Skip to content

preinstall 3 versions of awf for agentic workflow #13937

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
aiqiaoy wants to merge 3 commits into
base: main
Choose a base branch
from
+65 −0
Open

preinstall 3 versions of awf for agentic workflow #13937

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
efbca18
preinstall 3 versions of awf and copilot-cli
aiqiaoy Apr 16, 2026
67b7127
remove copilot-cli
aiqiaoy Apr 16, 2026
724d57c
remove install-awf from ubuntu-22 pkr
aiqiaoy Apr 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
45 changes: 45 additions & 0 deletions images/ubuntu/scripts/build/install-awf.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,45 @@
#!/bin/bash -e
################################################################################
## File: install-awf.sh
## Desc: Install Agent Workflow Firewall JS bundle (most recent 3 versions)
## Supply chain security: AWF - checksum validation
################################################################################

# Source the helpers for use with the script
source $HELPER_SCRIPTS/install.sh

# Number of versions to install (current + 2 previous)
NUM_VERSIONS=3

# Get the most recent stable releases (exclude pre-releases, beta and release without assets)
releases=$(curl -fsSL "https://api.github.com/repos/github/gh-aw-firewall/releases?per_page=10")
versions=$(echo "$releases" | jq -r '[.[] | select(.assets | length > 0) | select(.prerelease == false) | select(.tag_name | test(".*-[a-z]|beta") | not)] | .[:'"$NUM_VERSIONS"'] | .[].tag_name')

Comment on lines +14 to +17
Copy link

Copilot AI Apr 16, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The GitHub release query uses per_page=10 and only checks that a release has some assets, not that it includes awf-bundle.js/checksums.txt. This can lead to caching fewer than NUM_VERSIONS versions or failing downloads if a release is missing the expected files. Prefer using helpers/install.sh (get_github_releases_by_version + resolve_github_release_asset_url) or filter releases by the required asset name and increase the page size so you can reliably install 3 stable versions.

Copilot uses AI. Check for mistakes.
Copy link
Copy Markdown

@alinernunes15-a11y alinernunes15-a11y Apr 16, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

já verifiquei as mudanças a serem feitas.

if [[ -z "$versions" ]]; then
echo "Error: Unable to find AWF releases."
exit 1
fi

for tag in $versions; do
version="${tag#v}"
echo "Installing AWF JS bundle version $version to toolcache..."

# Download the JS bundle
bundle_url="https://github.com/github/gh-aw-firewall/releases/download/${tag}/awf-bundle.js"
bundle_path=$(download_with_retry "$bundle_url")

# Supply chain security - AWF
checksums_url="https://github.com/github/gh-aw-firewall/releases/download/${tag}/checksums.txt"
Copy link
Copy Markdown
Contributor

@paveliak paveliak Apr 16, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Curious, how do we enforce the security here? If someone was able to update release artifacts then they could equally update the checksum file too.

Copy link
Copy Markdown
Author

@aiqiaoy aiqiaoy Apr 17, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah good point. I think we need to verify signature to be fully protected, although this check sum validation is an existing pattern in our install scripts

external_hash=$(get_checksum_from_url "$checksums_url" "awf-bundle.js" "SHA256")
use_checksum_comparison "$bundle_path" "$external_hash"

# Install to toolcache
awf_toolcache_path="$AGENT_TOOLSDIRECTORY/agentic-workflow-firewall-js/$version/x64"
mkdir -p "$awf_toolcache_path"
cp "$bundle_path" "$awf_toolcache_path/awf-bundle.js"

# Mark installation complete
touch "$AGENT_TOOLSDIRECTORY/agentic-workflow-firewall-js/$version/x64.complete"
done

invoke_tests "Tools" "AWF"
19 changes: 19 additions & 0 deletions images/ubuntu/scripts/tests/Tools.Tests.ps1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -409,3 +409,22 @@ project(NinjaTest NONE)
Remove-Item -Path "/tmp/ninjaproject" -Recurse -Force
}
}

Describe "AWF" -Skip:(Test-IsUbuntu22) {
It "AWF toolcache directory exists" {
$awfPath = Join-Path $env:AGENT_TOOLSDIRECTORY "agentic-workflow-firewall-js"
$awfPath | Should -Exist
}

It "At least 3 versions are installed" {
$awfPath = Join-Path $env:AGENT_TOOLSDIRECTORY "agentic-workflow-firewall-js"
(Get-ChildItem -Path $awfPath -Directory).Count | Should -BeGreaterOrEqual 3
}

It "AWF JS bundle exists" {
$awfPath = Join-Path $env:AGENT_TOOLSDIRECTORY "agentic-workflow-firewall-js"
$latestVersion = Get-ChildItem -Path $awfPath -Directory | Sort-Object -Property { [version]$_.Name } -Descending | Select-Object -First 1
$bundlePath = Join-Path $latestVersion.FullName "x64" "awf-bundle.js"
$bundlePath | Should -Exist
}
}
1 change: 1 addition & 0 deletions images/ubuntu/templates/build.ubuntu-24_04.pkr.hcl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -110,6 +110,7 @@ provisioner "shell" {
"${path.root}/../scripts/build/install-swift.sh",
"${path.root}/../scripts/build/install-cmake.sh",
"${path.root}/../scripts/build/install-codeql-bundle.sh",
"${path.root}/../scripts/build/install-awf.sh",
"${path.root}/../scripts/build/install-container-tools.sh",
"${path.root}/../scripts/build/install-dotnetcore-sdk.sh",
"${path.root}/../scripts/build/install-microsoft-edge.sh",
Expand Down
Loading