[Parent] MCPG infrastructure and safe-output tooling improvements

[github-actions]

Umbrella tracking issue for bugs and improvements spanning the MCP Gateway (MCPG) infrastructure and the safe-output tool implementations — the two subsystems that form the agent tooling layer.

MCPG infrastructure

Issues with how ado-aw generates and wires the MCPG container step, and how failures are surfaced:

• MCPG step fails with docker: invalid reference format. — extra \ \ after -e ADO_MCP_AUTH_TOKEN in generated YAML (v0.36.0) #1034 — MCPG step fails with docker: invalid reference format (extra \\ after -e ADO_MCP_AUTH_TOKEN in generated YAML)
• Custom MCP container env passthrough never reaches the server (step env mapping missing) #945 — Custom MCP container env passthrough never reaches the server (step env mapping missing)
• debug: Noop smoke pipeline fails to pull non-existent ghcr.io/github/gh-aw-mcpg:v0.3.7 (manifest unknown) #621 — Noop smoke pipeline fails to pull non-existent ghcr.io/github/gh-aw-mcpg:v0.3.7 (manifest unknown)
• feat: surface MCPG backend failures in pipeline logs #254 — feat: surface MCPG backend failures in pipeline logs

Safe-output tooling

Bugs and improvements in the safe-output tool implementations that agents use to propose write actions:

• add-pr-comment: render inline threads as applyable single/multi-line suggestions #1103 — add-pr-comment: render inline threads as applyable single/multi-line suggestions
• fix(safe-outputs): add file staging to upload-workitem-attachment #381 — fix(safe-outputs): add file staging to upload-workitem-attachment
• debug: upload-pipeline-artifact fails with ContainerWriteAccessDeniedException when uploading to other builds #471 — upload-pipeline-artifact fails with ContainerWriteAccessDeniedException when uploading to other builds

Generated by Issue Arborist · 61.8 AIC · ⌖ 6.99 AIC · ⊞ 6K · ◷