From 55a16cb35888fe0a1071216602fae696d2f03869 Mon Sep 17 00:00:00 2001
From: qyt <486179@qq.com>
Date: Mon, 9 Feb 2026 16:22:57 +0800
Subject: [PATCH 01/21] update:depend library
---
XEngine_Source/XEngine_DependLibrary | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/XEngine_Source/XEngine_DependLibrary b/XEngine_Source/XEngine_DependLibrary
index dc2e4b3..adf48e2 160000
--- a/XEngine_Source/XEngine_DependLibrary
+++ b/XEngine_Source/XEngine_DependLibrary
@@ -1 +1 @@
-Subproject commit dc2e4b3af5b666e888166ef1e7567475f6f03904
+Subproject commit adf48e22d68f741ec52f299945f8f8f8fb3df9d2
From 5a311211970fa870624005b345ac6dbb87f2e2f5 Mon Sep 17 00:00:00 2001
From: qyt <486179@qq.com>
Date: Fri, 3 Apr 2026 10:52:24 +0800
Subject: [PATCH 02/21] update:depend library
---
XEngine_Source/XEngine_DependLibrary | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/XEngine_Source/XEngine_DependLibrary b/XEngine_Source/XEngine_DependLibrary
index adf48e2..055db5a 160000
--- a/XEngine_Source/XEngine_DependLibrary
+++ b/XEngine_Source/XEngine_DependLibrary
@@ -1 +1 @@
-Subproject commit adf48e22d68f741ec52f299945f8f8f8fb3df9d2
+Subproject commit 055db5ab639c8dc656c149eb00b9773ec73585bb
From 06db213443dce3d6e4637084ec5bc66a1c360b07 Mon Sep 17 00:00:00 2001
From: qyt <486179@qq.com>
Date: Fri, 3 Apr 2026 10:57:40 +0800
Subject: [PATCH 03/21] ci:update last version
---
.github/workflows/Alma_build.yml | 8 ++++----
.github/workflows/Centos_build.yml | 8 ++++----
.github/workflows/Rocky_build.yml | 8 ++++----
.github/workflows/codeql.yml | 8 ++++----
.github/workflows/cppcheck.yml | 4 ++--
.github/workflows/debian_build.yml | 8 ++++----
.github/workflows/fedora_build.yml | 8 ++++----
.github/workflows/macbuild.yml | 8 ++++----
.github/workflows/msbuild.yml | 14 +++++++-------
.github/workflows/release.yml | 18 +++++++++---------
.github/workflows/ubuntu_build.yml | 12 ++++++------
11 files changed, 52 insertions(+), 52 deletions(-)
diff --git a/.github/workflows/Alma_build.yml b/.github/workflows/Alma_build.yml
index e61e9c2..91a13f8 100644
--- a/.github/workflows/Alma_build.yml
+++ b/.github/workflows/Alma_build.yml
@@ -44,16 +44,16 @@ jobs:
steps:
- name: Checkout main repository code
- uses: actions/checkout@v4
+ uses: actions/checkout@v6
- name: Checkout dependency repository (xengine)
- uses: actions/checkout@v4
+ uses: actions/checkout@v6
with:
repository: libxengine/libxengine
path: libxengine
- name: sub module checkout (opensource)
- uses: actions/checkout@v4
+ uses: actions/checkout@v6
with:
repository: libxengine/XEngine_OPenSource
path: XEngine_Source/XEngine_DependLibrary
@@ -92,7 +92,7 @@ jobs:
./XEngine_StreamMediaApp -t
- name: Upload folder as artifact
- uses: actions/upload-artifact@v4
+ uses: actions/upload-artifact@v6
with:
name: XEngine_StreamMediaApp-AlmaLinux_${{ matrix.version }}_${{ matrix.artifact }}
path: XEngine_Release/
\ No newline at end of file
diff --git a/.github/workflows/Centos_build.yml b/.github/workflows/Centos_build.yml
index eafc9f0..7be2cd6 100644
--- a/.github/workflows/Centos_build.yml
+++ b/.github/workflows/Centos_build.yml
@@ -48,16 +48,16 @@ jobs:
steps:
- name: Checkout main repository code
- uses: actions/checkout@v4
+ uses: actions/checkout@v6
- name: Checkout dependency repository (xengine)
- uses: actions/checkout@v4
+ uses: actions/checkout@v6
with:
repository: libxengine/libxengine
path: libxengine
- name: sub module checkout (opensource)
- uses: actions/checkout@v4
+ uses: actions/checkout@v6
with:
repository: libxengine/XEngine_OPenSource
path: XEngine_Source/XEngine_DependLibrary
@@ -96,7 +96,7 @@ jobs:
./XEngine_StreamMediaApp -t
- name: Upload folder as artifact
- uses: actions/upload-artifact@v4
+ uses: actions/upload-artifact@v6
with:
name: XEngine_StreamMediaApp-CentOS_${{ matrix.version }}_${{ matrix.artifact }}
path: XEngine_Release/
\ No newline at end of file
diff --git a/.github/workflows/Rocky_build.yml b/.github/workflows/Rocky_build.yml
index 3372c08..f524611 100644
--- a/.github/workflows/Rocky_build.yml
+++ b/.github/workflows/Rocky_build.yml
@@ -44,18 +44,18 @@ jobs:
steps:
- name: Checkout main repository code
- uses: actions/checkout@v4
+ uses: actions/checkout@v6
with:
ref: 'develop'
- name: Checkout dependency repository (xengine)
- uses: actions/checkout@v4
+ uses: actions/checkout@v6
with:
repository: libxengine/libxengine
path: libxengine
- name: sub module checkout (opensource)
- uses: actions/checkout@v4
+ uses: actions/checkout@v6
with:
repository: libxengine/XEngine_OPenSource
path: XEngine_Source/XEngine_DependLibrary
@@ -97,7 +97,7 @@ jobs:
./XEngine_StreamMediaApp -t
- name: Upload folder as artifact with RockyLinux
- uses: actions/upload-artifact@v4
+ uses: actions/upload-artifact@v6
with:
name: XEngine_StreamMediaApp-RockyLinux_${{ matrix.version }}_${{ matrix.artifact }}
path: XEngine_Release/
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 68215a0..068b65b 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -25,12 +25,12 @@ jobs:
- language: c-cpp
steps:
- name: Checkout repository
- uses: actions/checkout@v4
+ uses: actions/checkout@v6
with:
ref: 'develop'
- name: Checkout dependency repository (xengine)
- uses: actions/checkout@v4
+ uses: actions/checkout@v6
with:
repository: libxengine/libxengine
path: libxengine
@@ -53,7 +53,7 @@ jobs:
run: sudo apt install libsrt-gnutls-dev libsrtp2-dev -y
- name: Initialize CodeQL
- uses: github/codeql-action/init@v3
+ uses: github/codeql-action/init@v4
with:
languages: ${{ matrix.language }}
@@ -63,6 +63,6 @@ jobs:
make
- name: Perform CodeQL Analysis
- uses: github/codeql-action/analyze@v3
+ uses: github/codeql-action/analyze@v4
with:
category: "/language:${{ matrix.language }}"
diff --git a/.github/workflows/cppcheck.yml b/.github/workflows/cppcheck.yml
index f21ee6e..7146b82 100644
--- a/.github/workflows/cppcheck.yml
+++ b/.github/workflows/cppcheck.yml
@@ -15,7 +15,7 @@ jobs:
steps:
- name: Checkout main repository code
- uses: actions/checkout@v4
+ uses: actions/checkout@v6
with:
ref: 'develop'
@@ -29,7 +29,7 @@ jobs:
continue-on-error: true
- name: Upload Cppcheck Results
- uses: actions/upload-artifact@v4
+ uses: actions/upload-artifact@v6
with:
name: cppcheck_results
path: static_analysis/log.xml
\ No newline at end of file
diff --git a/.github/workflows/debian_build.yml b/.github/workflows/debian_build.yml
index 642d279..5894ff7 100644
--- a/.github/workflows/debian_build.yml
+++ b/.github/workflows/debian_build.yml
@@ -36,18 +36,18 @@ jobs:
steps:
- name: Checkout main repository code
- uses: actions/checkout@v4
+ uses: actions/checkout@v6
with:
ref: 'develop'
- name: Checkout dependency repository (xengine)
- uses: actions/checkout@v4
+ uses: actions/checkout@v6
with:
repository: libxengine/libxengine
path: libxengine
- name: sub module checkout (opensource)
- uses: actions/checkout@v4
+ uses: actions/checkout@v6
with:
repository: libxengine/XEngine_OPenSource
path: XEngine_Source/XEngine_DependLibrary
@@ -91,7 +91,7 @@ jobs:
./XEngine_StreamMediaApp -t
- name: Upload folder as artifact
- uses: actions/upload-artifact@v4
+ uses: actions/upload-artifact@v6
with:
name: XEngine_StreamMediaApp-Debian_${{ matrix.version }}_x86-64
path: XEngine_Release/
diff --git a/.github/workflows/fedora_build.yml b/.github/workflows/fedora_build.yml
index 16206d3..a96b818 100644
--- a/.github/workflows/fedora_build.yml
+++ b/.github/workflows/fedora_build.yml
@@ -34,16 +34,16 @@ jobs:
steps:
- name: Checkout main repository code
- uses: actions/checkout@v4
+ uses: actions/checkout@v6
- name: Checkout dependency repository (xengine)
- uses: actions/checkout@v4
+ uses: actions/checkout@v6
with:
repository: libxengine/libxengine
path: libxengine
- name: sub module checkout (opensource)
- uses: actions/checkout@v4
+ uses: actions/checkout@v6
with:
repository: libxengine/XEngine_OPenSource
path: XEngine_Source/XEngine_DependLibrary
@@ -83,7 +83,7 @@ jobs:
./XEngine_StreamMediaApp -t
- name: Upload folder as artifact
- uses: actions/upload-artifact@v4
+ uses: actions/upload-artifact@v6
with:
name: XEngine_XEngine_StreamMediaAppProxyServiceApp-Fedora_${{ matrix.fedora-version }}_${{ matrix.artifact }}
path: XEngine_Release/
diff --git a/.github/workflows/macbuild.yml b/.github/workflows/macbuild.yml
index ca59b4a..c8fffe4 100644
--- a/.github/workflows/macbuild.yml
+++ b/.github/workflows/macbuild.yml
@@ -23,12 +23,12 @@ jobs:
steps:
- name: Checkout main repository code
- uses: actions/checkout@v4
+ uses: actions/checkout@v6
with:
ref: 'develop'
- name: Checkout dependency repository (xengine)
- uses: actions/checkout@v4
+ uses: actions/checkout@v6
with:
repository: libxengine/libxengine
path: libxengine
@@ -84,14 +84,14 @@ jobs:
- name: Upload folder as artifact with mac x64
if: matrix.os == 'macos-15-intel'
- uses: actions/upload-artifact@v4
+ uses: actions/upload-artifact@v6
with:
name: XEngine_StreamMediaApp-Mac_x86_64
path: XEngine_Release/
retention-days: 1
- name: Upload folder as artifact with mac arm
if: matrix.os == 'macos-15'
- uses: actions/upload-artifact@v4
+ uses: actions/upload-artifact@v6
with:
name: XEngine_StreamMediaApp-Mac_Arm64
path: XEngine_Release/
diff --git a/.github/workflows/msbuild.yml b/.github/workflows/msbuild.yml
index 5772171..4b34e48 100644
--- a/.github/workflows/msbuild.yml
+++ b/.github/workflows/msbuild.yml
@@ -24,12 +24,12 @@ jobs:
steps:
- name: Checkout main repository code
- uses: actions/checkout@v4
+ uses: actions/checkout@v6
with:
ref: 'develop'
- name: Checkout dependency repository (xengine)
- uses: actions/checkout@v4
+ uses: actions/checkout@v6
with:
repository: libxengine/libxengine
path: libxengine
@@ -41,7 +41,7 @@ jobs:
shell: pwsh
- name: vcpkg dependency repository
- uses: actions/checkout@v4
+ uses: actions/checkout@v6
with:
repository: microsoft/vcpkg
path: vcpkg
@@ -107,7 +107,7 @@ jobs:
shell: pwsh
- name: Setup MSBuild
- uses: microsoft/setup-msbuild@v2
+ uses: microsoft/setup-msbuild@v3
- name: Build Solution
run: msbuild XEngine_Source/XEngine.sln /p:Configuration=${{ matrix.configuration }} /p:Platform=${{ matrix.platform }}
@@ -143,7 +143,7 @@ jobs:
- name: Upload folder as artifact with x86
if: matrix.configuration == 'Release' && matrix.platform == 'x86'
- uses: actions/upload-artifact@v4
+ uses: actions/upload-artifact@v6
with:
name: XEngine_StreamMediaApp-Windows_x86_32
path: XEngine_Release/
@@ -151,14 +151,14 @@ jobs:
- name: Upload folder as artifact with x64
if: matrix.configuration == 'Release' && matrix.platform == 'x64'
- uses: actions/upload-artifact@v4
+ uses: actions/upload-artifact@v6
with:
name: XEngine_StreamMediaApp-Windows_x86_64
path: XEngine_Release/
retention-days: 1
- name: Upload folder as artifact with ARM64
if: matrix.configuration == 'Release' && matrix.platform == 'ARM64'
- uses: actions/upload-artifact@v4
+ uses: actions/upload-artifact@v6
with:
name: XEngine_StreamMediaApp-Windows_Arm64
path: XEngine_Release/
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 3036c31..e53859b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -11,12 +11,12 @@ jobs:
steps:
- name: Checkout code
- uses: actions/checkout@v4
+ uses: actions/checkout@v6
with:
fetch-depth: 0
- name: Download ubuntu build
- uses: dawidd6/action-download-artifact@v6
+ uses: dawidd6/action-download-artifact@v20
with:
workflow: ubuntu_build.yml
workflow_conclusion: success
@@ -25,7 +25,7 @@ jobs:
if_no_artifact_found: fail
path: ./XRelease/
- name: Download debian build
- uses: dawidd6/action-download-artifact@v6
+ uses: dawidd6/action-download-artifact@v20
with:
workflow: debian_build.yml
workflow_conclusion: success
@@ -34,7 +34,7 @@ jobs:
if_no_artifact_found: fail
path: ./XRelease/
- name: Download fedora build
- uses: dawidd6/action-download-artifact@v6
+ uses: dawidd6/action-download-artifact@v20
with:
workflow: fedora_build.yml
workflow_conclusion: success
@@ -43,7 +43,7 @@ jobs:
if_no_artifact_found: fail
path: ./XRelease/
- name: Download Rocky build
- uses: dawidd6/action-download-artifact@v6
+ uses: dawidd6/action-download-artifact@v20
with:
workflow: Rocky_build.yml
workflow_conclusion: success
@@ -52,7 +52,7 @@ jobs:
if_no_artifact_found: fail
path: ./XRelease/
- name: Download Alma build
- uses: dawidd6/action-download-artifact@v6
+ uses: dawidd6/action-download-artifact@v20
with:
workflow: Alma_build.yml
workflow_conclusion: success
@@ -61,7 +61,7 @@ jobs:
if_no_artifact_found: fail
path: ./XRelease/
- name: Download CentOS build
- uses: dawidd6/action-download-artifact@v6
+ uses: dawidd6/action-download-artifact@v20
with:
workflow: Centos_build.yml
workflow_conclusion: success
@@ -70,7 +70,7 @@ jobs:
if_no_artifact_found: fail
path: ./XRelease/
- name: Download macbuild
- uses: dawidd6/action-download-artifact@v6
+ uses: dawidd6/action-download-artifact@v20
with:
workflow: macbuild.yml
workflow_conclusion: success
@@ -79,7 +79,7 @@ jobs:
if_no_artifact_found: fail
path: ./XRelease/
- name: Download msbuild
- uses: dawidd6/action-download-artifact@v6
+ uses: dawidd6/action-download-artifact@v20
with:
workflow: msbuild.yml
workflow_conclusion: success
diff --git a/.github/workflows/ubuntu_build.yml b/.github/workflows/ubuntu_build.yml
index 06356ec..a3b696d 100644
--- a/.github/workflows/ubuntu_build.yml
+++ b/.github/workflows/ubuntu_build.yml
@@ -28,13 +28,13 @@ jobs:
steps:
# 检出您的主仓库代码
- name: Checkout main repository code
- uses: actions/checkout@v4
+ uses: actions/checkout@v6
with:
ref: 'develop'
# 检出依赖的xengine仓库到指定的xengine目录
- name: Checkout dependency repository (xengine)
- uses: actions/checkout@v4
+ uses: actions/checkout@v6
with:
repository: libxengine/libxengine
path: libxengine
@@ -105,28 +105,28 @@ jobs:
- name: Upload folder as artifact with ubuntu22.04-x86-64
if: matrix.os == 'ubuntu-22.04'
- uses: actions/upload-artifact@v4
+ uses: actions/upload-artifact@v6
with:
name: XEngine_StreamMediaApp-Ubuntu_22.04_x86_64
path: XEngine_Release/
retention-days: 1
- name: Upload folder as artifact with ubuntu24.04-x86-64
if: matrix.os == 'ubuntu-24.04'
- uses: actions/upload-artifact@v4
+ uses: actions/upload-artifact@v6
with:
name: XEngine_StreamMediaApp-Ubuntu_24.04_x86_64
path: XEngine_Release/
retention-days: 1
- name: Upload folder as artifact with ubuntu22.04-arm
if: matrix.os == 'ubuntu-22.04-arm'
- uses: actions/upload-artifact@v4
+ uses: actions/upload-artifact@v6
with:
name: XEngine_StreamMediaApp-Ubuntu_22.04_Arm64
path: XEngine_Release/
retention-days: 1
- name: Upload folder as artifact with ubuntu24.04-arm
if: matrix.os == 'ubuntu-24.04-arm'
- uses: actions/upload-artifact@v4
+ uses: actions/upload-artifact@v6
with:
name: XEngine_StreamMediaApp-Ubuntu_24.04_Arm64
path: XEngine_Release/
From 8eac65ea2fc1d24e3dee6f82e612d14b4b1eaa3d Mon Sep 17 00:00:00 2001
From: qyt <486179@qq.com>
Date: Fri, 3 Apr 2026 11:02:05 +0800
Subject: [PATCH 04/21] fixed:build error
---
.../XEngine_StreamMediaApp/XEngine_AVPacket.cpp | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/XEngine_Source/XEngine_ServiceApp/XEngine_StreamMediaApp/XEngine_AVPacket.cpp b/XEngine_Source/XEngine_ServiceApp/XEngine_StreamMediaApp/XEngine_AVPacket.cpp
index b30dc2c..d41e03b 100644
--- a/XEngine_Source/XEngine_ServiceApp/XEngine_StreamMediaApp/XEngine_AVPacket.cpp
+++ b/XEngine_Source/XEngine_ServiceApp/XEngine_StreamMediaApp/XEngine_AVPacket.cpp
@@ -39,7 +39,7 @@ bool XEngine_AVPacket_AVCreate(LPCXSTR lpszClientAddr)
_xstprintf(tszTSFile, _X("%s/%s/%ld.ts"), st_ServiceConfig.st_XPull.st_PullHls.tszHLSPath, tszSMSAddr, time(NULL));
#endif
- HLSProtocol_M3u8Packet_AddStream(xhHLSFile, &xhSub, tszHLSFile, false);
+ HLSProtocol_M3u8Packet_AddStream(xhHLSFile, &xhSub, tszHLSFile, false, 0);
ModuleSession_PushStream_HLSInsert(lpszClientAddr, tszTSFile, xhSub);
XLOG_PRINT(xhLog, XENGINE_HELPCOMPONENTS_XLOG_IN_LOGLEVEL_INFO, _X("HLS端:%s,媒体文件创建成功,M3U8文件地址:%s,TS文件地址:%s"), lpszClientAddr, tszHLSFile, tszTSFile);
}
@@ -557,7 +557,7 @@ bool XEngine_AVPacket_AVFrame(XCHAR* ptszSDBuffer, int* pInt_SDLen, XCHAR* ptszR
ModuleSession_PushStream_HLSClose(lpszClientAddr, &xhSubFile);
BaseLib_String_GetSeparatorStr(tszHLSFile, _X("/"), tszFile, 2, false);
- HLSProtocol_M3u8Packet_AddFile(xhHLSFile, xhSubFile, tszFile, double(nCalValue), false);
+ HLSProtocol_M3u8Packet_AddFile(xhHLSFile, xhSubFile, tszFile, double(nCalValue));
//打开新的
#ifdef _MSC_BUILD
_xstprintf(tszTSFile, _X("%s/%s/%lld.ts"), st_ServiceConfig.st_XPull.st_PullHls.tszHLSPath, tszSMSAddr, time(NULL));
From 9fa978c3d5e898f4530bf5ad8cac280c0f792815 Mon Sep 17 00:00:00 2001
From: qyt <486179@qq.com>
Date: Fri, 3 Apr 2026 11:21:46 +0800
Subject: [PATCH 05/21] delete:debug code
---
.../XEngine_StreamMediaApp/XEngine_StreamMediaApp.cpp | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/XEngine_Source/XEngine_ServiceApp/XEngine_StreamMediaApp/XEngine_StreamMediaApp.cpp b/XEngine_Source/XEngine_ServiceApp/XEngine_StreamMediaApp/XEngine_StreamMediaApp.cpp
index 957679b..7516980 100644
--- a/XEngine_Source/XEngine_ServiceApp/XEngine_StreamMediaApp/XEngine_StreamMediaApp.cpp
+++ b/XEngine_Source/XEngine_ServiceApp/XEngine_StreamMediaApp/XEngine_StreamMediaApp.cpp
@@ -217,7 +217,7 @@ int main(int argc, char** argv)
memset(&st_ServiceConfig, '\0', sizeof(XENGINE_SERVICECONFIG));
//pSt_VFile = _xtfopen("./1.h264", "wb");
- pSt_AFile = _xtfopen("./1.opus", "wb");
+ //pSt_AFile = _xtfopen("./1.opus", "wb");
//初始化参数
if (!XEngine_Configure_Parament(argc, argv))
{
From 8c5d7a3550ba480c4f0cd1eea999741658314bc7 Mon Sep 17 00:00:00 2001
From: qyt <486179@qq.com>
Date: Tue, 28 Apr 2026 13:50:12 +0800
Subject: [PATCH 06/21] update:depend library
---
XEngine_Source/XEngine_DependLibrary | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/XEngine_Source/XEngine_DependLibrary b/XEngine_Source/XEngine_DependLibrary
index 055db5a..fa19ea8 160000
--- a/XEngine_Source/XEngine_DependLibrary
+++ b/XEngine_Source/XEngine_DependLibrary
@@ -1 +1 @@
-Subproject commit 055db5ab639c8dc656c149eb00b9773ec73585bb
+Subproject commit fa19ea8880dfa312221b5d17ece40c3bbc0f00cf
From 91cb0bee519277bf77e990c913b7509698ab94d5 Mon Sep 17 00:00:00 2001
From: qyt <486179@qq.com>
Date: Tue, 28 Apr 2026 13:59:52 +0800
Subject: [PATCH 07/21] ci:update
---
.github/workflows/codeql.yml | 68 ------------------------------
.github/workflows/fedora_build.yml | 5 +++
2 files changed, 5 insertions(+), 68 deletions(-)
delete mode 100644 .github/workflows/codeql.yml
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
deleted file mode 100644
index 068b65b..0000000
--- a/.github/workflows/codeql.yml
+++ /dev/null
@@ -1,68 +0,0 @@
-name: CodeQL Advanced
-
-on:
- push:
- branches:
- - develop
- paths:
- - 'XEngine_Source/**'
- - 'XEngine_Release/**'
- - '.github/**'
-
-jobs:
- analyze:
- runs-on: ubuntu-24.04
- permissions:
- security-events: write
- packages: read
- actions: read
- contents: read
-
- strategy:
- fail-fast: false
- matrix:
- include:
- - language: c-cpp
- steps:
- - name: Checkout repository
- uses: actions/checkout@v6
- with:
- ref: 'develop'
-
- - name: Checkout dependency repository (xengine)
- uses: actions/checkout@v6
- with:
- repository: libxengine/libxengine
- path: libxengine
-
- - name: sub module checkout (opensource)
- run: |
- git submodule init
- git submodule update
-
- - name: Set TERM variable
- run: echo "TERM=xterm" >> $GITHUB_ENV
-
- - name: Set up Dependency Environment
- run: |
- cd libxengine
- chmod +x ./XEngine_LINEnv.sh
- sudo ./XEngine_LINEnv.sh -i 3
-
- - name: install library
- run: sudo apt install libsrt-gnutls-dev libsrtp2-dev -y
-
- - name: Initialize CodeQL
- uses: github/codeql-action/init@v4
- with:
- languages: ${{ matrix.language }}
-
- - name: make
- run: |
- cd XEngine_Source
- make
-
- - name: Perform CodeQL Analysis
- uses: github/codeql-action/analyze@v4
- with:
- category: "/language:${{ matrix.language }}"
diff --git a/.github/workflows/fedora_build.yml b/.github/workflows/fedora_build.yml
index a96b818..5b406b9 100644
--- a/.github/workflows/fedora_build.yml
+++ b/.github/workflows/fedora_build.yml
@@ -21,6 +21,11 @@ jobs:
strategy:
matrix:
include:
+ - arch: amd64
+ runner: ubuntu-24.04
+ platform: linux/amd64
+ fedora-version: 43
+ artifact: x86-64
- arch: amd64
runner: ubuntu-24.04
platform: linux/amd64
From e5e9e016160de5778f1b76191d5833f5250fc9ae Mon Sep 17 00:00:00 2001
From: qyt <486179@qq.com>
Date: Tue, 28 Apr 2026 14:16:50 +0800
Subject: [PATCH 08/21] ci:delete cppcheck.yml and update codeql.yml
---
.github/workflows/codeql.yml | 39 ++++++++++++++++++++++++++++++++++
.github/workflows/cppcheck.yml | 35 ------------------------------
2 files changed, 39 insertions(+), 35 deletions(-)
create mode 100644 .github/workflows/codeql.yml
delete mode 100644 .github/workflows/cppcheck.yml
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
new file mode 100644
index 0000000..88e161f
--- /dev/null
+++ b/.github/workflows/codeql.yml
@@ -0,0 +1,39 @@
+name: CodeQL Advanced
+
+on:
+ push:
+ branches:
+ - develop
+ paths:
+ - 'XEngine_Source/**'
+
+jobs:
+ analyze:
+ name: Analyze C++
+ runs-on: ubuntu-24.04
+ permissions:
+ security-events: write
+ packages: read
+ actions: read
+ contents: read
+
+ steps:
+ - name: Checkout repository
+ uses: actions/checkout@v6
+ with:
+ ref: 'develop'
+
+ - name: Set TERM variable
+ run: echo "TERM=xterm" >> $GITHUB_ENV
+
+ - name: Initialize CodeQL
+ uses: github/codeql-action/init@v4
+ with:
+ languages: c-cpp
+ build-mode: none
+ queries: security-extended
+
+ - name: Perform CodeQL Analysis
+ uses: github/codeql-action/analyze@v4
+ with:
+ category: "/language:c-cpp"
diff --git a/.github/workflows/cppcheck.yml b/.github/workflows/cppcheck.yml
deleted file mode 100644
index 7146b82..0000000
--- a/.github/workflows/cppcheck.yml
+++ /dev/null
@@ -1,35 +0,0 @@
-name: cpp check workflows
-
-on:
- push:
- branches:
- - develop
- paths:
- - 'XEngine_Source/**'
- - 'XEngine_Release/**'
- - '.github/**'
-
-jobs:
- build:
- runs-on: ubuntu-latest
-
- steps:
- - name: Checkout main repository code
- uses: actions/checkout@v6
- with:
- ref: 'develop'
-
- - name: Create static_analysis directory
- run: mkdir -p static_analysis
-
- - name: Run Cppcheck
- run: |
- sudo apt-get install -y cppcheck
- cppcheck --enable=all --language=c++ --std=c++20 ./XEngine_Source/ --output-file=static_analysis/log.xml --xml
- continue-on-error: true
-
- - name: Upload Cppcheck Results
- uses: actions/upload-artifact@v6
- with:
- name: cppcheck_results
- path: static_analysis/log.xml
\ No newline at end of file
From 4ec9cdc4bc6a80443c3a7bad4e4091429ccf7b3a Mon Sep 17 00:00:00 2001
From: qyt <486179@qq.com>
Date: Tue, 28 Apr 2026 14:23:57 +0800
Subject: [PATCH 09/21] modify: does not case-sensitive for HTTP API function
names
---
.../StreamMedia_HTTPApi/StreamMedia_HTTPApi.cpp | 8 ++++----
.../XEngine_StreamMediaApp/XEngine_HttpTask.cpp | 16 ++++++++--------
2 files changed, 12 insertions(+), 12 deletions(-)
diff --git a/XEngine_Source/XEngine_ServiceApp/XEngine_StreamMediaApp/StreamMedia_HTTPApi/StreamMedia_HTTPApi.cpp b/XEngine_Source/XEngine_ServiceApp/XEngine_StreamMediaApp/StreamMedia_HTTPApi/StreamMedia_HTTPApi.cpp
index 6c8079f..e49b1e1 100644
--- a/XEngine_Source/XEngine_ServiceApp/XEngine_StreamMediaApp/StreamMedia_HTTPApi/StreamMedia_HTTPApi.cpp
+++ b/XEngine_Source/XEngine_ServiceApp/XEngine_StreamMediaApp/StreamMedia_HTTPApi/StreamMedia_HTTPApi.cpp
@@ -34,14 +34,14 @@ bool HTTPApi_Management_Task(LPCXSTR lpszClientAddr, XCHAR*** ppptszListHdr, int
BaseLib_String_GetKeyValue((*ppptszListHdr)[0], "=", tszKeyBuffer, tszVluBuffer);
- if (0 == _tcsxnicmp(lpszAPIPublish, tszVluBuffer, _tcsxlen(lpszAPIPublish)))
+ if (0 == _tcsxncmp(lpszAPIPublish, tszVluBuffer, _tcsxlen(lpszAPIPublish)))
{
//获取发布流:http://127.0.0.1:5600?api?function=publish&method=get
memset(tszKeyBuffer, '\0', sizeof(tszKeyBuffer));
memset(tszVluBuffer, '\0', sizeof(tszVluBuffer));
BaseLib_String_GetKeyValue((*ppptszListHdr)[1], "=", tszKeyBuffer, tszVluBuffer);
- if (0 == _tcsxnicmp(lpszAPIGet, tszVluBuffer, _tcsxlen(lpszAPIGet)))
+ if (0 == _tcsxncmp(lpszAPIGet, tszVluBuffer, _tcsxlen(lpszAPIGet)))
{
int nListCount = 0;
STREAMMEDIA_PUBLISHINFO** ppSt_ProtocolStream;
@@ -53,14 +53,14 @@ bool HTTPApi_Management_Task(LPCXSTR lpszClientAddr, XCHAR*** ppptszListHdr, int
BaseLib_Memory_Free((XPPPMEM)&ppSt_ProtocolStream, nListCount);
}
}
- else if (0 == _tcsxnicmp(lpszAPIPull, tszVluBuffer, _tcsxlen(lpszAPIPull)))
+ else if (0 == _tcsxncmp(lpszAPIPull, tszVluBuffer, _tcsxlen(lpszAPIPull)))
{
//获取订阅流:http://127.0.0.1:5600/api?function=pull&method=get
memset(tszKeyBuffer, '\0', sizeof(tszKeyBuffer));
memset(tszVluBuffer, '\0', sizeof(tszVluBuffer));
BaseLib_String_GetKeyValue((*ppptszListHdr)[1], "=", tszKeyBuffer, tszVluBuffer);
- if (0 == _tcsxnicmp(lpszAPIGet, tszVluBuffer, _tcsxlen(lpszAPIGet)))
+ if (0 == _tcsxncmp(lpszAPIGet, tszVluBuffer, _tcsxlen(lpszAPIGet)))
{
int nListCount = 0;
STREAMMEDIA_PULLLISTINFO** ppSt_PullList;
diff --git a/XEngine_Source/XEngine_ServiceApp/XEngine_StreamMediaApp/XEngine_HttpTask.cpp b/XEngine_Source/XEngine_ServiceApp/XEngine_StreamMediaApp/XEngine_HttpTask.cpp
index 55d9613..912f714 100644
--- a/XEngine_Source/XEngine_ServiceApp/XEngine_StreamMediaApp/XEngine_HttpTask.cpp
+++ b/XEngine_Source/XEngine_ServiceApp/XEngine_StreamMediaApp/XEngine_HttpTask.cpp
@@ -203,7 +203,7 @@ bool XEngine_HTTPTask_Handle(RFCCOMPONENTS_HTTP_REQPARAM* pSt_HTTPParam, LPCXSTR
memset(tszKey, '\0', sizeof(tszKey));
memset(tszValue, '\0', sizeof(tszValue));
- if (0 != _tcsxnicmp(lpszFuncName, tszUrlName, _tcsxlen(lpszFuncName)) && 0 != _tcsxnicmp(lpszFunRtc, tszAPIType, _tcsxlen(lpszFunRtc)))
+ if (0 != _tcsxncmp(lpszFuncName, tszUrlName, _tcsxlen(lpszFuncName)) && 0 != _tcsxncmp(lpszFunRtc, tszAPIType, _tcsxlen(lpszFunRtc)))
{
ModuleProtocol_Packet_Comm(tszRVBuffer, &nRVLen, NULL, ERROR_SMS_PROTOCOL_REQUEST_PARAMETER, "Bad Request,parament is incorrent");
HttpProtocol_Server_SendMsgEx(xhHttpPacket, tszSDBuffer, &nSDLen, &st_HDRParam, tszRVBuffer, nRVLen);
@@ -213,11 +213,11 @@ bool XEngine_HTTPTask_Handle(RFCCOMPONENTS_HTTP_REQPARAM* pSt_HTTPParam, LPCXSTR
return false;
}
//获得方法
- if (0 == _tcsxnicmp(lpszMethodPost, pSt_HTTPParam->tszHttpMethod, _tcsxlen(lpszMethodPost)))
+ if (0 == _tcsxncmp(lpszMethodPost, pSt_HTTPParam->tszHttpMethod, _tcsxlen(lpszMethodPost)))
{
- if (0 == _tcsxnicmp(lpszFunRtc, tszAPIType, _tcsxlen(lpszFunRtc)))
+ if (0 == _tcsxncmp(lpszFunRtc, tszAPIType, _tcsxlen(lpszFunRtc)))
{
- if (0 == _tcsxnicmp(tszAPIName, "whip", 4))
+ if (0 == _tcsxncmp(tszAPIName, "whip", 4))
{
PushStream_ClientWhip_Handle(pSt_HTTPParam, lpszClientAddr, lpszMsgBuffer, nMsgLen);
}
@@ -227,23 +227,23 @@ bool XEngine_HTTPTask_Handle(RFCCOMPONENTS_HTTP_REQPARAM* pSt_HTTPParam, LPCXSTR
}
}
}
- else if (0 == _tcsxnicmp(lpszMethodGet, pSt_HTTPParam->tszHttpMethod, _tcsxlen(lpszMethodGet)))
+ else if (0 == _tcsxncmp(lpszMethodGet, pSt_HTTPParam->tszHttpMethod, _tcsxlen(lpszMethodGet)))
{
//获得函数名
BaseLib_String_GetKeyValue(pptszList[0], "=", tszKey, tszValue);
//获得函数名
//http://app.xyry.org:5501/api?function=forward&url=http://app.xyry.org
- if (0 == _tcsxnicmp(lpszFunctionStr, tszKey, _tcsxlen(lpszFunctionStr)))
+ if (0 == _tcsxncmp(lpszFunctionStr, tszKey, _tcsxlen(lpszFunctionStr)))
{
HTTPApi_Management_Task(lpszClientAddr, &pptszList, nListCount);
}
- else if (0 == _tcsxnicmp(lpszStreamStr, tszKey, _tcsxlen(lpszStreamStr)))
+ else if (0 == _tcsxncmp(lpszStreamStr, tszKey, _tcsxlen(lpszStreamStr)))
{
//如果是拉流请求
PullStream_ClientGet_Handle(lpszClientAddr, &pptszList, nListCount);
}
}
- else if (0 == _tcsxnicmp(lpszMethodOPtion, pSt_HTTPParam->tszHttpMethod, _tcsxlen(lpszMethodOPtion)))
+ else if (0 == _tcsxncmp(lpszMethodOPtion, pSt_HTTPParam->tszHttpMethod, _tcsxlen(lpszMethodOPtion)))
{
nSDLen = _xstprintf(tszSDBuffer, _X("HTTP/1.1 200 OK\r\n"
"Connection: Close\r\n"
From 3c553c1f2a0a8d7f018c120eced0cf9909988d68 Mon Sep 17 00:00:00 2001
From: qyt <486179@qq.com>
Date: Sat, 9 May 2026 14:38:07 +0800
Subject: [PATCH 10/21] feat: add agentic workflows for issue triage and auto
fix
---
.github/workflows/auto-code.lock.yml | 1179 +++++++++++++++++++++++
.github/workflows/auto-code.md | 88 ++
.github/workflows/issue-triage.lock.yml | 1097 +++++++++++++++++++++
.github/workflows/issue-triage.md | 68 ++
4 files changed, 2432 insertions(+)
create mode 100644 .github/workflows/auto-code.lock.yml
create mode 100644 .github/workflows/auto-code.md
create mode 100644 .github/workflows/issue-triage.lock.yml
create mode 100644 .github/workflows/issue-triage.md
diff --git a/.github/workflows/auto-code.lock.yml b/.github/workflows/auto-code.lock.yml
new file mode 100644
index 0000000..919efe7
--- /dev/null
+++ b/.github/workflows/auto-code.lock.yml
@@ -0,0 +1,1179 @@
+# gh-aw-metadata: {"schema_version":"v3","frontmatter_hash":"158e10df0b3421742ed672f7a5667899e0977be63eed6a6fa996ccb9de250211","compiler_version":"v0.71.5","agent_id":"copilot"}
+# gh-aw-manifest: {"version":1,"secrets":["COPILOT_GITHUB_TOKEN","GH_AW_CI_TRIGGER_TOKEN","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN","OPENAI_API_KEY"],"actions":[{"repo":"actions/checkout","sha":"de0fac2e4500dabe0009e67214ff5f5447ce83dd","version":"v6.0.2"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"},{"repo":"github/gh-aw-actions/setup","sha":"b8068426813005612b960b5ab0b8bd2c27142323","version":"v0.71.5"}],"containers":[{"image":"ghcr.io/github/github-mcp-server:v1.0.3","digest":"sha256:2ac27ef03461ef2b877031b838a7d1fd7f12b12d4ace7796d8cad91446d55959","pinned_image":"ghcr.io/github/github-mcp-server:v1.0.3@sha256:2ac27ef03461ef2b877031b838a7d1fd7f12b12d4ace7796d8cad91446d55959"},{"image":"node:lts-alpine","digest":"sha256:d1b3b4da11eefd5941e7f0b9cf17783fc99d9c6fc34884a665f40a06dbdfc94f","pinned_image":"node:lts-alpine@sha256:d1b3b4da11eefd5941e7f0b9cf17783fc99d9c6fc34884a665f40a06dbdfc94f"}]}
+# ___ _ _
+# / _ \ | | (_)
+# | |_| | __ _ ___ _ __ | |_ _ ___
+# | _ |/ _` |/ _ \ '_ \| __| |/ __|
+# | | | | (_| | __/ | | | |_| | (__
+# \_| |_/\__, |\___|_| |_|\__|_|\___|
+# __/ |
+# _ _ |___/
+# | | | | / _| |
+# | | | | ___ _ __ _ __| |_| | _____ ____
+# | |/\| |/ _ \ '__| |/ /| _| |/ _ \ \ /\ / / ___|
+# \ /\ / (_) | | | | ( | | | | (_) \ V V /\__ \
+# \/ \/ \___/|_| |_|\_\|_| |_|\___/ \_/\_/ |___/
+#
+# This file was automatically generated by gh-aw (v0.71.5). DO NOT EDIT.
+#
+# To update this file, edit the corresponding .md file and run:
+# gh aw compile
+# Not all edits will cause changes to this file.
+#
+# For more information: https://github.github.com/gh-aw/introduction/overview/
+#
+#
+# Secrets used:
+# - COPILOT_GITHUB_TOKEN
+# - GH_AW_CI_TRIGGER_TOKEN
+# - GH_AW_GITHUB_MCP_SERVER_TOKEN
+# - GH_AW_GITHUB_TOKEN
+# - GITHUB_TOKEN
+# - OPENAI_API_KEY
+#
+# Custom actions used:
+# - actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+# - actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+# - actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+# - actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+# - github/gh-aw-actions/setup@b8068426813005612b960b5ab0b8bd2c27142323 # v0.71.5
+#
+# Container images used:
+# - ghcr.io/github/github-mcp-server:v1.0.3@sha256:2ac27ef03461ef2b877031b838a7d1fd7f12b12d4ace7796d8cad91446d55959
+# - node:lts-alpine@sha256:d1b3b4da11eefd5941e7f0b9cf17783fc99d9c6fc34884a665f40a06dbdfc94f
+
+name: "自动处理 Issue"
+"on":
+ issues:
+ types:
+ - labeled
+
+permissions: {}
+
+concurrency:
+ group: "gh-aw-${{ github.workflow }}-${{ github.event.issue.number || github.run_id }}"
+
+run-name: "自动处理 Issue"
+
+jobs:
+ activation:
+ needs: pre_activation
+ if: needs.pre_activation.outputs.activated == 'true'
+ runs-on: ubuntu-slim
+ permissions:
+ actions: read
+ contents: read
+ outputs:
+ body: ${{ steps.sanitized.outputs.body }}
+ comment_id: ""
+ comment_repo: ""
+ engine_id: ${{ steps.generate_aw_info.outputs.engine_id }}
+ lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }}
+ model: ${{ steps.generate_aw_info.outputs.model }}
+ setup-trace-id: ${{ steps.setup.outputs.trace-id }}
+ stale_lock_file_failed: ${{ steps.check-lock-file.outputs.stale_lock_file_failed == 'true' }}
+ text: ${{ steps.sanitized.outputs.text }}
+ title: ${{ steps.sanitized.outputs.title }}
+ steps:
+ - name: Setup Scripts
+ id: setup
+ uses: github/gh-aw-actions/setup@b8068426813005612b960b5ab0b8bd2c27142323 # v0.71.5
+ with:
+ destination: ${{ runner.temp }}/gh-aw/actions
+ job-name: ${{ github.job }}
+ trace-id: ${{ needs.pre_activation.outputs.setup-trace-id }}
+ env:
+ GH_AW_SETUP_WORKFLOW_NAME: "自动处理 Issue"
+ GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/auto-code.lock.yml@${{ github.ref }}
+ GH_AW_INFO_VERSION: "1.0.40"
+ - name: Generate agentic run info
+ id: generate_aw_info
+ env:
+ GH_AW_INFO_ENGINE_ID: "copilot"
+ GH_AW_INFO_ENGINE_NAME: "GitHub Copilot CLI"
+ GH_AW_INFO_MODEL: ${{ vars.GH_AW_MODEL_AGENT_COPILOT || 'claude-sonnet-4.6' }}
+ GH_AW_INFO_VERSION: "1.0.40"
+ GH_AW_INFO_AGENT_VERSION: "1.0.40"
+ GH_AW_INFO_CLI_VERSION: "v0.71.5"
+ GH_AW_INFO_WORKFLOW_NAME: "自动处理 Issue"
+ GH_AW_INFO_EXPERIMENTAL: "false"
+ GH_AW_INFO_SUPPORTS_TOOLS_ALLOWLIST: "true"
+ GH_AW_INFO_STAGED: "false"
+ GH_AW_INFO_ALLOWED_DOMAINS: '["defaults","ark.cn-beijing.volces.com"]'
+ GH_AW_INFO_FIREWALL_ENABLED: "false"
+ GH_AW_INFO_AWF_VERSION: ""
+ GH_AW_INFO_AWMG_VERSION: ""
+ GH_AW_INFO_FIREWALL_TYPE: ""
+ GH_AW_COMPILED_STRICT: "false"
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ with:
+ script: |
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require('${{ runner.temp }}/gh-aw/actions/generate_aw_info.cjs');
+ await main(core, context);
+ - name: Checkout .github and .agents folders
+ uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ with:
+ persist-credentials: false
+ sparse-checkout: |
+ .github
+ .agents
+ .claude
+ .codex
+ .crush
+ .gemini
+ .opencode
+ .pi
+ sparse-checkout-cone-mode: true
+ fetch-depth: 1
+ - name: Save agent config folders for base branch restoration
+ env:
+ GH_AW_AGENT_FOLDERS: ".agents .claude .codex .crush .gemini .github .opencode .pi"
+ GH_AW_AGENT_FILES: ".crush.json AGENTS.md CLAUDE.md GEMINI.md PI.md opencode.jsonc"
+ # poutine:ignore untrusted_checkout_exec
+ run: bash "${RUNNER_TEMP}/gh-aw/actions/save_base_github_folders.sh"
+ - name: Check workflow lock file
+ id: check-lock-file
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_WORKFLOW_FILE: "auto-code.lock.yml"
+ GH_AW_CONTEXT_WORKFLOW_REF: "${{ github.workflow_ref }}"
+ with:
+ script: |
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require('${{ runner.temp }}/gh-aw/actions/check_workflow_timestamp_api.cjs');
+ await main();
+ - name: Check compile-agentic version
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_COMPILED_VERSION: "v0.71.5"
+ with:
+ script: |
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require('${{ runner.temp }}/gh-aw/actions/check_version_updates.cjs');
+ await main();
+ - name: Compute current body text
+ id: sanitized
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_ALLOWED_DOMAINS: "api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,api.snapcraft.io,archive.ubuntu.com,ark.cn-beijing.volces.com,azure.archive.ubuntu.com,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,github.com,host.docker.internal,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,ppa.launchpad.net,raw.githubusercontent.com,registry.npmjs.org,s.symcb.com,s.symcd.com,security.ubuntu.com,telemetry.enterprise.githubcopilot.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com,www.googleapis.com"
+ with:
+ script: |
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require('${{ runner.temp }}/gh-aw/actions/compute_text.cjs');
+ await main();
+ - name: Create prompt with built-in context
+ env:
+ GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
+ GH_AW_SAFE_OUTPUTS: ${{ runner.temp }}/gh-aw/safeoutputs/outputs.jsonl
+ GH_AW_GITHUB_ACTOR: ${{ github.actor }}
+ GH_AW_GITHUB_EVENT_COMMENT_ID: ${{ github.event.comment.id }}
+ GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER: ${{ github.event.discussion.number }}
+ GH_AW_GITHUB_EVENT_ISSUE_NUMBER: ${{ github.event.issue.number }}
+ GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER: ${{ github.event.pull_request.number }}
+ GH_AW_GITHUB_REPOSITORY: ${{ github.repository }}
+ GH_AW_GITHUB_RUN_ID: ${{ github.run_id }}
+ GH_AW_GITHUB_WORKSPACE: ${{ github.workspace }}
+ # poutine:ignore untrusted_checkout_exec
+ run: |
+ bash "${RUNNER_TEMP}/gh-aw/actions/create_prompt_first.sh"
+ {
+ cat << 'GH_AW_PROMPT_de410bcdbc8f0b37_EOF'
+
+ GH_AW_PROMPT_de410bcdbc8f0b37_EOF
+ cat "${RUNNER_TEMP}/gh-aw/prompts/xpia.md"
+ cat "${RUNNER_TEMP}/gh-aw/prompts/temp_folder_prompt.md"
+ cat "${RUNNER_TEMP}/gh-aw/prompts/markdown.md"
+ cat "${RUNNER_TEMP}/gh-aw/prompts/safe_outputs_prompt.md"
+ cat << 'GH_AW_PROMPT_de410bcdbc8f0b37_EOF'
+
+ Tools: add_comment, create_pull_request, missing_tool, missing_data, noop
+ GH_AW_PROMPT_de410bcdbc8f0b37_EOF
+ cat "${RUNNER_TEMP}/gh-aw/prompts/safe_outputs_create_pull_request.md"
+ cat << 'GH_AW_PROMPT_de410bcdbc8f0b37_EOF'
+
+ GH_AW_PROMPT_de410bcdbc8f0b37_EOF
+ cat "${RUNNER_TEMP}/gh-aw/prompts/mcp_cli_tools_prompt.md"
+ cat << 'GH_AW_PROMPT_de410bcdbc8f0b37_EOF'
+
+ The following GitHub context information is available for this workflow:
+ {{#if __GH_AW_GITHUB_ACTOR__ }}
+ - **actor**: __GH_AW_GITHUB_ACTOR__
+ {{/if}}
+ {{#if __GH_AW_GITHUB_REPOSITORY__ }}
+ - **repository**: __GH_AW_GITHUB_REPOSITORY__
+ {{/if}}
+ {{#if __GH_AW_GITHUB_WORKSPACE__ }}
+ - **workspace**: __GH_AW_GITHUB_WORKSPACE__
+ {{/if}}
+ {{#if __GH_AW_GITHUB_EVENT_ISSUE_NUMBER__ }}
+ - **issue-number**: #__GH_AW_GITHUB_EVENT_ISSUE_NUMBER__
+ {{/if}}
+ {{#if __GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER__ }}
+ - **discussion-number**: #__GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER__
+ {{/if}}
+ {{#if __GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER__ }}
+ - **pull-request-number**: #__GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER__
+ {{/if}}
+ {{#if __GH_AW_GITHUB_EVENT_COMMENT_ID__ }}
+ - **comment-id**: __GH_AW_GITHUB_EVENT_COMMENT_ID__
+ {{/if}}
+ {{#if __GH_AW_GITHUB_RUN_ID__ }}
+ - **workflow-run-id**: __GH_AW_GITHUB_RUN_ID__
+ {{/if}}
+
+
+ GH_AW_PROMPT_de410bcdbc8f0b37_EOF
+ cat "${RUNNER_TEMP}/gh-aw/prompts/github_mcp_tools_with_safeoutputs_prompt.md"
+ cat << 'GH_AW_PROMPT_de410bcdbc8f0b37_EOF'
+
+ {{#runtime-import .github/workflows/auto-code.md}}
+ GH_AW_PROMPT_de410bcdbc8f0b37_EOF
+ } > "$GH_AW_PROMPT"
+ - name: Interpolate variables and render templates
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
+ GH_AW_ENGINE_ID: "copilot"
+ GH_AW_GITHUB_EVENT_ISSUE_NUMBER: ${{ github.event.issue.number }}
+ with:
+ script: |
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require('${{ runner.temp }}/gh-aw/actions/interpolate_prompt.cjs');
+ await main();
+ - name: Substitute placeholders
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
+ GH_AW_GITHUB_ACTOR: ${{ github.actor }}
+ GH_AW_GITHUB_EVENT_COMMENT_ID: ${{ github.event.comment.id }}
+ GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER: ${{ github.event.discussion.number }}
+ GH_AW_GITHUB_EVENT_ISSUE_NUMBER: ${{ github.event.issue.number }}
+ GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER: ${{ github.event.pull_request.number }}
+ GH_AW_GITHUB_REPOSITORY: ${{ github.repository }}
+ GH_AW_GITHUB_RUN_ID: ${{ github.run_id }}
+ GH_AW_GITHUB_WORKSPACE: ${{ github.workspace }}
+ GH_AW_MCP_CLI_SERVERS_LIST: '- `safeoutputs` — run `safeoutputs --help` to see available tools'
+ GH_AW_NEEDS_PRE_ACTIVATION_OUTPUTS_ACTIVATED: ${{ needs.pre_activation.outputs.activated }}
+ with:
+ script: |
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+ setupGlobals(core, github, context, exec, io, getOctokit);
+
+ const substitutePlaceholders = require('${{ runner.temp }}/gh-aw/actions/substitute_placeholders.cjs');
+
+ // Call the substitution function
+ return await substitutePlaceholders({
+ file: process.env.GH_AW_PROMPT,
+ substitutions: {
+ GH_AW_GITHUB_ACTOR: process.env.GH_AW_GITHUB_ACTOR,
+ GH_AW_GITHUB_EVENT_COMMENT_ID: process.env.GH_AW_GITHUB_EVENT_COMMENT_ID,
+ GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER: process.env.GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER,
+ GH_AW_GITHUB_EVENT_ISSUE_NUMBER: process.env.GH_AW_GITHUB_EVENT_ISSUE_NUMBER,
+ GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER: process.env.GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER,
+ GH_AW_GITHUB_REPOSITORY: process.env.GH_AW_GITHUB_REPOSITORY,
+ GH_AW_GITHUB_RUN_ID: process.env.GH_AW_GITHUB_RUN_ID,
+ GH_AW_GITHUB_WORKSPACE: process.env.GH_AW_GITHUB_WORKSPACE,
+ GH_AW_MCP_CLI_SERVERS_LIST: process.env.GH_AW_MCP_CLI_SERVERS_LIST,
+ GH_AW_NEEDS_PRE_ACTIVATION_OUTPUTS_ACTIVATED: process.env.GH_AW_NEEDS_PRE_ACTIVATION_OUTPUTS_ACTIVATED
+ }
+ });
+ - name: Validate prompt placeholders
+ env:
+ GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
+ # poutine:ignore untrusted_checkout_exec
+ run: bash "${RUNNER_TEMP}/gh-aw/actions/validate_prompt_placeholders.sh"
+ - name: Print prompt
+ env:
+ GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
+ # poutine:ignore untrusted_checkout_exec
+ run: bash "${RUNNER_TEMP}/gh-aw/actions/print_prompt_summary.sh"
+ - name: Upload activation artifact
+ if: success()
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+ with:
+ name: activation
+ include-hidden-files: true
+ path: |
+ /tmp/gh-aw/aw_info.json
+ /tmp/gh-aw/aw-prompts/prompt.txt
+ /tmp/gh-aw/github_rate_limits.jsonl
+ /tmp/gh-aw/base
+ if-no-files-found: ignore
+ retention-days: 1
+
+ agent:
+ needs: activation
+ runs-on: ubuntu-latest
+ permissions:
+ contents: read
+ issues: read
+ pull-requests: read
+ env:
+ DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+ GH_AW_ASSETS_ALLOWED_EXTS: ""
+ GH_AW_ASSETS_BRANCH: ""
+ GH_AW_ASSETS_MAX_SIZE_KB: 0
+ GH_AW_MCP_LOG_DIR: /tmp/gh-aw/mcp-logs/safeoutputs
+ GH_AW_WORKFLOW_ID_SANITIZED: autocode
+ outputs:
+ agentic_engine_timeout: ${{ steps.detect-copilot-errors.outputs.agentic_engine_timeout || 'false' }}
+ checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
+ effective_tokens: ${{ steps.parse-mcp-gateway.outputs.effective_tokens }}
+ has_patch: ${{ steps.collect_output.outputs.has_patch }}
+ inference_access_error: ${{ steps.detect-copilot-errors.outputs.inference_access_error || 'false' }}
+ mcp_policy_error: ${{ steps.detect-copilot-errors.outputs.mcp_policy_error || 'false' }}
+ model: ${{ needs.activation.outputs.model }}
+ model_not_supported_error: ${{ steps.detect-copilot-errors.outputs.model_not_supported_error || 'false' }}
+ output: ${{ steps.collect_output.outputs.output }}
+ output_types: ${{ steps.collect_output.outputs.output_types }}
+ setup-trace-id: ${{ steps.setup.outputs.trace-id }}
+ steps:
+ - name: Setup Scripts
+ id: setup
+ uses: github/gh-aw-actions/setup@b8068426813005612b960b5ab0b8bd2c27142323 # v0.71.5
+ with:
+ destination: ${{ runner.temp }}/gh-aw/actions
+ job-name: ${{ github.job }}
+ trace-id: ${{ needs.activation.outputs.setup-trace-id }}
+ env:
+ GH_AW_SETUP_WORKFLOW_NAME: "自动处理 Issue"
+ GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/auto-code.lock.yml@${{ github.ref }}
+ GH_AW_INFO_VERSION: "1.0.40"
+ - name: Set runtime paths
+ id: set-runtime-paths
+ run: |
+ {
+ echo "GH_AW_SAFE_OUTPUTS=${RUNNER_TEMP}/gh-aw/safeoutputs/outputs.jsonl"
+ echo "GH_AW_SAFE_OUTPUTS_CONFIG_PATH=${RUNNER_TEMP}/gh-aw/safeoutputs/config.json"
+ echo "GH_AW_SAFE_OUTPUTS_TOOLS_PATH=${RUNNER_TEMP}/gh-aw/safeoutputs/tools.json"
+ } >> "$GITHUB_OUTPUT"
+ - name: Checkout repository
+ uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ with:
+ persist-credentials: false
+ - name: Create gh-aw temp directory
+ run: bash "${RUNNER_TEMP}/gh-aw/actions/create_gh_aw_tmp_dir.sh"
+ - name: Configure gh CLI for GitHub Enterprise
+ run: bash "${RUNNER_TEMP}/gh-aw/actions/configure_gh_for_ghe.sh"
+ env:
+ GH_TOKEN: ${{ github.token }}
+ - name: Configure Git credentials
+ env:
+ REPO_NAME: ${{ github.repository }}
+ SERVER_URL: ${{ github.server_url }}
+ GITHUB_TOKEN: ${{ github.token }}
+ run: |
+ git config --global user.email "github-actions[bot]@users.noreply.github.com"
+ git config --global user.name "github-actions[bot]"
+ git config --global am.keepcr true
+ # Re-authenticate git with GitHub token
+ SERVER_URL_STRIPPED="${SERVER_URL#https://}"
+ git remote set-url origin "https://x-access-token:${GITHUB_TOKEN}@${SERVER_URL_STRIPPED}/${REPO_NAME}.git"
+ echo "Git configured with standard GitHub Actions identity"
+ - name: Checkout PR branch
+ id: checkout-pr
+ if: |
+ github.event.pull_request || github.event.issue.pull_request
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+ with:
+ github-token: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+ script: |
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require('${{ runner.temp }}/gh-aw/actions/checkout_pr_branch.cjs');
+ await main();
+ - name: Install GitHub Copilot CLI
+ run: bash "${RUNNER_TEMP}/gh-aw/actions/install_copilot_cli.sh" 1.0.40
+ env:
+ GH_HOST: github.com
+ - name: Parse integrity filter lists
+ id: parse-guard-vars
+ env:
+ GH_AW_BLOCKED_USERS_VAR: ${{ vars.GH_AW_GITHUB_BLOCKED_USERS || '' }}
+ GH_AW_TRUSTED_USERS_VAR: ${{ vars.GH_AW_GITHUB_TRUSTED_USERS || '' }}
+ GH_AW_APPROVAL_LABELS_VAR: ${{ vars.GH_AW_GITHUB_APPROVAL_LABELS || '' }}
+ run: bash "${RUNNER_TEMP}/gh-aw/actions/parse_guard_list.sh"
+ - name: Download activation artifact
+ uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+ with:
+ name: activation
+ path: /tmp/gh-aw
+ - name: Restore agent config folders from base branch
+ if: steps.checkout-pr.outcome == 'success'
+ env:
+ GH_AW_AGENT_FOLDERS: ".agents .claude .codex .crush .gemini .github .opencode .pi"
+ GH_AW_AGENT_FILES: ".crush.json AGENTS.md CLAUDE.md GEMINI.md PI.md opencode.jsonc"
+ run: bash "${RUNNER_TEMP}/gh-aw/actions/restore_base_github_folders.sh"
+ - name: Download container images
+ run: bash "${RUNNER_TEMP}/gh-aw/actions/download_docker_images.sh" ghcr.io/github/github-mcp-server:v1.0.3@sha256:2ac27ef03461ef2b877031b838a7d1fd7f12b12d4ace7796d8cad91446d55959 node:lts-alpine@sha256:d1b3b4da11eefd5941e7f0b9cf17783fc99d9c6fc34884a665f40a06dbdfc94f
+ - name: Generate Safe Outputs Config
+ run: |
+ mkdir -p "${RUNNER_TEMP}/gh-aw/safeoutputs"
+ mkdir -p /tmp/gh-aw/safeoutputs
+ mkdir -p /tmp/gh-aw/mcp-logs/safeoutputs
+ cat > "${RUNNER_TEMP}/gh-aw/safeoutputs/config.json" << 'GH_AW_SAFE_OUTPUTS_CONFIG_982fd4401303461a_EOF'
+ {"add_comment":{"max":1},"create_pull_request":{"base_branch":"develop","max":1,"max_patch_files":100,"max_patch_size":1024,"protect_top_level_dot_folders":true,"protected_files":["package.json","bun.lockb","bunfig.toml","deno.json","deno.jsonc","deno.lock","global.json","NuGet.Config","Directory.Packages.props","mix.exs","mix.lock","go.mod","go.sum","stack.yaml","stack.yaml.lock","pom.xml","build.gradle","build.gradle.kts","settings.gradle","settings.gradle.kts","gradle.properties","package-lock.json","yarn.lock","pnpm-lock.yaml","npm-shrinkwrap.json","requirements.txt","Pipfile","Pipfile.lock","pyproject.toml","setup.py","setup.cfg","Gemfile","Gemfile.lock","uv.lock","CODEOWNERS","DESIGN.md","README.md","CONTRIBUTING.md","CHANGELOG.md","SECURITY.md","CODE_OF_CONDUCT.md","AGENTS.md","CLAUDE.md","GEMINI.md"]},"create_report_incomplete_issue":{},"missing_data":{},"missing_tool":{},"noop":{"max":1,"report-as-issue":"true"},"report_incomplete":{}}
+ GH_AW_SAFE_OUTPUTS_CONFIG_982fd4401303461a_EOF
+ - name: Generate Safe Outputs Tools
+ env:
+ GH_AW_TOOLS_META_JSON: |
+ {
+ "description_suffixes": {
+ "add_comment": " CONSTRAINTS: Maximum 1 comment(s) can be added. Supports reply_to_id for discussion threading.",
+ "create_pull_request": " CONSTRAINTS: Maximum 1 pull request(s) can be created."
+ },
+ "repo_params": {},
+ "dynamic_tools": []
+ }
+ GH_AW_VALIDATION_JSON: |
+ {
+ "add_comment": {
+ "defaultMax": 1,
+ "fields": {
+ "body": {
+ "required": true,
+ "type": "string",
+ "sanitize": true,
+ "maxLength": 65000
+ },
+ "item_number": {
+ "issueOrPRNumber": true
+ },
+ "reply_to_id": {
+ "type": "string",
+ "maxLength": 256
+ },
+ "repo": {
+ "type": "string",
+ "maxLength": 256
+ }
+ }
+ },
+ "create_pull_request": {
+ "defaultMax": 1,
+ "fields": {
+ "base": {
+ "type": "string",
+ "sanitize": true,
+ "maxLength": 128
+ },
+ "body": {
+ "required": true,
+ "type": "string",
+ "sanitize": true,
+ "maxLength": 65000
+ },
+ "branch": {
+ "required": true,
+ "type": "string",
+ "sanitize": true,
+ "maxLength": 256
+ },
+ "draft": {
+ "type": "boolean"
+ },
+ "labels": {
+ "type": "array",
+ "itemType": "string",
+ "itemSanitize": true,
+ "itemMaxLength": 128
+ },
+ "repo": {
+ "type": "string",
+ "maxLength": 256
+ },
+ "title": {
+ "required": true,
+ "type": "string",
+ "sanitize": true,
+ "maxLength": 128
+ }
+ }
+ },
+ "missing_data": {
+ "defaultMax": 20,
+ "fields": {
+ "alternatives": {
+ "type": "string",
+ "sanitize": true,
+ "maxLength": 256
+ },
+ "context": {
+ "type": "string",
+ "sanitize": true,
+ "maxLength": 256
+ },
+ "data_type": {
+ "type": "string",
+ "sanitize": true,
+ "maxLength": 128
+ },
+ "reason": {
+ "type": "string",
+ "sanitize": true,
+ "maxLength": 256
+ }
+ }
+ },
+ "missing_tool": {
+ "defaultMax": 20,
+ "fields": {
+ "alternatives": {
+ "type": "string",
+ "sanitize": true,
+ "maxLength": 512
+ },
+ "reason": {
+ "required": true,
+ "type": "string",
+ "sanitize": true,
+ "maxLength": 256
+ },
+ "tool": {
+ "type": "string",
+ "sanitize": true,
+ "maxLength": 128
+ }
+ }
+ },
+ "noop": {
+ "defaultMax": 1,
+ "fields": {
+ "message": {
+ "required": true,
+ "type": "string",
+ "sanitize": true,
+ "maxLength": 65000
+ }
+ }
+ },
+ "report_incomplete": {
+ "defaultMax": 5,
+ "fields": {
+ "details": {
+ "type": "string",
+ "sanitize": true,
+ "maxLength": 65000
+ },
+ "reason": {
+ "required": true,
+ "type": "string",
+ "sanitize": true,
+ "maxLength": 1024
+ }
+ }
+ }
+ }
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ with:
+ script: |
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require('${{ runner.temp }}/gh-aw/actions/generate_safe_outputs_tools.cjs');
+ await main();
+ - name: Generate Safe Outputs MCP Server Config
+ id: safe-outputs-config
+ run: |
+ # Generate a secure random API key (360 bits of entropy, 40+ chars)
+ # Mask immediately to prevent timing vulnerabilities
+ API_KEY=$(openssl rand -base64 45 | tr -d '/+=')
+ echo "::add-mask::${API_KEY}"
+
+ PORT=3001
+
+ # Set outputs for next steps
+ {
+ echo "safe_outputs_api_key=${API_KEY}"
+ echo "safe_outputs_port=${PORT}"
+ } >> "$GITHUB_OUTPUT"
+
+ echo "Safe Outputs MCP server will run on port ${PORT}"
+
+ - name: Start Safe Outputs MCP HTTP Server
+ id: safe-outputs-start
+ env:
+ DEBUG: '*'
+ GH_AW_SAFE_OUTPUTS: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS }}
+ GH_AW_SAFE_OUTPUTS_PORT: ${{ steps.safe-outputs-config.outputs.safe_outputs_port }}
+ GH_AW_SAFE_OUTPUTS_API_KEY: ${{ steps.safe-outputs-config.outputs.safe_outputs_api_key }}
+ GH_AW_SAFE_OUTPUTS_TOOLS_PATH: ${{ runner.temp }}/gh-aw/safeoutputs/tools.json
+ GH_AW_SAFE_OUTPUTS_CONFIG_PATH: ${{ runner.temp }}/gh-aw/safeoutputs/config.json
+ GH_AW_MCP_LOG_DIR: /tmp/gh-aw/mcp-logs/safeoutputs
+ run: |
+ # Environment variables are set above to prevent template injection
+ export DEBUG
+ export GH_AW_SAFE_OUTPUTS
+ export GH_AW_SAFE_OUTPUTS_PORT
+ export GH_AW_SAFE_OUTPUTS_API_KEY
+ export GH_AW_SAFE_OUTPUTS_TOOLS_PATH
+ export GH_AW_SAFE_OUTPUTS_CONFIG_PATH
+ export GH_AW_MCP_LOG_DIR
+
+ bash "${RUNNER_TEMP}/gh-aw/actions/start_safe_outputs_server.sh"
+
+ - name: Start MCP Gateway
+ id: start-mcp-gateway
+ env:
+ GH_AW_SAFE_OUTPUTS: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS }}
+ GH_AW_SAFE_OUTPUTS_API_KEY: ${{ steps.safe-outputs-start.outputs.api_key }}
+ GH_AW_SAFE_OUTPUTS_PORT: ${{ steps.safe-outputs-start.outputs.port }}
+ GITHUB_MCP_SERVER_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+ run: |
+ set -eo pipefail
+ mkdir -p "${RUNNER_TEMP}/gh-aw/mcp-config"
+
+ # Export gateway environment variables for MCP config and gateway script
+ export MCP_GATEWAY_PORT="8080"
+ export MCP_GATEWAY_DOMAIN="localhost"
+ export MCP_GATEWAY_HOST_DOMAIN="localhost"
+ MCP_GATEWAY_API_KEY=$(openssl rand -base64 45 | tr -d '/+=')
+ echo "::add-mask::${MCP_GATEWAY_API_KEY}"
+ export MCP_GATEWAY_API_KEY
+ export MCP_GATEWAY_PAYLOAD_DIR="/tmp/gh-aw/mcp-payloads"
+ mkdir -p "${MCP_GATEWAY_PAYLOAD_DIR}"
+ export MCP_GATEWAY_PAYLOAD_SIZE_THRESHOLD="524288"
+ export DEBUG="*"
+
+ export GH_AW_ENGINE="copilot"
+ MCP_GATEWAY_UID=$(id -u 2>/dev/null || echo '0')
+ MCP_GATEWAY_GID=$(id -g 2>/dev/null || echo '0')
+ DOCKER_SOCK_GID=$(stat -c '%g' /var/run/docker.sock 2>/dev/null || echo '0')
+ export MCP_GATEWAY_DOCKER_COMMAND='docker run -i --rm --network host --add-host host.docker.internal:127.0.0.1 --user '"${MCP_GATEWAY_UID}"':'"${MCP_GATEWAY_GID}"' --group-add '"${DOCKER_SOCK_GID}"' -v /var/run/docker.sock:/var/run/docker.sock -e MCP_GATEWAY_PORT -e MCP_GATEWAY_DOMAIN -e MCP_GATEWAY_API_KEY -e MCP_GATEWAY_PAYLOAD_DIR -e MCP_GATEWAY_PAYLOAD_SIZE_THRESHOLD -e DEBUG -e MCP_GATEWAY_LOG_DIR -e GH_AW_MCP_LOG_DIR -e GH_AW_SAFE_OUTPUTS -e GH_AW_SAFE_OUTPUTS_CONFIG_PATH -e GH_AW_SAFE_OUTPUTS_TOOLS_PATH -e GH_AW_ASSETS_BRANCH -e GH_AW_ASSETS_MAX_SIZE_KB -e GH_AW_ASSETS_ALLOWED_EXTS -e DEFAULT_BRANCH -e GITHUB_MCP_SERVER_TOKEN -e GITHUB_MCP_GUARD_MIN_INTEGRITY -e GITHUB_MCP_GUARD_REPOS -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e GITHUB_SHA -e GITHUB_WORKSPACE -e GITHUB_TOKEN -e GITHUB_RUN_ID -e GITHUB_RUN_NUMBER -e GITHUB_RUN_ATTEMPT -e GITHUB_JOB -e GITHUB_ACTION -e GITHUB_EVENT_NAME -e GITHUB_EVENT_PATH -e GITHUB_ACTOR -e GITHUB_ACTOR_ID -e GITHUB_TRIGGERING_ACTOR -e GITHUB_WORKFLOW -e GITHUB_WORKFLOW_REF -e GITHUB_WORKFLOW_SHA -e GITHUB_REF -e GITHUB_REF_NAME -e GITHUB_REF_TYPE -e GITHUB_HEAD_REF -e GITHUB_BASE_REF -e GH_AW_SAFE_OUTPUTS_PORT -e GH_AW_SAFE_OUTPUTS_API_KEY -v /tmp/gh-aw/mcp-payloads:/tmp/gh-aw/mcp-payloads:rw -v /opt:/opt:ro -v /tmp:/tmp:rw -v '"${GITHUB_WORKSPACE}"':'"${GITHUB_WORKSPACE}"':rw ghcr.io/github/gh-aw-mcpg:v0.3.6'
+
+ mkdir -p /home/runner/.copilot
+ GH_AW_NODE=$(which node 2>/dev/null || command -v node 2>/dev/null || echo node)
+ cat << GH_AW_MCP_CONFIG_01a7963a8b9bf043_EOF | "$GH_AW_NODE" "${RUNNER_TEMP}/gh-aw/actions/start_mcp_gateway.cjs"
+ {
+ "mcpServers": {
+ "github": {
+ "type": "stdio",
+ "container": "ghcr.io/github/github-mcp-server:v1.0.3",
+ "env": {
+ "GITHUB_HOST": "\${GITHUB_SERVER_URL}",
+ "GITHUB_PERSONAL_ACCESS_TOKEN": "\${GITHUB_MCP_SERVER_TOKEN}",
+ "GITHUB_READ_ONLY": "1",
+ "GITHUB_TOOLSETS": "context,repos,issues,pull_requests"
+ },
+ "guard-policies": {
+ "allow-only": {
+ "approval-labels": ${{ steps.parse-guard-vars.outputs.approval_labels }},
+ "blocked-users": ${{ steps.parse-guard-vars.outputs.blocked_users }},
+ "min-integrity": "none",
+ "repos": "all",
+ "trusted-users": ${{ steps.parse-guard-vars.outputs.trusted_users }}
+ }
+ }
+ },
+ "safeoutputs": {
+ "type": "http",
+ "url": "http://localhost:$GH_AW_SAFE_OUTPUTS_PORT",
+ "headers": {
+ "Authorization": "\${GH_AW_SAFE_OUTPUTS_API_KEY}"
+ },
+ "guard-policies": {
+ "write-sink": {
+ "accept": [
+ "*"
+ ]
+ }
+ }
+ }
+ },
+ "gateway": {
+ "port": $MCP_GATEWAY_PORT,
+ "domain": "${MCP_GATEWAY_DOMAIN}",
+ "apiKey": "${MCP_GATEWAY_API_KEY}",
+ "payloadDir": "${MCP_GATEWAY_PAYLOAD_DIR}"
+ }
+ }
+ GH_AW_MCP_CONFIG_01a7963a8b9bf043_EOF
+ - name: Mount MCP servers as CLIs
+ id: mount-mcp-clis
+ continue-on-error: true
+ env:
+ MCP_GATEWAY_API_KEY: ${{ steps.start-mcp-gateway.outputs.gateway-api-key }}
+ MCP_GATEWAY_DOMAIN: ${{ steps.start-mcp-gateway.outputs.gateway-domain }}
+ MCP_GATEWAY_PORT: ${{ steps.start-mcp-gateway.outputs.gateway-port }}
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ with:
+ script: |
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+ setupGlobals(core, github, context, exec, io);
+ const { main } = require('${{ runner.temp }}/gh-aw/actions/mount_mcp_as_cli.cjs');
+ await main();
+ - name: Clean credentials
+ continue-on-error: true
+ run: bash "${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh"
+ - name: Audit pre-agent workspace
+ id: pre_agent_audit
+ continue-on-error: true
+ run: bash "${RUNNER_TEMP}/gh-aw/actions/audit_pre_agent_workspace.sh"
+ - name: Execute GitHub Copilot CLI
+ id: agentic_execution
+ # Copilot CLI tool arguments (sorted):
+ # --allow-tool github
+ # --allow-tool safeoutputs
+ # --allow-tool shell(cat)
+ # --allow-tool shell(date)
+ # --allow-tool shell(echo)
+ # --allow-tool shell(git add:*)
+ # --allow-tool shell(git branch:*)
+ # --allow-tool shell(git checkout:*)
+ # --allow-tool shell(git commit:*)
+ # --allow-tool shell(git merge:*)
+ # --allow-tool shell(git rm:*)
+ # --allow-tool shell(git status)
+ # --allow-tool shell(git switch:*)
+ # --allow-tool shell(grep)
+ # --allow-tool shell(head)
+ # --allow-tool shell(ls)
+ # --allow-tool shell(pwd)
+ # --allow-tool shell(safeoutputs:*)
+ # --allow-tool shell(sort)
+ # --allow-tool shell(tail)
+ # --allow-tool shell(uniq)
+ # --allow-tool shell(wc)
+ # --allow-tool shell(yq)
+ # --allow-tool write
+ timeout-minutes: 20
+ run: |
+ set -o pipefail
+ touch /tmp/gh-aw/agent-step-summary.md
+ (umask 177 && touch /tmp/gh-aw/agent-stdio.log)
+ mkdir -p /tmp/
+ mkdir -p /tmp/gh-aw/
+ mkdir -p /tmp/gh-aw/agent/
+ mkdir -p /tmp/gh-aw/sandbox/agent/logs/
+ GH_AW_NODE_EXEC="${GH_AW_NODE_BIN:-}"; if [ -z "$GH_AW_NODE_EXEC" ] || [ ! -x "$GH_AW_NODE_EXEC" ]; then GH_AW_NODE_EXEC="$(command -v node 2>/dev/null || echo node)"; fi; "$GH_AW_NODE_EXEC" ${RUNNER_TEMP}/gh-aw/actions/copilot_harness.cjs copilot --add-dir /tmp/ --add-dir /tmp/gh-aw/ --add-dir /tmp/gh-aw/agent/ --log-level all --log-dir /tmp/gh-aw/sandbox/agent/logs/ --disable-builtin-mcps --no-ask-user --allow-tool github --allow-tool safeoutputs --allow-tool 'shell(cat)' --allow-tool 'shell(date)' --allow-tool 'shell(echo)' --allow-tool 'shell(git add:*)' --allow-tool 'shell(git branch:*)' --allow-tool 'shell(git checkout:*)' --allow-tool 'shell(git commit:*)' --allow-tool 'shell(git merge:*)' --allow-tool 'shell(git rm:*)' --allow-tool 'shell(git status)' --allow-tool 'shell(git switch:*)' --allow-tool 'shell(grep)' --allow-tool 'shell(head)' --allow-tool 'shell(ls)' --allow-tool 'shell(pwd)' --allow-tool 'shell(safeoutputs:*)' --allow-tool 'shell(sort)' --allow-tool 'shell(tail)' --allow-tool 'shell(uniq)' --allow-tool 'shell(wc)' --allow-tool 'shell(yq)' --allow-tool write --allow-all-paths --prompt-file /tmp/gh-aw/aw-prompts/prompt.txt 2>&1 | tee /tmp/gh-aw/agent-stdio.log
+ env:
+ COPILOT_AGENT_RUNNER_TYPE: STANDALONE
+ COPILOT_API_KEY: dummy-byok-key-for-offline-mode
+ COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
+ COPILOT_MODEL: doubao-seed-2-0-code-preview-260215
+ COPILOT_PROVIDER_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+ COPILOT_PROVIDER_BASE_URL: https://ark.cn-beijing.volces.com/api/v3
+ COPILOT_PROVIDER_TYPE: openai
+ GH_AW_MCP_CONFIG: /home/runner/.copilot/mcp-config.json
+ GH_AW_PHASE: agent
+ GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
+ GH_AW_SAFE_OUTPUTS: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS }}
+ GH_AW_VERSION: v0.71.5
+ GITHUB_API_URL: ${{ github.api_url }}
+ GITHUB_AW: true
+ GITHUB_COPILOT_INTEGRATION_ID: agentic-workflows
+ GITHUB_HEAD_REF: ${{ github.head_ref }}
+ GITHUB_MCP_SERVER_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+ GITHUB_REF_NAME: ${{ github.ref_name }}
+ GITHUB_SERVER_URL: ${{ github.server_url }}
+ GITHUB_STEP_SUMMARY: /tmp/gh-aw/agent-step-summary.md
+ GITHUB_WORKSPACE: ${{ github.workspace }}
+ XDG_CONFIG_HOME: /home/runner
+ - name: Detect Copilot errors
+ id: detect-copilot-errors
+ if: always()
+ continue-on-error: true
+ run: node "${RUNNER_TEMP}/gh-aw/actions/detect_copilot_errors.cjs"
+ - name: Configure Git credentials
+ env:
+ REPO_NAME: ${{ github.repository }}
+ SERVER_URL: ${{ github.server_url }}
+ GITHUB_TOKEN: ${{ github.token }}
+ run: |
+ git config --global user.email "github-actions[bot]@users.noreply.github.com"
+ git config --global user.name "github-actions[bot]"
+ git config --global am.keepcr true
+ # Re-authenticate git with GitHub token
+ SERVER_URL_STRIPPED="${SERVER_URL#https://}"
+ git remote set-url origin "https://x-access-token:${GITHUB_TOKEN}@${SERVER_URL_STRIPPED}/${REPO_NAME}.git"
+ echo "Git configured with standard GitHub Actions identity"
+ - name: Copy Copilot session state files to logs
+ if: always()
+ continue-on-error: true
+ run: bash "${RUNNER_TEMP}/gh-aw/actions/copy_copilot_session_state.sh"
+ - name: Stop MCP Gateway
+ if: always()
+ continue-on-error: true
+ env:
+ MCP_GATEWAY_PORT: ${{ steps.start-mcp-gateway.outputs.gateway-port }}
+ MCP_GATEWAY_API_KEY: ${{ steps.start-mcp-gateway.outputs.gateway-api-key }}
+ GATEWAY_PID: ${{ steps.start-mcp-gateway.outputs.gateway-pid }}
+ run: |
+ bash "${RUNNER_TEMP}/gh-aw/actions/stop_mcp_gateway.sh" "$GATEWAY_PID"
+ - name: Redact secrets in logs
+ if: always()
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ with:
+ script: |
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require('${{ runner.temp }}/gh-aw/actions/redact_secrets.cjs');
+ await main();
+ env:
+ GH_AW_SECRET_NAMES: 'COPILOT_GITHUB_TOKEN,GH_AW_GITHUB_MCP_SERVER_TOKEN,GH_AW_GITHUB_TOKEN,GITHUB_TOKEN,OPENAI_API_KEY'
+ SECRET_COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
+ SECRET_GH_AW_GITHUB_MCP_SERVER_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN }}
+ SECRET_GH_AW_GITHUB_TOKEN: ${{ secrets.GH_AW_GITHUB_TOKEN }}
+ SECRET_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+ SECRET_OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+ - name: Append agent step summary
+ if: always()
+ run: bash "${RUNNER_TEMP}/gh-aw/actions/append_agent_step_summary.sh"
+ - name: Copy Safe Outputs
+ if: always()
+ env:
+ GH_AW_SAFE_OUTPUTS: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS }}
+ run: |
+ mkdir -p /tmp/gh-aw
+ cp "$GH_AW_SAFE_OUTPUTS" /tmp/gh-aw/safeoutputs.jsonl 2>/dev/null || true
+ - name: Ingest agent output
+ id: collect_output
+ if: always()
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_SAFE_OUTPUTS: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS }}
+ GH_AW_ALLOWED_DOMAINS: "api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,api.snapcraft.io,archive.ubuntu.com,ark.cn-beijing.volces.com,azure.archive.ubuntu.com,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,github.com,host.docker.internal,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,ppa.launchpad.net,raw.githubusercontent.com,registry.npmjs.org,s.symcb.com,s.symcd.com,security.ubuntu.com,telemetry.enterprise.githubcopilot.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com,www.googleapis.com"
+ GITHUB_SERVER_URL: ${{ github.server_url }}
+ GITHUB_API_URL: ${{ github.api_url }}
+ with:
+ script: |
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require('${{ runner.temp }}/gh-aw/actions/collect_ndjson_output.cjs');
+ await main();
+ - name: Parse agent logs for step summary
+ if: always()
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_AGENT_OUTPUT: /tmp/gh-aw/sandbox/agent/logs/
+ with:
+ script: |
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require('${{ runner.temp }}/gh-aw/actions/parse_copilot_log.cjs');
+ await main();
+ - name: Parse MCP Gateway logs for step summary
+ if: always()
+ id: parse-mcp-gateway
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ with:
+ script: |
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require('${{ runner.temp }}/gh-aw/actions/parse_mcp_gateway_log.cjs');
+ await main();
+ - name: Write agent output placeholder if missing
+ if: always()
+ run: |
+ if [ ! -f /tmp/gh-aw/agent_output.json ]; then
+ echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
+ fi
+ - name: Upload agent artifacts
+ if: always()
+ continue-on-error: true
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+ with:
+ name: agent
+ path: |
+ /tmp/gh-aw/aw-prompts/prompt.txt
+ /tmp/gh-aw/sandbox/agent/logs/
+ /tmp/gh-aw/redacted-urls.log
+ /tmp/gh-aw/mcp-logs/
+ /tmp/gh-aw/proxy-logs/
+ !/tmp/gh-aw/proxy-logs/proxy-tls/
+ /tmp/gh-aw/agent-stdio.log
+ /tmp/gh-aw/pre-agent-audit.txt
+ /tmp/gh-aw/agent/
+ /tmp/gh-aw/github_rate_limits.jsonl
+ /tmp/gh-aw/safeoutputs.jsonl
+ /tmp/gh-aw/agent_output.json
+ /tmp/gh-aw/aw-*.patch
+ /tmp/gh-aw/aw-*.bundle
+ if-no-files-found: ignore
+
+ conclusion:
+ needs:
+ - activation
+ - agent
+ - safe_outputs
+ if: >
+ always() && (needs.agent.result != 'skipped' || needs.activation.outputs.lockdown_check_failed == 'true' ||
+ needs.activation.outputs.stale_lock_file_failed == 'true')
+ runs-on: ubuntu-slim
+ permissions:
+ contents: write
+ discussions: write
+ issues: write
+ pull-requests: write
+ concurrency:
+ group: "gh-aw-conclusion-auto-code"
+ cancel-in-progress: false
+ outputs:
+ incomplete_count: ${{ steps.report_incomplete.outputs.incomplete_count }}
+ noop_message: ${{ steps.noop.outputs.noop_message }}
+ tools_reported: ${{ steps.missing_tool.outputs.tools_reported }}
+ total_count: ${{ steps.missing_tool.outputs.total_count }}
+ steps:
+ - name: Setup Scripts
+ id: setup
+ uses: github/gh-aw-actions/setup@b8068426813005612b960b5ab0b8bd2c27142323 # v0.71.5
+ with:
+ destination: ${{ runner.temp }}/gh-aw/actions
+ job-name: ${{ github.job }}
+ trace-id: ${{ needs.activation.outputs.setup-trace-id }}
+ env:
+ GH_AW_SETUP_WORKFLOW_NAME: "自动处理 Issue"
+ GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/auto-code.lock.yml@${{ github.ref }}
+ GH_AW_INFO_VERSION: "1.0.40"
+ - name: Download agent output artifact
+ id: download-agent-output
+ continue-on-error: true
+ uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+ with:
+ name: agent
+ path: /tmp/gh-aw/
+ - name: Setup agent output environment variable
+ id: setup-agent-output-env
+ if: steps.download-agent-output.outcome == 'success'
+ run: |
+ mkdir -p /tmp/gh-aw/
+ find "/tmp/gh-aw/" -type f -print
+ echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT"
+ - name: Process no-op messages
+ id: noop
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }}
+ GH_AW_NOOP_MAX: "1"
+ GH_AW_WORKFLOW_NAME: "自动处理 Issue"
+ GH_AW_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+ GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }}
+ GH_AW_NOOP_REPORT_AS_ISSUE: "true"
+ with:
+ github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+ script: |
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require('${{ runner.temp }}/gh-aw/actions/handle_noop_message.cjs');
+ await main();
+ - name: Record missing tool
+ id: missing_tool
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }}
+ GH_AW_MISSING_TOOL_CREATE_ISSUE: "true"
+ GH_AW_WORKFLOW_NAME: "自动处理 Issue"
+ with:
+ github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+ script: |
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require('${{ runner.temp }}/gh-aw/actions/missing_tool.cjs');
+ await main();
+ - name: Record incomplete
+ id: report_incomplete
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }}
+ GH_AW_REPORT_INCOMPLETE_CREATE_ISSUE: "true"
+ GH_AW_WORKFLOW_NAME: "自动处理 Issue"
+ with:
+ github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+ script: |
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require('${{ runner.temp }}/gh-aw/actions/report_incomplete_handler.cjs');
+ await main();
+ - name: Handle agent failure
+ id: handle_agent_failure
+ if: always()
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }}
+ GH_AW_WORKFLOW_NAME: "自动处理 Issue"
+ GH_AW_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+ GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }}
+ GH_AW_WORKFLOW_ID: "auto-code"
+ GH_AW_ACTION_FAILURE_ISSUE_EXPIRES_HOURS: "168"
+ GH_AW_ENGINE_ID: "copilot"
+ GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+ GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+ GH_AW_MCP_POLICY_ERROR: ${{ needs.agent.outputs.mcp_policy_error }}
+ GH_AW_AGENTIC_ENGINE_TIMEOUT: ${{ needs.agent.outputs.agentic_engine_timeout }}
+ GH_AW_MODEL_NOT_SUPPORTED_ERROR: ${{ needs.agent.outputs.model_not_supported_error }}
+ GH_AW_ENGINE_API_HOSTS: "api.enterprise.githubcopilot.com,api.githubcopilot.com,api.business.githubcopilot.com,api.individual.githubcopilot.com"
+ GH_AW_CODE_PUSH_FAILURE_ERRORS: ${{ needs.safe_outputs.outputs.code_push_failure_errors }}
+ GH_AW_CODE_PUSH_FAILURE_COUNT: ${{ needs.safe_outputs.outputs.code_push_failure_count }}
+ GH_AW_LOCKDOWN_CHECK_FAILED: ${{ needs.activation.outputs.lockdown_check_failed }}
+ GH_AW_STALE_LOCK_FILE_FAILED: ${{ needs.activation.outputs.stale_lock_file_failed }}
+ GH_AW_GROUP_REPORTS: "false"
+ GH_AW_FAILURE_REPORT_AS_ISSUE: "true"
+ GH_AW_MISSING_TOOL_REPORT_AS_FAILURE: "true"
+ GH_AW_MISSING_DATA_REPORT_AS_FAILURE: "true"
+ GH_AW_TIMEOUT_MINUTES: "20"
+ with:
+ github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+ script: |
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require('${{ runner.temp }}/gh-aw/actions/handle_agent_failure.cjs');
+ await main();
+
+ pre_activation:
+ runs-on: ubuntu-slim
+ outputs:
+ activated: ${{ steps.check_membership.outputs.is_team_member == 'true' }}
+ matched_command: ''
+ setup-trace-id: ${{ steps.setup.outputs.trace-id }}
+ steps:
+ - name: Setup Scripts
+ id: setup
+ uses: github/gh-aw-actions/setup@b8068426813005612b960b5ab0b8bd2c27142323 # v0.71.5
+ with:
+ destination: ${{ runner.temp }}/gh-aw/actions
+ job-name: ${{ github.job }}
+ env:
+ GH_AW_SETUP_WORKFLOW_NAME: "自动处理 Issue"
+ GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/auto-code.lock.yml@${{ github.ref }}
+ GH_AW_INFO_VERSION: "1.0.40"
+ - name: Check team membership for workflow
+ id: check_membership
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_REQUIRED_ROLES: "admin,maintainer,write"
+ with:
+ github-token: ${{ secrets.GITHUB_TOKEN }}
+ script: |
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require('${{ runner.temp }}/gh-aw/actions/check_membership.cjs');
+ await main();
+
+ safe_outputs:
+ needs:
+ - activation
+ - agent
+ if: (!cancelled()) && needs.agent.result != 'skipped'
+ runs-on: ubuntu-slim
+ permissions:
+ contents: write
+ discussions: write
+ issues: write
+ pull-requests: write
+ timeout-minutes: 15
+ env:
+ GH_AW_CALLER_WORKFLOW_ID: "${{ github.repository }}/auto-code"
+ GH_AW_EFFECTIVE_TOKENS: ${{ needs.agent.outputs.effective_tokens }}
+ GH_AW_ENGINE_ID: "copilot"
+ GH_AW_ENGINE_MODEL: ${{ needs.agent.outputs.model }}
+ GH_AW_ENGINE_VERSION: "1.0.40"
+ GH_AW_WORKFLOW_ID: "auto-code"
+ GH_AW_WORKFLOW_NAME: "自动处理 Issue"
+ outputs:
+ code_push_failure_count: ${{ steps.process_safe_outputs.outputs.code_push_failure_count }}
+ code_push_failure_errors: ${{ steps.process_safe_outputs.outputs.code_push_failure_errors }}
+ comment_id: ${{ steps.process_safe_outputs.outputs.comment_id }}
+ comment_url: ${{ steps.process_safe_outputs.outputs.comment_url }}
+ create_discussion_error_count: ${{ steps.process_safe_outputs.outputs.create_discussion_error_count }}
+ create_discussion_errors: ${{ steps.process_safe_outputs.outputs.create_discussion_errors }}
+ created_pr_number: ${{ steps.process_safe_outputs.outputs.created_pr_number }}
+ created_pr_url: ${{ steps.process_safe_outputs.outputs.created_pr_url }}
+ process_safe_outputs_processed_count: ${{ steps.process_safe_outputs.outputs.processed_count }}
+ process_safe_outputs_temporary_id_map: ${{ steps.process_safe_outputs.outputs.temporary_id_map }}
+ steps:
+ - name: Setup Scripts
+ id: setup
+ uses: github/gh-aw-actions/setup@b8068426813005612b960b5ab0b8bd2c27142323 # v0.71.5
+ with:
+ destination: ${{ runner.temp }}/gh-aw/actions
+ job-name: ${{ github.job }}
+ trace-id: ${{ needs.activation.outputs.setup-trace-id }}
+ env:
+ GH_AW_SETUP_WORKFLOW_NAME: "自动处理 Issue"
+ GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/auto-code.lock.yml@${{ github.ref }}
+ GH_AW_INFO_VERSION: "1.0.40"
+ - name: Download agent output artifact
+ id: download-agent-output
+ continue-on-error: true
+ uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+ with:
+ name: agent
+ path: /tmp/gh-aw/
+ - name: Setup agent output environment variable
+ id: setup-agent-output-env
+ if: steps.download-agent-output.outcome == 'success'
+ run: |
+ mkdir -p /tmp/gh-aw/
+ find "/tmp/gh-aw/" -type f -print
+ echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT"
+ - name: Download patch artifact
+ continue-on-error: true
+ uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+ with:
+ name: agent
+ path: /tmp/gh-aw/
+ - name: Checkout repository
+ if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
+ uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ with:
+ ref: develop
+ token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+ persist-credentials: false
+ fetch-depth: 1
+ - name: Configure Git credentials
+ if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
+ env:
+ REPO_NAME: ${{ github.repository }}
+ SERVER_URL: ${{ github.server_url }}
+ GIT_TOKEN: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+ run: |
+ git config --global user.email "github-actions[bot]@users.noreply.github.com"
+ git config --global user.name "github-actions[bot]"
+ git config --global am.keepcr true
+ # Re-authenticate git with GitHub token
+ SERVER_URL_STRIPPED="${SERVER_URL#https://}"
+ git remote set-url origin "https://x-access-token:${GIT_TOKEN}@${SERVER_URL_STRIPPED}/${REPO_NAME}.git"
+ echo "Git configured with standard GitHub Actions identity"
+ - name: Configure GH_HOST for enterprise compatibility
+ id: ghes-host-config
+ shell: bash
+ run: |
+ # Derive GH_HOST from GITHUB_SERVER_URL so the gh CLI targets the correct
+ # GitHub instance (GHES/GHEC). On github.com this is a harmless no-op.
+ GH_HOST="${GITHUB_SERVER_URL#https://}"
+ GH_HOST="${GH_HOST#http://}"
+ echo "GH_HOST=${GH_HOST}" >> "$GITHUB_ENV"
+ - name: Process Safe Outputs
+ id: process_safe_outputs
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }}
+ GH_AW_ALLOWED_DOMAINS: "api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,api.snapcraft.io,archive.ubuntu.com,ark.cn-beijing.volces.com,azure.archive.ubuntu.com,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,github.com,host.docker.internal,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,ppa.launchpad.net,raw.githubusercontent.com,registry.npmjs.org,s.symcb.com,s.symcd.com,security.ubuntu.com,telemetry.enterprise.githubcopilot.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com,www.googleapis.com"
+ GITHUB_SERVER_URL: ${{ github.server_url }}
+ GITHUB_API_URL: ${{ github.api_url }}
+ GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"add_comment\":{\"max\":1},\"create_pull_request\":{\"base_branch\":\"develop\",\"max\":1,\"max_patch_files\":100,\"max_patch_size\":1024,\"protect_top_level_dot_folders\":true,\"protected_files\":[\"package.json\",\"bun.lockb\",\"bunfig.toml\",\"deno.json\",\"deno.jsonc\",\"deno.lock\",\"global.json\",\"NuGet.Config\",\"Directory.Packages.props\",\"mix.exs\",\"mix.lock\",\"go.mod\",\"go.sum\",\"stack.yaml\",\"stack.yaml.lock\",\"pom.xml\",\"build.gradle\",\"build.gradle.kts\",\"settings.gradle\",\"settings.gradle.kts\",\"gradle.properties\",\"package-lock.json\",\"yarn.lock\",\"pnpm-lock.yaml\",\"npm-shrinkwrap.json\",\"requirements.txt\",\"Pipfile\",\"Pipfile.lock\",\"pyproject.toml\",\"setup.py\",\"setup.cfg\",\"Gemfile\",\"Gemfile.lock\",\"uv.lock\",\"CODEOWNERS\",\"DESIGN.md\",\"README.md\",\"CONTRIBUTING.md\",\"CHANGELOG.md\",\"SECURITY.md\",\"CODE_OF_CONDUCT.md\",\"AGENTS.md\",\"CLAUDE.md\",\"GEMINI.md\"]},\"create_report_incomplete_issue\":{},\"missing_data\":{},\"missing_tool\":{},\"noop\":{\"max\":1,\"report-as-issue\":\"true\"},\"report_incomplete\":{}}"
+ GH_AW_CI_TRIGGER_TOKEN: ${{ secrets.GH_AW_CI_TRIGGER_TOKEN }}
+ with:
+ github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+ script: |
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require('${{ runner.temp }}/gh-aw/actions/safe_output_handler_manager.cjs');
+ await main();
+ - name: Upload Safe Outputs Items
+ if: always()
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+ with:
+ name: safe-outputs-items
+ path: |
+ /tmp/gh-aw/safe-output-items.jsonl
+ /tmp/gh-aw/temporary-id-map.json
+ if-no-files-found: ignore
+
diff --git a/.github/workflows/auto-code.md b/.github/workflows/auto-code.md
new file mode 100644
index 0000000..5a51003
--- /dev/null
+++ b/.github/workflows/auto-code.md
@@ -0,0 +1,88 @@
+---
+on:
+ issues:
+ types: [labeled]
+
+engine:
+ id: copilot
+ env:
+ COPILOT_PROVIDER_BASE_URL: "https://ark.cn-beijing.volces.com/api/v3"
+ COPILOT_MODEL: doubao-seed-2-0-code-preview-260215
+ COPILOT_PROVIDER_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+ COPILOT_PROVIDER_TYPE: openai
+
+network:
+ allowed:
+ - defaults
+ - ark.cn-beijing.volces.com
+
+sandbox:
+ agent: false
+strict: false
+
+tools:
+ github:
+ min-integrity: none
+
+permissions:
+ contents: read
+ issues: read
+ pull-requests: read
+
+safe-outputs:
+ threat-detection: false
+ create-pull-request:
+ base-branch: develop
+ add-comment:
+ max: 1
+---
+
+# 自动处理 Issue
+
+当 Issue 被打上 `bug` 或 `enhancement` 标签时触发。其他标签直接退出，不做任何操作。
+
+## 判断任务类型
+
+读取 Issue #${{ github.event.issue.number }} 当前的标签：
+- 如果包含 `bug` 标签 → 执行【Bug 修复流程】
+- 如果包含 `enhancement` 标签 → 执行【新功能开发流程】
+- 其他情况 → 直接退出
+
+---
+
+## Bug 修复流程
+
+1. 阅读 Issue 的完整标题和正文，理解问题现象
+2. 浏览仓库代码和文档，定位问题所在的文件和函数
+3. 分析根本原因
+4. 实现修复方案，注意：
+ - 保持与现有代码风格一致
+ - 只修改必要的部分，不做无关改动
+5. 创建 Pull Request，标题格式：`fix: `，描述中说明：
+ - 问题根因
+ - 修复方式
+ - 如何验证
+6. 在原 Issue 下用中文回复，说明已提交 PR 及修复思路
+
+如果问题过于复杂或信息不足，在 Issue 下用中文说明原因，不创建 PR。
+
+---
+
+## 新功能开发流程
+
+1. 阅读 Issue 的完整标题和正文，理解需求目标
+2. 浏览仓库现有代码结构和文档，找到最相关的模块和文件
+3. 制定实现方案：
+ - 需要新增哪些文件或函数
+ - 需要修改哪些现有文件
+4. 按方案实现代码，注意：
+ - 保持与现有代码风格一致
+ - 新增函数/类需要添加注释
+ - 如果涉及接口变更，同步更新相关调用方
+5. 创建 Pull Request，标题格式：`feat: `，描述中说明：
+ - 实现了哪些功能
+ - 涉及哪些文件改动
+ - 如何验证/测试
+6. 在原 Issue 下用用户提问的语言进行回复，说明已提交 PR、实现思路和测试建议
+
+如果需求描述不清晰或实现风险过大，在 Issue 下用用户提问的语言说明原因，不创建 PR。
\ No newline at end of file
diff --git a/.github/workflows/issue-triage.lock.yml b/.github/workflows/issue-triage.lock.yml
new file mode 100644
index 0000000..4dd0549
--- /dev/null
+++ b/.github/workflows/issue-triage.lock.yml
@@ -0,0 +1,1097 @@
+# gh-aw-metadata: {"schema_version":"v3","frontmatter_hash":"49f1529d95cbf3c8e3d0da1df4b6cee935245532511b98ca9ecd7a44f1d0bb68","compiler_version":"v0.71.5","agent_id":"copilot"}
+# gh-aw-manifest: {"version":1,"secrets":["COPILOT_GITHUB_TOKEN","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN","OPENAI_API_KEY"],"actions":[{"repo":"actions/checkout","sha":"de0fac2e4500dabe0009e67214ff5f5447ce83dd","version":"v6.0.2"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"},{"repo":"github/gh-aw-actions/setup","sha":"b8068426813005612b960b5ab0b8bd2c27142323","version":"v0.71.5"}],"containers":[{"image":"ghcr.io/github/github-mcp-server:v1.0.3","digest":"sha256:2ac27ef03461ef2b877031b838a7d1fd7f12b12d4ace7796d8cad91446d55959","pinned_image":"ghcr.io/github/github-mcp-server:v1.0.3@sha256:2ac27ef03461ef2b877031b838a7d1fd7f12b12d4ace7796d8cad91446d55959"},{"image":"node:lts-alpine","digest":"sha256:d1b3b4da11eefd5941e7f0b9cf17783fc99d9c6fc34884a665f40a06dbdfc94f","pinned_image":"node:lts-alpine@sha256:d1b3b4da11eefd5941e7f0b9cf17783fc99d9c6fc34884a665f40a06dbdfc94f"}]}
+# ___ _ _
+# / _ \ | | (_)
+# | |_| | __ _ ___ _ __ | |_ _ ___
+# | _ |/ _` |/ _ \ '_ \| __| |/ __|
+# | | | | (_| | __/ | | | |_| | (__
+# \_| |_/\__, |\___|_| |_|\__|_|\___|
+# __/ |
+# _ _ |___/
+# | | | | / _| |
+# | | | | ___ _ __ _ __| |_| | _____ ____
+# | |/\| |/ _ \ '__| |/ /| _| |/ _ \ \ /\ / / ___|
+# \ /\ / (_) | | | | ( | | | | (_) \ V V /\__ \
+# \/ \/ \___/|_| |_|\_\|_| |_|\___/ \_/\_/ |___/
+#
+# This file was automatically generated by gh-aw (v0.71.5). DO NOT EDIT.
+#
+# To update this file, edit the corresponding .md file and run:
+# gh aw compile
+# Not all edits will cause changes to this file.
+#
+# For more information: https://github.github.com/gh-aw/introduction/overview/
+#
+#
+# Secrets used:
+# - COPILOT_GITHUB_TOKEN
+# - GH_AW_GITHUB_MCP_SERVER_TOKEN
+# - GH_AW_GITHUB_TOKEN
+# - GITHUB_TOKEN
+# - OPENAI_API_KEY
+#
+# Custom actions used:
+# - actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+# - actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+# - actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+# - actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+# - github/gh-aw-actions/setup@b8068426813005612b960b5ab0b8bd2c27142323 # v0.71.5
+#
+# Container images used:
+# - ghcr.io/github/github-mcp-server:v1.0.3@sha256:2ac27ef03461ef2b877031b838a7d1fd7f12b12d4ace7796d8cad91446d55959
+# - node:lts-alpine@sha256:d1b3b4da11eefd5941e7f0b9cf17783fc99d9c6fc34884a665f40a06dbdfc94f
+
+name: "Issue 自动分类与回复"
+"on":
+ issues:
+ types:
+ - opened
+ - reopened
+
+permissions: {}
+
+concurrency:
+ group: "gh-aw-${{ github.workflow }}-${{ github.event.issue.number || github.run_id }}"
+
+run-name: "Issue 自动分类与回复"
+
+jobs:
+ activation:
+ needs: pre_activation
+ if: needs.pre_activation.outputs.activated == 'true'
+ runs-on: ubuntu-slim
+ permissions:
+ actions: read
+ contents: read
+ outputs:
+ body: ${{ steps.sanitized.outputs.body }}
+ comment_id: ""
+ comment_repo: ""
+ engine_id: ${{ steps.generate_aw_info.outputs.engine_id }}
+ lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }}
+ model: ${{ steps.generate_aw_info.outputs.model }}
+ setup-trace-id: ${{ steps.setup.outputs.trace-id }}
+ stale_lock_file_failed: ${{ steps.check-lock-file.outputs.stale_lock_file_failed == 'true' }}
+ text: ${{ steps.sanitized.outputs.text }}
+ title: ${{ steps.sanitized.outputs.title }}
+ steps:
+ - name: Setup Scripts
+ id: setup
+ uses: github/gh-aw-actions/setup@b8068426813005612b960b5ab0b8bd2c27142323 # v0.71.5
+ with:
+ destination: ${{ runner.temp }}/gh-aw/actions
+ job-name: ${{ github.job }}
+ trace-id: ${{ needs.pre_activation.outputs.setup-trace-id }}
+ env:
+ GH_AW_SETUP_WORKFLOW_NAME: "Issue 自动分类与回复"
+ GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/issue-triage.lock.yml@${{ github.ref }}
+ GH_AW_INFO_VERSION: "1.0.40"
+ - name: Generate agentic run info
+ id: generate_aw_info
+ env:
+ GH_AW_INFO_ENGINE_ID: "copilot"
+ GH_AW_INFO_ENGINE_NAME: "GitHub Copilot CLI"
+ GH_AW_INFO_MODEL: ${{ vars.GH_AW_MODEL_AGENT_COPILOT || 'claude-sonnet-4.6' }}
+ GH_AW_INFO_VERSION: "1.0.40"
+ GH_AW_INFO_AGENT_VERSION: "1.0.40"
+ GH_AW_INFO_CLI_VERSION: "v0.71.5"
+ GH_AW_INFO_WORKFLOW_NAME: "Issue 自动分类与回复"
+ GH_AW_INFO_EXPERIMENTAL: "false"
+ GH_AW_INFO_SUPPORTS_TOOLS_ALLOWLIST: "true"
+ GH_AW_INFO_STAGED: "false"
+ GH_AW_INFO_ALLOWED_DOMAINS: '["defaults","ark.cn-beijing.volces.com"]'
+ GH_AW_INFO_FIREWALL_ENABLED: "false"
+ GH_AW_INFO_AWF_VERSION: ""
+ GH_AW_INFO_AWMG_VERSION: ""
+ GH_AW_INFO_FIREWALL_TYPE: ""
+ GH_AW_COMPILED_STRICT: "false"
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ with:
+ script: |
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require('${{ runner.temp }}/gh-aw/actions/generate_aw_info.cjs');
+ await main(core, context);
+ - name: Checkout .github and .agents folders
+ uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ with:
+ persist-credentials: false
+ sparse-checkout: |
+ .github
+ .agents
+ .claude
+ .codex
+ .crush
+ .gemini
+ .opencode
+ .pi
+ sparse-checkout-cone-mode: true
+ fetch-depth: 1
+ - name: Save agent config folders for base branch restoration
+ env:
+ GH_AW_AGENT_FOLDERS: ".agents .claude .codex .crush .gemini .github .opencode .pi"
+ GH_AW_AGENT_FILES: ".crush.json AGENTS.md CLAUDE.md GEMINI.md PI.md opencode.jsonc"
+ # poutine:ignore untrusted_checkout_exec
+ run: bash "${RUNNER_TEMP}/gh-aw/actions/save_base_github_folders.sh"
+ - name: Check workflow lock file
+ id: check-lock-file
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_WORKFLOW_FILE: "issue-triage.lock.yml"
+ GH_AW_CONTEXT_WORKFLOW_REF: "${{ github.workflow_ref }}"
+ with:
+ script: |
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require('${{ runner.temp }}/gh-aw/actions/check_workflow_timestamp_api.cjs');
+ await main();
+ - name: Check compile-agentic version
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_COMPILED_VERSION: "v0.71.5"
+ with:
+ script: |
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require('${{ runner.temp }}/gh-aw/actions/check_version_updates.cjs');
+ await main();
+ - name: Compute current body text
+ id: sanitized
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_ALLOWED_DOMAINS: "api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,api.snapcraft.io,archive.ubuntu.com,ark.cn-beijing.volces.com,azure.archive.ubuntu.com,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,github.com,host.docker.internal,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,ppa.launchpad.net,raw.githubusercontent.com,registry.npmjs.org,s.symcb.com,s.symcd.com,security.ubuntu.com,telemetry.enterprise.githubcopilot.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com,www.googleapis.com"
+ with:
+ script: |
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require('${{ runner.temp }}/gh-aw/actions/compute_text.cjs');
+ await main();
+ - name: Create prompt with built-in context
+ env:
+ GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
+ GH_AW_SAFE_OUTPUTS: ${{ runner.temp }}/gh-aw/safeoutputs/outputs.jsonl
+ GH_AW_GITHUB_ACTOR: ${{ github.actor }}
+ GH_AW_GITHUB_EVENT_COMMENT_ID: ${{ github.event.comment.id }}
+ GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER: ${{ github.event.discussion.number }}
+ GH_AW_GITHUB_EVENT_ISSUE_NUMBER: ${{ github.event.issue.number }}
+ GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER: ${{ github.event.pull_request.number }}
+ GH_AW_GITHUB_REPOSITORY: ${{ github.repository }}
+ GH_AW_GITHUB_RUN_ID: ${{ github.run_id }}
+ GH_AW_GITHUB_WORKSPACE: ${{ github.workspace }}
+ # poutine:ignore untrusted_checkout_exec
+ run: |
+ bash "${RUNNER_TEMP}/gh-aw/actions/create_prompt_first.sh"
+ {
+ cat << 'GH_AW_PROMPT_1857816c8098cba9_EOF'
+
+ GH_AW_PROMPT_1857816c8098cba9_EOF
+ cat "${RUNNER_TEMP}/gh-aw/prompts/xpia.md"
+ cat "${RUNNER_TEMP}/gh-aw/prompts/temp_folder_prompt.md"
+ cat "${RUNNER_TEMP}/gh-aw/prompts/markdown.md"
+ cat "${RUNNER_TEMP}/gh-aw/prompts/safe_outputs_prompt.md"
+ cat << 'GH_AW_PROMPT_1857816c8098cba9_EOF'
+
+ Tools: add_comment, add_labels, missing_tool, missing_data, noop
+
+ GH_AW_PROMPT_1857816c8098cba9_EOF
+ cat "${RUNNER_TEMP}/gh-aw/prompts/mcp_cli_tools_prompt.md"
+ cat << 'GH_AW_PROMPT_1857816c8098cba9_EOF'
+
+ The following GitHub context information is available for this workflow:
+ {{#if __GH_AW_GITHUB_ACTOR__ }}
+ - **actor**: __GH_AW_GITHUB_ACTOR__
+ {{/if}}
+ {{#if __GH_AW_GITHUB_REPOSITORY__ }}
+ - **repository**: __GH_AW_GITHUB_REPOSITORY__
+ {{/if}}
+ {{#if __GH_AW_GITHUB_WORKSPACE__ }}
+ - **workspace**: __GH_AW_GITHUB_WORKSPACE__
+ {{/if}}
+ {{#if __GH_AW_GITHUB_EVENT_ISSUE_NUMBER__ }}
+ - **issue-number**: #__GH_AW_GITHUB_EVENT_ISSUE_NUMBER__
+ {{/if}}
+ {{#if __GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER__ }}
+ - **discussion-number**: #__GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER__
+ {{/if}}
+ {{#if __GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER__ }}
+ - **pull-request-number**: #__GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER__
+ {{/if}}
+ {{#if __GH_AW_GITHUB_EVENT_COMMENT_ID__ }}
+ - **comment-id**: __GH_AW_GITHUB_EVENT_COMMENT_ID__
+ {{/if}}
+ {{#if __GH_AW_GITHUB_RUN_ID__ }}
+ - **workflow-run-id**: __GH_AW_GITHUB_RUN_ID__
+ {{/if}}
+
+
+ GH_AW_PROMPT_1857816c8098cba9_EOF
+ cat "${RUNNER_TEMP}/gh-aw/prompts/github_mcp_tools_with_safeoutputs_prompt.md"
+ cat << 'GH_AW_PROMPT_1857816c8098cba9_EOF'
+
+ {{#runtime-import .github/workflows/issue-triage.md}}
+ GH_AW_PROMPT_1857816c8098cba9_EOF
+ } > "$GH_AW_PROMPT"
+ - name: Interpolate variables and render templates
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
+ GH_AW_ENGINE_ID: "copilot"
+ GH_AW_GITHUB_REPOSITORY: ${{ github.repository }}
+ with:
+ script: |
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require('${{ runner.temp }}/gh-aw/actions/interpolate_prompt.cjs');
+ await main();
+ - name: Substitute placeholders
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
+ GH_AW_GITHUB_ACTOR: ${{ github.actor }}
+ GH_AW_GITHUB_EVENT_COMMENT_ID: ${{ github.event.comment.id }}
+ GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER: ${{ github.event.discussion.number }}
+ GH_AW_GITHUB_EVENT_ISSUE_NUMBER: ${{ github.event.issue.number }}
+ GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER: ${{ github.event.pull_request.number }}
+ GH_AW_GITHUB_REPOSITORY: ${{ github.repository }}
+ GH_AW_GITHUB_RUN_ID: ${{ github.run_id }}
+ GH_AW_GITHUB_WORKSPACE: ${{ github.workspace }}
+ GH_AW_MCP_CLI_SERVERS_LIST: '- `safeoutputs` — run `safeoutputs --help` to see available tools'
+ GH_AW_NEEDS_PRE_ACTIVATION_OUTPUTS_ACTIVATED: ${{ needs.pre_activation.outputs.activated }}
+ with:
+ script: |
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+ setupGlobals(core, github, context, exec, io, getOctokit);
+
+ const substitutePlaceholders = require('${{ runner.temp }}/gh-aw/actions/substitute_placeholders.cjs');
+
+ // Call the substitution function
+ return await substitutePlaceholders({
+ file: process.env.GH_AW_PROMPT,
+ substitutions: {
+ GH_AW_GITHUB_ACTOR: process.env.GH_AW_GITHUB_ACTOR,
+ GH_AW_GITHUB_EVENT_COMMENT_ID: process.env.GH_AW_GITHUB_EVENT_COMMENT_ID,
+ GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER: process.env.GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER,
+ GH_AW_GITHUB_EVENT_ISSUE_NUMBER: process.env.GH_AW_GITHUB_EVENT_ISSUE_NUMBER,
+ GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER: process.env.GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER,
+ GH_AW_GITHUB_REPOSITORY: process.env.GH_AW_GITHUB_REPOSITORY,
+ GH_AW_GITHUB_RUN_ID: process.env.GH_AW_GITHUB_RUN_ID,
+ GH_AW_GITHUB_WORKSPACE: process.env.GH_AW_GITHUB_WORKSPACE,
+ GH_AW_MCP_CLI_SERVERS_LIST: process.env.GH_AW_MCP_CLI_SERVERS_LIST,
+ GH_AW_NEEDS_PRE_ACTIVATION_OUTPUTS_ACTIVATED: process.env.GH_AW_NEEDS_PRE_ACTIVATION_OUTPUTS_ACTIVATED
+ }
+ });
+ - name: Validate prompt placeholders
+ env:
+ GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
+ # poutine:ignore untrusted_checkout_exec
+ run: bash "${RUNNER_TEMP}/gh-aw/actions/validate_prompt_placeholders.sh"
+ - name: Print prompt
+ env:
+ GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
+ # poutine:ignore untrusted_checkout_exec
+ run: bash "${RUNNER_TEMP}/gh-aw/actions/print_prompt_summary.sh"
+ - name: Upload activation artifact
+ if: success()
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+ with:
+ name: activation
+ include-hidden-files: true
+ path: |
+ /tmp/gh-aw/aw_info.json
+ /tmp/gh-aw/aw-prompts/prompt.txt
+ /tmp/gh-aw/github_rate_limits.jsonl
+ /tmp/gh-aw/base
+ if-no-files-found: ignore
+ retention-days: 1
+
+ agent:
+ needs: activation
+ runs-on: ubuntu-latest
+ permissions:
+ contents: read
+ issues: read
+ pull-requests: read
+ env:
+ DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+ GH_AW_ASSETS_ALLOWED_EXTS: ""
+ GH_AW_ASSETS_BRANCH: ""
+ GH_AW_ASSETS_MAX_SIZE_KB: 0
+ GH_AW_MCP_LOG_DIR: /tmp/gh-aw/mcp-logs/safeoutputs
+ GH_AW_WORKFLOW_ID_SANITIZED: issuetriage
+ outputs:
+ agentic_engine_timeout: ${{ steps.detect-copilot-errors.outputs.agentic_engine_timeout || 'false' }}
+ checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
+ effective_tokens: ${{ steps.parse-mcp-gateway.outputs.effective_tokens }}
+ has_patch: ${{ steps.collect_output.outputs.has_patch }}
+ inference_access_error: ${{ steps.detect-copilot-errors.outputs.inference_access_error || 'false' }}
+ mcp_policy_error: ${{ steps.detect-copilot-errors.outputs.mcp_policy_error || 'false' }}
+ model: ${{ needs.activation.outputs.model }}
+ model_not_supported_error: ${{ steps.detect-copilot-errors.outputs.model_not_supported_error || 'false' }}
+ output: ${{ steps.collect_output.outputs.output }}
+ output_types: ${{ steps.collect_output.outputs.output_types }}
+ setup-trace-id: ${{ steps.setup.outputs.trace-id }}
+ steps:
+ - name: Setup Scripts
+ id: setup
+ uses: github/gh-aw-actions/setup@b8068426813005612b960b5ab0b8bd2c27142323 # v0.71.5
+ with:
+ destination: ${{ runner.temp }}/gh-aw/actions
+ job-name: ${{ github.job }}
+ trace-id: ${{ needs.activation.outputs.setup-trace-id }}
+ env:
+ GH_AW_SETUP_WORKFLOW_NAME: "Issue 自动分类与回复"
+ GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/issue-triage.lock.yml@${{ github.ref }}
+ GH_AW_INFO_VERSION: "1.0.40"
+ - name: Set runtime paths
+ id: set-runtime-paths
+ run: |
+ {
+ echo "GH_AW_SAFE_OUTPUTS=${RUNNER_TEMP}/gh-aw/safeoutputs/outputs.jsonl"
+ echo "GH_AW_SAFE_OUTPUTS_CONFIG_PATH=${RUNNER_TEMP}/gh-aw/safeoutputs/config.json"
+ echo "GH_AW_SAFE_OUTPUTS_TOOLS_PATH=${RUNNER_TEMP}/gh-aw/safeoutputs/tools.json"
+ } >> "$GITHUB_OUTPUT"
+ - name: Checkout repository
+ uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ with:
+ persist-credentials: false
+ - name: Create gh-aw temp directory
+ run: bash "${RUNNER_TEMP}/gh-aw/actions/create_gh_aw_tmp_dir.sh"
+ - name: Configure gh CLI for GitHub Enterprise
+ run: bash "${RUNNER_TEMP}/gh-aw/actions/configure_gh_for_ghe.sh"
+ env:
+ GH_TOKEN: ${{ github.token }}
+ - name: Configure Git credentials
+ env:
+ REPO_NAME: ${{ github.repository }}
+ SERVER_URL: ${{ github.server_url }}
+ GITHUB_TOKEN: ${{ github.token }}
+ run: |
+ git config --global user.email "github-actions[bot]@users.noreply.github.com"
+ git config --global user.name "github-actions[bot]"
+ git config --global am.keepcr true
+ # Re-authenticate git with GitHub token
+ SERVER_URL_STRIPPED="${SERVER_URL#https://}"
+ git remote set-url origin "https://x-access-token:${GITHUB_TOKEN}@${SERVER_URL_STRIPPED}/${REPO_NAME}.git"
+ echo "Git configured with standard GitHub Actions identity"
+ - name: Checkout PR branch
+ id: checkout-pr
+ if: |
+ github.event.pull_request || github.event.issue.pull_request
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+ with:
+ github-token: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+ script: |
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require('${{ runner.temp }}/gh-aw/actions/checkout_pr_branch.cjs');
+ await main();
+ - name: Install GitHub Copilot CLI
+ run: bash "${RUNNER_TEMP}/gh-aw/actions/install_copilot_cli.sh" 1.0.40
+ env:
+ GH_HOST: github.com
+ - name: Parse integrity filter lists
+ id: parse-guard-vars
+ env:
+ GH_AW_BLOCKED_USERS_VAR: ${{ vars.GH_AW_GITHUB_BLOCKED_USERS || '' }}
+ GH_AW_TRUSTED_USERS_VAR: ${{ vars.GH_AW_GITHUB_TRUSTED_USERS || '' }}
+ GH_AW_APPROVAL_LABELS_VAR: ${{ vars.GH_AW_GITHUB_APPROVAL_LABELS || '' }}
+ run: bash "${RUNNER_TEMP}/gh-aw/actions/parse_guard_list.sh"
+ - name: Download activation artifact
+ uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+ with:
+ name: activation
+ path: /tmp/gh-aw
+ - name: Restore agent config folders from base branch
+ if: steps.checkout-pr.outcome == 'success'
+ env:
+ GH_AW_AGENT_FOLDERS: ".agents .claude .codex .crush .gemini .github .opencode .pi"
+ GH_AW_AGENT_FILES: ".crush.json AGENTS.md CLAUDE.md GEMINI.md PI.md opencode.jsonc"
+ run: bash "${RUNNER_TEMP}/gh-aw/actions/restore_base_github_folders.sh"
+ - name: Download container images
+ run: bash "${RUNNER_TEMP}/gh-aw/actions/download_docker_images.sh" ghcr.io/github/github-mcp-server:v1.0.3@sha256:2ac27ef03461ef2b877031b838a7d1fd7f12b12d4ace7796d8cad91446d55959 node:lts-alpine@sha256:d1b3b4da11eefd5941e7f0b9cf17783fc99d9c6fc34884a665f40a06dbdfc94f
+ - name: Generate Safe Outputs Config
+ run: |
+ mkdir -p "${RUNNER_TEMP}/gh-aw/safeoutputs"
+ mkdir -p /tmp/gh-aw/safeoutputs
+ mkdir -p /tmp/gh-aw/mcp-logs/safeoutputs
+ cat > "${RUNNER_TEMP}/gh-aw/safeoutputs/config.json" << 'GH_AW_SAFE_OUTPUTS_CONFIG_18efef56cd5f6986_EOF'
+ {"add_comment":{"max":1},"add_labels":{"allowed":["bug","feature","enhancement","documentation","question","duplicate","invalid"]},"create_report_incomplete_issue":{},"missing_data":{},"missing_tool":{},"noop":{"max":1,"report-as-issue":"true"},"report_incomplete":{}}
+ GH_AW_SAFE_OUTPUTS_CONFIG_18efef56cd5f6986_EOF
+ - name: Generate Safe Outputs Tools
+ env:
+ GH_AW_TOOLS_META_JSON: |
+ {
+ "description_suffixes": {
+ "add_comment": " CONSTRAINTS: Maximum 1 comment(s) can be added. Supports reply_to_id for discussion threading.",
+ "add_labels": " CONSTRAINTS: Only these labels are allowed: [\"bug\" \"feature\" \"enhancement\" \"documentation\" \"question\" \"duplicate\" \"invalid\"]."
+ },
+ "repo_params": {},
+ "dynamic_tools": []
+ }
+ GH_AW_VALIDATION_JSON: |
+ {
+ "add_comment": {
+ "defaultMax": 1,
+ "fields": {
+ "body": {
+ "required": true,
+ "type": "string",
+ "sanitize": true,
+ "maxLength": 65000
+ },
+ "item_number": {
+ "issueOrPRNumber": true
+ },
+ "reply_to_id": {
+ "type": "string",
+ "maxLength": 256
+ },
+ "repo": {
+ "type": "string",
+ "maxLength": 256
+ }
+ }
+ },
+ "add_labels": {
+ "defaultMax": 5,
+ "fields": {
+ "item_number": {
+ "issueNumberOrTemporaryId": true
+ },
+ "labels": {
+ "required": true,
+ "type": "array",
+ "itemType": "string",
+ "itemSanitize": true,
+ "itemMaxLength": 128
+ },
+ "repo": {
+ "type": "string",
+ "maxLength": 256
+ }
+ }
+ },
+ "missing_data": {
+ "defaultMax": 20,
+ "fields": {
+ "alternatives": {
+ "type": "string",
+ "sanitize": true,
+ "maxLength": 256
+ },
+ "context": {
+ "type": "string",
+ "sanitize": true,
+ "maxLength": 256
+ },
+ "data_type": {
+ "type": "string",
+ "sanitize": true,
+ "maxLength": 128
+ },
+ "reason": {
+ "type": "string",
+ "sanitize": true,
+ "maxLength": 256
+ }
+ }
+ },
+ "missing_tool": {
+ "defaultMax": 20,
+ "fields": {
+ "alternatives": {
+ "type": "string",
+ "sanitize": true,
+ "maxLength": 512
+ },
+ "reason": {
+ "required": true,
+ "type": "string",
+ "sanitize": true,
+ "maxLength": 256
+ },
+ "tool": {
+ "type": "string",
+ "sanitize": true,
+ "maxLength": 128
+ }
+ }
+ },
+ "noop": {
+ "defaultMax": 1,
+ "fields": {
+ "message": {
+ "required": true,
+ "type": "string",
+ "sanitize": true,
+ "maxLength": 65000
+ }
+ }
+ },
+ "report_incomplete": {
+ "defaultMax": 5,
+ "fields": {
+ "details": {
+ "type": "string",
+ "sanitize": true,
+ "maxLength": 65000
+ },
+ "reason": {
+ "required": true,
+ "type": "string",
+ "sanitize": true,
+ "maxLength": 1024
+ }
+ }
+ }
+ }
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ with:
+ script: |
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require('${{ runner.temp }}/gh-aw/actions/generate_safe_outputs_tools.cjs');
+ await main();
+ - name: Generate Safe Outputs MCP Server Config
+ id: safe-outputs-config
+ run: |
+ # Generate a secure random API key (360 bits of entropy, 40+ chars)
+ # Mask immediately to prevent timing vulnerabilities
+ API_KEY=$(openssl rand -base64 45 | tr -d '/+=')
+ echo "::add-mask::${API_KEY}"
+
+ PORT=3001
+
+ # Set outputs for next steps
+ {
+ echo "safe_outputs_api_key=${API_KEY}"
+ echo "safe_outputs_port=${PORT}"
+ } >> "$GITHUB_OUTPUT"
+
+ echo "Safe Outputs MCP server will run on port ${PORT}"
+
+ - name: Start Safe Outputs MCP HTTP Server
+ id: safe-outputs-start
+ env:
+ DEBUG: '*'
+ GH_AW_SAFE_OUTPUTS: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS }}
+ GH_AW_SAFE_OUTPUTS_PORT: ${{ steps.safe-outputs-config.outputs.safe_outputs_port }}
+ GH_AW_SAFE_OUTPUTS_API_KEY: ${{ steps.safe-outputs-config.outputs.safe_outputs_api_key }}
+ GH_AW_SAFE_OUTPUTS_TOOLS_PATH: ${{ runner.temp }}/gh-aw/safeoutputs/tools.json
+ GH_AW_SAFE_OUTPUTS_CONFIG_PATH: ${{ runner.temp }}/gh-aw/safeoutputs/config.json
+ GH_AW_MCP_LOG_DIR: /tmp/gh-aw/mcp-logs/safeoutputs
+ run: |
+ # Environment variables are set above to prevent template injection
+ export DEBUG
+ export GH_AW_SAFE_OUTPUTS
+ export GH_AW_SAFE_OUTPUTS_PORT
+ export GH_AW_SAFE_OUTPUTS_API_KEY
+ export GH_AW_SAFE_OUTPUTS_TOOLS_PATH
+ export GH_AW_SAFE_OUTPUTS_CONFIG_PATH
+ export GH_AW_MCP_LOG_DIR
+
+ bash "${RUNNER_TEMP}/gh-aw/actions/start_safe_outputs_server.sh"
+
+ - name: Start MCP Gateway
+ id: start-mcp-gateway
+ env:
+ GH_AW_SAFE_OUTPUTS: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS }}
+ GH_AW_SAFE_OUTPUTS_API_KEY: ${{ steps.safe-outputs-start.outputs.api_key }}
+ GH_AW_SAFE_OUTPUTS_PORT: ${{ steps.safe-outputs-start.outputs.port }}
+ GITHUB_MCP_SERVER_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+ run: |
+ set -eo pipefail
+ mkdir -p "${RUNNER_TEMP}/gh-aw/mcp-config"
+
+ # Export gateway environment variables for MCP config and gateway script
+ export MCP_GATEWAY_PORT="8080"
+ export MCP_GATEWAY_DOMAIN="localhost"
+ export MCP_GATEWAY_HOST_DOMAIN="localhost"
+ MCP_GATEWAY_API_KEY=$(openssl rand -base64 45 | tr -d '/+=')
+ echo "::add-mask::${MCP_GATEWAY_API_KEY}"
+ export MCP_GATEWAY_API_KEY
+ export MCP_GATEWAY_PAYLOAD_DIR="/tmp/gh-aw/mcp-payloads"
+ mkdir -p "${MCP_GATEWAY_PAYLOAD_DIR}"
+ export MCP_GATEWAY_PAYLOAD_SIZE_THRESHOLD="524288"
+ export DEBUG="*"
+
+ export GH_AW_ENGINE="copilot"
+ MCP_GATEWAY_UID=$(id -u 2>/dev/null || echo '0')
+ MCP_GATEWAY_GID=$(id -g 2>/dev/null || echo '0')
+ DOCKER_SOCK_GID=$(stat -c '%g' /var/run/docker.sock 2>/dev/null || echo '0')
+ export MCP_GATEWAY_DOCKER_COMMAND='docker run -i --rm --network host --add-host host.docker.internal:127.0.0.1 --user '"${MCP_GATEWAY_UID}"':'"${MCP_GATEWAY_GID}"' --group-add '"${DOCKER_SOCK_GID}"' -v /var/run/docker.sock:/var/run/docker.sock -e MCP_GATEWAY_PORT -e MCP_GATEWAY_DOMAIN -e MCP_GATEWAY_API_KEY -e MCP_GATEWAY_PAYLOAD_DIR -e MCP_GATEWAY_PAYLOAD_SIZE_THRESHOLD -e DEBUG -e MCP_GATEWAY_LOG_DIR -e GH_AW_MCP_LOG_DIR -e GH_AW_SAFE_OUTPUTS -e GH_AW_SAFE_OUTPUTS_CONFIG_PATH -e GH_AW_SAFE_OUTPUTS_TOOLS_PATH -e GH_AW_ASSETS_BRANCH -e GH_AW_ASSETS_MAX_SIZE_KB -e GH_AW_ASSETS_ALLOWED_EXTS -e DEFAULT_BRANCH -e GITHUB_MCP_SERVER_TOKEN -e GITHUB_MCP_GUARD_MIN_INTEGRITY -e GITHUB_MCP_GUARD_REPOS -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e GITHUB_SHA -e GITHUB_WORKSPACE -e GITHUB_TOKEN -e GITHUB_RUN_ID -e GITHUB_RUN_NUMBER -e GITHUB_RUN_ATTEMPT -e GITHUB_JOB -e GITHUB_ACTION -e GITHUB_EVENT_NAME -e GITHUB_EVENT_PATH -e GITHUB_ACTOR -e GITHUB_ACTOR_ID -e GITHUB_TRIGGERING_ACTOR -e GITHUB_WORKFLOW -e GITHUB_WORKFLOW_REF -e GITHUB_WORKFLOW_SHA -e GITHUB_REF -e GITHUB_REF_NAME -e GITHUB_REF_TYPE -e GITHUB_HEAD_REF -e GITHUB_BASE_REF -e GH_AW_SAFE_OUTPUTS_PORT -e GH_AW_SAFE_OUTPUTS_API_KEY -v /tmp/gh-aw/mcp-payloads:/tmp/gh-aw/mcp-payloads:rw -v /opt:/opt:ro -v /tmp:/tmp:rw -v '"${GITHUB_WORKSPACE}"':'"${GITHUB_WORKSPACE}"':rw ghcr.io/github/gh-aw-mcpg:v0.3.6'
+
+ mkdir -p /home/runner/.copilot
+ GH_AW_NODE=$(which node 2>/dev/null || command -v node 2>/dev/null || echo node)
+ cat << GH_AW_MCP_CONFIG_0138aecd21cfde50_EOF | "$GH_AW_NODE" "${RUNNER_TEMP}/gh-aw/actions/start_mcp_gateway.cjs"
+ {
+ "mcpServers": {
+ "github": {
+ "type": "stdio",
+ "container": "ghcr.io/github/github-mcp-server:v1.0.3",
+ "env": {
+ "GITHUB_HOST": "\${GITHUB_SERVER_URL}",
+ "GITHUB_PERSONAL_ACCESS_TOKEN": "\${GITHUB_MCP_SERVER_TOKEN}",
+ "GITHUB_READ_ONLY": "1",
+ "GITHUB_TOOLSETS": "context,repos,issues,pull_requests"
+ },
+ "guard-policies": {
+ "allow-only": {
+ "approval-labels": ${{ steps.parse-guard-vars.outputs.approval_labels }},
+ "blocked-users": ${{ steps.parse-guard-vars.outputs.blocked_users }},
+ "min-integrity": "none",
+ "repos": "all",
+ "trusted-users": ${{ steps.parse-guard-vars.outputs.trusted_users }}
+ }
+ }
+ },
+ "safeoutputs": {
+ "type": "http",
+ "url": "http://localhost:$GH_AW_SAFE_OUTPUTS_PORT",
+ "headers": {
+ "Authorization": "\${GH_AW_SAFE_OUTPUTS_API_KEY}"
+ },
+ "guard-policies": {
+ "write-sink": {
+ "accept": [
+ "*"
+ ]
+ }
+ }
+ }
+ },
+ "gateway": {
+ "port": $MCP_GATEWAY_PORT,
+ "domain": "${MCP_GATEWAY_DOMAIN}",
+ "apiKey": "${MCP_GATEWAY_API_KEY}",
+ "payloadDir": "${MCP_GATEWAY_PAYLOAD_DIR}"
+ }
+ }
+ GH_AW_MCP_CONFIG_0138aecd21cfde50_EOF
+ - name: Mount MCP servers as CLIs
+ id: mount-mcp-clis
+ continue-on-error: true
+ env:
+ MCP_GATEWAY_API_KEY: ${{ steps.start-mcp-gateway.outputs.gateway-api-key }}
+ MCP_GATEWAY_DOMAIN: ${{ steps.start-mcp-gateway.outputs.gateway-domain }}
+ MCP_GATEWAY_PORT: ${{ steps.start-mcp-gateway.outputs.gateway-port }}
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ with:
+ script: |
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+ setupGlobals(core, github, context, exec, io);
+ const { main } = require('${{ runner.temp }}/gh-aw/actions/mount_mcp_as_cli.cjs');
+ await main();
+ - name: Clean credentials
+ continue-on-error: true
+ run: bash "${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh"
+ - name: Audit pre-agent workspace
+ id: pre_agent_audit
+ continue-on-error: true
+ run: bash "${RUNNER_TEMP}/gh-aw/actions/audit_pre_agent_workspace.sh"
+ - name: Execute GitHub Copilot CLI
+ id: agentic_execution
+ # Copilot CLI tool arguments (sorted):
+ # --allow-tool github
+ # --allow-tool safeoutputs
+ timeout-minutes: 20
+ run: |
+ set -o pipefail
+ touch /tmp/gh-aw/agent-step-summary.md
+ (umask 177 && touch /tmp/gh-aw/agent-stdio.log)
+ mkdir -p /tmp/
+ mkdir -p /tmp/gh-aw/
+ mkdir -p /tmp/gh-aw/agent/
+ mkdir -p /tmp/gh-aw/sandbox/agent/logs/
+ GH_AW_NODE_EXEC="${GH_AW_NODE_BIN:-}"; if [ -z "$GH_AW_NODE_EXEC" ] || [ ! -x "$GH_AW_NODE_EXEC" ]; then GH_AW_NODE_EXEC="$(command -v node 2>/dev/null || echo node)"; fi; "$GH_AW_NODE_EXEC" ${RUNNER_TEMP}/gh-aw/actions/copilot_harness.cjs copilot --add-dir /tmp/ --add-dir /tmp/gh-aw/ --add-dir /tmp/gh-aw/agent/ --log-level all --log-dir /tmp/gh-aw/sandbox/agent/logs/ --disable-builtin-mcps --no-ask-user --allow-tool github --allow-tool safeoutputs --prompt-file /tmp/gh-aw/aw-prompts/prompt.txt 2>&1 | tee /tmp/gh-aw/agent-stdio.log
+ env:
+ COPILOT_AGENT_RUNNER_TYPE: STANDALONE
+ COPILOT_API_KEY: dummy-byok-key-for-offline-mode
+ COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
+ COPILOT_MODEL: doubao-seed-2-0-code-preview-260215
+ COPILOT_PROVIDER_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+ COPILOT_PROVIDER_BASE_URL: https://ark.cn-beijing.volces.com/api/v3
+ COPILOT_PROVIDER_TYPE: openai
+ GH_AW_MCP_CONFIG: /home/runner/.copilot/mcp-config.json
+ GH_AW_PHASE: agent
+ GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
+ GH_AW_SAFE_OUTPUTS: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS }}
+ GH_AW_VERSION: v0.71.5
+ GITHUB_API_URL: ${{ github.api_url }}
+ GITHUB_AW: true
+ GITHUB_COPILOT_INTEGRATION_ID: agentic-workflows
+ GITHUB_HEAD_REF: ${{ github.head_ref }}
+ GITHUB_MCP_SERVER_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+ GITHUB_REF_NAME: ${{ github.ref_name }}
+ GITHUB_SERVER_URL: ${{ github.server_url }}
+ GITHUB_STEP_SUMMARY: /tmp/gh-aw/agent-step-summary.md
+ GITHUB_WORKSPACE: ${{ github.workspace }}
+ XDG_CONFIG_HOME: /home/runner
+ - name: Detect Copilot errors
+ id: detect-copilot-errors
+ if: always()
+ continue-on-error: true
+ run: node "${RUNNER_TEMP}/gh-aw/actions/detect_copilot_errors.cjs"
+ - name: Configure Git credentials
+ env:
+ REPO_NAME: ${{ github.repository }}
+ SERVER_URL: ${{ github.server_url }}
+ GITHUB_TOKEN: ${{ github.token }}
+ run: |
+ git config --global user.email "github-actions[bot]@users.noreply.github.com"
+ git config --global user.name "github-actions[bot]"
+ git config --global am.keepcr true
+ # Re-authenticate git with GitHub token
+ SERVER_URL_STRIPPED="${SERVER_URL#https://}"
+ git remote set-url origin "https://x-access-token:${GITHUB_TOKEN}@${SERVER_URL_STRIPPED}/${REPO_NAME}.git"
+ echo "Git configured with standard GitHub Actions identity"
+ - name: Copy Copilot session state files to logs
+ if: always()
+ continue-on-error: true
+ run: bash "${RUNNER_TEMP}/gh-aw/actions/copy_copilot_session_state.sh"
+ - name: Stop MCP Gateway
+ if: always()
+ continue-on-error: true
+ env:
+ MCP_GATEWAY_PORT: ${{ steps.start-mcp-gateway.outputs.gateway-port }}
+ MCP_GATEWAY_API_KEY: ${{ steps.start-mcp-gateway.outputs.gateway-api-key }}
+ GATEWAY_PID: ${{ steps.start-mcp-gateway.outputs.gateway-pid }}
+ run: |
+ bash "${RUNNER_TEMP}/gh-aw/actions/stop_mcp_gateway.sh" "$GATEWAY_PID"
+ - name: Redact secrets in logs
+ if: always()
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ with:
+ script: |
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require('${{ runner.temp }}/gh-aw/actions/redact_secrets.cjs');
+ await main();
+ env:
+ GH_AW_SECRET_NAMES: 'COPILOT_GITHUB_TOKEN,GH_AW_GITHUB_MCP_SERVER_TOKEN,GH_AW_GITHUB_TOKEN,GITHUB_TOKEN,OPENAI_API_KEY'
+ SECRET_COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
+ SECRET_GH_AW_GITHUB_MCP_SERVER_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN }}
+ SECRET_GH_AW_GITHUB_TOKEN: ${{ secrets.GH_AW_GITHUB_TOKEN }}
+ SECRET_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+ SECRET_OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+ - name: Append agent step summary
+ if: always()
+ run: bash "${RUNNER_TEMP}/gh-aw/actions/append_agent_step_summary.sh"
+ - name: Copy Safe Outputs
+ if: always()
+ env:
+ GH_AW_SAFE_OUTPUTS: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS }}
+ run: |
+ mkdir -p /tmp/gh-aw
+ cp "$GH_AW_SAFE_OUTPUTS" /tmp/gh-aw/safeoutputs.jsonl 2>/dev/null || true
+ - name: Ingest agent output
+ id: collect_output
+ if: always()
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_SAFE_OUTPUTS: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS }}
+ GH_AW_ALLOWED_DOMAINS: "api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,api.snapcraft.io,archive.ubuntu.com,ark.cn-beijing.volces.com,azure.archive.ubuntu.com,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,github.com,host.docker.internal,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,ppa.launchpad.net,raw.githubusercontent.com,registry.npmjs.org,s.symcb.com,s.symcd.com,security.ubuntu.com,telemetry.enterprise.githubcopilot.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com,www.googleapis.com"
+ GITHUB_SERVER_URL: ${{ github.server_url }}
+ GITHUB_API_URL: ${{ github.api_url }}
+ with:
+ script: |
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require('${{ runner.temp }}/gh-aw/actions/collect_ndjson_output.cjs');
+ await main();
+ - name: Parse agent logs for step summary
+ if: always()
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_AGENT_OUTPUT: /tmp/gh-aw/sandbox/agent/logs/
+ with:
+ script: |
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require('${{ runner.temp }}/gh-aw/actions/parse_copilot_log.cjs');
+ await main();
+ - name: Parse MCP Gateway logs for step summary
+ if: always()
+ id: parse-mcp-gateway
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ with:
+ script: |
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require('${{ runner.temp }}/gh-aw/actions/parse_mcp_gateway_log.cjs');
+ await main();
+ - name: Write agent output placeholder if missing
+ if: always()
+ run: |
+ if [ ! -f /tmp/gh-aw/agent_output.json ]; then
+ echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
+ fi
+ - name: Upload agent artifacts
+ if: always()
+ continue-on-error: true
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+ with:
+ name: agent
+ path: |
+ /tmp/gh-aw/aw-prompts/prompt.txt
+ /tmp/gh-aw/sandbox/agent/logs/
+ /tmp/gh-aw/redacted-urls.log
+ /tmp/gh-aw/mcp-logs/
+ /tmp/gh-aw/proxy-logs/
+ !/tmp/gh-aw/proxy-logs/proxy-tls/
+ /tmp/gh-aw/agent-stdio.log
+ /tmp/gh-aw/pre-agent-audit.txt
+ /tmp/gh-aw/agent/
+ /tmp/gh-aw/github_rate_limits.jsonl
+ /tmp/gh-aw/safeoutputs.jsonl
+ /tmp/gh-aw/agent_output.json
+ if-no-files-found: ignore
+
+ conclusion:
+ needs:
+ - activation
+ - agent
+ - safe_outputs
+ if: >
+ always() && (needs.agent.result != 'skipped' || needs.activation.outputs.lockdown_check_failed == 'true' ||
+ needs.activation.outputs.stale_lock_file_failed == 'true')
+ runs-on: ubuntu-slim
+ permissions:
+ contents: read
+ discussions: write
+ issues: write
+ pull-requests: write
+ concurrency:
+ group: "gh-aw-conclusion-issue-triage"
+ cancel-in-progress: false
+ outputs:
+ incomplete_count: ${{ steps.report_incomplete.outputs.incomplete_count }}
+ noop_message: ${{ steps.noop.outputs.noop_message }}
+ tools_reported: ${{ steps.missing_tool.outputs.tools_reported }}
+ total_count: ${{ steps.missing_tool.outputs.total_count }}
+ steps:
+ - name: Setup Scripts
+ id: setup
+ uses: github/gh-aw-actions/setup@b8068426813005612b960b5ab0b8bd2c27142323 # v0.71.5
+ with:
+ destination: ${{ runner.temp }}/gh-aw/actions
+ job-name: ${{ github.job }}
+ trace-id: ${{ needs.activation.outputs.setup-trace-id }}
+ env:
+ GH_AW_SETUP_WORKFLOW_NAME: "Issue 自动分类与回复"
+ GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/issue-triage.lock.yml@${{ github.ref }}
+ GH_AW_INFO_VERSION: "1.0.40"
+ - name: Download agent output artifact
+ id: download-agent-output
+ continue-on-error: true
+ uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+ with:
+ name: agent
+ path: /tmp/gh-aw/
+ - name: Setup agent output environment variable
+ id: setup-agent-output-env
+ if: steps.download-agent-output.outcome == 'success'
+ run: |
+ mkdir -p /tmp/gh-aw/
+ find "/tmp/gh-aw/" -type f -print
+ echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT"
+ - name: Process no-op messages
+ id: noop
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }}
+ GH_AW_NOOP_MAX: "1"
+ GH_AW_WORKFLOW_NAME: "Issue 自动分类与回复"
+ GH_AW_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+ GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }}
+ GH_AW_NOOP_REPORT_AS_ISSUE: "true"
+ with:
+ github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+ script: |
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require('${{ runner.temp }}/gh-aw/actions/handle_noop_message.cjs');
+ await main();
+ - name: Record missing tool
+ id: missing_tool
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }}
+ GH_AW_MISSING_TOOL_CREATE_ISSUE: "true"
+ GH_AW_WORKFLOW_NAME: "Issue 自动分类与回复"
+ with:
+ github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+ script: |
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require('${{ runner.temp }}/gh-aw/actions/missing_tool.cjs');
+ await main();
+ - name: Record incomplete
+ id: report_incomplete
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }}
+ GH_AW_REPORT_INCOMPLETE_CREATE_ISSUE: "true"
+ GH_AW_WORKFLOW_NAME: "Issue 自动分类与回复"
+ with:
+ github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+ script: |
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require('${{ runner.temp }}/gh-aw/actions/report_incomplete_handler.cjs');
+ await main();
+ - name: Handle agent failure
+ id: handle_agent_failure
+ if: always()
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }}
+ GH_AW_WORKFLOW_NAME: "Issue 自动分类与回复"
+ GH_AW_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+ GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }}
+ GH_AW_WORKFLOW_ID: "issue-triage"
+ GH_AW_ACTION_FAILURE_ISSUE_EXPIRES_HOURS: "168"
+ GH_AW_ENGINE_ID: "copilot"
+ GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+ GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+ GH_AW_MCP_POLICY_ERROR: ${{ needs.agent.outputs.mcp_policy_error }}
+ GH_AW_AGENTIC_ENGINE_TIMEOUT: ${{ needs.agent.outputs.agentic_engine_timeout }}
+ GH_AW_MODEL_NOT_SUPPORTED_ERROR: ${{ needs.agent.outputs.model_not_supported_error }}
+ GH_AW_ENGINE_API_HOSTS: "api.enterprise.githubcopilot.com,api.githubcopilot.com,api.business.githubcopilot.com,api.individual.githubcopilot.com"
+ GH_AW_LOCKDOWN_CHECK_FAILED: ${{ needs.activation.outputs.lockdown_check_failed }}
+ GH_AW_STALE_LOCK_FILE_FAILED: ${{ needs.activation.outputs.stale_lock_file_failed }}
+ GH_AW_GROUP_REPORTS: "false"
+ GH_AW_FAILURE_REPORT_AS_ISSUE: "true"
+ GH_AW_MISSING_TOOL_REPORT_AS_FAILURE: "true"
+ GH_AW_MISSING_DATA_REPORT_AS_FAILURE: "true"
+ GH_AW_TIMEOUT_MINUTES: "20"
+ with:
+ github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+ script: |
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require('${{ runner.temp }}/gh-aw/actions/handle_agent_failure.cjs');
+ await main();
+
+ pre_activation:
+ runs-on: ubuntu-slim
+ outputs:
+ activated: ${{ steps.check_membership.outputs.is_team_member == 'true' }}
+ matched_command: ''
+ setup-trace-id: ${{ steps.setup.outputs.trace-id }}
+ steps:
+ - name: Setup Scripts
+ id: setup
+ uses: github/gh-aw-actions/setup@b8068426813005612b960b5ab0b8bd2c27142323 # v0.71.5
+ with:
+ destination: ${{ runner.temp }}/gh-aw/actions
+ job-name: ${{ github.job }}
+ env:
+ GH_AW_SETUP_WORKFLOW_NAME: "Issue 自动分类与回复"
+ GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/issue-triage.lock.yml@${{ github.ref }}
+ GH_AW_INFO_VERSION: "1.0.40"
+ - name: Check team membership for workflow
+ id: check_membership
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_REQUIRED_ROLES: "admin,maintainer,write"
+ with:
+ github-token: ${{ secrets.GITHUB_TOKEN }}
+ script: |
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require('${{ runner.temp }}/gh-aw/actions/check_membership.cjs');
+ await main();
+
+ safe_outputs:
+ needs:
+ - activation
+ - agent
+ if: (!cancelled()) && needs.agent.result != 'skipped'
+ runs-on: ubuntu-slim
+ permissions:
+ contents: read
+ discussions: write
+ issues: write
+ pull-requests: write
+ timeout-minutes: 15
+ env:
+ GH_AW_CALLER_WORKFLOW_ID: "${{ github.repository }}/issue-triage"
+ GH_AW_EFFECTIVE_TOKENS: ${{ needs.agent.outputs.effective_tokens }}
+ GH_AW_ENGINE_ID: "copilot"
+ GH_AW_ENGINE_MODEL: ${{ needs.agent.outputs.model }}
+ GH_AW_ENGINE_VERSION: "1.0.40"
+ GH_AW_WORKFLOW_ID: "issue-triage"
+ GH_AW_WORKFLOW_NAME: "Issue 自动分类与回复"
+ outputs:
+ code_push_failure_count: ${{ steps.process_safe_outputs.outputs.code_push_failure_count }}
+ code_push_failure_errors: ${{ steps.process_safe_outputs.outputs.code_push_failure_errors }}
+ comment_id: ${{ steps.process_safe_outputs.outputs.comment_id }}
+ comment_url: ${{ steps.process_safe_outputs.outputs.comment_url }}
+ create_discussion_error_count: ${{ steps.process_safe_outputs.outputs.create_discussion_error_count }}
+ create_discussion_errors: ${{ steps.process_safe_outputs.outputs.create_discussion_errors }}
+ process_safe_outputs_processed_count: ${{ steps.process_safe_outputs.outputs.processed_count }}
+ process_safe_outputs_temporary_id_map: ${{ steps.process_safe_outputs.outputs.temporary_id_map }}
+ steps:
+ - name: Setup Scripts
+ id: setup
+ uses: github/gh-aw-actions/setup@b8068426813005612b960b5ab0b8bd2c27142323 # v0.71.5
+ with:
+ destination: ${{ runner.temp }}/gh-aw/actions
+ job-name: ${{ github.job }}
+ trace-id: ${{ needs.activation.outputs.setup-trace-id }}
+ env:
+ GH_AW_SETUP_WORKFLOW_NAME: "Issue 自动分类与回复"
+ GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/issue-triage.lock.yml@${{ github.ref }}
+ GH_AW_INFO_VERSION: "1.0.40"
+ - name: Download agent output artifact
+ id: download-agent-output
+ continue-on-error: true
+ uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+ with:
+ name: agent
+ path: /tmp/gh-aw/
+ - name: Setup agent output environment variable
+ id: setup-agent-output-env
+ if: steps.download-agent-output.outcome == 'success'
+ run: |
+ mkdir -p /tmp/gh-aw/
+ find "/tmp/gh-aw/" -type f -print
+ echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT"
+ - name: Configure GH_HOST for enterprise compatibility
+ id: ghes-host-config
+ shell: bash
+ run: |
+ # Derive GH_HOST from GITHUB_SERVER_URL so the gh CLI targets the correct
+ # GitHub instance (GHES/GHEC). On github.com this is a harmless no-op.
+ GH_HOST="${GITHUB_SERVER_URL#https://}"
+ GH_HOST="${GH_HOST#http://}"
+ echo "GH_HOST=${GH_HOST}" >> "$GITHUB_ENV"
+ - name: Process Safe Outputs
+ id: process_safe_outputs
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }}
+ GH_AW_ALLOWED_DOMAINS: "api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,api.snapcraft.io,archive.ubuntu.com,ark.cn-beijing.volces.com,azure.archive.ubuntu.com,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,github.com,host.docker.internal,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,ppa.launchpad.net,raw.githubusercontent.com,registry.npmjs.org,s.symcb.com,s.symcd.com,security.ubuntu.com,telemetry.enterprise.githubcopilot.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com,www.googleapis.com"
+ GITHUB_SERVER_URL: ${{ github.server_url }}
+ GITHUB_API_URL: ${{ github.api_url }}
+ GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"add_comment\":{\"max\":1},\"add_labels\":{\"allowed\":[\"bug\",\"feature\",\"enhancement\",\"documentation\",\"question\",\"duplicate\",\"invalid\"]},\"create_report_incomplete_issue\":{},\"missing_data\":{},\"missing_tool\":{},\"noop\":{\"max\":1,\"report-as-issue\":\"true\"},\"report_incomplete\":{}}"
+ with:
+ github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+ script: |
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require('${{ runner.temp }}/gh-aw/actions/safe_output_handler_manager.cjs');
+ await main();
+ - name: Upload Safe Outputs Items
+ if: always()
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+ with:
+ name: safe-outputs-items
+ path: |
+ /tmp/gh-aw/safe-output-items.jsonl
+ /tmp/gh-aw/temporary-id-map.json
+ if-no-files-found: ignore
+
diff --git a/.github/workflows/issue-triage.md b/.github/workflows/issue-triage.md
new file mode 100644
index 0000000..f384730
--- /dev/null
+++ b/.github/workflows/issue-triage.md
@@ -0,0 +1,68 @@
+---
+on:
+ issues:
+ types: [opened, reopened]
+
+engine:
+ id: copilot
+ env:
+ COPILOT_PROVIDER_BASE_URL: "https://ark.cn-beijing.volces.com/api/v3"
+ COPILOT_MODEL: doubao-seed-2-0-code-preview-260215
+ COPILOT_PROVIDER_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+ COPILOT_PROVIDER_TYPE: openai
+
+network:
+ allowed:
+ - defaults
+ - ark.cn-beijing.volces.com
+
+sandbox:
+ agent: false
+strict: false
+
+tools:
+ github:
+ min-integrity: none
+
+permissions:
+ issues: read
+ contents: read
+ pull-requests: read
+
+safe-outputs:
+ threat-detection: false
+ add-comment:
+ max: 1
+ add-labels:
+ allowed:
+ - bug
+ - feature
+ - enhancement
+ - documentation
+ - question
+ - duplicate
+ - invalid
+---
+
+# Issue 自动分类与回复
+
+分析仓库 ${{ github.repository }} 中新开的 Issue。
+
+## 任务
+
+1. 阅读 Issue 的标题和正文
+2. 判断类型，添加合适的标签：
+ - `bug`：程序出错、功能异常
+ - `feature`：新功能请求
+ - `enhancement`：改进现有功能
+ - `documentation`：文档问题
+ - `question`：使用疑问
+ - `duplicate`：与已有 Issue 重复
+ - `invalid`：信息不完整或无效
+
+3. 根据用户的提问语言按照用户语言回复一条友好的评论，包含：
+ - 感谢用户提交 Issue
+ - 说明你打的标签和原因
+ - 如果是 bug，请用户补充：复现步骤、环境信息、错误日志
+ - 如果是 question，尝试根据仓库代码和文档给出初步解答
+ - 预计处理时间（普通问题 3 个工作日内）
\ No newline at end of file
From dcfb31c0f66413f737cd2ccd8cfb6916a4813233 Mon Sep 17 00:00:00 2001
From: qyt <486179@qq.com>
Date: Sat, 9 May 2026 14:46:41 +0800
Subject: [PATCH 11/21] update:depend library
---
XEngine_Source/XEngine_DependLibrary | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/XEngine_Source/XEngine_DependLibrary b/XEngine_Source/XEngine_DependLibrary
index fa19ea8..e388b23 160000
--- a/XEngine_Source/XEngine_DependLibrary
+++ b/XEngine_Source/XEngine_DependLibrary
@@ -1 +1 @@
-Subproject commit fa19ea8880dfa312221b5d17ece40c3bbc0f00cf
+Subproject commit e388b2353f5530dd9dfde647a0c7b9a6c3666163
From 9ec9edd2f4e8d54f04d2f4fda6b9ea171f6ea1b0 Mon Sep 17 00:00:00 2001
From: qyt <486179@qq.com>
Date: Sat, 9 May 2026 14:53:30 +0800
Subject: [PATCH 12/21] ci:add mint build and delete translator and codeql to
pr update:makefile
---
.github/workflows/Mintbuild.yml | 76 ++++++++++
.github/workflows/codeql-to-commit.yml | 194 +++++++++++++++++++++++++
.github/workflows/codeql.yml | 47 +++++-
.github/workflows/issue-translator.yml | 15 --
.github/workflows/release.yml | 27 ++--
XEngine_Source/Makefile | 18 ++-
6 files changed, 345 insertions(+), 32 deletions(-)
create mode 100644 .github/workflows/Mintbuild.yml
create mode 100644 .github/workflows/codeql-to-commit.yml
delete mode 100644 .github/workflows/issue-translator.yml
diff --git a/.github/workflows/Mintbuild.yml b/.github/workflows/Mintbuild.yml
new file mode 100644
index 0000000..38c8fc3
--- /dev/null
+++ b/.github/workflows/Mintbuild.yml
@@ -0,0 +1,76 @@
+name: MintLinux build workflows
+
+on:
+ push:
+ branches:
+ - 'develop'
+ paths:
+ - 'XEngine_Source/**'
+ - 'XEngine_Release/**'
+ - '.github/**'
+
+permissions:
+ contents: read
+
+jobs:
+ build:
+ runs-on: ${{ matrix.runner }}
+ container:
+ image: ${{ matrix.name }}
+ options: --platform ${{ matrix.platform }}
+ strategy:
+ matrix:
+ include:
+ - arch: amd64
+ runner: ubuntu-24.04
+ platform: linux/amd64
+ artifact: x86-64
+ name: linuxmintd/mint22-amd64
+ version: 22
+
+ steps:
+ - name: Checkout main repository code
+ uses: actions/checkout@v6
+
+ - name: Checkout dependency repository (xengine)
+ uses: actions/checkout@v6
+ with:
+ repository: libxengine/libxengine
+ path: libxengine
+
+ - name: sub module checkout (opensource)
+ uses: actions/checkout@v6
+ with:
+ repository: libxengine/XEngine_OPenSource
+ path: XEngine_Source/XEngine_DependLibrary
+
+ - name: install library
+ run: sudo apt install libsrt-gnutls-dev libsrtp2-dev -y
+
+ - name: Set TERM variable
+ run: echo "TERM=xterm" >> $GITHUB_ENV
+
+ - name: Set up Dependency ubuntu24.04 Environment
+ run: |
+ cd libxengine
+ chmod 777 *
+ sudo ./XEngine_LINEnv.sh -i 3
+
+ - name: make
+ run: |
+ cd XEngine_Source
+ make RELEASE=1
+ make FLAGS=InstallAll
+ make FLAGS=CleanAll
+ cd ..
+ - name: test
+ run: |
+ cd XEngine_Release
+ ./XEngine_StreamMediaApp -t
+
+ - name: Upload folder as artifact
+ uses: actions/upload-artifact@v7
+ with:
+ name: XEngine_StreamMediaApp-MintLinux_${{ matrix.version }}_x86-64
+ path: XEngine_Release/
+ retention-days: 1
\ No newline at end of file
diff --git a/.github/workflows/codeql-to-commit.yml b/.github/workflows/codeql-to-commit.yml
new file mode 100644
index 0000000..d297c94
--- /dev/null
+++ b/.github/workflows/codeql-to-commit.yml
@@ -0,0 +1,194 @@
+name: Auto Copilot Autofix (High & Medium Only)
+
+on:
+ workflow_dispatch:
+ workflow_run:
+ workflows: ["CodeQL Advanced"]
+ types: [completed]
+
+jobs:
+ auto-fix:
+ runs-on: ubuntu-latest
+ if: ${{ github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success' }}
+ permissions:
+ security-events: read
+ contents: write
+ pull-requests: write
+
+ steps:
+ - name: Trigger Autofix for High & Medium alerts
+ env:
+ GH_TOKEN: ${{ secrets.AUTOFIX_TOKEN }}
+ OWNER: ${{ github.repository_owner }}
+ REPO: ${{ github.event.repository.name }}
+ run: |
+ set +e
+ DEFAULT_BRANCH=$(gh api /repos/$OWNER/$REPO --jq '.default_branch')
+ echo "Default branch: $DEFAULT_BRANCH"
+
+ ALERTS=$(gh api "/repos/$OWNER/$REPO/code-scanning/alerts?state=open&per_page=100" \
+ --jq '[.[] | select(.rule.security_severity_level == "high" or .rule.security_severity_level == "medium" or .rule.severity == "warning") | {number: .number, level: (.rule.security_severity_level // .rule.severity)}]')
+
+ COUNT=$(echo $ALERTS | jq 'length')
+ echo "Found $COUNT alerts with high / medium / warning"
+ echo "$ALERTS" | jq -r '.[] | " Alert #\(.number) [\(.level)]"'
+
+ if [ "$COUNT" -eq 0 ]; then
+ echo "No alerts to process, exiting."
+ exit 0
+ fi
+
+ for ROW in $(echo $ALERTS | jq -r '.[] | @base64'); do
+ _jq() { echo "$ROW" | base64 -d | jq -r "$1"; }
+
+ NUMBER=$(_jq '.number')
+ SEC_LEVEL=$(_jq '.level')
+ BRANCH="autofix/${SEC_LEVEL}/alert-${NUMBER}"
+
+ echo "--- Alert #$NUMBER [$SEC_LEVEL] ---"
+
+ # 检查是否已有 autofix
+ EXISTING=$(gh api \
+ /repos/$OWNER/$REPO/code-scanning/alerts/$NUMBER/autofix \
+ --jq '.status' 2>/dev/null || echo "none")
+
+ if [ "$EXISTING" = "success" ]; then
+ echo "✅ Fix already exists"
+ else
+ echo "⏳ Generating fix..."
+ gh api -X POST \
+ /repos/$OWNER/$REPO/code-scanning/alerts/$NUMBER/autofix || {
+ echo "⚠️ Failed to trigger autofix for #$NUMBER, skipping"
+ continue
+ }
+
+ for i in 1 2 3; do
+ sleep 30
+ EXISTING=$(gh api \
+ /repos/$OWNER/$REPO/code-scanning/alerts/$NUMBER/autofix \
+ --jq '.status' 2>/dev/null || echo "none")
+ echo " Attempt $i: status = $EXISTING"
+ [ "$EXISTING" = "success" ] && break
+ done
+ fi
+
+ if [ "$EXISTING" != "success" ]; then
+ echo "⚠️ Autofix not available for alert #$NUMBER (status: $EXISTING), skipping"
+ continue
+ fi
+
+ # 检查分支是否已存在
+ BRANCH_STATUS=$(gh api \
+ /repos/$OWNER/$REPO/git/refs/heads/$BRANCH \
+ --silent 2>/dev/null && echo "exists" || echo "not_found")
+ echo "DEBUG branch status: $BRANCH_STATUS"
+
+ if [ "$BRANCH_STATUS" = "not_found" ]; then
+ # 创建分支
+ SHA=$(gh api /repos/$OWNER/$REPO/git/refs/heads/$DEFAULT_BRANCH \
+ --jq '.object.sha')
+
+ gh api -X POST /repos/$OWNER/$REPO/git/refs \
+ -f ref="refs/heads/$BRANCH" \
+ -f sha="$SHA" 2>/dev/null || true
+ echo "🌿 Created branch: $BRANCH"
+
+ # 提交 fix
+ COMMIT_RESULT=$(gh api -X POST \
+ /repos/$OWNER/$REPO/code-scanning/alerts/$NUMBER/autofix/commits \
+ -f target_ref="$BRANCH" 2>&1)
+ echo "DEBUG commit result: $COMMIT_RESULT"
+
+ if echo "$COMMIT_RESULT" | grep -q "target_ref"; then
+ echo "✅ Committed fix to branch: $BRANCH"
+ else
+ echo "⚠️ No code changes generated, deleting branch and skipping"
+ gh api -X DELETE \
+ /repos/$OWNER/$REPO/git/refs/heads/$BRANCH 2>/dev/null || true
+ continue
+ fi
+ else
+ # 分支已存在，检查是否已有 open PR
+ EXISTING_PR=$(gh pr list \
+ --repo "$OWNER/$REPO" \
+ --head "$BRANCH" \
+ --state open \
+ --json number \
+ --jq '.[0].number // empty')
+
+ if [ -n "$EXISTING_PR" ]; then
+ echo "⏭️ PR #$EXISTING_PR already exists, skipping"
+ continue
+ fi
+
+ echo "🌿 Branch exists, creating PR with existing branch"
+ fi
+
+ # 获取 alert 详情
+ ALERT_INFO=$(gh api \
+ /repos/$OWNER/$REPO/code-scanning/alerts/$NUMBER)
+
+ ALERT_TITLE=$(echo $ALERT_INFO | jq -r '.rule.description')
+ ALERT_HELP=$(echo $ALERT_INFO | jq -r '.rule.help // "暂无详细说明"' | head -c 800)
+ ALERT_TAGS=$(echo $ALERT_INFO | jq -r '.rule.tags // [] | join(", ")')
+ ALERT_FILE=$(echo $ALERT_INFO | jq -r '.most_recent_instance.location.path // "未知文件"')
+ ALERT_LINE=$(echo $ALERT_INFO | jq -r '.most_recent_instance.location.start_line // "未知行"')
+ ALERT_URL=$(echo $ALERT_INFO | jq -r '.html_url')
+ CWE_TAGS=$(echo $ALERT_INFO | jq -r '[.rule.tags[] | select(startswith("external/cwe/"))] | join(", ")')
+
+ AUTOFIX_DESC=$(gh api \
+ /repos/$OWNER/$REPO/code-scanning/alerts/$NUMBER/autofix \
+ --jq '.description // "暂无 AI 修复说明"')
+
+ # 创建 Draft PR
+ gh pr create \
+ --repo "$OWNER/$REPO" \
+ --base "$DEFAULT_BRANCH" \
+ --head "$BRANCH" \
+ --draft \
+ --title "[Autofix][$SEC_LEVEL] Alert #$NUMBER: $ALERT_TITLE" \
+ --body "## 🤖 Copilot Autofix 自动修复报告
+
+ ---
+
+ ### 📋 基本信息
+
+ | 字段 | 内容 |
+ |------|------|
+ | **Alert ID** | [#$NUMBER]($ALERT_URL) |
+ | **安全级别** | $SEC_LEVEL |
+ | **规则名称** | $ALERT_TITLE |
+ | **问题文件** | \`$ALERT_FILE\` 第 $ALERT_LINE 行 |
+ | **CWE 分类** | $CWE_TAGS |
+ | **规则标签** | $ALERT_TAGS |
+
+ ---
+
+ ### 🔍 问题说明
+
+ $ALERT_HELP
+
+ ---
+
+ ### 🤖 AI 修复思路
+
+ $AUTOFIX_DESC
+
+ ---
+
+ ### ✅ Review 检查清单
+
+ - [ ] 理解了漏洞的成因和影响范围
+ - [ ] 确认 AI 修复逻辑正确，没有遗漏边界情况
+ - [ ] 确认修复没有改变原有业务逻辑
+ - [ ] 确认没有引入新的安全问题
+ - [ ] CI / 单元测试全部通过
+ - [ ] 如有必要，已补充对应的测试用例
+
+ ---
+
+ > 此 PR 由 GitHub Copilot Autofix 自动生成，请仔细审核后再 merge。" && \
+ echo "🎉 PR created for alert #$NUMBER" || \
+ echo "❌ Failed to create PR for alert #$NUMBER"
+
+ done
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 88e161f..7105181 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -3,13 +3,14 @@ name: CodeQL Advanced
on:
push:
branches:
- - develop
+ - 'develop'
paths:
- 'XEngine_Source/**'
+ - 'XEngine_Release/**'
+ - '.github/**'
jobs:
analyze:
- name: Analyze C++
runs-on: ubuntu-24.04
permissions:
security-events: write
@@ -17,23 +18,57 @@ jobs:
actions: read
contents: read
+ strategy:
+ fail-fast: false
+ matrix:
+ include:
+ - language: c-cpp
+ build-mode: manual
+
steps:
- name: Checkout repository
uses: actions/checkout@v6
with:
ref: 'develop'
+ - name: Checkout dependency repository (xengine)
+ uses: actions/checkout@v6
+ with:
+ repository: libxengine/libxengine
+ path: libxengine
+
+ - name: sub module checkout (opensource)
+ run: |
+ git submodule init
+ git submodule update
+
- name: Set TERM variable
run: echo "TERM=xterm" >> $GITHUB_ENV
+ - name: Set up Dependency Environment
+ run: |
+ cd libxengine
+ chmod +x ./XEngine_LINEnv.sh
+ sudo ./XEngine_LINEnv.sh -i 3
+
+ - name: make pre
+ run: |
+ cd XEngine_Source
+ make BUILDTYPE=1
+
- name: Initialize CodeQL
uses: github/codeql-action/init@v4
with:
- languages: c-cpp
- build-mode: none
- queries: security-extended
+ languages: ${{ matrix.language }}
+ build-mode: manual
+ queries: security-and-quality
+
+ - name: make check
+ run: |
+ cd XEngine_Source
+ make BUILDTYPE=2
- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@v4
with:
- category: "/language:c-cpp"
+ category: "/language:${{ matrix.language }}"
\ No newline at end of file
diff --git a/.github/workflows/issue-translator.yml b/.github/workflows/issue-translator.yml
deleted file mode 100644
index d9fdac8..0000000
--- a/.github/workflows/issue-translator.yml
+++ /dev/null
@@ -1,15 +0,0 @@
-name: Issue Translator
-on:
- issue_comment:
- types: [created]
- issues:
- types: [opened]
-
-jobs:
- build:
- runs-on: ubuntu-latest
- steps:
- - uses: usthe/issues-translate-action@v2.7
- with:
- IS_MODIFY_TITLE: false
- CUSTOM_BOT_NOTE: Bot detected the issue body's language is not English, translate it automatically.
\ No newline at end of file
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index e53859b..b24c864 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -16,7 +16,7 @@ jobs:
fetch-depth: 0
- name: Download ubuntu build
- uses: dawidd6/action-download-artifact@v20
+ uses: dawidd6/action-download-artifact@v21
with:
workflow: ubuntu_build.yml
workflow_conclusion: success
@@ -24,8 +24,17 @@ jobs:
skip_unpack: true
if_no_artifact_found: fail
path: ./XRelease/
+ - name: Download Mint build
+ uses: dawidd6/action-download-artifact@v21
+ with:
+ workflow: Mintbuild.yml
+ workflow_conclusion: success
+ check_artifacts: false
+ skip_unpack: true
+ if_no_artifact_found: fail
+ path: ./XRelease/
- name: Download debian build
- uses: dawidd6/action-download-artifact@v20
+ uses: dawidd6/action-download-artifact@v21
with:
workflow: debian_build.yml
workflow_conclusion: success
@@ -34,7 +43,7 @@ jobs:
if_no_artifact_found: fail
path: ./XRelease/
- name: Download fedora build
- uses: dawidd6/action-download-artifact@v20
+ uses: dawidd6/action-download-artifact@v21
with:
workflow: fedora_build.yml
workflow_conclusion: success
@@ -43,7 +52,7 @@ jobs:
if_no_artifact_found: fail
path: ./XRelease/
- name: Download Rocky build
- uses: dawidd6/action-download-artifact@v20
+ uses: dawidd6/action-download-artifact@v21
with:
workflow: Rocky_build.yml
workflow_conclusion: success
@@ -52,7 +61,7 @@ jobs:
if_no_artifact_found: fail
path: ./XRelease/
- name: Download Alma build
- uses: dawidd6/action-download-artifact@v20
+ uses: dawidd6/action-download-artifact@v21
with:
workflow: Alma_build.yml
workflow_conclusion: success
@@ -61,7 +70,7 @@ jobs:
if_no_artifact_found: fail
path: ./XRelease/
- name: Download CentOS build
- uses: dawidd6/action-download-artifact@v20
+ uses: dawidd6/action-download-artifact@v21
with:
workflow: Centos_build.yml
workflow_conclusion: success
@@ -70,7 +79,7 @@ jobs:
if_no_artifact_found: fail
path: ./XRelease/
- name: Download macbuild
- uses: dawidd6/action-download-artifact@v20
+ uses: dawidd6/action-download-artifact@v21
with:
workflow: macbuild.yml
workflow_conclusion: success
@@ -79,7 +88,7 @@ jobs:
if_no_artifact_found: fail
path: ./XRelease/
- name: Download msbuild
- uses: dawidd6/action-download-artifact@v20
+ uses: dawidd6/action-download-artifact@v21
with:
workflow: msbuild.yml
workflow_conclusion: success
@@ -121,7 +130,7 @@ jobs:
echo "$release_notes" > release_notes.txt
- name: Release
- uses: softprops/action-gh-release@v2
+ uses: softprops/action-gh-release@v3
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
with:
diff --git a/XEngine_Source/Makefile b/XEngine_Source/Makefile
index 0a87d20..d89f90c 100644
--- a/XEngine_Source/Makefile
+++ b/XEngine_Source/Makefile
@@ -1,6 +1,7 @@
RELEASE = 0
UNICODE = 0
PLATFORM=linux
+BUILDTYPE=0
FLAGS=
#要编译的模块
THIRDPART_MODULE_JSONCPP = ./XEngine_DependLibrary/XEngine_Module/jsoncpp
@@ -21,10 +22,23 @@ else ifeq ($(PLATFORM),mac)
FILEEXT = dylib
endif
-XENGINE_MODULES = libjsoncpp.so libXEngine_InfoReport.so libXEngine_Verification.so \
- libXEngine_ModuleConfigure.so libXEngine_ModuleHelp.so libXEngine_ModuleProtocol.so libXEngine_ModuleSession.so libXEngine_ModuleQueue.so \
+
+# 第三方库模块
+MODULES_THIRD = libjsoncpp.so libXEngine_InfoReport.so libXEngine_Verification.so
+# 业务模块 + 应用
+MODULES_APP = libXEngine_ModuleConfigure.so libXEngine_ModuleHelp.so libXEngine_ModuleProtocol.so libXEngine_ModuleSession.so libXEngine_ModuleQueue.so \
XEngine_StreamMediaApp.exe
+
+# 根据 BUILDTYPE 决定编译目标
+ifeq ($(BUILDTYPE),0)
+ XENGINE_MODULES = $(MODULES_THIRD) $(MODULES_APP)
+else ifeq ($(BUILDTYPE),1)
+ XENGINE_MODULES = $(MODULES_THIRD)
+else ifeq ($(BUILDTYPE),2)
+ XENGINE_MODULES = $(MODULES_APP)
+endif
+
.PHONY:MakeAll
MakeAll:$(XENGINE_MODULES)
From 8eec9ee82640e242af26acd5f54770aa5c4cc8c4 Mon Sep 17 00:00:00 2001
From: qyt <486179@qq.com>
Date: Mon, 11 May 2026 14:55:36 +0800
Subject: [PATCH 13/21] ci:update
---
.github/workflows/codeql.yml | 3 +++
1 file changed, 3 insertions(+)
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 7105181..56c3adc 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -51,6 +51,9 @@ jobs:
chmod +x ./XEngine_LINEnv.sh
sudo ./XEngine_LINEnv.sh -i 3
+ - name: install library
+ run: sudo apt install libsrt-gnutls-dev libsrtp2-dev -y
+
- name: make pre
run: |
cd XEngine_Source
From 154f94db2b4f6f613b617fa9071aa2f7bb4d5ff4 Mon Sep 17 00:00:00 2001
From: qyt <486179@qq.com>
Date: Mon, 11 May 2026 07:09:07 +0000
Subject: [PATCH 14/21] Potential fix for code scanning alert no. 42
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
---
.../ModuleSession_PushStream.cpp | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
diff --git a/XEngine_Source/XEngine_ModuleSession/ModuleSession_PushStream/ModuleSession_PushStream.cpp b/XEngine_Source/XEngine_ModuleSession/ModuleSession_PushStream/ModuleSession_PushStream.cpp
index 4444446..43e67d6 100644
--- a/XEngine_Source/XEngine_ModuleSession/ModuleSession_PushStream/ModuleSession_PushStream.cpp
+++ b/XEngine_Source/XEngine_ModuleSession/ModuleSession_PushStream/ModuleSession_PushStream.cpp
@@ -555,9 +555,18 @@ bool CModuleSession_PushStream::ModuleSession_PushStream_HLSInsert(LPCXSTR lpszC
_tcsxcpy(stl_MapIterator->second->st_HLSFile.tszFileName, lpszTSFile);
stl_MapIterator->second->st_HLSFile.xhToken = xhToken;
- stl_MapIterator->second->st_HLSFile.pSt_File = _xtfopen(lpszTSFile, _X("wb"));
+ int nFileHandle = _open(lpszTSFile, _O_WRONLY | _O_CREAT | _O_TRUNC, _S_IREAD | _S_IWRITE);
+ if (nFileHandle < 0)
+ {
+ Session_IsErrorOccur = true;
+ Session_dwErrorCode = ERROR_STREAMMEDIA_MODULE_SESSION_FILE;
+ st_Locker.unlock_shared();
+ return false;
+ }
+ stl_MapIterator->second->st_HLSFile.pSt_File = _fdopen(nFileHandle, "wb");
if (NULL == stl_MapIterator->second->st_HLSFile.pSt_File)
{
+ _close(nFileHandle);
Session_IsErrorOccur = true;
Session_dwErrorCode = ERROR_STREAMMEDIA_MODULE_SESSION_FILE;
st_Locker.unlock_shared();
From 0211af94de504a20e14735b75316f223fda75db5 Mon Sep 17 00:00:00 2001
From: qyt <486179@qq.com>
Date: Mon, 11 May 2026 07:09:43 +0000
Subject: [PATCH 15/21] Potential fix for code scanning alert no. 41
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
---
.../ModuleConfigure_Json/ModuleConfigure_Json.cpp | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/XEngine_Source/XEngine_ModuleConfigure/ModuleConfigure_Json/ModuleConfigure_Json.cpp b/XEngine_Source/XEngine_ModuleConfigure/ModuleConfigure_Json/ModuleConfigure_Json.cpp
index 51bc466..8933600 100644
--- a/XEngine_Source/XEngine_ModuleConfigure/ModuleConfigure_Json/ModuleConfigure_Json.cpp
+++ b/XEngine_Source/XEngine_ModuleConfigure/ModuleConfigure_Json/ModuleConfigure_Json.cpp
@@ -261,7 +261,7 @@ bool CModuleConfigure_Json::ModuleConfigure_Json_Versions(LPCXSTR lpszConfigFile
return false;
}
Json::Value st_JsonXVer = st_JsonRoot["XVer"];
- pSt_ServerConfig->st_XVer.pStl_ListVer = new list;
+ pSt_ServerConfig->st_XVer.pStl_ListVer = new (std::nothrow) list;
if (NULL == pSt_ServerConfig->st_XVer.pStl_ListVer)
{
Config_IsErrorOccur = true;
From ad004856805c55bc7326635852463988953d2551 Mon Sep 17 00:00:00 2001
From: qyt <486179@qq.com>
Date: Mon, 11 May 2026 07:10:18 +0000
Subject: [PATCH 16/21] Potential fix for code scanning alert no. 40
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
---
.../ModuleSession_PushStream/ModuleSession_PushStream.cpp | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/XEngine_Source/XEngine_ModuleSession/ModuleSession_PushStream/ModuleSession_PushStream.cpp b/XEngine_Source/XEngine_ModuleSession/ModuleSession_PushStream/ModuleSession_PushStream.cpp
index 4444446..1d9ae88 100644
--- a/XEngine_Source/XEngine_ModuleSession/ModuleSession_PushStream/ModuleSession_PushStream.cpp
+++ b/XEngine_Source/XEngine_ModuleSession/ModuleSession_PushStream/ModuleSession_PushStream.cpp
@@ -1,5 +1,6 @@
#include "pch.h"
#include "ModuleSession_PushStream.h"
+#include
/********************************************************************
// Created: 2023/06/04 20:19:13
// File Name: D:\XEngine_StreamMedia\XEngine_Source\XEngine_ModuleSession\ModuleSession_PushStream\ModuleSession_PushStream.cpp
@@ -54,7 +55,7 @@ bool CModuleSession_PushStream::ModuleSession_PushStream_Create(LPCXSTR lpszClie
return false;
}
//申请内存
- PUSHSTREAM_PACKET* pSt_Packet = new PUSHSTREAM_PACKET;
+ PUSHSTREAM_PACKET* pSt_Packet = new(std::nothrow) PUSHSTREAM_PACKET;
if (NULL == pSt_Packet)
{
Session_IsErrorOccur = true;
From 9480cbd0a776dd087dd7dd83bae6e600f0ba506b Mon Sep 17 00:00:00 2001
From: qyt <486179@qq.com>
Date: Mon, 11 May 2026 07:10:54 +0000
Subject: [PATCH 17/21] Potential fix for code scanning alert no. 39
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
---
.../ModuleSession_PullStream/ModuleSession_PullStream.cpp | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/XEngine_Source/XEngine_ModuleSession/ModuleSession_PullStream/ModuleSession_PullStream.cpp b/XEngine_Source/XEngine_ModuleSession/ModuleSession_PullStream/ModuleSession_PullStream.cpp
index e64773b..a621c74 100644
--- a/XEngine_Source/XEngine_ModuleSession/ModuleSession_PullStream/ModuleSession_PullStream.cpp
+++ b/XEngine_Source/XEngine_ModuleSession/ModuleSession_PullStream/ModuleSession_PullStream.cpp
@@ -1,5 +1,6 @@
#include "pch.h"
#include "ModuleSession_PullStream.h"
+#include
/********************************************************************
// Created: 2023/06/05 16:11:53
// File Name: D:\XEngine_StreamMedia\XEngine_Source\XEngine_ModuleSession\ModuleSession_PullStream\ModuleSession_PullStream.cpp
@@ -52,7 +53,7 @@ bool CModuleSession_PullStream::ModuleSession_PullStream_Insert(LPCXSTR lpszClie
{
Session_IsErrorOccur = false;
- STREAMMEDIA_PULLLISTINFO* pSt_PullStream = new STREAMMEDIA_PULLLISTINFO;
+ STREAMMEDIA_PULLLISTINFO* pSt_PullStream = new(std::nothrow) STREAMMEDIA_PULLLISTINFO;
if (NULL == pSt_PullStream)
{
Session_IsErrorOccur = true;
From 53563aa642780c2f795c77f3d2515e1c7cabec20 Mon Sep 17 00:00:00 2001
From: qyt <486179@qq.com>
Date: Tue, 2 Jun 2026 15:23:39 +0800
Subject: [PATCH 18/21] update:depend library
---
XEngine_Source/XEngine_DependLibrary | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/XEngine_Source/XEngine_DependLibrary b/XEngine_Source/XEngine_DependLibrary
index e388b23..4d407e7 160000
--- a/XEngine_Source/XEngine_DependLibrary
+++ b/XEngine_Source/XEngine_DependLibrary
@@ -1 +1 @@
-Subproject commit e388b2353f5530dd9dfde647a0c7b9a6c3666163
+Subproject commit 4d407e745805633dc8c08672e275e864499c556c
From 803e02078c3489342f8ff6861e48b1f6cf3f7f79 Mon Sep 17 00:00:00 2001
From: qyt <486179@qq.com>
Date: Tue, 2 Jun 2026 15:23:58 +0800
Subject: [PATCH 19/21] update:vs to 2026 version
---
.../XEngine_ModuleConfigure.vcxproj | 12 ++++++------
.../XEngine_ModuleHelp/XEngine_ModuleHelp.vcxproj | 12 ++++++------
.../XEngine_ModuleProtocol.vcxproj | 12 ++++++------
.../XEngine_ModuleQueue/XEngine_ModuleQueue.vcxproj | 12 ++++++------
.../XEngine_ModuleSession.vcxproj | 12 ++++++------
.../XEngine_StreamMediaApp.vcxproj | 12 ++++++------
6 files changed, 36 insertions(+), 36 deletions(-)
diff --git a/XEngine_Source/XEngine_ModuleConfigure/XEngine_ModuleConfigure.vcxproj b/XEngine_Source/XEngine_ModuleConfigure/XEngine_ModuleConfigure.vcxproj
index 273138f..d06d108 100644
--- a/XEngine_Source/XEngine_ModuleConfigure/XEngine_ModuleConfigure.vcxproj
+++ b/XEngine_Source/XEngine_ModuleConfigure/XEngine_ModuleConfigure.vcxproj
@@ -37,39 +37,39 @@
DynamicLibrary
true
- v143
+ v145
Unicode
DynamicLibrary
false
- v143
+ v145
true
Unicode
DynamicLibrary
true
- v143
+ v145
Unicode
DynamicLibrary
true
- v143
+ v145
Unicode
DynamicLibrary
false
- v143
+ v145
true
Unicode
DynamicLibrary
false
- v143
+ v145
true
Unicode
diff --git a/XEngine_Source/XEngine_ModuleHelp/XEngine_ModuleHelp.vcxproj b/XEngine_Source/XEngine_ModuleHelp/XEngine_ModuleHelp.vcxproj
index 9e78bb0..6ed64c2 100644
--- a/XEngine_Source/XEngine_ModuleHelp/XEngine_ModuleHelp.vcxproj
+++ b/XEngine_Source/XEngine_ModuleHelp/XEngine_ModuleHelp.vcxproj
@@ -37,39 +37,39 @@
DynamicLibrary
true
- v143
+ v145
Unicode
DynamicLibrary
false
- v143
+ v145
true
Unicode
DynamicLibrary
true
- v143
+ v145
Unicode
DynamicLibrary
true
- v143
+ v145
Unicode
DynamicLibrary
false
- v143
+ v145
true
Unicode
DynamicLibrary
false
- v143
+ v145
true
Unicode
diff --git a/XEngine_Source/XEngine_ModuleProtocol/XEngine_ModuleProtocol.vcxproj b/XEngine_Source/XEngine_ModuleProtocol/XEngine_ModuleProtocol.vcxproj
index f1d8e2f..2596a77 100644
--- a/XEngine_Source/XEngine_ModuleProtocol/XEngine_ModuleProtocol.vcxproj
+++ b/XEngine_Source/XEngine_ModuleProtocol/XEngine_ModuleProtocol.vcxproj
@@ -37,39 +37,39 @@
DynamicLibrary
true
- v143
+ v145
Unicode
DynamicLibrary
false
- v143
+ v145
true
Unicode
DynamicLibrary
true
- v143
+ v145
Unicode
DynamicLibrary
true
- v143
+ v145
Unicode
DynamicLibrary
false
- v143
+ v145
true
Unicode
DynamicLibrary
false
- v143
+ v145
true
Unicode
diff --git a/XEngine_Source/XEngine_ModuleQueue/XEngine_ModuleQueue.vcxproj b/XEngine_Source/XEngine_ModuleQueue/XEngine_ModuleQueue.vcxproj
index ac67acc..bafb0a5 100644
--- a/XEngine_Source/XEngine_ModuleQueue/XEngine_ModuleQueue.vcxproj
+++ b/XEngine_Source/XEngine_ModuleQueue/XEngine_ModuleQueue.vcxproj
@@ -37,39 +37,39 @@
DynamicLibrary
true
- v143
+ v145
Unicode
DynamicLibrary
false
- v143
+ v145
true
Unicode
DynamicLibrary
true
- v143
+ v145
Unicode
DynamicLibrary
true
- v143
+ v145
Unicode
DynamicLibrary
false
- v143
+ v145
true
Unicode
DynamicLibrary
false
- v143
+ v145
true
Unicode
diff --git a/XEngine_Source/XEngine_ModuleSession/XEngine_ModuleSession.vcxproj b/XEngine_Source/XEngine_ModuleSession/XEngine_ModuleSession.vcxproj
index 413b10e..f281552 100644
--- a/XEngine_Source/XEngine_ModuleSession/XEngine_ModuleSession.vcxproj
+++ b/XEngine_Source/XEngine_ModuleSession/XEngine_ModuleSession.vcxproj
@@ -37,39 +37,39 @@
DynamicLibrary
true
- v143
+ v145
Unicode
DynamicLibrary
false
- v143
+ v145
true
Unicode
DynamicLibrary
true
- v143
+ v145
Unicode
DynamicLibrary
true
- v143
+ v145
Unicode
DynamicLibrary
false
- v143
+ v145
true
Unicode
DynamicLibrary
false
- v143
+ v145
true
Unicode
diff --git a/XEngine_Source/XEngine_ServiceApp/XEngine_StreamMediaApp/XEngine_StreamMediaApp.vcxproj b/XEngine_Source/XEngine_ServiceApp/XEngine_StreamMediaApp/XEngine_StreamMediaApp.vcxproj
index fe87fb3..b8be179 100644
--- a/XEngine_Source/XEngine_ServiceApp/XEngine_StreamMediaApp/XEngine_StreamMediaApp.vcxproj
+++ b/XEngine_Source/XEngine_ServiceApp/XEngine_StreamMediaApp/XEngine_StreamMediaApp.vcxproj
@@ -37,39 +37,39 @@
Application
true
- v143
+ v145
Unicode
Application
false
- v143
+ v145
true
Unicode
Application
true
- v143
+ v145
Unicode
Application
true
- v143
+ v145
Unicode
Application
false
- v143
+ v145
true
Unicode
Application
false
- v143
+ v145
true
Unicode
From a41fdc0d18d70bc95e07620e5bc08916e9160c46 Mon Sep 17 00:00:00 2001
From: qyt <486179@qq.com>
Date: Tue, 2 Jun 2026 16:15:47 +0800
Subject: [PATCH 20/21] modify:security code
---
.github/workflows/msbuild.yml | 2 +-
.../ModuleSession_PullStream.cpp | 1 -
.../ModuleSession_PushStream.cpp | 13 +------------
XEngine_Source/XEngine_ModuleSession/pch.h | 1 +
4 files changed, 3 insertions(+), 14 deletions(-)
diff --git a/.github/workflows/msbuild.yml b/.github/workflows/msbuild.yml
index 4b34e48..e1eba8c 100644
--- a/.github/workflows/msbuild.yml
+++ b/.github/workflows/msbuild.yml
@@ -20,7 +20,7 @@ jobs:
configuration: [Debug ,Release]
platform: [x86 ,x64 ,ARM64]
- runs-on: windows-latest
+ runs-on: windows-2025-vs2026
steps:
- name: Checkout main repository code
diff --git a/XEngine_Source/XEngine_ModuleSession/ModuleSession_PullStream/ModuleSession_PullStream.cpp b/XEngine_Source/XEngine_ModuleSession/ModuleSession_PullStream/ModuleSession_PullStream.cpp
index a621c74..51fa8b4 100644
--- a/XEngine_Source/XEngine_ModuleSession/ModuleSession_PullStream/ModuleSession_PullStream.cpp
+++ b/XEngine_Source/XEngine_ModuleSession/ModuleSession_PullStream/ModuleSession_PullStream.cpp
@@ -1,6 +1,5 @@
#include "pch.h"
#include "ModuleSession_PullStream.h"
-#include
/********************************************************************
// Created: 2023/06/05 16:11:53
// File Name: D:\XEngine_StreamMedia\XEngine_Source\XEngine_ModuleSession\ModuleSession_PullStream\ModuleSession_PullStream.cpp
diff --git a/XEngine_Source/XEngine_ModuleSession/ModuleSession_PushStream/ModuleSession_PushStream.cpp b/XEngine_Source/XEngine_ModuleSession/ModuleSession_PushStream/ModuleSession_PushStream.cpp
index 54883fe..861cad8 100644
--- a/XEngine_Source/XEngine_ModuleSession/ModuleSession_PushStream/ModuleSession_PushStream.cpp
+++ b/XEngine_Source/XEngine_ModuleSession/ModuleSession_PushStream/ModuleSession_PushStream.cpp
@@ -1,6 +1,5 @@
#include "pch.h"
#include "ModuleSession_PushStream.h"
-#include
/********************************************************************
// Created: 2023/06/04 20:19:13
// File Name: D:\XEngine_StreamMedia\XEngine_Source\XEngine_ModuleSession\ModuleSession_PushStream\ModuleSession_PushStream.cpp
@@ -556,18 +555,9 @@ bool CModuleSession_PushStream::ModuleSession_PushStream_HLSInsert(LPCXSTR lpszC
_tcsxcpy(stl_MapIterator->second->st_HLSFile.tszFileName, lpszTSFile);
stl_MapIterator->second->st_HLSFile.xhToken = xhToken;
- int nFileHandle = _open(lpszTSFile, _O_WRONLY | _O_CREAT | _O_TRUNC, _S_IREAD | _S_IWRITE);
- if (nFileHandle < 0)
- {
- Session_IsErrorOccur = true;
- Session_dwErrorCode = ERROR_STREAMMEDIA_MODULE_SESSION_FILE;
- st_Locker.unlock_shared();
- return false;
- }
- stl_MapIterator->second->st_HLSFile.pSt_File = _fdopen(nFileHandle, "wb");
+ stl_MapIterator->second->st_HLSFile.pSt_File = _xtfopen(lpszTSFile, _X("wb"));
if (NULL == stl_MapIterator->second->st_HLSFile.pSt_File)
{
- _close(nFileHandle);
Session_IsErrorOccur = true;
Session_dwErrorCode = ERROR_STREAMMEDIA_MODULE_SESSION_FILE;
st_Locker.unlock_shared();
@@ -1126,7 +1116,6 @@ bool CModuleSession_PushStream::ModuleSession_PushStream_RTCIndexSet(LPCXSTR lps
Session_dwErrorCode = ERROR_STREAMMEDIA_MODULE_SESSION_PARAMENT;
return false;
}
- bool bFound = false;
//是否存在
st_Locker.lock_shared();
unordered_map::iterator stl_MapIterator = stl_MapPushStream.find(lpszClientUser);
diff --git a/XEngine_Source/XEngine_ModuleSession/pch.h b/XEngine_Source/XEngine_ModuleSession/pch.h
index 600b7b0..2944f56 100644
--- a/XEngine_Source/XEngine_ModuleSession/pch.h
+++ b/XEngine_Source/XEngine_ModuleSession/pch.h
@@ -21,6 +21,7 @@
#include
#include
#include
+#include
#include
#include
using namespace std;
From a7c7b5319387683a6ba93727edc59896452cb9a3 Mon Sep 17 00:00:00 2001
From: qyt <486179@qq.com>
Date: Wed, 3 Jun 2026 10:20:26 +0800
Subject: [PATCH 21/21] update:configure file
---
CHANGELOG | 18 ++++++++++++++++++
.../XEngine_Config/XEngine_Version.json | 1 +
2 files changed, 19 insertions(+)
diff --git a/CHANGELOG b/CHANGELOG
index 80a2d96..e3463a9 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,3 +1,21 @@
+XEngine_StreamMedia V2.14.0.1001
+
+ci:增加AI代理工作流
+ci:增加mint编译
+ci:删除了多余的翻译和检查
+更新:升级vs编译器版本
+更新:依赖库
+修改:某些安全检查代码
+修改:http api不区分名称大小写
+
+ci:add agentic workflows for issue triage and auto fix
+ci:add mint build and delete translator and codeql to pr
+ci:delete cppcheck.yml and update codeql.yml
+update:vs to 2026 version
+update:depend library
+modify:security code
+modify:does not case-sensitive for HTTP API function names
+=======================================================
XEngine_StreamMedia V2.13.0.1001
ci:增加了centos alma系统支持
diff --git a/XEngine_Release/XEngine_Config/XEngine_Version.json b/XEngine_Release/XEngine_Config/XEngine_Version.json
index d8dec01..79764b9 100644
--- a/XEngine_Release/XEngine_Config/XEngine_Version.json
+++ b/XEngine_Release/XEngine_Config/XEngine_Version.json
@@ -1,5 +1,6 @@
{
"XVer": [
+ "V2.13.0.1001 Build20250603",
"V2.13.0.1001 Build20251107",
"V2.12.0.1001 Build20250815",
"V2.11.1.1001 Build20250409",