From 5bbe98280e395abd2c127380fc776d4ec8f855e6 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 22 Jan 2026 20:23:53 +0000
Subject: [PATCH 1/8] Initial plan


From bb96c7059d90e9db224eee44a683556e2e1b7404 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 22 Jan 2026 20:49:15 +0000
Subject: [PATCH 2/8] ci: use local awf build for smoke workflows

Co-authored-by: Mossaka <5447827+Mossaka@users.noreply.github.com>
---
 .github/workflows/smoke-claude.lock.yml   | 15 ++++++-
 .github/workflows/smoke-copilot.lock.yml  | 15 ++++++-
 scripts/ci/postprocess-smoke-workflows.ts | 52 +++++++++++++++++++++++
 3 files changed, 78 insertions(+), 4 deletions(-)
 create mode 100644 scripts/ci/postprocess-smoke-workflows.ts

diff --git a/.github/workflows/smoke-claude.lock.yml b/.github/workflows/smoke-claude.lock.yml
index 6e2780258..cee5a71c3 100644
--- a/.github/workflows/smoke-claude.lock.yml
+++ b/.github/workflows/smoke-claude.lock.yml
@@ -167,8 +167,19 @@ jobs:
         with:
           node-version: '24'
           package-manager-cache: false
-      - name: Install awf binary
-        run: bash /opt/gh-aw/actions/install_awf_binary.sh v0.10.0
+      - name: Install awf dependencies
+        run: npm ci
+      - name: Build awf
+        run: npm run build
+      - name: Install awf binary (local)
+        run: |
+          WORKSPACE_PATH="${GITHUB_WORKSPACE:-$(pwd)}"
+          NODE_BIN="$(command -v node)"
+          sudo tee /usr/local/bin/awf > /dev/null <<EOF
+          #!/bin/bash
+          exec "${NODE_BIN}" "${WORKSPACE_PATH}/dist/cli.js" "\$@"
+          EOF
+          sudo chmod +x /usr/local/bin/awf
       - name: Install Claude Code CLI
         run: npm install -g --silent @anthropic-ai/claude-code@2.1.14
       - name: Determine automatic lockdown mode for GitHub MCP server
diff --git a/.github/workflows/smoke-copilot.lock.yml b/.github/workflows/smoke-copilot.lock.yml
index 0643bea6b..a48f84d13 100644
--- a/.github/workflows/smoke-copilot.lock.yml
+++ b/.github/workflows/smoke-copilot.lock.yml
@@ -172,8 +172,19 @@ jobs:
           
           # Verify installation
           copilot --version
-      - name: Install awf binary
-        run: bash /opt/gh-aw/actions/install_awf_binary.sh v0.10.0
+      - name: Install awf dependencies
+        run: npm ci
+      - name: Build awf
+        run: npm run build
+      - name: Install awf binary (local)
+        run: |
+          WORKSPACE_PATH="${GITHUB_WORKSPACE:-$(pwd)}"
+          NODE_BIN="$(command -v node)"
+          sudo tee /usr/local/bin/awf > /dev/null <<EOF
+          #!/bin/bash
+          exec "${NODE_BIN}" "${WORKSPACE_PATH}/dist/cli.js" "\$@"
+          EOF
+          sudo chmod +x /usr/local/bin/awf
       - name: Determine automatic lockdown mode for GitHub MCP server
         id: determine-automatic-lockdown
         env:
diff --git a/scripts/ci/postprocess-smoke-workflows.ts b/scripts/ci/postprocess-smoke-workflows.ts
new file mode 100644
index 000000000..34d8c9834
--- /dev/null
+++ b/scripts/ci/postprocess-smoke-workflows.ts
@@ -0,0 +1,52 @@
+#!/usr/bin/env node
+
+import * as fs from 'fs';
+import * as path from 'path';
+
+const repoRoot = path.resolve(__dirname, '../..');
+const workflowPaths = [
+  path.join(repoRoot, '.github/workflows/smoke-copilot.lock.yml'),
+  path.join(repoRoot, '.github/workflows/smoke-claude.lock.yml'),
+];
+
+const installStepRegex =
+  /^ {6}- name: Install awf binary\n {8}run: bash \/opt\/gh-aw\/actions\/install_awf_binary\.sh v[0-9.]+\n/m;
+const installStepRegexGlobal = new RegExp(installStepRegex.source, 'gm');
+
+const localInstallSteps = [
+  '      - name: Install awf dependencies',
+  '        run: npm ci',
+  '      - name: Build awf',
+  '        run: npm run build',
+  '      - name: Install awf binary (local)',
+  '        run: |',
+  '          WORKSPACE_PATH="${GITHUB_WORKSPACE:-$(pwd)}"',
+  '          NODE_BIN="$(command -v node)"',
+  '          sudo tee /usr/local/bin/awf > /dev/null <<EOF',
+  '          #!/bin/bash',
+  '          exec "${NODE_BIN}" "${WORKSPACE_PATH}/dist/cli.js" "\\$@"',
+  '          EOF',
+  '          sudo chmod +x /usr/local/bin/awf',
+  '',
+].join('\n');
+
+for (const workflowPath of workflowPaths) {
+  const content = fs.readFileSync(workflowPath, 'utf-8');
+  const matches = content.match(installStepRegexGlobal);
+
+  if (!matches || matches.length !== 1) {
+    throw new Error(
+      `Expected exactly one awf install step in ${workflowPath}, found ${matches?.length ?? 0}.`
+    );
+  }
+
+  const updated = content.replace(installStepRegex, localInstallSteps);
+
+  if (updated === content) {
+    console.log(`No changes required for ${workflowPath}`);
+    continue;
+  }
+
+  fs.writeFileSync(workflowPath, updated);
+  console.log(`Updated ${workflowPath}`);
+}

From 7fc059846aba27ee2227a1a92f1f02ba0ccb5847 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 22 Jan 2026 20:53:14 +0000
Subject: [PATCH 3/8] ci: make smoke workflow postprocess resilient

Co-authored-by: Mossaka <5447827+Mossaka@users.noreply.github.com>
---
 scripts/ci/postprocess-smoke-workflows.ts | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/scripts/ci/postprocess-smoke-workflows.ts b/scripts/ci/postprocess-smoke-workflows.ts
index 34d8c9834..10e939c77 100644
--- a/scripts/ci/postprocess-smoke-workflows.ts
+++ b/scripts/ci/postprocess-smoke-workflows.ts
@@ -34,9 +34,14 @@ for (const workflowPath of workflowPaths) {
   const content = fs.readFileSync(workflowPath, 'utf-8');
   const matches = content.match(installStepRegexGlobal);
 
-  if (!matches || matches.length !== 1) {
+  if (!matches || matches.length === 0) {
+    console.log(`Skipping ${workflowPath}: no awf install step found.`);
+    continue;
+  }
+
+  if (matches.length !== 1) {
     throw new Error(
-      `Expected exactly one awf install step in ${workflowPath}, found ${matches?.length ?? 0}.`
+      `Expected exactly one awf install step in ${workflowPath}, found ${matches.length}.`
     );
   }
 

From fa4ed941e8d77b0e75e04588297fc0a568b69a2d Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 22 Jan 2026 20:54:26 +0000
Subject: [PATCH 4/8] ci: tighten smoke workflow postprocess replace

Co-authored-by: Mossaka <5447827+Mossaka@users.noreply.github.com>
---
 scripts/ci/postprocess-smoke-workflows.ts | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/scripts/ci/postprocess-smoke-workflows.ts b/scripts/ci/postprocess-smoke-workflows.ts
index 10e939c77..1be1a4ebc 100644
--- a/scripts/ci/postprocess-smoke-workflows.ts
+++ b/scripts/ci/postprocess-smoke-workflows.ts
@@ -45,12 +45,7 @@ for (const workflowPath of workflowPaths) {
     );
   }
 
-  const updated = content.replace(installStepRegex, localInstallSteps);
-
-  if (updated === content) {
-    console.log(`No changes required for ${workflowPath}`);
-    continue;
-  }
+  const updated = content.replace(installStepRegexGlobal, localInstallSteps);
 
   fs.writeFileSync(workflowPath, updated);
   console.log(`Updated ${workflowPath}`);

From 2afe4b41bc2bc2c56377a531ef91f53aeb80f5aa Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 22 Jan 2026 20:56:02 +0000
Subject: [PATCH 5/8] ci: make smoke postprocess indentation-aware

Co-authored-by: Mossaka <5447827+Mossaka@users.noreply.github.com>
---
 scripts/ci/postprocess-smoke-workflows.ts | 47 ++++++++++++++---------
 1 file changed, 28 insertions(+), 19 deletions(-)

diff --git a/scripts/ci/postprocess-smoke-workflows.ts b/scripts/ci/postprocess-smoke-workflows.ts
index 1be1a4ebc..4c9c9b077 100644
--- a/scripts/ci/postprocess-smoke-workflows.ts
+++ b/scripts/ci/postprocess-smoke-workflows.ts
@@ -10,25 +10,30 @@ const workflowPaths = [
 ];
 
 const installStepRegex =
-  /^ {6}- name: Install awf binary\n {8}run: bash \/opt\/gh-aw\/actions\/install_awf_binary\.sh v[0-9.]+\n/m;
+  /^(\s*)- name: Install awf binary\n\1\s*run: bash \/opt\/gh-aw\/actions\/install_awf_binary\.sh v[0-9.]+\n/m;
 const installStepRegexGlobal = new RegExp(installStepRegex.source, 'gm');
 
-const localInstallSteps = [
-  '      - name: Install awf dependencies',
-  '        run: npm ci',
-  '      - name: Build awf',
-  '        run: npm run build',
-  '      - name: Install awf binary (local)',
-  '        run: |',
-  '          WORKSPACE_PATH="${GITHUB_WORKSPACE:-$(pwd)}"',
-  '          NODE_BIN="$(command -v node)"',
-  '          sudo tee /usr/local/bin/awf > /dev/null <<EOF',
-  '          #!/bin/bash',
-  '          exec "${NODE_BIN}" "${WORKSPACE_PATH}/dist/cli.js" "\\$@"',
-  '          EOF',
-  '          sudo chmod +x /usr/local/bin/awf',
-  '',
-].join('\n');
+function buildLocalInstallSteps(indent: string): string {
+  const stepIndent = indent;
+  const runIndent = `${indent}  `;
+  const scriptIndent = `${runIndent}  `;
+
+  return [
+    `${stepIndent}- name: Install awf dependencies`,
+    `${runIndent}run: npm ci`,
+    `${stepIndent}- name: Build awf`,
+    `${runIndent}run: npm run build`,
+    `${stepIndent}- name: Install awf binary (local)`,
+    `${runIndent}run: |`,
+    `${scriptIndent}WORKSPACE_PATH="${'${GITHUB_WORKSPACE:-$(pwd)}'}"`,
+    `${scriptIndent}NODE_BIN="$(command -v node)"`,
+    `${scriptIndent}sudo tee /usr/local/bin/awf > /dev/null <<EOF`,
+    `${scriptIndent}#!/bin/bash`,
+    `${scriptIndent}exec "${'${NODE_BIN}'}" "${'${WORKSPACE_PATH}'}/dist/cli.js" "\\$@"`,
+    `${scriptIndent}EOF`,
+    `${scriptIndent}sudo chmod +x /usr/local/bin/awf`,
+  ].join('\n') + '\n';
+}
 
 for (const workflowPath of workflowPaths) {
   const content = fs.readFileSync(workflowPath, 'utf-8');
@@ -41,11 +46,15 @@ for (const workflowPath of workflowPaths) {
 
   if (matches.length !== 1) {
     throw new Error(
-      `Expected exactly one awf install step in ${workflowPath}, found ${matches.length}.`
+      `Expected exactly one awf install step in ${workflowPath}, found ${matches.length}. ` +
+        'Ensure the workflow has a single "Install awf binary" step in the agent job.'
     );
   }
 
-  const updated = content.replace(installStepRegexGlobal, localInstallSteps);
+  const updated = content.replace(
+    installStepRegexGlobal,
+    (_match, indent: string) => buildLocalInstallSteps(indent)
+  );
 
   fs.writeFileSync(workflowPath, updated);
   console.log(`Updated ${workflowPath}`);

From 256c9da9103fb5f3f93cab5a9608f1a718630cbc Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 22 Jan 2026 20:57:05 +0000
Subject: [PATCH 6/8] ci: validate local awf wrapper setup

Co-authored-by: Mossaka <5447827+Mossaka@users.noreply.github.com>
---
 scripts/ci/postprocess-smoke-workflows.ts | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/scripts/ci/postprocess-smoke-workflows.ts b/scripts/ci/postprocess-smoke-workflows.ts
index 4c9c9b077..8a4bf4b6f 100644
--- a/scripts/ci/postprocess-smoke-workflows.ts
+++ b/scripts/ci/postprocess-smoke-workflows.ts
@@ -9,6 +9,9 @@ const workflowPaths = [
   path.join(repoRoot, '.github/workflows/smoke-claude.lock.yml'),
 ];
 
+// Matches the install step with captured indentation:
+// - "Install awf binary" step at any indent level
+// - run command invoking install_awf_binary.sh with a version
 const installStepRegex =
   /^(\s*)- name: Install awf binary\n\1\s*run: bash \/opt\/gh-aw\/actions\/install_awf_binary\.sh v[0-9.]+\n/m;
 const installStepRegexGlobal = new RegExp(installStepRegex.source, 'gm');
@@ -27,6 +30,18 @@ function buildLocalInstallSteps(indent: string): string {
     `${runIndent}run: |`,
     `${scriptIndent}WORKSPACE_PATH="${'${GITHUB_WORKSPACE:-$(pwd)}'}"`,
     `${scriptIndent}NODE_BIN="$(command -v node)"`,
+    `${scriptIndent}if [ ! -d "$WORKSPACE_PATH" ]; then`,
+    `${scriptIndent}  echo "Workspace path not found: $WORKSPACE_PATH"`,
+    `${scriptIndent}  exit 1`,
+    `${scriptIndent}fi`,
+    `${scriptIndent}if [ ! -x "$NODE_BIN" ]; then`,
+    `${scriptIndent}  echo "Node binary not found: $NODE_BIN"`,
+    `${scriptIndent}  exit 1`,
+    `${scriptIndent}fi`,
+    `${scriptIndent}if [ ! -d "/usr/local/bin" ]; then`,
+    `${scriptIndent}  echo "/usr/local/bin is missing"`,
+    `${scriptIndent}  exit 1`,
+    `${scriptIndent}fi`,
     `${scriptIndent}sudo tee /usr/local/bin/awf > /dev/null <<EOF`,
     `${scriptIndent}#!/bin/bash`,
     `${scriptIndent}exec "${'${NODE_BIN}'}" "${'${WORKSPACE_PATH}'}/dist/cli.js" "\\$@"`,

From f5767d98c6da8d29d5aba787bd030acbc3ba7812 Mon Sep 17 00:00:00 2001
From: "Jiaxiao (mossaka) Zhou" <duibao55328@gmail.com>
Date: Thu, 22 Jan 2026 21:56:55 +0000
Subject: [PATCH 7/8] ci: allow all roles for smoke workflows

---
 .github/workflows/smoke-claude.lock.yml  | 58 ++----------------------
 .github/workflows/smoke-claude.md        |  3 +-
 .github/workflows/smoke-copilot.lock.yml | 58 ++----------------------
 .github/workflows/smoke-copilot.md       |  3 +-
 4 files changed, 10 insertions(+), 112 deletions(-)

diff --git a/.github/workflows/smoke-claude.lock.yml b/.github/workflows/smoke-claude.lock.yml
index cee5a71c3..2cea91662 100644
--- a/.github/workflows/smoke-claude.lock.yml
+++ b/.github/workflows/smoke-claude.lock.yml
@@ -46,9 +46,7 @@ run-name: "Smoke Claude"
 
 jobs:
   activation:
-    needs: pre_activation
-    if: >
-      (needs.pre_activation.outputs.activated == 'true') && ((github.event_name != 'pull_request') || (github.event.pull_request.head.repo.id == github.repository_id))
+    if: (github.event_name != 'pull_request') || (github.event.pull_request.head.repo.id == github.repository_id)
     runs-on: ubuntu-slim
     permissions:
       contents: read
@@ -167,19 +165,8 @@ jobs:
         with:
           node-version: '24'
           package-manager-cache: false
-      - name: Install awf dependencies
-        run: npm ci
-      - name: Build awf
-        run: npm run build
-      - name: Install awf binary (local)
-        run: |
-          WORKSPACE_PATH="${GITHUB_WORKSPACE:-$(pwd)}"
-          NODE_BIN="$(command -v node)"
-          sudo tee /usr/local/bin/awf > /dev/null <<EOF
-          #!/bin/bash
-          exec "${NODE_BIN}" "${WORKSPACE_PATH}/dist/cli.js" "\$@"
-          EOF
-          sudo chmod +x /usr/local/bin/awf
+      - name: Install awf binary
+        run: bash /opt/gh-aw/actions/install_awf_binary.sh v0.10.0
       - name: Install Claude Code CLI
         run: npm install -g --silent @anthropic-ai/claude-code@2.1.14
       - name: Determine automatic lockdown mode for GitHub MCP server
@@ -1287,45 +1274,6 @@ jobs:
           path: /tmp/gh-aw/threat-detection/detection.log
           if-no-files-found: ignore
 
-  pre_activation:
-    if: (github.event_name != 'pull_request') || (github.event.pull_request.head.repo.id == github.repository_id)
-    runs-on: ubuntu-slim
-    permissions:
-      discussions: write
-      issues: write
-      pull-requests: write
-    outputs:
-      activated: ${{ steps.check_membership.outputs.is_team_member == 'true' }}
-    steps:
-      - name: Setup Scripts
-        uses: githubnext/gh-aw/actions/setup@55503f44aef44813947980f65655a67b5ed8702f # v0.37.3
-        with:
-          destination: /opt/gh-aw/actions
-      - name: Add heart reaction for immediate feedback
-        id: react
-        if: github.event_name == 'issues' || github.event_name == 'issue_comment' || github.event_name == 'pull_request_review_comment' || github.event_name == 'discussion' || github.event_name == 'discussion_comment' || (github.event_name == 'pull_request') && (github.event.pull_request.head.repo.id == github.repository_id)
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
-        env:
-          GH_AW_REACTION: "heart"
-        with:
-          script: |
-            const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
-            setupGlobals(core, github, context, exec, io);
-            const { main } = require('/opt/gh-aw/actions/add_reaction.cjs');
-            await main();
-      - name: Check team membership for workflow
-        id: check_membership
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
-        env:
-          GH_AW_REQUIRED_ROLES: admin,maintainer,write
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          script: |
-            const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
-            setupGlobals(core, github, context, exec, io);
-            const { main } = require('/opt/gh-aw/actions/check_membership.cjs');
-            await main();
-
   safe_outputs:
     needs:
       - agent
diff --git a/.github/workflows/smoke-claude.md b/.github/workflows/smoke-claude.md
index f65f474be..a32c7efe1 100644
--- a/.github/workflows/smoke-claude.md
+++ b/.github/workflows/smoke-claude.md
@@ -1,11 +1,12 @@
 ---
 description: Smoke test workflow that validates Claude engine functionality by reviewing recent PRs twice daily
-on: 
+on:
   schedule: every 12h
   workflow_dispatch:
   pull_request:
     types: [opened, synchronize, reopened]
   reaction: "heart"
+roles: all
 permissions:
   contents: read
   issues: read
diff --git a/.github/workflows/smoke-copilot.lock.yml b/.github/workflows/smoke-copilot.lock.yml
index a48f84d13..917fe0c87 100644
--- a/.github/workflows/smoke-copilot.lock.yml
+++ b/.github/workflows/smoke-copilot.lock.yml
@@ -42,9 +42,7 @@ run-name: "Smoke Copilot"
 
 jobs:
   activation:
-    needs: pre_activation
-    if: >
-      (needs.pre_activation.outputs.activated == 'true') && ((github.event_name != 'pull_request') || (github.event.pull_request.head.repo.id == github.repository_id))
+    if: (github.event_name != 'pull_request') || (github.event.pull_request.head.repo.id == github.repository_id)
     runs-on: ubuntu-slim
     permissions:
       contents: read
@@ -172,19 +170,8 @@ jobs:
           
           # Verify installation
           copilot --version
-      - name: Install awf dependencies
-        run: npm ci
-      - name: Build awf
-        run: npm run build
-      - name: Install awf binary (local)
-        run: |
-          WORKSPACE_PATH="${GITHUB_WORKSPACE:-$(pwd)}"
-          NODE_BIN="$(command -v node)"
-          sudo tee /usr/local/bin/awf > /dev/null <<EOF
-          #!/bin/bash
-          exec "${NODE_BIN}" "${WORKSPACE_PATH}/dist/cli.js" "\$@"
-          EOF
-          sudo chmod +x /usr/local/bin/awf
+      - name: Install awf binary
+        run: bash /opt/gh-aw/actions/install_awf_binary.sh v0.10.0
       - name: Determine automatic lockdown mode for GitHub MCP server
         id: determine-automatic-lockdown
         env:
@@ -1132,45 +1119,6 @@ jobs:
           path: /tmp/gh-aw/threat-detection/detection.log
           if-no-files-found: ignore
 
-  pre_activation:
-    if: (github.event_name != 'pull_request') || (github.event.pull_request.head.repo.id == github.repository_id)
-    runs-on: ubuntu-slim
-    permissions:
-      discussions: write
-      issues: write
-      pull-requests: write
-    outputs:
-      activated: ${{ steps.check_membership.outputs.is_team_member == 'true' }}
-    steps:
-      - name: Setup Scripts
-        uses: githubnext/gh-aw/actions/setup@55503f44aef44813947980f65655a67b5ed8702f # v0.37.3
-        with:
-          destination: /opt/gh-aw/actions
-      - name: Add eyes reaction for immediate feedback
-        id: react
-        if: github.event_name == 'issues' || github.event_name == 'issue_comment' || github.event_name == 'pull_request_review_comment' || github.event_name == 'discussion' || github.event_name == 'discussion_comment' || (github.event_name == 'pull_request') && (github.event.pull_request.head.repo.id == github.repository_id)
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
-        env:
-          GH_AW_REACTION: "eyes"
-        with:
-          script: |
-            const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
-            setupGlobals(core, github, context, exec, io);
-            const { main } = require('/opt/gh-aw/actions/add_reaction.cjs');
-            await main();
-      - name: Check team membership for workflow
-        id: check_membership
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
-        env:
-          GH_AW_REQUIRED_ROLES: admin,maintainer,write
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          script: |
-            const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
-            setupGlobals(core, github, context, exec, io);
-            const { main } = require('/opt/gh-aw/actions/check_membership.cjs');
-            await main();
-
   safe_outputs:
     needs:
       - agent
diff --git a/.github/workflows/smoke-copilot.md b/.github/workflows/smoke-copilot.md
index 55beaa081..2ac91554c 100644
--- a/.github/workflows/smoke-copilot.md
+++ b/.github/workflows/smoke-copilot.md
@@ -1,11 +1,12 @@
 ---
 description: Smoke Copilot
-on: 
+on:
   schedule: every 12h
   workflow_dispatch:
   pull_request:
     types: [opened, synchronize, reopened]
   reaction: "eyes"
+roles: all
 permissions:
   contents: read
   pull-requests: read

From 39c98f54fd8a53a9cd214fee7f0172284f4c1345 Mon Sep 17 00:00:00 2001
From: "Jiaxiao (mossaka) Zhou" <duibao55328@gmail.com>
Date: Thu, 22 Jan 2026 22:01:34 +0000
Subject: [PATCH 8/8] ci: post-process smoke workflows to use local awf build

---
 .github/workflows/smoke-claude.lock.yml  | 27 ++++++++++++++++++++++--
 .github/workflows/smoke-copilot.lock.yml | 27 ++++++++++++++++++++++--
 2 files changed, 50 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/smoke-claude.lock.yml b/.github/workflows/smoke-claude.lock.yml
index 2cea91662..4c622b5d7 100644
--- a/.github/workflows/smoke-claude.lock.yml
+++ b/.github/workflows/smoke-claude.lock.yml
@@ -165,8 +165,31 @@ jobs:
         with:
           node-version: '24'
           package-manager-cache: false
-      - name: Install awf binary
-        run: bash /opt/gh-aw/actions/install_awf_binary.sh v0.10.0
+      - name: Install awf dependencies
+        run: npm ci
+      - name: Build awf
+        run: npm run build
+      - name: Install awf binary (local)
+        run: |
+          WORKSPACE_PATH="${GITHUB_WORKSPACE:-$(pwd)}"
+          NODE_BIN="$(command -v node)"
+          if [ ! -d "$WORKSPACE_PATH" ]; then
+            echo "Workspace path not found: $WORKSPACE_PATH"
+            exit 1
+          fi
+          if [ ! -x "$NODE_BIN" ]; then
+            echo "Node binary not found: $NODE_BIN"
+            exit 1
+          fi
+          if [ ! -d "/usr/local/bin" ]; then
+            echo "/usr/local/bin is missing"
+            exit 1
+          fi
+          sudo tee /usr/local/bin/awf > /dev/null <<EOF
+          #!/bin/bash
+          exec "${NODE_BIN}" "${WORKSPACE_PATH}/dist/cli.js" "\$@"
+          EOF
+          sudo chmod +x /usr/local/bin/awf
       - name: Install Claude Code CLI
         run: npm install -g --silent @anthropic-ai/claude-code@2.1.14
       - name: Determine automatic lockdown mode for GitHub MCP server
diff --git a/.github/workflows/smoke-copilot.lock.yml b/.github/workflows/smoke-copilot.lock.yml
index 917fe0c87..589dd71ce 100644
--- a/.github/workflows/smoke-copilot.lock.yml
+++ b/.github/workflows/smoke-copilot.lock.yml
@@ -170,8 +170,31 @@ jobs:
           
           # Verify installation
           copilot --version
-      - name: Install awf binary
-        run: bash /opt/gh-aw/actions/install_awf_binary.sh v0.10.0
+      - name: Install awf dependencies
+        run: npm ci
+      - name: Build awf
+        run: npm run build
+      - name: Install awf binary (local)
+        run: |
+          WORKSPACE_PATH="${GITHUB_WORKSPACE:-$(pwd)}"
+          NODE_BIN="$(command -v node)"
+          if [ ! -d "$WORKSPACE_PATH" ]; then
+            echo "Workspace path not found: $WORKSPACE_PATH"
+            exit 1
+          fi
+          if [ ! -x "$NODE_BIN" ]; then
+            echo "Node binary not found: $NODE_BIN"
+            exit 1
+          fi
+          if [ ! -d "/usr/local/bin" ]; then
+            echo "/usr/local/bin is missing"
+            exit 1
+          fi
+          sudo tee /usr/local/bin/awf > /dev/null <<EOF
+          #!/bin/bash
+          exec "${NODE_BIN}" "${WORKSPACE_PATH}/dist/cli.js" "\$@"
+          EOF
+          sudo chmod +x /usr/local/bin/awf
       - name: Determine automatic lockdown mode for GitHub MCP server
         id: determine-automatic-lockdown
         env: