Function generateCacheMemoryGitSetupStep

pkg/workflow/cache.go:612–630

generateCacheMemoryGitSetupStep emits a pre-agent step that sets up the git-backed integrity repository inside the given cache directory. It must run after the cache is restored so that any previous git history is available for the merge-down step. The step also performs pre-agent security sanitizat

(builder *strings.Builder, cache CacheMemoryEntry, cacheDir, integrityLevel string, useBackwardCompatiblePaths bool)

// working-tree files and, when allowed extensions are configured, removes files with
// disallowed extensions before the agent can access them.
func generateCacheMemoryGitSetupStep(builder *strings.Builder, cache CacheMemoryEntry, cacheDir, integrityLevel string, useBackwardCompatiblePaths bool) {
	if useBackwardCompatiblePaths {
		builder.WriteString("      - name: Setup cache-memory git repository\n")
	} else {
		fmt.Fprintf(builder, "      - name: Setup cache-memory git repository (%s)\n", cache.ID)
	}
	builder.WriteString("        env:\n")
	fmt.Fprintf(builder, "          GH_AW_CACHE_DIR: %s\n", cacheDir)
	fmt.Fprintf(builder, "          GH_AW_MIN_INTEGRITY: %s\n", integrityLevel)
	// Pass colon-separated allowed extensions so the setup script can remove disallowed files
	// before the agent runs (pre-agent sanitization). Skip when the list is empty (allow all).
	// Single quotes in the value are escaped ('' in YAML single-quoted scalars) as defense-in-depth,
	// even though isValidFileExtension already rejects values containing single quotes at parse time.
	if len(cache.AllowedExtensions) > 0 {
		escaped := strings.ReplaceAll(strings.Join(cache.AllowedExtensions, ":"), "'", "''")
		fmt.Fprintf(builder, "          GH_AW_ALLOWED_EXTENSIONS: '%s'\n", escaped)
	}
	builder.WriteString("        run: bash \"${RUNNER_TEMP}/gh-aw/actions/setup_cache_memory_git.sh\"\n")
}

// generateCacheMemoryGitCommitSteps emits post-agent steps that commit agent-written changes
// to the current integrity branch. These steps run after agent execution and before artifact