Validate default AI credit guardrails in compiler output, runtime env wiring, and compile logs by Copilot · Pull Request #38184 · github/gh-aw

Copilot · 2026-06-09T17:47:45Z

The compiler defaulted max-ai-credits and max-daily-ai-credits through different paths, but the generated runtime wiring did not consistently apply the same fallback order for both metrics. This updates the built-in daily default to 5000, preserves the per-run default of 1000, and makes the compiled workflow output consistently resolve both guardrails as: frontmatter value → GitHub Actions default var → built-in constant.

Default guardrail constants
- Introduce a shared DefaultMaxDailyAICredits = "5000" constant.
- Keep DefaultMaxAICredits = 1000 unchanged.
Compiler default resolution
- Replace hard-coded "500000" fallbacks in daily AI credit resolution with the shared constant.
- Preserve compiler-process enterprise override behavior via GH_AW_DEFAULT_MAX_DAILY_AI_CREDITS for compile-time resolution and logging.
Runtime guardrail env wiring
- Make emitted workflow guardrail env values check GitHub Actions default vars first, then fall back to built-in constants.
- For daily guardrails, emit GH_AW_MAX_DAILY_AI_CREDITS: ${{ vars.GH_AW_DEFAULT_MAX_DAILY_AI_CREDITS || '5000' }} when frontmatter does not set a value.
- For per-run AWF guardrails, emit GH_AW_MAX_AI_CREDITS: ${{ vars.GH_AW_DEFAULT_MAX_AI_CREDITS || '1000' }} when frontmatter does not set a value, and update the generated AWF config at runtime from that env value.
- Preserve explicit frontmatter values ahead of runtime defaults, and preserve -1 handling for per-run disablement.
Compile log verification
- Make the compiler emit explicit debug log lines for resolved defaults:
  - daily guardrail resolution in daily_aic_workflow.go
  - AWF per-run credit resolution in awf_config.go
- Add an integration test that runs gh aw compile with debug logging, writes the combined output to a compile.log, and asserts both defaults are present.
Test and golden updates
- Add helper coverage for the runtime daily-default and per-run default expression builders.
- Add sanity unit tests that compile workflows and assert generated lock.yml output contains the expected per-run and daily fallback values.
- Update unit tests that encoded the previous daily default behavior.
- Refresh wasm golden outputs and regenerated .lock.yml files so compiled workflow output now reflects the runtime fallback order for both metrics.

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

pelikhan · 2026-06-09T17:56:54Z

          GH_AW_WORKFLOW_DISPATCH_AW_CONTEXT: ${{ github.event.inputs.aw_context || '' }}
          GH_AW_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          GH_AW_MAX_DAILY_AI_CREDITS: "500000"
+          GH_AW_MAX_DAILY_AI_CREDITS: "5000"


@copilot this value should first look up the env variable gh aw default max daily ai credits

Fixed in ef514cd. The emitted guardrail now uses vars.GH_AW_DEFAULT_MAX_DAILY_AI_CREDITS first and only falls back to the compiler-resolved default.

pelikhan · 2026-06-09T17:57:02Z

          GH_AW_WORKFLOW_DISPATCH_AW_CONTEXT: ${{ github.event.inputs.aw_context || '' }}
          GH_AW_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          GH_AW_MAX_DAILY_AI_CREDITS: "500000"
+          GH_AW_MAX_DAILY_AI_CREDITS: "5000"


@copilot this value should first look up the env variable gh aw default daily ai credits

Fixed in ef514cd. The compiled guardrail env now checks vars.GH_AW_DEFAULT_MAX_DAILY_AI_CREDITS before falling back to the default value.

pelikhan · 2026-06-09T17:57:10Z

          GH_AW_WORKFLOW_DISPATCH_AW_CONTEXT: ${{ github.event.inputs.aw_context || '' }}
          GH_AW_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          GH_AW_MAX_DAILY_AI_CREDITS: "500000"
+          GH_AW_MAX_DAILY_AI_CREDITS: "5000"


See other comments

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

pelikhan · 2026-06-09T18:29:59Z

@copilot the following fallback logic should be applied for each metric. Recompile and validate that it is correctly configured.

 frontmatter value -> env.gh default value -> constant value

Add sanity unit tests to validate that the lock.yml files contains those values

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-06-09T18:51:02Z

@copilot the following fallback logic should be applied for each metric. Recompile and validate that it is correctly configured.
 frontmatter value -> env.gh default value -> constant value

...

Addressed in 1404779. The compiled workflows now use frontmatter → GitHub Actions default var → built-in constant for both AI credit guardrails, and I added sanity tests that assert the generated lock files contain those values.

Copilot

Pull request overview

Updates compiler and emitted workflow runtime wiring so daily and per-run AI credit guardrails consistently resolve as: frontmatter value → GitHub Actions repo variable (vars.*) → built-in default, while also refreshing generated .lock.yml/golden outputs and adding test coverage around the new behavior.

Changes:

Emit runtime vars.* || '<builtin>' expressions for GH_AW_MAX_DAILY_AI_CREDITS (default 5000) and GH_AW_MAX_AI_CREDITS (default 1000) in compiled workflows.
Add per-run credit env injection across engines and a runtime AWF-config updater script to apply GH_AW_MAX_AI_CREDITS to apiProxy.maxAiCredits (including -1 disablement).
Add/adjust unit + integration tests and regenerate wasm goldens and repository workflow .lock.yml files.

Show a summary per file

File	Description
pkg/workflow/testdata/TestWasmGolden_CompileFixtures/with-imports.golden	Golden update for daily vars-fallback + per-run max-ai-credits env + runtime AWF config patching script.
pkg/workflow/testdata/TestWasmGolden_CompileFixtures/smoke-copilot.golden	Golden update for daily vars-fallback + per-run max-ai-credits env + runtime AWF config patching script.
pkg/workflow/testdata/TestWasmGolden_CompileFixtures/playwright-cli-mode.golden	Golden update for daily vars-fallback + per-run max-ai-credits env + runtime AWF config patching script.
pkg/workflow/testdata/TestWasmGolden_CompileFixtures/basic-copilot.golden	Golden update for daily vars-fallback + per-run max-ai-credits env + runtime AWF config patching script.
pkg/workflow/testdata/TestWasmGolden_AllEngines/pi.golden	Golden update for daily vars-fallback + per-run max-ai-credits env + runtime AWF config patching script.
pkg/workflow/testdata/TestWasmGolden_AllEngines/gemini.golden	Golden update for daily vars-fallback + per-run max-ai-credits env + runtime AWF config patching script.
pkg/workflow/testdata/TestWasmGolden_AllEngines/copilot.golden	Golden update for daily vars-fallback + per-run max-ai-credits env + runtime AWF config patching script.
pkg/workflow/testdata/TestWasmGolden_AllEngines/codex.golden	Golden update for daily vars-fallback + per-run max-ai-credits env + runtime AWF config patching script.
pkg/workflow/testdata/TestWasmGolden_AllEngines/claude.golden	Golden update for daily vars-fallback + per-run max-ai-credits env + runtime AWF config patching script.
pkg/workflow/pi_engine.go	Inject per-run max AI credits env into Pi engine execution env.
pkg/workflow/opencode_engine.go	Inject per-run max AI credits env into OpenCode engine env.
pkg/workflow/gemini_engine.go	Inject per-run max AI credits env into Gemini engine env.
pkg/workflow/engine.go	Add shared per-run max AI credits env injection with runtime vars-fallback.
pkg/workflow/daily_aic_workflow.go	Switch daily default wiring to runtime vars-fallback expression and add default-resolution debug logs.
pkg/workflow/daily_aic_workflow_guardrail_test.go	Update daily guardrail default-resolution unit tests for new expression-based defaults.
pkg/workflow/crush_engine.go	Inject per-run max AI credits env into Crush engine env.
pkg/workflow/copilot_engine_execution.go	Inject per-run max AI credits env into Copilot engine env.
pkg/workflow/compilerenv/manager.go	Add helpers to build `vars.*
pkg/workflow/compilerenv/manager_test.go	Add tests for new expression builders and update daily default fallback expectations.
pkg/workflow/codex_engine.go	Inject per-run max AI credits env into Codex engine env.
pkg/workflow/claude_engine.go	Inject per-run max AI credits env into Claude engine env.
pkg/workflow/awf_helpers.go	Add runtime AWF-config update script to apply GH_AW_MAX_AI_CREDITS at runtime.
pkg/workflow/awf_config.go	Add debug log for resolved maxAiCredits in generated AWF config.
pkg/workflow/awf_config_test.go	Add test asserting the AWF runtime updater script is included.
pkg/workflow/antigravity_engine.go	Inject per-run max AI credits env into Antigravity engine env.
pkg/workflow/ai_credits_lock_test.go	New unit tests asserting compiled lock output contains the expected fallback expressions and respects explicit frontmatter values.
pkg/constants/constants.go	Introduce built-in daily default constant (5000).
pkg/cli/env_command_test.go	Update defaults-file tests for new daily default value.
pkg/cli/compile_integration_test.go	Add integration test asserting compile debug logs include resolved daily/per-run defaults.
.github/workflows/test-workflow.lock.yml	Regenerated lock workflow with daily vars-fallback and per-run max-ai-credits env + runtime AWF config patching script.
.github/workflows/smoke-ci.lock.yml	Regenerated lock workflow with daily vars-fallback and per-run max-ai-credits env + runtime AWF config patching script.
.github/workflows/release.lock.yml	Regenerated lock workflow with daily vars-fallback and per-run max-ai-credits env + runtime AWF config patching script.
.github/workflows/hippo-embed.lock.yml	Regenerated lock workflow with daily vars-fallback and per-run max-ai-credits env + runtime AWF config patching script.
.github/workflows/firewall.lock.yml	Regenerated lock workflow with daily vars-fallback and per-run max-ai-credits env + runtime AWF config patching script.
.github/workflows/example-permissions-warning.lock.yml	Regenerated lock workflow with daily vars-fallback and per-run max-ai-credits env + runtime AWF config patching script.
.github/workflows/daily-max-ai-credits-test.lock.yml	Regenerated lock workflow with per-run max-ai-credits env + runtime AWF config patching script (including explicit max-ai-credits cases).
.github/workflows/daily-malicious-code-scan.lock.yml	Regenerated lock workflow with per-run max-ai-credits env + runtime AWF config patching script.
.github/workflows/daily-credit-limit-test.lock.yml	Regenerated lock workflow with per-run max-ai-credits env + runtime AWF config patching script.
.github/workflows/daily-community-attribution.lock.yml	Regenerated lock workflow with per-run max-ai-credits env + runtime AWF config patching script.
.github/workflows/daily-cache-strategy-analyzer.lock.yml	Regenerated lock workflow with per-run max-ai-credits env + runtime AWF config patching script.
.github/workflows/daily-byok-ollama-test.lock.yml	Regenerated lock workflow with per-run max-ai-credits env + runtime AWF config patching script.
.github/workflows/constraint-solving-potd.lock.yml	Regenerated lock workflow with per-run max-ai-credits env + runtime AWF config patching script.
.github/workflows/codex-github-remote-mcp-test.lock.yml	Regenerated lock workflow with per-run max-ai-credits env + runtime AWF config patching script.
.github/workflows/code-simplifier.lock.yml	Regenerated lock workflow with per-run max-ai-credits env + runtime AWF config patching script.
.github/workflows/bot-detection.lock.yml	Regenerated lock workflow with per-run max-ai-credits env + runtime AWF config patching script.
.github/workflows/ai-moderator.lock.yml	Regenerated lock workflow with per-run max-ai-credits env + runtime AWF config patching script.
.github/workflows/agentic-token-optimizer.lock.yml	Regenerated lock workflow with daily vars-fallback and per-run max-ai-credits env + runtime AWF config patching script.
.github/workflows/agent-persona-explorer.lock.yml	Regenerated lock workflow with per-run max-ai-credits env + runtime AWF config patching script.
.github/workflows/ace-editor.lock.yml	Regenerated lock workflow with per-run max-ai-credits env + runtime AWF config patching script.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 94/277 changed files
Comments generated: 4

+	cmd := exec.Command(setup.binaryPath, "compile", testWorkflowPath)
+	cmd.Env = append(os.Environ(), "DEBUG=workflow:daily_effective_workflow,workflow:awf_config")
+	output, err := cmd.CombinedOutput()


+func resolveDefaultMaxDailyAIC() *string {
+	return parseMaxDailyAICValue(compilerenv.BuildDefaultMaxDailyAICreditsExpression(constants.DefaultMaxDailyAICredits))
+}
+
 func resolveMaxDailyAIC(frontmatter map[string]any, importedJSON string) *string {


+	t.Run("uses GitHub variable fallback when unset even with compiler env override", func(t *testing.T) {
 		t.Setenv(compilerenv.DefaultMaxDailyAICredits, "2222")
 		got := resolveMaxDailyAIC(map[string]any{}, "")
-		if got == nil || *got != "2222" {
-			t.Fatalf("expected enterprise default, got %v", got)
+		if got == nil || *got != "${{ vars.GH_AW_DEFAULT_MAX_DAILY_AI_CREDITS || '5000' }}" {
+			t.Fatalf("expected GitHub variable fallback with built-in default, got %v", got)


 	}
+	awfConfigLog.Printf("API proxy: resolved maxAiCredits=%d", maxAICredits)


Copilot AI and others added 2 commits June 9, 2026 17:43

Update AI credit defaults and tests

cc85baf

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Update wasm golden defaults

9deba8a

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI assigned Copilot and pelikhan Jun 9, 2026

Copilot AI changed the title ~~Validate default AI credit limits in compiler and compile logs~~ Validate default AI credit guardrails in compiler output and compile logs Jun 9, 2026

Copilot created this pull request from a session on behalf of pelikhan June 9, 2026 17:48 View session

Copilot AI requested a review from pelikhan June 9, 2026 17:48

Copilot finished work on behalf of pelikhan June 9, 2026 17:48

Merge branch 'main' into copilot/validate-default-ai-credits

59f2cbf

pelikhan reviewed Jun 9, 2026

View reviewed changes

Copilot started work on behalf of pelikhan June 9, 2026 17:58 View session

Copilot AI and others added 4 commits June 9, 2026 18:03

chore: start addressing review feedback

b565cc8

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

revert: remove accidental lockfile progress commit

a65e293

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Respect runtime daily AI credit defaults in emitted guardrails

fe209c7

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Refactor default daily AI credit resolution

ef514cd

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI changed the title ~~Validate default AI credit guardrails in compiler output and compile logs~~ Validate default AI credit guardrails in compiler output, runtime env wiring, and compile logs Jun 9, 2026

Copilot AI requested a review from pelikhan June 9, 2026 18:16

Copilot finished work on behalf of pelikhan June 9, 2026 18:16

Merge branch 'main' into copilot/validate-default-ai-credits

75f3890

Copilot started work on behalf of pelikhan June 9, 2026 18:30 View session

Copilot AI and others added 2 commits June 9, 2026 18:36

Plan review feedback follow-up

80e61b7

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Apply runtime AI credit fallback wiring

1404779

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan June 9, 2026 18:51

Merge branch 'main' into copilot/validate-default-ai-credits

0b76f97

pelikhan marked this pull request as ready for review June 9, 2026 18:57

Copilot AI review requested due to automatic review settings June 9, 2026 18:57

Copilot started reviewing on behalf of pelikhan June 9, 2026 18:58 View session

pelikhan closed this Jun 9, 2026

Copilot AI reviewed Jun 9, 2026

View reviewed changes

github-actions Bot deleted the copilot/validate-default-ai-credits branch June 29, 2026 16:52

Navigation Menu

Uh oh!

Validate default AI credit guardrails in compiler output, runtime env wiring, and compile logs - #38184

Validate default AI credit guardrails in compiler output, runtime env wiring, and compile logs#38184
pelikhan with Copilot wants to merge 11 commits into
mainfrom
copilot/validate-default-ai-credits

Copilot AI commented Jun 9, 2026 •

edited

Loading

Uh oh!

pelikhan Jun 9, 2026

Uh oh!

Copilot AI Jun 9, 2026

Uh oh!

pelikhan Jun 9, 2026

Uh oh!

Copilot AI Jun 9, 2026

Uh oh!

pelikhan Jun 9, 2026

Uh oh!

pelikhan commented Jun 9, 2026

Uh oh!

Copilot AI commented Jun 9, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		}
		awfConfigLog.Printf("API proxy: resolved maxAiCredits=%d", maxAICredits)

Uh oh!

Conversation

Copilot AI commented Jun 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pelikhan Jun 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jun 9, 2026

Choose a reason for hiding this comment

Uh oh!

pelikhan Jun 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jun 9, 2026

Choose a reason for hiding this comment

Uh oh!

pelikhan Jun 9, 2026

Choose a reason for hiding this comment

Uh oh!

pelikhan commented Jun 9, 2026

Uh oh!

Copilot AI commented Jun 9, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Copilot's findings

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Jun 9, 2026 •

edited

Loading