Use AWF --enable-chroot mode and remove unnecessary --mount and --env flags (#13576)

* Initial plan

* feat: Use AWF --enable-chroot mode and remove unnecessary mount/env flags

- Add --enable-chroot flag to AWF invocations for transparent host access
- Remove unnecessary --mount flags for host binaries (replaced by chroot mode)
- Remove --env-all and mirrored environment variable flags (inherited by chroot)
- Remove tool bins setup command (not needed with chroot mode)
- Update tests to verify new chroot mode behavior
- Recompile all workflow files with simplified AWF commands

Co-authored-by: Mossaka <5447827+Mossaka@users.noreply.github.com>

* Merge main and regenerate agentic workflows

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* Add changeset [skip-ci]

* Update awf to v0.13.2 with chroot fix

Bumps gh-aw-firewall from v0.13.1 to v0.13.2 which includes
the fix for --enable-chroot with preset agent images (PR #459).

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* feat: Apply --enable-chroot mode to Claude and Codex engines

- Update claude_engine.go to use --enable-chroot instead of --env-all and individual mounts
- Update codex_engine.go to use --enable-chroot instead of --env-all and individual mounts
- Remove unnecessary toolBinsSetup and mkdir commands from both engines
- Recompile all workflow files with simplified AWF commands for all engines

This ensures consistency across all three engines (Copilot, Claude, Codex).

Co-authored-by: Mossaka <5447827+Mossaka@users.noreply.github.com>

* Add --env-all flag to copilot engine for chroot mode

Pass all environment variables to the AWF container in chroot mode,
fixing the GITHUB_WORKSPACE unbound variable error.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* fix: Update test expectations for DefaultFirewallVersion and custom checkout behavior

- Update TestVersionConstants/DefaultFirewallVersion to expect v0.13.2
- Update TestGitHubFolderCheckoutOptimization test to expect custom_checkout_skips_github_sparse behavior (from origin/main)

Co-authored-by: Mossaka <5447827+Mossaka@users.noreply.github.com>

* Add GOROOT capture step after Go setup for AWF chroot mode

GitHub Actions uses "trimmed" Go binaries that require GOROOT to be
explicitly set. actions/setup-go does NOT export GOROOT to the
environment, so we must capture it with `go env GOROOT`.

This is required for AWF chroot mode which passes GOROOT as AWF_GOROOT
to the container's entrypoint script.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* Add env capture steps for Java and dotnet in chroot mode

Extend the runtime step generator to capture JAVA_HOME and DOTNET_ROOT
after their respective setup actions, similar to GOROOT for Go.

These environment variables are required for AWF chroot mode to properly
configure the container with access to Java and .NET runtimes.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* fix: Remove --env-all from copilot engine chroot mode

Remove --env-all flag from AWF invocation in copilot engine since
chroot mode inherits the host environment automatically. This aligns
with the original PR design and fixes the test failure.

Co-authored-by: Mossaka <5447827+Mossaka@users.noreply.github.com>

* Simplify PATH handling in chroot mode for dotnet support

In chroot mode, AWF's entrypoint.sh already sets PATH from AWF_HOST_PATH,
which contains the complete host PATH including all setup-* action additions.
This eliminates the need for redundant PATH reconstruction.

Changes:
- Remove GetHostedToolcachePathSetup() wrapper for copilot/codex in chroot mode
- Claude engine: only apply PATH setup for non-firewall mode
- Remove DOTNET_ROOT and JAVA_HOME capture steps (PATH inheritance is sufficient)
- Keep GOROOT capture (Go's trimmed binaries specifically need GOROOT)
- Fix test to expect --env-all (required for AWF to receive host env vars)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* Add changeset for simplified chroot path handling [skip-ci]

* Recompile workflows with simplified PATH handling

Regenerated all .lock.yml files to use the simplified PATH handling
in chroot mode. PATH is now inherited from AWF_HOST_PATH instead of
being reconstructed via GetHostedToolcachePathSetup().

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* Fix: Keep PATH setup for Claude/Codex (npm-installed binaries need PATH)

Unlike Copilot which uses /usr/local/bin/copilot (full path), Claude and
Codex use 'claude' and 'codex' commands which require PATH to be set.
The PATH setup script ensures npm-installed binaries are found.

Also restore --env-all flag for Copilot which was accidentally removed.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* Use full paths for Claude/Codex in AWF chroot mode

Instead of using PATH setup with GetHostedToolcachePathSetup(), use full
paths (/usr/local/bin/claude and /usr/local/bin/codex) in AWF chroot mode.
This simplifies the commands and avoids shell complexity.

Changes:
- Claude: Use /usr/local/bin/claude in AWF mode, add --env-all
- Codex: Use /usr/local/bin/codex in AWF mode, add --env-all
- Both: Keep PATH setup only for non-firewall mode

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* Fix: Keep PATH setup for Claude/Codex (npm-installed binaries need PATH)

Reverts the hardcoded /usr/local/bin paths because npm global installs
with actions/setup-node go to a different location managed by the action.

Instead, use the regular command names (claude, codex) and add PATH setup
inside the AWF command so the container can find both:
- npm-installed CLI binaries
- Runtimes in /opt/hostedtoolcache

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* Fix: Export INSTRUCTION env var for Codex AWF (needed for --env-all)

The $INSTRUCTION variable is set outside the AWF container, but when the
codex command is wrapped in single quotes for bash -c, the variable isn't
expanded. By exporting INSTRUCTION, it becomes an environment variable
that gets passed through --env-all to the AWF container.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* Fix: Read prompt inside AWF container to avoid Docker Compose interpolation

The prompt file may contain $ characters which Docker Compose tries to
interpolate when passed as an environment variable via --env-all. By
reading the prompt inside the AWF container's shell command, we avoid
this issue entirely.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* Fix: Add PATH setup to Copilot AWF for hostedtoolcache priority

The system Go at /usr/bin/go (1.24.12) was being found before the
hostedtoolcache Go (1.25.6) because AWF_HOST_PATH preserves the original
PATH order where system paths come first.

GetHostedToolcachePathSetup() PREPENDS hostedtoolcache paths to PATH,
ensuring tools from actions/setup-go are found before system versions.

This matches the approach used by Claude and Codex engines.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* Fix: Wrap Copilot AWF command in /bin/bash -c for PATH setup

The PATH setup using 'source sanitize_path.sh' requires a bash shell
to execute properly. Without wrapping in /bin/bash -c, the source
command wasn't being executed, causing Go 1.23 (system) to be found
instead of Go 1.25 from hostedtoolcache.

This aligns Copilot's command structure with Codex, which already
wraps its command in /bin/bash -c.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* Add GH_AW_TOOL_BINS setup before AWF for correct tool PATH ordering

All three engines (Copilot, Claude, Codex) now call GetToolBinsSetup()
before invoking AWF. This computes GH_AW_TOOL_BINS from GOROOT, JAVA_HOME,
etc. on the host side and exports it. The variable is then passed to the
container via --env-all.

Inside the container, GetHostedToolcachePathSetup() uses GH_AW_TOOL_BINS
to PREPEND the specific tool paths (e.g., /opt/hostedtoolcache/go/1.25.6/x64/bin)
before the generic find results. Without this, find returns directories in
alphabetical order causing Go 1.22/1.23 to shadow Go 1.25.

This fixes the "Go version mismatch (requires >=1.25.0, running 1.23.12)"
error in smoke tests when make build is invoked inside the AWF container.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* Remove PATH gymnastics from engine execution - trust AWF native PATH handling

AWF with --enable-chroot and --env-all already handles PATH correctly:
1. Captures host PATH → AWF_HOST_PATH (correct ordering from actions/setup-*)
2. Passes ALL host env vars including JAVA_HOME, DOTNET_ROOT, GOROOT
3. entrypoint.sh exports PATH="${AWF_HOST_PATH}" and tool-specific vars
4. Container inherits complete, correctly-ordered environment

Changes:
- copilot_engine_execution.go: Remove GetToolBinsSetup, GetHostedToolcachePathSetup,
  and /bin/bash -c wrapper - pass command directly via shellEscapeArg
- claude_engine.go: Remove PATH setup from both firewall and non-firewall modes,
  keep bash wrapper only for && chains
- codex_engine.go: Remove PATH setup, keep INSTRUCTION reading inside container
  to avoid Docker Compose interpolation issues

This simplifies the generated workflows by ~150 lines across all lock files.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* Fix: Add PATH setup for npm-installed CLIs (Claude, Codex)

AWF's native PATH handling (AWF_HOST_PATH) doesn't include npm global bin
directories. Claude and Codex are installed via `npm install -g` which puts
binaries in hostedtoolcache node bin directory.

Added GetNpmBinPathSetup() helper that adds hostedtoolcache bin directories
to PATH. This is simpler than the previous GetHostedToolcachePathSetup()
because it doesn't include GH_AW_TOOL_BINS - AWF already handles tool-specific
paths (GOROOT, JAVA_HOME, etc.) natively.

Copilot doesn't need this because it uses an absolute path (/usr/local/bin/copilot).

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* Update AWF to v0.13.4 - fix GOROOT/bin PATH in chroot mode

AWF v0.13.4 fixes an issue where the Go version from actions/setup-go
was not being found in chroot mode. The entrypoint now prepends
$GOROOT/bin to PATH when AWF_GOROOT is provided, ensuring the correct
Go version is used.

This fixes the smoke-copilot test failure:
"Build: ❌ (Go 1.24.12 < required 1.25.0)"

Also updates the constants_test.go expectation from v0.13.1 to v0.13.4.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Mossaka <5447827+Mossaka@users.noreply.github.com>
Co-authored-by: Jiaxiao (mossaka) Zhou <duibao55328@gmail.com>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

Author: 4 people

.changeset/patch-enable-awf-chroot-mode.md

@@ -25,6 +25,16 @@
             "pull-requests": "write",
             "workflows": "write"
           }
+        },
+        "githubnext/gh-aw": {
+          "permissions": {
+            "actions": "write",
+            "contents": "write",
+            "discussions": "read",
+            "issues": "read",
+            "pull-requests": "write",
+            "workflows": "write"
+          }
         }
       }
     }