Skip to content

Fix Rig workflow credential handoff with a harness-owned launch tool - #549

Closed
pelikhan wants to merge 8 commits into
mainfrom
pelikhan-rig-connection-pipe
Closed

pelikhan wants to merge 8 commits into
mainfrom
pelikhan-rig-connection-pipe

Conversation

@pelikhan

@pelikhan pelikhan commented Oct 6, 2026

Copy link
Copy Markdown
Collaborator

The three-judge Actions fixture was failing when nested Rig sessions could not authenticate to the Copilot sidecar. This replaces shell-based credential forwarding in the fixture with a trusted SDK launch tool and makes the runtime guidance small enough for agents to read reliably.

Approach

  • Add rig/launch-tool with a source-only run_rig tool. The harness sends connection credentials through an inherited pipe, removes them from the child environment, and bounds execution time and output with token redaction.
  • Support --connection-fd with validated, launcher-scoped SDK configuration, including programs that configure their own Copilot engine.
  • Register the tool through gh-aw's supported custom driver while retaining compiler-owned tool filtering and permissions. The integration driver accepts only the unchanged fixture, permits one launch per driver invocation, and persists successful output for post-step assertions.
  • Normalize fixed-object native Copilot response schemas with additionalProperties: false, preserving explicit record schemas and leaving the original schemas unchanged.
  • Split runtime.md into focused references, update the skill router, and make the three-judge workflow instructions more directive.

Important details

The connection token authenticates the SDK transport, not an individual judge session. The launcher and the program's "rig" import must use the same runtime copy so the scoped connection is retained. The first Actions attempt exposed this mismatch; the driver now uses the checkout tool factory's matching default launcher.

The existing environment-based launch path remains available. This change does not recover credentials or weaken the workflow's sandbox, firewall, or existing tool policy.

Validation

  • All 501 unit tests pass; TypeScript typecheck and strict gh-aw compilation pass.
  • The live SDK integration test passes with real judge sessions and credentials absent from Rig's environment.
  • Actions run 37519682727 passed all jobs. Its post-step verified exactly three model calls, criterion order, valid nonempty judgments, and an approve majority verdict.
  • Failed and successful runs were downloaded and investigated with gh aw audit.

Peli and others added 6 commits October 6, 2026 11:53
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Register the tool through a custom gh-aw driver, preserve compiler-owned permissions, and validate the three-judge fixture in Actions. Split runtime documentation and normalize native Copilot output schemas.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Use the tool factory's default launcher so package imports retain the pipe-scoped SDK connection. Return explicit SDK tool failure results for accurate reporting.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Scan JavaScript module extensions alongside TypeScript and skip TypeScript-only rules for JavaScript in the CLI and ESLint plugin. Cover file discovery, fixes, exclusions, and language-aware rule selection.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
@pelikhan
pelikhan marked this pull request as ready for review October 6, 2026 20:36
@pelikhan

pelikhan commented Oct 6, 2026

Copy link
Copy Markdown
Collaborator Author

@copilot resolve the merge conflicts in this pull request

Copilot AI and others added 2 commits October 6, 2026 20:38
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI commented Oct 6, 2026

Copy link
Copy Markdown
Contributor

@copilot resolve the merge conflicts in this pull request

Merged main and resolved the conflicts in c2f7385.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants