Skip to content

fix: expose erl in AWF sandbox when using runtimes.elixir#44283

Merged
pelikhan merged 11 commits into
mainfrom
copilot/bugfix-preserve-setup-beam-paths
Jul 9, 2026
Merged

fix: expose erl in AWF sandbox when using runtimes.elixir#44283
pelikhan merged 11 commits into
mainfrom
copilot/bugfix-preserve-setup-beam-paths

Conversation

Copilot AI commented Jul 8, 2026

Copy link
Copy Markdown
Contributor

erlef/setup-beam installs OTP to ${RUNNER_TEMP}/.setup-beam/otp/ via core.addPath(), not to RUNNER_TOOL_CACHE. Since GetNpmBinPathSetup() reconstructs PATH by scanning only $RUNNER_TOOL_CACHE, erl was invisible inside the AWF container — causing mix to fail when it tried to exec erl.

Changes

  • runtime_step_generator.go — Added case "elixir": (parallel to "go") that emits an ERLANG_HOME capture step after erlef/setup-beam:

    - name: Capture ERLANG_HOME for AWF chroot mode
      run: echo "ERLANG_HOME=$(erl -noshell -eval 'io:format("~s", [code:root_dir()]), halt().')" >> "$GITHUB_ENV"
  • nodejs.go (GetNpmBinPathSetup) — Appended ERLANG_HOME/bin re-prepend after the existing GOROOT handling:

    [ -n "$ERLANG_HOME" ] && export PATH="$ERLANG_HOME/bin:$PATH" || true

    No-ops silently on non-Elixir workflows (|| true preserves the && chain).

  • Tests — Elixir now expects 2 runtime steps; added TestGetNpmBinPathSetup_ErlangHomeOrdering and TestGetNpmBinPathSetup_NoErlangHomeDoesNotBreakChain.

  • Golden files + lock files — Regenerated to reflect the updated GetNpmBinPathSetup output.


Generated by 👨‍🍳 PR Sous Chef · 9.91 AIC · ⌖ 10.6 AIC · ⊞ 7.1K ·
Comment /souschef to run again


Generated by 👨‍🍳 PR Sous Chef · 6.93 AIC · ⌖ 5.06 AIC · ⊞ 7.1K ·
Comment /souschef to run again


Generated by 👨‍🍳 PR Sous Chef · 6.55 AIC · ⌖ 5.29 AIC · ⊞ 7.1K ·
Comment /souschef to run again

Copilot AI and others added 2 commits July 8, 2026 12:18
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
- Add ERLANG_HOME capture step after erlef/setup-beam in runtime_step_generator.go
  (parallel to Go's GOROOT capture step). setup-beam installs OTP to
  ${RUNNER_TEMP}/.setup-beam/otp/ via core.addPath(), which is not under
  RUNNER_TOOL_CACHE and therefore missed by GetNpmBinPathSetup's find.
- Modify GetNpmBinPathSetup() in nodejs.go to add $ERLANG_HOME/bin to PATH
  (parallel to GOROOT handling), ensuring erl is reachable inside AWF container.
- Update tests and golden files to reflect the new behavior.
- Regenerate workflow lock files.

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copilot AI changed the title [WIP] Fix AWF sandbox to preserve setup-beam paths fix: expose erl in AWF sandbox when using runtimes.elixir Jul 8, 2026
Copilot AI requested a review from pelikhan July 8, 2026 12:32
@pelikhan pelikhan marked this pull request as ready for review July 8, 2026 12:38
Copilot AI review requested due to automatic review settings July 8, 2026 12:38
@pelikhan pelikhan added the awf label Jul 8, 2026

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR fixes Elixir workflows running under the AWF sandbox (chroot/container mode) by ensuring Erlang/OTP (erl) is discoverable on PATH even though erlef/setup-beam installs OTP under ${RUNNER_TEMP} (not RUNNER_TOOL_CACHE). It does this by capturing ERLANG_HOME after setup-beam runs and then re-prepending ERLANG_HOME/bin in the PATH reconstruction logic used inside the sandbox.

Changes:

  • Add an Elixir-specific runtime capture step to export ERLANG_HOME into GITHUB_ENV for chroot/sandbox compatibility.
  • Extend GetNpmBinPathSetup() to re-prepend ERLANG_HOME/bin (similar to the existing GOROOT/bin handling).
  • Update tests, golden outputs, and regenerated lock files to reflect the new PATH setup.
Show a summary per file
File Description
pkg/workflow/runtime_step_generator.go Adds Elixir runtime env capture for ERLANG_HOME after erlef/setup-beam.
pkg/workflow/nodejs.go Updates GetNpmBinPathSetup() to prepend ERLANG_HOME/bin when present.
pkg/workflow/runtime_setup_test.go Updates Elixir runtime step expectations to include the new capture step.
pkg/workflow/engine_helpers_test.go Adds coverage for ERLANG_HOME PATH ordering and non-breaking chaining when unset.
pkg/workflow/testdata/TestWasmGolden_CompileFixtures/with-imports.golden Golden update: PATH setup now includes ERLANG_HOME/bin.
pkg/workflow/testdata/TestWasmGolden_CompileFixtures/smoke-copilot.golden Golden update: PATH setup now includes ERLANG_HOME/bin.
pkg/workflow/testdata/TestWasmGolden_CompileFixtures/playwright-cli-mode.golden Golden update: PATH setup now includes ERLANG_HOME/bin.
pkg/workflow/testdata/TestWasmGolden_CompileFixtures/basic-copilot.golden Golden update: PATH setup now includes ERLANG_HOME/bin.
pkg/workflow/testdata/TestWasmGolden_AllEngines/pi.golden Golden update: PATH setup now includes ERLANG_HOME/bin.
pkg/workflow/testdata/TestWasmGolden_AllEngines/gemini.golden Golden update: PATH setup now includes ERLANG_HOME/bin.
pkg/workflow/testdata/TestWasmGolden_AllEngines/copilot.golden Golden update: PATH setup now includes ERLANG_HOME/bin.
pkg/workflow/testdata/TestWasmGolden_AllEngines/codex.golden Golden update: PATH setup now includes ERLANG_HOME/bin.
.github/workflows/test-workflow.lock.yml Regenerated: PATH setup now includes ERLANG_HOME/bin.
.github/workflows/test-project-url-default.lock.yml Regenerated: PATH setup now includes ERLANG_HOME/bin.
.github/workflows/test-dispatcher.lock.yml Regenerated: PATH setup now includes ERLANG_HOME/bin.
.github/workflows/smoke-opencode.lock.yml Regenerated: PATH setup now includes ERLANG_HOME/bin.
.github/workflows/smoke-gemini.lock.yml Regenerated: PATH setup now includes ERLANG_HOME/bin.
.github/workflows/smoke-crush.lock.yml Regenerated: PATH setup now includes ERLANG_HOME/bin.
.github/workflows/smoke-ci.lock.yml Regenerated: PATH setup now includes ERLANG_HOME/bin.
.github/workflows/smoke-antigravity.lock.yml Regenerated: PATH setup now includes ERLANG_HOME/bin.
.github/workflows/release.lock.yml Regenerated: PATH setup now includes ERLANG_HOME/bin.
.github/workflows/hippo-embed.lock.yml Regenerated: PATH setup now includes ERLANG_HOME/bin.
.github/workflows/github-remote-mcp-auth-test.lock.yml Regenerated: PATH setup now includes ERLANG_HOME/bin.
.github/workflows/firewall.lock.yml Regenerated: PATH setup now includes ERLANG_HOME/bin.
.github/workflows/example-permissions-warning.lock.yml Regenerated: PATH setup now includes ERLANG_HOME/bin.
.github/workflows/docs-noob-tester.lock.yml Regenerated: PATH setup now includes ERLANG_HOME/bin.
.github/workflows/daily-news.lock.yml Regenerated: PATH setup now includes ERLANG_HOME/bin.
.github/workflows/daily-multi-device-docs-tester.lock.yml Regenerated: PATH setup now includes ERLANG_HOME/bin.
.github/workflows/daily-model-resolution.lock.yml Regenerated: PATH setup now includes ERLANG_HOME/bin.
.github/workflows/daily-model-inventory.lock.yml Regenerated: PATH setup now includes ERLANG_HOME/bin.
.github/workflows/daily-max-ai-credits-test.lock.yml Regenerated: PATH setup now includes ERLANG_HOME/bin.
.github/workflows/daily-malicious-code-scan.lock.yml Regenerated: PATH setup now includes ERLANG_HOME/bin.
.github/workflows/daily-hippo-learn.lock.yml Regenerated: PATH setup now includes ERLANG_HOME/bin.
.github/workflows/daily-function-namer.lock.yml Regenerated: PATH setup now includes ERLANG_HOME/bin.
.github/workflows/daily-experiment-report.lock.yml Regenerated: PATH setup now includes ERLANG_HOME/bin.
.github/workflows/daily-credit-limit-test.lock.yml Regenerated: PATH setup now includes ERLANG_HOME/bin.
.github/workflows/daily-compiler-quality.lock.yml Regenerated: PATH setup now includes ERLANG_HOME/bin.
.github/workflows/daily-cli-tools-tester.lock.yml Regenerated: PATH setup now includes ERLANG_HOME/bin.
.github/workflows/daily-byok-ollama-test.lock.yml Regenerated: PATH setup now includes ERLANG_HOME/bin.
.github/workflows/daily-awf-spec-compiler-surfacing.lock.yml Regenerated: PATH setup now includes ERLANG_HOME/bin.
.github/workflows/daily-architecture-diagram.lock.yml Regenerated: PATH setup now includes ERLANG_HOME/bin.
.github/workflows/daily-ambient-context-optimizer.lock.yml Regenerated: PATH setup now includes ERLANG_HOME/bin.
.github/workflows/craft.lock.yml Regenerated: PATH setup now includes ERLANG_HOME/bin.
.github/workflows/copilot-pr-prompt-analysis.lock.yml Regenerated: PATH setup now includes ERLANG_HOME/bin.
.github/workflows/copilot-pr-nlp-analysis.lock.yml Regenerated: PATH setup now includes ERLANG_HOME/bin.
.github/workflows/copilot-pr-merged-report.lock.yml Regenerated: PATH setup now includes ERLANG_HOME/bin.
.github/workflows/copilot-opt.lock.yml Regenerated: PATH setup now includes ERLANG_HOME/bin.
.github/workflows/constraint-solving-potd.lock.yml Regenerated: PATH setup now includes ERLANG_HOME/bin.
.github/workflows/commit-changes-analyzer.lock.yml Regenerated: PATH setup now includes ERLANG_HOME/bin.
.github/workflows/codex-github-remote-mcp-test.lock.yml Regenerated: PATH setup now includes ERLANG_HOME/bin.
.github/workflows/cli-consistency-checker.lock.yml Regenerated: PATH setup now includes ERLANG_HOME/bin.
.github/workflows/ci-coach.lock.yml Regenerated: PATH setup now includes ERLANG_HOME/bin.
.github/workflows/chaos-pr-bundle-fuzzer.lock.yml Regenerated: PATH setup now includes ERLANG_HOME/bin.
.github/workflows/changeset.lock.yml Regenerated: PATH setup now includes ERLANG_HOME/bin.
.github/workflows/brave.lock.yml Regenerated: PATH setup now includes ERLANG_HOME/bin.
.github/workflows/bot-detection.lock.yml Regenerated: PATH setup now includes ERLANG_HOME/bin.
.github/workflows/artifacts-summary.lock.yml Regenerated: PATH setup now includes ERLANG_HOME/bin.
.github/workflows/architecture-guardian.lock.yml Regenerated: PATH setup now includes ERLANG_HOME/bin.
.github/workflows/archie.lock.yml Regenerated: PATH setup now includes ERLANG_HOME/bin.
.github/workflows/ai-moderator.lock.yml Regenerated, but currently removes determine-automatic-lockdown while still referencing its outputs (workflow-breaking).
.github/workflows/agentic-token-trend-audit.lock.yml Regenerated: PATH setup now includes ERLANG_HOME/bin.
.github/workflows/agentic-token-optimizer.lock.yml Regenerated: PATH setup now includes ERLANG_HOME/bin.
.github/workflows/agent-persona-explorer.lock.yml Regenerated: PATH setup now includes ERLANG_HOME/bin.
.github/workflows/ace-editor.lock.yml Regenerated: PATH setup now includes ERLANG_HOME/bin.
.github/workflows/ab-testing-advisor.lock.yml Regenerated: PATH setup now includes ERLANG_HOME/bin.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comments suppressed due to low confidence (1)

.github/workflows/ai-moderator.lock.yml:600

  • The determine-automatic-lockdown step was removed, but this workflow still references steps.determine-automatic-lockdown.outputs.visibility later (e.g. around line 880). That will make the workflow invalid at runtime because the step ID no longer exists. Re-add the step (or remove/replace all references to its outputs).
      - name: Install AWF binary
        run: bash "${RUNNER_TEMP}/gh-aw/actions/install_awf_binary.sh" v0.27.27 --rootless
      - name: Parse integrity filter lists
        id: parse-guard-vars
        env:
          GH_AW_BLOCKED_USERS_VAR: ${{ vars.GH_AW_GITHUB_BLOCKED_USERS || '' }}
          GH_AW_TRUSTED_USERS_VAR: ${{ vars.GH_AW_GITHUB_TRUSTED_USERS || '' }}
          GH_AW_APPROVAL_LABELS_VAR: ${{ vars.GH_AW_GITHUB_APPROVAL_LABELS || '' }}
        run: bash "${RUNNER_TEMP}/gh-aw/actions/parse_guard_list.sh"
  • Files reviewed: 152/271 changed files
  • Comments generated: 0
  • Review effort level: Low

@github-actions

github-actions Bot commented Jul 8, 2026

Copy link
Copy Markdown
Contributor

🤖 PR Triage

Field Value
Category bug
Risk 🟡 medium
Score 62 / 100
Recommended action fast_track

Score breakdown: Impact 30 + Urgency 18 + Quality 14

Assessment: Fixes Elixir erl binary invisible inside AWF sandbox — mix fails at runtime for all Elixir workflows. Targeted 2-file fix capturing ERLANG_HOME and prepending to PATH. AI reviewer approved.

Next step: Confirm CI green, then fast-track merge.

Generated by 🔧 PR Triage Agent · 64.6 AIC · ⌖ 20.4 AIC · ⊞ 5.4K ·

@pelikhan

pelikhan commented Jul 8, 2026

Copy link
Copy Markdown
Collaborator

@copilot run pr-finisher skill

Copilot AI commented Jul 8, 2026

Copy link
Copy Markdown
Contributor Author

@copilot run pr-finisher skill

Ran the PR-finisher pass.

  • Reviews: no unresolved in-scope review threads.
  • Local checks: make fmt, make lint, make test-unit, make test, and make recompile all passed locally.
  • Mergeability: PR is open/non-draft; GitHub reports it as blocked on merge requirements rather than conflicts.
  • CI: last known checks were mostly green with one run still in progress at triage time; after any new agent push, CI must be re-triggered by a maintainer to verify current HEAD.

No additional code changes were needed in this pass.

@pelikhan

pelikhan commented Jul 8, 2026

Copy link
Copy Markdown
Collaborator

Create a daily agentic workflow that uses a popular Elixir tool to improve this repository. Choose a widely adopted tool, install it in the workflow steps, and prompt the agent to use it.

@gh-aw-bot

Copy link
Copy Markdown
Collaborator

@copilot please run the pr-finisher skill, address any unresolved review feedback, and rerun checks once the branch is up to date.

Generated by 👨‍🍳 PR Sous Chef · 9.91 AIC · ⌖ 10.6 AIC · ⊞ 7.1K ·
Comment /souschef to run again

…ve-setup-beam-paths

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot AI commented Jul 8, 2026

Copy link
Copy Markdown
Contributor Author

pr-sous-chef
@copilot please run the pr-finisher skill, address any unresolved review feedback, and rerun checks once the branch is up to date.
...

Done in e3e3c35.

I updated the branch with latest origin/main (it was behind by 1), rechecked in-scope feedback (no unresolved in-scope review threads), and reran local checks on current HEAD: make fmt, make lint, make test-unit, make test, make recompile, and make agent-report-progress all passed.

I also reviewed CI runs/logs via MCP for this branch. The latest non-agent runs on this head are action_required and currently provide no failed job logs to remediate agent-side.

CI for current HEAD still needs a maintainer re-trigger before merge (close/reopen PR, workflow_dispatch, or maintainer push).

@github-actions

github-actions Bot commented Jul 8, 2026

Copy link
Copy Markdown
Contributor

🤖 PR Triage

Field Value
Category bug
Risk 🟡 medium
Score 69/100 (impact:38 urgency:22 quality:9)
Action ⚡ fast_track

Status: Carry-over (run 3) · CI blocked · mergeable_state: blocked.

Elixir AWF workflows are fully broken (erl missing from PATH). CI is blocked — needs unblocking before merge. Labels preserved from prior run.

Run §28966928999

Generated by 🔧 PR Triage Agent · 106.9 AIC · ⌖ 10.9 AIC · ⊞ 5.4K ·

@gh-aw-bot

Copy link
Copy Markdown
Collaborator

pr-sous-chef
@copilot this branch has merge conflicts. Please run make merge-main to merge the latest main branch and resolve any conflicts, then push the result.

Run: https://github.com/github/gh-aw/actions/runs/28969326363

Generated by 👨‍🍳 PR Sous Chef · 10.3 AIC · ⌖ 7.04 AIC · ⊞ 7.1K ·
Comment /souschef to run again

…ve-setup-beam-paths

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot AI commented Jul 8, 2026

Copy link
Copy Markdown
Contributor Author

pr-sous-chef
@copilot this branch has merge conflicts. Please run make merge-main to merge the latest main branch and resolve any conflicts, then push the result.
...

Done in 0c894de.

I ran make merge-main and the branch now includes the latest main via merge commit with no remaining merge conflicts. I also reran checks on current HEAD (make fmt, make lint, make test-unit, make test, make recompile, make agent-report-progress) and ran final parallel_validation (clean).

@pelikhan

pelikhan commented Jul 9, 2026

Copy link
Copy Markdown
Collaborator

@copilot Create a daily agentic workflow that uses a popular Elixir tool to improve this repository. Choose a widely adopted tool, install it in the workflow steps, and prompt the agent to use it.

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI commented Jul 9, 2026

Copy link
Copy Markdown
Contributor Author

@copilot Create a daily agentic workflow that uses a popular Elixir tool to improve this repository. Choose a widely adopted tool, install it in the workflow steps, and prompt the agent to use it.

Done in dc0d7ba.

I added .github/workflows/daily-elixir-credo-snippet-audit.md (plus compiled lock file) as a new daily agentic workflow that uses the widely adopted Elixir tool Credo. It installs Credo in workflow steps and prompts the agent to lint Elixir snippets in repository markdown and propose/fix improvements.

@pelikhan

pelikhan commented Jul 9, 2026

Copy link
Copy Markdown
Collaborator

/smoke-copilot

@pelikhan pelikhan added the smoke label Jul 9, 2026
@github-actions

github-actions Bot commented Jul 9, 2026

Copy link
Copy Markdown
Contributor

📰 BREAKING: Smoke Copilot is now investigating this issue comment. Sources say the story is developing...

@github-actions

github-actions Bot commented Jul 9, 2026

Copy link
Copy Markdown
Contributor

fix: expose erl in AWF sandbox when using runtimes.elixir
Schedule Smoke Copilot Sub Agents workflow to run daily
[safe-output-integrator] Add missing safe-output type fixtures and Go test coverage (11 types)
1❌ 2✅ 3✅ 4✅ 5❌ 6✅ 7❌ 8✅ 9✅ 10❌ 11✅ 12✅ 13✅ 14❌ 15✅ 16✅
Overall: FAIL
Author: @app/copilot-swe-agent
Assignees: @pelikhan @Copilot

Warning

Firewall blocked 6 domains

The following domains were blocked by the firewall during workflow execution:

  • accounts.google.com
  • android.clients.google.com
  • clients2.google.com
  • contentautofill.googleapis.com
  • safebrowsingohttpgateway.googleapis.com
  • www.google.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "accounts.google.com"
    - "android.clients.google.com"
    - "clients2.google.com"
    - "contentautofill.googleapis.com"
    - "safebrowsingohttpgateway.googleapis.com"
    - "www.google.com"

See Network Configuration for more information.

📰 BREAKING: Report filed by Smoke Copilot · 94.8 AIC · ⌖ 5.74 AIC · ⊞ 19.8K ·
Comment /smoke-copilot to run again
Add label smoke to run again

@github-actions

github-actions Bot commented Jul 9, 2026

Copy link
Copy Markdown
Contributor

Comment Memory

Bot pound stone keys
Night tests echo through cave walls
Green sparks chase the dawn

Note

This comment is managed by comment memory.

It stores persistent context for this thread in the code block at the top of this comment.
Edit only the text inside the backtick fences; workflow metadata and the footer are regenerated automatically.

Learn more about comment memory

Warning

Firewall blocked 6 domains

The following domains were blocked by the firewall during workflow execution:

  • accounts.google.com
  • android.clients.google.com
  • clients2.google.com
  • contentautofill.googleapis.com
  • safebrowsingohttpgateway.googleapis.com
  • www.google.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "accounts.google.com"
    - "android.clients.google.com"
    - "clients2.google.com"
    - "contentautofill.googleapis.com"
    - "safebrowsingohttpgateway.googleapis.com"
    - "www.google.com"

See Network Configuration for more information.

📰 BREAKING: Report filed by Smoke Copilot · 94.8 AIC · ⌖ 5.74 AIC · ⊞ 19.8K ·
Comment /smoke-copilot to run again
Add label smoke to run again

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Smoke pass. Me leave two tiny cave notes.

Warning

Firewall blocked 6 domains

The following domains were blocked by the firewall during workflow execution:

  • accounts.google.com
  • android.clients.google.com
  • clients2.google.com
  • contentautofill.googleapis.com
  • safebrowsingohttpgateway.googleapis.com
  • www.google.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "accounts.google.com"
    - "android.clients.google.com"
    - "clients2.google.com"
    - "contentautofill.googleapis.com"
    - "safebrowsingohttpgateway.googleapis.com"
    - "www.google.com"

See Network Configuration for more information.

📰 BREAKING: Report filed by Smoke Copilot · 94.8 AIC · ⌖ 5.74 AIC · ⊞ 19.8K
Comment /smoke-copilot to run again
Add label smoke to run again

@pelikhan pelikhan merged commit 3fa71b5 into main Jul 9, 2026
46 checks passed
@pelikhan pelikhan deleted the copilot/bugfix-preserve-setup-beam-paths branch July 9, 2026 02:16
@github-actions

github-actions Bot commented Jul 9, 2026

Copy link
Copy Markdown
Contributor

🎉 This pull request is included in a new release.

Release: v0.82.7

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[bug] runtimes.elixir exposes mix but not erl inside AWF sandbox

4 participants