Disable uv Actions caching and isolate sandbox runtime paths - #66958

✅ Test Quality Sentinel completed test quality analysis.

Test Quality Sentinel skipped because pre-fetch PR data was unavailable: unable to fetch test file diff

🧪 Test quality analysis by Test Quality Sentinel

✅ Design Decision Gate 🏗️ completed the design decision gate check. See the comment below for the result and any generated ADR draft.

🏗️ ADR gate enforced by Design Decision Gate 🏗️

✅ PR Code Quality Reviewer completed the code quality review.

🔎 Code quality review by PR Code Quality Reviewer

🧠 Matt Pocock Skills Reviewer is reviewing this pull request using Matt Pocock's engineering skills...

✅ Ponytail Reviewer completed successfully!

Lean already. Ship.

Generated by Ponytail Reviewer for #66958

Comment Memory

reviewed_at: 2026-10-08T18:21:23Z
review_event: REQUEST_CHANGES
top_themes:
  - substring-based deduplication can remove unrelated setup-uv-like actions
files_reviewed:
  - pkg/workflow/runtime_cache_validation.go
  - pkg/workflow/runtime_deduplication.go
  - pkg/workflow/awf_env.go
  - pkg/workflow/awf_command_builder.go
  - pkg/workflow/runtime_definitions.go
comment_count: 1

🔎 Code quality review by PR Code Quality Reviewer · copilot · gpt54 · 58 AIC · ⌖ 5.62 AIC · ⊞ 19.8K · ◷
_{Comment /review to run again}

🏗️ Design Decision Gate — ADR Required

This PR makes significant changes to core business logic (763 new lines across pkg/workflow/) but does not have a linked Architecture Decision Record (ADR).

📄 Draft ADR committed: docs/adr/66958-disable-uv-actions-caching-and-isolate-sandbox-runtime-paths.md — review and complete it before merging.

🔒 This PR cannot merge until an ADR is linked in the PR body.

🏗️ ADR gate enforced by Design Decision Gate 🏗️ · pi · opus50 · 54 AIC · ⌖ 54.1 AIC · ⊞ 1.8K · ◷
_{Comment /review to run again}

@copilot address the following outstanding work in one pass:

1. Update this branch with the latest main using make merge-main, resolving any conflicts and preserving the intended changes.
2. Review (pkg/workflow/runtime_cache_validation.go:14): This reuses DeduplicateRuntimeSetupStepsFromCustomSteps, but that helper still treats any uses: containing astral-sh/setup-uv as a runtime setup step, so an unrelated action like other/astral-sh/setup-uv... will be silently stripped before we validate or compile whenever uv is detected. - Disable uv Actions caching and isolate sandbox runtime paths #66958 (comment)
3. Review (pkg/workflow/awf_env.go:201): This literal-prefix check misses valid secret expressions such as ${{secrets.CACHE}} and ${{ vars.UV_CACHE_DIR || secrets.CACHE }}. When setup-uv is present and workflow env.UV_CACHE_DIR uses either form, the continue skips its runtime exclusion, allowing --env-all to forward the resolved secret unless explicitly excluded elsewhere. Use ExtractSecretsFromValue alongside ContainsJobOutputExpr, and add regression cases for these expression forms. - Disable uv Actions caching and isolate sandbox runtime paths #66958 (comment)
4. Review (pkg/workflow/runtime_cache_validation.go:20): Both this validator and runtimeHostOnlyEnvVarNames omit jobs.agent.setup-steps and jobs.agent.pre-steps, although applyBuiltinJobPreSteps inserts them before the agent. A setup-uv action there can pass strict compilation with caching enabled; with a sandbox-writable cache-local-path, its post action can save agent-written content to a repository-wide cache. Even with caching disabled, if uv is not otherwise detected, UV_PYTHON_INSTALL_DIR remains forwarded and managed interpreter downloads target the unwritable host directory. Include both nested sections in setup-action discovery ... - Disable uv Actions caching and isolate sandbox runtime paths #66958 (comment)

Push the necessary fixes, reply to each listed review thread and resolve it when addressed. Ignore feedback already answered or resolved. Use the pr-finisher skill and stop when only human review or CI remains; do not trigger CI.

Sous-chef head: ccd3c89
Sous-chef work: 193b7803a43ecb00a2f28cbae3e0ff5f795bdd62711599b39fef21e403609ccd 3175a1beb10e17852a448004df846fa350497d4e6f2ce47d7040ca2638d3b272 e01891bfdef02902536e6e233b586109250ba864eefc45067b70f47ce7e7864d
Sous-chef state: 59e1ae0e8e2be54a85a36787dddbd472ccd76817374cef4ae6c63785798a2aa7

Generated by 👨‍🍳 PR Sous Chef · pi · haiku45 · 3.79 AIC · ⌖ 6.76 AIC · ⊞ 1K · ◷
_{Comment /souschef to run again}

@lpcox

@copilot /pr-finisher

Verified at ab971d3c in our private sandbox (Copilot and pi engines, runtimes: uv, task runs uv sync and pytest, AWF v0.28.44):

• The setup-uv step has enable-cache: false. Its log shows no Set UV_CACHE_DIR, no cache restore and no cache save, and --exclude-env UV_CACHE_DIR / UV_PYTHON_INSTALL_DIR are on the AWF command.
• Inside the sandbox there were 0 Failed to initialize cache errors (previously 2–39 per run), and no agent invented its own UV_CACHE_DIR. The full test suite ran (408 passed; the 1 failure is an unrelated pre-existing test).

@copilot address the following outstanding work in one pass:

1. Update this branch with the latest main using make merge-main, resolving any conflicts and preserving the intended changes....

Merged latest main with make merge-main in 59836480, without conflicts. All three listed fixes are already in ab971d3; existing replies were not duplicated. Final review caught a related lowercase-secret regression, fixed with case-insensitive extraction and regression tests in 14e78d40. Targeted tests and all 333 workflow compilations/drift checks pass. Custom lint reports pre-existing diagnostics; CodeQL timed out. Two answered threads still need marking resolved: this environment has no authenticated thread-resolution tool. CI was not triggered.

@copilot /pr-finisher

Verified at ab971d3c in our private sandbox (Copilot and pi engines, runtimes: uv, task runs uv sync and pytest, AWF v0.28.44):...

Finisher pass pushed 59836480 (clean merge of latest main) and 14e78d40 (lowercase/mixed-case secret exclusion regression fix). Targeted uv/topology/secret tests, build, Go lint, and all 333 workflow drift checks pass. Remaining blockers: pre-existing custom-lint diagnostics, two already-answered threads requiring manual resolution, human review, and CI verification on the new head. CodeQL timed out; no CI was triggered.

Ready for review. Sandbox-verified at ab971d3c (Copilot and pi, runtimes: uv: no setup-uv cache restore or save, UV_* excluded, 0 uv errors in the sandbox, full pytest ran). The later commits (merge of main, lowercase-secret exclusion fix) compile to the same setup-uv and AWF exclusions. All review threads are resolved; Copilot answered each. CI on 14e78d40 needs a re-trigger.

Per @pelikhan's request to split this into smaller PRs, it's superseded by:

• Detect secret references in all AWF environment sources #67017 (fixes AWF --exclude-env misses secret references that aren't written exactly as '${{ secrets.' #67016): secret references that aren't written exactly as ${{ secrets. (lowercase, no space, or not first in a fallback expression) are now excluded from the agent sandbox's environment. This is the lowercase-secret fix from 14e78d40 here, broadened.
• Exclude Cloud Hypervisor HOME state from Git staging and agent patches #67020 (fixes Cloud Hypervisor: HOME tool state under /workspace/.awf-home can be staged into commits and agent patches #67018): git-exclude /.awf-home/ under Cloud Hypervisor.
• Disable Actions caching for setup-uv in agent jobs #67022 (fixes Generated setup-uv step: disable Actions caching in agentic jobs #67021): enable-cache: false for the generated setup-uv step.

The UV_CACHE_DIR/UV_PYTHON_INSTALL_DIR exclusion isn't carried over: gh-aw-firewall#9705 covers it once an AWF release containing it becomes gh-aw's default. This PR can be closed.