ``` **Manual Override (Optional):** @@ -287,10 +289,10 @@ Explicitly setting `lockdown: false` in a public repository disables this securi **Security Benefits:** -- **Prevents token scope leakage**: Even if a GitHub token has access to private repositories, lockdown mode prevents that access from being used in public repository workflows +- **Prevents token scope leakage**: When using a custom token with private repository access, lockdown mode prevents that access from being used in public repository workflows - **Defense in depth**: Adds an additional layer of protection beyond token scoping -- **Automatic and transparent**: Works without any configuration changes -- **Safe by default**: Failures default to the most secure setting +- **Automatic and transparent**: Works automatically when `GH_AW_GITHUB_MCP_SERVER_TOKEN` is defined +- **Safe by default**: Detection failures default to the most secure setting See also: [GitHub MCP Tool Configuration](/gh-aw/reference/tools/#github-tools-github) for complete tool configuration options. diff --git a/docs/src/content/docs/reference/tools.md b/docs/src/content/docs/reference/tools.md index d6c5cd743c..831965784a 100644 --- a/docs/src/content/docs/reference/tools.md +++ b/docs/src/content/docs/reference/tools.md @@ -110,16 +110,16 @@ Setup: `gh aw secrets set GH_AW_GITHUB_TOKEN --value ""` **Read-Only**: Default behavior; restricts to read operations unless write operations configured. -**Lockdown**: Automatically enabled for public repositories to prevent accidental data leakage. Filters public repository content to items from users with push access. Private repositories are unaffected. +**Lockdown**: Automatically determined based on repository visibility when using a custom token (`GH_AW_GITHUB_MCP_SERVER_TOKEN`). Filters public repository content to items from users with push access. Private repositories are unaffected. -- **Automatic (default)**: Lockdown is automatically enabled for public repositories and disabled for private/internal repositories -- **Manual override**: Explicitly set `lockdown: true` or `lockdown: false` to override automatic detection +- **Automatic (default)**: When `GH_AW_GITHUB_MCP_SERVER_TOKEN` is defined, lockdown is automatically enabled for public repositories and disabled for private/internal repositories +- **Manual override**: Explicitly set `lockdown: true` or `lockdown: false` to override automatic determination ```yaml wrap tools: github: - # Option 1: Automatic (recommended) - no configuration needed - # Lockdown automatically enabled for public repos + # Option 1: Automatic (recommended) - determined at runtime + # Lockdown automatically enabled for public repos when GH_AW_GITHUB_MCP_SERVER_TOKEN is set # Option 2: Explicit override lockdown: true # Force enable