Treat gh aw as a first-class runtime with release setup-cli injection, dev source build, and firewall domains (#31622)

* Add gh-aw runtime detection and setup-cli mapping

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

* Address review feedback for gh-aw runtime

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

* Plan for addressing PR review feedback

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

* Use build/compiler version for gh-aw runtime default

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

* Refine gh-aw runtime default version resolution

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

* Pin gh-aw setup-cli refs in lock workflows

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

* Build gh-aw runtime from source in dev mode

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

* Strengthen dev-mode gh-aw runtime test assertions

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

* Cover gh-aw version check in dev runtime test

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Author: Copilot

.github/workflows/copilot-token-audit.lock.yml

@@ -726,6 +726,40 @@ func TestGenerateMainJobStepsWithDevMode(t *testing.T) {
 	}
 }
 
+func TestGenerateMainJobStepsWithDevMode_GhAwRuntimeBuildsFromSource(t *testing.T) {
+	originalRelease := IsRelease()
+	t.Cleanup(func() {
+		SetIsRelease(originalRelease)
+	})
+	SetIsRelease(false)
+
+	compiler := NewCompiler()
+	compiler.actionMode = ActionModeDev
+	compiler.stepOrderTracker = NewStepOrderTracker()
+
+	data := &WorkflowData{
+		Name:            "Test Workflow",
+		AI:              "copilot",
+		MarkdownContent: "Test prompt",
+		EngineConfig: &EngineConfig{
+			ID: "copilot",
+		},
+		ParsedTools: NewTools(nil),
+		Runtimes: map[string]any{
+			"gh-aw": map[string]any{},
+		},
+	}
+
+	var yaml strings.Builder
+	err := compiler.generateMainJobSteps(&yaml, data)
+	require.NoError(t, err, "generateMainJobSteps should not error in dev mode with gh-aw runtime")
+
+	result := yaml.String()
+	assert.Contains(t, result, "- name: Build and install gh-aw CLI from source")
+	assert.Contains(t, result, "gh extension install .")
+	assert.NotContains(t, result, "uses: github/gh-aw/actions/setup-cli@")
+}
+
 // TestGenerateMainJobStepsStepOrdering tests step ordering validation
 func TestGenerateMainJobStepsStepOrdering(t *testing.T) {
 	compiler := NewCompiler()

.github/workflows/copilot-token-optimizer.lock.yml

@@ -120,6 +120,12 @@
     "productionresultssa18.blob.core.windows.net",
     "productionresultssa19.blob.core.windows.net"
   ],
+  "gh-aw": [
+    "codeload.github.com",
+    "github.com",
+    "github.github.com",
+    "raw.githubusercontent.com"
+  ],
   "go": ["go.dev", "golang.org", "proxy.golang.org", "sum.golang.org", "pkg.go.dev", "goproxy.io", "storage.googleapis.com"],
   "haskell": ["haskell.org", "*.hackage.haskell.org", "get-ghcup.haskell.org", "downloads.haskell.org"],
   "java": [

.github/workflows/static-analysis-report.lock.yml

@@ -380,6 +380,7 @@ var runtimeToEcosystem = map[string]string{
 	"ruby":    "ruby",
 	"dotnet":  "dotnet",
 	"haskell": "haskell",
+	"gh-aw":   "gh-aw",
 	"bun":     "node",   // bun.sh is in the node ecosystem
 	"deno":    "node",   // deno.land is in the node ecosystem
 	"uv":      "python", // uv is a Python package manager

pkg/workflow/compiler_yaml_main_job_test.go

@@ -160,6 +160,8 @@ func parseRuntimesConfig(runtimes map[string]any) (*RuntimesConfig, error) {
 			config.Dotnet = runtimeConfig
 		case "elixir":
 			config.Elixir = runtimeConfig
+		case "gh-aw":
+			config.GhAw = runtimeConfig
 		case "haskell":
 			config.Haskell = runtimeConfig
 		case "java":

pkg/workflow/data/ecosystem_domains.json

@@ -24,6 +24,9 @@ func countRuntimes(config *RuntimesConfig) int {
 	if config.Deno != nil {
 		count++
 	}
+	if config.GhAw != nil {
+		count++
+	}
 	return count
 }
 
@@ -267,6 +270,7 @@ func runtimesConfigToMap(config *RuntimesConfig) map[string]any {
 		{"deno", config.Deno},
 		{"dotnet", config.Dotnet},
 		{"elixir", config.Elixir},
+		{"gh-aw", config.GhAw},
 		{"haskell", config.Haskell},
 		{"java", config.Java},
 		{"ruby", config.Ruby},

pkg/workflow/domains.go

@@ -26,6 +26,7 @@ type RuntimesConfig struct {
 	Deno    *RuntimeConfig `json:"deno,omitempty"`    // Deno runtime
 	Dotnet  *RuntimeConfig `json:"dotnet,omitempty"`  // .NET runtime
 	Elixir  *RuntimeConfig `json:"elixir,omitempty"`  // Elixir runtime
+	GhAw    *RuntimeConfig `json:"gh-aw,omitempty"`   // gh-aw CLI runtime
 	Haskell *RuntimeConfig `json:"haskell,omitempty"` // Haskell runtime
 	Java    *RuntimeConfig `json:"java,omitempty"`    // Java runtime
 	Ruby    *RuntimeConfig `json:"ruby,omitempty"`    // Ruby runtime

pkg/workflow/frontmatter_parsing.go

@@ -88,6 +88,17 @@ var knownRuntimes = []*Runtime{
 		},
 		ManifestFiles: []string{"go.mod", "go.sum"},
 	},
+	{
+		ID:             "gh-aw",
+		Name:           "gh-aw CLI",
+		ActionRepo:     "github/gh-aw/actions/setup-cli",
+		ActionVersion:  "v0.72.1",
+		VersionField:   "version",
+		// Default version is computed at generation time from the current gh-aw build.
+		DefaultVersion: "",
+		Commands:       []string{"gh-aw"},
+		ManifestFiles:  nil,
+	},
 	{
 		ID:             "haskell",
 		Name:           "Haskell",