Method GetExecutionSteps

pkg/workflow/pi_engine.go:290–530

GetExecutionSteps returns the GitHub Actions steps for executing the Pi CLI. The prompt is piped to Pi via stdin; streaming JSON events are written to PiStreamingLogFile for post-run analysis and step summary rendering.

(workflowData *WorkflowData, logFile string)

// The prompt is piped to Pi via stdin; streaming JSON events are written to
// PiStreamingLogFile for post-run analysis and step summary rendering.
func (e *PiEngine) GetExecutionSteps(workflowData *WorkflowData, logFile string) []GitHubActionStep {
	piLog.Printf("Generating execution steps for Pi engine: workflow=%s, firewall=%v",
		workflowData.Name, isFirewallEnabled(workflowData))

	commandName := "pi"
	if workflowData.EngineConfig != nil && workflowData.EngineConfig.Command != "" {
		commandName = workflowData.EngineConfig.Command
	}

	// Resolve backend and profile early so we can use them when building piArgs.
	modelConfigured := workflowData.EngineConfig != nil && workflowData.EngineConfig.Model != ""
	backend := resolvePiBackend(workflowData)
	profile := getUniversalLLMBackendProfile(backend, hasCopilotRequestsWritePermission(workflowData))
	firewallEnabled := isFirewallEnabled(workflowData)

	// When engine.driver is set, run the driver script directly instead of the pi CLI.
	driverConfigured := workflowData.EngineConfig != nil && workflowData.EngineConfig.Driver != ""

	// Build the pi command.  Pi v0.72+ uses flags-only syntax (no "run" subcommand).
	// --print: non-interactive, process prompt from stdin and exit.
	// --mode json: emit structured JSONL events to stdout.
	// --no-session: don't persist a session file (appropriate for CI).
	piArgs := []string{"--print", "--mode", "json", "--no-session"}

	// Append any user-supplied extra args from engine.args
	if workflowData.EngineConfig != nil {
		piArgs = append(piArgs, filterPiArgs(workflowData.EngineConfig.Args)...)
	}

	// Pi v0.72+ does not support a PI_MODEL env var for CLI model selection; the model must be passed as
	// the --model CLI flag.  When the firewall is enabled we route LLM traffic
	// through the AWF gateway sidecar by generating a temporary models.json that
	// registers a custom "aw-gateway" provider pointing at the gateway port.  When
	// the firewall is disabled we use Pi's built-in provider directly.
	var piModelsJSONSetup string // shell fragment prepended to piCommand when needed
	if modelConfigured {
		modelID := extractPiModelID(workflowData.EngineConfig.Model)

		// Determine the env var name to use as the "apiKey" in the models.json gateway
		// config. Pi's resolveConfigValue() reads process.env[apiKey] at runtime to
		// obtain the actual token value.
		gatewaySecretEnvVar := resolvePiGatewaySecretEnvVar(profile, backend)

		if firewallEnabled {
			// Pi + firewall must always route through aw-gateway/models.json. Native
			// provider resolution bypasses the gateway and is incompatible with this mode.
			if gatewaySecretEnvVar == "" {
				piLog.Printf("Pi: no gateway apiKey env resolved for backend=%s; defaulting to COPILOT_GITHUB_TOKEN", backend)
				gatewaySecretEnvVar = "COPILOT_GITHUB_TOKEN"
			}

			// Firewall case: write a models.json that redirects Pi's LLM calls to the
			// AWF gateway sidecar port.  The "apiKey" field value is the name of the env
			// var that holds the secret; Pi's resolveConfigValue() looks up
			// process.env[apiKey] to obtain the actual token value at runtime.
			//
			// printf '%s\n' '<json>' is safe here because JSON uses only double quotes
			// (never single quotes), so single-quoting via shellEscapeArg requires no