feat: publish versioned JSON Schema for AWF config file by Copilot · Pull Request #2375 · github/gh-aw-firewall

Copilot · 2026-05-01T21:39:15Z

AwfFileConfig had no published JSON Schema, leaving consumers (IDE validators, gh-aw compiler) without a machine-readable contract and no way to reference a stable, versioned URL.

Changes

scripts/generate-schema.mjs — generator script that builds the complete JSON Schema for AwfFileConfig
- --version v0.X.Y embeds a version-specific $id for release assets
- --print writes to stdout (used in release pipeline)
- Default output: docs/awf-config.schema.json
docs/awf-config.schema.json — updated existing schema:
- Added missing fields: apiProxy.anthropicAutoCache, apiProxy.anthropicCacheTailTtl, apiProxy.models
- Added description on every property for IDE autocomplete
- copilot target correctly uses a host-only $defs ref (no basePath)
src/schema.test.ts — 16 tests using ajv/dist/2020 (already transitive) covering valid configs, enum constraints, additionalProperties rejection, and type mismatches
package.json — generate:schema script
.github/workflows/release.yml — generates versioned schema and uploads awf-config.schema.json as a release asset
README.md / docs/awf-config-spec.md — documents the versioned release asset URL

IDE integration

Users can reference the schema for autocomplete in .awf.yml / .awf.json:

$schema: "https://github.com/github/gh-aw-firewall/releases/download/v0.23.1/awf-config.schema.json"
network:
  allowDomains:
    - github.com
apiProxy:
  enabled: true
  anthropicAutoCache: true

The live schema at docs/awf-config.schema.json is reachable via raw.githubusercontent.com; each release additionally uploads a pinned copy so downstream tools can reference a specific AWF version.

Agent-Logs-Url: https://github.com/github/gh-aw-firewall/sessions/67604e30-6b7e-4524-8572-239a489b0733

github-actions · 2026-05-01T21:50:09Z

Documentation Preview

Documentation build failed for this PR. View logs.

Built from commit 9df6004

github-actions · 2026-05-01T21:50:09Z

✅ Coverage Check Passed

Overall Coverage

Metric	Base	PR	Delta
Lines	85.90%	85.98%	📈 +0.08%
Statements	85.88%	85.96%	📈 +0.08%
Functions	88.00%	88.00%	➡️ +0.00%
Branches	80.06%	80.10%	📈 +0.04%

📁 Per-file Coverage Changes (1 files)

File	Lines (Before → After)	Statements (Before → After)
`src/docker-manager.ts`	87.4% → 87.7% (+0.29%)	87.0% → 87.3% (+0.27%)

Coverage comparison generated by scripts/ci/compare-coverage.ts

Copilot

Pull request overview

Adds a generated, versioned JSON Schema for the AWF config file, along with tests and release automation to publish the schema as a release asset for IDE validation/autocomplete.

Changes:

Introduces scripts/generate-schema.mjs to generate docs/awf-config.schema.json (optionally embedding a versioned $id).
Adds Jest tests (src/schema.test.ts) to compile and validate the schema with Ajv 2020-12.
Updates docs and the release workflow to publish the versioned schema as a release asset.

Show a summary per file

File	Description
src/schema.test.ts	New unit tests that compile and validate the JSON Schema with Ajv.
scripts/generate-schema.mjs	New generator script to produce the JSON Schema (supports `--version` and `--print`).
package.json	Adds an npm script to run the schema generator.
docs/awf-config.schema.json	Expands schema coverage and adds descriptions for IDE autocomplete.
docs/awf-config-spec.md	Documents live vs versioned schema locations.
README.md	Links to schema and notes the versioned release asset URL.
.github/workflows/release.yml	Generates a versioned schema during releases and uploads it as an asset.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 7/7 changed files
Comments generated: 4

+ * The schema mirrors the AwfFileConfig TypeScript interface in src/config-file.ts.
+ * When the interface changes, update this script to match.


+          enum: ['5m', '1h'],
+          description:
+            'TTL for Anthropic cache tail optimization. ' +
+            'Requires anthropicAutoCache to be enabled. Allowed values: "5m" or "1h".',


+import * as fs from 'fs';
+import * as path from 'path';
+import Ajv2020 from 'ajv/dist/2020';


+const versionIdx = args.indexOf('--version');
+const version = versionIdx !== -1 ? args[versionIdx + 1] : null;
+const printOnly = args.includes('--print');
+


lpcox · 2026-05-01T21:57:39Z

@copilot address the review feedback

Agent-Logs-Url: https://github.com/github/gh-aw-firewall/sessions/db68ca3d-815c-49d2-8348-f5c8568b7e01

Copilot · 2026-05-01T22:00:18Z

@copilot address the review feedback

Addressed all four review items in c42ce40:

Header comment (generate-schema.mjs:11-12): Updated to say the schema reflects the validated config surface from validateAwfFileConfig, not just the TypeScript interface.
anthropicCacheTailTtl description (generate-schema.mjs:106): Changed "Requires anthropicAutoCache to be enabled" → "Only applies when anthropicAutoCache is enabled" to avoid implying enforcement.
ajv devDependency (src/schema.test.ts:1-3): Added ajv@^8.18.0 as an explicit devDependency in package.json (with updated lockfile).
--version argument validation (generate-schema.mjs:25-28): Added validation that exits non-zero with usage text when --version is missing its value, --version is followed by another flag, or an unknown flag is passed.

github-actions · 2026-05-01T22:05:17Z

🔥 Smoke Test: Copilot BYOK — PASS

Test	Result
GitHub MCP (list PRs)	✅ PR #2360 retrieved successfully
GitHub.com connectivity	✅ (pre-step validated)
File write/read	⚠️ Pre-step vars not interpolated (template placeholders unexpanded)
BYOK inference (this response)	✅

Running in BYOK offline mode (COPILOT_OFFLINE=true) via api-proxy → api.githubcopilot.com

Overall: PASS · PR by @Copilot · Assignees: @lpcox, @Copilot

🔑 BYOK report filed by Smoke Copilot BYOK

github-actions · 2026-05-01T22:05:18Z

Smoke Test Results ✅

✅ GitHub API: Last 2 merged PRs retrieved
- feat(api-proxy): Anthropic prompt-cache injection, TTL upgrade, tool drop, ANSI strip, custom transform hook #2360 feat(api-proxy): Anthropic prompt-cache injection, TTL upgrade, tool drop, ANSI strip, custom transform hook
- fix(api-proxy): set GOOGLE_GEMINI_BASE_URL to route Gemini CLI through sidecar #2348 fix(api-proxy): set GOOGLE_GEMINI_BASE_URL to route Gemini CLI through sidecar
✅ Playwright: github.com loads with correct title
✅ File write: Test file created in /tmp/gh-aw/agent/
✅ Bash verify: File contents confirmed

Overall: PASS

💥 [THE END] — Illustrated by Smoke Claude

github-actions · 2026-05-01T22:05:41Z

🔬 Smoke Test Results

Test	Status
GitHub MCP connectivity	✅
GitHub.com HTTP connectivity	⚠️ pre-step data unavailable
File write/read	⚠️ pre-step data unavailable

PR: feat: publish versioned JSON Schema for AWF config file — author @Copilot, assignees: @lpcox @Copilot

Overall: PARTIAL — MCP works; connectivity/file tests skipped due to unresolved template variables in workflow step data.

📰 BREAKING: Report filed by Smoke Copilot

github-actions · 2026-05-01T22:05:46Z

PR titles: unavailable
GitHub merged PR review: ❌
Safeinputs PR query: ❌
Playwright title check: ✅
Tavily search: ❌
File write/readback: ✅
Build (npm ci && npm run build): ✅
Discussion oracle comment: ❌
Overall status: FAIL

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex

github-actions · 2026-05-01T22:06:27Z

Chroot Smoke Test Results

Runtime	Host Version	Chroot Version	Match?
Python	Python 3.12.13	Python 3.12.3	❌ NO
Node.js	v24.14.1	v20.20.2	❌ NO
Go	go1.22.12	go1.22.12	✅ YES

Overall: FAILED — Python and Node.js versions differ between host and chroot environment.

Tested by Smoke Chroot

github-actions · 2026-05-01T22:07:00Z

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	✅	1/1 passed	✅ PASS
Bun	hono	✅	1/1 passed	✅ PASS
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	N/A	1/1 passed	✅ PASS
Deno	std	N/A	1/1 passed	✅ PASS
.NET	hello-world	✅	N/A	✅ PASS
.NET	json-parse	✅	N/A	✅ PASS
Go	color	✅	passed	✅ PASS
Go	env	✅	passed	✅ PASS
Go	uuid	✅	passed	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS
Java	caffeine	✅	1/1 passed	✅ PASS
Node.js	clsx	✅	passed	✅ PASS
Node.js	execa	✅	passed	✅ PASS
Node.js	p-limit	✅	passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 8/8 ecosystems passed — ✅ PASS

Note: Java Maven required a custom local repository path (-Dmaven.repo.local) because the default ~/.m2/repository directory was owned by root and could not be created without elevated permissions in this environment.

Generated by Build Test Suite for issue #2375 · ● 567.7K · ◷

github-actions · 2026-05-01T22:12:43Z

Smoke Test Results

Redis PING: ❌ (host.docker.internal:6379 — timeout/no response)
PostgreSQL pg_isready: ❌ (host.docker.internal:5432 — no response)
PostgreSQL SELECT 1: ❌ (skipped, pg_isready failed)

Overall: FAIL — Service containers unreachable from this environment.

🔌 Service connectivity validated by Smoke Services

Initial plan

a42c828

Copilot AI assigned Copilot and lpcox May 1, 2026

Copilot started work on behalf of lpcox May 1, 2026 21:39 View session

Copilot AI linked an issue May 1, 2026 that may be closed by this pull request

feat: publish versioned JSON Schema for AWF config file #2374

Closed

feat: publish versioned JSON Schema for AWF config file

b145431

Agent-Logs-Url: https://github.com/github/gh-aw-firewall/sessions/67604e30-6b7e-4524-8572-239a489b0733

lpcox marked this pull request as ready for review May 1, 2026 21:49

lpcox requested a review from Mossaka as a code owner May 1, 2026 21:49

Copilot AI review requested due to automatic review settings May 1, 2026 21:49

Copilot started reviewing on behalf of lpcox May 1, 2026 21:49 View session

fix: use --print in release schema generation step

88ae896

github-actions Bot mentioned this pull request May 1, 2026

[aw] Smoke OpenCode failed #2377

Closed

Copilot AI changed the title ~~[WIP] Add versioned JSON Schema for AWF config file~~ feat: publish versioned JSON Schema for AWF config file May 1, 2026

Copilot AI requested a review from lpcox May 1, 2026 21:52

Copilot finished work on behalf of lpcox May 1, 2026 21:52

This comment has been minimized.

Sign in to view

github-actions Bot added smoke-claude smoke-copilot-byok labels May 1, 2026

This comment has been minimized.

Sign in to view

Copilot AI reviewed May 1, 2026

View reviewed changes

This comment has been minimized.

Sign in to view

github-actions Bot added the build-test label May 1, 2026

This comment has been minimized.

Sign in to view

github-actions Bot mentioned this pull request May 1, 2026

[aw] Smoke Gemini failed #2379

Open

Copilot started work on behalf of lpcox May 1, 2026 21:57 View session

fix: address schema generator review feedback

c42ce40

Agent-Logs-Url: https://github.com/github/gh-aw-firewall/sessions/db68ca3d-815c-49d2-8348-f5c8568b7e01

github-actions Bot mentioned this pull request May 1, 2026

[aw] Smoke OpenCode failed #2381

Open

Copilot finished work on behalf of lpcox May 1, 2026 22:00

lpcox merged commit 34b4e73 into main May 1, 2026
66 of 70 checks passed

lpcox deleted the copilot/publish-versioned-json-schema branch May 1, 2026 22:20

This was referenced May 1, 2026

feat: publish versioned schemas for JSONL audit/telemetry artifacts #2380

Merged

feat: validate config files against published JSON Schema at runtime #2384

Merged

		* The schema mirrors the AwfFileConfig TypeScript interface in src/config-file.ts.
		* When the interface changes, update this script to match.

Conversation

Copilot AI commented May 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

IDE integration

Uh oh!

github-actions Bot commented May 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Documentation Preview

Uh oh!

github-actions Bot commented May 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Coverage Check Passed

Overall Coverage

Uh oh!

This comment has been minimized.

This comment has been minimized.

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Copilot's findings

Uh oh!

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

lpcox commented May 1, 2026

Uh oh!

Copilot AI commented May 1, 2026

Uh oh!

github-actions Bot commented May 1, 2026

🔥 Smoke Test: Copilot BYOK — PASS

Uh oh!

github-actions Bot commented May 1, 2026

Uh oh!

github-actions Bot commented May 1, 2026

🔬 Smoke Test Results

Uh oh!

github-actions Bot commented May 1, 2026

Uh oh!

github-actions Bot commented May 1, 2026

Chroot Smoke Test Results

Uh oh!

github-actions Bot commented May 1, 2026

🏗️ Build Test Suite Results

Uh oh!

github-actions Bot commented May 1, 2026

Smoke Test Results

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented May 1, 2026 •

edited

Loading

github-actions Bot commented May 1, 2026 •

edited

Loading

github-actions Bot commented May 1, 2026 •

edited

Loading