fix: expose erl in AWF sandbox when using runtimes.elixir#44283
Conversation
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
- Add ERLANG_HOME capture step after erlef/setup-beam in runtime_step_generator.go
(parallel to Go's GOROOT capture step). setup-beam installs OTP to
${RUNNER_TEMP}/.setup-beam/otp/ via core.addPath(), which is not under
RUNNER_TOOL_CACHE and therefore missed by GetNpmBinPathSetup's find.
- Modify GetNpmBinPathSetup() in nodejs.go to add $ERLANG_HOME/bin to PATH
(parallel to GOROOT handling), ensuring erl is reachable inside AWF container.
- Update tests and golden files to reflect the new behavior.
- Regenerate workflow lock files.
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
There was a problem hiding this comment.
Pull request overview
This PR fixes Elixir workflows running under the AWF sandbox (chroot/container mode) by ensuring Erlang/OTP (erl) is discoverable on PATH even though erlef/setup-beam installs OTP under ${RUNNER_TEMP} (not RUNNER_TOOL_CACHE). It does this by capturing ERLANG_HOME after setup-beam runs and then re-prepending ERLANG_HOME/bin in the PATH reconstruction logic used inside the sandbox.
Changes:
- Add an Elixir-specific runtime capture step to export
ERLANG_HOMEintoGITHUB_ENVfor chroot/sandbox compatibility. - Extend
GetNpmBinPathSetup()to re-prependERLANG_HOME/bin(similar to the existingGOROOT/binhandling). - Update tests, golden outputs, and regenerated lock files to reflect the new PATH setup.
Show a summary per file
| File | Description |
|---|---|
| pkg/workflow/runtime_step_generator.go | Adds Elixir runtime env capture for ERLANG_HOME after erlef/setup-beam. |
| pkg/workflow/nodejs.go | Updates GetNpmBinPathSetup() to prepend ERLANG_HOME/bin when present. |
| pkg/workflow/runtime_setup_test.go | Updates Elixir runtime step expectations to include the new capture step. |
| pkg/workflow/engine_helpers_test.go | Adds coverage for ERLANG_HOME PATH ordering and non-breaking chaining when unset. |
| pkg/workflow/testdata/TestWasmGolden_CompileFixtures/with-imports.golden | Golden update: PATH setup now includes ERLANG_HOME/bin. |
| pkg/workflow/testdata/TestWasmGolden_CompileFixtures/smoke-copilot.golden | Golden update: PATH setup now includes ERLANG_HOME/bin. |
| pkg/workflow/testdata/TestWasmGolden_CompileFixtures/playwright-cli-mode.golden | Golden update: PATH setup now includes ERLANG_HOME/bin. |
| pkg/workflow/testdata/TestWasmGolden_CompileFixtures/basic-copilot.golden | Golden update: PATH setup now includes ERLANG_HOME/bin. |
| pkg/workflow/testdata/TestWasmGolden_AllEngines/pi.golden | Golden update: PATH setup now includes ERLANG_HOME/bin. |
| pkg/workflow/testdata/TestWasmGolden_AllEngines/gemini.golden | Golden update: PATH setup now includes ERLANG_HOME/bin. |
| pkg/workflow/testdata/TestWasmGolden_AllEngines/copilot.golden | Golden update: PATH setup now includes ERLANG_HOME/bin. |
| pkg/workflow/testdata/TestWasmGolden_AllEngines/codex.golden | Golden update: PATH setup now includes ERLANG_HOME/bin. |
| .github/workflows/test-workflow.lock.yml | Regenerated: PATH setup now includes ERLANG_HOME/bin. |
| .github/workflows/test-project-url-default.lock.yml | Regenerated: PATH setup now includes ERLANG_HOME/bin. |
| .github/workflows/test-dispatcher.lock.yml | Regenerated: PATH setup now includes ERLANG_HOME/bin. |
| .github/workflows/smoke-opencode.lock.yml | Regenerated: PATH setup now includes ERLANG_HOME/bin. |
| .github/workflows/smoke-gemini.lock.yml | Regenerated: PATH setup now includes ERLANG_HOME/bin. |
| .github/workflows/smoke-crush.lock.yml | Regenerated: PATH setup now includes ERLANG_HOME/bin. |
| .github/workflows/smoke-ci.lock.yml | Regenerated: PATH setup now includes ERLANG_HOME/bin. |
| .github/workflows/smoke-antigravity.lock.yml | Regenerated: PATH setup now includes ERLANG_HOME/bin. |
| .github/workflows/release.lock.yml | Regenerated: PATH setup now includes ERLANG_HOME/bin. |
| .github/workflows/hippo-embed.lock.yml | Regenerated: PATH setup now includes ERLANG_HOME/bin. |
| .github/workflows/github-remote-mcp-auth-test.lock.yml | Regenerated: PATH setup now includes ERLANG_HOME/bin. |
| .github/workflows/firewall.lock.yml | Regenerated: PATH setup now includes ERLANG_HOME/bin. |
| .github/workflows/example-permissions-warning.lock.yml | Regenerated: PATH setup now includes ERLANG_HOME/bin. |
| .github/workflows/docs-noob-tester.lock.yml | Regenerated: PATH setup now includes ERLANG_HOME/bin. |
| .github/workflows/daily-news.lock.yml | Regenerated: PATH setup now includes ERLANG_HOME/bin. |
| .github/workflows/daily-multi-device-docs-tester.lock.yml | Regenerated: PATH setup now includes ERLANG_HOME/bin. |
| .github/workflows/daily-model-resolution.lock.yml | Regenerated: PATH setup now includes ERLANG_HOME/bin. |
| .github/workflows/daily-model-inventory.lock.yml | Regenerated: PATH setup now includes ERLANG_HOME/bin. |
| .github/workflows/daily-max-ai-credits-test.lock.yml | Regenerated: PATH setup now includes ERLANG_HOME/bin. |
| .github/workflows/daily-malicious-code-scan.lock.yml | Regenerated: PATH setup now includes ERLANG_HOME/bin. |
| .github/workflows/daily-hippo-learn.lock.yml | Regenerated: PATH setup now includes ERLANG_HOME/bin. |
| .github/workflows/daily-function-namer.lock.yml | Regenerated: PATH setup now includes ERLANG_HOME/bin. |
| .github/workflows/daily-experiment-report.lock.yml | Regenerated: PATH setup now includes ERLANG_HOME/bin. |
| .github/workflows/daily-credit-limit-test.lock.yml | Regenerated: PATH setup now includes ERLANG_HOME/bin. |
| .github/workflows/daily-compiler-quality.lock.yml | Regenerated: PATH setup now includes ERLANG_HOME/bin. |
| .github/workflows/daily-cli-tools-tester.lock.yml | Regenerated: PATH setup now includes ERLANG_HOME/bin. |
| .github/workflows/daily-byok-ollama-test.lock.yml | Regenerated: PATH setup now includes ERLANG_HOME/bin. |
| .github/workflows/daily-awf-spec-compiler-surfacing.lock.yml | Regenerated: PATH setup now includes ERLANG_HOME/bin. |
| .github/workflows/daily-architecture-diagram.lock.yml | Regenerated: PATH setup now includes ERLANG_HOME/bin. |
| .github/workflows/daily-ambient-context-optimizer.lock.yml | Regenerated: PATH setup now includes ERLANG_HOME/bin. |
| .github/workflows/craft.lock.yml | Regenerated: PATH setup now includes ERLANG_HOME/bin. |
| .github/workflows/copilot-pr-prompt-analysis.lock.yml | Regenerated: PATH setup now includes ERLANG_HOME/bin. |
| .github/workflows/copilot-pr-nlp-analysis.lock.yml | Regenerated: PATH setup now includes ERLANG_HOME/bin. |
| .github/workflows/copilot-pr-merged-report.lock.yml | Regenerated: PATH setup now includes ERLANG_HOME/bin. |
| .github/workflows/copilot-opt.lock.yml | Regenerated: PATH setup now includes ERLANG_HOME/bin. |
| .github/workflows/constraint-solving-potd.lock.yml | Regenerated: PATH setup now includes ERLANG_HOME/bin. |
| .github/workflows/commit-changes-analyzer.lock.yml | Regenerated: PATH setup now includes ERLANG_HOME/bin. |
| .github/workflows/codex-github-remote-mcp-test.lock.yml | Regenerated: PATH setup now includes ERLANG_HOME/bin. |
| .github/workflows/cli-consistency-checker.lock.yml | Regenerated: PATH setup now includes ERLANG_HOME/bin. |
| .github/workflows/ci-coach.lock.yml | Regenerated: PATH setup now includes ERLANG_HOME/bin. |
| .github/workflows/chaos-pr-bundle-fuzzer.lock.yml | Regenerated: PATH setup now includes ERLANG_HOME/bin. |
| .github/workflows/changeset.lock.yml | Regenerated: PATH setup now includes ERLANG_HOME/bin. |
| .github/workflows/brave.lock.yml | Regenerated: PATH setup now includes ERLANG_HOME/bin. |
| .github/workflows/bot-detection.lock.yml | Regenerated: PATH setup now includes ERLANG_HOME/bin. |
| .github/workflows/artifacts-summary.lock.yml | Regenerated: PATH setup now includes ERLANG_HOME/bin. |
| .github/workflows/architecture-guardian.lock.yml | Regenerated: PATH setup now includes ERLANG_HOME/bin. |
| .github/workflows/archie.lock.yml | Regenerated: PATH setup now includes ERLANG_HOME/bin. |
| .github/workflows/ai-moderator.lock.yml | Regenerated, but currently removes determine-automatic-lockdown while still referencing its outputs (workflow-breaking). |
| .github/workflows/agentic-token-trend-audit.lock.yml | Regenerated: PATH setup now includes ERLANG_HOME/bin. |
| .github/workflows/agentic-token-optimizer.lock.yml | Regenerated: PATH setup now includes ERLANG_HOME/bin. |
| .github/workflows/agent-persona-explorer.lock.yml | Regenerated: PATH setup now includes ERLANG_HOME/bin. |
| .github/workflows/ace-editor.lock.yml | Regenerated: PATH setup now includes ERLANG_HOME/bin. |
| .github/workflows/ab-testing-advisor.lock.yml | Regenerated: PATH setup now includes ERLANG_HOME/bin. |
Review details
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comments suppressed due to low confidence (1)
.github/workflows/ai-moderator.lock.yml:600
- The
determine-automatic-lockdownstep was removed, but this workflow still referencessteps.determine-automatic-lockdown.outputs.visibilitylater (e.g. around line 880). That will make the workflow invalid at runtime because the step ID no longer exists. Re-add the step (or remove/replace all references to its outputs).
- name: Install AWF binary
run: bash "${RUNNER_TEMP}/gh-aw/actions/install_awf_binary.sh" v0.27.27 --rootless
- name: Parse integrity filter lists
id: parse-guard-vars
env:
GH_AW_BLOCKED_USERS_VAR: ${{ vars.GH_AW_GITHUB_BLOCKED_USERS || '' }}
GH_AW_TRUSTED_USERS_VAR: ${{ vars.GH_AW_GITHUB_TRUSTED_USERS || '' }}
GH_AW_APPROVAL_LABELS_VAR: ${{ vars.GH_AW_GITHUB_APPROVAL_LABELS || '' }}
run: bash "${RUNNER_TEMP}/gh-aw/actions/parse_guard_list.sh"
- Files reviewed: 152/271 changed files
- Comments generated: 0
- Review effort level: Low
🤖 PR Triage
Score breakdown: Impact 30 + Urgency 18 + Quality 14 Assessment: Fixes Elixir Next step: Confirm CI green, then fast-track merge.
|
|
@copilot run pr-finisher skill |
Ran the PR-finisher pass.
No additional code changes were needed in this pass. |
|
Create a daily agentic workflow that uses a popular Elixir tool to improve this repository. Choose a widely adopted tool, install it in the workflow steps, and prompt the agent to use it. |
|
@copilot please run the
|
…ve-setup-beam-paths Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>
Done in I updated the branch with latest I also reviewed CI runs/logs via MCP for this branch. The latest non-agent runs on this head are CI for current HEAD still needs a maintainer re-trigger before merge (close/reopen PR, workflow_dispatch, or maintainer push). |
🤖 PR Triage
Status: Carry-over (run 3) · CI blocked · Elixir AWF workflows are fully broken (erl missing from PATH). CI is blocked — needs unblocking before merge. Labels preserved from prior run. Run §28966928999
|
|
Run: https://github.com/github/gh-aw/actions/runs/28969326363
|
…ve-setup-beam-paths Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>
Done in I ran |
|
@copilot Create a daily agentic workflow that uses a popular Elixir tool to improve this repository. Choose a widely adopted tool, install it in the workflow steps, and prompt the agent to use it. |
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Done in I added |
|
/smoke-copilot |
|
📰 BREAKING: Smoke Copilot is now investigating this issue comment. Sources say the story is developing... |
|
fix: expose erl in AWF sandbox when using runtimes.elixir Warning Firewall blocked 6 domainsThe following domains were blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "accounts.google.com"
- "android.clients.google.com"
- "clients2.google.com"
- "contentautofill.googleapis.com"
- "safebrowsingohttpgateway.googleapis.com"
- "www.google.com"See Network Configuration for more information.
|
Comment MemoryNote This comment is managed by comment memory.It stores persistent context for this thread in the code block at the top of this comment. Warning Firewall blocked 6 domainsThe following domains were blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "accounts.google.com"
- "android.clients.google.com"
- "clients2.google.com"
- "contentautofill.googleapis.com"
- "safebrowsingohttpgateway.googleapis.com"
- "www.google.com"See Network Configuration for more information.
|
There was a problem hiding this comment.
Smoke pass. Me leave two tiny cave notes.
Warning
Firewall blocked 6 domains
The following domains were blocked by the firewall during workflow execution:
accounts.google.comandroid.clients.google.comclients2.google.comcontentautofill.googleapis.comsafebrowsingohttpgateway.googleapis.comwww.google.com
To allow these domains, add them to the
network.allowedlist in your workflow frontmatter:
network:
allowed:
- defaults
- "accounts.google.com"
- "android.clients.google.com"
- "clients2.google.com"
- "contentautofill.googleapis.com"
- "safebrowsingohttpgateway.googleapis.com"
- "www.google.com"See Network Configuration for more information.
📰 BREAKING: Report filed by Smoke Copilot · 94.8 AIC · ⌖ 5.74 AIC · ⊞ 19.8K
Comment /smoke-copilot to run again
Add label smoke to run again
|
🎉 This pull request is included in a new release. Release: |
erlef/setup-beaminstalls OTP to${RUNNER_TEMP}/.setup-beam/otp/viacore.addPath(), not toRUNNER_TOOL_CACHE. SinceGetNpmBinPathSetup()reconstructs PATH by scanning only$RUNNER_TOOL_CACHE,erlwas invisible inside the AWF container — causingmixto fail when it tried to execerl.Changes
runtime_step_generator.go— Addedcase "elixir":(parallel to"go") that emits anERLANG_HOMEcapture step aftererlef/setup-beam:nodejs.go(GetNpmBinPathSetup) — AppendedERLANG_HOME/binre-prepend after the existing GOROOT handling:No-ops silently on non-Elixir workflows (
|| truepreserves the&&chain).Tests — Elixir now expects 2 runtime steps; added
TestGetNpmBinPathSetup_ErlangHomeOrderingandTestGetNpmBinPathSetup_NoErlangHomeDoesNotBreakChain.Golden files + lock files — Regenerated to reflect the updated
GetNpmBinPathSetupoutput.