From cc84379598f6bb22dee22270e73c50c36a1c5490 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Tue, 28 Jul 2026 17:04:42 +0000 Subject: [PATCH 1/2] chore: plan checkout cache for cgo.yml jobs Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> --- .github/workflows/daily-spending-forecast.lock.yml | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/.github/workflows/daily-spending-forecast.lock.yml b/.github/workflows/daily-spending-forecast.lock.yml index 2fe96ea5cce..018f9ff8a6c 100644 --- a/.github/workflows/daily-spending-forecast.lock.yml +++ b/.github/workflows/daily-spending-forecast.lock.yml @@ -737,6 +737,7 @@ jobs: GH_AW_SAFE_OUTPUTS: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS }} GH_AW_SAFE_OUTPUTS_CONFIG_PATH: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS_CONFIG_PATH }} GH_AW_SAFE_OUTPUTS_TOOLS_PATH: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS_TOOLS_PATH }} + GH_AW_SINK_VISIBILITY: ${{ steps.determine-automatic-lockdown.outputs.visibility }} GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} run: | set -eo pipefail @@ -758,11 +759,11 @@ jobs: MCP_GATEWAY_UID=$(id -u 2>/dev/null || echo '0') MCP_GATEWAY_GID=$(id -g 2>/dev/null || echo '0') source "${RUNNER_TEMP}/gh-aw/actions/resolve_docker_socket_gid.sh" - export MCP_GATEWAY_DOCKER_COMMAND='docker run -i --rm --network bridge -p 127.0.0.1:'"${MCP_GATEWAY_PORT}"':'"${MCP_GATEWAY_PORT}"' --name awmg-mcpg --add-host host.docker.internal:host-gateway --user '"${MCP_GATEWAY_UID}"':'"${MCP_GATEWAY_GID}"' --group-add '"${DOCKER_SOCK_GID}"' -v '"${DOCKER_SOCK_PATH}"':/var/run/docker.sock -e MCP_GATEWAY_PORT -e MCP_GATEWAY_DOMAIN -e MCP_GATEWAY_API_KEY -e MCP_GATEWAY_PAYLOAD_DIR -e MCP_GATEWAY_PAYLOAD_SIZE_THRESHOLD -e DOCKER_HOST=unix:///var/run/docker.sock -e DEBUG -e MCP_GATEWAY_LOG_DIR -e GH_AW_MCP_LOG_DIR -e GH_AW_SAFE_OUTPUTS -e GH_AW_SAFE_OUTPUTS_CONFIG_PATH -e GH_AW_SAFE_OUTPUTS_TOOLS_PATH -e GH_AW_POLICY_ALLOW_CREATE_PULL_REQUEST -e GH_AW_ASSETS_BRANCH -e GH_AW_ASSETS_MAX_SIZE_KB -e GH_AW_ASSETS_ALLOWED_EXTS -e DEFAULT_BRANCH -e GITHUB_MCP_SERVER_TOKEN -e GITHUB_MCP_GUARD_MIN_INTEGRITY -e GITHUB_MCP_GUARD_REPOS -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e GITHUB_SHA -e GITHUB_WORKSPACE -e GITHUB_TOKEN -e GITHUB_RUN_ID -e GITHUB_RUN_NUMBER -e GITHUB_RUN_ATTEMPT -e GITHUB_JOB -e GITHUB_ACTION -e GITHUB_EVENT_NAME -e GITHUB_EVENT_PATH -e GITHUB_ACTOR -e GITHUB_ACTOR_ID -e GITHUB_TRIGGERING_ACTOR -e GITHUB_WORKFLOW -e GITHUB_WORKFLOW_REF -e GITHUB_WORKFLOW_SHA -e GITHUB_REF -e GITHUB_REF_NAME -e GITHUB_REF_TYPE -e GITHUB_HEAD_REF -e GITHUB_BASE_REF -e RUNNER_TEMP -v /tmp/gh-aw/mcp-payloads:/tmp/gh-aw/mcp-payloads:rw -v /opt:/opt:ro -v /tmp:/tmp:rw -v '"${GITHUB_WORKSPACE}"':'"${GITHUB_WORKSPACE}"':rw -v '"${RUNNER_TEMP}"'/gh-aw/safeoutputs:'"${RUNNER_TEMP}"'/gh-aw/safeoutputs:rw ghcr.io/github/gh-aw-mcpg:v0.4.6' + export MCP_GATEWAY_DOCKER_COMMAND='docker run -i --rm --network bridge -p 127.0.0.1:'"${MCP_GATEWAY_PORT}"':'"${MCP_GATEWAY_PORT}"' --name awmg-mcpg --add-host host.docker.internal:host-gateway --user '"${MCP_GATEWAY_UID}"':'"${MCP_GATEWAY_GID}"' --group-add '"${DOCKER_SOCK_GID}"' -v '"${DOCKER_SOCK_PATH}"':/var/run/docker.sock -e MCP_GATEWAY_PORT -e MCP_GATEWAY_DOMAIN -e MCP_GATEWAY_API_KEY -e MCP_GATEWAY_PAYLOAD_DIR -e MCP_GATEWAY_PAYLOAD_SIZE_THRESHOLD -e DOCKER_HOST=unix:///var/run/docker.sock -e DEBUG -e MCP_GATEWAY_LOG_DIR -e GH_AW_MCP_LOG_DIR -e GH_AW_SAFE_OUTPUTS -e GH_AW_SAFE_OUTPUTS_CONFIG_PATH -e GH_AW_SAFE_OUTPUTS_TOOLS_PATH -e GH_AW_POLICY_ALLOW_CREATE_PULL_REQUEST -e GH_AW_ASSETS_BRANCH -e GH_AW_ASSETS_MAX_SIZE_KB -e GH_AW_ASSETS_ALLOWED_EXTS -e DEFAULT_BRANCH -e GITHUB_MCP_SERVER_TOKEN -e GITHUB_MCP_GUARD_MIN_INTEGRITY -e GITHUB_MCP_GUARD_REPOS -e GH_AW_SINK_VISIBILITY -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e GITHUB_SHA -e GITHUB_WORKSPACE -e GITHUB_TOKEN -e GITHUB_RUN_ID -e GITHUB_RUN_NUMBER -e GITHUB_RUN_ATTEMPT -e GITHUB_JOB -e GITHUB_ACTION -e GITHUB_EVENT_NAME -e GITHUB_EVENT_PATH -e GITHUB_ACTOR -e GITHUB_ACTOR_ID -e GITHUB_TRIGGERING_ACTOR -e GITHUB_WORKFLOW -e GITHUB_WORKFLOW_REF -e GITHUB_WORKFLOW_SHA -e GITHUB_REF -e GITHUB_REF_NAME -e GITHUB_REF_TYPE -e GITHUB_HEAD_REF -e GITHUB_BASE_REF -e RUNNER_TEMP -v /tmp/gh-aw/mcp-payloads:/tmp/gh-aw/mcp-payloads:rw -v /opt:/opt:ro -v /tmp:/tmp:rw -v '"${GITHUB_WORKSPACE}"':'"${GITHUB_WORKSPACE}"':rw -v '"${RUNNER_TEMP}"'/gh-aw/safeoutputs:'"${RUNNER_TEMP}"'/gh-aw/safeoutputs:rw ghcr.io/github/gh-aw-mcpg:v0.4.6' mkdir -p "$HOME/.copilot" GH_AW_NODE=$(which node 2>/dev/null || command -v node 2>/dev/null || echo node) - cat << GH_AW_MCP_CONFIG_4372d8b74e23dfe8_EOF | "$GH_AW_NODE" "${RUNNER_TEMP}/gh-aw/actions/start_mcp_gateway.cjs" + cat << GH_AW_MCP_CONFIG_fae66f5fc44e6d30_EOF | "$GH_AW_NODE" "${RUNNER_TEMP}/gh-aw/actions/start_mcp_gateway.cjs" { "mcpServers": { "agenticworkflows": { @@ -781,7 +782,7 @@ jobs: "accept": [ "*" ], - "sink-visibility": ${{ toJSON(steps.determine-automatic-lockdown.outputs.visibility) }} + "sink-visibility": "${GH_AW_SINK_VISIBILITY}" } } }, @@ -814,7 +815,7 @@ jobs: "accept": [ "*" ], - "sink-visibility": ${{ toJSON(steps.determine-automatic-lockdown.outputs.visibility) }} + "sink-visibility": "${GH_AW_SINK_VISIBILITY}" } } } @@ -827,7 +828,7 @@ jobs: "startupTimeout": 120 } } - GH_AW_MCP_CONFIG_4372d8b74e23dfe8_EOF + GH_AW_MCP_CONFIG_fae66f5fc44e6d30_EOF - name: Mount MCP servers as CLIs id: mount-mcp-clis continue-on-error: true From da8a0669ec54e6ff630e6f5acb82799d3b9881e8 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Tue, 28 Jul 2026 17:12:50 +0000 Subject: [PATCH 2/2] feat: cache checkout in cgo.yml to reduce GitHub API calls Add a checkout-cache job that checks out with persist-credentials: false and saves to actions/cache. All ubuntu-latest jobs restore from cache instead of calling actions/checkout. Jobs needing fetch-depth: 0 or running on non-Linux platforms keep direct checkout. Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> --- .github/workflows/cgo.yml | 161 ++++++++++++++++++++++++++++++-------- 1 file changed, 129 insertions(+), 32 deletions(-) diff --git a/.github/workflows/cgo.yml b/.github/workflows/cgo.yml index b05de076e80..b410819ff63 100644 --- a/.github/workflows/cgo.yml +++ b/.github/workflows/cgo.yml @@ -39,7 +39,24 @@ on: - 'install-gh-aw.sh' workflow_dispatch: jobs: + checkout-cache: + runs-on: ubuntu-latest + timeout-minutes: 5 + permissions: + contents: read + steps: + - name: Checkout code + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false + - name: Cache repository checkout + uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 + with: + path: . + key: checkout-${{ github.sha }} + verify-integration-build: + needs: [checkout-cache] runs-on: ubuntu-latest timeout-minutes: 15 permissions: @@ -48,8 +65,12 @@ jobs: group: ci-${{ github.ref }}-verify-integration-build cancel-in-progress: true steps: - - name: Checkout code - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - name: Restore checkout + uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 + with: + path: . + key: checkout-${{ github.sha }} + fail-on-cache-miss: true - name: Set up Go id: setup-go @@ -118,6 +139,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 15 needs: + - checkout-cache - verify-integration-build permissions: contents: read @@ -141,8 +163,12 @@ jobs: group: ci-${{ github.ref }}-test-${{ matrix.shard }} cancel-in-progress: true steps: - - name: Checkout code - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - name: Restore checkout + uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 + with: + path: . + key: checkout-${{ github.sha }} + fail-on-cache-miss: true - name: Set up Go id: setup-go @@ -285,13 +311,18 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 15 needs: + - checkout-cache - test if: always() && needs.test.result == 'success' # Skip coverage check for cancelled/failed test runs permissions: contents: read steps: - - name: Checkout code - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - name: Restore checkout + uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 + with: + path: . + key: checkout-${{ github.sha }} + fail-on-cache-miss: true - name: List unit tests in codebase run: | @@ -372,6 +403,7 @@ jobs: run: make test-impacted-go BASE_REF=origin/main CI_COVERAGE_SOURCE_BRANCH=main build: + needs: [checkout-cache] runs-on: ubuntu-latest timeout-minutes: 15 permissions: @@ -380,8 +412,12 @@ jobs: group: ci-${{ github.ref }}-build cancel-in-progress: true steps: - - name: Checkout code - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - name: Restore checkout + uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 + with: + path: . + key: checkout-${{ github.sha }} + fail-on-cache-miss: true - name: Set up Node.js id: setup-node uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6 @@ -460,6 +496,7 @@ jobs: GH_TOKEN: ${{ github.token }} build-wasm: + needs: [checkout-cache] runs-on: ubuntu-latest timeout-minutes: 15 permissions: @@ -468,8 +505,12 @@ jobs: group: ci-${{ github.ref }}-build-wasm cancel-in-progress: true steps: - - name: Checkout code - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - name: Restore checkout + uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 + with: + path: . + key: checkout-${{ github.sha }} + fail-on-cache-miss: true - name: Set up Go id: setup-go @@ -555,13 +596,18 @@ jobs: run: node scripts/test-wasm-golden.mjs validate-yaml: + needs: [checkout-cache] runs-on: ubuntu-latest timeout-minutes: 10 permissions: contents: read steps: - - name: Checkout code - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - name: Restore checkout + uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 + with: + path: . + key: checkout-${{ github.sha }} + fail-on-cache-miss: true - name: Check for ANSI escape sequences in YAML files run: | @@ -1008,6 +1054,7 @@ jobs: bench: # Only run benchmarks on main branch for performance tracking if: github.ref == 'refs/heads/main' + needs: [checkout-cache] runs-on: ubuntu-latest timeout-minutes: 20 permissions: @@ -1017,8 +1064,12 @@ jobs: group: ci-${{ github.ref }}-bench cancel-in-progress: true steps: - - name: Checkout code - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - name: Restore checkout + uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 + with: + path: . + key: checkout-${{ github.sha }} + fail-on-cache-miss: true - name: Set up Go id: setup-go @@ -1171,6 +1222,7 @@ jobs: check-validator-sizes: name: Check validator file sizes + needs: [checkout-cache] runs-on: ubuntu-latest timeout-minutes: 10 # Non-blocking: report violations but don't fail the build until existing files are cleaned up @@ -1178,8 +1230,12 @@ jobs: permissions: contents: read steps: - - name: Checkout code - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - name: Restore checkout + uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 + with: + path: . + key: checkout-${{ github.sha }} + fail-on-cache-miss: true - name: Check validator file sizes id: check @@ -1313,6 +1369,7 @@ jobs: run: make lint-action-sh lint-error-messages: + needs: [checkout-cache] runs-on: ubuntu-latest timeout-minutes: 10 permissions: @@ -1321,8 +1378,12 @@ jobs: group: ci-${{ github.ref }}-lint-error-messages cancel-in-progress: true steps: - - name: Checkout code - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - name: Restore checkout + uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 + with: + path: . + key: checkout-${{ github.sha }} + fail-on-cache-miss: true - name: Set up Go uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6 @@ -1335,6 +1396,7 @@ jobs: run: make lint-errors actions-build: + needs: [checkout-cache] runs-on: ubuntu-latest timeout-minutes: 10 permissions: @@ -1343,8 +1405,12 @@ jobs: group: ci-${{ github.ref }}-actions-build cancel-in-progress: true steps: - - name: Checkout code - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - name: Restore checkout + uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 + with: + path: . + key: checkout-${{ github.sha }} + fail-on-cache-miss: true - name: Set up Go id: setup-go @@ -1397,6 +1463,7 @@ jobs: fuzz: # Only run fuzz tests on main branch (10s is insufficient for PRs) if: github.ref == 'refs/heads/main' + needs: [checkout-cache] runs-on: ubuntu-latest timeout-minutes: 20 permissions: @@ -1441,8 +1508,12 @@ jobs: FuzzParseInputDefinition:./pkg/workflow/ FuzzParseInputDefinitions:./pkg/workflow/ steps: - - name: Checkout code - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - name: Restore checkout + uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 + with: + path: . + key: checkout-${{ github.sha }} + fail-on-cache-miss: true - name: Set up Go id: setup-go @@ -1564,6 +1635,7 @@ jobs: retention-days: 7 security: + needs: [checkout-cache] runs-on: ubuntu-latest timeout-minutes: 15 permissions: @@ -1572,8 +1644,12 @@ jobs: group: ci-${{ github.ref }}-security cancel-in-progress: true steps: - - name: Checkout code - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - name: Restore checkout + uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 + with: + path: . + key: checkout-${{ github.sha }} + fail-on-cache-miss: true - name: Set up Go id: setup-go @@ -1623,6 +1699,7 @@ jobs: security-scan: # Only run security scans on main branch to reduce PR overhead if: github.ref == 'refs/heads/main' + needs: [checkout-cache] runs-on: ubuntu-latest timeout-minutes: 10 # Prevent jobs from hanging indefinitely permissions: @@ -1644,8 +1721,12 @@ jobs: cancel-in-progress: true name: "Security Scan: ${{ matrix.tool.name }}" steps: - - name: Checkout code - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - name: Restore checkout + uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 + with: + path: . + key: checkout-${{ github.sha }} + fail-on-cache-miss: true - name: Set up Go id: setup-go @@ -1693,6 +1774,7 @@ jobs: run: ./gh-aw compile poem-bot ${{ matrix.tool.flag }} --verbose mcp-server-compile-test: + needs: [checkout-cache] runs-on: ubuntu-latest timeout-minutes: 10 permissions: @@ -1701,8 +1783,12 @@ jobs: group: ci-${{ github.ref }}-mcp-server-compile-test cancel-in-progress: true steps: - - name: Checkout code - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - name: Restore checkout + uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 + with: + path: . + key: checkout-${{ github.sha }} + fail-on-cache-miss: true - name: Set up Go id: setup-go @@ -2250,6 +2336,7 @@ jobs: alpine-container-test: name: Alpine Container Test + needs: [checkout-cache] runs-on: ubuntu-latest timeout-minutes: 20 permissions: @@ -2258,8 +2345,12 @@ jobs: group: ci-${{ github.ref }}-alpine-container cancel-in-progress: true steps: - - name: Checkout code - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - name: Restore checkout + uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 + with: + path: . + key: checkout-${{ github.sha }} + fail-on-cache-miss: true - name: Set up Go id: setup-go @@ -2386,13 +2477,18 @@ jobs: rm -rf test-workspace safe-outputs-conformance: + needs: [checkout-cache] runs-on: ubuntu-latest timeout-minutes: 10 permissions: contents: read steps: - - name: Checkout code - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - name: Restore checkout + uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 + with: + path: . + key: checkout-${{ github.sha }} + fail-on-cache-miss: true - name: Run Safe Outputs Conformance Checker id: conformance @@ -2443,6 +2539,7 @@ jobs: timeout-minutes: 5 if: always() && github.ref == 'refs/heads/main' needs: + - checkout-cache - verify-integration-build - test - canary-go