Bind Node.js into the AWF chroot for Copilot-engine runs — the missing node aborts the agent before its first turn and has blanked Daily Issues Report for 6 straight days.
Problem statement
The Copilot CLI entrypoint cannot find node inside the AWF firewall chroot and aborts immediately with exit 127, before any agent turn runs. The workflow has produced zero output for 6 consecutive scheduled days.
Affected workflow and run IDs
- Daily Issues Report Generator (
.github/workflows/daily-issues-report.lock.yml, Copilot engine, model claude-sonnet-4.6, CLI v1.0.60) — 6/6 consecutive scheduled failures.
- Representative (in-window): §27502926049 (2026-06-14T15:09Z) — failed
Execute GitHub Copilot CLI, exit 127.
- Prior streak (same
conclusion=failure): §27470398413, §27425935620, §27358932502, §27287691627, §27217080796 (2026-06-09 → 06-13). Per-day root cause not individually re-audited; all share the failing conclusion.
Root cause
The chroot entrypoint logs, immediately before exit, that the Copilot CLI's Node.js dependency is unreachable inside the sandbox:
[entrypoint][ERROR] Copilot CLI requires Node.js, but 'node' is not available inside AWF chroot.
[entrypoint][ERROR] Ensure Node.js is installed on the runner and reachable from PATH inside the chroot.
[entrypoint][ERROR] If using setup-node or nvm, verify the install path is present and bind-mounted into /host.
...
[WARN] Command completed with exit code: 127
Process exiting with code: 127
##[error]Process completed with exit code 127.
The agent never started — the firewall/chroot bind-mount for this run did not expose the runner's node (e.g. /opt/hostedtoolcache/..., /home/runner/.nvm/...) on the chroot PATH. Note another Copilot run in the same window (Daily Formal Spec Verifier, §27504260264) did reach the agent, so the missing-node condition is not universal — it is intermittent or specific to this workflow's runner/setup ordering, which fits a bind-mount/PATH race rather than a global outage.
Proposed remediation
- In the AWF chroot setup, detect the active Node.js install (setup-node / hostedtoolcache / nvm path) and explicitly bind-mount it into
/host and prepend it to the chroot PATH for Copilot-engine workflows.
- Fail fast with a classified flag (e.g.
GH_AW_NODE_UNAVAILABLE) instead of a generic exit 127, so this is categorized rather than bucketed as an unclassified failure by the conclusion classifier.
- Add a pre-agent assertion that
node --version succeeds inside the chroot before launching the Copilot CLI, surfacing a clear remediation message.
Success criteria / verification
- Daily Issues Report Generator completes its agent turn (no exit-127
node error) for ≥3 consecutive scheduled runs.
- A future missing-
node-in-chroot condition surfaces as a dedicated classified flag, not a generic exit-1/127.
Parent: #29109. Analyzed run: 27502926049 (audit). Engine: Copilot CLI v1.0.60.
Related to #29109
Generated by 🔍 [aw] Failure Investigator (6h) · 457 AIC · ⌖ 12 AIC · ⊞ 4.5K · ◷
Additional occurrence — 2026-06-15 6h sweep
Daily News hit the identical root cause today: Copilot CLI entrypoint exited 127 inside the AWF chroot because node was not on PATH — agent never started (0 turns, empty agent_output). Run: §27540688430.
Confirms this engine_crash (missing runtimes.node bind-mount) is not workflow-specific — it decapitates any Copilot-engine workflow scheduled onto an affected runner, not just Daily Issues Report. Broaden the fix/verification accordingly.
Generated by 🔍 [aw] Failure Investigator (6h) · 241.8 AIC · ⌖ 12.7 AIC · ⊞ 4.5K · ◷
Bind Node.js into the AWF chroot for Copilot-engine runs — the missing
nodeaborts the agent before its first turn and has blanked Daily Issues Report for 6 straight days.Problem statement
The Copilot CLI entrypoint cannot find
nodeinside the AWF firewall chroot and aborts immediately with exit 127, before any agent turn runs. The workflow has produced zero output for 6 consecutive scheduled days.Affected workflow and run IDs
.github/workflows/daily-issues-report.lock.yml, Copilot engine, modelclaude-sonnet-4.6, CLI v1.0.60) — 6/6 consecutive scheduled failures.Execute GitHub Copilot CLI, exit 127.conclusion=failure): §27470398413, §27425935620, §27358932502, §27287691627, §27217080796 (2026-06-09 → 06-13). Per-day root cause not individually re-audited; all share the failing conclusion.Root cause
The chroot entrypoint logs, immediately before exit, that the Copilot CLI's Node.js dependency is unreachable inside the sandbox:
The agent never started — the firewall/chroot bind-mount for this run did not expose the runner's
node(e.g./opt/hostedtoolcache/...,/home/runner/.nvm/...) on the chroot PATH. Note another Copilot run in the same window (Daily Formal Spec Verifier, §27504260264) did reach the agent, so the missing-node condition is not universal — it is intermittent or specific to this workflow's runner/setup ordering, which fits a bind-mount/PATH race rather than a global outage.Proposed remediation
/hostand prepend it to the chroot PATH for Copilot-engine workflows.GH_AW_NODE_UNAVAILABLE) instead of a generic exit 127, so this is categorized rather than bucketed as an unclassified failure by the conclusion classifier.node --versionsucceeds inside the chroot before launching the Copilot CLI, surfacing a clear remediation message.Success criteria / verification
nodeerror) for ≥3 consecutive scheduled runs.node-in-chroot condition surfaces as a dedicated classified flag, not a generic exit-1/127.Parent: #29109. Analyzed run: 27502926049 (audit). Engine: Copilot CLI v1.0.60.
Related to #29109
Additional occurrence — 2026-06-15 6h sweep
Daily News hit the identical root cause today: Copilot CLI entrypoint exited 127 inside the AWF chroot because
nodewas not on PATH — agent never started (0 turns, emptyagent_output). Run: §27540688430.Confirms this
engine_crash(missingruntimes.nodebind-mount) is not workflow-specific — it decapitates any Copilot-engine workflow scheduled onto an affected runner, not just Daily Issues Report. Broaden the fix/verification accordingly.