feat: default to strict security mode, stop injecting sudo and --enable-host-access by lpcox · Pull Request #45360 · github/gh-aw

lpcox · 2026-07-14T02:46:40Z

Summary

Implements the compiler-side changes for the strict security mode migration. The AWF firewall CLI (v0.27.32) now defaults to strict mode and this PR updates the compiler to match.

Changes

Default command: AWFDefaultCommand changed from sudo -E awf to awf
Legacy opt-in: Added AWFLegacySecurityCommand = "sudo -E awf" for workflows that explicitly need legacy mode
Frontmatter support: legacy-security: enable in workflow frontmatter opts into legacy behavior
BuildAWFArgs(): Only emits --legacy-security, --enable-host-access, --allow-host-ports when LegacySecurity is true
Version bump: DefaultFirewallVersion → v0.27.32 (the first release with --legacy-security flag)

Companion PR

gh-aw-firewall: feat: rename --security-mode to --legacy-security, deprecate --enable-api-proxy gh-aw-firewall#6209 (renames --security-mode to --legacy-security, deprecates --enable-api-proxy)

Migration

Existing workflows continue to work unchanged (strict mode is the secure default). Workflows that need legacy behavior must add legacy-security: enable to their frontmatter.

Note on CI

Container pin tests (TestApplyContainerPins_DefaultFirewallVersion, etc.) will fail until make build && make recompile && make recompile is run with registry access to resolve v0.27.32 SHA digests. Lock files also need regeneration.

Closes #45344

Generated by 👨‍🍳 PR Sous Chef · 12.8 AIC · ⌖ 5.92 AIC · ⊞ 7.5K · ◷
_{Comment /souschef to run again}

- Change AWFDefaultCommand from 'sudo -E awf' to 'awf' (strict mode) - Add AWFLegacySecurityCommand for explicit legacy mode opt-in - Add LegacySecurity field to AgentSandboxConfig (frontmatter: legacy-security: enable) - GetAWFCommandPrefix() returns 'awf' by default, 'sudo -E awf' only for legacy - BuildAWFArgs() only emits --legacy-security, --enable-host-access, --allow-host-ports when LegacySecurity is true - Bump DefaultFirewallVersion to v0.27.32 (requires --legacy-security flag) - Update all test assertions for new default behavior - Update golden files for strict-mode output Note: Container pin tests will fail until 'make build && make recompile && make recompile' is run with registry access to resolve v0.27.32 SHA digests. Closes #45344 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 8dcc99fc-3d0e-40c5-8b75-bc43d9bf5dee

Copilot

Pull request overview

Updates the compiler for AWF v0.27.32’s strict-security default and introduces legacy-security opt-in behavior.

Changes:

Removes sudo and host-access flags from default AWF execution.
Adds legacy-security: enable handling and legacy command arguments.
Bumps AWF to v0.27.32 and refreshes tests/golden outputs.

Show a summary per file

File	Description
`pkg/workflow/testdata/TestWasmGolden_CompileFixtures/with-imports.golden`	Updates AWF fixture version.
`pkg/workflow/testdata/TestWasmGolden_CompileFixtures/smoke-copilot.golden`	Updates AWF fixture version.
`pkg/workflow/testdata/TestWasmGolden_CompileFixtures/playwright-cli-mode.golden`	Updates AWF fixture version.
`pkg/workflow/testdata/TestWasmGolden_CompileFixtures/basic-copilot.golden`	Updates AWF fixture version.
`pkg/workflow/testdata/TestWasmGolden_AllEngines/pi.golden`	Updates Pi AWF output.
`pkg/workflow/testdata/TestWasmGolden_AllEngines/gemini.golden`	Updates Gemini AWF output.
`pkg/workflow/testdata/TestWasmGolden_AllEngines/copilot.golden`	Updates Copilot AWF output.
`pkg/workflow/testdata/TestWasmGolden_AllEngines/codex.golden`	Updates Codex AWF output.
`pkg/workflow/testdata/TestWasmGolden_AllEngines/claude.golden`	Updates Claude AWF output.
`pkg/workflow/sandbox.go`	Adds legacy-security state.
`pkg/workflow/sandbox_mounts_test.go`	Updates AWF command assertions.
`pkg/workflow/gh_cli_mount_test.go`	Updates AWF command assertions.
`pkg/workflow/frontmatter_extraction_security.go`	Extracts legacy-security configuration.
`pkg/workflow/firewall_workflow_test.go`	Updates firewall command assertion.
`pkg/workflow/firewall_args_test.go`	Updates firewall argument assertions.
`pkg/workflow/compiled_lock_files_test.go`	Updates compiled-command assertion.
`pkg/workflow/claude_engine_network_test.go`	Updates Claude network assertions.
`pkg/workflow/awf_helpers.go`	Implements strict and legacy command behavior.
`pkg/workflow/awf_helpers_test.go`	Tests strict and legacy behavior.
`pkg/workflow/awf_config.go`	Documents unconditional API proxy behavior.
`pkg/workflow/awf_config_test.go`	Updates generated-command assertions.
`pkg/workflow/agentic_output_test.go`	Updates AWF wrapper assertions.
`pkg/constants/version_constants.go`	Bumps AWF and adds compatibility boundary.
`pkg/constants/spec_test.go`	Updates documented default-command test.
`pkg/constants/constants.go`	Defines strict and legacy commands.
`pkg/constants/constants_test.go`	Updates constant expectations.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 26/26 changed files
Comments generated: 3
Review effort level: Medium

1. Schema: Add legacy-security field (enum: ['enable']) to sandbox.agent object in main_workflow_schema.json so frontmatter passes validation. 2. Service ports: Gate --allow-host-service-ports on LegacySecurity mode. Strict mode no longer emits host-access flags for service ports. 3. Version guard: Only emit --legacy-security flag when AWF version >= v0.27.32. Older AWF versions default to legacy mode and don't recognize the flag. --enable-host-access is still emitted for backward compat with older AWF. 4. Tests: Full-compilation tests validating legacy-security: enable passes schema validation and produces expected output. Unit tests for version guard and service port gating. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 8dcc99fc-3d0e-40c5-8b75-bc43d9bf5dee

gh-aw-bot · 2026-07-14T03:38:18Z

pr-sous-chef
@copilot please run the pr-finisher skill, address these unresolved review comments, and rerun checks once finished:

Copilot: feat: default to strict security mode, stop injecting sudo and --enable-host-access #45360 (comment)
Copilot: feat: default to strict security mode, stop injecting sudo and --enable-host-access #45360 (comment)
Copilot: feat: default to strict security mode, stop injecting sudo and --enable-host-access #45360 (comment)

Run: https://github.com/github/gh-aw/actions/runs/29303664684

Generated by 👨‍🍳 PR Sous Chef · 14.9 AIC · ⌖ 5.2 AIC · ⊞ 7.5K · ◷
_{Comment /souschef to run again}

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot · 2026-07-14T03:54:53Z

pr-sous-chef
@copilot please run the pr-finisher skill, address these unresolved review comments, and rerun checks once finished:

Copilot: feat: default to strict security mode, stop injecting sudo and --enable-host-access #45360 (comment)...

Addressed in a29dcc3.

Local checks rerun:

make fmt ✅
make lint ✅
go test -tags=integration ./pkg/cli -run 'TestCompileServicePorts' ✅
go test ./pkg/workflow -run 'TestBuildAWFCommand_ServicePortsRequireLegacy|TestCompileWorkflow_LegacySecurityFromFrontmatter|TestCompileWorkflow_StrictSecurityDefault' ✅
make test-unit / make test still hit the pre-existing AWF v0.27.32 pinning failures already noted in the PR description (TestBuildAWFImageTagWithDigests, TestCompileWorkflow_FirewallImagesPinnedForDefaultVersion, TestCompileWorkflow_BuildToolsImagePinnedForArcDind, TestApplyContainerPins_DefaultFirewallVersion).

I also recompiled .github/workflows/smoke-service-ports.md; CI on this new HEAD still needs a maintainer-triggered rerun because agent pushes do not start workflows.

lpcox · 2026-07-14T04:22:37Z

@copilot revert all .lock.yml updates to main

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot · 2026-07-14T04:40:49Z

@copilot revert all .lock.yml updates to main

Addressed in 8c420f9.

I reverted the incidental .lock.yml churn back to the pre-change/main state. I kept .github/workflows/smoke-service-ports.lock.yml aligned with its updated .md source, because reverting that one also reintroduces the lockfile hash-consistency failure.

gh-aw-bot · 2026-07-14T04:43:04Z

pr-sous-chef
@copilot please run the pr-finisher skill, address unresolved review comments, and rerun checks once the branch is up to date.

Generated by 👨‍🍳 PR Sous Chef · 12.8 AIC · ⌖ 5.92 AIC · ⊞ 7.5K · ◷
_{Comment /souschef to run again}

Copilot · 2026-07-14T04:58:24Z

pr-sous-chef
@copilot please run the pr-finisher skill, address unresolved review comments, and rerun checks once the branch is up to date.
...

No additional code changes were needed; the unresolved review items are already addressed on this branch in 946e5aa and a29dcc3, and I replied on each review thread.

Reran local validation:

make fmt ✅
make lint ✅
go test ./pkg/workflow -run 'TestBuildAWFArgs_LegacySecurityVersionGuard|TestBuildAWFCommand_ServicePortsRequireLegacy|TestCompileWorkflow_LegacySecurityFromFrontmatter|TestCompileWorkflow_StrictSecurityDefault' ✅
go test -tags=integration ./pkg/cli -run 'TestCompileServicePorts' ✅
make test ❌ still hits the known AWF v0.27.32 pinning failures already called out in the PR (TestBuildAWFImageTagWithDigests, TestCompileWorkflow_FirewallImagesPinnedForDefaultVersion, TestCompileWorkflow_BuildToolsImagePinnedForArcDind, TestApplyContainerPins_DefaultFirewallVersion).

Branch is already up to date with main; CI on this HEAD still needs a maintainer-triggered rerun because agent pushes do not start workflows.

pelikhan · 2026-07-14T07:26:27Z

 strict: true
+sandbox:
+  agent:
+    legacy-security: enable


@lpcox don't we have a "sudo" mode already?

Yes — this is using the existing sudo/host-access path. legacy-security: enable is the workflow-side opt-in that selects sudo -E awf plus the host-access flags for service-port passthrough; strict mode stays on the plain awf path by default.

gh-aw-bot · 2026-07-14T18:54:05Z

@copilot please run the pr-finisher skill, address unresolved review feedback, refresh this branch for the latest base branch state if needed, and rerun checks when complete.

Generated by 👨‍🍳 PR Sous Chef · 7.67 AIC · ⌖ 5.51 AIC · ⊞ 7.5K · ◷
_{Comment /souschef to run again}

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

…compiler # Conflicts: # .github/workflows/daily-multi-device-docs-tester.lock.yml # .github/workflows/dependabot-repair.lock.yml # .github/workflows/impeccable-skills-reviewer.lock.yml # .github/workflows/mattpocock-skills-reviewer.lock.yml # .github/workflows/pr-code-quality-reviewer.lock.yml # .github/workflows/pr-sous-chef.lock.yml # .github/workflows/semantic-function-refactor.lock.yml # .github/workflows/sighthound-security-scan.lock.yml # .github/workflows/smoke-copilot.lock.yml # .github/workflows/smoke-crush.lock.yml # .github/workflows/smoke-opencode.lock.yml Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot · 2026-07-14T19:17:08Z

@copilot please run the pr-finisher skill, address unresolved review feedback, refresh this branch for the latest base branch state if needed, and rerun checks when complete.

...

Addressed in 3965642 and 3ce6ce6.

Refreshed the branch from main and resolved the generated .lock.yml merge conflicts by taking the current main versions.
Fixed the merged-head unit failure in pkg/workflow/behavior_defined_engine_harness_test.go by asserting on strict-mode AWF invocation (awf --config) instead of sudo.

Local validation on the updated head:

make fmt ✅
make lint ✅
go test ./pkg/workflow -run 'TestBehaviorDefinedEngineHarnessScript' ✅
make test-unit ❌ only the known AWF v0.27.32 pinning failures remain (TestBuildAWFImageTagWithDigests, TestCompileWorkflow_FirewallImagesPinnedForDefaultVersion, TestCompileWorkflow_BuildToolsImagePinnedForArcDind, TestApplyContainerPins_DefaultFirewallVersion)
make test ❌ same known pinning failures
make agent-report-progress ❌ same known pinning failures

CI on this pushed head is still unverified until a maintainer re-triggers it, since agent pushes do not start workflows.

gh-aw-bot · 2026-07-14T19:29:06Z

@copilot please run the pr-finisher skill, address any unresolved review feedback, and rerun checks once the branch is up to date.

Generated by 👨‍🍳 PR Sous Chef · 5.11 AIC · ⌖ 13.1 AIC · ⊞ 7.5K · ◷
_{Comment /souschef to run again}

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot · 2026-07-14T19:47:07Z

@copilot please run the pr-finisher skill, address any unresolved review feedback, and rerun checks once the branch is up to date.

...

No additional code changes were needed on this head. I replied on the remaining unresolved review thread to clarify that legacy-security: enable is the existing sudo/host-access mode expressed through workflow frontmatter.

Reran local validation on the current branch:

make fmt ✅
make lint ✅
go test ./pkg/workflow -run 'TestBuildAWFArgs_LegacySecurityVersionGuard|TestBuildAWFCommand_ServicePortsRequireLegacy|TestCompileWorkflow_LegacySecurityFromFrontmatter|TestCompileWorkflow_StrictSecurityDefault|TestBehaviorDefinedEngineHarnessScript' ✅
go test -tags=integration ./pkg/cli -run 'TestCompileServicePorts' ✅
make test-unit / make test ❌ still reproduce only the known AWF v0.27.32 pinning failures (TestBuildAWFImageTagWithDigests, TestCompileWorkflow_FirewallImagesPinnedForDefaultVersion, TestCompileWorkflow_BuildToolsImagePinnedForArcDind, TestApplyContainerPins_DefaultFirewallVersion)

The branch already contains the PR base SHA, so it is up to date enough for review. CI on the current agent-pushed head remains unverified until a maintainer re-triggers workflows.

Copilot AI review requested due to automatic review settings July 14, 2026 02:46

Copilot started reviewing on behalf of lpcox July 14, 2026 02:47 View session

Copilot AI reviewed Jul 14, 2026

View reviewed changes

Comment thread pkg/workflow/frontmatter_extraction_security.go

Comment thread pkg/workflow/awf_helpers.go

Comment thread pkg/workflow/awf_helpers.go Outdated

github-actions Bot mentioned this pull request Jul 14, 2026

[pr-sous-chef] Run report — 4 nudged, 3 skipped #45345

Closed

Copilot started work on behalf of gh-aw-bot July 14, 2026 03:39 View session

Copilot AI and others added 2 commits July 14, 2026 03:44

chore: begin review feedback follow-up

b89da77

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

fix: opt service-port workflows into legacy security

a29dcc3

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot finished work on behalf of gh-aw-bot July 14, 2026 03:57

Copilot AI requested a review from gh-aw-bot July 14, 2026 03:57

Copilot started work on behalf of lpcox July 14, 2026 04:23 View session

chore: revert incidental lockfile updates

8c420f9

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot finished work on behalf of lpcox July 14, 2026 04:41

Merge branch 'main' into feat/legacy-security-compiler

c225286

Copilot started work on behalf of gh-aw-bot July 14, 2026 04:43 View session

Copilot finished work on behalf of gh-aw-bot July 14, 2026 04:59

pelikhan reviewed Jul 14, 2026

View reviewed changes

Copilot started work on behalf of gh-aw-bot July 14, 2026 18:54 View session

Copilot AI and others added 3 commits July 14, 2026 18:58

chore: start PR finisher pass

e846401

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

test: align harness AWF assertion with strict mode

3ce6ce6

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot finished work on behalf of gh-aw-bot July 14, 2026 19:17

Copilot started work on behalf of gh-aw-bot July 14, 2026 19:29 View session

Plan unresolved PR feedback

abaeea0

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot finished work on behalf of gh-aw-bot July 14, 2026 19:47

github-actions Bot mentioned this pull request Jul 15, 2026

[pr-sous-chef] Run report — 0 nudged, 0 skipped #45581

Open

Uh oh!

Conversation

lpcox commented Jul 14, 2026 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Companion PR

Migration

Note on CI

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

Uh oh!

Uh oh!

Uh oh!

gh-aw-bot commented Jul 14, 2026

Uh oh!

Copilot AI commented Jul 14, 2026

Uh oh!

lpcox commented Jul 14, 2026

Uh oh!

Copilot AI commented Jul 14, 2026

Uh oh!

gh-aw-bot commented Jul 14, 2026

Uh oh!

Copilot AI commented Jul 14, 2026

Uh oh!

pelikhan Jul 14, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jul 14, 2026

Choose a reason for hiding this comment

Uh oh!

gh-aw-bot commented Jul 14, 2026

Uh oh!

Copilot AI commented Jul 14, 2026

Uh oh!

gh-aw-bot commented Jul 14, 2026

Uh oh!

Copilot AI commented Jul 14, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

lpcox commented Jul 14, 2026 •

edited by github-actions Bot

Loading