Function BuildAWFConfigJSON

pkg/workflow/awf_config.go:379–597

BuildAWFConfigJSON generates a compact JSON config file for AWF from the provided command configuration. The JSON is single-line (no indentation) for safe embedding in a shell printf command. The caller is responsible for writing the returned JSON to disk at the path expected by the AWF --config fl

(config AWFCommandConfig)

// The caller is responsible for writing the returned JSON to disk at the path expected
// by the AWF --config flag. See BuildAWFCommand for how this is wired together.
func BuildAWFConfigJSON(config AWFCommandConfig) (string, error) {
	awfConfigLog.Printf("Building AWF config JSON: engine=%s, allowed_domains=%q", config.EngineName, config.AllowedDomains)

	// Resolve firewall config once — used for both the schema URL and the container image tag.
	firewallConfig := getFirewallConfig(config.WorkflowData)

	awfConfig := AWFConfigFile{
		Schema: buildAWFConfigSchemaURL(firewallConfig),
	}

	// ── Runner section ──────────────────────────────────────────────────────
	if topology := getRunnerTopology(config.WorkflowData); topology != "" {
		awfConfig.Runner = &AWFRunnerConfig{Topology: topology}
		awfConfigLog.Printf("Runner section: topology=%s", topology)
	}

	// ── Network section ──────────────────────────────────────────────────────
	if config.AllowedDomains != "" {
		allowList := splitDomainList(config.AllowedDomains)
		awfConfig.Network = &AWFNetworkConfig{
			AllowDomains: allowList,
		}
		awfConfigLog.Printf("Network section: %d allowed domains", len(allowList))

		// Blocked domains (if configured in the workflow)
		if config.WorkflowData != nil {
			blockedDomainsStr := formatBlockedDomains(config.WorkflowData.NetworkPermissions)
			if blockedDomainsStr != "" {
				blockList := splitDomainList(blockedDomainsStr)
				awfConfig.Network.BlockDomains = blockList
				awfConfigLog.Printf("Network section: %d blocked domains", len(blockList))
			}
		}
	}

	if isAWFNetworkIsolationEnabled(config.WorkflowData) {
		if awfConfig.Network == nil {
			awfConfig.Network = &AWFNetworkConfig{}
		}
		awfConfig.Network.Isolation = true
		awfConfig.Network.TopologyAttach = buildAWFTopologyAttachList(config.WorkflowData)
		awfConfigLog.Printf("Network section: isolation enabled with %d topology attachments", len(awfConfig.Network.TopologyAttach))
	}

	if platformType := extractPlatformType(config.WorkflowData); platformType != "" {
		awfConfig.Platform = &AWFPlatformConfig{Type: platformType}
		awfConfigLog.Printf("Platform section: type=%s", platformType)
	}

	// ── API proxy section ─────────────────────────────────────────────────────
	// maxAICredits is taken from frontmatter/imports only; when unset (0) the
	// runtime value is resolved from vars.GH_AW_DEFAULT_MAX_AI_CREDITS via a
	// GitHub Actions expression injected directly into the JSON string in
	// BuildAWFCommand (see injectMaxAICreditsExpression in awf_helpers.go).
	maxAICredits := int64(0)
	maxRuns := constants.DefaultMaxRuns
	// GetMaxTurnCacheMisses handles nil receiver and env-var fallback, so pre-init
	// via the nil receiver avoids a redundant os.Getenv when EngineConfig is set.