Harden Copilot AWF node bootstrap when GH_AW_NODE_BIN is invalid in container

[Copilot]

Two Copilot workflows failed because GH_AW_NODE_BIN was exported from the host toolcache (/home/runner/work/_tool/...) and then reused inside AWF container execution where that path was not available. The driver launch used the broken path unconditionally, causing /bin/bash: ... No such file or directory.

• Runtime node resolution in AWF Copilot execution

  • Replaced direct ${GH_AW_NODE_BIN:-node} usage with guarded runtime resolution:
    • prefer GH_AW_NODE_BIN only when executable
    • otherwise fall back to command -v node (then node)
  • This keeps host-optimized resolution when valid, but avoids hard failure on unmapped toolcache paths.

• Shared command fragment for consistency

  • Extracted node-resolution shell logic into a shared constant used by command generation and tests to keep behavior and assertions aligned.

• Golden/workflow output updates

  • Updated WASM golden fixtures for the generated AWF command to reflect the new guarded node bootstrap sequence.

• Merge-conflict resolution with main

  • Merged origin/main and resolved conflicts in generated workflow outputs.
  • Preserved this PR’s node-bootstrap fallback while keeping AWF command-line flag behavior that already landed in main.

GH_AW_NODE_EXEC="${GH_AW_NODE_BIN:-}"
if [ -z "$GH_AW_NODE_EXEC" ] || [ ! -x "$GH_AW_NODE_EXEC" ]; then
  GH_AW_NODE_EXEC="$(command -v node 2>/dev/null || echo node)"
fi
"$GH_AW_NODE_EXEC" "${RUNNER_TEMP}/gh-aw/actions/copilot_driver.cjs" ...

[!WARNING]

[pelikhan]

@lpcox i broke self hosted runners

[lpcox]

@copilot resolve the merge conflicts in this pull request make sure that awf command line flags incorporate requirements from this PR as well as what has already landed in main

[lpcox]

@copilot resolve the merge conflicts in this pull request

[Copilot]

@copilot resolve the merge conflicts in this pull request make sure that awf command line flags incorporate requirements from this PR as well as what has already landed in main

Merged origin/main, resolved the PR conflicts, and kept both sets of requirements in the AWF/Copilot command path (including your latest main-branch AWF flag behavior plus this PR’s GH_AW_NODE_BIN runtime fallback). Addressed in 28f577f (merge resolution) with fixture refresh in 7cb0909.

[Copilot]

@copilot resolve the merge conflicts in this pull request

Conflicts are resolved on this PR branch. Merge resolution is in 28f577f, with follow-up fixture alignment in 7cb0909. No UI changes were made (no screenshot applicable).

[Copilot]

Pull request overview

Hardens Copilot AWF container execution by avoiding unconditional use of GH_AW_NODE_BIN when it points to a host-only toolcache path, preventing /bin/bash: ... No such file or directory failures inside containers.

Changes:

• Add guarded runtime Node resolution (prefer GH_AW_NODE_BIN only when executable; otherwise fall back to command -v node / node) for driver invocation.
• Centralize the shell fragment as a shared constant and assert its presence in the execution-step unit test.
• Regenerate golden fixtures and workflow lockfiles to match the new bootstrap sequence.

Show a summary per file

File	Description
pkg/workflow/copilot_engine_execution.go	Introduces shared Node runtime resolution fragment and uses it when building the driver execution prefix.
pkg/workflow/copilot_engine_test.go	Adds an assertion that the execution step includes the Node runtime resolution logic.
pkg/workflow/testdata/TestWasmGolden_CompileFixtures/basic-copilot.golden	Updates expected generated AWF command to include guarded Node bootstrap logic.
pkg/workflow/testdata/TestWasmGolden_CompileFixtures/with-imports.golden	Updates expected generated AWF command to include guarded Node bootstrap logic.
.github/workflows/workflow-health-manager.lock.yml	Regenerated locked workflow output to include guarded Node bootstrap logic.
.github/workflows/workflow-generator.lock.yml	Regenerated locked workflow output to include guarded Node bootstrap logic.
.github/workflows/weekly-safe-outputs-spec-review.lock.yml	Regenerated locked workflow output to include guarded Node bootstrap logic.
.github/workflows/weekly-blog-post-writer.lock.yml	Regenerated locked workflow output to include guarded Node bootstrap logic.
.github/workflows/video-analyzer.lock.yml	Regenerated locked workflow output to include guarded Node bootstrap logic.
.github/workflows/test-workflow.lock.yml	Regenerated locked workflow output to include guarded Node bootstrap logic.
.github/workflows/test-project-url-default.lock.yml	Regenerated locked workflow output to include guarded Node bootstrap logic.
.github/workflows/test-dispatcher.lock.yml	Regenerated locked workflow output to include guarded Node bootstrap logic.
.github/workflows/terminal-stylist.lock.yml	Regenerated locked workflow output to include guarded Node bootstrap logic.
.github/workflows/technical-doc-writer.lock.yml	Regenerated locked workflow output to include guarded Node bootstrap logic.
.github/workflows/super-linter.lock.yml	Regenerated locked workflow output to include guarded Node bootstrap logic.
.github/workflows/sub-issue-closer.lock.yml	Regenerated locked workflow output to include guarded Node bootstrap logic.
.github/workflows/smoke-update-cross-repo-pr.lock.yml	Regenerated locked workflow output to include guarded Node bootstrap logic.
.github/workflows/smoke-service-ports.lock.yml	Regenerated locked workflow output to include guarded Node bootstrap logic.
.github/workflows/smoke-create-cross-repo-pr.lock.yml	Regenerated locked workflow output to include guarded Node bootstrap logic.
.github/workflows/smoke-ci.lock.yml	Regenerated locked workflow output to include guarded Node bootstrap logic.
.github/workflows/security-review.lock.yml	Regenerated locked workflow output to include guarded Node bootstrap logic.
.github/workflows/security-compliance.lock.yml	Regenerated locked workflow output to include guarded Node bootstrap logic.
.github/workflows/repository-quality-improver.lock.yml	Regenerated locked workflow output to include guarded Node bootstrap logic.
.github/workflows/repo-tree-map.lock.yml	Regenerated locked workflow output to include guarded Node bootstrap logic.
.github/workflows/repo-audit-analyzer.lock.yml	Regenerated locked workflow output to include guarded Node bootstrap logic.
.github/workflows/refiner.lock.yml	Regenerated locked workflow output to include guarded Node bootstrap logic.
.github/workflows/refactoring-cadence.lock.yml	Regenerated locked workflow output to include guarded Node bootstrap logic.
.github/workflows/q.lock.yml	Regenerated locked workflow output to include guarded Node bootstrap logic.
.github/workflows/pr-triage-agent.lock.yml	Regenerated locked workflow output to include guarded Node bootstrap logic.
.github/workflows/pr-nitpick-reviewer.lock.yml	Regenerated locked workflow output to include guarded Node bootstrap logic.
.github/workflows/plan.lock.yml	Regenerated locked workflow output to include guarded Node bootstrap logic.
.github/workflows/pdf-summary.lock.yml	Regenerated locked workflow output to include guarded Node bootstrap logic.
.github/workflows/notion-issue-summary.lock.yml	Regenerated locked workflow output to include guarded Node bootstrap logic.
.github/workflows/metrics-collector.lock.yml	Regenerated locked workflow output to include guarded Node bootstrap logic.
.github/workflows/jsweep.lock.yml	Regenerated locked workflow output to include guarded Node bootstrap logic.
.github/workflows/issue-triage-agent.lock.yml	Regenerated locked workflow output to include guarded Node bootstrap logic.
.github/workflows/issue-monster.lock.yml	Regenerated locked workflow output to include guarded Node bootstrap logic.
.github/workflows/gpclean.lock.yml	Regenerated locked workflow output to include guarded Node bootstrap logic.
.github/workflows/github-remote-mcp-auth-test.lock.yml	Regenerated locked workflow output to include guarded Node bootstrap logic.
.github/workflows/firewall.lock.yml	Regenerated locked workflow output to include guarded Node bootstrap logic.
.github/workflows/example-permissions-warning.lock.yml	Regenerated locked workflow output to include guarded Node bootstrap logic.
.github/workflows/dictation-prompt.lock.yml	Regenerated locked workflow output to include guarded Node bootstrap logic.
.github/workflows/dev.lock.yml	Regenerated locked workflow output to include guarded Node bootstrap logic.
.github/workflows/dependabot-go-checker.lock.yml	Regenerated locked workflow output to include guarded Node bootstrap logic.
.github/workflows/dependabot-burner.lock.yml	Regenerated locked workflow output to include guarded Node bootstrap logic.
.github/workflows/dead-code-remover.lock.yml	Regenerated locked workflow output to include guarded Node bootstrap logic.
.github/workflows/daily-workflow-updater.lock.yml	Regenerated locked workflow output to include guarded Node bootstrap logic.
.github/workflows/daily-team-status.lock.yml	Regenerated locked workflow output to include guarded Node bootstrap logic.
.github/workflows/daily-semgrep-scan.lock.yml	Regenerated locked workflow output to include guarded Node bootstrap logic.
.github/workflows/daily-secrets-analysis.lock.yml	Regenerated locked workflow output to include guarded Node bootstrap logic.
.github/workflows/daily-regulatory.lock.yml	Regenerated locked workflow output to include guarded Node bootstrap logic.
.github/workflows/daily-malicious-code-scan.lock.yml	Regenerated locked workflow output to include guarded Node bootstrap logic.
.github/workflows/daily-cli-tools-tester.lock.yml	Regenerated locked workflow output to include guarded Node bootstrap logic.
.github/workflows/daily-cli-performance.lock.yml	Regenerated locked workflow output to include guarded Node bootstrap logic.
.github/workflows/daily-assign-issue-to-user.lock.yml	Regenerated locked workflow output to include guarded Node bootstrap logic.
.github/workflows/daily-architecture-diagram.lock.yml	Regenerated locked workflow output to include guarded Node bootstrap logic.
.github/workflows/craft.lock.yml	Regenerated locked workflow output to include guarded Node bootstrap logic.
.github/workflows/copilot-token-optimizer.lock.yml	Regenerated locked workflow output to include guarded Node bootstrap logic.
.github/workflows/copilot-pr-merged-report.lock.yml	Regenerated locked workflow output to include guarded Node bootstrap logic.
.github/workflows/contribution-check.lock.yml	Regenerated locked workflow output to include guarded Node bootstrap logic.
.github/workflows/constraint-solving-potd.lock.yml	Regenerated locked workflow output to include guarded Node bootstrap logic.
.github/workflows/code-simplifier.lock.yml	Regenerated locked workflow output to include guarded Node bootstrap logic.
.github/workflows/code-scanning-fixer.lock.yml	Regenerated locked workflow output to include guarded Node bootstrap logic.
.github/workflows/ci-coach.lock.yml	Regenerated locked workflow output to include guarded Node bootstrap logic.
.github/workflows/brave.lock.yml	Regenerated locked workflow output to include guarded Node bootstrap logic.
.github/workflows/bot-detection.lock.yml	Regenerated locked workflow output to include guarded Node bootstrap logic.
.github/workflows/archie.lock.yml	Regenerated locked workflow output to include guarded Node bootstrap logic.
.github/workflows/agentic-observability-kit.lock.yml	Regenerated locked workflow output to include guarded Node bootstrap logic.
.github/workflows/agent-persona-explorer.lock.yml	Regenerated locked workflow output to include guarded Node bootstrap logic.
.github/workflows/agent-performance-analyzer.lock.yml	Regenerated locked workflow output to include guarded Node bootstrap logic.
.github/workflows/agent-performance-analyzer.lock.yml	Regenerated locked workflow output to include guarded Node bootstrap logic (threat-detection step).
.github/workflows/ace-editor.lock.yml	Regenerated locked workflow output to include guarded Node bootstrap logic.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 131/131 changed files
• Comments generated: 0