thin GitHub remote-fetch wrappers (download

thin GitHub remote-fetch wrappers and repo-spec\n// parsing utilities.\n\npackage cli\n\nimport (\n\t\"errors\"\n\t\"path\"\n\t\"path/filepath\"\n\n\t\"github.com/github/gh-aw/pkg/constants\"\n\t\"github.com/github/gh-aw/pkg/logger\"\n)\n\nvar (\n\terrRepositoryPackageFileNotFound = errors.New(\"repository package file not found\")\n\terrRepositoryPackageManifestNotFound = errors.New(\"repository package manifest not found\")\n)\n\nvar downloadPackageFileFromGitHubForHost = downloadRepositoryPackageFileFromGitHubForHost\nvar listPackageWorkflowFilesForHost = listRepositoryPackageWorkflowFilesForHost\nvar listPackageDirFilesForHost = listRepositoryPackageDirFilesForHost\nvar listPackageDirFilesRecursivelyForHost = listRepositoryPackageDirFilesRecursivelyForHost\nvar listPackageDirSubdirsForHost = listRepositoryPackageDirSubdirsForHost\nvar getRepositoryPackageDefaultBranch = resolveRepositoryPackageDefaultBranch\nvar getRepositoryPackageLatestRelease = resolveRepositoryPackageLatestRelease\nvar addPackageManifestLog = logger.New(\"cli:add_package_manifest\")\n\nvar packageSourceDirectories = []string{\"workflows\", constants.WorkflowsDir}\n\nconst repositoryPackageManifestFileName = \"aw.yml\"\nconst repositoryPackageManifestVersion = \"1\"\nconst ghAwRepositorySlug = \"github/gh-aw\"\nconst packageSkillsDirectory = \"skills\"\nconst packageAgentsDirectory = \"agents\"\nconst packageSkillMarkerFile = \"SKILL.md\"\n\ntype resolvedRepositoryPackage struct {\n\tManifestPath string\n\tResolvedRef string\n\tName string\n\tEmoji string\n\tIcon string\n\tDescription string\n\tLicense string\n\tPrivate bool\n\tExperimental bool\n\tDocsPath string\n\tInstallationSource []resolvedPackageInstallable\n\tResourceFiles []resolvedPackageResource\n\tProjectFile *resolvedPackageResource\n\tBootstrap *repositoryPackageBootstrap\n\tSkillFiles []resolvedPackageSkillFile\n\tAgentFiles []string\n\tWarnings []string\n}\n\n// resolvedPackageInstallable pairs the location a workflow file is read from with the\n// path it is installed to in the consuming repository.\ntype resolvedPackageInstallable struct {\n\t// SourcePath is where the file is fetched from. For remote packages it is a\n\t// repository-relative path (e.g. \"factory/payload/workflows/reviewer.md\"); for local\n\t// packages it is an absolute filesystem path.\n\tSourcePath string\n\t// DestinationPath is the repository-root-relative install path in the consuming\n\t// repository (e.g. \".github/workflows/reviewer.md\").\n\tDestinationPath string\n}\n\ntype resolvedPackageResource struct {\n\tSourcePath string\n\tDestinationPath string\n}\n\n// packageInstallableSourcePaths returns the source paths of the given installables.\nfunc packageInstallableSourcePaths(installables []resolvedPackageInstallable) []string {\n\tpaths := make([]string, 0, len(installables))\n\tfor _, installable := range installables {\n\t\tpaths = append(paths, installable.SourcePath)\n\t}\n\treturn paths\n}\n\n// defaultPackageInstallDestination returns the repository-root-relative install path used\n// for entries that do not declare an explicit destination.\nfunc defaultPackageInstallDestination(sourcePath string) string {\n\treturn constants.WorkflowsDirSlash + path.Base(filepath.ToSlash(sourcePath))\n}\n\n// packageInstallablesFromSourcePaths converts plain source paths into installables using\n// the default destination for each entry.\nfunc packageInstallablesFromSourcePaths(sourcePaths []string) []resolvedPackageInstallable {\n\tinstallables := make([]resolvedPackageInstallable, 0, len(sourcePaths))\n\tfor _, sourcePath := range sourcePaths {\n\t\tinstallables = append(installables, resolvedPackageInstallable{\n\t\t\tSourcePath: sourcePath,\n\t\t\tDestinationPath: defaultPackageInstallDestination(sourcePath),\n\t\t})\n\t}\n\treturn installables\n}\n\n// resolvedPackageSkillFile represents a single file within a skill directory that\n// should

thin GitHub remote-fetch wrappers (download\n// file/list dir/branch/release lookups) and repo-spec parsing utilities.\n\npackage cli\n\nimport (\n\t\"context\"\n\t\"errors\"\n\t\"fmt\"\n\t\"path\"\n\t\"path/filepath\"\n\t\"strings\"\n\n\t\"github.com/github/gh-aw/pkg/errorutil\"\n\t\"github.com/github/gh-aw/pkg/parser\"\n\t\"github.com/github/gh-aw/pkg/workflow\"\n)\n\nfunc parseRepositoryPackageSpec(spec string) (*RepoSpec, bool, error) {\n\tif strings.HasPrefix(spec, \"http://\") || strings.HasPrefix(spec, \"https://\") || isLocalWorkflowPath(spec) {\n\t\treturn nil, false, nil\n\t}\n\n\tparts := strings.SplitN(spec, \"@\", 2)\n\tspecWithoutVersion := parts[0]\n\tif strings.HasSuffix(strings.ToLower(specWithoutVersion), \".md\") {\n\t\treturn nil, false, nil\n\t}\n\n\tslashParts := strings.Split(specWithoutVersion, \"/\")\n\tif len(slashParts) < 2 || slashParts[0] == \"\" || slashParts[1] == \"\" {\n\t\treturn nil, false, nil\n\t}\n\tif !parser.IsValidGitHubIdentifier(slashParts[0]) || !parser.IsValidGitHubRepositoryName(slashParts[1]) {\n\t\treturn nil, false, nil\n\t}\n\n\tpackagePath := strings.Trim(strings.Join(slashParts[2:], \"/\"), \"/\")\n\tif packagePath != \"\" {\n\t\tcleanedPath := path.Clean(packagePath)\n\t\tif cleanedPath == \".\" {\n\t\t\tpackagePath = \"\"\n\t\t} else if cleanedPath == \"..\" || strings.HasPrefix(cleanedPath, \"../\") {\n\t\t\treturn nil, true, fmt.Errorf(\"invalid repository package path %q: path traversal outside the repository is not allowed. Use a path relative to the repository root. Example: packages/my-package\", packagePath)\n\t\t} else {\n\t\t\tpackagePath = cleanedPath\n\t\t}\n\t}\n\n\trepoSpec := &RepoSpec{\n\t\tRepoSlug: path.Join(slashParts[0], slashParts[1]),\n\t\tPackagePath: packagePath,\n\t}\n\tif len(parts) == 2 {\n\t\trepoSpec.Version = parts[1]\n\t}\n\n\taddPackageManifestLog.Printf(\"Parsed repository package spec %q as repo=%s path=%q version=%q\", spec, repoSpec.RepoSlug, repoSpec.PackagePath, repoSpec.Version)\n\treturn repoSpec, true, nil\n}\n\nfunc joinRepositoryPackagePath(packagePath, relativePath string) string {\n\tif packagePath == \"\" {\n\t\treturn filepath.ToSlash(relativePath)\n\t}\n\treturn filepath.ToSlash(filepath.Join(packagePath, relativePath))\n}\n\nfunc stringValue(value any) (string, bool) {\n\ts, ok := value.(string)\n\treturn s, ok\n}\n\nfunc isRepositoryFileNotFound(err error) bool {\n\treturn errors.Is(err, errRepositoryPackageFileNotFound)\n}\n\nfunc isRepositoryPackageManifestNotFound(err error) bool {\n\treturn errors.Is(err, errRepositoryPackageManifestNotFound)\n}\n\nfunc downloadRepositoryPackageFileFromGitHubForHost(ctx context.Context, owner, repo, path, ref, host string) ([]byte, error) {\n\taddPackageManifestLog.Printf(\"Downloading repository package file %s from %s/%s@%s (host=%q)\", path, owner, repo, ref, host)\n\tcontent, err := parser.DownloadFileFromGitHubForHost(ctx, owner, repo, path, ref, host)\n\treturn content, normalizeRepositoryPackageRemoteError(err)\n}\n\nfunc listRepositoryPackageWorkflowFilesForHost(ctx context.Context, owner, repo, ref, workflowPath, host string) ([]string, error) {\n\tfiles, err := parser.ListWorkflowFilesForHost(ctx, owner, repo, ref, workflowPath, host)\n\treturn files, normalizeRepositoryPackageRemoteError(err)\n}\n\nfunc listRepositoryPackageDirFilesForHost(ctx context.Context, owner, repo, ref, dirPath, host string) ([]string, error) {\n\tfiles, err := parser.ListDirAllFilesForHost(ctx, owner, repo, ref, dirPath, host)\n\treturn files, normalizeRepositoryPackageRemoteError(err)\n}\n\nfunc listRepositoryPackageDirFilesRecursivelyForHost(ctx context.Context, owner, repo, ref, dirPath, host string) ([]string, error) {\n\tfiles, err := parser.ListDirAllFilesRecursivelyForHost(ctx, owner, repo, ref, dirPath, host)\n\treturn files, normalizeRepositoryPackageRemoteError(err)\n}\n\nfunc listRepositoryPackageDirSubdirsForHost(ctx context.Context, owner, repo, ref, dirPath, host string) ([]string, error) {\n\tdirs, err := parser.ListDirSubdirsForHost(ctx, owner, repo, ref, dirPath, host)\n\tretu

Process completed with exit code 1.

ERR_SYSTEM: ❌ Detection result file not found at: /tmp/gh-aw/threat-detection/detection_result.json

Process completed with exit code 2.

Process completed with exit code 1.

Agent execution exited with code 1

Agent reported that it could not complete the task

Replaced non-writable file for secret redaction: /home/runner/work/_temp/gh-aw/safeoutputs/outputs.jsonl

Replaced non-writable file for secret redaction: /tmp/gh-aw/mcp-logs/safeoutputs/server.log

Replaced non-writable file for secret redaction: /tmp/gh-aw/sandbox/firewall/logs/cli-proxy-logs/access.jsonl

Replaced non-writable file for secret redaction: /tmp/gh-aw/aw-log-actionlint-schedule-wizard-debug-logging.patch

Removed symbolic link before artifact upload: /tmp/gh-aw/latest

Removed symbolic link before artifact upload: /tmp/gh-aw/latest

⚠️ report_incomplete: Accidentally submitted the create_pull_request call with a placeholder title/body while testing a permission denial; the per-run limit (1) is now exhausted so the correct content could not be sent.

Failed to post comment to detection runs issue: Commenting is disabled on issues with more than 2500 comments - https://docs.github.com/rest/issues/comments#create-an-issue-comment

Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs.

"The ubuntu-latest label will migrate to Ubuntu 26 beginning October 19, 2026. For more information, see https://github.com/actions/runner-images/issues/14748"

"The ubuntu-latest label will migrate to Ubuntu 26 beginning October 19, 2026. For more information, see https://github.com/actions/runner-images/issues/14748"