Skip to content

Commit be484ba

Browse files
Copilotlpcox
Copilot
and
lpcox
authored
Pass GitHub Actions environment variables to safeoutputs MCP server at gateway (#10940)
* Initial plan * Add GitHub Actions environment variables to safe outputs MCP server gateway Added common GitHub Actions environment variables to the safeoutputs MCP server when configured at the gateway, enabling access to workflow run context, actor information, event details, and ref information. Changes: - Updated mcp-config-builtin.go to include additional env vars in envVars list - Updated mcp_renderer.go TOML env_vars array for Codex engine - Updated mcp_servers.go to pass env vars via -e flags in Docker command - Variables added: GITHUB_RUN_*, GITHUB_JOB, GITHUB_ACTION, GITHUB_EVENT_*, GITHUB_ACTOR*, GITHUB_TRIGGERING_ACTOR, GITHUB_WORKFLOW*, GITHUB_REF*, GITHUB_HEAD_REF, GITHUB_BASE_REF Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com> * Refactor: Improve readability of environment variable arrays Addressed code review feedback by refactoring long single-line environment variable arrays into maintainable slice-based code. This improves readability and makes it easier to maintain the environment variable lists. Changes: - Refactored renderSafeOutputsMCPConfigTOML to use a slice and loop - Refactored renderSafeOutputsTOML to use the same approach - Both functions now programmatically build the env_vars array - No functional changes - output remains identical Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
1 parent add0c3d commit be484ba

6 files changed

Lines changed: 195 additions & 8 deletions

File tree

‎.github/workflows/agent-performance-analyzer.lock.yml‎

Lines changed: 20 additions & 2 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎.github/workflows/agent-persona-explorer.lock.yml‎

Lines changed: 20 additions & 2 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎.github/workflows/agentic-campaign-generator.lock.yml‎

Lines changed: 19 additions & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎pkg/workflow/mcp-config-builtin.go‎

Lines changed: 67 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,18 +21,43 @@ func renderSafeOutputsMCPConfig(yaml *strings.Builder, isLast bool) {
2121
// Uses MCP Gateway spec format: container, entrypoint, entrypointArgs, and mounts fields.
2222
func renderSafeOutputsMCPConfigWithOptions(yaml *strings.Builder, isLast bool, includeCopilotFields bool) {
2323
envVars := []string{
24+
// GH_AW specific environment variables
2425
"GH_AW_MCP_LOG_DIR",
2526
"GH_AW_SAFE_OUTPUTS",
2627
"GH_AW_SAFE_OUTPUTS_CONFIG_PATH",
2728
"GH_AW_SAFE_OUTPUTS_TOOLS_PATH",
2829
"GH_AW_ASSETS_BRANCH",
2930
"GH_AW_ASSETS_MAX_SIZE_KB",
3031
"GH_AW_ASSETS_ALLOWED_EXTS",
32+
// GitHub Actions workflow context (already included)
3133
"GITHUB_REPOSITORY",
3234
"GITHUB_SERVER_URL",
3335
"GITHUB_SHA",
3436
"GITHUB_WORKSPACE",
3537
"DEFAULT_BRANCH",
38+
// GitHub Actions run context
39+
"GITHUB_RUN_ID",
40+
"GITHUB_RUN_NUMBER",
41+
"GITHUB_RUN_ATTEMPT",
42+
"GITHUB_JOB",
43+
"GITHUB_ACTION",
44+
// GitHub Actions event context
45+
"GITHUB_EVENT_NAME",
46+
"GITHUB_EVENT_PATH",
47+
// GitHub Actions actor context
48+
"GITHUB_ACTOR",
49+
"GITHUB_ACTOR_ID",
50+
"GITHUB_TRIGGERING_ACTOR",
51+
// GitHub Actions workflow context
52+
"GITHUB_WORKFLOW",
53+
"GITHUB_WORKFLOW_REF",
54+
"GITHUB_WORKFLOW_SHA",
55+
// GitHub Actions ref context
56+
"GITHUB_REF",
57+
"GITHUB_REF_NAME",
58+
"GITHUB_REF_TYPE",
59+
"GITHUB_HEAD_REF",
60+
"GITHUB_BASE_REF",
3661
}
3762

3863
// Use MCP Gateway spec format with container, entrypoint, entrypointArgs, and mounts
@@ -135,14 +160,55 @@ func renderAgenticWorkflowsMCPConfigWithOptions(yaml *strings.Builder, isLast bo
135160
// Per MCP Gateway Specification v1.0.0 section 3.2.1, stdio-based MCP servers MUST be containerized.
136161
// Uses MCP Gateway spec format: container, entrypoint, entrypointArgs, and mounts fields.
137162
func renderSafeOutputsMCPConfigTOML(yaml *strings.Builder) {
163+
// Define environment variables for safe-outputs MCP server
164+
// These are a subset of the full envVars list, excluding some internal variables
165+
envVars := []string{
166+
"GH_AW_SAFE_OUTPUTS",
167+
"GH_AW_ASSETS_BRANCH",
168+
"GH_AW_ASSETS_MAX_SIZE_KB",
169+
"GH_AW_ASSETS_ALLOWED_EXTS",
170+
"GITHUB_REPOSITORY",
171+
"GITHUB_SERVER_URL",
172+
"GITHUB_SHA",
173+
"GITHUB_WORKSPACE",
174+
"DEFAULT_BRANCH",
175+
"GITHUB_RUN_ID",
176+
"GITHUB_RUN_NUMBER",
177+
"GITHUB_RUN_ATTEMPT",
178+
"GITHUB_JOB",
179+
"GITHUB_ACTION",
180+
"GITHUB_EVENT_NAME",
181+
"GITHUB_EVENT_PATH",
182+
"GITHUB_ACTOR",
183+
"GITHUB_ACTOR_ID",
184+
"GITHUB_TRIGGERING_ACTOR",
185+
"GITHUB_WORKFLOW",
186+
"GITHUB_WORKFLOW_REF",
187+
"GITHUB_WORKFLOW_SHA",
188+
"GITHUB_REF",
189+
"GITHUB_REF_NAME",
190+
"GITHUB_REF_TYPE",
191+
"GITHUB_HEAD_REF",
192+
"GITHUB_BASE_REF",
193+
}
194+
138195
yaml.WriteString(" \n")
139196
yaml.WriteString(" [mcp_servers." + constants.SafeOutputsMCPServerID + "]\n")
140197
yaml.WriteString(" container = \"" + constants.DefaultNodeAlpineLTSImage + "\"\n")
141198
yaml.WriteString(" entrypoint = \"node\"\n")
142199
yaml.WriteString(" entrypointArgs = [\"/opt/gh-aw/safeoutputs/mcp-server.cjs\"]\n")
143200
yaml.WriteString(" mounts = [\"" + constants.DefaultGhAwMount + "\", \"" + constants.DefaultTmpGhAwMount + "\", \"" + constants.DefaultWorkspaceMount + "\"]\n")
201+
144202
// Use env_vars array to reference environment variables instead of embedding GitHub Actions expressions
145-
yaml.WriteString(" env_vars = [\"GH_AW_SAFE_OUTPUTS\", \"GH_AW_ASSETS_BRANCH\", \"GH_AW_ASSETS_MAX_SIZE_KB\", \"GH_AW_ASSETS_ALLOWED_EXTS\", \"GITHUB_REPOSITORY\", \"GITHUB_SERVER_URL\", \"GITHUB_SHA\", \"GITHUB_WORKSPACE\", \"DEFAULT_BRANCH\"]\n")
203+
// Convert envVars slice to JSON array format
204+
yaml.WriteString(" env_vars = [")
205+
for i, envVar := range envVars {
206+
if i > 0 {
207+
yaml.WriteString(", ")
208+
}
209+
yaml.WriteString("\"" + envVar + "\"")
210+
}
211+
yaml.WriteString("]\n")
146212
}
147213

148214
// renderAgenticWorkflowsMCPConfigTOML generates the Agentic Workflows MCP server configuration in TOML format for Codex

‎pkg/workflow/mcp_renderer.go‎

Lines changed: 45 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -267,13 +267,57 @@ func (r *MCPConfigRendererUnified) RenderSafeOutputsMCP(yaml *strings.Builder) {
267267
// Per MCP Gateway Specification v1.0.0 section 3.2.1, stdio-based MCP servers MUST be containerized.
268268
// Uses MCP Gateway spec format: container, entrypoint, entrypointArgs, and mounts fields.
269269
func (r *MCPConfigRendererUnified) renderSafeOutputsTOML(yaml *strings.Builder) {
270+
// Define environment variables for safe-outputs MCP server
271+
envVars := []string{
272+
"GH_AW_MCP_LOG_DIR",
273+
"GH_AW_SAFE_OUTPUTS",
274+
"GH_AW_SAFE_OUTPUTS_CONFIG_PATH",
275+
"GH_AW_SAFE_OUTPUTS_TOOLS_PATH",
276+
"GH_AW_ASSETS_BRANCH",
277+
"GH_AW_ASSETS_MAX_SIZE_KB",
278+
"GH_AW_ASSETS_ALLOWED_EXTS",
279+
"GITHUB_REPOSITORY",
280+
"GITHUB_SERVER_URL",
281+
"GITHUB_SHA",
282+
"GITHUB_WORKSPACE",
283+
"DEFAULT_BRANCH",
284+
"GITHUB_RUN_ID",
285+
"GITHUB_RUN_NUMBER",
286+
"GITHUB_RUN_ATTEMPT",
287+
"GITHUB_JOB",
288+
"GITHUB_ACTION",
289+
"GITHUB_EVENT_NAME",
290+
"GITHUB_EVENT_PATH",
291+
"GITHUB_ACTOR",
292+
"GITHUB_ACTOR_ID",
293+
"GITHUB_TRIGGERING_ACTOR",
294+
"GITHUB_WORKFLOW",
295+
"GITHUB_WORKFLOW_REF",
296+
"GITHUB_WORKFLOW_SHA",
297+
"GITHUB_REF",
298+
"GITHUB_REF_NAME",
299+
"GITHUB_REF_TYPE",
300+
"GITHUB_HEAD_REF",
301+
"GITHUB_BASE_REF",
302+
}
303+
270304
yaml.WriteString(" \n")
271305
yaml.WriteString(" [mcp_servers." + constants.SafeOutputsMCPServerID + "]\n")
272306
yaml.WriteString(" container = \"" + constants.DefaultNodeAlpineLTSImage + "\"\n")
273307
yaml.WriteString(" entrypoint = \"node\"\n")
274308
yaml.WriteString(" entrypointArgs = [\"/opt/gh-aw/safeoutputs/mcp-server.cjs\"]\n")
275309
yaml.WriteString(" mounts = [\"/opt/gh-aw:/opt/gh-aw:ro\", \"/tmp/gh-aw:/tmp/gh-aw:rw\", \"${{ github.workspace }}:${{ github.workspace }}:rw\"]\n")
276-
yaml.WriteString(" env_vars = [\"GH_AW_MCP_LOG_DIR\", \"GH_AW_SAFE_OUTPUTS\", \"GH_AW_SAFE_OUTPUTS_CONFIG_PATH\", \"GH_AW_SAFE_OUTPUTS_TOOLS_PATH\", \"GH_AW_ASSETS_BRANCH\", \"GH_AW_ASSETS_MAX_SIZE_KB\", \"GH_AW_ASSETS_ALLOWED_EXTS\", \"GITHUB_REPOSITORY\", \"GITHUB_SERVER_URL\", \"GITHUB_SHA\", \"GITHUB_WORKSPACE\", \"DEFAULT_BRANCH\"]\n")
310+
311+
// Include all common GitHub Actions environment variables for context
312+
// Convert envVars slice to JSON array format
313+
yaml.WriteString(" env_vars = [")
314+
for i, envVar := range envVars {
315+
if i > 0 {
316+
yaml.WriteString(", ")
317+
}
318+
yaml.WriteString("\"" + envVar + "\"")
319+
}
320+
yaml.WriteString("]\n")
277321
}
278322

279323
// RenderSafeInputsMCP generates the Safe Inputs MCP server configuration

‎pkg/workflow/mcp_servers.go‎

Lines changed: 24 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -593,12 +593,35 @@ func (c *Compiler) generateMCPSetup(yaml *strings.Builder, tools map[string]any,
593593
containerCmd += " -e GITHUB_PERSONAL_ACCESS_TOKEN"
594594
}
595595
containerCmd += " -e GITHUB_MCP_LOCKDOWN"
596-
// Standard GitHub Actions environment variables
596+
// Standard GitHub Actions environment variables (repository context)
597597
containerCmd += " -e GITHUB_REPOSITORY"
598598
containerCmd += " -e GITHUB_SERVER_URL"
599599
containerCmd += " -e GITHUB_SHA"
600600
containerCmd += " -e GITHUB_WORKSPACE"
601601
containerCmd += " -e GITHUB_TOKEN"
602+
// GitHub Actions run context
603+
containerCmd += " -e GITHUB_RUN_ID"
604+
containerCmd += " -e GITHUB_RUN_NUMBER"
605+
containerCmd += " -e GITHUB_RUN_ATTEMPT"
606+
containerCmd += " -e GITHUB_JOB"
607+
containerCmd += " -e GITHUB_ACTION"
608+
// GitHub Actions event context
609+
containerCmd += " -e GITHUB_EVENT_NAME"
610+
containerCmd += " -e GITHUB_EVENT_PATH"
611+
// GitHub Actions actor context
612+
containerCmd += " -e GITHUB_ACTOR"
613+
containerCmd += " -e GITHUB_ACTOR_ID"
614+
containerCmd += " -e GITHUB_TRIGGERING_ACTOR"
615+
// GitHub Actions workflow context
616+
containerCmd += " -e GITHUB_WORKFLOW"
617+
containerCmd += " -e GITHUB_WORKFLOW_REF"
618+
containerCmd += " -e GITHUB_WORKFLOW_SHA"
619+
// GitHub Actions ref context
620+
containerCmd += " -e GITHUB_REF"
621+
containerCmd += " -e GITHUB_REF_NAME"
622+
containerCmd += " -e GITHUB_REF_TYPE"
623+
containerCmd += " -e GITHUB_HEAD_REF"
624+
containerCmd += " -e GITHUB_BASE_REF"
602625
// Environment variables used by safeinputs MCP server
603626
// Only add if safe-inputs is actually enabled (has tools configured)
604627
if IsSafeInputsEnabled(workflowData.SafeInputs, workflowData) {

0 commit comments

Comments
 (0)