Allow Daily Safe Output Integrator to create its temp coverage script

[Copilot]

The Daily Safe Output Integrator was repeatedly exhausting its shell denial budget instead of completing its safe-output coverage pass. The workflow prompt expected a temporary analysis script under /tmp/gh-aw/agent/, but the shell allowlist did not permit creating that file.

• Workflow allowlist

  • Adds an explicit shell allowlist entry for creating the temporary Python script the workflow already expects:

    tools:
      bash:
        - cat > /tmp/gh-aw/agent/*.py
        - python3 *

• Prompt guidance

  • Tightens the workflow instructions to steer the agent toward the allowed /tmp/gh-aw/agent/ path.
  • Clarifies that the agent should not retry alternate shell-redirection paths once this path is available.

• Regression coverage

  • Adds a focused workflow test that verifies:
    • the markdown source includes the temp-script allowlist entry
    • the compiled lock file carries the corresponding shell(...) permission

This keeps the change scoped to the failing workflow while locking in the expected temp-script creation path in both source and compiled output.

---

pr-sous-chef run https://github.com/github/gh-aw/actions/runs/28317576838

Generated by 👨‍🍳 PR Sous Chef · 70.2 AIC · ⌖ 1.04 AIC · ⊞ 17.1K · ◷

[pelikhan]

@copilot merge main and recompile

[Copilot]

Pull request overview

This PR updates the “Daily Safe Output Integrator” agentic workflow so it can create a temporary Python analysis script under /tmp/gh-aw/agent/ without exhausting its shell-denial budget, and adds a regression test to ensure both the workflow source and compiled lock carry the expected permission.

Changes:

• Adds a bash tool allowlist entry for cat > /tmp/gh-aw/agent/*.py in the workflow markdown source.
• Tightens workflow prompt guidance to steer script creation to /tmp/gh-aw/agent/.
• Adds a Go unit test to assert the source and compiled lock include the expected allowlist/shell(...) permission.

Show a summary per file

File	Description
pkg/workflow/daily_safe_output_integrator_workflow_test.go	New test asserting the workflow source and lock file include the temp-script allowlist and compiled shell(...) permission.
.github/workflows/daily-safe-output-integrator.md	Adds the cat > /tmp/gh-aw/agent/*.py allowlist entry and new prompt guidance for temp script creation.
.github/workflows/daily-safe-output-integrator.lock.yml	Compiled workflow update to carry the corresponding --allow-tool shell(cat > /tmp/gh-aw/agent/*.py) permission.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 3/3 changed files
• Comments generated: 2
• Review effort level: Low

[gh-aw-bot]

@copilot please run the pr-finisher skill, refresh the branch if needed, address any unresolved review feedback, and rerun checks so this PR can move forward.

Generated by 👨‍🍳 PR Sous Chef · 70.2 AIC · ⌖ 1.04 AIC · ⊞ 17.1K · ◷

[github-actions]

🎉 This pull request is included in a new release.

Release: v0.82.0