generateAWFInstallationStep creates a GitHub Actions step to install the AWF binary with SHA256 checksum verification to protect against supply chain attacks. The installation logic is implemented in a separate shell script (install_awf_binary.sh) which downloads the binary directly from GitHub rel
(version string, agentConfig *AgentSandboxConfig)
| 284 | // If a custom command is specified in the agent config, the installation is skipped |
| 285 | // as the custom command replaces the AWF binary. |
| 286 | func generateAWFInstallationStep(version string, agentConfig *AgentSandboxConfig) GitHubActionStep { |
| 287 | // If custom command is specified, skip installation (command replaces binary) |
| 288 | if agentConfig != nil && agentConfig.Command != "" { |
| 289 | copilotInstallLog.Print("Skipping AWF binary installation (custom command specified)") |
| 290 | // Return empty step - custom command will be used in execution |
| 291 | return GitHubActionStep([]string{}) |
| 292 | } |
| 293 | |
| 294 | // Use default version for logging when not specified |
| 295 | if version == "" { |
| 296 | version = string(constants.DefaultFirewallVersion) |
| 297 | } |
| 298 | |
| 299 | installCmd := "bash \"${RUNNER_TEMP}/gh-aw/actions/install_awf_binary.sh\" " + version |
| 300 | // When sudo is false (network isolation mode), AWF runs rootless: pass --rootless |
| 301 | // so the install script installs into $HOME/.local/{bin,lib/awf} (always writable, |
| 302 | // even on standard GitHub-hosted runners where /usr/local is root-owned) and exports |
| 303 | // $GITHUB_PATH so the bare awf invocation in later steps resolves correctly. |
| 304 | // Also check Disabled to match isAWFNetworkIsolationEnabled() behavior. |
| 305 | if agentConfig != nil && agentConfig.NetworkIsolation && !agentConfig.Disabled { |
| 306 | installCmd += " --rootless" |
| 307 | } |
| 308 | |
| 309 | stepLines := []string{ |
| 310 | " - name: Install AWF binary", |
| 311 | " run: " + installCmd, |
| 312 | } |
| 313 | |
| 314 | return GitHubActionStep(stepLines) |
| 315 | } |
| 316 | |
| 317 | // generateDockerComposeInstallStep creates a step that installs the Docker Compose |
| 318 | // CLI plugin. ARC/DinD runners may not have Docker Compose pre-installed, but AWF |