Allow shared workflow partials to define and merge `sandbox.agent.mounts` by Copilot · Pull Request #44500 · github/gh-aw

Copilot · 2026-07-09T05:38:09Z

Shared workflow partials could not declare sandbox, forcing every consuming main workflow to duplicate mount declarations. This change allows partials to carry sandbox.agent.mounts and merges mounts from imports + main workflow with deduped union semantics.

Shared-workflow schema/validation surface
- Removed sandbox from shared-workflow forbidden frontmatter fields so partials can declare sandbox config directly.
Import aggregation
- Extended import extraction to collect sandbox.agent.mounts from imported partials.
- Added MergedSandboxAgentMounts to import-processing output.
Compiler merge semantics
- Added sandbox merge step in engine/import setup:
  - union imported mounts with main workflow mounts
  - deduplicate entries
  - preserve sandbox.agent: false behavior (no mount injection when agent sandbox is disabled)
Resulting behavior
- Partial-local tool setup + mount declarations now remain co-located and propagate automatically to consumers.

# shared/setup-my-cli.md
---
sandbox:
  agent:
    mounts:
      - ${MY_CLI_PATH}/my-cli:${MY_CLI_PATH}/my-cli:ro
steps:
  - name: Set up my-cli
    uses: my-org/setup-my-cli@v2
---

# main workflow
---
on: issues
imports:
  - ./setup-my-cli.md
sandbox:
  agent:
    mounts:
      - /custom/main-mount:/custom/main-mount:ro
---

Compiled AWF invocation now includes the deduped union of both mount lists.

Generated by 👨‍🍳 PR Sous Chef · 8.9 AIC · ⌖ 5.99 AIC · ⊞ 4.7K · ◷
_{Comment /souschef to run again}

Generated by 👨‍🍳 PR Sous Chef · 6.57 AIC · ⌖ 6.74 AIC · ⊞ 7.1K · ◷
_{Comment /souschef to run again}

Generated by 👨‍🍳 PR Sous Chef · 9.71 AIC · ⌖ 6.72 AIC · ⊞ 7.1K · ◷
_{Comment /souschef to run again}

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot

Pull request overview

This PR enables shared (imported) workflow partials to declare sandbox.agent.mounts and have those mounts merged into the consuming main workflow’s sandbox configuration with union + deduplication semantics, while preserving sandbox.agent: false behavior.

Changes:

Allowed sandbox in shared workflow frontmatter by removing it from SharedWorkflowForbiddenFields.
Extended import processing to extract and aggregate sandbox.agent.mounts across imports into MergedSandboxAgentMounts.
Added a compiler merge step that unions imported mounts with main-workflow mounts (deduped) and skips injection when the agent sandbox is explicitly disabled.

Show a summary per file

File	Description
pkg/workflow/sandbox.go	Adds merge helper to union imported mounts into the effective sandbox config.
pkg/workflow/sandbox_test.go	Adds unit coverage for mount merge behavior (nil config, dedupe, disabled agent).
pkg/workflow/imports_test.go	Adds integration-style compile test asserting mounts appear once in the lock output.
pkg/workflow/compiler_orchestrator_engine.go	Wires imported mount merge into engine/import setup flow.
pkg/parser/import_processor.go	Extends `ImportsResult` to carry merged sandbox agent mounts from imports.
pkg/parser/import_field_extractor.go	Extracts/dedupes `sandbox.agent.mounts` from imported frontmatter into the accumulator/result.
pkg/constants/constants.go	Removes `sandbox` from shared-workflow forbidden fields list (schema surface change).

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 7/7 changed files
Comments generated: 0
Review effort level: Low

github-actions · 2026-07-09T11:06:41Z

❌ Test Quality Sentinel failed during test quality analysis.

github-actions · 2026-07-09T11:06:42Z

🧠 Matt Pocock Skills Reviewer is reviewing this pull request using Matt Pocock's engineering skills...

github-actions · 2026-07-09T11:06:44Z

❌ Design Decision Gate 🏗️ failed during design decision gate check.

github-actions · 2026-07-09T11:17:53Z

⚠️ PR Code Quality Reviewer failed during code quality review.

pelikhan · 2026-07-09T11:51:55Z

@copilot run pr-finisher skill

Copilot · 2026-07-09T12:12:03Z

@copilot run pr-finisher skill

PR finisher complete. All three merge-ready conditions satisfied:

✅ Reviews — no unresolved review threads; automated reviewer (copilot-pull-request-reviewer) left no action items.
✅ Checks (local) — make fmt, make lint (0 errors), make test-unit (all pass), make agent-report-progress (lock files in sync) all green.
❓ Checks (CI) — stale after agent push; needs human re-trigger. No prior CI failures were open.
✅ Mergeable — PR is open, not draft, no conflicts.

Hand-off: A maintainer needs to re-trigger CI (close/reopen, workflow_dispatch, or a push) before merging.

github-actions · 2026-07-09T13:37:29Z

🤖 PR Triage — Run §29020837798

Field	Value
Category	`feature`
Risk	🟡 Medium
Score	68 / 100
Action	🔄 `fast_track`

Score breakdown: Impact 33 + Urgency 20 + Quality 15

Rationale: Clean ergonomic improvement — partials can now carry sandbox.agent.mounts, eliminating cross-workflow duplication. Small, focused diff (243 +/ 8 −) with clear description and dedup semantics. Removes friction for shared workflow authors. Review focus: merge semantics correctness.

Generated by 🔧 PR Triage Agent · 77.6 AIC · ⌖ 14.7 AIC · ⊞ 5.4K · ◷

gh-aw-bot · 2026-07-09T14:02:03Z

@copilot please run the pr-finisher skill, make sure the branch is up to date, and rerun checks.

Generated by 👨‍🍳 PR Sous Chef · 12.1 AIC · ⌖ 6.75 AIC · ⊞ 4.7K · ◷
_{Comment /souschef to run again}

gh-aw-bot · 2026-07-10T01:53:27Z

@copilot please run the pr-finisher skill, address unresolved review comments, ensure the branch is up to date, and rerun checks.

Generated by 👨‍🍳 PR Sous Chef · 7.94 AIC · ⌖ 6.73 AIC · ⊞ 7.1K · ◷
_{Comment /souschef to run again}

…sandbox-field Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot · 2026-07-10T02:13:52Z

@copilot please run the pr-finisher skill, address unresolved review comments, ensure the branch is up to date, and rerun checks.

...

PR finisher complete. All three merge-ready conditions satisfied:

✅ Reviews — no unresolved review threads (0 inline comments from automated reviewer on 7/7 files).
✅ Checks (local) — make fmt, make lint (0 errors), make test-unit (all pass), make recompile (256/256 workflows compiled, 4 orphaned lock files removed after rename, lock files in sync), make agent-report-progress all green.
❓ Checks (CI) — stale after agent push; needs human re-trigger. No prior product CI failures to fix.
✅ Mergeable — PR is open, not draft, branch updated with 2 new main commits (merge commit 3e93a48), no conflicts.

Actions taken: Merged latest main (commits f2bff5d and 7833adf) into branch; recompiled 256 workflows (removed 4 orphaned lock files from test workflow renames).
Hand-off: A maintainer needs to re-trigger CI (close/reopen, workflow_dispatch, or push from a maintainer account) before merging.

gh-aw-bot · 2026-07-10T02:58:43Z

pr-sous-chef
@copilot please run the pr-finisher skill, address unresolved review comments, ensure the branch is up to date, and rerun checks.

Run: https://github.com/github/gh-aw/actions/runs/29065468296

Generated by 👨‍🍳 PR Sous Chef · 9.71 AIC · ⌖ 6.72 AIC · ⊞ 7.1K · ◷
_{Comment /souschef to run again}

Copilot · 2026-07-10T03:11:02Z

pr-sous-chef
@copilot please run the pr-finisher skill, address unresolved review comments, ensure the branch is up to date, and rerun checks.
...

PR finisher complete. All three merge-ready conditions satisfied:

✅ Reviews — no unresolved review threads (0 inline comments from automated reviewer on 7/7 files).
✅ Checks (local) — make fmt, make lint (0 errors), make test-unit (all pass), make agent-report-progress (256/256 workflows in sync) all green.
❓ Checks (CI) — stale after agent push; needs human re-trigger. No prior product CI failures to fix.
✅ Mergeable — PR is open, not draft, branch is up to date with main (head 3e93a48), no conflicts.

Actions taken: No code changes needed — branch was already up to date and all local validations pass.
Hand-off: A maintainer needs to re-trigger CI (close/reopen, workflow_dispatch, or push from a maintainer account) before merging.

pelikhan · 2026-07-10T03:57:39Z

@lpcox ang concern?

gh-aw-bot · 2026-07-10T04:21:15Z

@copilot please run the pr-finisher skill, address unresolved review comments, and rerun checks once the branch is up to date.

Generated by 👨‍🍳 PR Sous Chef · 6.82 AIC · ⌖ 5.64 AIC · ⊞ 7.1K · ◷
_{Comment /souschef to run again}

…sandbox-field Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot · 2026-07-10T04:32:00Z

@copilot please run the pr-finisher skill, address unresolved review comments, and rerun checks once the branch is up to date.

...

PR finisher complete. All three merge-ready conditions satisfied:

✅ Reviews — no unresolved review threads (0 inline comments from automated reviewer on 7/7 files).
✅ Checks (local) — make fmt, make lint (0 errors), make test-unit (all pass), make agent-report-progress (256/256 workflows in sync) all green.
❓ Checks (CI) — stale after agent push; needs human re-trigger. No prior product CI failures to fix.
✅ Mergeable — PR is open, not draft, branch updated with 5 new main commits (merge commit f91c76b), no conflicts.

Actions taken: Merged latest main (5 commits including GHE SSH URL fix, dispatch-repository test fixture fix, docs updates) into branch.
Hand-off: A maintainer needs to re-trigger CI (close/reopen, workflow_dispatch, or push from a maintainer account) before merging.

gh-aw-bot · 2026-07-10T05:54:07Z

pr-sous-chef
@copilot please run the pr-finisher skill, confirm the branch is current, and rerun checks so this PR is ready for maintainer review.

Run: https://github.com/github/gh-aw/actions/runs/29072075004

Generated by 👨‍🍳 PR Sous Chef · 10.3 AIC · ⌖ 7.41 AIC · ⊞ 7.1K · ◷
_{Comment /souschef to run again}

…sandbox-field Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot · 2026-07-10T06:05:13Z

pr-sous-chef
@copilot please run the pr-finisher skill, confirm the branch is current, and rerun checks so this PR is ready for maintainer review.
...

PR finisher complete. All three merge-ready conditions satisfied:

✅ Reviews — no unresolved review threads (0 inline comments from automated reviewer on 7/7 files).
✅ Checks (local) — make fmt, make lint (0 errors), make test-unit (all pass), make agent-report-progress (256/256 workflows in sync) all green.
❓ Checks (CI) — stale after agent push; needs human re-trigger. No prior product CI failures to fix.
✅ Mergeable — PR is open, not draft, branch updated with 10 new main commits (merge commit d5b5514), no conflicts.

Actions taken: Merged latest main (10 commits including permissions consolidation, security architecture tests, yamllint fixes, model inventory updates) into branch; all local validations pass.
Hand-off: A maintainer needs to re-trigger CI (close/reopen, workflow_dispatch, or push from a maintainer account) before merging.

github-actions · 2026-07-11T09:03:33Z

🎉 This pull request is included in a new release.

Release: v0.82.8

Initial plan

0959fea

Copilot AI assigned Copilot and pelikhan Jul 9, 2026

Copilot started work on behalf of pelikhan July 9, 2026 05:40 View session

Copilot AI linked an issue Jul 9, 2026 that may be closed by this pull request

feat(shared-workflows): support sandbox field in shared workflow partials with merge semantics #37722

Closed

feat: allow shared sandbox mounts and merge with main workflow

651e19d

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Add support for sandbox field in shared workflow partials~~ Allow shared workflow partials to define and merge sandbox.agent.mounts Jul 9, 2026

Copilot finished work on behalf of pelikhan July 9, 2026 06:07

Copilot AI requested a review from pelikhan July 9, 2026 06:07

github-actions Bot added pr-action:defer pr-agent:copilot-swe-agent pr-priority:medium pr-risk:medium pr-type:feature labels Jul 9, 2026

pelikhan marked this pull request as ready for review July 9, 2026 10:55

Copilot AI review requested due to automatic review settings July 9, 2026 10:55

Copilot started reviewing on behalf of pelikhan July 9, 2026 10:59 View session

Copilot AI reviewed Jul 9, 2026

View reviewed changes

Copilot started work on behalf of pelikhan July 9, 2026 11:57 View session

Copilot finished work on behalf of pelikhan July 9, 2026 12:12

github-actions Bot added the pr-action:fast_track label Jul 9, 2026

github-actions Bot mentioned this pull request Jul 9, 2026

[pr-sous-chef] Run report — 8 nudged, 0 skipped #44558

Closed

github-actions Bot mentioned this pull request Jul 10, 2026

[pr-sous-chef] Run report — 9 nudged, 0 not nudged #44642

Closed

Copilot started work on behalf of gh-aw-bot July 10, 2026 01:54 View session

Merge remote-tracking branch 'origin/main' into copilot/feat-support-…

3e93a48

…sandbox-field Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot finished work on behalf of gh-aw-bot July 10, 2026 02:14

Copilot started work on behalf of gh-aw-bot July 10, 2026 02:59 View session

github-actions Bot mentioned this pull request Jul 10, 2026

[pr-sous-chef] Run report — 9 nudged, 0 skipped #44643

Closed

Copilot finished work on behalf of gh-aw-bot July 10, 2026 03:11

github-actions Bot mentioned this pull request Jul 10, 2026

[pr-sous-chef] Run report — 6 nudged, 4 skipped #44647

Closed

Copilot started work on behalf of gh-aw-bot July 10, 2026 04:21 View session

Merge remote-tracking branch 'origin/main' into copilot/feat-support-…

f91c76b

…sandbox-field Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot finished work on behalf of gh-aw-bot July 10, 2026 04:33

pelikhan requested a review from lpcox July 10, 2026 04:43

github-actions Bot mentioned this pull request Jul 10, 2026

[pr-sous-chef] Run report — 6 nudged, 0 skipped #44662

Closed

Copilot started work on behalf of gh-aw-bot July 10, 2026 05:54 View session

Merge remote-tracking branch 'origin/main' into copilot/feat-support-…

d5b5514

…sandbox-field Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot finished work on behalf of gh-aw-bot July 10, 2026 06:05

pelikhan merged commit 9eabba4 into main Jul 10, 2026
25 checks passed

pelikhan deleted the copilot/feat-support-sandbox-field branch July 10, 2026 06:44

github-actions Bot mentioned this pull request Jul 10, 2026

Suggested test: copilot/sandbox-mounts-from-partial githubnext/gh-aw-test#6385

Open

github-actions Bot mentioned this pull request Jul 11, 2026

[instructions] Sync instruction files with release v0.82.8 #44920

Merged

Uh oh!

Conversation

Copilot AI commented Jul 9, 2026 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

github-actions Bot commented Jul 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 9, 2026

Uh oh!

github-actions Bot commented Jul 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pelikhan commented Jul 9, 2026

Uh oh!

Copilot AI commented Jul 9, 2026

Uh oh!

github-actions Bot commented Jul 9, 2026

🤖 PR Triage — Run §29020837798

Uh oh!

gh-aw-bot commented Jul 9, 2026

Uh oh!

gh-aw-bot commented Jul 10, 2026

Uh oh!

Copilot AI commented Jul 10, 2026

Uh oh!

gh-aw-bot commented Jul 10, 2026

Uh oh!

Copilot AI commented Jul 10, 2026

Uh oh!

pelikhan commented Jul 10, 2026

Uh oh!

gh-aw-bot commented Jul 10, 2026

Uh oh!

Copilot AI commented Jul 10, 2026

Uh oh!

gh-aw-bot commented Jul 10, 2026

Uh oh!

Copilot AI commented Jul 10, 2026

Uh oh!

Uh oh!

github-actions Bot commented Jul 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Copilot AI commented Jul 9, 2026 •

edited by github-actions Bot

Loading

github-actions Bot commented Jul 9, 2026 •

edited

Loading

github-actions Bot commented Jul 9, 2026 •

edited

Loading

github-actions Bot commented Jul 9, 2026 •

edited

Loading