Fix CodeQL code-injection alert for runner.tool_cache in generated shell run block

[Copilot]

gh aw compile generated lock workflows that interpolated ${{ runner.tool_cache }} directly into an executable run: shell block, which CodeQL flags as actions/code-injection/medium in any workflow using on.workflow-call with this pattern.

Changes

• pkg/workflow/compiler_yaml_step_generation.go: generateSetRuntimePathsStep now passes runner.tool_cache through a step-level env: entry (GH_AW_RUNNER_TOOL_CACHE) instead of interpolating the expression directly into script text; the shell script references it as ${GH_AW_RUNNER_TOOL_CACHE}.
• pkg/workflow/agentic_output_test.go: updated assertion to match the new generated output.
• All .lock.yml files: recompiled to propagate the fix across all 298 generated workflows.

- name: Set runtime paths
  id: set-runtime-paths
  env:
    GH_AW_RUNNER_TOOL_CACHE: ${{ runner.tool_cache }}
  run: |
    if [ -z "${RUNNER_TOOL_CACHE:-}" ]; then
      echo "RUNNER_TOOL_CACHE=${GH_AW_RUNNER_TOOL_CACHE}" >> "$GITHUB_ENV"
    fi

• Fixes gh aw compile generates CodeQL code-injection alert for ${{ runner.tool_cache }} in shell run block #57775

[pelikhan]

@copilot aadd a rule in the compiler's shell checker. The compiler includes a microshell checker that detects these code patterns, raises an error, and tells the agent how to fix them.

[Copilot]

🟡 Changes recommended

The test does not assert the new environment mapping or prevent reintroduction of direct shell interpolation.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Moves runner.tool_cache out of generated shell text to prevent CodeQL injection alerts.

Changes:

• Passes the runner tool cache through step-level env.
• Updates the generated-output test.
• Regenerates 298 workflow lock files.

File summaries

File	Description
pkg/workflow/compiler_yaml_step_generation.go	Generates secure environment indirection.
pkg/workflow/agentic_output_test.go	Updates generated-output assertion.
.github/workflows/ab-testing-advisor.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/ace-editor.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/agent-job-health.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/agent-performance-analyzer.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/agent-persona-explorer.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/agentic-token-audit.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/agentic-token-optimizer.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/agentic-token-trend-audit.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/ai-moderator.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/api-consumption-report.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/approach-validator.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/archie.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/architecture-guardian.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/archivx-agentic-workflows-analyzer.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/artifacts-summary.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/audit-workflows.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/auto-triage-issues.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/avenger.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/aw-failure-investigator.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/blog-auditor.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/bot-detection.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/breaking-change-checker.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/changeset.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/chaos-pr-bundle-fuzzer.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/ci-coach.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/ci-doctor.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/claude-code-user-docs-review.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/cli-consistency-checker.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/cli-version-checker.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/cloclo.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/code-scanning-fixer.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/code-simplifier.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/codex-github-remote-mcp-test.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/commit-changes-analyzer.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/constraint-solving-potd.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/contribution-check.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/copilot-agent-analysis.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/copilot-centralization-drilldown.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/copilot-centralization-optimizer.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/copilot-cli-deep-research.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/copilot-opt.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/copilot-pr-merged-report.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/copilot-pr-nlp-analysis.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/copilot-pr-prompt-analysis.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/copilot-session-insights.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/craft.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/daily-action-setup-security-audit.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/daily-agent-of-the-day-blog-writer.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/daily-agentrx-trace-optimizer.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/daily-ambient-context-optimizer.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/daily-architecture-diagram.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/daily-arxiv-researcher.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/daily-assign-issue-to-user.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/daily-astrostylelite-markdown-spellcheck.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/daily-aw-cross-repo-compile-check.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/daily-awf-spec-compiler-surfacing.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/daily-byok-ollama-test.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/daily-cache-strategy-analyzer.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/daily-caveman-optimizer.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/daily-choice-test.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/daily-cli-performance.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/daily-cli-tools-tester.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/daily-code-debt-aider.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/daily-code-metrics.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/daily-community-attribution.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/daily-compiler-quality.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/daily-compiler-threat-spec-optimizer.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/daily-credit-limit-test.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/daily-doc-healer.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/daily-doc-updater.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/daily-documentation-diagram.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/daily-elixir-credo-snippet-audit.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/daily-evals-report.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/daily-experiment-report.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/daily-fact.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/daily-file-diet.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/daily-firewall-report.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/daily-formal-spec-verifier.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/daily-function-namer.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/daily-geo-optimizer.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/daily-github-docs-seo-optimizer.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/daily-go-test-parallelizer.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/daily-go-test-stubs-aider.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/daily-grader-audit.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/daily-graft-intelligence.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/daily-harness-experiment-proposer.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/daily-hippo-learn.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/daily-issues-report.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/daily-malicious-code-scan.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/daily-max-ai-credits-test.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/daily-mcp-concurrency-analysis.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/daily-model-inventory.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/daily-model-resolution.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/daily-multi-device-docs-tester.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/daily-news.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/daily-observability-report.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/daily-performance-summary.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/daily-pr-review-cursor.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/daily-regression-audit-kiro.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/daily-regulatory.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/daily-reliability-review.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/daily-rendering-scripts-verifier.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/daily-repo-chronicle.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/daily-safe-output-integrator.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/daily-safe-output-optimizer.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/daily-safe-outputs-conformance.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/daily-safeoutputs-git-simulator.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/daily-schema-audit-cursor.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/daily-secrets-analysis.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/daily-security-observability.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/daily-security-red-team.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/daily-semgrep-scan.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/daily-spdd-spec-planner.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/daily-spec-coverage-kiro.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/daily-spending-forecast.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/daily-squid-image-scan.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/daily-storify.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/daily-syntax-error-quality.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/daily-team-evolution-insights.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/daily-team-status.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/daily-testify-uber-super-expert.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/daily-token-consumption-report.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/daily-trajectory-grader-implementer.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/daily-vulnhunter-scan.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/daily-windows-defender-scan.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/daily-windows-terminal-integration-builder.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/daily-workflow-updater.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/daily-yamllint-fixer.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/dataflow-pr-discussion-dataset.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/dead-code-remover.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/deep-report.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/deepsec-security-scan.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/delight.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/dependabot-burner.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/dependabot-go-checker.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/deployment-incident-monitor.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/design-decision-gate.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/designer-drift-audit.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/detection-analysis-report.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/dev-hawk.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/dev.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/developer-docs-consolidator.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/dictation-prompt.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/docs-noob-tester.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/draft-pr-cleanup.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/duplicate-code-detector.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/eslint-miner.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/eslint-monster.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/eslint-refiner.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/evoskill-evolver.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/example-failure-category-filter.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/example-permissions-warning.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/example-workflow-analyzer.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/feature-grower.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/firewall-escape.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/firewall.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/front-page-copy-guard.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/functional-pragmatist.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/github-mcp-structural-analysis.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/github-mcp-tools-report.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/github-remote-mcp-auth-test.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/glossary-maintainer.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/go-fan.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/go-logger.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/go-pattern-detector.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/gpclean.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/grumpy-reviewer.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/hippo-embed.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/hourly-ci-cleaner.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/impeccable-skills-reviewer.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/instructions-janitor.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/issue-arborist.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/issue-monster.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/issue-triage-agent.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/jsweep.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/layout-spec-maintainer.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/lint-monster.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/linter-miner.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/lockfile-stats.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/mattpocock-skills-reviewer.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/mcp-inspector.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/mergefest.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/metrics-collector.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/necromancer.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/notion-issue-summary.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/objective-impact-report.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/org-health-report.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/outcome-collector.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/pdf-summary.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/plan.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/poem-bot.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/ponytail-reviewer.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/portfolio-analyst.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/pr-code-quality-reviewer.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/pr-description-caveman.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/pr-nitpick-reviewer.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/pr-sous-chef.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/pr-triage-agent.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/prompt-clustering-analysis.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/purelock.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/python-data-charts.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/q.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/refactoring-cadence.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/refiner.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/release.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/repo-audit-analyzer.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/repo-tree-map.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/repository-quality-improver.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/research.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/ruflo-backed-task.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/safe-output-health.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/schema-consistency-checker.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/schema-feature-coverage.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/scout.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/security-compliance.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/security-review.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/semantic-function-refactor.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/sergo.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/sighthound-security-scan.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/skillet.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/slide-deck-maintainer.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/smoke-agent-all-merged.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/smoke-agent-all-none.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/smoke-agent-public-approved.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/smoke-agent-public-none.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/smoke-agent-scoped-approved.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/smoke-aider.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/smoke-call-workflow.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/smoke-checkout-pr-dispatch.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/smoke-ci.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/smoke-claude-on-copilot.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/smoke-claude.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/smoke-codex.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/smoke-copilot-aoai-apikey.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/smoke-copilot-aoai-entra.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/smoke-copilot-arm.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/smoke-copilot-auto.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/smoke-copilot-mai.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/smoke-copilot-sdk.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/smoke-copilot-small.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/smoke-copilot-sub-agents.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/smoke-copilot.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/smoke-create-cross-repo-pr.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/smoke-crush.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/smoke-cursor.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/smoke-deepseek-harness.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/smoke-drive.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/smoke-gemini.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/smoke-github-claude.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/smoke-goose.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/smoke-kiro.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/smoke-multi-pr.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/smoke-opencode.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/smoke-otel-backends.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/smoke-pi.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/smoke-project.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/smoke-pydantic.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/smoke-service-ports.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/smoke-temporary-id.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/smoke-test-tools.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/smoke-update-cross-repo-pr.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/smoke-workflow-call-with-inputs.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/smoke-workflow-call.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/spec-enforcer.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/spec-extractor.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/spec-librarian.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/squad-game-planner.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/squad-implement-worker.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/squad-plan.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/squad.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/stale-pr-cleanup.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/stale-repo-identifier.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/static-analysis-report.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/step-name-alignment.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/sub-issue-closer.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/super-linter.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/technical-doc-writer.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/terminal-stylist.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/test-quality-sentinel.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/tidy.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/typist.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/ubuntu-image-analyzer.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/uk-ai-operational-resilience.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/unbloat-docs.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/update-astro.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/video-analyzer.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/visual-regression-checker.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/weekly-blog-post-writer.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/weekly-editors-health-check.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/weekly-issue-summary.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/weekly-network-domains-audit.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/weekly-safe-outputs-spec-review.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/windows-grower.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/windows.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/workflow-generator.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/workflow-health-manager.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/workflow-normalizer.lock.yml	Regenerates secure tool-cache setup.
.github/workflows/workflow-skill-extractor.lock.yml	Regenerates secure tool-cache setup.

Review details

• Files reviewed: 300/300 changed files
• Comments generated: 1
• Review effort level: Balanced

[Copilot]

Addressed in d82b286: the test now asserts the GH_AW_RUNNER_TOOL_CACHE: ${{ runner.tool_cache }} env mapping and isolates the generated run: block to ensure the expression is absent from shell code.

[Copilot]

@copilot aadd a rule in the compiler's shell checker. The compiler includes a microshell checker that detects these code patterns, raises an error, and tells the agent how to fix them.

Added a compiler shell-checker rule that rejects direct ${{ runner.tool_cache }} interpolation in run: scripts and explains the env-variable fix. Added regression coverage and generated-output assertions in commit 8c8a93a.

[gh-aw-bot]

@copilot Please address the remaining test-gap feedback on the latest head before handing back to maintainers.

• The current generated-output assertion only checks the shell-side variable reference. Please also assert that the step-level env mapping for GH_AW_RUNNER_TOOL_CACHE/RUNNER_TOOL_CACHE is present and that direct ${{ runner.tool_cache }} interpolation does not reappear in the generated script.
• Failed check still open on the current head:
  • Unit tests (D-G) — https://github.com/github/gh-aw/actions/runs/33689703664/job/100446430469
• Branch refresh was not requested from this pass.

Please run the pr-finisher skill and leave a concise maintainer-facing summary after the follow-up push.

Generated by PR Sous Chef

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 40.4 AIC · ⌖ 8.88 AIC · ⊞ 9.2K · ◷
_{Comment /souschef to run again}

[Copilot]

@copilot Please address the remaining test-gap feedback on the latest head before handing back to maintainers.

• The current generated-output assertion only checks the shell-side variable reference. ...

Pushed d82b286, strengthening pkg/workflow/agentic_output_test.go to verify the step-level GH_AW_RUNNER_TOOL_CACHE: ${{ runner.tool_cache }} mapping and inspect the generated run: block for any direct expression interpolation. Targeted workflow tests pass. The reported CI failure is an unrelated pre-existing fallback AW-file sync failure (compat.md missing from embedded data).

[github-actions]

🎉 This pull request is included in a new release.

Release: v0.88.2