From 54543d0c4ee414366a129d679ec126573d899a52 Mon Sep 17 00:00:00 2001 From: Efra Espada Date: Thu, 29 Oct 2026 19:07:51 +0100 Subject: [PATCH 1/4] bugfix-775-private-verification-home-does-not-redirect-jvmgradle-account-level-configuration: isolate JVM and Gradle verification homes (#775) --- .copilot/AGENT_GUIDE.md | 2 +- .copilot/setup-manifest.json | 2 +- .github/workflows/copilot_comment_runtime.yml | 40 + .github/workflows/setup_platform_smoke.yml | 794 ++++-------------- build/cli/index.js | 85 +- build/github_action/index.js | 93 +- .../operations/verification.mdx | 24 +- scripts/coverage-budgets.json | 22 + ...generate-native-verification-workflows.cjs | 2 +- specs/CATALOG.md | 24 +- specs/agent-execution-policy-hardening.md | 9 + specs/catalog.json | 27 +- ...tory-verification-runtime-prerequisites.md | 197 ++++- specs/repository-verification-setup-hooks.md | 11 + .../repository_agent_guidance_policy.ts | 2 +- .../__tests__/git_commit_adapter.test.ts | 36 + .../native_verification_controller.test.ts | 33 +- .../native_verification_workflow.test.ts | 16 +- .../__tests__/private_jvm_environment.test.ts | 104 +++ .../untrusted_command_environment.test.ts | 4 +- .../native_verification_controller.ts | 9 +- src/infrastructure/private_jvm_environment.ts | 10 + .../untrusted_command_environment.ts | 52 +- ...rification_jvm_gradle_container_fixture.ts | 49 ++ .../verification_jvm_gradle_probe.cjs | 94 +++ .../fixtures/verification_native_fixture.ts | 33 +- 26 files changed, 1037 insertions(+), 737 deletions(-) create mode 100644 src/infrastructure/__tests__/private_jvm_environment.test.ts create mode 100644 src/infrastructure/private_jvm_environment.ts create mode 100644 src/tooling/__tests__/fixtures/verification_jvm_gradle_container_fixture.ts create mode 100644 src/tooling/__tests__/fixtures/verification_jvm_gradle_probe.cjs diff --git a/.copilot/AGENT_GUIDE.md b/.copilot/AGENT_GUIDE.md index 1da6dcf81..866b3b577 100644 --- a/.copilot/AGENT_GUIDE.md +++ b/.copilot/AGENT_GUIDE.md @@ -49,7 +49,7 @@ Never expose credentials, tokens, private keys, or other secrets in issues, comm The setup runner profile selects placement; it does not install the project's language runtimes. An operator must provision the project's required runtimes and dependencies in every job that runs file-changing or branch-sync verification, before the Copilot step. A separate application CI job does not prepare this job. -Declare reviewed version prefixes in `.copilot/verification-prerequisites.json` (schemaVersion 1, runtimes such as java 17, node 24, pnpm 10). Copilot checks declared versions in the credential-free verification environment before each configured verification command; a missing or incompatible runtime blocks publication. Without this optional declaration, existing verification behavior remains and no language is inferred. Java provisioning may use `actions/setup-java`; `JAVA_HOME` and `PATH` survive isolation, while agent credentials and tool-option injection variables do not. Do not add an unreviewed bootstrap or weaken verification to work around a missing runtime. Read [verification prerequisites and same-job setup](https://docs.page/vypdev/copilot/security-operations/operations/verification#repository-verification-prerequisites). +Declare reviewed version prefixes in `.copilot/verification-prerequisites.json` (schemaVersion 1, runtimes such as java 17, node 24, pnpm 10). Copilot checks declared versions in the credential-free verification environment before each configured verification command; a missing or incompatible runtime blocks publication. Without this optional declaration, existing verification behavior remains and no language is inferred. Java provisioning may use `actions/setup-java`; `JAVA_HOME` and `PATH` survive isolation. Repository verification derives `JDK_JAVA_OPTIONS` for its private JVM user.home and `GRADLE_USER_HOME` inside the same fresh profile; inherited tool options, account caches and agent credentials remain excluded. Do not add an unreviewed bootstrap or weaken verification to work around a missing runtime. Read [verification prerequisites and same-job setup](https://docs.page/vypdev/copilot/security-operations/operations/verification#repository-verification-prerequisites). The optional repository-owned composite action prepares each candidate before verification. Setup creates .github/actions/copilot-verification-setup/action.yml only if missing and preserves an existing consumer action and its assets. The shared terminal/web assistant offers explicit activation, disabled by default. Customize the generated failing placeholder before enabling; setup generation and installer PRs do not prove runtime readiness. Review `.github/actions/copilot-verification-setup/action.yml` and its assets onto trusted main, update generated workflows, then enable `VERIFICATION_SETUP=true` (Action input `verification-setup`, disabled by default). GitHub Actions executes the trusted snapshot before each command with a fresh private HOME; candidate changes cannot replace it. Native post steps finish before profile cleanup. Setup failure blocks verification and commit/push. The local CLI cannot execute composite actions and fails closed when opted in. Read [repository-owned setup](https://docs.page/vypdev/copilot/security-operations/operations/verification#repository-owned-setup). diff --git a/.copilot/setup-manifest.json b/.copilot/setup-manifest.json index dd9956cc0..ad3cc1ab1 100644 --- a/.copilot/setup-manifest.json +++ b/.copilot/setup-manifest.json @@ -12,7 +12,7 @@ }, ".copilot/AGENT_GUIDE.md": { "role": "guide", - "sha256": "c3bd0df4bfdcbba2a007b1596a93480a3bb3145a6285e0a91809f3a93c3fbcd0" + "sha256": "2e9f977122b9fcb1d6cf12bb6fac4bb500691797f425c2acd802ede354a06075" }, ".copilot/repository-profile.json": { "role": "profile", diff --git a/.github/workflows/copilot_comment_runtime.yml b/.github/workflows/copilot_comment_runtime.yml index ecd38d14f..e656b8101 100644 --- a/.github/workflows/copilot_comment_runtime.yml +++ b/.github/workflows/copilot_comment_runtime.yml @@ -177,6 +177,8 @@ jobs: LOCALAPPDATA: ${{ steps.copilot.outputs.verification-localappdata }} PATH: ${{ steps.copilot.outputs.verification-path }} JAVA_HOME: ${{ steps.copilot.outputs.verification-java_home }} + JDK_JAVA_OPTIONS: ${{ steps.copilot.outputs.verification-jdk_java_options }} + GRADLE_USER_HOME: ${{ steps.copilot.outputs.verification-gradle_user_home }} TMP: ${{ steps.copilot.outputs.verification-tmp }} TEMP: ${{ steps.copilot.outputs.verification-temp }} TMPDIR: ${{ steps.copilot.outputs.verification-tmpdir }} @@ -205,6 +207,8 @@ jobs: LOCALAPPDATA: ${{ steps.verification_continue_1.outputs.verification-localappdata }} PATH: ${{ steps.verification_continue_1.outputs.verification-path }} JAVA_HOME: ${{ steps.verification_continue_1.outputs.verification-java_home }} + JDK_JAVA_OPTIONS: ${{ steps.verification_continue_1.outputs.verification-jdk_java_options }} + GRADLE_USER_HOME: ${{ steps.verification_continue_1.outputs.verification-gradle_user_home }} TMP: ${{ steps.verification_continue_1.outputs.verification-tmp }} TEMP: ${{ steps.verification_continue_1.outputs.verification-temp }} TMPDIR: ${{ steps.verification_continue_1.outputs.verification-tmpdir }} @@ -233,6 +237,8 @@ jobs: LOCALAPPDATA: ${{ steps.verification_continue_2.outputs.verification-localappdata }} PATH: ${{ steps.verification_continue_2.outputs.verification-path }} JAVA_HOME: ${{ steps.verification_continue_2.outputs.verification-java_home }} + JDK_JAVA_OPTIONS: ${{ steps.verification_continue_2.outputs.verification-jdk_java_options }} + GRADLE_USER_HOME: ${{ steps.verification_continue_2.outputs.verification-gradle_user_home }} TMP: ${{ steps.verification_continue_2.outputs.verification-tmp }} TEMP: ${{ steps.verification_continue_2.outputs.verification-temp }} TMPDIR: ${{ steps.verification_continue_2.outputs.verification-tmpdir }} @@ -261,6 +267,8 @@ jobs: LOCALAPPDATA: ${{ steps.verification_continue_3.outputs.verification-localappdata }} PATH: ${{ steps.verification_continue_3.outputs.verification-path }} JAVA_HOME: ${{ steps.verification_continue_3.outputs.verification-java_home }} + JDK_JAVA_OPTIONS: ${{ steps.verification_continue_3.outputs.verification-jdk_java_options }} + GRADLE_USER_HOME: ${{ steps.verification_continue_3.outputs.verification-gradle_user_home }} TMP: ${{ steps.verification_continue_3.outputs.verification-tmp }} TEMP: ${{ steps.verification_continue_3.outputs.verification-temp }} TMPDIR: ${{ steps.verification_continue_3.outputs.verification-tmpdir }} @@ -289,6 +297,8 @@ jobs: LOCALAPPDATA: ${{ steps.verification_continue_4.outputs.verification-localappdata }} PATH: ${{ steps.verification_continue_4.outputs.verification-path }} JAVA_HOME: ${{ steps.verification_continue_4.outputs.verification-java_home }} + JDK_JAVA_OPTIONS: ${{ steps.verification_continue_4.outputs.verification-jdk_java_options }} + GRADLE_USER_HOME: ${{ steps.verification_continue_4.outputs.verification-gradle_user_home }} TMP: ${{ steps.verification_continue_4.outputs.verification-tmp }} TEMP: ${{ steps.verification_continue_4.outputs.verification-temp }} TMPDIR: ${{ steps.verification_continue_4.outputs.verification-tmpdir }} @@ -317,6 +327,8 @@ jobs: LOCALAPPDATA: ${{ steps.verification_continue_5.outputs.verification-localappdata }} PATH: ${{ steps.verification_continue_5.outputs.verification-path }} JAVA_HOME: ${{ steps.verification_continue_5.outputs.verification-java_home }} + JDK_JAVA_OPTIONS: ${{ steps.verification_continue_5.outputs.verification-jdk_java_options }} + GRADLE_USER_HOME: ${{ steps.verification_continue_5.outputs.verification-gradle_user_home }} TMP: ${{ steps.verification_continue_5.outputs.verification-tmp }} TEMP: ${{ steps.verification_continue_5.outputs.verification-temp }} TMPDIR: ${{ steps.verification_continue_5.outputs.verification-tmpdir }} @@ -345,6 +357,8 @@ jobs: LOCALAPPDATA: ${{ steps.verification_continue_6.outputs.verification-localappdata }} PATH: ${{ steps.verification_continue_6.outputs.verification-path }} JAVA_HOME: ${{ steps.verification_continue_6.outputs.verification-java_home }} + JDK_JAVA_OPTIONS: ${{ steps.verification_continue_6.outputs.verification-jdk_java_options }} + GRADLE_USER_HOME: ${{ steps.verification_continue_6.outputs.verification-gradle_user_home }} TMP: ${{ steps.verification_continue_6.outputs.verification-tmp }} TEMP: ${{ steps.verification_continue_6.outputs.verification-temp }} TMPDIR: ${{ steps.verification_continue_6.outputs.verification-tmpdir }} @@ -373,6 +387,8 @@ jobs: LOCALAPPDATA: ${{ steps.verification_continue_7.outputs.verification-localappdata }} PATH: ${{ steps.verification_continue_7.outputs.verification-path }} JAVA_HOME: ${{ steps.verification_continue_7.outputs.verification-java_home }} + JDK_JAVA_OPTIONS: ${{ steps.verification_continue_7.outputs.verification-jdk_java_options }} + GRADLE_USER_HOME: ${{ steps.verification_continue_7.outputs.verification-gradle_user_home }} TMP: ${{ steps.verification_continue_7.outputs.verification-tmp }} TEMP: ${{ steps.verification_continue_7.outputs.verification-temp }} TMPDIR: ${{ steps.verification_continue_7.outputs.verification-tmpdir }} @@ -401,6 +417,8 @@ jobs: LOCALAPPDATA: ${{ steps.verification_continue_8.outputs.verification-localappdata }} PATH: ${{ steps.verification_continue_8.outputs.verification-path }} JAVA_HOME: ${{ steps.verification_continue_8.outputs.verification-java_home }} + JDK_JAVA_OPTIONS: ${{ steps.verification_continue_8.outputs.verification-jdk_java_options }} + GRADLE_USER_HOME: ${{ steps.verification_continue_8.outputs.verification-gradle_user_home }} TMP: ${{ steps.verification_continue_8.outputs.verification-tmp }} TEMP: ${{ steps.verification_continue_8.outputs.verification-temp }} TMPDIR: ${{ steps.verification_continue_8.outputs.verification-tmpdir }} @@ -429,6 +447,8 @@ jobs: LOCALAPPDATA: ${{ steps.verification_continue_9.outputs.verification-localappdata }} PATH: ${{ steps.verification_continue_9.outputs.verification-path }} JAVA_HOME: ${{ steps.verification_continue_9.outputs.verification-java_home }} + JDK_JAVA_OPTIONS: ${{ steps.verification_continue_9.outputs.verification-jdk_java_options }} + GRADLE_USER_HOME: ${{ steps.verification_continue_9.outputs.verification-gradle_user_home }} TMP: ${{ steps.verification_continue_9.outputs.verification-tmp }} TEMP: ${{ steps.verification_continue_9.outputs.verification-temp }} TMPDIR: ${{ steps.verification_continue_9.outputs.verification-tmpdir }} @@ -457,6 +477,8 @@ jobs: LOCALAPPDATA: ${{ steps.verification_continue_10.outputs.verification-localappdata }} PATH: ${{ steps.verification_continue_10.outputs.verification-path }} JAVA_HOME: ${{ steps.verification_continue_10.outputs.verification-java_home }} + JDK_JAVA_OPTIONS: ${{ steps.verification_continue_10.outputs.verification-jdk_java_options }} + GRADLE_USER_HOME: ${{ steps.verification_continue_10.outputs.verification-gradle_user_home }} TMP: ${{ steps.verification_continue_10.outputs.verification-tmp }} TEMP: ${{ steps.verification_continue_10.outputs.verification-temp }} TMPDIR: ${{ steps.verification_continue_10.outputs.verification-tmpdir }} @@ -485,6 +507,8 @@ jobs: LOCALAPPDATA: ${{ steps.verification_continue_11.outputs.verification-localappdata }} PATH: ${{ steps.verification_continue_11.outputs.verification-path }} JAVA_HOME: ${{ steps.verification_continue_11.outputs.verification-java_home }} + JDK_JAVA_OPTIONS: ${{ steps.verification_continue_11.outputs.verification-jdk_java_options }} + GRADLE_USER_HOME: ${{ steps.verification_continue_11.outputs.verification-gradle_user_home }} TMP: ${{ steps.verification_continue_11.outputs.verification-tmp }} TEMP: ${{ steps.verification_continue_11.outputs.verification-temp }} TMPDIR: ${{ steps.verification_continue_11.outputs.verification-tmpdir }} @@ -513,6 +537,8 @@ jobs: LOCALAPPDATA: ${{ steps.verification_continue_12.outputs.verification-localappdata }} PATH: ${{ steps.verification_continue_12.outputs.verification-path }} JAVA_HOME: ${{ steps.verification_continue_12.outputs.verification-java_home }} + JDK_JAVA_OPTIONS: ${{ steps.verification_continue_12.outputs.verification-jdk_java_options }} + GRADLE_USER_HOME: ${{ steps.verification_continue_12.outputs.verification-gradle_user_home }} TMP: ${{ steps.verification_continue_12.outputs.verification-tmp }} TEMP: ${{ steps.verification_continue_12.outputs.verification-temp }} TMPDIR: ${{ steps.verification_continue_12.outputs.verification-tmpdir }} @@ -541,6 +567,8 @@ jobs: LOCALAPPDATA: ${{ steps.verification_continue_13.outputs.verification-localappdata }} PATH: ${{ steps.verification_continue_13.outputs.verification-path }} JAVA_HOME: ${{ steps.verification_continue_13.outputs.verification-java_home }} + JDK_JAVA_OPTIONS: ${{ steps.verification_continue_13.outputs.verification-jdk_java_options }} + GRADLE_USER_HOME: ${{ steps.verification_continue_13.outputs.verification-gradle_user_home }} TMP: ${{ steps.verification_continue_13.outputs.verification-tmp }} TEMP: ${{ steps.verification_continue_13.outputs.verification-temp }} TMPDIR: ${{ steps.verification_continue_13.outputs.verification-tmpdir }} @@ -569,6 +597,8 @@ jobs: LOCALAPPDATA: ${{ steps.verification_continue_14.outputs.verification-localappdata }} PATH: ${{ steps.verification_continue_14.outputs.verification-path }} JAVA_HOME: ${{ steps.verification_continue_14.outputs.verification-java_home }} + JDK_JAVA_OPTIONS: ${{ steps.verification_continue_14.outputs.verification-jdk_java_options }} + GRADLE_USER_HOME: ${{ steps.verification_continue_14.outputs.verification-gradle_user_home }} TMP: ${{ steps.verification_continue_14.outputs.verification-tmp }} TEMP: ${{ steps.verification_continue_14.outputs.verification-temp }} TMPDIR: ${{ steps.verification_continue_14.outputs.verification-tmpdir }} @@ -597,6 +627,8 @@ jobs: LOCALAPPDATA: ${{ steps.verification_continue_15.outputs.verification-localappdata }} PATH: ${{ steps.verification_continue_15.outputs.verification-path }} JAVA_HOME: ${{ steps.verification_continue_15.outputs.verification-java_home }} + JDK_JAVA_OPTIONS: ${{ steps.verification_continue_15.outputs.verification-jdk_java_options }} + GRADLE_USER_HOME: ${{ steps.verification_continue_15.outputs.verification-gradle_user_home }} TMP: ${{ steps.verification_continue_15.outputs.verification-tmp }} TEMP: ${{ steps.verification_continue_15.outputs.verification-temp }} TMPDIR: ${{ steps.verification_continue_15.outputs.verification-tmpdir }} @@ -625,6 +657,8 @@ jobs: LOCALAPPDATA: ${{ steps.verification_continue_16.outputs.verification-localappdata }} PATH: ${{ steps.verification_continue_16.outputs.verification-path }} JAVA_HOME: ${{ steps.verification_continue_16.outputs.verification-java_home }} + JDK_JAVA_OPTIONS: ${{ steps.verification_continue_16.outputs.verification-jdk_java_options }} + GRADLE_USER_HOME: ${{ steps.verification_continue_16.outputs.verification-gradle_user_home }} TMP: ${{ steps.verification_continue_16.outputs.verification-tmp }} TEMP: ${{ steps.verification_continue_16.outputs.verification-temp }} TMPDIR: ${{ steps.verification_continue_16.outputs.verification-tmpdir }} @@ -653,6 +687,8 @@ jobs: LOCALAPPDATA: ${{ steps.verification_continue_17.outputs.verification-localappdata }} PATH: ${{ steps.verification_continue_17.outputs.verification-path }} JAVA_HOME: ${{ steps.verification_continue_17.outputs.verification-java_home }} + JDK_JAVA_OPTIONS: ${{ steps.verification_continue_17.outputs.verification-jdk_java_options }} + GRADLE_USER_HOME: ${{ steps.verification_continue_17.outputs.verification-gradle_user_home }} TMP: ${{ steps.verification_continue_17.outputs.verification-tmp }} TEMP: ${{ steps.verification_continue_17.outputs.verification-temp }} TMPDIR: ${{ steps.verification_continue_17.outputs.verification-tmpdir }} @@ -681,6 +717,8 @@ jobs: LOCALAPPDATA: ${{ steps.verification_continue_18.outputs.verification-localappdata }} PATH: ${{ steps.verification_continue_18.outputs.verification-path }} JAVA_HOME: ${{ steps.verification_continue_18.outputs.verification-java_home }} + JDK_JAVA_OPTIONS: ${{ steps.verification_continue_18.outputs.verification-jdk_java_options }} + GRADLE_USER_HOME: ${{ steps.verification_continue_18.outputs.verification-gradle_user_home }} TMP: ${{ steps.verification_continue_18.outputs.verification-tmp }} TEMP: ${{ steps.verification_continue_18.outputs.verification-temp }} TMPDIR: ${{ steps.verification_continue_18.outputs.verification-tmpdir }} @@ -709,6 +747,8 @@ jobs: LOCALAPPDATA: ${{ steps.verification_continue_19.outputs.verification-localappdata }} PATH: ${{ steps.verification_continue_19.outputs.verification-path }} JAVA_HOME: ${{ steps.verification_continue_19.outputs.verification-java_home }} + JDK_JAVA_OPTIONS: ${{ steps.verification_continue_19.outputs.verification-jdk_java_options }} + GRADLE_USER_HOME: ${{ steps.verification_continue_19.outputs.verification-gradle_user_home }} TMP: ${{ steps.verification_continue_19.outputs.verification-tmp }} TEMP: ${{ steps.verification_continue_19.outputs.verification-temp }} TMPDIR: ${{ steps.verification_continue_19.outputs.verification-tmpdir }} diff --git a/.github/workflows/setup_platform_smoke.yml b/.github/workflows/setup_platform_smoke.yml index ce5b4731e..b67a94421 100644 --- a/.github/workflows/setup_platform_smoke.yml +++ b/.github/workflows/setup_platform_smoke.yml @@ -67,10 +67,12 @@ jobs: uses: ./.github/actions/copilot-native-cleanup-check - name: Build native verification acceptance fixture run: pnpm exec ncc build src/tooling/__tests__/fixtures/verification_native_fixture.ts -o .github/actions/copilot-native-fixture/dist - - name: Snapshot native fixture runtime + - &native_prepare_native_fixture_runtime + name: Snapshot native fixture runtime id: prepare_native_fixture_runtime run: node scripts/prepare-native-source-action.cjs --fixture - - name: Prepare native verification acceptance + - &native_copilot_native_fixture + name: Prepare native verification acceptance id: copilot_native_fixture uses: ./../.copilot-native-fixture-runtime with: &native-fixture-inputs @@ -78,7 +80,8 @@ jobs: env: COPILOT_NATIVE_PHASE: prepare COPILOT_NATIVE_RUNTIME_CACHE: ${{ steps.prepare_native_fixture_runtime.outputs.path }} - - name: Prepare repository verification 1 + - &native_verification_setup_1 + name: Prepare repository verification 1 id: verification_setup_1 if: ${{ !cancelled() && steps.copilot_native_fixture.outcome == 'success' && steps.copilot_native_fixture.outputs.verification-setup-pending == 'true' }} uses: ./.git/copilot-verification-setup @@ -90,10 +93,13 @@ jobs: LOCALAPPDATA: ${{ steps.copilot_native_fixture.outputs.verification-localappdata }} PATH: ${{ steps.copilot_native_fixture.outputs.verification-path }} JAVA_HOME: ${{ steps.copilot_native_fixture.outputs.verification-java_home }} + JDK_JAVA_OPTIONS: ${{ steps.copilot_native_fixture.outputs.verification-jdk_java_options }} + GRADLE_USER_HOME: ${{ steps.copilot_native_fixture.outputs.verification-gradle_user_home }} TMP: ${{ steps.copilot_native_fixture.outputs.verification-tmp }} TEMP: ${{ steps.copilot_native_fixture.outputs.verification-temp }} TMPDIR: ${{ steps.copilot_native_fixture.outputs.verification-tmpdir }} - - name: Continue repository verification 1 + - &native_verification_continue_1 + name: Continue repository verification 1 id: verification_continue_1 if: ${{ always() && steps.copilot_native_fixture.outputs.verification-setup-pending == 'true' }} uses: ./../.copilot-native-fixture-runtime @@ -106,7 +112,8 @@ jobs: COPILOT_NATIVE_TICKET: ${{ steps.copilot_native_fixture.outputs.verification-ticket }} COPILOT_NATIVE_REQUEST: ${{ steps.copilot_native_fixture.outputs.verification-request }} COPILOT_NATIVE_OUTCOME: ${{ steps.verification_setup_1.outcome }} - - name: Prepare repository verification 2 + - &native_verification_setup_2 + name: Prepare repository verification 2 id: verification_setup_2 if: ${{ !cancelled() && steps.verification_continue_1.outcome == 'success' && steps.verification_continue_1.outputs.verification-setup-pending == 'true' }} uses: ./.git/copilot-verification-setup @@ -118,10 +125,13 @@ jobs: LOCALAPPDATA: ${{ steps.verification_continue_1.outputs.verification-localappdata }} PATH: ${{ steps.verification_continue_1.outputs.verification-path }} JAVA_HOME: ${{ steps.verification_continue_1.outputs.verification-java_home }} + JDK_JAVA_OPTIONS: ${{ steps.verification_continue_1.outputs.verification-jdk_java_options }} + GRADLE_USER_HOME: ${{ steps.verification_continue_1.outputs.verification-gradle_user_home }} TMP: ${{ steps.verification_continue_1.outputs.verification-tmp }} TEMP: ${{ steps.verification_continue_1.outputs.verification-temp }} TMPDIR: ${{ steps.verification_continue_1.outputs.verification-tmpdir }} - - name: Continue repository verification 2 + - &native_verification_continue_2 + name: Continue repository verification 2 id: verification_continue_2 if: ${{ always() && steps.verification_continue_1.outputs.verification-setup-pending == 'true' }} uses: ./../.copilot-native-fixture-runtime @@ -134,7 +144,8 @@ jobs: COPILOT_NATIVE_TICKET: ${{ steps.copilot_native_fixture.outputs.verification-ticket }} COPILOT_NATIVE_REQUEST: ${{ steps.verification_continue_1.outputs.verification-request }} COPILOT_NATIVE_OUTCOME: ${{ steps.verification_setup_2.outcome }} - - name: Prepare repository verification 3 + - &native_verification_setup_3 + name: Prepare repository verification 3 id: verification_setup_3 if: ${{ !cancelled() && steps.verification_continue_2.outcome == 'success' && steps.verification_continue_2.outputs.verification-setup-pending == 'true' }} uses: ./.git/copilot-verification-setup @@ -146,10 +157,13 @@ jobs: LOCALAPPDATA: ${{ steps.verification_continue_2.outputs.verification-localappdata }} PATH: ${{ steps.verification_continue_2.outputs.verification-path }} JAVA_HOME: ${{ steps.verification_continue_2.outputs.verification-java_home }} + JDK_JAVA_OPTIONS: ${{ steps.verification_continue_2.outputs.verification-jdk_java_options }} + GRADLE_USER_HOME: ${{ steps.verification_continue_2.outputs.verification-gradle_user_home }} TMP: ${{ steps.verification_continue_2.outputs.verification-tmp }} TEMP: ${{ steps.verification_continue_2.outputs.verification-temp }} TMPDIR: ${{ steps.verification_continue_2.outputs.verification-tmpdir }} - - name: Continue repository verification 3 + - &native_verification_continue_3 + name: Continue repository verification 3 id: verification_continue_3 if: ${{ always() && steps.verification_continue_2.outputs.verification-setup-pending == 'true' }} uses: ./../.copilot-native-fixture-runtime @@ -162,7 +176,8 @@ jobs: COPILOT_NATIVE_TICKET: ${{ steps.copilot_native_fixture.outputs.verification-ticket }} COPILOT_NATIVE_REQUEST: ${{ steps.verification_continue_2.outputs.verification-request }} COPILOT_NATIVE_OUTCOME: ${{ steps.verification_setup_3.outcome }} - - name: Prepare repository verification 4 + - &native_verification_setup_4 + name: Prepare repository verification 4 id: verification_setup_4 if: ${{ !cancelled() && steps.verification_continue_3.outcome == 'success' && steps.verification_continue_3.outputs.verification-setup-pending == 'true' }} uses: ./.git/copilot-verification-setup @@ -174,10 +189,13 @@ jobs: LOCALAPPDATA: ${{ steps.verification_continue_3.outputs.verification-localappdata }} PATH: ${{ steps.verification_continue_3.outputs.verification-path }} JAVA_HOME: ${{ steps.verification_continue_3.outputs.verification-java_home }} + JDK_JAVA_OPTIONS: ${{ steps.verification_continue_3.outputs.verification-jdk_java_options }} + GRADLE_USER_HOME: ${{ steps.verification_continue_3.outputs.verification-gradle_user_home }} TMP: ${{ steps.verification_continue_3.outputs.verification-tmp }} TEMP: ${{ steps.verification_continue_3.outputs.verification-temp }} TMPDIR: ${{ steps.verification_continue_3.outputs.verification-tmpdir }} - - name: Continue repository verification 4 + - &native_verification_continue_4 + name: Continue repository verification 4 id: verification_continue_4 if: ${{ always() && steps.verification_continue_3.outputs.verification-setup-pending == 'true' }} uses: ./../.copilot-native-fixture-runtime @@ -190,7 +208,8 @@ jobs: COPILOT_NATIVE_TICKET: ${{ steps.copilot_native_fixture.outputs.verification-ticket }} COPILOT_NATIVE_REQUEST: ${{ steps.verification_continue_3.outputs.verification-request }} COPILOT_NATIVE_OUTCOME: ${{ steps.verification_setup_4.outcome }} - - name: Prepare repository verification 5 + - &native_verification_setup_5 + name: Prepare repository verification 5 id: verification_setup_5 if: ${{ !cancelled() && steps.verification_continue_4.outcome == 'success' && steps.verification_continue_4.outputs.verification-setup-pending == 'true' }} uses: ./.git/copilot-verification-setup @@ -202,10 +221,13 @@ jobs: LOCALAPPDATA: ${{ steps.verification_continue_4.outputs.verification-localappdata }} PATH: ${{ steps.verification_continue_4.outputs.verification-path }} JAVA_HOME: ${{ steps.verification_continue_4.outputs.verification-java_home }} + JDK_JAVA_OPTIONS: ${{ steps.verification_continue_4.outputs.verification-jdk_java_options }} + GRADLE_USER_HOME: ${{ steps.verification_continue_4.outputs.verification-gradle_user_home }} TMP: ${{ steps.verification_continue_4.outputs.verification-tmp }} TEMP: ${{ steps.verification_continue_4.outputs.verification-temp }} TMPDIR: ${{ steps.verification_continue_4.outputs.verification-tmpdir }} - - name: Continue repository verification 5 + - &native_verification_continue_5 + name: Continue repository verification 5 id: verification_continue_5 if: ${{ always() && steps.verification_continue_4.outputs.verification-setup-pending == 'true' }} uses: ./../.copilot-native-fixture-runtime @@ -218,7 +240,8 @@ jobs: COPILOT_NATIVE_TICKET: ${{ steps.copilot_native_fixture.outputs.verification-ticket }} COPILOT_NATIVE_REQUEST: ${{ steps.verification_continue_4.outputs.verification-request }} COPILOT_NATIVE_OUTCOME: ${{ steps.verification_setup_5.outcome }} - - name: Prepare repository verification 6 + - &native_verification_setup_6 + name: Prepare repository verification 6 id: verification_setup_6 if: ${{ !cancelled() && steps.verification_continue_5.outcome == 'success' && steps.verification_continue_5.outputs.verification-setup-pending == 'true' }} uses: ./.git/copilot-verification-setup @@ -230,10 +253,13 @@ jobs: LOCALAPPDATA: ${{ steps.verification_continue_5.outputs.verification-localappdata }} PATH: ${{ steps.verification_continue_5.outputs.verification-path }} JAVA_HOME: ${{ steps.verification_continue_5.outputs.verification-java_home }} + JDK_JAVA_OPTIONS: ${{ steps.verification_continue_5.outputs.verification-jdk_java_options }} + GRADLE_USER_HOME: ${{ steps.verification_continue_5.outputs.verification-gradle_user_home }} TMP: ${{ steps.verification_continue_5.outputs.verification-tmp }} TEMP: ${{ steps.verification_continue_5.outputs.verification-temp }} TMPDIR: ${{ steps.verification_continue_5.outputs.verification-tmpdir }} - - name: Continue repository verification 6 + - &native_verification_continue_6 + name: Continue repository verification 6 id: verification_continue_6 if: ${{ always() && steps.verification_continue_5.outputs.verification-setup-pending == 'true' }} uses: ./../.copilot-native-fixture-runtime @@ -246,7 +272,8 @@ jobs: COPILOT_NATIVE_TICKET: ${{ steps.copilot_native_fixture.outputs.verification-ticket }} COPILOT_NATIVE_REQUEST: ${{ steps.verification_continue_5.outputs.verification-request }} COPILOT_NATIVE_OUTCOME: ${{ steps.verification_setup_6.outcome }} - - name: Prepare repository verification 7 + - &native_verification_setup_7 + name: Prepare repository verification 7 id: verification_setup_7 if: ${{ !cancelled() && steps.verification_continue_6.outcome == 'success' && steps.verification_continue_6.outputs.verification-setup-pending == 'true' }} uses: ./.git/copilot-verification-setup @@ -258,10 +285,13 @@ jobs: LOCALAPPDATA: ${{ steps.verification_continue_6.outputs.verification-localappdata }} PATH: ${{ steps.verification_continue_6.outputs.verification-path }} JAVA_HOME: ${{ steps.verification_continue_6.outputs.verification-java_home }} + JDK_JAVA_OPTIONS: ${{ steps.verification_continue_6.outputs.verification-jdk_java_options }} + GRADLE_USER_HOME: ${{ steps.verification_continue_6.outputs.verification-gradle_user_home }} TMP: ${{ steps.verification_continue_6.outputs.verification-tmp }} TEMP: ${{ steps.verification_continue_6.outputs.verification-temp }} TMPDIR: ${{ steps.verification_continue_6.outputs.verification-tmpdir }} - - name: Continue repository verification 7 + - &native_verification_continue_7 + name: Continue repository verification 7 id: verification_continue_7 if: ${{ always() && steps.verification_continue_6.outputs.verification-setup-pending == 'true' }} uses: ./../.copilot-native-fixture-runtime @@ -274,7 +304,8 @@ jobs: COPILOT_NATIVE_TICKET: ${{ steps.copilot_native_fixture.outputs.verification-ticket }} COPILOT_NATIVE_REQUEST: ${{ steps.verification_continue_6.outputs.verification-request }} COPILOT_NATIVE_OUTCOME: ${{ steps.verification_setup_7.outcome }} - - name: Prepare repository verification 8 + - &native_verification_setup_8 + name: Prepare repository verification 8 id: verification_setup_8 if: ${{ !cancelled() && steps.verification_continue_7.outcome == 'success' && steps.verification_continue_7.outputs.verification-setup-pending == 'true' }} uses: ./.git/copilot-verification-setup @@ -286,10 +317,13 @@ jobs: LOCALAPPDATA: ${{ steps.verification_continue_7.outputs.verification-localappdata }} PATH: ${{ steps.verification_continue_7.outputs.verification-path }} JAVA_HOME: ${{ steps.verification_continue_7.outputs.verification-java_home }} + JDK_JAVA_OPTIONS: ${{ steps.verification_continue_7.outputs.verification-jdk_java_options }} + GRADLE_USER_HOME: ${{ steps.verification_continue_7.outputs.verification-gradle_user_home }} TMP: ${{ steps.verification_continue_7.outputs.verification-tmp }} TEMP: ${{ steps.verification_continue_7.outputs.verification-temp }} TMPDIR: ${{ steps.verification_continue_7.outputs.verification-tmpdir }} - - name: Continue repository verification 8 + - &native_verification_continue_8 + name: Continue repository verification 8 id: verification_continue_8 if: ${{ always() && steps.verification_continue_7.outputs.verification-setup-pending == 'true' }} uses: ./../.copilot-native-fixture-runtime @@ -302,7 +336,8 @@ jobs: COPILOT_NATIVE_TICKET: ${{ steps.copilot_native_fixture.outputs.verification-ticket }} COPILOT_NATIVE_REQUEST: ${{ steps.verification_continue_7.outputs.verification-request }} COPILOT_NATIVE_OUTCOME: ${{ steps.verification_setup_8.outcome }} - - name: Prepare repository verification 9 + - &native_verification_setup_9 + name: Prepare repository verification 9 id: verification_setup_9 if: ${{ !cancelled() && steps.verification_continue_8.outcome == 'success' && steps.verification_continue_8.outputs.verification-setup-pending == 'true' }} uses: ./.git/copilot-verification-setup @@ -314,10 +349,13 @@ jobs: LOCALAPPDATA: ${{ steps.verification_continue_8.outputs.verification-localappdata }} PATH: ${{ steps.verification_continue_8.outputs.verification-path }} JAVA_HOME: ${{ steps.verification_continue_8.outputs.verification-java_home }} + JDK_JAVA_OPTIONS: ${{ steps.verification_continue_8.outputs.verification-jdk_java_options }} + GRADLE_USER_HOME: ${{ steps.verification_continue_8.outputs.verification-gradle_user_home }} TMP: ${{ steps.verification_continue_8.outputs.verification-tmp }} TEMP: ${{ steps.verification_continue_8.outputs.verification-temp }} TMPDIR: ${{ steps.verification_continue_8.outputs.verification-tmpdir }} - - name: Continue repository verification 9 + - &native_verification_continue_9 + name: Continue repository verification 9 id: verification_continue_9 if: ${{ always() && steps.verification_continue_8.outputs.verification-setup-pending == 'true' }} uses: ./../.copilot-native-fixture-runtime @@ -330,7 +368,8 @@ jobs: COPILOT_NATIVE_TICKET: ${{ steps.copilot_native_fixture.outputs.verification-ticket }} COPILOT_NATIVE_REQUEST: ${{ steps.verification_continue_8.outputs.verification-request }} COPILOT_NATIVE_OUTCOME: ${{ steps.verification_setup_9.outcome }} - - name: Prepare repository verification 10 + - &native_verification_setup_10 + name: Prepare repository verification 10 id: verification_setup_10 if: ${{ !cancelled() && steps.verification_continue_9.outcome == 'success' && steps.verification_continue_9.outputs.verification-setup-pending == 'true' }} uses: ./.git/copilot-verification-setup @@ -342,10 +381,13 @@ jobs: LOCALAPPDATA: ${{ steps.verification_continue_9.outputs.verification-localappdata }} PATH: ${{ steps.verification_continue_9.outputs.verification-path }} JAVA_HOME: ${{ steps.verification_continue_9.outputs.verification-java_home }} + JDK_JAVA_OPTIONS: ${{ steps.verification_continue_9.outputs.verification-jdk_java_options }} + GRADLE_USER_HOME: ${{ steps.verification_continue_9.outputs.verification-gradle_user_home }} TMP: ${{ steps.verification_continue_9.outputs.verification-tmp }} TEMP: ${{ steps.verification_continue_9.outputs.verification-temp }} TMPDIR: ${{ steps.verification_continue_9.outputs.verification-tmpdir }} - - name: Continue repository verification 10 + - &native_verification_continue_10 + name: Continue repository verification 10 id: verification_continue_10 if: ${{ always() && steps.verification_continue_9.outputs.verification-setup-pending == 'true' }} uses: ./../.copilot-native-fixture-runtime @@ -358,7 +400,8 @@ jobs: COPILOT_NATIVE_TICKET: ${{ steps.copilot_native_fixture.outputs.verification-ticket }} COPILOT_NATIVE_REQUEST: ${{ steps.verification_continue_9.outputs.verification-request }} COPILOT_NATIVE_OUTCOME: ${{ steps.verification_setup_10.outcome }} - - name: Prepare repository verification 11 + - &native_verification_setup_11 + name: Prepare repository verification 11 id: verification_setup_11 if: ${{ !cancelled() && steps.verification_continue_10.outcome == 'success' && steps.verification_continue_10.outputs.verification-setup-pending == 'true' }} uses: ./.git/copilot-verification-setup @@ -370,10 +413,13 @@ jobs: LOCALAPPDATA: ${{ steps.verification_continue_10.outputs.verification-localappdata }} PATH: ${{ steps.verification_continue_10.outputs.verification-path }} JAVA_HOME: ${{ steps.verification_continue_10.outputs.verification-java_home }} + JDK_JAVA_OPTIONS: ${{ steps.verification_continue_10.outputs.verification-jdk_java_options }} + GRADLE_USER_HOME: ${{ steps.verification_continue_10.outputs.verification-gradle_user_home }} TMP: ${{ steps.verification_continue_10.outputs.verification-tmp }} TEMP: ${{ steps.verification_continue_10.outputs.verification-temp }} TMPDIR: ${{ steps.verification_continue_10.outputs.verification-tmpdir }} - - name: Continue repository verification 11 + - &native_verification_continue_11 + name: Continue repository verification 11 id: verification_continue_11 if: ${{ always() && steps.verification_continue_10.outputs.verification-setup-pending == 'true' }} uses: ./../.copilot-native-fixture-runtime @@ -386,7 +432,8 @@ jobs: COPILOT_NATIVE_TICKET: ${{ steps.copilot_native_fixture.outputs.verification-ticket }} COPILOT_NATIVE_REQUEST: ${{ steps.verification_continue_10.outputs.verification-request }} COPILOT_NATIVE_OUTCOME: ${{ steps.verification_setup_11.outcome }} - - name: Prepare repository verification 12 + - &native_verification_setup_12 + name: Prepare repository verification 12 id: verification_setup_12 if: ${{ !cancelled() && steps.verification_continue_11.outcome == 'success' && steps.verification_continue_11.outputs.verification-setup-pending == 'true' }} uses: ./.git/copilot-verification-setup @@ -398,10 +445,13 @@ jobs: LOCALAPPDATA: ${{ steps.verification_continue_11.outputs.verification-localappdata }} PATH: ${{ steps.verification_continue_11.outputs.verification-path }} JAVA_HOME: ${{ steps.verification_continue_11.outputs.verification-java_home }} + JDK_JAVA_OPTIONS: ${{ steps.verification_continue_11.outputs.verification-jdk_java_options }} + GRADLE_USER_HOME: ${{ steps.verification_continue_11.outputs.verification-gradle_user_home }} TMP: ${{ steps.verification_continue_11.outputs.verification-tmp }} TEMP: ${{ steps.verification_continue_11.outputs.verification-temp }} TMPDIR: ${{ steps.verification_continue_11.outputs.verification-tmpdir }} - - name: Continue repository verification 12 + - &native_verification_continue_12 + name: Continue repository verification 12 id: verification_continue_12 if: ${{ always() && steps.verification_continue_11.outputs.verification-setup-pending == 'true' }} uses: ./../.copilot-native-fixture-runtime @@ -414,7 +464,8 @@ jobs: COPILOT_NATIVE_TICKET: ${{ steps.copilot_native_fixture.outputs.verification-ticket }} COPILOT_NATIVE_REQUEST: ${{ steps.verification_continue_11.outputs.verification-request }} COPILOT_NATIVE_OUTCOME: ${{ steps.verification_setup_12.outcome }} - - name: Prepare repository verification 13 + - &native_verification_setup_13 + name: Prepare repository verification 13 id: verification_setup_13 if: ${{ !cancelled() && steps.verification_continue_12.outcome == 'success' && steps.verification_continue_12.outputs.verification-setup-pending == 'true' }} uses: ./.git/copilot-verification-setup @@ -426,10 +477,13 @@ jobs: LOCALAPPDATA: ${{ steps.verification_continue_12.outputs.verification-localappdata }} PATH: ${{ steps.verification_continue_12.outputs.verification-path }} JAVA_HOME: ${{ steps.verification_continue_12.outputs.verification-java_home }} + JDK_JAVA_OPTIONS: ${{ steps.verification_continue_12.outputs.verification-jdk_java_options }} + GRADLE_USER_HOME: ${{ steps.verification_continue_12.outputs.verification-gradle_user_home }} TMP: ${{ steps.verification_continue_12.outputs.verification-tmp }} TEMP: ${{ steps.verification_continue_12.outputs.verification-temp }} TMPDIR: ${{ steps.verification_continue_12.outputs.verification-tmpdir }} - - name: Continue repository verification 13 + - &native_verification_continue_13 + name: Continue repository verification 13 id: verification_continue_13 if: ${{ always() && steps.verification_continue_12.outputs.verification-setup-pending == 'true' }} uses: ./../.copilot-native-fixture-runtime @@ -442,7 +496,8 @@ jobs: COPILOT_NATIVE_TICKET: ${{ steps.copilot_native_fixture.outputs.verification-ticket }} COPILOT_NATIVE_REQUEST: ${{ steps.verification_continue_12.outputs.verification-request }} COPILOT_NATIVE_OUTCOME: ${{ steps.verification_setup_13.outcome }} - - name: Prepare repository verification 14 + - &native_verification_setup_14 + name: Prepare repository verification 14 id: verification_setup_14 if: ${{ !cancelled() && steps.verification_continue_13.outcome == 'success' && steps.verification_continue_13.outputs.verification-setup-pending == 'true' }} uses: ./.git/copilot-verification-setup @@ -454,10 +509,13 @@ jobs: LOCALAPPDATA: ${{ steps.verification_continue_13.outputs.verification-localappdata }} PATH: ${{ steps.verification_continue_13.outputs.verification-path }} JAVA_HOME: ${{ steps.verification_continue_13.outputs.verification-java_home }} + JDK_JAVA_OPTIONS: ${{ steps.verification_continue_13.outputs.verification-jdk_java_options }} + GRADLE_USER_HOME: ${{ steps.verification_continue_13.outputs.verification-gradle_user_home }} TMP: ${{ steps.verification_continue_13.outputs.verification-tmp }} TEMP: ${{ steps.verification_continue_13.outputs.verification-temp }} TMPDIR: ${{ steps.verification_continue_13.outputs.verification-tmpdir }} - - name: Continue repository verification 14 + - &native_verification_continue_14 + name: Continue repository verification 14 id: verification_continue_14 if: ${{ always() && steps.verification_continue_13.outputs.verification-setup-pending == 'true' }} uses: ./../.copilot-native-fixture-runtime @@ -470,7 +528,8 @@ jobs: COPILOT_NATIVE_TICKET: ${{ steps.copilot_native_fixture.outputs.verification-ticket }} COPILOT_NATIVE_REQUEST: ${{ steps.verification_continue_13.outputs.verification-request }} COPILOT_NATIVE_OUTCOME: ${{ steps.verification_setup_14.outcome }} - - name: Prepare repository verification 15 + - &native_verification_setup_15 + name: Prepare repository verification 15 id: verification_setup_15 if: ${{ !cancelled() && steps.verification_continue_14.outcome == 'success' && steps.verification_continue_14.outputs.verification-setup-pending == 'true' }} uses: ./.git/copilot-verification-setup @@ -482,10 +541,13 @@ jobs: LOCALAPPDATA: ${{ steps.verification_continue_14.outputs.verification-localappdata }} PATH: ${{ steps.verification_continue_14.outputs.verification-path }} JAVA_HOME: ${{ steps.verification_continue_14.outputs.verification-java_home }} + JDK_JAVA_OPTIONS: ${{ steps.verification_continue_14.outputs.verification-jdk_java_options }} + GRADLE_USER_HOME: ${{ steps.verification_continue_14.outputs.verification-gradle_user_home }} TMP: ${{ steps.verification_continue_14.outputs.verification-tmp }} TEMP: ${{ steps.verification_continue_14.outputs.verification-temp }} TMPDIR: ${{ steps.verification_continue_14.outputs.verification-tmpdir }} - - name: Continue repository verification 15 + - &native_verification_continue_15 + name: Continue repository verification 15 id: verification_continue_15 if: ${{ always() && steps.verification_continue_14.outputs.verification-setup-pending == 'true' }} uses: ./../.copilot-native-fixture-runtime @@ -498,7 +560,8 @@ jobs: COPILOT_NATIVE_TICKET: ${{ steps.copilot_native_fixture.outputs.verification-ticket }} COPILOT_NATIVE_REQUEST: ${{ steps.verification_continue_14.outputs.verification-request }} COPILOT_NATIVE_OUTCOME: ${{ steps.verification_setup_15.outcome }} - - name: Prepare repository verification 16 + - &native_verification_setup_16 + name: Prepare repository verification 16 id: verification_setup_16 if: ${{ !cancelled() && steps.verification_continue_15.outcome == 'success' && steps.verification_continue_15.outputs.verification-setup-pending == 'true' }} uses: ./.git/copilot-verification-setup @@ -510,10 +573,13 @@ jobs: LOCALAPPDATA: ${{ steps.verification_continue_15.outputs.verification-localappdata }} PATH: ${{ steps.verification_continue_15.outputs.verification-path }} JAVA_HOME: ${{ steps.verification_continue_15.outputs.verification-java_home }} + JDK_JAVA_OPTIONS: ${{ steps.verification_continue_15.outputs.verification-jdk_java_options }} + GRADLE_USER_HOME: ${{ steps.verification_continue_15.outputs.verification-gradle_user_home }} TMP: ${{ steps.verification_continue_15.outputs.verification-tmp }} TEMP: ${{ steps.verification_continue_15.outputs.verification-temp }} TMPDIR: ${{ steps.verification_continue_15.outputs.verification-tmpdir }} - - name: Continue repository verification 16 + - &native_verification_continue_16 + name: Continue repository verification 16 id: verification_continue_16 if: ${{ always() && steps.verification_continue_15.outputs.verification-setup-pending == 'true' }} uses: ./../.copilot-native-fixture-runtime @@ -526,7 +592,8 @@ jobs: COPILOT_NATIVE_TICKET: ${{ steps.copilot_native_fixture.outputs.verification-ticket }} COPILOT_NATIVE_REQUEST: ${{ steps.verification_continue_15.outputs.verification-request }} COPILOT_NATIVE_OUTCOME: ${{ steps.verification_setup_16.outcome }} - - name: Prepare repository verification 17 + - &native_verification_setup_17 + name: Prepare repository verification 17 id: verification_setup_17 if: ${{ !cancelled() && steps.verification_continue_16.outcome == 'success' && steps.verification_continue_16.outputs.verification-setup-pending == 'true' }} uses: ./.git/copilot-verification-setup @@ -538,10 +605,13 @@ jobs: LOCALAPPDATA: ${{ steps.verification_continue_16.outputs.verification-localappdata }} PATH: ${{ steps.verification_continue_16.outputs.verification-path }} JAVA_HOME: ${{ steps.verification_continue_16.outputs.verification-java_home }} + JDK_JAVA_OPTIONS: ${{ steps.verification_continue_16.outputs.verification-jdk_java_options }} + GRADLE_USER_HOME: ${{ steps.verification_continue_16.outputs.verification-gradle_user_home }} TMP: ${{ steps.verification_continue_16.outputs.verification-tmp }} TEMP: ${{ steps.verification_continue_16.outputs.verification-temp }} TMPDIR: ${{ steps.verification_continue_16.outputs.verification-tmpdir }} - - name: Continue repository verification 17 + - &native_verification_continue_17 + name: Continue repository verification 17 id: verification_continue_17 if: ${{ always() && steps.verification_continue_16.outputs.verification-setup-pending == 'true' }} uses: ./../.copilot-native-fixture-runtime @@ -554,7 +624,8 @@ jobs: COPILOT_NATIVE_TICKET: ${{ steps.copilot_native_fixture.outputs.verification-ticket }} COPILOT_NATIVE_REQUEST: ${{ steps.verification_continue_16.outputs.verification-request }} COPILOT_NATIVE_OUTCOME: ${{ steps.verification_setup_17.outcome }} - - name: Prepare repository verification 18 + - &native_verification_setup_18 + name: Prepare repository verification 18 id: verification_setup_18 if: ${{ !cancelled() && steps.verification_continue_17.outcome == 'success' && steps.verification_continue_17.outputs.verification-setup-pending == 'true' }} uses: ./.git/copilot-verification-setup @@ -566,10 +637,13 @@ jobs: LOCALAPPDATA: ${{ steps.verification_continue_17.outputs.verification-localappdata }} PATH: ${{ steps.verification_continue_17.outputs.verification-path }} JAVA_HOME: ${{ steps.verification_continue_17.outputs.verification-java_home }} + JDK_JAVA_OPTIONS: ${{ steps.verification_continue_17.outputs.verification-jdk_java_options }} + GRADLE_USER_HOME: ${{ steps.verification_continue_17.outputs.verification-gradle_user_home }} TMP: ${{ steps.verification_continue_17.outputs.verification-tmp }} TEMP: ${{ steps.verification_continue_17.outputs.verification-temp }} TMPDIR: ${{ steps.verification_continue_17.outputs.verification-tmpdir }} - - name: Continue repository verification 18 + - &native_verification_continue_18 + name: Continue repository verification 18 id: verification_continue_18 if: ${{ always() && steps.verification_continue_17.outputs.verification-setup-pending == 'true' }} uses: ./../.copilot-native-fixture-runtime @@ -582,7 +656,8 @@ jobs: COPILOT_NATIVE_TICKET: ${{ steps.copilot_native_fixture.outputs.verification-ticket }} COPILOT_NATIVE_REQUEST: ${{ steps.verification_continue_17.outputs.verification-request }} COPILOT_NATIVE_OUTCOME: ${{ steps.verification_setup_18.outcome }} - - name: Prepare repository verification 19 + - &native_verification_setup_19 + name: Prepare repository verification 19 id: verification_setup_19 if: ${{ !cancelled() && steps.verification_continue_18.outcome == 'success' && steps.verification_continue_18.outputs.verification-setup-pending == 'true' }} uses: ./.git/copilot-verification-setup @@ -594,10 +669,13 @@ jobs: LOCALAPPDATA: ${{ steps.verification_continue_18.outputs.verification-localappdata }} PATH: ${{ steps.verification_continue_18.outputs.verification-path }} JAVA_HOME: ${{ steps.verification_continue_18.outputs.verification-java_home }} + JDK_JAVA_OPTIONS: ${{ steps.verification_continue_18.outputs.verification-jdk_java_options }} + GRADLE_USER_HOME: ${{ steps.verification_continue_18.outputs.verification-gradle_user_home }} TMP: ${{ steps.verification_continue_18.outputs.verification-tmp }} TEMP: ${{ steps.verification_continue_18.outputs.verification-temp }} TMPDIR: ${{ steps.verification_continue_18.outputs.verification-tmpdir }} - - name: Continue repository verification 19 + - &native_verification_continue_19 + name: Continue repository verification 19 id: verification_continue_19 if: ${{ always() && steps.verification_continue_18.outputs.verification-setup-pending == 'true' }} uses: ./../.copilot-native-fixture-runtime @@ -610,7 +688,8 @@ jobs: COPILOT_NATIVE_TICKET: ${{ steps.copilot_native_fixture.outputs.verification-ticket }} COPILOT_NATIVE_REQUEST: ${{ steps.verification_continue_18.outputs.verification-request }} COPILOT_NATIVE_OUTCOME: ${{ steps.verification_setup_19.outcome }} - - name: Prepare repository verification 20 + - &native_verification_setup_20 + name: Prepare repository verification 20 id: verification_setup_20 if: ${{ !cancelled() && steps.verification_continue_19.outcome == 'success' && steps.verification_continue_19.outputs.verification-setup-pending == 'true' }} uses: ./.git/copilot-verification-setup @@ -622,10 +701,13 @@ jobs: LOCALAPPDATA: ${{ steps.verification_continue_19.outputs.verification-localappdata }} PATH: ${{ steps.verification_continue_19.outputs.verification-path }} JAVA_HOME: ${{ steps.verification_continue_19.outputs.verification-java_home }} + JDK_JAVA_OPTIONS: ${{ steps.verification_continue_19.outputs.verification-jdk_java_options }} + GRADLE_USER_HOME: ${{ steps.verification_continue_19.outputs.verification-gradle_user_home }} TMP: ${{ steps.verification_continue_19.outputs.verification-tmp }} TEMP: ${{ steps.verification_continue_19.outputs.verification-temp }} TMPDIR: ${{ steps.verification_continue_19.outputs.verification-tmpdir }} - - name: Continue repository verification 20 + - &native_verification_continue_20 + name: Continue repository verification 20 id: verification_continue_20 if: ${{ always() && steps.verification_continue_19.outputs.verification-setup-pending == 'true' }} uses: ./../.copilot-native-fixture-runtime @@ -638,7 +720,8 @@ jobs: COPILOT_NATIVE_TICKET: ${{ steps.copilot_native_fixture.outputs.verification-ticket }} COPILOT_NATIVE_REQUEST: ${{ steps.verification_continue_19.outputs.verification-request }} COPILOT_NATIVE_OUTCOME: ${{ steps.verification_setup_20.outcome }} - - name: Complete repository verification + - &native_verification_complete + name: Complete repository verification id: verification_complete if: ${{ always() && steps.copilot_native_fixture.outputs.verification-ticket != '' }} uses: ./../.copilot-native-fixture-runtime @@ -776,588 +859,49 @@ jobs: uses: ./.github/actions/copilot-native-cleanup-check - name: Build native verification acceptance fixture run: pnpm exec ncc build src/tooling/__tests__/fixtures/verification_native_fixture.ts -o .github/actions/copilot-native-fixture/dist - - name: Snapshot native fixture runtime - id: prepare_native_fixture_runtime - run: node scripts/prepare-native-source-action.cjs --fixture - - name: Prepare native verification acceptance - id: copilot_native_fixture - uses: ./../.copilot-native-fixture-runtime - with: &native-fixture-inputs - verification-setup: 'true' - env: - COPILOT_NATIVE_PHASE: prepare - COPILOT_NATIVE_RUNTIME_CACHE: ${{ steps.prepare_native_fixture_runtime.outputs.path }} - - name: Prepare repository verification 1 - id: verification_setup_1 - if: ${{ !cancelled() && steps.copilot_native_fixture.outcome == 'success' && steps.copilot_native_fixture.outputs.verification-setup-pending == 'true' }} - uses: ./.git/copilot-verification-setup - timeout-minutes: 5 - env: - HOME: ${{ steps.copilot_native_fixture.outputs.verification-home }} - USERPROFILE: ${{ steps.copilot_native_fixture.outputs.verification-userprofile }} - APPDATA: ${{ steps.copilot_native_fixture.outputs.verification-appdata }} - LOCALAPPDATA: ${{ steps.copilot_native_fixture.outputs.verification-localappdata }} - PATH: ${{ steps.copilot_native_fixture.outputs.verification-path }} - JAVA_HOME: ${{ steps.copilot_native_fixture.outputs.verification-java_home }} - TMP: ${{ steps.copilot_native_fixture.outputs.verification-tmp }} - TEMP: ${{ steps.copilot_native_fixture.outputs.verification-temp }} - TMPDIR: ${{ steps.copilot_native_fixture.outputs.verification-tmpdir }} - - name: Continue repository verification 1 - id: verification_continue_1 - if: ${{ always() && steps.copilot_native_fixture.outputs.verification-setup-pending == 'true' }} - uses: ./../.copilot-native-fixture-runtime - with: *native-fixture-inputs - env: - COPILOT_NATIVE_PHASE: continue - COPILOT_NATIVE_SOURCE: ${{ steps.copilot_native_fixture.outputs.verification-source }} - COPILOT_NATIVE_DIGEST: ${{ steps.copilot_native_fixture.outputs.verification-digest }} - COPILOT_NATIVE_GIT: ${{ steps.copilot_native_fixture.outputs.verification-git }} - COPILOT_NATIVE_TICKET: ${{ steps.copilot_native_fixture.outputs.verification-ticket }} - COPILOT_NATIVE_REQUEST: ${{ steps.copilot_native_fixture.outputs.verification-request }} - COPILOT_NATIVE_OUTCOME: ${{ steps.verification_setup_1.outcome }} - - name: Prepare repository verification 2 - id: verification_setup_2 - if: ${{ !cancelled() && steps.verification_continue_1.outcome == 'success' && steps.verification_continue_1.outputs.verification-setup-pending == 'true' }} - uses: ./.git/copilot-verification-setup - timeout-minutes: 5 - env: - HOME: ${{ steps.verification_continue_1.outputs.verification-home }} - USERPROFILE: ${{ steps.verification_continue_1.outputs.verification-userprofile }} - APPDATA: ${{ steps.verification_continue_1.outputs.verification-appdata }} - LOCALAPPDATA: ${{ steps.verification_continue_1.outputs.verification-localappdata }} - PATH: ${{ steps.verification_continue_1.outputs.verification-path }} - JAVA_HOME: ${{ steps.verification_continue_1.outputs.verification-java_home }} - TMP: ${{ steps.verification_continue_1.outputs.verification-tmp }} - TEMP: ${{ steps.verification_continue_1.outputs.verification-temp }} - TMPDIR: ${{ steps.verification_continue_1.outputs.verification-tmpdir }} - - name: Continue repository verification 2 - id: verification_continue_2 - if: ${{ always() && steps.verification_continue_1.outputs.verification-setup-pending == 'true' }} - uses: ./../.copilot-native-fixture-runtime - with: *native-fixture-inputs - env: - COPILOT_NATIVE_PHASE: continue - COPILOT_NATIVE_SOURCE: ${{ steps.copilot_native_fixture.outputs.verification-source }} - COPILOT_NATIVE_DIGEST: ${{ steps.copilot_native_fixture.outputs.verification-digest }} - COPILOT_NATIVE_GIT: ${{ steps.copilot_native_fixture.outputs.verification-git }} - COPILOT_NATIVE_TICKET: ${{ steps.copilot_native_fixture.outputs.verification-ticket }} - COPILOT_NATIVE_REQUEST: ${{ steps.verification_continue_1.outputs.verification-request }} - COPILOT_NATIVE_OUTCOME: ${{ steps.verification_setup_2.outcome }} - - name: Prepare repository verification 3 - id: verification_setup_3 - if: ${{ !cancelled() && steps.verification_continue_2.outcome == 'success' && steps.verification_continue_2.outputs.verification-setup-pending == 'true' }} - uses: ./.git/copilot-verification-setup - timeout-minutes: 5 - env: - HOME: ${{ steps.verification_continue_2.outputs.verification-home }} - USERPROFILE: ${{ steps.verification_continue_2.outputs.verification-userprofile }} - APPDATA: ${{ steps.verification_continue_2.outputs.verification-appdata }} - LOCALAPPDATA: ${{ steps.verification_continue_2.outputs.verification-localappdata }} - PATH: ${{ steps.verification_continue_2.outputs.verification-path }} - JAVA_HOME: ${{ steps.verification_continue_2.outputs.verification-java_home }} - TMP: ${{ steps.verification_continue_2.outputs.verification-tmp }} - TEMP: ${{ steps.verification_continue_2.outputs.verification-temp }} - TMPDIR: ${{ steps.verification_continue_2.outputs.verification-tmpdir }} - - name: Continue repository verification 3 - id: verification_continue_3 - if: ${{ always() && steps.verification_continue_2.outputs.verification-setup-pending == 'true' }} - uses: ./../.copilot-native-fixture-runtime - with: *native-fixture-inputs - env: - COPILOT_NATIVE_PHASE: continue - COPILOT_NATIVE_SOURCE: ${{ steps.copilot_native_fixture.outputs.verification-source }} - COPILOT_NATIVE_DIGEST: ${{ steps.copilot_native_fixture.outputs.verification-digest }} - COPILOT_NATIVE_GIT: ${{ steps.copilot_native_fixture.outputs.verification-git }} - COPILOT_NATIVE_TICKET: ${{ steps.copilot_native_fixture.outputs.verification-ticket }} - COPILOT_NATIVE_REQUEST: ${{ steps.verification_continue_2.outputs.verification-request }} - COPILOT_NATIVE_OUTCOME: ${{ steps.verification_setup_3.outcome }} - - name: Prepare repository verification 4 - id: verification_setup_4 - if: ${{ !cancelled() && steps.verification_continue_3.outcome == 'success' && steps.verification_continue_3.outputs.verification-setup-pending == 'true' }} - uses: ./.git/copilot-verification-setup - timeout-minutes: 5 - env: - HOME: ${{ steps.verification_continue_3.outputs.verification-home }} - USERPROFILE: ${{ steps.verification_continue_3.outputs.verification-userprofile }} - APPDATA: ${{ steps.verification_continue_3.outputs.verification-appdata }} - LOCALAPPDATA: ${{ steps.verification_continue_3.outputs.verification-localappdata }} - PATH: ${{ steps.verification_continue_3.outputs.verification-path }} - JAVA_HOME: ${{ steps.verification_continue_3.outputs.verification-java_home }} - TMP: ${{ steps.verification_continue_3.outputs.verification-tmp }} - TEMP: ${{ steps.verification_continue_3.outputs.verification-temp }} - TMPDIR: ${{ steps.verification_continue_3.outputs.verification-tmpdir }} - - name: Continue repository verification 4 - id: verification_continue_4 - if: ${{ always() && steps.verification_continue_3.outputs.verification-setup-pending == 'true' }} - uses: ./../.copilot-native-fixture-runtime - with: *native-fixture-inputs - env: - COPILOT_NATIVE_PHASE: continue - COPILOT_NATIVE_SOURCE: ${{ steps.copilot_native_fixture.outputs.verification-source }} - COPILOT_NATIVE_DIGEST: ${{ steps.copilot_native_fixture.outputs.verification-digest }} - COPILOT_NATIVE_GIT: ${{ steps.copilot_native_fixture.outputs.verification-git }} - COPILOT_NATIVE_TICKET: ${{ steps.copilot_native_fixture.outputs.verification-ticket }} - COPILOT_NATIVE_REQUEST: ${{ steps.verification_continue_3.outputs.verification-request }} - COPILOT_NATIVE_OUTCOME: ${{ steps.verification_setup_4.outcome }} - - name: Prepare repository verification 5 - id: verification_setup_5 - if: ${{ !cancelled() && steps.verification_continue_4.outcome == 'success' && steps.verification_continue_4.outputs.verification-setup-pending == 'true' }} - uses: ./.git/copilot-verification-setup - timeout-minutes: 5 - env: - HOME: ${{ steps.verification_continue_4.outputs.verification-home }} - USERPROFILE: ${{ steps.verification_continue_4.outputs.verification-userprofile }} - APPDATA: ${{ steps.verification_continue_4.outputs.verification-appdata }} - LOCALAPPDATA: ${{ steps.verification_continue_4.outputs.verification-localappdata }} - PATH: ${{ steps.verification_continue_4.outputs.verification-path }} - JAVA_HOME: ${{ steps.verification_continue_4.outputs.verification-java_home }} - TMP: ${{ steps.verification_continue_4.outputs.verification-tmp }} - TEMP: ${{ steps.verification_continue_4.outputs.verification-temp }} - TMPDIR: ${{ steps.verification_continue_4.outputs.verification-tmpdir }} - - name: Continue repository verification 5 - id: verification_continue_5 - if: ${{ always() && steps.verification_continue_4.outputs.verification-setup-pending == 'true' }} - uses: ./../.copilot-native-fixture-runtime - with: *native-fixture-inputs - env: - COPILOT_NATIVE_PHASE: continue - COPILOT_NATIVE_SOURCE: ${{ steps.copilot_native_fixture.outputs.verification-source }} - COPILOT_NATIVE_DIGEST: ${{ steps.copilot_native_fixture.outputs.verification-digest }} - COPILOT_NATIVE_GIT: ${{ steps.copilot_native_fixture.outputs.verification-git }} - COPILOT_NATIVE_TICKET: ${{ steps.copilot_native_fixture.outputs.verification-ticket }} - COPILOT_NATIVE_REQUEST: ${{ steps.verification_continue_4.outputs.verification-request }} - COPILOT_NATIVE_OUTCOME: ${{ steps.verification_setup_5.outcome }} - - name: Prepare repository verification 6 - id: verification_setup_6 - if: ${{ !cancelled() && steps.verification_continue_5.outcome == 'success' && steps.verification_continue_5.outputs.verification-setup-pending == 'true' }} - uses: ./.git/copilot-verification-setup - timeout-minutes: 5 - env: - HOME: ${{ steps.verification_continue_5.outputs.verification-home }} - USERPROFILE: ${{ steps.verification_continue_5.outputs.verification-userprofile }} - APPDATA: ${{ steps.verification_continue_5.outputs.verification-appdata }} - LOCALAPPDATA: ${{ steps.verification_continue_5.outputs.verification-localappdata }} - PATH: ${{ steps.verification_continue_5.outputs.verification-path }} - JAVA_HOME: ${{ steps.verification_continue_5.outputs.verification-java_home }} - TMP: ${{ steps.verification_continue_5.outputs.verification-tmp }} - TEMP: ${{ steps.verification_continue_5.outputs.verification-temp }} - TMPDIR: ${{ steps.verification_continue_5.outputs.verification-tmpdir }} - - name: Continue repository verification 6 - id: verification_continue_6 - if: ${{ always() && steps.verification_continue_5.outputs.verification-setup-pending == 'true' }} - uses: ./../.copilot-native-fixture-runtime - with: *native-fixture-inputs - env: - COPILOT_NATIVE_PHASE: continue - COPILOT_NATIVE_SOURCE: ${{ steps.copilot_native_fixture.outputs.verification-source }} - COPILOT_NATIVE_DIGEST: ${{ steps.copilot_native_fixture.outputs.verification-digest }} - COPILOT_NATIVE_GIT: ${{ steps.copilot_native_fixture.outputs.verification-git }} - COPILOT_NATIVE_TICKET: ${{ steps.copilot_native_fixture.outputs.verification-ticket }} - COPILOT_NATIVE_REQUEST: ${{ steps.verification_continue_5.outputs.verification-request }} - COPILOT_NATIVE_OUTCOME: ${{ steps.verification_setup_6.outcome }} - - name: Prepare repository verification 7 - id: verification_setup_7 - if: ${{ !cancelled() && steps.verification_continue_6.outcome == 'success' && steps.verification_continue_6.outputs.verification-setup-pending == 'true' }} - uses: ./.git/copilot-verification-setup - timeout-minutes: 5 - env: - HOME: ${{ steps.verification_continue_6.outputs.verification-home }} - USERPROFILE: ${{ steps.verification_continue_6.outputs.verification-userprofile }} - APPDATA: ${{ steps.verification_continue_6.outputs.verification-appdata }} - LOCALAPPDATA: ${{ steps.verification_continue_6.outputs.verification-localappdata }} - PATH: ${{ steps.verification_continue_6.outputs.verification-path }} - JAVA_HOME: ${{ steps.verification_continue_6.outputs.verification-java_home }} - TMP: ${{ steps.verification_continue_6.outputs.verification-tmp }} - TEMP: ${{ steps.verification_continue_6.outputs.verification-temp }} - TMPDIR: ${{ steps.verification_continue_6.outputs.verification-tmpdir }} - - name: Continue repository verification 7 - id: verification_continue_7 - if: ${{ always() && steps.verification_continue_6.outputs.verification-setup-pending == 'true' }} - uses: ./../.copilot-native-fixture-runtime - with: *native-fixture-inputs - env: - COPILOT_NATIVE_PHASE: continue - COPILOT_NATIVE_SOURCE: ${{ steps.copilot_native_fixture.outputs.verification-source }} - COPILOT_NATIVE_DIGEST: ${{ steps.copilot_native_fixture.outputs.verification-digest }} - COPILOT_NATIVE_GIT: ${{ steps.copilot_native_fixture.outputs.verification-git }} - COPILOT_NATIVE_TICKET: ${{ steps.copilot_native_fixture.outputs.verification-ticket }} - COPILOT_NATIVE_REQUEST: ${{ steps.verification_continue_6.outputs.verification-request }} - COPILOT_NATIVE_OUTCOME: ${{ steps.verification_setup_7.outcome }} - - name: Prepare repository verification 8 - id: verification_setup_8 - if: ${{ !cancelled() && steps.verification_continue_7.outcome == 'success' && steps.verification_continue_7.outputs.verification-setup-pending == 'true' }} - uses: ./.git/copilot-verification-setup - timeout-minutes: 5 - env: - HOME: ${{ steps.verification_continue_7.outputs.verification-home }} - USERPROFILE: ${{ steps.verification_continue_7.outputs.verification-userprofile }} - APPDATA: ${{ steps.verification_continue_7.outputs.verification-appdata }} - LOCALAPPDATA: ${{ steps.verification_continue_7.outputs.verification-localappdata }} - PATH: ${{ steps.verification_continue_7.outputs.verification-path }} - JAVA_HOME: ${{ steps.verification_continue_7.outputs.verification-java_home }} - TMP: ${{ steps.verification_continue_7.outputs.verification-tmp }} - TEMP: ${{ steps.verification_continue_7.outputs.verification-temp }} - TMPDIR: ${{ steps.verification_continue_7.outputs.verification-tmpdir }} - - name: Continue repository verification 8 - id: verification_continue_8 - if: ${{ always() && steps.verification_continue_7.outputs.verification-setup-pending == 'true' }} - uses: ./../.copilot-native-fixture-runtime - with: *native-fixture-inputs - env: - COPILOT_NATIVE_PHASE: continue - COPILOT_NATIVE_SOURCE: ${{ steps.copilot_native_fixture.outputs.verification-source }} - COPILOT_NATIVE_DIGEST: ${{ steps.copilot_native_fixture.outputs.verification-digest }} - COPILOT_NATIVE_GIT: ${{ steps.copilot_native_fixture.outputs.verification-git }} - COPILOT_NATIVE_TICKET: ${{ steps.copilot_native_fixture.outputs.verification-ticket }} - COPILOT_NATIVE_REQUEST: ${{ steps.verification_continue_7.outputs.verification-request }} - COPILOT_NATIVE_OUTCOME: ${{ steps.verification_setup_8.outcome }} - - name: Prepare repository verification 9 - id: verification_setup_9 - if: ${{ !cancelled() && steps.verification_continue_8.outcome == 'success' && steps.verification_continue_8.outputs.verification-setup-pending == 'true' }} - uses: ./.git/copilot-verification-setup - timeout-minutes: 5 - env: - HOME: ${{ steps.verification_continue_8.outputs.verification-home }} - USERPROFILE: ${{ steps.verification_continue_8.outputs.verification-userprofile }} - APPDATA: ${{ steps.verification_continue_8.outputs.verification-appdata }} - LOCALAPPDATA: ${{ steps.verification_continue_8.outputs.verification-localappdata }} - PATH: ${{ steps.verification_continue_8.outputs.verification-path }} - JAVA_HOME: ${{ steps.verification_continue_8.outputs.verification-java_home }} - TMP: ${{ steps.verification_continue_8.outputs.verification-tmp }} - TEMP: ${{ steps.verification_continue_8.outputs.verification-temp }} - TMPDIR: ${{ steps.verification_continue_8.outputs.verification-tmpdir }} - - name: Continue repository verification 9 - id: verification_continue_9 - if: ${{ always() && steps.verification_continue_8.outputs.verification-setup-pending == 'true' }} - uses: ./../.copilot-native-fixture-runtime - with: *native-fixture-inputs - env: - COPILOT_NATIVE_PHASE: continue - COPILOT_NATIVE_SOURCE: ${{ steps.copilot_native_fixture.outputs.verification-source }} - COPILOT_NATIVE_DIGEST: ${{ steps.copilot_native_fixture.outputs.verification-digest }} - COPILOT_NATIVE_GIT: ${{ steps.copilot_native_fixture.outputs.verification-git }} - COPILOT_NATIVE_TICKET: ${{ steps.copilot_native_fixture.outputs.verification-ticket }} - COPILOT_NATIVE_REQUEST: ${{ steps.verification_continue_8.outputs.verification-request }} - COPILOT_NATIVE_OUTCOME: ${{ steps.verification_setup_9.outcome }} - - name: Prepare repository verification 10 - id: verification_setup_10 - if: ${{ !cancelled() && steps.verification_continue_9.outcome == 'success' && steps.verification_continue_9.outputs.verification-setup-pending == 'true' }} - uses: ./.git/copilot-verification-setup - timeout-minutes: 5 - env: - HOME: ${{ steps.verification_continue_9.outputs.verification-home }} - USERPROFILE: ${{ steps.verification_continue_9.outputs.verification-userprofile }} - APPDATA: ${{ steps.verification_continue_9.outputs.verification-appdata }} - LOCALAPPDATA: ${{ steps.verification_continue_9.outputs.verification-localappdata }} - PATH: ${{ steps.verification_continue_9.outputs.verification-path }} - JAVA_HOME: ${{ steps.verification_continue_9.outputs.verification-java_home }} - TMP: ${{ steps.verification_continue_9.outputs.verification-tmp }} - TEMP: ${{ steps.verification_continue_9.outputs.verification-temp }} - TMPDIR: ${{ steps.verification_continue_9.outputs.verification-tmpdir }} - - name: Continue repository verification 10 - id: verification_continue_10 - if: ${{ always() && steps.verification_continue_9.outputs.verification-setup-pending == 'true' }} - uses: ./../.copilot-native-fixture-runtime - with: *native-fixture-inputs - env: - COPILOT_NATIVE_PHASE: continue - COPILOT_NATIVE_SOURCE: ${{ steps.copilot_native_fixture.outputs.verification-source }} - COPILOT_NATIVE_DIGEST: ${{ steps.copilot_native_fixture.outputs.verification-digest }} - COPILOT_NATIVE_GIT: ${{ steps.copilot_native_fixture.outputs.verification-git }} - COPILOT_NATIVE_TICKET: ${{ steps.copilot_native_fixture.outputs.verification-ticket }} - COPILOT_NATIVE_REQUEST: ${{ steps.verification_continue_9.outputs.verification-request }} - COPILOT_NATIVE_OUTCOME: ${{ steps.verification_setup_10.outcome }} - - name: Prepare repository verification 11 - id: verification_setup_11 - if: ${{ !cancelled() && steps.verification_continue_10.outcome == 'success' && steps.verification_continue_10.outputs.verification-setup-pending == 'true' }} - uses: ./.git/copilot-verification-setup - timeout-minutes: 5 - env: - HOME: ${{ steps.verification_continue_10.outputs.verification-home }} - USERPROFILE: ${{ steps.verification_continue_10.outputs.verification-userprofile }} - APPDATA: ${{ steps.verification_continue_10.outputs.verification-appdata }} - LOCALAPPDATA: ${{ steps.verification_continue_10.outputs.verification-localappdata }} - PATH: ${{ steps.verification_continue_10.outputs.verification-path }} - JAVA_HOME: ${{ steps.verification_continue_10.outputs.verification-java_home }} - TMP: ${{ steps.verification_continue_10.outputs.verification-tmp }} - TEMP: ${{ steps.verification_continue_10.outputs.verification-temp }} - TMPDIR: ${{ steps.verification_continue_10.outputs.verification-tmpdir }} - - name: Continue repository verification 11 - id: verification_continue_11 - if: ${{ always() && steps.verification_continue_10.outputs.verification-setup-pending == 'true' }} - uses: ./../.copilot-native-fixture-runtime - with: *native-fixture-inputs - env: - COPILOT_NATIVE_PHASE: continue - COPILOT_NATIVE_SOURCE: ${{ steps.copilot_native_fixture.outputs.verification-source }} - COPILOT_NATIVE_DIGEST: ${{ steps.copilot_native_fixture.outputs.verification-digest }} - COPILOT_NATIVE_GIT: ${{ steps.copilot_native_fixture.outputs.verification-git }} - COPILOT_NATIVE_TICKET: ${{ steps.copilot_native_fixture.outputs.verification-ticket }} - COPILOT_NATIVE_REQUEST: ${{ steps.verification_continue_10.outputs.verification-request }} - COPILOT_NATIVE_OUTCOME: ${{ steps.verification_setup_11.outcome }} - - name: Prepare repository verification 12 - id: verification_setup_12 - if: ${{ !cancelled() && steps.verification_continue_11.outcome == 'success' && steps.verification_continue_11.outputs.verification-setup-pending == 'true' }} - uses: ./.git/copilot-verification-setup - timeout-minutes: 5 - env: - HOME: ${{ steps.verification_continue_11.outputs.verification-home }} - USERPROFILE: ${{ steps.verification_continue_11.outputs.verification-userprofile }} - APPDATA: ${{ steps.verification_continue_11.outputs.verification-appdata }} - LOCALAPPDATA: ${{ steps.verification_continue_11.outputs.verification-localappdata }} - PATH: ${{ steps.verification_continue_11.outputs.verification-path }} - JAVA_HOME: ${{ steps.verification_continue_11.outputs.verification-java_home }} - TMP: ${{ steps.verification_continue_11.outputs.verification-tmp }} - TEMP: ${{ steps.verification_continue_11.outputs.verification-temp }} - TMPDIR: ${{ steps.verification_continue_11.outputs.verification-tmpdir }} - - name: Continue repository verification 12 - id: verification_continue_12 - if: ${{ always() && steps.verification_continue_11.outputs.verification-setup-pending == 'true' }} - uses: ./../.copilot-native-fixture-runtime - with: *native-fixture-inputs - env: - COPILOT_NATIVE_PHASE: continue - COPILOT_NATIVE_SOURCE: ${{ steps.copilot_native_fixture.outputs.verification-source }} - COPILOT_NATIVE_DIGEST: ${{ steps.copilot_native_fixture.outputs.verification-digest }} - COPILOT_NATIVE_GIT: ${{ steps.copilot_native_fixture.outputs.verification-git }} - COPILOT_NATIVE_TICKET: ${{ steps.copilot_native_fixture.outputs.verification-ticket }} - COPILOT_NATIVE_REQUEST: ${{ steps.verification_continue_11.outputs.verification-request }} - COPILOT_NATIVE_OUTCOME: ${{ steps.verification_setup_12.outcome }} - - name: Prepare repository verification 13 - id: verification_setup_13 - if: ${{ !cancelled() && steps.verification_continue_12.outcome == 'success' && steps.verification_continue_12.outputs.verification-setup-pending == 'true' }} - uses: ./.git/copilot-verification-setup - timeout-minutes: 5 - env: - HOME: ${{ steps.verification_continue_12.outputs.verification-home }} - USERPROFILE: ${{ steps.verification_continue_12.outputs.verification-userprofile }} - APPDATA: ${{ steps.verification_continue_12.outputs.verification-appdata }} - LOCALAPPDATA: ${{ steps.verification_continue_12.outputs.verification-localappdata }} - PATH: ${{ steps.verification_continue_12.outputs.verification-path }} - JAVA_HOME: ${{ steps.verification_continue_12.outputs.verification-java_home }} - TMP: ${{ steps.verification_continue_12.outputs.verification-tmp }} - TEMP: ${{ steps.verification_continue_12.outputs.verification-temp }} - TMPDIR: ${{ steps.verification_continue_12.outputs.verification-tmpdir }} - - name: Continue repository verification 13 - id: verification_continue_13 - if: ${{ always() && steps.verification_continue_12.outputs.verification-setup-pending == 'true' }} - uses: ./../.copilot-native-fixture-runtime - with: *native-fixture-inputs - env: - COPILOT_NATIVE_PHASE: continue - COPILOT_NATIVE_SOURCE: ${{ steps.copilot_native_fixture.outputs.verification-source }} - COPILOT_NATIVE_DIGEST: ${{ steps.copilot_native_fixture.outputs.verification-digest }} - COPILOT_NATIVE_GIT: ${{ steps.copilot_native_fixture.outputs.verification-git }} - COPILOT_NATIVE_TICKET: ${{ steps.copilot_native_fixture.outputs.verification-ticket }} - COPILOT_NATIVE_REQUEST: ${{ steps.verification_continue_12.outputs.verification-request }} - COPILOT_NATIVE_OUTCOME: ${{ steps.verification_setup_13.outcome }} - - name: Prepare repository verification 14 - id: verification_setup_14 - if: ${{ !cancelled() && steps.verification_continue_13.outcome == 'success' && steps.verification_continue_13.outputs.verification-setup-pending == 'true' }} - uses: ./.git/copilot-verification-setup - timeout-minutes: 5 - env: - HOME: ${{ steps.verification_continue_13.outputs.verification-home }} - USERPROFILE: ${{ steps.verification_continue_13.outputs.verification-userprofile }} - APPDATA: ${{ steps.verification_continue_13.outputs.verification-appdata }} - LOCALAPPDATA: ${{ steps.verification_continue_13.outputs.verification-localappdata }} - PATH: ${{ steps.verification_continue_13.outputs.verification-path }} - JAVA_HOME: ${{ steps.verification_continue_13.outputs.verification-java_home }} - TMP: ${{ steps.verification_continue_13.outputs.verification-tmp }} - TEMP: ${{ steps.verification_continue_13.outputs.verification-temp }} - TMPDIR: ${{ steps.verification_continue_13.outputs.verification-tmpdir }} - - name: Continue repository verification 14 - id: verification_continue_14 - if: ${{ always() && steps.verification_continue_13.outputs.verification-setup-pending == 'true' }} - uses: ./../.copilot-native-fixture-runtime - with: *native-fixture-inputs - env: - COPILOT_NATIVE_PHASE: continue - COPILOT_NATIVE_SOURCE: ${{ steps.copilot_native_fixture.outputs.verification-source }} - COPILOT_NATIVE_DIGEST: ${{ steps.copilot_native_fixture.outputs.verification-digest }} - COPILOT_NATIVE_GIT: ${{ steps.copilot_native_fixture.outputs.verification-git }} - COPILOT_NATIVE_TICKET: ${{ steps.copilot_native_fixture.outputs.verification-ticket }} - COPILOT_NATIVE_REQUEST: ${{ steps.verification_continue_13.outputs.verification-request }} - COPILOT_NATIVE_OUTCOME: ${{ steps.verification_setup_14.outcome }} - - name: Prepare repository verification 15 - id: verification_setup_15 - if: ${{ !cancelled() && steps.verification_continue_14.outcome == 'success' && steps.verification_continue_14.outputs.verification-setup-pending == 'true' }} - uses: ./.git/copilot-verification-setup - timeout-minutes: 5 - env: - HOME: ${{ steps.verification_continue_14.outputs.verification-home }} - USERPROFILE: ${{ steps.verification_continue_14.outputs.verification-userprofile }} - APPDATA: ${{ steps.verification_continue_14.outputs.verification-appdata }} - LOCALAPPDATA: ${{ steps.verification_continue_14.outputs.verification-localappdata }} - PATH: ${{ steps.verification_continue_14.outputs.verification-path }} - JAVA_HOME: ${{ steps.verification_continue_14.outputs.verification-java_home }} - TMP: ${{ steps.verification_continue_14.outputs.verification-tmp }} - TEMP: ${{ steps.verification_continue_14.outputs.verification-temp }} - TMPDIR: ${{ steps.verification_continue_14.outputs.verification-tmpdir }} - - name: Continue repository verification 15 - id: verification_continue_15 - if: ${{ always() && steps.verification_continue_14.outputs.verification-setup-pending == 'true' }} - uses: ./../.copilot-native-fixture-runtime - with: *native-fixture-inputs - env: - COPILOT_NATIVE_PHASE: continue - COPILOT_NATIVE_SOURCE: ${{ steps.copilot_native_fixture.outputs.verification-source }} - COPILOT_NATIVE_DIGEST: ${{ steps.copilot_native_fixture.outputs.verification-digest }} - COPILOT_NATIVE_GIT: ${{ steps.copilot_native_fixture.outputs.verification-git }} - COPILOT_NATIVE_TICKET: ${{ steps.copilot_native_fixture.outputs.verification-ticket }} - COPILOT_NATIVE_REQUEST: ${{ steps.verification_continue_14.outputs.verification-request }} - COPILOT_NATIVE_OUTCOME: ${{ steps.verification_setup_15.outcome }} - - name: Prepare repository verification 16 - id: verification_setup_16 - if: ${{ !cancelled() && steps.verification_continue_15.outcome == 'success' && steps.verification_continue_15.outputs.verification-setup-pending == 'true' }} - uses: ./.git/copilot-verification-setup - timeout-minutes: 5 - env: - HOME: ${{ steps.verification_continue_15.outputs.verification-home }} - USERPROFILE: ${{ steps.verification_continue_15.outputs.verification-userprofile }} - APPDATA: ${{ steps.verification_continue_15.outputs.verification-appdata }} - LOCALAPPDATA: ${{ steps.verification_continue_15.outputs.verification-localappdata }} - PATH: ${{ steps.verification_continue_15.outputs.verification-path }} - JAVA_HOME: ${{ steps.verification_continue_15.outputs.verification-java_home }} - TMP: ${{ steps.verification_continue_15.outputs.verification-tmp }} - TEMP: ${{ steps.verification_continue_15.outputs.verification-temp }} - TMPDIR: ${{ steps.verification_continue_15.outputs.verification-tmpdir }} - - name: Continue repository verification 16 - id: verification_continue_16 - if: ${{ always() && steps.verification_continue_15.outputs.verification-setup-pending == 'true' }} - uses: ./../.copilot-native-fixture-runtime - with: *native-fixture-inputs - env: - COPILOT_NATIVE_PHASE: continue - COPILOT_NATIVE_SOURCE: ${{ steps.copilot_native_fixture.outputs.verification-source }} - COPILOT_NATIVE_DIGEST: ${{ steps.copilot_native_fixture.outputs.verification-digest }} - COPILOT_NATIVE_GIT: ${{ steps.copilot_native_fixture.outputs.verification-git }} - COPILOT_NATIVE_TICKET: ${{ steps.copilot_native_fixture.outputs.verification-ticket }} - COPILOT_NATIVE_REQUEST: ${{ steps.verification_continue_15.outputs.verification-request }} - COPILOT_NATIVE_OUTCOME: ${{ steps.verification_setup_16.outcome }} - - name: Prepare repository verification 17 - id: verification_setup_17 - if: ${{ !cancelled() && steps.verification_continue_16.outcome == 'success' && steps.verification_continue_16.outputs.verification-setup-pending == 'true' }} - uses: ./.git/copilot-verification-setup - timeout-minutes: 5 - env: - HOME: ${{ steps.verification_continue_16.outputs.verification-home }} - USERPROFILE: ${{ steps.verification_continue_16.outputs.verification-userprofile }} - APPDATA: ${{ steps.verification_continue_16.outputs.verification-appdata }} - LOCALAPPDATA: ${{ steps.verification_continue_16.outputs.verification-localappdata }} - PATH: ${{ steps.verification_continue_16.outputs.verification-path }} - JAVA_HOME: ${{ steps.verification_continue_16.outputs.verification-java_home }} - TMP: ${{ steps.verification_continue_16.outputs.verification-tmp }} - TEMP: ${{ steps.verification_continue_16.outputs.verification-temp }} - TMPDIR: ${{ steps.verification_continue_16.outputs.verification-tmpdir }} - - name: Continue repository verification 17 - id: verification_continue_17 - if: ${{ always() && steps.verification_continue_16.outputs.verification-setup-pending == 'true' }} - uses: ./../.copilot-native-fixture-runtime - with: *native-fixture-inputs - env: - COPILOT_NATIVE_PHASE: continue - COPILOT_NATIVE_SOURCE: ${{ steps.copilot_native_fixture.outputs.verification-source }} - COPILOT_NATIVE_DIGEST: ${{ steps.copilot_native_fixture.outputs.verification-digest }} - COPILOT_NATIVE_GIT: ${{ steps.copilot_native_fixture.outputs.verification-git }} - COPILOT_NATIVE_TICKET: ${{ steps.copilot_native_fixture.outputs.verification-ticket }} - COPILOT_NATIVE_REQUEST: ${{ steps.verification_continue_16.outputs.verification-request }} - COPILOT_NATIVE_OUTCOME: ${{ steps.verification_setup_17.outcome }} - - name: Prepare repository verification 18 - id: verification_setup_18 - if: ${{ !cancelled() && steps.verification_continue_17.outcome == 'success' && steps.verification_continue_17.outputs.verification-setup-pending == 'true' }} - uses: ./.git/copilot-verification-setup - timeout-minutes: 5 - env: - HOME: ${{ steps.verification_continue_17.outputs.verification-home }} - USERPROFILE: ${{ steps.verification_continue_17.outputs.verification-userprofile }} - APPDATA: ${{ steps.verification_continue_17.outputs.verification-appdata }} - LOCALAPPDATA: ${{ steps.verification_continue_17.outputs.verification-localappdata }} - PATH: ${{ steps.verification_continue_17.outputs.verification-path }} - JAVA_HOME: ${{ steps.verification_continue_17.outputs.verification-java_home }} - TMP: ${{ steps.verification_continue_17.outputs.verification-tmp }} - TEMP: ${{ steps.verification_continue_17.outputs.verification-temp }} - TMPDIR: ${{ steps.verification_continue_17.outputs.verification-tmpdir }} - - name: Continue repository verification 18 - id: verification_continue_18 - if: ${{ always() && steps.verification_continue_17.outputs.verification-setup-pending == 'true' }} - uses: ./../.copilot-native-fixture-runtime - with: *native-fixture-inputs - env: - COPILOT_NATIVE_PHASE: continue - COPILOT_NATIVE_SOURCE: ${{ steps.copilot_native_fixture.outputs.verification-source }} - COPILOT_NATIVE_DIGEST: ${{ steps.copilot_native_fixture.outputs.verification-digest }} - COPILOT_NATIVE_GIT: ${{ steps.copilot_native_fixture.outputs.verification-git }} - COPILOT_NATIVE_TICKET: ${{ steps.copilot_native_fixture.outputs.verification-ticket }} - COPILOT_NATIVE_REQUEST: ${{ steps.verification_continue_17.outputs.verification-request }} - COPILOT_NATIVE_OUTCOME: ${{ steps.verification_setup_18.outcome }} - - name: Prepare repository verification 19 - id: verification_setup_19 - if: ${{ !cancelled() && steps.verification_continue_18.outcome == 'success' && steps.verification_continue_18.outputs.verification-setup-pending == 'true' }} - uses: ./.git/copilot-verification-setup - timeout-minutes: 5 - env: - HOME: ${{ steps.verification_continue_18.outputs.verification-home }} - USERPROFILE: ${{ steps.verification_continue_18.outputs.verification-userprofile }} - APPDATA: ${{ steps.verification_continue_18.outputs.verification-appdata }} - LOCALAPPDATA: ${{ steps.verification_continue_18.outputs.verification-localappdata }} - PATH: ${{ steps.verification_continue_18.outputs.verification-path }} - JAVA_HOME: ${{ steps.verification_continue_18.outputs.verification-java_home }} - TMP: ${{ steps.verification_continue_18.outputs.verification-tmp }} - TEMP: ${{ steps.verification_continue_18.outputs.verification-temp }} - TMPDIR: ${{ steps.verification_continue_18.outputs.verification-tmpdir }} - - name: Continue repository verification 19 - id: verification_continue_19 - if: ${{ always() && steps.verification_continue_18.outputs.verification-setup-pending == 'true' }} - uses: ./../.copilot-native-fixture-runtime - with: *native-fixture-inputs - env: - COPILOT_NATIVE_PHASE: continue - COPILOT_NATIVE_SOURCE: ${{ steps.copilot_native_fixture.outputs.verification-source }} - COPILOT_NATIVE_DIGEST: ${{ steps.copilot_native_fixture.outputs.verification-digest }} - COPILOT_NATIVE_GIT: ${{ steps.copilot_native_fixture.outputs.verification-git }} - COPILOT_NATIVE_TICKET: ${{ steps.copilot_native_fixture.outputs.verification-ticket }} - COPILOT_NATIVE_REQUEST: ${{ steps.verification_continue_18.outputs.verification-request }} - COPILOT_NATIVE_OUTCOME: ${{ steps.verification_setup_19.outcome }} - - name: Prepare repository verification 20 - id: verification_setup_20 - if: ${{ !cancelled() && steps.verification_continue_19.outcome == 'success' && steps.verification_continue_19.outputs.verification-setup-pending == 'true' }} - uses: ./.git/copilot-verification-setup - timeout-minutes: 5 - env: - HOME: ${{ steps.verification_continue_19.outputs.verification-home }} - USERPROFILE: ${{ steps.verification_continue_19.outputs.verification-userprofile }} - APPDATA: ${{ steps.verification_continue_19.outputs.verification-appdata }} - LOCALAPPDATA: ${{ steps.verification_continue_19.outputs.verification-localappdata }} - PATH: ${{ steps.verification_continue_19.outputs.verification-path }} - JAVA_HOME: ${{ steps.verification_continue_19.outputs.verification-java_home }} - TMP: ${{ steps.verification_continue_19.outputs.verification-tmp }} - TEMP: ${{ steps.verification_continue_19.outputs.verification-temp }} - TMPDIR: ${{ steps.verification_continue_19.outputs.verification-tmpdir }} - - name: Continue repository verification 20 - id: verification_continue_20 - if: ${{ always() && steps.verification_continue_19.outputs.verification-setup-pending == 'true' }} - uses: ./../.copilot-native-fixture-runtime - with: *native-fixture-inputs - env: - COPILOT_NATIVE_PHASE: continue - COPILOT_NATIVE_SOURCE: ${{ steps.copilot_native_fixture.outputs.verification-source }} - COPILOT_NATIVE_DIGEST: ${{ steps.copilot_native_fixture.outputs.verification-digest }} - COPILOT_NATIVE_GIT: ${{ steps.copilot_native_fixture.outputs.verification-git }} - COPILOT_NATIVE_TICKET: ${{ steps.copilot_native_fixture.outputs.verification-ticket }} - COPILOT_NATIVE_REQUEST: ${{ steps.verification_continue_19.outputs.verification-request }} - COPILOT_NATIVE_OUTCOME: ${{ steps.verification_setup_20.outcome }} - - name: Complete repository verification - id: verification_complete - if: ${{ always() && steps.copilot_native_fixture.outputs.verification-ticket != '' }} - uses: ./../.copilot-native-fixture-runtime - with: *native-fixture-inputs - env: - COPILOT_NATIVE_PHASE: finish - COPILOT_NATIVE_SOURCE: ${{ steps.copilot_native_fixture.outputs.verification-source }} - COPILOT_NATIVE_DIGEST: ${{ steps.copilot_native_fixture.outputs.verification-digest }} - COPILOT_NATIVE_GIT: ${{ steps.copilot_native_fixture.outputs.verification-git }} - COPILOT_NATIVE_TICKET: ${{ steps.copilot_native_fixture.outputs.verification-ticket }} + - *native_prepare_native_fixture_runtime + - *native_copilot_native_fixture + - *native_verification_setup_1 + - *native_verification_continue_1 + - *native_verification_setup_2 + - *native_verification_continue_2 + - *native_verification_setup_3 + - *native_verification_continue_3 + - *native_verification_setup_4 + - *native_verification_continue_4 + - *native_verification_setup_5 + - *native_verification_continue_5 + - *native_verification_setup_6 + - *native_verification_continue_6 + - *native_verification_setup_7 + - *native_verification_continue_7 + - *native_verification_setup_8 + - *native_verification_continue_8 + - *native_verification_setup_9 + - *native_verification_continue_9 + - *native_verification_setup_10 + - *native_verification_continue_10 + - *native_verification_setup_11 + - *native_verification_continue_11 + - *native_verification_setup_12 + - *native_verification_continue_12 + - *native_verification_setup_13 + - *native_verification_continue_13 + - *native_verification_setup_14 + - *native_verification_continue_14 + - *native_verification_setup_15 + - *native_verification_continue_15 + - *native_verification_setup_16 + - *native_verification_continue_16 + - *native_verification_setup_17 + - *native_verification_continue_17 + - *native_verification_setup_18 + - *native_verification_continue_18 + - *native_verification_setup_19 + - *native_verification_continue_19 + - *native_verification_setup_20 + - *native_verification_continue_20 + - *native_verification_complete - run: pnpm run build - run: pnpm run validate:build - run: pnpm run typecheck diff --git a/build/cli/index.js b/build/cli/index.js index df8ef9588..d6d58726e 100755 --- a/build/cli/index.js +++ b/build/cli/index.js @@ -47916,7 +47916,7 @@ Never expose credentials, tokens, private keys, or other secrets in issues, comm The setup runner profile selects placement; it does not install the project's language runtimes. An operator must provision the project's required runtimes and dependencies in every job that runs file-changing or branch-sync verification, before the Copilot step. A separate application CI job does not prepare this job. -Declare reviewed version prefixes in \`.copilot/verification-prerequisites.json\` (schemaVersion 1, runtimes such as java 17, node 24, pnpm 10). Copilot checks declared versions in the credential-free verification environment before each configured verification command; a missing or incompatible runtime blocks publication. Without this optional declaration, existing verification behavior remains and no language is inferred. Java provisioning may use \`actions/setup-java\`; \`JAVA_HOME\` and \`PATH\` survive isolation, while agent credentials and tool-option injection variables do not. Do not add an unreviewed bootstrap or weaken verification to work around a missing runtime. Read [verification prerequisites and same-job setup](https://docs.page/vypdev/copilot/security-operations/operations/verification#repository-verification-prerequisites). +Declare reviewed version prefixes in \`.copilot/verification-prerequisites.json\` (schemaVersion 1, runtimes such as java 17, node 24, pnpm 10). Copilot checks declared versions in the credential-free verification environment before each configured verification command; a missing or incompatible runtime blocks publication. Without this optional declaration, existing verification behavior remains and no language is inferred. Java provisioning may use \`actions/setup-java\`; \`JAVA_HOME\` and \`PATH\` survive isolation. Repository verification derives \`JDK_JAVA_OPTIONS\` for its private JVM user.home and \`GRADLE_USER_HOME\` inside the same fresh profile; inherited tool options, account caches and agent credentials remain excluded. Do not add an unreviewed bootstrap or weaken verification to work around a missing runtime. Read [verification prerequisites and same-job setup](https://docs.page/vypdev/copilot/security-operations/operations/verification#repository-verification-prerequisites). The optional repository-owned composite action prepares each candidate before verification. Setup creates .github/actions/copilot-verification-setup/action.yml only if missing and preserves an existing consumer action and its assets. The shared terminal/web assistant offers explicit activation, disabled by default. Customize the generated failing placeholder before enabling; setup generation and installer PRs do not prove runtime readiness. Review \`.github/actions/copilot-verification-setup/action.yml\` and its assets onto trusted main, update generated workflows, then enable \`VERIFICATION_SETUP=true\` (Action input \`verification-setup\`, disabled by default). GitHub Actions executes the trusted snapshot before each command with a fresh private HOME; candidate changes cannot replace it. Native post steps finish before profile cleanup. Setup failure blocks verification and commit/push. The local CLI cannot execute composite actions and fails closed when opted in. Read [repository-owned setup](https://docs.page/vypdev/copilot/security-operations/operations/verification#repository-owned-setup). @@ -103873,6 +103873,30 @@ function writeSpecFile(target, content, exists) { } +/***/ }), + +/***/ 46584: +/***/ ((__unused_webpack_module, exports) => { + +"use strict"; + +Object.defineProperty(exports, "__esModule", ({ value: true })); +exports.privateJvmHomeOption = privateJvmHomeOption; +/** Encode one JDK launcher argument, independently of shell/JSON/Windows argv quoting. */ +function privateJvmHomeOption(home) { + if (!home || /[\0\r\n]/u.test(home)) + throw new Error('Private JVM home is invalid.'); + const value = Array.from(home, character => { + if (character === '"') + return "'\"'"; + if (/[\s']/u.test(character)) + return '"' + character + '"'; + return character; + }).join(''); + return '-Duser.home=' + value; +} + + /***/ }), /***/ 78572: @@ -108333,6 +108357,7 @@ exports.prepareUntrustedCommandEnvironment = prepareUntrustedCommandEnvironment; const node_fs_1 = __nccwpck_require__(87561); const node_path_1 = __nccwpck_require__(49411); const agent_private_install_root_1 = __nccwpck_require__(44640); +const private_jvm_environment_1 = __nccwpck_require__(46584); const ALLOWED_VARIABLES = [ 'PATH', 'JAVA_HOME', @@ -108367,31 +108392,41 @@ const ALLOWED_VARIABLES = [ * credentials or paths to local agent authentication stores. */ function prepareUntrustedCommandEnvironment(source = process.env, platform = process.platform) { - const runtimeHome = (0, node_fs_1.realpathSync)((0, agent_private_install_root_1.createPrivateVerificationRuntimeRoot)()); - const environment = { HOME: runtimeHome }; - for (const variable of ALLOWED_VARIABLES) { - const value = source[variable]; - if (value !== undefined) - environment[variable] = value; - } - // Nested fixtures/installers must not fall back into host temp directories - // whose ancestors may be replaceable by another Windows principal. - const runtimeTemp = (0, node_path_1.join)(runtimeHome, 'temp'); - (0, node_fs_1.mkdirSync)(runtimeTemp, { mode: 0o700 }); - for (const key of ['TMP', 'TEMP', 'TMPDIR', 'RUNNER_TEMP']) - environment[key] = runtimeTemp; - if (platform === 'win32') { - environment.USERPROFILE = runtimeHome; - environment.APPDATA = (0, node_path_1.join)(runtimeHome, 'roaming'); - environment.LOCALAPPDATA = (0, node_path_1.join)(runtimeHome, 'local'); - for (const directory of [environment.APPDATA, environment.LOCALAPPDATA]) - (0, node_fs_1.mkdirSync)(directory, { mode: 0o700 }); - environment.PSModuleAnalysisCachePath = (0, node_path_1.join)(environment.LOCALAPPDATA, 'powershell-module-analysis.cache'); + const ownedRoot = (0, agent_private_install_root_1.createPrivateVerificationRuntimeRoot)(); + try { + const runtimeHome = (0, node_fs_1.realpathSync)(ownedRoot); + const environment = { HOME: runtimeHome }; + for (const variable of ALLOWED_VARIABLES) { + const value = source[variable]; + if (value !== undefined) + environment[variable] = value; + } + // These are derived, never inherited tool-option or account-cache settings. + environment.JDK_JAVA_OPTIONS = (0, private_jvm_environment_1.privateJvmHomeOption)(runtimeHome); + environment.GRADLE_USER_HOME = (0, node_path_1.join)(runtimeHome, '.gradle'); + (0, node_fs_1.mkdirSync)(environment.GRADLE_USER_HOME, { mode: 0o700 }); + // Nested fixtures/installers stay inside this command's owned profile. + const runtimeTemp = (0, node_path_1.join)(runtimeHome, 'temp'); + (0, node_fs_1.mkdirSync)(runtimeTemp, { mode: 0o700 }); + for (const key of ['TMP', 'TEMP', 'TMPDIR', 'RUNNER_TEMP']) + environment[key] = runtimeTemp; + if (platform === 'win32') { + environment.USERPROFILE = runtimeHome; + environment.APPDATA = (0, node_path_1.join)(runtimeHome, 'roaming'); + environment.LOCALAPPDATA = (0, node_path_1.join)(runtimeHome, 'local'); + for (const directory of [environment.APPDATA, environment.LOCALAPPDATA]) + (0, node_fs_1.mkdirSync)(directory, { mode: 0o700 }); + environment.PSModuleAnalysisCachePath = (0, node_path_1.join)(environment.LOCALAPPDATA, 'powershell-module-analysis.cache'); + } + return { + environment, + cleanup: () => (0, node_fs_1.rmSync)(runtimeHome, { recursive: true, force: true }), + }; + } + catch (error) { + (0, node_fs_1.rmSync)(ownedRoot, { recursive: true, force: true }); + throw error; } - return { - environment, - cleanup: () => (0, node_fs_1.rmSync)(runtimeHome, { recursive: true, force: true }), - }; } diff --git a/build/github_action/index.js b/build/github_action/index.js index 75092844d..83a2e3651 100644 --- a/build/github_action/index.js +++ b/build/github_action/index.js @@ -49770,7 +49770,7 @@ Never expose credentials, tokens, private keys, or other secrets in issues, comm The setup runner profile selects placement; it does not install the project's language runtimes. An operator must provision the project's required runtimes and dependencies in every job that runs file-changing or branch-sync verification, before the Copilot step. A separate application CI job does not prepare this job. -Declare reviewed version prefixes in \`.copilot/verification-prerequisites.json\` (schemaVersion 1, runtimes such as java 17, node 24, pnpm 10). Copilot checks declared versions in the credential-free verification environment before each configured verification command; a missing or incompatible runtime blocks publication. Without this optional declaration, existing verification behavior remains and no language is inferred. Java provisioning may use \`actions/setup-java\`; \`JAVA_HOME\` and \`PATH\` survive isolation, while agent credentials and tool-option injection variables do not. Do not add an unreviewed bootstrap or weaken verification to work around a missing runtime. Read [verification prerequisites and same-job setup](https://docs.page/vypdev/copilot/security-operations/operations/verification#repository-verification-prerequisites). +Declare reviewed version prefixes in \`.copilot/verification-prerequisites.json\` (schemaVersion 1, runtimes such as java 17, node 24, pnpm 10). Copilot checks declared versions in the credential-free verification environment before each configured verification command; a missing or incompatible runtime blocks publication. Without this optional declaration, existing verification behavior remains and no language is inferred. Java provisioning may use \`actions/setup-java\`; \`JAVA_HOME\` and \`PATH\` survive isolation. Repository verification derives \`JDK_JAVA_OPTIONS\` for its private JVM user.home and \`GRADLE_USER_HOME\` inside the same fresh profile; inherited tool options, account caches and agent credentials remain excluded. Do not add an unreviewed bootstrap or weaken verification to work around a missing runtime. Read [verification prerequisites and same-job setup](https://docs.page/vypdev/copilot/security-operations/operations/verification#repository-verification-prerequisites). The optional repository-owned composite action prepares each candidate before verification. Setup creates .github/actions/copilot-verification-setup/action.yml only if missing and preserves an existing consumer action and its assets. The shared terminal/web assistant offers explicit activation, disabled by default. Customize the generated failing placeholder before enabling; setup generation and installer PRs do not prove runtime readiness. Review \`.github/actions/copilot-verification-setup/action.yml\` and its assets onto trusted main, update generated workflows, then enable \`VERIFICATION_SETUP=true\` (Action input \`verification-setup\`, disabled by default). GitHub Actions executes the trusted snapshot before each command with a fresh private HOME; candidate changes cannot replace it. Native post steps finish before profile cleanup. Setup failure blocks verification and commit/push. The local CLI cannot execute composite actions and fails closed when opted in. Read [repository-owned setup](https://docs.page/vypdev/copilot/security-operations/operations/verification#repository-owned-setup). @@ -93949,6 +93949,7 @@ const core = __importStar(__nccwpck_require__(75855)); const node_child_process_1 = __nccwpck_require__(17718); const node_fs_1 = __nccwpck_require__(87561); const node_path_1 = __nccwpck_require__(49411); +const private_jvm_environment_1 = __nccwpck_require__(46584); const agent_private_install_root_1 = __nccwpck_require__(44640); const agent_trusted_system_tools_1 = __nccwpck_require__(76049); const github_action_input_1 = __nccwpck_require__(57581); @@ -94033,12 +94034,17 @@ async function awaitNativeBoundary(root, timeoutMs = 7200000) { if (!/^[a-f0-9-]{36}$/u.test(request.id) || !/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/u.test(request.sourceSha) || !/^[a-f0-9]{64}$/u.test(request.digest) || !request.environment || typeof request.environment.HOME !== 'string') throw new verification_setup_policy_1.VerificationSetupError('handoff-invalid'); + const home = request.environment.HOME; + if (!(0, node_path_1.isAbsolute)(home) || /[\r\n\0]/u.test(home) + || request.environment.JDK_JAVA_OPTIONS !== (0, private_jvm_environment_1.privateJvmHomeOption)(home) + || request.environment.GRADLE_USER_HOME !== (0, node_path_1.join)(home, '.gradle')) + throw new verification_setup_policy_1.VerificationSetupError('handoff-invalid'); core.setOutput('verification-request', request.id); core.setOutput('verification-source', request.sourceSha); core.setOutput('verification-digest', request.digest); core.saveState('native-verification-digest', request.digest); core.saveState('native-verification-source', request.sourceSha); - for (const key of ['HOME', 'USERPROFILE', 'APPDATA', 'LOCALAPPDATA', 'PATH', 'JAVA_HOME', 'TMP', 'TEMP', 'TMPDIR']) { + for (const key of ['HOME', 'USERPROFILE', 'APPDATA', 'LOCALAPPDATA', 'PATH', 'JAVA_HOME', 'JDK_JAVA_OPTIONS', 'GRADLE_USER_HOME', 'TMP', 'TEMP', 'TMPDIR']) { const value = request.environment[key] ?? ''; if (typeof value !== 'string' || /[\r\n\0]/u.test(value)) throw new verification_setup_policy_1.VerificationSetupError('handoff-invalid'); @@ -94940,6 +94946,30 @@ function writeSpecFile(target, content, exists) { } +/***/ }), + +/***/ 46584: +/***/ ((__unused_webpack_module, exports) => { + +"use strict"; + +Object.defineProperty(exports, "__esModule", ({ value: true })); +exports.privateJvmHomeOption = privateJvmHomeOption; +/** Encode one JDK launcher argument, independently of shell/JSON/Windows argv quoting. */ +function privateJvmHomeOption(home) { + if (!home || /[\0\r\n]/u.test(home)) + throw new Error('Private JVM home is invalid.'); + const value = Array.from(home, character => { + if (character === '"') + return "'\"'"; + if (/[\s']/u.test(character)) + return '"' + character + '"'; + return character; + }).join(''); + return '-Duser.home=' + value; +} + + /***/ }), /***/ 12471: @@ -95488,6 +95518,7 @@ exports.prepareUntrustedCommandEnvironment = prepareUntrustedCommandEnvironment; const node_fs_1 = __nccwpck_require__(87561); const node_path_1 = __nccwpck_require__(49411); const agent_private_install_root_1 = __nccwpck_require__(44640); +const private_jvm_environment_1 = __nccwpck_require__(46584); const ALLOWED_VARIABLES = [ 'PATH', 'JAVA_HOME', @@ -95522,31 +95553,41 @@ const ALLOWED_VARIABLES = [ * credentials or paths to local agent authentication stores. */ function prepareUntrustedCommandEnvironment(source = process.env, platform = process.platform) { - const runtimeHome = (0, node_fs_1.realpathSync)((0, agent_private_install_root_1.createPrivateVerificationRuntimeRoot)()); - const environment = { HOME: runtimeHome }; - for (const variable of ALLOWED_VARIABLES) { - const value = source[variable]; - if (value !== undefined) - environment[variable] = value; - } - // Nested fixtures/installers must not fall back into host temp directories - // whose ancestors may be replaceable by another Windows principal. - const runtimeTemp = (0, node_path_1.join)(runtimeHome, 'temp'); - (0, node_fs_1.mkdirSync)(runtimeTemp, { mode: 0o700 }); - for (const key of ['TMP', 'TEMP', 'TMPDIR', 'RUNNER_TEMP']) - environment[key] = runtimeTemp; - if (platform === 'win32') { - environment.USERPROFILE = runtimeHome; - environment.APPDATA = (0, node_path_1.join)(runtimeHome, 'roaming'); - environment.LOCALAPPDATA = (0, node_path_1.join)(runtimeHome, 'local'); - for (const directory of [environment.APPDATA, environment.LOCALAPPDATA]) - (0, node_fs_1.mkdirSync)(directory, { mode: 0o700 }); - environment.PSModuleAnalysisCachePath = (0, node_path_1.join)(environment.LOCALAPPDATA, 'powershell-module-analysis.cache'); + const ownedRoot = (0, agent_private_install_root_1.createPrivateVerificationRuntimeRoot)(); + try { + const runtimeHome = (0, node_fs_1.realpathSync)(ownedRoot); + const environment = { HOME: runtimeHome }; + for (const variable of ALLOWED_VARIABLES) { + const value = source[variable]; + if (value !== undefined) + environment[variable] = value; + } + // These are derived, never inherited tool-option or account-cache settings. + environment.JDK_JAVA_OPTIONS = (0, private_jvm_environment_1.privateJvmHomeOption)(runtimeHome); + environment.GRADLE_USER_HOME = (0, node_path_1.join)(runtimeHome, '.gradle'); + (0, node_fs_1.mkdirSync)(environment.GRADLE_USER_HOME, { mode: 0o700 }); + // Nested fixtures/installers stay inside this command's owned profile. + const runtimeTemp = (0, node_path_1.join)(runtimeHome, 'temp'); + (0, node_fs_1.mkdirSync)(runtimeTemp, { mode: 0o700 }); + for (const key of ['TMP', 'TEMP', 'TMPDIR', 'RUNNER_TEMP']) + environment[key] = runtimeTemp; + if (platform === 'win32') { + environment.USERPROFILE = runtimeHome; + environment.APPDATA = (0, node_path_1.join)(runtimeHome, 'roaming'); + environment.LOCALAPPDATA = (0, node_path_1.join)(runtimeHome, 'local'); + for (const directory of [environment.APPDATA, environment.LOCALAPPDATA]) + (0, node_fs_1.mkdirSync)(directory, { mode: 0o700 }); + environment.PSModuleAnalysisCachePath = (0, node_path_1.join)(environment.LOCALAPPDATA, 'powershell-module-analysis.cache'); + } + return { + environment, + cleanup: () => (0, node_fs_1.rmSync)(runtimeHome, { recursive: true, force: true }), + }; + } + catch (error) { + (0, node_fs_1.rmSync)(ownedRoot, { recursive: true, force: true }); + throw error; } - return { - environment, - cleanup: () => (0, node_fs_1.rmSync)(runtimeHome, { recursive: true, force: true }), - }; } diff --git a/docs/security-operations/operations/verification.mdx b/docs/security-operations/operations/verification.mdx index 6139dcdee..02715ecfd 100644 --- a/docs/security-operations/operations/verification.mdx +++ b/docs/security-operations/operations/verification.mdx @@ -115,9 +115,27 @@ selects its `bin/java` (`java.exe` on Windows), including installations not on `PATH`. Python uses `python3` on Linux/macOS and `python` on Windows; pnpm uses the installed Windows command shim via fixed `cmd.exe` arguments. The isolated `HOME`, temporary directories and Windows profile/cache paths remain private. -`JAVA_TOOL_OPTIONS`, `JDK_JAVA_OPTIONS`, `MAVEN_OPTS`, `GRADLE_USER_HOME`, -`NODE_OPTIONS`, agent auth-store paths and credentials are not inherited. Avoid -depending on authenticated caches or user-home build settings. +Inherited Java/Gradle tool options, Node options, agent auth-store paths and +credentials remain excluded. Copilot derives its own JVM user.home option and +Gradle user home inside each fresh verification profile, before native setup, +runtime probes and the configured command. Changing HOME alone is insufficient +for normal JVM discovery; this correction does not require a wrapper rewrite or +different verification commands. + +The derived `JDK_JAVA_OPTIONS` contains only that private user.home property; +`GRADLE_USER_HOME` points to the profile's `.gradle` directory. Caller values +cannot override them. `JAVA_TOOL_OPTIONS`, `_JAVA_OPTIONS`, `GRADLE_OPTS`, +`MAVEN_OPTS` and `NODE_OPTIONS` remain excluded. Each command starts with new +private configuration/cache state, retained only until its native post steps +finish. Provision required dependencies explicitly and avoid authenticated +account caches or user-home settings. + +Upgrade the Action and its canonical coordinator/generated callbacks together +so native setup also receives these derived values. The setup result still +accepts only approved PATH directories and JAVA_HOME, with no arbitrary option +forwarding. Private discovery does not provide an OS sandbox, prevent deliberate +candidate overrides or relocate Gradle distribution-level init scripts. Existing +runtime, verification, candidate and publication gates still apply. If a declared runtime is missing, incompatible or cannot be verified, the configured repository command is not executed. The existing result reports, diff --git a/scripts/coverage-budgets.json b/scripts/coverage-budgets.json index d40b39e30..724ba02a7 100644 --- a/scripts/coverage-budgets.json +++ b/scripts/coverage-budgets.json @@ -1143,6 +1143,28 @@ } ], "successMessage": "unpublished candidate replacement coverage: PASS (100% lines/statements/branches/functions)" + }, + { + "name": "Private JVM and Gradle discovery", + "missingEntryLabel": "private JVM and Gradle discovery", + "rules": [ + { + "files": [ + "src/infrastructure/private_jvm_environment.ts", + "src/infrastructure/untrusted_command_environment.ts" + ], + "mode": "each", + "thresholdProfile": "exhaustive" + }, + { + "files": [ + "src/infrastructure/native_verification_controller.ts" + ], + "mode": "each", + "thresholdProfile": "default" + } + ], + "successMessage": "private JVM/Gradle coverage: PASS (encoding/profile100%; native controller95/90)" } ] } diff --git a/scripts/generate-native-verification-workflows.cjs b/scripts/generate-native-verification-workflows.cjs index f2c5c23ec..b3d058621 100644 --- a/scripts/generate-native-verification-workflows.cjs +++ b/scripts/generate-native-verification-workflows.cjs @@ -23,7 +23,7 @@ function phaseSteps(action, inputAlias = 'copilot-inputs', id = 'copilot') { const output = key => `\${{ steps.${previous}.outputs.verification-${key} }}`; steps.push({ name: `Prepare repository verification ${count}`, id: setup, if: `\${{ !cancelled() && steps.${previous}.outcome == 'success' && ${pending} }}`, uses: ACTION, 'timeout-minutes': 5, - env: Object.fromEntries(['HOME', 'USERPROFILE', 'APPDATA', 'LOCALAPPDATA', 'PATH', 'JAVA_HOME', 'TMP', 'TEMP', 'TMPDIR'].map(key => [key, output(key.toLowerCase())])) }); + env: Object.fromEntries(['HOME', 'USERPROFILE', 'APPDATA', 'LOCALAPPDATA', 'PATH', 'JAVA_HOME', 'JDK_JAVA_OPTIONS', 'GRADLE_USER_HOME', 'TMP', 'TEMP', 'TMPDIR'].map(key => [key, output(key.toLowerCase())])) }); steps.push({ name: `Continue repository verification ${count}`, id: continuation, if: `\${{ always() && ${pending} }}`, uses: action, with: { alias: inputAlias }, env: { COPILOT_NATIVE_PHASE: 'continue', COPILOT_NATIVE_SOURCE: `\${{ steps.${id}.outputs.verification-source }}`, COPILOT_NATIVE_DIGEST: `\${{ steps.${id}.outputs.verification-digest }}`, COPILOT_NATIVE_GIT: `\${{ steps.${id}.outputs.verification-git }}`, COPILOT_NATIVE_TICKET: `\${{ steps.${id}.outputs.verification-ticket }}`, diff --git a/specs/CATALOG.md b/specs/CATALOG.md index ccf37b95b..c0bfdced8 100644 --- a/specs/CATALOG.md +++ b/specs/CATALOG.md @@ -16,7 +16,7 @@ debt or convert unknown historic intent into a design decision. | `bugbot-review-state-reconciliation` | Implemented | Reconcile review snapshots, findings, threads, comments, and check conclusions | [Bugbot review-state reconciliation](./bugbot-review-state-reconciliation.md) | 86 paths · 2026-10-26 | | `execution-lifecycle` | Implemented | Shared GitHub Action lifecycle with pinned native resource/lane coordination proof, conservative predecessor fencing, routing and durable user-facing results | [Execution admission, queueing, routing, and result publication](./execution-admission-queue-and-publication.md) + 4 companion | 159 paths · 2026-10-29 | | `architecture-quality-hardening` | Implemented | Close verified concurrency, error-contract, context-coupling, fan-out, setup/doctor, and provider-policy risks in dependency order | [Architecture quality and scalability hardening](./architecture-quality-and-scalability-hardening.md) + 1 companion | 72 paths · 2026-10-13 | -| `setup-and-doctor` | Implemented | Plan, validate, provision, and audit a repository installation without exposing credentials | [Setup, configuration, credentials, and doctor](./setup-configuration-credentials-and-doctor.md) + 6 companion | 332 paths · 2026-10-24 | +| `setup-and-doctor` | Implemented | Plan, validate, provision, and audit a repository installation without exposing credentials | [Setup, configuration, credentials, and doctor](./setup-configuration-credentials-and-doctor.md) + 6 companion | 334 paths · 2026-10-29 | | `local-web-setup-assistant` | Proposed | Offer a packaged, loopback-only Svelte setup interface over the existing engine with four-language guidance, English CLI help, basic/custom first-run paths, editable question and plan review, source-labelled GitHub facts, assisted CI and Project evidence, role-separated PATs, and truthful itemized outcomes; inspect existing configuration and apply independent, scope-aware runtime adjustments with permission, drift and read-back verification | [Local web setup assistant](./local-web-setup-assistant.md) + 2 companion | 248 paths · 2026-10-21 | | `guided-bot-pat-onboarding` | Proposed | Guide creation of the persistent workflow PAT, verify bot identity and grants, recover explicitly from wrong-account input within the session, and install the approved Actions Secret | [Guided bot PAT onboarding](./guided-bot-pat-onboarding.md) | 39 paths · 2026-10-07 | | `temporary-setup-operator-authorization` | Proposed | Guide creation of the one-run operator PAT through GitHub's official form, verify final setup access, and report user-owned deletion accurately | [Assisted setup PAT creation](./temporary-setup-operator-authorization.md) | 36 paths · 2026-10-18 | @@ -24,9 +24,9 @@ debt or convert unknown historic intent into a design decision. | `managed-issue-lifecycle` | As-built baseline | Convert typed issues into traceable work branches, project state, and lifecycle state | [Managed issue and branch lifecycle](./managed-issue-and-branch-lifecycle.md) | 71 paths · 2026-10-20 | | `comment-automation` | Implemented | Admit only explicit commands or exact mentions, then route them while protecting repository mutations | [Comment automation and authorization](./comment-automation-and-authorization.md) | 88 paths · 2026-10-26 | | `bugbot-analysis-and-autofix` | Implemented | Select one canonical PR, exhaustively analyze bounded diff partitions with version-grounded dependency, delegated test-path and external Action input-contract, host-aware self-repository references and Kotlin/Wasm lexical-binding and renderer-grounded Markdown path evidence, publish stable findings atomically, and apply authorized verified fixes | [Bugbot analysis, finding publication, and autofix](./bugbot-analysis-publication-and-autofix.md) + 3 companion | 130 paths · 2026-10-29 | -| `branch-synchronization` | Implemented | Observe parent drift with one localized status card and transition-only notifications, then safely merge a parent branch into a linked working branch | [Branch synchronization and conflict recovery](./branch-synchronization-and-conflict-recovery.md) + 2 companion | 134 paths · 2026-10-27 | +| `branch-synchronization` | Implemented | Observe parent drift with one localized status card and transition-only notifications, then safely merge a parent branch into a linked working branch | [Branch synchronization and conflict recovery](./branch-synchronization-and-conflict-recovery.md) + 2 companion | 139 paths · 2026-10-29 | | `pull-request-lifecycle` | Implemented | Enrich linked and unlinked pull requests with safe issue linkage, projects, metadata, reviewers, concise descriptions, and distinct workflow evidence | [Pull request lifecycle and enrichment](./pull-request-lifecycle-and-enrichment.md) | 77 paths · 2026-10-20 | -| `agent-runtime` | Implemented | Resolve, provision, authenticate, authorize, and execute only the agent roles reachable by a run | [Agent runtime, provider, model, and role routing](./agent-runtime-provider-and-model-routing.md) + 1 companion | 100 paths · 2026-10-24 | +| `agent-runtime` | Implemented | Resolve, provision, authenticate, authorize, and execute only the agent roles reachable by a run | [Agent runtime, provider, model, and role routing](./agent-runtime-provider-and-model-routing.md) + 1 companion | 102 paths · 2026-10-29 | | `cli-and-single-actions` | As-built baseline | Expose bounded local commands and workflow-dispatched operations through the shared application core | [CLI and single-action execution](./cli-and-single-action-execution.md) | 51 paths · 2026-10-28 | | `configurable-issue-workflows` | Implemented | Select canonical issue workflows and explicit consumer field mappings; preserve forms, compare setup/doctor schemas, and report actionable fail-closed admission without state writes | [Configurable issue workflows and fail-closed admission](./configurable-issue-workflows-and-admission.md) | 119 paths · 2026-10-27 | | `repository-agent-collaboration` | Implemented | Generate safe repository-local profiles, guidance, and a skill for agents contributing through configured issues, Action-managed branches, pull requests, and deployment boundaries | [Repository agent collaboration contract](./repository-agent-collaboration-contract.md) | 47 paths · 2026-10-17 | @@ -104,12 +104,12 @@ debt or convert unknown historic intent into a design decision. ### `setup-and-doctor` — Setup, configuration, credentials, and doctor - Owner: Copilot maintainers -- Last verified: 2026-10-24 +- Last verified: 2026-10-29 - Specifications: [`specs/setup-configuration-credentials-and-doctor.md`](./setup-configuration-credentials-and-doctor.md) · [`specs/setup-doctor-architecture-hardening.md`](./setup-doctor-architecture-hardening.md) · [`specs/setup-pat-permission-guidance-and-verification.md`](./setup-pat-permission-guidance-and-verification.md) · [`specs/github-runtime-doctor-command.md`](./github-runtime-doctor-command.md) · [`specs/organization-configuration-reuse-and-batch-setup.md`](./organization-configuration-reuse-and-batch-setup.md) · [`specs/setup-runner-profiles-and-installation-parity.md`](./setup-runner-profiles-and-installation-parity.md) · [`specs/copilot-comment-workflow-coordinator.md`](./copilot-comment-workflow-coordinator.md) - Workflows: [`setup/workflows/agent-cli-provisioning.yml`](../setup/workflows/agent-cli-provisioning.yml) · [`setup/workflows/copilot_credential_health.yml`](../setup/workflows/copilot_credential_health.yml) · [`.github/workflows/copilot_issue_comment.yml`](../.github/workflows/copilot_issue_comment.yml) · [`.github/workflows/copilot_pull_request_comment.yml`](../.github/workflows/copilot_pull_request_comment.yml) · [`.github/workflows/agent-cli-provisioning.yml`](../.github/workflows/agent-cli-provisioning.yml) · [`.github/workflows/copilot_credential_health.yml`](../.github/workflows/copilot_credential_health.yml) · [`.github/workflows/copilot_commit.yml`](../.github/workflows/copilot_commit.yml) · [`.github/workflows/copilot_branch_sync.yml`](../.github/workflows/copilot_branch_sync.yml) · [`setup/workflows/copilot_commit.yml`](../setup/workflows/copilot_commit.yml) · [`setup/workflows/copilot_branch_sync.yml`](../setup/workflows/copilot_branch_sync.yml) · [`setup/workflows/copilot_issue_comment.yml`](../setup/workflows/copilot_issue_comment.yml) · [`setup/workflows/copilot_pull_request_comment.yml`](../setup/workflows/copilot_pull_request_comment.yml) - Entrypoints: [`src/cli/commands/setup.ts`](../src/cli/commands/setup.ts) · [`src/cli/commands/doctor.ts`](../src/cli/commands/doctor.ts) · [`src/application/usecases/issue_comment_use_case.ts`](../src/application/usecases/issue_comment_use_case.ts) · [`src/application/usecases/pull_request_review_comment_use_case.ts`](../src/application/usecases/pull_request_review_comment_use_case.ts) -- Core code: [`src/domain/setup.ts`](../src/domain/setup.ts) · [`src/domain/setup_questionnaire.ts`](../src/domain/setup_questionnaire.ts) · [`src/domain/setup_token_permissions.ts`](../src/domain/setup_token_permissions.ts) · [`src/application/ports/setup_terminal_ports.ts`](../src/application/ports/setup_terminal_ports.ts) · [`src/application/ports/setup_wizard_ports.ts`](../src/application/ports/setup_wizard_ports.ts) · [`src/application/ports/branch_tag_ports.ts`](../src/application/ports/branch_tag_ports.ts) · [`src/application/policies/setup_issue_workflow_policy.ts`](../src/application/policies/setup_issue_workflow_policy.ts) · [`src/data/repository/release/repository_version_tags_query_repository.ts`](../src/data/repository/release/repository_version_tags_query_repository.ts) · [`src/application/ports/setup_token_permission_ports.ts`](../src/application/ports/setup_token_permission_ports.ts) · [`src/application/policies/setup_token_permission_evidence_policy.ts`](../src/application/policies/setup_token_permission_evidence_policy.ts) · [`src/application/policies/setup_token_permission_policy.ts`](../src/application/policies/setup_token_permission_policy.ts) · [`src/application/policies/setup_questionnaire_policy.ts`](../src/application/policies/setup_questionnaire_policy.ts) · [`src/application/policies/setup_configuration_plan.ts`](../src/application/policies/setup_configuration_plan.ts) · [`src/application/policies/merge_setup_overrides_policy.ts`](../src/application/policies/merge_setup_overrides_policy.ts) · [`src/application/policies/setup_configuration_storage_policy.ts`](../src/application/policies/setup_configuration_storage_policy.ts) · [`src/application/policies/setup_doctor_message_catalog.ts`](../src/application/policies/setup_doctor_message_catalog.ts) · [`src/application/policies/setup_doctor_report_policy.ts`](../src/application/policies/setup_doctor_report_policy.ts) · [`src/application/policies/setup_journey_policy.ts`](../src/application/policies/setup_journey_policy.ts) · [`src/application/policies/setup_permission_summary_policy.ts`](../src/application/policies/setup_permission_summary_policy.ts) · [`src/application/usecases/setup/setup_wizard_use_case.ts`](../src/application/usecases/setup/setup_wizard_use_case.ts) · [`src/application/usecases/setup/setup_journey_use_case.ts`](../src/application/usecases/setup/setup_journey_use_case.ts) · [`src/application/usecases/setup/setup_session_coordinator.ts`](../src/application/usecases/setup/setup_session_coordinator.ts) · [`src/application/usecases/setup/setup_questionnaire_controller.ts`](../src/application/usecases/setup/setup_questionnaire_controller.ts) · [`src/application/usecases/setup/setup_credentials_use_case.ts`](../src/application/usecases/setup/setup_credentials_use_case.ts) · [`src/application/usecases/setup/setup_token_permissions_use_case.ts`](../src/application/usecases/setup/setup_token_permissions_use_case.ts) · [`src/application/usecases/setup/doctor_use_case.ts`](../src/application/usecases/setup/doctor_use_case.ts) · [`src/application/usecases/setup/merge_queue_readiness_use_case.ts`](../src/application/usecases/setup/merge_queue_readiness_use_case.ts) · [`src/application/usecases/actions/initial_setup_workflow.ts`](../src/application/usecases/actions/initial_setup_workflow.ts) · [`src/application/usecases/actions/setup_resource_provisioning.ts`](../src/application/usecases/actions/setup_resource_provisioning.ts) · [`src/application/ports/message_catalog_ports.ts`](../src/application/ports/message_catalog_ports.ts) · [`src/application/usecases/localization/resolve_message_catalog_use_case.ts`](../src/application/usecases/localization/resolve_message_catalog_use_case.ts) · [`src/application/policies/setup_configuration_validation.ts`](../src/application/policies/setup_configuration_validation.ts) · [`src/infrastructure/setup_workspace_adapter.ts`](../src/infrastructure/setup_workspace_adapter.ts) · [`src/data/repository/repository_variables_repository.ts`](../src/data/repository/repository_variables_repository.ts) · [`src/infrastructure/github/ports/github_repository_variables_protocol.ts`](../src/infrastructure/github/ports/github_repository_variables_protocol.ts) · [`src/infrastructure/setup_remote_credential_health_adapter.ts`](../src/infrastructure/setup_remote_credential_health_adapter.ts) · [`src/infrastructure/setup_credential_validation_adapter.ts`](../src/infrastructure/setup_credential_validation_adapter.ts) · [`src/infrastructure/setup_token_permission_query_adapter.ts`](../src/infrastructure/setup_token_permission_query_adapter.ts) · [`src/infrastructure/setup_permission_actions_probe.ts`](../src/infrastructure/setup_permission_actions_probe.ts) · [`src/infrastructure/setup_permission_issue_probe.ts`](../src/infrastructure/setup_permission_issue_probe.ts) · [`src/infrastructure/setup_permission_issue_cleanup.ts`](../src/infrastructure/setup_permission_issue_cleanup.ts) · [`src/infrastructure/setup_permission_probe_journal.ts`](../src/infrastructure/setup_permission_probe_journal.ts) · [`src/infrastructure/setup_permission_probe_transaction.ts`](../src/infrastructure/setup_permission_probe_transaction.ts) · [`src/infrastructure/setup_permission_resource_probes.ts`](../src/infrastructure/setup_permission_resource_probes.ts) · [`src/infrastructure/setup_projects_probe_page_policy.ts`](../src/infrastructure/setup_projects_probe_page_policy.ts) · [`src/cli/setup_terminal_driver.ts`](../src/cli/setup_terminal_driver.ts) · [`src/cli/setup_question_renderer.ts`](../src/cli/setup_question_renderer.ts) · [`src/cli/setup_journey_presenter.ts`](../src/cli/setup_journey_presenter.ts) · [`src/cli/setup_plan_presenter.ts`](../src/cli/setup_plan_presenter.ts) · [`src/cli/setup_doctor_presenter.ts`](../src/cli/setup_doctor_presenter.ts) · [`src/cli/setup_prompt_rendering.ts`](../src/cli/setup_prompt_rendering.ts) · [`src/cli/setup_credential_prompt_adapter.ts`](../src/cli/setup_credential_prompt_adapter.ts) · [`src/cli/setup_credential_collection.ts`](../src/cli/setup_credential_collection.ts) · [`src/cli/commands/setup_execution.ts`](../src/cli/commands/setup_execution.ts) · [`src/cli/setup_token_permission_presenter.ts`](../src/cli/setup_token_permission_presenter.ts) · [`src/infrastructure/composition/setup_credentials_composition_root.ts`](../src/infrastructure/composition/setup_credentials_composition_root.ts) · [`src/infrastructure/composition/setup_token_permissions_composition_root.ts`](../src/infrastructure/composition/setup_token_permissions_composition_root.ts) · [`src/infrastructure/composition/setup_doctor_composition_root.ts`](../src/infrastructure/composition/setup_doctor_composition_root.ts) · [`scripts/coverage-budgets.json`](../scripts/coverage-budgets.json) · [`scripts/documentation_pat_exception_policy.cjs`](../scripts/documentation_pat_exception_policy.cjs) · [`scripts/validate-documentation-contract.cjs`](../scripts/validate-documentation-contract.cjs) · [`src/infrastructure/http_deadline.ts`](../src/infrastructure/http_deadline.ts) · [`src/infrastructure/setup_permission_denial.ts`](../src/infrastructure/setup_permission_denial.ts) · [`src/infrastructure/setup_permission_read_probe.ts`](../src/infrastructure/setup_permission_read_probe.ts) · [`src/infrastructure/setup_permission_read_evidence.ts`](../src/infrastructure/setup_permission_read_evidence.ts) · [`src/infrastructure/setup_permission_read_shape.ts`](../src/infrastructure/setup_permission_read_shape.ts) · [`src/infrastructure/setup_permission_projects_read.ts`](../src/infrastructure/setup_permission_projects_read.ts) · [`src/infrastructure/setup_permission_projects_access.ts`](../src/infrastructure/setup_permission_projects_access.ts) · [`src/infrastructure/setup_permission_workflow_cleanup.ts`](../src/infrastructure/setup_permission_workflow_cleanup.ts) · [`src/infrastructure/setup_permission_project_cleanup.ts`](../src/infrastructure/setup_permission_project_cleanup.ts) · [`src/infrastructure/setup_permission_probe_http.ts`](../src/infrastructure/setup_permission_probe_http.ts) · [`src/infrastructure/setup_permission_pull_request_probe.ts`](../src/infrastructure/setup_permission_pull_request_probe.ts) · [`src/infrastructure/git_authentication_environment.ts`](../src/infrastructure/git_authentication_environment.ts) · [`src/actions/github_action_input.ts`](../src/actions/github_action_input.ts) · [`src/infrastructure/setup_github_identity_query_adapter.ts`](../src/infrastructure/setup_github_identity_query_adapter.ts) · [`src/infrastructure/github_secret_encryption.ts`](../src/infrastructure/github_secret_encryption.ts) · [`src/infrastructure/setup_permission_organization_owner.ts`](../src/infrastructure/setup_permission_organization_owner.ts) · [`src/data/repository/github/github_actions_resource_inspector.ts`](../src/data/repository/github/github_actions_resource_inspector.ts) · [`src/data/repository/github/github_actions_resource_commands.ts`](../src/data/repository/github/github_actions_resource_commands.ts) · [`src/data/repository/github/github_actions_resource_collection.ts`](../src/data/repository/github/github_actions_resource_collection.ts) · [`src/application/usecases/setup/resolve_setup_workflow_pat_conflict_use_case.ts`](../src/application/usecases/setup/resolve_setup_workflow_pat_conflict_use_case.ts) · [`src/cli/setup_workflow_pat_storage_copy.ts`](../src/cli/setup_workflow_pat_storage_copy.ts) · [`src/cli/commands/setup_policy.ts`](../src/cli/commands/setup_policy.ts) · [`src/application/usecases/execution/execution_issue_number_policy.ts`](../src/application/usecases/execution/execution_issue_number_policy.ts) · [`src/application/usecases/execution/setup_execution_workflow.ts`](../src/application/usecases/execution/setup_execution_workflow.ts) · [`src/domain/github_runtime_doctor.ts`](../src/domain/github_runtime_doctor.ts) · [`src/domain/copilot_command.ts`](../src/domain/copilot_command.ts) · [`src/application/usecases/comment_automation_command_workflow.ts`](../src/application/usecases/comment_automation_command_workflow.ts) · [`src/application/policies/copilot_interaction_policy.ts`](../src/application/policies/copilot_interaction_policy.ts) · [`src/application/policies/publication_message_catalog.ts`](../src/application/policies/publication_message_catalog.ts) · [`src/application/ports/github_runtime_doctor_ports.ts`](../src/application/ports/github_runtime_doctor_ports.ts) · [`src/application/policies/github_runtime_doctor_policy.ts`](../src/application/policies/github_runtime_doctor_policy.ts) · [`src/application/policies/doctor_workflow_condition_policy.ts`](../src/application/policies/doctor_workflow_condition_policy.ts) · [`src/application/policies/github_runtime_doctor_presentation_policy.ts`](../src/application/policies/github_runtime_doctor_presentation_policy.ts) · [`src/application/usecases/read_copilot_doctor_workflow.ts`](../src/application/usecases/read_copilot_doctor_workflow.ts) · [`src/data/repository/github/runtime_doctor_repository.ts`](../src/data/repository/github/runtime_doctor_repository.ts) · [`src/infrastructure/composition/github_runtime_doctor_composition_root.ts`](../src/infrastructure/composition/github_runtime_doctor_composition_root.ts) · [`src/application/policies/agent_activity_policy.ts`](../src/application/policies/agent_activity_policy.ts) · [`src/application/policies/doctor_workflow_matrix_policy.ts`](../src/application/policies/doctor_workflow_matrix_policy.ts) · [`src/application/contracts/setup_batch_view.ts`](../src/application/contracts/setup_batch_view.ts) · [`src/application/policies/issue_resource_input_policy.ts`](../src/application/policies/issue_resource_input_policy.ts) · [`src/application/policies/setup_batch_access_policy.ts`](../src/application/policies/setup_batch_access_policy.ts) · [`src/application/policies/setup_batch_policy.ts`](../src/application/policies/setup_batch_policy.ts) · [`src/application/policies/setup_batch_retry_policy.ts`](../src/application/policies/setup_batch_retry_policy.ts) · [`src/application/policies/setup_batch_selection_policy.ts`](../src/application/policies/setup_batch_selection_policy.ts) · [`src/application/policies/setup_batch_view_policy.ts`](../src/application/policies/setup_batch_view_policy.ts) · [`src/application/policies/setup_credential_binding_policy.ts`](../src/application/policies/setup_credential_binding_policy.ts) · [`src/application/policies/setup_organization_import_policy.ts`](../src/application/policies/setup_organization_import_policy.ts) · [`src/application/policies/setup_organization_variable_bindings.ts`](../src/application/policies/setup_organization_variable_bindings.ts) · [`src/application/policies/setup_organization_variable_reuse_policy.ts`](../src/application/policies/setup_organization_variable_reuse_policy.ts) · [`src/application/ports/setup_batch_ports.ts`](../src/application/ports/setup_batch_ports.ts) · [`src/application/usecases/setup/apply_setup_batch_use_case.ts`](../src/application/usecases/setup/apply_setup_batch_use_case.ts) · [`src/application/usecases/setup/configure_setup_batch_target_use_case.ts`](../src/application/usecases/setup/configure_setup_batch_target_use_case.ts) · [`src/application/usecases/setup/prepare_setup_batch_use_case.ts`](../src/application/usecases/setup/prepare_setup_batch_use_case.ts) · [`src/application/usecases/setup/select_setup_batch_targets_use_case.ts`](../src/application/usecases/setup/select_setup_batch_targets_use_case.ts) · [`src/application/usecases/setup/setup_batch_session_use_case.ts`](../src/application/usecases/setup/setup_batch_session_use_case.ts) · [`src/cli/setup_batch_adapter.ts`](../src/cli/setup_batch_adapter.ts) · [`src/cli/setup_source_adapter.ts`](../src/cli/setup_source_adapter.ts) · [`src/domain/setup_batch.ts`](../src/domain/setup_batch.ts) · [`src/domain/setup_credential_health.ts`](../src/domain/setup_credential_health.ts) · [`src/domain/setup_organization_reuse.ts`](../src/domain/setup_organization_reuse.ts) · [`src/infrastructure/composition/setup_batch_composition_root.ts`](../src/infrastructure/composition/setup_batch_composition_root.ts) · [`src/infrastructure/github/ports/github_setup_batch_protocol.ts`](../src/infrastructure/github/ports/github_setup_batch_protocol.ts) · [`src/infrastructure/github/ports/github_trusted_credential_health_protocol.ts`](../src/infrastructure/github/ports/github_trusted_credential_health_protocol.ts) · [`src/infrastructure/setup_batch_github_apply_adapter.ts`](../src/infrastructure/setup_batch_github_apply_adapter.ts) · [`src/infrastructure/setup_batch_github_read_adapter.ts`](../src/infrastructure/setup_batch_github_read_adapter.ts) · [`src/infrastructure/setup_batch_journal_adapter.ts`](../src/infrastructure/setup_batch_journal_adapter.ts) · [`src/infrastructure/setup_batch_workspace_adapter.ts`](../src/infrastructure/setup_batch_workspace_adapter.ts) · [`src/infrastructure/setup_trusted_credential_health_adapter.ts`](../src/infrastructure/setup_trusted_credential_health_adapter.ts) · [`src/application/policies/setup_remote_facts_policy.ts`](../src/application/policies/setup_remote_facts_policy.ts) · [`src/cli/setup_confirmation_adapter.ts`](../src/cli/setup_confirmation_adapter.ts) · [`src/cli/web_setup_adapters.ts`](../src/cli/web_setup_adapters.ts) · [`scripts/validate-agent-documentation.cjs`](../scripts/validate-agent-documentation.cjs) · [`src/utils/setup_workflow_upgrade.ts`](../src/utils/setup_workflow_upgrade.ts) · [`src/domain/setup_runner.ts`](../src/domain/setup_runner.ts) · [`src/application/policies/setup_runner_policy.ts`](../src/application/policies/setup_runner_policy.ts) · [`src/application/policies/setup_runner_question_policy.ts`](../src/application/policies/setup_runner_question_policy.ts) · [`src/application/policies/setup_runner_guidance_policy.ts`](../src/application/policies/setup_runner_guidance_policy.ts) · [`src/application/ports/setup_runner_ports.ts`](../src/application/ports/setup_runner_ports.ts) · [`src/infrastructure/setup_runner_discovery_adapter.ts`](../src/infrastructure/setup_runner_discovery_adapter.ts) · [`src/infrastructure/composition/setup_runner_composition_root.ts`](../src/infrastructure/composition/setup_runner_composition_root.ts) · [`src/utils/setup_installation_review.ts`](../src/utils/setup_installation_review.ts) · [`src/cli/setup_installation_review_presenter.ts`](../src/cli/setup_installation_review_presenter.ts) · [`src/application/policies/setup_runner_installation_summary_policy.ts`](../src/application/policies/setup_runner_installation_summary_policy.ts) · [`src/utils/setup_files.ts`](../src/utils/setup_files.ts) · [`src/domain/specification_catalog_path_policy.cjs`](../src/domain/specification_catalog_path_policy.cjs) · [`src/domain/sdd_prerequisite_policy.cjs`](../src/domain/sdd_prerequisite_policy.cjs) · [`src/application/contracts/setup_documentation.ts`](../src/application/contracts/setup_documentation.ts) · [`src/application/policies/setup_question_documentation_policy.ts`](../src/application/policies/setup_question_documentation_policy.ts) · [`web/src/components/SetupHelp.svelte`](../web/src/components/SetupHelp.svelte) · [`web/src/components/CompletedSetupHelp.svelte`](../web/src/components/CompletedSetupHelp.svelte) · [`src/application/policies/verification_runtime_policy.ts`](../src/application/policies/verification_runtime_policy.ts) · [`src/infrastructure/verification_runtime_manifest.ts`](../src/infrastructure/verification_runtime_manifest.ts) · [`src/infrastructure/verification_runtime_preflight.ts`](../src/infrastructure/verification_runtime_preflight.ts) · [`src/infrastructure/untrusted_command_environment.ts`](../src/infrastructure/untrusted_command_environment.ts) · [`src/application/ports/git_ports.ts`](../src/application/ports/git_ports.ts) · [`src/application/ports/bugbot_git_ports.ts`](../src/application/ports/bugbot_git_ports.ts) · [`src/application/usecases/steps/commit/bugbot/commit_and_push_preflight.ts`](../src/application/usecases/steps/commit/bugbot/commit_and_push_preflight.ts) · [`src/application/usecases/steps/commit/bugbot/verify_command_runner.ts`](../src/application/usecases/steps/commit/bugbot/verify_command_runner.ts) · [`src/cli/setup_config_file.ts`](../src/cli/setup_config_file.ts) · [`src/domain/copilot_comment_workflow.ts`](../src/domain/copilot_comment_workflow.ts) · [`src/infrastructure/copilot_comment_inputs.json`](../src/infrastructure/copilot_comment_inputs.json) -- Tests: [`src/data/repository/__tests__/repository_version_tags_query_repository.test.ts`](../src/data/repository/__tests__/repository_version_tags_query_repository.test.ts) · [`src/cli/__tests__/setup_command_options.test.ts`](../src/cli/__tests__/setup_command_options.test.ts) · [`src/data/repository/__tests__/setup_variable_write_failures.test.ts`](../src/data/repository/__tests__/setup_variable_write_failures.test.ts) · [`src/infrastructure/composition/__tests__/initial_setup_composition_root.test.ts`](../src/infrastructure/composition/__tests__/initial_setup_composition_root.test.ts) · [`src/application/policies/__tests__/setup_questionnaire_policy.test.ts`](../src/application/policies/__tests__/setup_questionnaire_policy.test.ts) · [`src/application/policies/__tests__/setup_configuration_policy.test.ts`](../src/application/policies/__tests__/setup_configuration_policy.test.ts) · [`src/application/policies/__tests__/setup_token_permission_policy.test.ts`](../src/application/policies/__tests__/setup_token_permission_policy.test.ts) · [`src/application/policies/__tests__/setup_remote_facts_policy.test.ts`](../src/application/policies/__tests__/setup_remote_facts_policy.test.ts) · [`src/application/policies/__tests__/setup_doctor_message_catalog.test.ts`](../src/application/policies/__tests__/setup_doctor_message_catalog.test.ts) · [`src/application/policies/__tests__/setup_doctor_report_policy.test.ts`](../src/application/policies/__tests__/setup_doctor_report_policy.test.ts) · [`src/application/usecases/setup/__tests__/setup_questionnaire_controller.test.ts`](../src/application/usecases/setup/__tests__/setup_questionnaire_controller.test.ts) · [`src/application/usecases/setup/__tests__/setup_wizard_use_case.test.ts`](../src/application/usecases/setup/__tests__/setup_wizard_use_case.test.ts) · [`src/application/usecases/setup/__tests__/setup_journey_use_case.test.ts`](../src/application/usecases/setup/__tests__/setup_journey_use_case.test.ts) · [`src/application/usecases/setup/__tests__/setup_session_coordinator.test.ts`](../src/application/usecases/setup/__tests__/setup_session_coordinator.test.ts) · [`src/application/usecases/setup/__tests__/setup_credentials_use_case.test.ts`](../src/application/usecases/setup/__tests__/setup_credentials_use_case.test.ts) · [`src/application/usecases/setup/__tests__/setup_token_permissions_use_case.test.ts`](../src/application/usecases/setup/__tests__/setup_token_permissions_use_case.test.ts) · [`src/application/usecases/setup/__tests__/doctor_use_case.test.ts`](../src/application/usecases/setup/__tests__/doctor_use_case.test.ts) · [`src/application/usecases/setup/__tests__/merge_queue_readiness_use_case.test.ts`](../src/application/usecases/setup/__tests__/merge_queue_readiness_use_case.test.ts) · [`src/application/usecases/actions/__tests__/initial_setup_use_case.test.ts`](../src/application/usecases/actions/__tests__/initial_setup_use_case.test.ts) · [`src/application/usecases/actions/__tests__/setup_resource_provisioning.test.ts`](../src/application/usecases/actions/__tests__/setup_resource_provisioning.test.ts) · [`src/infrastructure/__tests__/setup_workspace_adapter.test.ts`](../src/infrastructure/__tests__/setup_workspace_adapter.test.ts) · [`src/infrastructure/__tests__/setup_remote_credential_health_adapter.test.ts`](../src/infrastructure/__tests__/setup_remote_credential_health_adapter.test.ts) · [`src/infrastructure/__tests__/setup_token_permission_query_adapter.test.ts`](../src/infrastructure/__tests__/setup_token_permission_query_adapter.test.ts) · [`src/infrastructure/__tests__/setup_permission_resource_probes.test.ts`](../src/infrastructure/__tests__/setup_permission_resource_probes.test.ts) · [`src/infrastructure/__tests__/setup_projects_probe_page_policy.test.ts`](../src/infrastructure/__tests__/setup_projects_probe_page_policy.test.ts) · [`src/infrastructure/composition/__tests__/setup_token_permissions_composition_root.test.ts`](../src/infrastructure/composition/__tests__/setup_token_permissions_composition_root.test.ts) · [`src/data/repository/__tests__/repository_variables_repository.test.ts`](../src/data/repository/__tests__/repository_variables_repository.test.ts) · [`src/cli/__tests__/setup_presenters.test.ts`](../src/cli/__tests__/setup_presenters.test.ts) · [`src/cli/__tests__/setup_journey_presenter.test.ts`](../src/cli/__tests__/setup_journey_presenter.test.ts) · [`src/cli/__tests__/setup_prompt_rendering.test.ts`](../src/cli/__tests__/setup_prompt_rendering.test.ts) · [`src/cli/__tests__/setup_token_permission_presenter.test.ts`](../src/cli/__tests__/setup_token_permission_presenter.test.ts) · [`src/__tests__/cli.test.ts`](../src/__tests__/cli.test.ts) · [`src/cli/__tests__/setup_terminal_driver.test.ts`](../src/cli/__tests__/setup_terminal_driver.test.ts) · [`src/architecture/__tests__/setup_doctor_boundaries.test.ts`](../src/architecture/__tests__/setup_doctor_boundaries.test.ts) · [`src/tooling/__tests__/documentation_pat_exception_policy.test.ts`](../src/tooling/__tests__/documentation_pat_exception_policy.test.ts) · [`src/infrastructure/__tests__/setup_pat_audit.test.ts`](../src/infrastructure/__tests__/setup_pat_audit.test.ts) · [`src/infrastructure/__tests__/setup_permission_projects_access.test.ts`](../src/infrastructure/__tests__/setup_permission_projects_access.test.ts) · [`src/infrastructure/__tests__/setup_credential_validation_adapter.test.ts`](../src/infrastructure/__tests__/setup_credential_validation_adapter.test.ts) · [`src/infrastructure/__tests__/setup_github_identity_query_adapter.test.ts`](../src/infrastructure/__tests__/setup_github_identity_query_adapter.test.ts) · [`src/infrastructure/__tests__/git_commit_adapter.test.ts`](../src/infrastructure/__tests__/git_commit_adapter.test.ts) · [`src/actions/__tests__/github_action_input.test.ts`](../src/actions/__tests__/github_action_input.test.ts) · [`src/infrastructure/__tests__/setup_permission_cleanup_contract.test.ts`](../src/infrastructure/__tests__/setup_permission_cleanup_contract.test.ts) · [`src/infrastructure/__tests__/setup_permission_actions_cleanup_timing.test.ts`](../src/infrastructure/__tests__/setup_permission_actions_cleanup_timing.test.ts) · [`src/infrastructure/__tests__/setup_permission_operator_actions.test.ts`](../src/infrastructure/__tests__/setup_permission_operator_actions.test.ts) · [`src/infrastructure/__tests__/setup_permission_journal_contract.test.ts`](../src/infrastructure/__tests__/setup_permission_journal_contract.test.ts) · [`src/infrastructure/__tests__/setup_permission_audit_transactions.test.ts`](../src/infrastructure/__tests__/setup_permission_audit_transactions.test.ts) · [`src/infrastructure/__tests__/setup_permission_write_failures.test.ts`](../src/infrastructure/__tests__/setup_permission_write_failures.test.ts) · [`src/infrastructure/__tests__/setup_permission_resource_failures.test.ts`](../src/infrastructure/__tests__/setup_permission_resource_failures.test.ts) · [`src/infrastructure/__tests__/setup_permission_boundary_failures.test.ts`](../src/infrastructure/__tests__/setup_permission_boundary_failures.test.ts) · [`src/infrastructure/__tests__/github_secret_encryption.test.ts`](../src/infrastructure/__tests__/github_secret_encryption.test.ts) · [`src/infrastructure/__tests__/setup_permission_organization_owner.test.ts`](../src/infrastructure/__tests__/setup_permission_organization_owner.test.ts) · [`src/infrastructure/__tests__/setup_pat_bootstrap_transactions.test.ts`](../src/infrastructure/__tests__/setup_pat_bootstrap_transactions.test.ts) · [`src/data/repository/__tests__/repository_actions_sdk_contract.integration.test.ts`](../src/data/repository/__tests__/repository_actions_sdk_contract.integration.test.ts) · [`src/data/repository/__tests__/repository_actions_resource_edge_cases.test.ts`](../src/data/repository/__tests__/repository_actions_resource_edge_cases.test.ts) · [`src/data/repository/__tests__/repository_selected_resource_grants.test.ts`](../src/data/repository/__tests__/repository_selected_resource_grants.test.ts) · [`src/infrastructure/__tests__/setup_permission_read_contract.test.ts`](../src/infrastructure/__tests__/setup_permission_read_contract.test.ts) · [`src/application/usecases/setup/__tests__/setup_workflow_pat_conflict.test.ts`](../src/application/usecases/setup/__tests__/setup_workflow_pat_conflict.test.ts) · [`src/application/usecases/setup/__tests__/setup_workflow_pat_credential_rotation.test.ts`](../src/application/usecases/setup/__tests__/setup_workflow_pat_credential_rotation.test.ts) · [`src/data/repository/__tests__/setup_organization_pat_inventory.test.ts`](../src/data/repository/__tests__/setup_organization_pat_inventory.test.ts) · [`src/cli/__tests__/web_setup_bot_pat_scope_conflict.test.ts`](../src/cli/__tests__/web_setup_bot_pat_scope_conflict.test.ts) · [`src/actions/__tests__/local_setup_apply_contract.test.ts`](../src/actions/__tests__/local_setup_apply_contract.test.ts) · [`src/cli/commands/__tests__/setup_policy.test.ts`](../src/cli/commands/__tests__/setup_policy.test.ts) · [`src/application/usecases/execution/__tests__/execution_issue_number_policy.test.ts`](../src/application/usecases/execution/__tests__/execution_issue_number_policy.test.ts) · [`src/application/usecases/execution/__tests__/setup_execution_workflow.test.ts`](../src/application/usecases/execution/__tests__/setup_execution_workflow.test.ts) · [`src/domain/__tests__/github_runtime_doctor.test.ts`](../src/domain/__tests__/github_runtime_doctor.test.ts) · [`src/domain/__tests__/copilot_command.test.ts`](../src/domain/__tests__/copilot_command.test.ts) · [`src/application/usecases/__tests__/comment_automation_use_case.test.ts`](../src/application/usecases/__tests__/comment_automation_use_case.test.ts) · [`src/application/policies/__tests__/github_runtime_doctor_policy.test.ts`](../src/application/policies/__tests__/github_runtime_doctor_policy.test.ts) · [`src/application/policies/__tests__/doctor_workflow_condition_policy.test.ts`](../src/application/policies/__tests__/doctor_workflow_condition_policy.test.ts) · [`src/application/policies/__tests__/github_runtime_doctor_presentation_policy.test.ts`](../src/application/policies/__tests__/github_runtime_doctor_presentation_policy.test.ts) · [`src/application/usecases/__tests__/read_copilot_doctor_workflow.test.ts`](../src/application/usecases/__tests__/read_copilot_doctor_workflow.test.ts) · [`src/application/usecases/__tests__/runtime_doctor_security_integration.test.ts`](../src/application/usecases/__tests__/runtime_doctor_security_integration.test.ts) · [`src/data/repository/github/__tests__/runtime_doctor_repository.test.ts`](../src/data/repository/github/__tests__/runtime_doctor_repository.test.ts) · [`src/infrastructure/composition/__tests__/github_runtime_doctor_composition_root.test.ts`](../src/infrastructure/composition/__tests__/github_runtime_doctor_composition_root.test.ts) · [`src/application/policies/__tests__/runtime_doctor_agent_activity.test.ts`](../src/application/policies/__tests__/runtime_doctor_agent_activity.test.ts) · [`src/application/policies/__tests__/doctor_workflow_matrix_policy.test.ts`](../src/application/policies/__tests__/doctor_workflow_matrix_policy.test.ts) · [`src/application/policies/__tests__/setup_approval_operator_permissions.test.ts`](../src/application/policies/__tests__/setup_approval_operator_permissions.test.ts) · [`src/application/usecases/setup/__tests__/audit_configured_setup_pat_use_case.test.ts`](../src/application/usecases/setup/__tests__/audit_configured_setup_pat_use_case.test.ts) · [`src/application/policies/__tests__/setup_batch_permission_policy.test.ts`](../src/application/policies/__tests__/setup_batch_permission_policy.test.ts) · [`src/application/policies/__tests__/setup_batch_policy.test.ts`](../src/application/policies/__tests__/setup_batch_policy.test.ts) · [`src/application/policies/__tests__/setup_batch_retry_policy.test.ts`](../src/application/policies/__tests__/setup_batch_retry_policy.test.ts) · [`src/application/policies/__tests__/setup_batch_selection_policy.test.ts`](../src/application/policies/__tests__/setup_batch_selection_policy.test.ts) · [`src/application/policies/__tests__/setup_organization_approval_draft.test.ts`](../src/application/policies/__tests__/setup_organization_approval_draft.test.ts) · [`src/application/policies/__tests__/setup_organization_import_policy.test.ts`](../src/application/policies/__tests__/setup_organization_import_policy.test.ts) · [`src/application/policies/__tests__/setup_organization_import_safety.test.ts`](../src/application/policies/__tests__/setup_organization_import_safety.test.ts) · [`src/application/policies/__tests__/setup_organization_variable_reuse_policy.test.ts`](../src/application/policies/__tests__/setup_organization_variable_reuse_policy.test.ts) · [`src/application/usecases/actions/__tests__/setup_organization_reuse_provisioning.test.ts`](../src/application/usecases/actions/__tests__/setup_organization_reuse_provisioning.test.ts) · [`src/application/usecases/setup/__tests__/apply_setup_batch_use_case.test.ts`](../src/application/usecases/setup/__tests__/apply_setup_batch_use_case.test.ts) · [`src/application/usecases/setup/__tests__/select_setup_batch_targets_use_case.test.ts`](../src/application/usecases/setup/__tests__/select_setup_batch_targets_use_case.test.ts) · [`src/application/usecases/setup/__tests__/setup_batch_flow.test.ts`](../src/application/usecases/setup/__tests__/setup_batch_flow.test.ts) · [`src/application/usecases/setup/__tests__/setup_organization_import_wizard.test.ts`](../src/application/usecases/setup/__tests__/setup_organization_import_wizard.test.ts) · [`src/application/usecases/setup/__tests__/setup_organization_secret_reuse.test.ts`](../src/application/usecases/setup/__tests__/setup_organization_secret_reuse.test.ts) · [`src/cli/__tests__/setup_source_adapter.test.ts`](../src/cli/__tests__/setup_source_adapter.test.ts) · [`src/cli/__tests__/web_setup_batch_components.test.ts`](../src/cli/__tests__/web_setup_batch_components.test.ts) · [`src/cli/__tests__/web_setup_batch_selection.test.ts`](../src/cli/__tests__/web_setup_batch_selection.test.ts) · [`src/infrastructure/__tests__/setup_batch_github_apply_adapter.test.ts`](../src/infrastructure/__tests__/setup_batch_github_apply_adapter.test.ts) · [`src/infrastructure/__tests__/setup_batch_github_read_adapter.test.ts`](../src/infrastructure/__tests__/setup_batch_github_read_adapter.test.ts) · [`src/infrastructure/__tests__/setup_batch_local_adapters.test.ts`](../src/infrastructure/__tests__/setup_batch_local_adapters.test.ts) · [`src/infrastructure/__tests__/setup_reuse_empty_collections.integration.test.ts`](../src/infrastructure/__tests__/setup_reuse_empty_collections.integration.test.ts) · [`src/infrastructure/__tests__/setup_trusted_credential_health_adapter.test.ts`](../src/infrastructure/__tests__/setup_trusted_credential_health_adapter.test.ts) · [`src/infrastructure/__tests__/setup_trusted_health_sdk_contract.integration.test.ts`](../src/infrastructure/__tests__/setup_trusted_health_sdk_contract.integration.test.ts) · [`src/application/policies/__tests__/setup_batch_access_and_view.test.ts`](../src/application/policies/__tests__/setup_batch_access_and_view.test.ts) · [`src/cli/__tests__/setup_batch_adapter.test.ts`](../src/cli/__tests__/setup_batch_adapter.test.ts) · [`src/infrastructure/__tests__/setup_batch_composition.test.ts`](../src/infrastructure/__tests__/setup_batch_composition.test.ts) · [`src/infrastructure/__tests__/setup_batch_guidance_compatibility.test.ts`](../src/infrastructure/__tests__/setup_batch_guidance_compatibility.test.ts) · [`src/utils/__tests__/setup_workflow_upgrade.test.ts`](../src/utils/__tests__/setup_workflow_upgrade.test.ts) · [`src/cli/__tests__/setup_pat_intent_adapter.test.ts`](../src/cli/__tests__/setup_pat_intent_adapter.test.ts) · [`src/application/usecases/__tests__/push_single_action_contexts.test.ts`](../src/application/usecases/__tests__/push_single_action_contexts.test.ts) · [`src/application/policies/__tests__/setup_runner_policy.test.ts`](../src/application/policies/__tests__/setup_runner_policy.test.ts) · [`src/application/policies/__tests__/setup_runner_question_policy.test.ts`](../src/application/policies/__tests__/setup_runner_question_policy.test.ts) · [`src/infrastructure/__tests__/setup_runner_discovery_adapter.test.ts`](../src/infrastructure/__tests__/setup_runner_discovery_adapter.test.ts) · [`src/utils/__tests__/setup_runner_installation.test.ts`](../src/utils/__tests__/setup_runner_installation.test.ts) · [`src/cli/__tests__/web_setup_runner_components.test.ts`](../src/cli/__tests__/web_setup_runner_components.test.ts) · [`src/application/policies/__tests__/setup_runner_installation_summary_policy.test.ts`](../src/application/policies/__tests__/setup_runner_installation_summary_policy.test.ts) · [`src/application/usecases/setup/__tests__/setup_runner_planning.test.ts`](../src/application/usecases/setup/__tests__/setup_runner_planning.test.ts) · [`src/cli/__tests__/setup_runner_config_file.test.ts`](../src/cli/__tests__/setup_runner_config_file.test.ts) · [`src/infrastructure/__tests__/setup_runner_composition.test.ts`](../src/infrastructure/__tests__/setup_runner_composition.test.ts) · [`src/tooling/__tests__/setup_provisioning_workflow.test.ts`](../src/tooling/__tests__/setup_provisioning_workflow.test.ts) · [`src/infrastructure/__tests__/setup_sdd_prerequisites.test.ts`](../src/infrastructure/__tests__/setup_sdd_prerequisites.test.ts) · [`src/cli/__tests__/setup_documentation_navigation.test.ts`](../src/cli/__tests__/setup_documentation_navigation.test.ts) · [`src/application/policies/__tests__/setup_question_documentation_policy.test.ts`](../src/application/policies/__tests__/setup_question_documentation_policy.test.ts) · [`src/application/policies/__tests__/verification_runtime_policy.test.ts`](../src/application/policies/__tests__/verification_runtime_policy.test.ts) · [`src/infrastructure/__tests__/verification_runtime_preflight.test.ts`](../src/infrastructure/__tests__/verification_runtime_preflight.test.ts) · [`src/infrastructure/__tests__/verification_runtime_branch_sync.test.ts`](../src/infrastructure/__tests__/verification_runtime_branch_sync.test.ts) · [`src/infrastructure/__tests__/untrusted_command_environment.test.ts`](../src/infrastructure/__tests__/untrusted_command_environment.test.ts) · [`src/application/usecases/steps/commit/bugbot/__tests__/verify_command_runner.test.ts`](../src/application/usecases/steps/commit/bugbot/__tests__/verify_command_runner.test.ts) · [`src/application/usecases/steps/commit/bugbot/__tests__/commit_verification_workspace.test.ts`](../src/application/usecases/steps/commit/bugbot/__tests__/commit_verification_workspace.test.ts) · [`src/tooling/__tests__/verification_runtime_guidance.test.ts`](../src/tooling/__tests__/verification_runtime_guidance.test.ts) · [`src/infrastructure/__tests__/verification_setup_configuration.test.ts`](../src/infrastructure/__tests__/verification_setup_configuration.test.ts) · [`src/domain/__tests__/copilot_comment_workflow.test.ts`](../src/domain/__tests__/copilot_comment_workflow.test.ts) · [`src/tooling/__tests__/credential_health_transport.test.ts`](../src/tooling/__tests__/credential_health_transport.test.ts) +- Core code: [`src/domain/setup.ts`](../src/domain/setup.ts) · [`src/domain/setup_questionnaire.ts`](../src/domain/setup_questionnaire.ts) · [`src/domain/setup_token_permissions.ts`](../src/domain/setup_token_permissions.ts) · [`src/application/ports/setup_terminal_ports.ts`](../src/application/ports/setup_terminal_ports.ts) · [`src/application/ports/setup_wizard_ports.ts`](../src/application/ports/setup_wizard_ports.ts) · [`src/application/ports/branch_tag_ports.ts`](../src/application/ports/branch_tag_ports.ts) · [`src/application/policies/setup_issue_workflow_policy.ts`](../src/application/policies/setup_issue_workflow_policy.ts) · [`src/data/repository/release/repository_version_tags_query_repository.ts`](../src/data/repository/release/repository_version_tags_query_repository.ts) · [`src/application/ports/setup_token_permission_ports.ts`](../src/application/ports/setup_token_permission_ports.ts) · [`src/application/policies/setup_token_permission_evidence_policy.ts`](../src/application/policies/setup_token_permission_evidence_policy.ts) · [`src/application/policies/setup_token_permission_policy.ts`](../src/application/policies/setup_token_permission_policy.ts) · [`src/application/policies/setup_questionnaire_policy.ts`](../src/application/policies/setup_questionnaire_policy.ts) · [`src/application/policies/setup_configuration_plan.ts`](../src/application/policies/setup_configuration_plan.ts) · [`src/application/policies/merge_setup_overrides_policy.ts`](../src/application/policies/merge_setup_overrides_policy.ts) · [`src/application/policies/setup_configuration_storage_policy.ts`](../src/application/policies/setup_configuration_storage_policy.ts) · [`src/application/policies/setup_doctor_message_catalog.ts`](../src/application/policies/setup_doctor_message_catalog.ts) · [`src/application/policies/setup_doctor_report_policy.ts`](../src/application/policies/setup_doctor_report_policy.ts) · [`src/application/policies/setup_journey_policy.ts`](../src/application/policies/setup_journey_policy.ts) · [`src/application/policies/setup_permission_summary_policy.ts`](../src/application/policies/setup_permission_summary_policy.ts) · [`src/application/usecases/setup/setup_wizard_use_case.ts`](../src/application/usecases/setup/setup_wizard_use_case.ts) · [`src/application/usecases/setup/setup_journey_use_case.ts`](../src/application/usecases/setup/setup_journey_use_case.ts) · [`src/application/usecases/setup/setup_session_coordinator.ts`](../src/application/usecases/setup/setup_session_coordinator.ts) · [`src/application/usecases/setup/setup_questionnaire_controller.ts`](../src/application/usecases/setup/setup_questionnaire_controller.ts) · [`src/application/usecases/setup/setup_credentials_use_case.ts`](../src/application/usecases/setup/setup_credentials_use_case.ts) · [`src/application/usecases/setup/setup_token_permissions_use_case.ts`](../src/application/usecases/setup/setup_token_permissions_use_case.ts) · [`src/application/usecases/setup/doctor_use_case.ts`](../src/application/usecases/setup/doctor_use_case.ts) · [`src/application/usecases/setup/merge_queue_readiness_use_case.ts`](../src/application/usecases/setup/merge_queue_readiness_use_case.ts) · [`src/application/usecases/actions/initial_setup_workflow.ts`](../src/application/usecases/actions/initial_setup_workflow.ts) · [`src/application/usecases/actions/setup_resource_provisioning.ts`](../src/application/usecases/actions/setup_resource_provisioning.ts) · [`src/application/ports/message_catalog_ports.ts`](../src/application/ports/message_catalog_ports.ts) · [`src/application/usecases/localization/resolve_message_catalog_use_case.ts`](../src/application/usecases/localization/resolve_message_catalog_use_case.ts) · [`src/application/policies/setup_configuration_validation.ts`](../src/application/policies/setup_configuration_validation.ts) · [`src/infrastructure/setup_workspace_adapter.ts`](../src/infrastructure/setup_workspace_adapter.ts) · [`src/data/repository/repository_variables_repository.ts`](../src/data/repository/repository_variables_repository.ts) · [`src/infrastructure/github/ports/github_repository_variables_protocol.ts`](../src/infrastructure/github/ports/github_repository_variables_protocol.ts) · [`src/infrastructure/setup_remote_credential_health_adapter.ts`](../src/infrastructure/setup_remote_credential_health_adapter.ts) · [`src/infrastructure/setup_credential_validation_adapter.ts`](../src/infrastructure/setup_credential_validation_adapter.ts) · [`src/infrastructure/setup_token_permission_query_adapter.ts`](../src/infrastructure/setup_token_permission_query_adapter.ts) · [`src/infrastructure/setup_permission_actions_probe.ts`](../src/infrastructure/setup_permission_actions_probe.ts) · [`src/infrastructure/setup_permission_issue_probe.ts`](../src/infrastructure/setup_permission_issue_probe.ts) · [`src/infrastructure/setup_permission_issue_cleanup.ts`](../src/infrastructure/setup_permission_issue_cleanup.ts) · [`src/infrastructure/setup_permission_probe_journal.ts`](../src/infrastructure/setup_permission_probe_journal.ts) · [`src/infrastructure/setup_permission_probe_transaction.ts`](../src/infrastructure/setup_permission_probe_transaction.ts) · [`src/infrastructure/setup_permission_resource_probes.ts`](../src/infrastructure/setup_permission_resource_probes.ts) · [`src/infrastructure/setup_projects_probe_page_policy.ts`](../src/infrastructure/setup_projects_probe_page_policy.ts) · [`src/cli/setup_terminal_driver.ts`](../src/cli/setup_terminal_driver.ts) · [`src/cli/setup_question_renderer.ts`](../src/cli/setup_question_renderer.ts) · [`src/cli/setup_journey_presenter.ts`](../src/cli/setup_journey_presenter.ts) · [`src/cli/setup_plan_presenter.ts`](../src/cli/setup_plan_presenter.ts) · [`src/cli/setup_doctor_presenter.ts`](../src/cli/setup_doctor_presenter.ts) · [`src/cli/setup_prompt_rendering.ts`](../src/cli/setup_prompt_rendering.ts) · [`src/cli/setup_credential_prompt_adapter.ts`](../src/cli/setup_credential_prompt_adapter.ts) · [`src/cli/setup_credential_collection.ts`](../src/cli/setup_credential_collection.ts) · [`src/cli/commands/setup_execution.ts`](../src/cli/commands/setup_execution.ts) · [`src/cli/setup_token_permission_presenter.ts`](../src/cli/setup_token_permission_presenter.ts) · [`src/infrastructure/composition/setup_credentials_composition_root.ts`](../src/infrastructure/composition/setup_credentials_composition_root.ts) · [`src/infrastructure/composition/setup_token_permissions_composition_root.ts`](../src/infrastructure/composition/setup_token_permissions_composition_root.ts) · [`src/infrastructure/composition/setup_doctor_composition_root.ts`](../src/infrastructure/composition/setup_doctor_composition_root.ts) · [`scripts/coverage-budgets.json`](../scripts/coverage-budgets.json) · [`scripts/documentation_pat_exception_policy.cjs`](../scripts/documentation_pat_exception_policy.cjs) · [`scripts/validate-documentation-contract.cjs`](../scripts/validate-documentation-contract.cjs) · [`src/infrastructure/http_deadline.ts`](../src/infrastructure/http_deadline.ts) · [`src/infrastructure/setup_permission_denial.ts`](../src/infrastructure/setup_permission_denial.ts) · [`src/infrastructure/setup_permission_read_probe.ts`](../src/infrastructure/setup_permission_read_probe.ts) · [`src/infrastructure/setup_permission_read_evidence.ts`](../src/infrastructure/setup_permission_read_evidence.ts) · [`src/infrastructure/setup_permission_read_shape.ts`](../src/infrastructure/setup_permission_read_shape.ts) · [`src/infrastructure/setup_permission_projects_read.ts`](../src/infrastructure/setup_permission_projects_read.ts) · [`src/infrastructure/setup_permission_projects_access.ts`](../src/infrastructure/setup_permission_projects_access.ts) · [`src/infrastructure/setup_permission_workflow_cleanup.ts`](../src/infrastructure/setup_permission_workflow_cleanup.ts) · [`src/infrastructure/setup_permission_project_cleanup.ts`](../src/infrastructure/setup_permission_project_cleanup.ts) · [`src/infrastructure/setup_permission_probe_http.ts`](../src/infrastructure/setup_permission_probe_http.ts) · [`src/infrastructure/setup_permission_pull_request_probe.ts`](../src/infrastructure/setup_permission_pull_request_probe.ts) · [`src/infrastructure/git_authentication_environment.ts`](../src/infrastructure/git_authentication_environment.ts) · [`src/actions/github_action_input.ts`](../src/actions/github_action_input.ts) · [`src/infrastructure/setup_github_identity_query_adapter.ts`](../src/infrastructure/setup_github_identity_query_adapter.ts) · [`src/infrastructure/github_secret_encryption.ts`](../src/infrastructure/github_secret_encryption.ts) · [`src/infrastructure/setup_permission_organization_owner.ts`](../src/infrastructure/setup_permission_organization_owner.ts) · [`src/data/repository/github/github_actions_resource_inspector.ts`](../src/data/repository/github/github_actions_resource_inspector.ts) · [`src/data/repository/github/github_actions_resource_commands.ts`](../src/data/repository/github/github_actions_resource_commands.ts) · [`src/data/repository/github/github_actions_resource_collection.ts`](../src/data/repository/github/github_actions_resource_collection.ts) · [`src/application/usecases/setup/resolve_setup_workflow_pat_conflict_use_case.ts`](../src/application/usecases/setup/resolve_setup_workflow_pat_conflict_use_case.ts) · [`src/cli/setup_workflow_pat_storage_copy.ts`](../src/cli/setup_workflow_pat_storage_copy.ts) · [`src/cli/commands/setup_policy.ts`](../src/cli/commands/setup_policy.ts) · [`src/application/usecases/execution/execution_issue_number_policy.ts`](../src/application/usecases/execution/execution_issue_number_policy.ts) · [`src/application/usecases/execution/setup_execution_workflow.ts`](../src/application/usecases/execution/setup_execution_workflow.ts) · [`src/domain/github_runtime_doctor.ts`](../src/domain/github_runtime_doctor.ts) · [`src/domain/copilot_command.ts`](../src/domain/copilot_command.ts) · [`src/application/usecases/comment_automation_command_workflow.ts`](../src/application/usecases/comment_automation_command_workflow.ts) · [`src/application/policies/copilot_interaction_policy.ts`](../src/application/policies/copilot_interaction_policy.ts) · [`src/application/policies/publication_message_catalog.ts`](../src/application/policies/publication_message_catalog.ts) · [`src/application/ports/github_runtime_doctor_ports.ts`](../src/application/ports/github_runtime_doctor_ports.ts) · [`src/application/policies/github_runtime_doctor_policy.ts`](../src/application/policies/github_runtime_doctor_policy.ts) · [`src/application/policies/doctor_workflow_condition_policy.ts`](../src/application/policies/doctor_workflow_condition_policy.ts) · [`src/application/policies/github_runtime_doctor_presentation_policy.ts`](../src/application/policies/github_runtime_doctor_presentation_policy.ts) · [`src/application/usecases/read_copilot_doctor_workflow.ts`](../src/application/usecases/read_copilot_doctor_workflow.ts) · [`src/data/repository/github/runtime_doctor_repository.ts`](../src/data/repository/github/runtime_doctor_repository.ts) · [`src/infrastructure/composition/github_runtime_doctor_composition_root.ts`](../src/infrastructure/composition/github_runtime_doctor_composition_root.ts) · [`src/application/policies/agent_activity_policy.ts`](../src/application/policies/agent_activity_policy.ts) · [`src/application/policies/doctor_workflow_matrix_policy.ts`](../src/application/policies/doctor_workflow_matrix_policy.ts) · [`src/application/contracts/setup_batch_view.ts`](../src/application/contracts/setup_batch_view.ts) · [`src/application/policies/issue_resource_input_policy.ts`](../src/application/policies/issue_resource_input_policy.ts) · [`src/application/policies/setup_batch_access_policy.ts`](../src/application/policies/setup_batch_access_policy.ts) · [`src/application/policies/setup_batch_policy.ts`](../src/application/policies/setup_batch_policy.ts) · [`src/application/policies/setup_batch_retry_policy.ts`](../src/application/policies/setup_batch_retry_policy.ts) · [`src/application/policies/setup_batch_selection_policy.ts`](../src/application/policies/setup_batch_selection_policy.ts) · [`src/application/policies/setup_batch_view_policy.ts`](../src/application/policies/setup_batch_view_policy.ts) · [`src/application/policies/setup_credential_binding_policy.ts`](../src/application/policies/setup_credential_binding_policy.ts) · [`src/application/policies/setup_organization_import_policy.ts`](../src/application/policies/setup_organization_import_policy.ts) · [`src/application/policies/setup_organization_variable_bindings.ts`](../src/application/policies/setup_organization_variable_bindings.ts) · [`src/application/policies/setup_organization_variable_reuse_policy.ts`](../src/application/policies/setup_organization_variable_reuse_policy.ts) · [`src/application/ports/setup_batch_ports.ts`](../src/application/ports/setup_batch_ports.ts) · [`src/application/usecases/setup/apply_setup_batch_use_case.ts`](../src/application/usecases/setup/apply_setup_batch_use_case.ts) · [`src/application/usecases/setup/configure_setup_batch_target_use_case.ts`](../src/application/usecases/setup/configure_setup_batch_target_use_case.ts) · [`src/application/usecases/setup/prepare_setup_batch_use_case.ts`](../src/application/usecases/setup/prepare_setup_batch_use_case.ts) · [`src/application/usecases/setup/select_setup_batch_targets_use_case.ts`](../src/application/usecases/setup/select_setup_batch_targets_use_case.ts) · [`src/application/usecases/setup/setup_batch_session_use_case.ts`](../src/application/usecases/setup/setup_batch_session_use_case.ts) · [`src/cli/setup_batch_adapter.ts`](../src/cli/setup_batch_adapter.ts) · [`src/cli/setup_source_adapter.ts`](../src/cli/setup_source_adapter.ts) · [`src/domain/setup_batch.ts`](../src/domain/setup_batch.ts) · [`src/domain/setup_credential_health.ts`](../src/domain/setup_credential_health.ts) · [`src/domain/setup_organization_reuse.ts`](../src/domain/setup_organization_reuse.ts) · [`src/infrastructure/composition/setup_batch_composition_root.ts`](../src/infrastructure/composition/setup_batch_composition_root.ts) · [`src/infrastructure/github/ports/github_setup_batch_protocol.ts`](../src/infrastructure/github/ports/github_setup_batch_protocol.ts) · [`src/infrastructure/github/ports/github_trusted_credential_health_protocol.ts`](../src/infrastructure/github/ports/github_trusted_credential_health_protocol.ts) · [`src/infrastructure/setup_batch_github_apply_adapter.ts`](../src/infrastructure/setup_batch_github_apply_adapter.ts) · [`src/infrastructure/setup_batch_github_read_adapter.ts`](../src/infrastructure/setup_batch_github_read_adapter.ts) · [`src/infrastructure/setup_batch_journal_adapter.ts`](../src/infrastructure/setup_batch_journal_adapter.ts) · [`src/infrastructure/setup_batch_workspace_adapter.ts`](../src/infrastructure/setup_batch_workspace_adapter.ts) · [`src/infrastructure/setup_trusted_credential_health_adapter.ts`](../src/infrastructure/setup_trusted_credential_health_adapter.ts) · [`src/application/policies/setup_remote_facts_policy.ts`](../src/application/policies/setup_remote_facts_policy.ts) · [`src/cli/setup_confirmation_adapter.ts`](../src/cli/setup_confirmation_adapter.ts) · [`src/cli/web_setup_adapters.ts`](../src/cli/web_setup_adapters.ts) · [`scripts/validate-agent-documentation.cjs`](../scripts/validate-agent-documentation.cjs) · [`src/utils/setup_workflow_upgrade.ts`](../src/utils/setup_workflow_upgrade.ts) · [`src/domain/setup_runner.ts`](../src/domain/setup_runner.ts) · [`src/application/policies/setup_runner_policy.ts`](../src/application/policies/setup_runner_policy.ts) · [`src/application/policies/setup_runner_question_policy.ts`](../src/application/policies/setup_runner_question_policy.ts) · [`src/application/policies/setup_runner_guidance_policy.ts`](../src/application/policies/setup_runner_guidance_policy.ts) · [`src/application/ports/setup_runner_ports.ts`](../src/application/ports/setup_runner_ports.ts) · [`src/infrastructure/setup_runner_discovery_adapter.ts`](../src/infrastructure/setup_runner_discovery_adapter.ts) · [`src/infrastructure/composition/setup_runner_composition_root.ts`](../src/infrastructure/composition/setup_runner_composition_root.ts) · [`src/utils/setup_installation_review.ts`](../src/utils/setup_installation_review.ts) · [`src/cli/setup_installation_review_presenter.ts`](../src/cli/setup_installation_review_presenter.ts) · [`src/application/policies/setup_runner_installation_summary_policy.ts`](../src/application/policies/setup_runner_installation_summary_policy.ts) · [`src/utils/setup_files.ts`](../src/utils/setup_files.ts) · [`src/domain/specification_catalog_path_policy.cjs`](../src/domain/specification_catalog_path_policy.cjs) · [`src/domain/sdd_prerequisite_policy.cjs`](../src/domain/sdd_prerequisite_policy.cjs) · [`src/application/contracts/setup_documentation.ts`](../src/application/contracts/setup_documentation.ts) · [`src/application/policies/setup_question_documentation_policy.ts`](../src/application/policies/setup_question_documentation_policy.ts) · [`web/src/components/SetupHelp.svelte`](../web/src/components/SetupHelp.svelte) · [`web/src/components/CompletedSetupHelp.svelte`](../web/src/components/CompletedSetupHelp.svelte) · [`src/application/policies/verification_runtime_policy.ts`](../src/application/policies/verification_runtime_policy.ts) · [`src/infrastructure/verification_runtime_manifest.ts`](../src/infrastructure/verification_runtime_manifest.ts) · [`src/infrastructure/verification_runtime_preflight.ts`](../src/infrastructure/verification_runtime_preflight.ts) · [`src/infrastructure/untrusted_command_environment.ts`](../src/infrastructure/untrusted_command_environment.ts) · [`src/application/ports/git_ports.ts`](../src/application/ports/git_ports.ts) · [`src/application/ports/bugbot_git_ports.ts`](../src/application/ports/bugbot_git_ports.ts) · [`src/application/usecases/steps/commit/bugbot/commit_and_push_preflight.ts`](../src/application/usecases/steps/commit/bugbot/commit_and_push_preflight.ts) · [`src/application/usecases/steps/commit/bugbot/verify_command_runner.ts`](../src/application/usecases/steps/commit/bugbot/verify_command_runner.ts) · [`src/cli/setup_config_file.ts`](../src/cli/setup_config_file.ts) · [`src/domain/copilot_comment_workflow.ts`](../src/domain/copilot_comment_workflow.ts) · [`src/infrastructure/copilot_comment_inputs.json`](../src/infrastructure/copilot_comment_inputs.json) · [`src/infrastructure/private_jvm_environment.ts`](../src/infrastructure/private_jvm_environment.ts) +- Tests: [`src/data/repository/__tests__/repository_version_tags_query_repository.test.ts`](../src/data/repository/__tests__/repository_version_tags_query_repository.test.ts) · [`src/cli/__tests__/setup_command_options.test.ts`](../src/cli/__tests__/setup_command_options.test.ts) · [`src/data/repository/__tests__/setup_variable_write_failures.test.ts`](../src/data/repository/__tests__/setup_variable_write_failures.test.ts) · [`src/infrastructure/composition/__tests__/initial_setup_composition_root.test.ts`](../src/infrastructure/composition/__tests__/initial_setup_composition_root.test.ts) · [`src/application/policies/__tests__/setup_questionnaire_policy.test.ts`](../src/application/policies/__tests__/setup_questionnaire_policy.test.ts) · [`src/application/policies/__tests__/setup_configuration_policy.test.ts`](../src/application/policies/__tests__/setup_configuration_policy.test.ts) · [`src/application/policies/__tests__/setup_token_permission_policy.test.ts`](../src/application/policies/__tests__/setup_token_permission_policy.test.ts) · [`src/application/policies/__tests__/setup_remote_facts_policy.test.ts`](../src/application/policies/__tests__/setup_remote_facts_policy.test.ts) · [`src/application/policies/__tests__/setup_doctor_message_catalog.test.ts`](../src/application/policies/__tests__/setup_doctor_message_catalog.test.ts) · [`src/application/policies/__tests__/setup_doctor_report_policy.test.ts`](../src/application/policies/__tests__/setup_doctor_report_policy.test.ts) · [`src/application/usecases/setup/__tests__/setup_questionnaire_controller.test.ts`](../src/application/usecases/setup/__tests__/setup_questionnaire_controller.test.ts) · [`src/application/usecases/setup/__tests__/setup_wizard_use_case.test.ts`](../src/application/usecases/setup/__tests__/setup_wizard_use_case.test.ts) · [`src/application/usecases/setup/__tests__/setup_journey_use_case.test.ts`](../src/application/usecases/setup/__tests__/setup_journey_use_case.test.ts) · [`src/application/usecases/setup/__tests__/setup_session_coordinator.test.ts`](../src/application/usecases/setup/__tests__/setup_session_coordinator.test.ts) · [`src/application/usecases/setup/__tests__/setup_credentials_use_case.test.ts`](../src/application/usecases/setup/__tests__/setup_credentials_use_case.test.ts) · [`src/application/usecases/setup/__tests__/setup_token_permissions_use_case.test.ts`](../src/application/usecases/setup/__tests__/setup_token_permissions_use_case.test.ts) · [`src/application/usecases/setup/__tests__/doctor_use_case.test.ts`](../src/application/usecases/setup/__tests__/doctor_use_case.test.ts) · [`src/application/usecases/setup/__tests__/merge_queue_readiness_use_case.test.ts`](../src/application/usecases/setup/__tests__/merge_queue_readiness_use_case.test.ts) · [`src/application/usecases/actions/__tests__/initial_setup_use_case.test.ts`](../src/application/usecases/actions/__tests__/initial_setup_use_case.test.ts) · [`src/application/usecases/actions/__tests__/setup_resource_provisioning.test.ts`](../src/application/usecases/actions/__tests__/setup_resource_provisioning.test.ts) · [`src/infrastructure/__tests__/setup_workspace_adapter.test.ts`](../src/infrastructure/__tests__/setup_workspace_adapter.test.ts) · [`src/infrastructure/__tests__/setup_remote_credential_health_adapter.test.ts`](../src/infrastructure/__tests__/setup_remote_credential_health_adapter.test.ts) · [`src/infrastructure/__tests__/setup_token_permission_query_adapter.test.ts`](../src/infrastructure/__tests__/setup_token_permission_query_adapter.test.ts) · [`src/infrastructure/__tests__/setup_permission_resource_probes.test.ts`](../src/infrastructure/__tests__/setup_permission_resource_probes.test.ts) · [`src/infrastructure/__tests__/setup_projects_probe_page_policy.test.ts`](../src/infrastructure/__tests__/setup_projects_probe_page_policy.test.ts) · [`src/infrastructure/composition/__tests__/setup_token_permissions_composition_root.test.ts`](../src/infrastructure/composition/__tests__/setup_token_permissions_composition_root.test.ts) · [`src/data/repository/__tests__/repository_variables_repository.test.ts`](../src/data/repository/__tests__/repository_variables_repository.test.ts) · [`src/cli/__tests__/setup_presenters.test.ts`](../src/cli/__tests__/setup_presenters.test.ts) · [`src/cli/__tests__/setup_journey_presenter.test.ts`](../src/cli/__tests__/setup_journey_presenter.test.ts) · [`src/cli/__tests__/setup_prompt_rendering.test.ts`](../src/cli/__tests__/setup_prompt_rendering.test.ts) · [`src/cli/__tests__/setup_token_permission_presenter.test.ts`](../src/cli/__tests__/setup_token_permission_presenter.test.ts) · [`src/__tests__/cli.test.ts`](../src/__tests__/cli.test.ts) · [`src/cli/__tests__/setup_terminal_driver.test.ts`](../src/cli/__tests__/setup_terminal_driver.test.ts) · [`src/architecture/__tests__/setup_doctor_boundaries.test.ts`](../src/architecture/__tests__/setup_doctor_boundaries.test.ts) · [`src/tooling/__tests__/documentation_pat_exception_policy.test.ts`](../src/tooling/__tests__/documentation_pat_exception_policy.test.ts) · [`src/infrastructure/__tests__/setup_pat_audit.test.ts`](../src/infrastructure/__tests__/setup_pat_audit.test.ts) · [`src/infrastructure/__tests__/setup_permission_projects_access.test.ts`](../src/infrastructure/__tests__/setup_permission_projects_access.test.ts) · [`src/infrastructure/__tests__/setup_credential_validation_adapter.test.ts`](../src/infrastructure/__tests__/setup_credential_validation_adapter.test.ts) · [`src/infrastructure/__tests__/setup_github_identity_query_adapter.test.ts`](../src/infrastructure/__tests__/setup_github_identity_query_adapter.test.ts) · [`src/infrastructure/__tests__/git_commit_adapter.test.ts`](../src/infrastructure/__tests__/git_commit_adapter.test.ts) · [`src/actions/__tests__/github_action_input.test.ts`](../src/actions/__tests__/github_action_input.test.ts) · [`src/infrastructure/__tests__/setup_permission_cleanup_contract.test.ts`](../src/infrastructure/__tests__/setup_permission_cleanup_contract.test.ts) · [`src/infrastructure/__tests__/setup_permission_actions_cleanup_timing.test.ts`](../src/infrastructure/__tests__/setup_permission_actions_cleanup_timing.test.ts) · [`src/infrastructure/__tests__/setup_permission_operator_actions.test.ts`](../src/infrastructure/__tests__/setup_permission_operator_actions.test.ts) · [`src/infrastructure/__tests__/setup_permission_journal_contract.test.ts`](../src/infrastructure/__tests__/setup_permission_journal_contract.test.ts) · [`src/infrastructure/__tests__/setup_permission_audit_transactions.test.ts`](../src/infrastructure/__tests__/setup_permission_audit_transactions.test.ts) · [`src/infrastructure/__tests__/setup_permission_write_failures.test.ts`](../src/infrastructure/__tests__/setup_permission_write_failures.test.ts) · [`src/infrastructure/__tests__/setup_permission_resource_failures.test.ts`](../src/infrastructure/__tests__/setup_permission_resource_failures.test.ts) · [`src/infrastructure/__tests__/setup_permission_boundary_failures.test.ts`](../src/infrastructure/__tests__/setup_permission_boundary_failures.test.ts) · [`src/infrastructure/__tests__/github_secret_encryption.test.ts`](../src/infrastructure/__tests__/github_secret_encryption.test.ts) · [`src/infrastructure/__tests__/setup_permission_organization_owner.test.ts`](../src/infrastructure/__tests__/setup_permission_organization_owner.test.ts) · [`src/infrastructure/__tests__/setup_pat_bootstrap_transactions.test.ts`](../src/infrastructure/__tests__/setup_pat_bootstrap_transactions.test.ts) · [`src/data/repository/__tests__/repository_actions_sdk_contract.integration.test.ts`](../src/data/repository/__tests__/repository_actions_sdk_contract.integration.test.ts) · [`src/data/repository/__tests__/repository_actions_resource_edge_cases.test.ts`](../src/data/repository/__tests__/repository_actions_resource_edge_cases.test.ts) · [`src/data/repository/__tests__/repository_selected_resource_grants.test.ts`](../src/data/repository/__tests__/repository_selected_resource_grants.test.ts) · [`src/infrastructure/__tests__/setup_permission_read_contract.test.ts`](../src/infrastructure/__tests__/setup_permission_read_contract.test.ts) · [`src/application/usecases/setup/__tests__/setup_workflow_pat_conflict.test.ts`](../src/application/usecases/setup/__tests__/setup_workflow_pat_conflict.test.ts) · [`src/application/usecases/setup/__tests__/setup_workflow_pat_credential_rotation.test.ts`](../src/application/usecases/setup/__tests__/setup_workflow_pat_credential_rotation.test.ts) · [`src/data/repository/__tests__/setup_organization_pat_inventory.test.ts`](../src/data/repository/__tests__/setup_organization_pat_inventory.test.ts) · [`src/cli/__tests__/web_setup_bot_pat_scope_conflict.test.ts`](../src/cli/__tests__/web_setup_bot_pat_scope_conflict.test.ts) · [`src/actions/__tests__/local_setup_apply_contract.test.ts`](../src/actions/__tests__/local_setup_apply_contract.test.ts) · [`src/cli/commands/__tests__/setup_policy.test.ts`](../src/cli/commands/__tests__/setup_policy.test.ts) · [`src/application/usecases/execution/__tests__/execution_issue_number_policy.test.ts`](../src/application/usecases/execution/__tests__/execution_issue_number_policy.test.ts) · [`src/application/usecases/execution/__tests__/setup_execution_workflow.test.ts`](../src/application/usecases/execution/__tests__/setup_execution_workflow.test.ts) · [`src/domain/__tests__/github_runtime_doctor.test.ts`](../src/domain/__tests__/github_runtime_doctor.test.ts) · [`src/domain/__tests__/copilot_command.test.ts`](../src/domain/__tests__/copilot_command.test.ts) · [`src/application/usecases/__tests__/comment_automation_use_case.test.ts`](../src/application/usecases/__tests__/comment_automation_use_case.test.ts) · [`src/application/policies/__tests__/github_runtime_doctor_policy.test.ts`](../src/application/policies/__tests__/github_runtime_doctor_policy.test.ts) · [`src/application/policies/__tests__/doctor_workflow_condition_policy.test.ts`](../src/application/policies/__tests__/doctor_workflow_condition_policy.test.ts) · [`src/application/policies/__tests__/github_runtime_doctor_presentation_policy.test.ts`](../src/application/policies/__tests__/github_runtime_doctor_presentation_policy.test.ts) · [`src/application/usecases/__tests__/read_copilot_doctor_workflow.test.ts`](../src/application/usecases/__tests__/read_copilot_doctor_workflow.test.ts) · [`src/application/usecases/__tests__/runtime_doctor_security_integration.test.ts`](../src/application/usecases/__tests__/runtime_doctor_security_integration.test.ts) · [`src/data/repository/github/__tests__/runtime_doctor_repository.test.ts`](../src/data/repository/github/__tests__/runtime_doctor_repository.test.ts) · [`src/infrastructure/composition/__tests__/github_runtime_doctor_composition_root.test.ts`](../src/infrastructure/composition/__tests__/github_runtime_doctor_composition_root.test.ts) · [`src/application/policies/__tests__/runtime_doctor_agent_activity.test.ts`](../src/application/policies/__tests__/runtime_doctor_agent_activity.test.ts) · [`src/application/policies/__tests__/doctor_workflow_matrix_policy.test.ts`](../src/application/policies/__tests__/doctor_workflow_matrix_policy.test.ts) · [`src/application/policies/__tests__/setup_approval_operator_permissions.test.ts`](../src/application/policies/__tests__/setup_approval_operator_permissions.test.ts) · [`src/application/usecases/setup/__tests__/audit_configured_setup_pat_use_case.test.ts`](../src/application/usecases/setup/__tests__/audit_configured_setup_pat_use_case.test.ts) · [`src/application/policies/__tests__/setup_batch_permission_policy.test.ts`](../src/application/policies/__tests__/setup_batch_permission_policy.test.ts) · [`src/application/policies/__tests__/setup_batch_policy.test.ts`](../src/application/policies/__tests__/setup_batch_policy.test.ts) · [`src/application/policies/__tests__/setup_batch_retry_policy.test.ts`](../src/application/policies/__tests__/setup_batch_retry_policy.test.ts) · [`src/application/policies/__tests__/setup_batch_selection_policy.test.ts`](../src/application/policies/__tests__/setup_batch_selection_policy.test.ts) · [`src/application/policies/__tests__/setup_organization_approval_draft.test.ts`](../src/application/policies/__tests__/setup_organization_approval_draft.test.ts) · [`src/application/policies/__tests__/setup_organization_import_policy.test.ts`](../src/application/policies/__tests__/setup_organization_import_policy.test.ts) · [`src/application/policies/__tests__/setup_organization_import_safety.test.ts`](../src/application/policies/__tests__/setup_organization_import_safety.test.ts) · [`src/application/policies/__tests__/setup_organization_variable_reuse_policy.test.ts`](../src/application/policies/__tests__/setup_organization_variable_reuse_policy.test.ts) · [`src/application/usecases/actions/__tests__/setup_organization_reuse_provisioning.test.ts`](../src/application/usecases/actions/__tests__/setup_organization_reuse_provisioning.test.ts) · [`src/application/usecases/setup/__tests__/apply_setup_batch_use_case.test.ts`](../src/application/usecases/setup/__tests__/apply_setup_batch_use_case.test.ts) · [`src/application/usecases/setup/__tests__/select_setup_batch_targets_use_case.test.ts`](../src/application/usecases/setup/__tests__/select_setup_batch_targets_use_case.test.ts) · [`src/application/usecases/setup/__tests__/setup_batch_flow.test.ts`](../src/application/usecases/setup/__tests__/setup_batch_flow.test.ts) · [`src/application/usecases/setup/__tests__/setup_organization_import_wizard.test.ts`](../src/application/usecases/setup/__tests__/setup_organization_import_wizard.test.ts) · [`src/application/usecases/setup/__tests__/setup_organization_secret_reuse.test.ts`](../src/application/usecases/setup/__tests__/setup_organization_secret_reuse.test.ts) · [`src/cli/__tests__/setup_source_adapter.test.ts`](../src/cli/__tests__/setup_source_adapter.test.ts) · [`src/cli/__tests__/web_setup_batch_components.test.ts`](../src/cli/__tests__/web_setup_batch_components.test.ts) · [`src/cli/__tests__/web_setup_batch_selection.test.ts`](../src/cli/__tests__/web_setup_batch_selection.test.ts) · [`src/infrastructure/__tests__/setup_batch_github_apply_adapter.test.ts`](../src/infrastructure/__tests__/setup_batch_github_apply_adapter.test.ts) · [`src/infrastructure/__tests__/setup_batch_github_read_adapter.test.ts`](../src/infrastructure/__tests__/setup_batch_github_read_adapter.test.ts) · [`src/infrastructure/__tests__/setup_batch_local_adapters.test.ts`](../src/infrastructure/__tests__/setup_batch_local_adapters.test.ts) · [`src/infrastructure/__tests__/setup_reuse_empty_collections.integration.test.ts`](../src/infrastructure/__tests__/setup_reuse_empty_collections.integration.test.ts) · [`src/infrastructure/__tests__/setup_trusted_credential_health_adapter.test.ts`](../src/infrastructure/__tests__/setup_trusted_credential_health_adapter.test.ts) · [`src/infrastructure/__tests__/setup_trusted_health_sdk_contract.integration.test.ts`](../src/infrastructure/__tests__/setup_trusted_health_sdk_contract.integration.test.ts) · [`src/application/policies/__tests__/setup_batch_access_and_view.test.ts`](../src/application/policies/__tests__/setup_batch_access_and_view.test.ts) · [`src/cli/__tests__/setup_batch_adapter.test.ts`](../src/cli/__tests__/setup_batch_adapter.test.ts) · [`src/infrastructure/__tests__/setup_batch_composition.test.ts`](../src/infrastructure/__tests__/setup_batch_composition.test.ts) · [`src/infrastructure/__tests__/setup_batch_guidance_compatibility.test.ts`](../src/infrastructure/__tests__/setup_batch_guidance_compatibility.test.ts) · [`src/utils/__tests__/setup_workflow_upgrade.test.ts`](../src/utils/__tests__/setup_workflow_upgrade.test.ts) · [`src/cli/__tests__/setup_pat_intent_adapter.test.ts`](../src/cli/__tests__/setup_pat_intent_adapter.test.ts) · [`src/application/usecases/__tests__/push_single_action_contexts.test.ts`](../src/application/usecases/__tests__/push_single_action_contexts.test.ts) · [`src/application/policies/__tests__/setup_runner_policy.test.ts`](../src/application/policies/__tests__/setup_runner_policy.test.ts) · [`src/application/policies/__tests__/setup_runner_question_policy.test.ts`](../src/application/policies/__tests__/setup_runner_question_policy.test.ts) · [`src/infrastructure/__tests__/setup_runner_discovery_adapter.test.ts`](../src/infrastructure/__tests__/setup_runner_discovery_adapter.test.ts) · [`src/utils/__tests__/setup_runner_installation.test.ts`](../src/utils/__tests__/setup_runner_installation.test.ts) · [`src/cli/__tests__/web_setup_runner_components.test.ts`](../src/cli/__tests__/web_setup_runner_components.test.ts) · [`src/application/policies/__tests__/setup_runner_installation_summary_policy.test.ts`](../src/application/policies/__tests__/setup_runner_installation_summary_policy.test.ts) · [`src/application/usecases/setup/__tests__/setup_runner_planning.test.ts`](../src/application/usecases/setup/__tests__/setup_runner_planning.test.ts) · [`src/cli/__tests__/setup_runner_config_file.test.ts`](../src/cli/__tests__/setup_runner_config_file.test.ts) · [`src/infrastructure/__tests__/setup_runner_composition.test.ts`](../src/infrastructure/__tests__/setup_runner_composition.test.ts) · [`src/tooling/__tests__/setup_provisioning_workflow.test.ts`](../src/tooling/__tests__/setup_provisioning_workflow.test.ts) · [`src/infrastructure/__tests__/setup_sdd_prerequisites.test.ts`](../src/infrastructure/__tests__/setup_sdd_prerequisites.test.ts) · [`src/cli/__tests__/setup_documentation_navigation.test.ts`](../src/cli/__tests__/setup_documentation_navigation.test.ts) · [`src/application/policies/__tests__/setup_question_documentation_policy.test.ts`](../src/application/policies/__tests__/setup_question_documentation_policy.test.ts) · [`src/application/policies/__tests__/verification_runtime_policy.test.ts`](../src/application/policies/__tests__/verification_runtime_policy.test.ts) · [`src/infrastructure/__tests__/verification_runtime_preflight.test.ts`](../src/infrastructure/__tests__/verification_runtime_preflight.test.ts) · [`src/infrastructure/__tests__/verification_runtime_branch_sync.test.ts`](../src/infrastructure/__tests__/verification_runtime_branch_sync.test.ts) · [`src/infrastructure/__tests__/untrusted_command_environment.test.ts`](../src/infrastructure/__tests__/untrusted_command_environment.test.ts) · [`src/application/usecases/steps/commit/bugbot/__tests__/verify_command_runner.test.ts`](../src/application/usecases/steps/commit/bugbot/__tests__/verify_command_runner.test.ts) · [`src/application/usecases/steps/commit/bugbot/__tests__/commit_verification_workspace.test.ts`](../src/application/usecases/steps/commit/bugbot/__tests__/commit_verification_workspace.test.ts) · [`src/tooling/__tests__/verification_runtime_guidance.test.ts`](../src/tooling/__tests__/verification_runtime_guidance.test.ts) · [`src/infrastructure/__tests__/verification_setup_configuration.test.ts`](../src/infrastructure/__tests__/verification_setup_configuration.test.ts) · [`src/domain/__tests__/copilot_comment_workflow.test.ts`](../src/domain/__tests__/copilot_comment_workflow.test.ts) · [`src/tooling/__tests__/credential_health_transport.test.ts`](../src/tooling/__tests__/credential_health_transport.test.ts) · [`src/infrastructure/__tests__/private_jvm_environment.test.ts`](../src/infrastructure/__tests__/private_jvm_environment.test.ts) - User documentation: [`README.md`](../README.md) · [`docs/how-to-use.mdx`](../docs/how-to-use.mdx) · [`docs/configuration.mdx`](../docs/configuration.mdx) · [`docs/configuration-checklist.mdx`](../docs/configuration-checklist.mdx) · [`docs/authentication.mdx`](../docs/authentication.mdx) · [`docs/development/architecture.mdx`](../docs/development/architecture.mdx) · [`docs/security-operations/operations/provisioning.mdx`](../docs/security-operations/operations/provisioning.mdx) · [`docs/security-operations/operations/troubleshooting.mdx`](../docs/security-operations/operations/troubleshooting.mdx) · [`docs/security-operations/security/credentials.mdx`](../docs/security-operations/security/credentials.mdx) · [`docs/single-actions/workflow-and-cli.mdx`](../docs/single-actions/workflow-and-cli.mdx) · [`docs/security-operations/operations/verification.mdx`](../docs/security-operations/operations/verification.mdx) · [`docs/development/setup-pat-provider-audit-2026-10-06.md`](../docs/development/setup-pat-provider-audit-2026-10-06.md) · [`docs/issues/comment-commands.mdx`](../docs/issues/comment-commands.mdx) · [`docs/issues/branch-synchronization.mdx`](../docs/issues/branch-synchronization.mdx) · [`docs/setup-web.mdx`](../docs/setup-web.mdx) · [`docs/first-workflow.mdx`](../docs/first-workflow.mdx) · [`docs/using-the-docs.mdx`](../docs/using-the-docs.mdx) · [`docs/guides/index.mdx`](../docs/guides/index.mdx) · [`docs/guides/issues-and-branches.mdx`](../docs/guides/issues-and-branches.mdx) · [`docs/guides/review-pull-requests.mdx`](../docs/guides/review-pull-requests.mdx) · [`docs/guides/work-with-the-bot.mdx`](../docs/guides/work-with-the-bot.mdx) · [`docs/guides/releases-and-hotfixes.mdx`](../docs/guides/releases-and-hotfixes.mdx) · [`docs/agents/repository-collaboration.mdx`](../docs/agents/repository-collaboration.mdx) ### `local-web-setup-assistant` — Local web setup assistant @@ -192,12 +192,12 @@ debt or convert unknown historic intent into a design decision. ### `branch-synchronization` — Branch synchronization and conflict recovery - Owner: Copilot maintainers -- Last verified: 2026-10-27 +- Last verified: 2026-10-29 - Specifications: [`specs/branch-synchronization-and-conflict-recovery.md`](./branch-synchronization-and-conflict-recovery.md) · [`specs/repository-verification-runtime-prerequisites.md`](./repository-verification-runtime-prerequisites.md) · [`specs/repository-verification-setup-hooks.md`](./repository-verification-setup-hooks.md) - Workflows: [`.github/workflows/copilot_branch_sync.yml`](../.github/workflows/copilot_branch_sync.yml) · [`setup/workflows/copilot_branch_sync.yml`](../setup/workflows/copilot_branch_sync.yml) · [`.github/workflows/copilot_issue.yml`](../.github/workflows/copilot_issue.yml) · [`setup/workflows/copilot_issue.yml`](../setup/workflows/copilot_issue.yml) · [`setup/workflows/copilot_issue_comment.yml`](../setup/workflows/copilot_issue_comment.yml) · [`setup/workflows/copilot_pull_request_comment.yml`](../setup/workflows/copilot_pull_request_comment.yml) · [`.github/workflows/copilot_comment_runtime.yml`](../.github/workflows/copilot_comment_runtime.yml) · [`.github/workflows/copilot_issue_comment.yml`](../.github/workflows/copilot_issue_comment.yml) · [`.github/workflows/copilot_pull_request_comment.yml`](../.github/workflows/copilot_pull_request_comment.yml) - Entrypoints: [`src/application/usecases/branch_sync/sync_branch_use_case.ts`](../src/application/usecases/branch_sync/sync_branch_use_case.ts) · [`src/application/usecases/actions/observe_branch_sync_use_case.ts`](../src/application/usecases/actions/observe_branch_sync_use_case.ts) -- Core code: [`src/domain/branch_sync_command.ts`](../src/domain/branch_sync_command.ts) · [`src/application/ports/branch_sync_ports.ts`](../src/application/ports/branch_sync_ports.ts) · [`src/application/policies/branch_sync_message_catalog.ts`](../src/application/policies/branch_sync_message_catalog.ts) · [`src/application/policies/branch_sync_notification_policy.ts`](../src/application/policies/branch_sync_notification_policy.ts) · [`src/application/usecases/branch_sync/branch_sync_execution_policy.ts`](../src/application/usecases/branch_sync/branch_sync_execution_policy.ts) · [`src/application/usecases/actions/observe_branch_sync_use_case.ts`](../src/application/usecases/actions/observe_branch_sync_use_case.ts) · [`src/application/usecases/push_single_action_contexts.ts`](../src/application/usecases/push_single_action_contexts.ts) · [`src/application/usecases/steps/common/transition_notification_workflow.ts`](../src/application/usecases/steps/common/transition_notification_workflow.ts) · [`src/data/repository/branch_sync/branch_dependency_policy.ts`](../src/data/repository/branch_sync/branch_dependency_policy.ts) · [`src/data/repository/branch_sync/branch_dependency_repository.ts`](../src/data/repository/branch_sync/branch_dependency_repository.ts) · [`src/infrastructure/composition/main_run_route_composition_root.ts`](../src/infrastructure/composition/main_run_route_composition_root.ts) · [`src/infrastructure/composition/push_single_action_capability_port_binding.ts`](../src/infrastructure/composition/push_single_action_capability_port_binding.ts) · [`src/infrastructure/branch_sync_workspace_adapter.ts`](../src/infrastructure/branch_sync_workspace_adapter.ts) · [`src/prompts/branch_sync_conflicts.ts`](../src/prompts/branch_sync_conflicts.ts) · [`src/data/model/application_error.ts`](../src/data/model/application_error.ts) · [`src/application/policies/application_error_message_catalog.ts`](../src/application/policies/application_error_message_catalog.ts) · [`src/infrastructure/git_commit_adapter.ts`](../src/infrastructure/git_commit_adapter.ts) · [`src/infrastructure/branch_sync_sdd_catalog.ts`](../src/infrastructure/branch_sync_sdd_catalog.ts) · [`src/domain/branch_sync_validation.ts`](../src/domain/branch_sync_validation.ts) · [`src/application/policies/lifecycle_state_policy.ts`](../src/application/policies/lifecycle_state_policy.ts) · [`src/infrastructure/branch_sync_communication_budget.ts`](../src/infrastructure/branch_sync_communication_budget.ts) · [`src/application/usecases/actions/retire_branch_sync_use_case.ts`](../src/application/usecases/actions/retire_branch_sync_use_case.ts) · [`src/application/ports/issue_completion_ports.ts`](../src/application/ports/issue_completion_ports.ts) · [`src/application/usecases/pull_request_workflow.ts`](../src/application/usecases/pull_request_workflow.ts) · [`src/application/usecases/pull_request_workflow_context.ts`](../src/application/usecases/pull_request_workflow_context.ts) · [`src/infrastructure/composition/pull_request_use_case_composition_root.ts`](../src/infrastructure/composition/pull_request_use_case_composition_root.ts) · [`src/actions/common_action.ts`](../src/actions/common_action.ts) · [`src/actions/github_action.ts`](../src/actions/github_action.ts) · [`scripts/validate-workflow-contract.cjs`](../scripts/validate-workflow-contract.cjs) · [`src/application/ports/reply_request_read_ports.ts`](../src/application/ports/reply_request_read_ports.ts) · [`src/domain/reply_request_digest.ts`](../src/domain/reply_request_digest.ts) · [`src/infrastructure/composition/reply_request_composition_root.ts`](../src/infrastructure/composition/reply_request_composition_root.ts) · [`src/data/repository/reply_request_repository.ts`](../src/data/repository/reply_request_repository.ts) · [`src/application/policies/verification_runtime_policy.ts`](../src/application/policies/verification_runtime_policy.ts) · [`src/infrastructure/verification_runtime_manifest.ts`](../src/infrastructure/verification_runtime_manifest.ts) · [`src/infrastructure/verification_runtime_preflight.ts`](../src/infrastructure/verification_runtime_preflight.ts) · [`src/infrastructure/untrusted_command_environment.ts`](../src/infrastructure/untrusted_command_environment.ts) · [`src/application/ports/git_ports.ts`](../src/application/ports/git_ports.ts) · [`src/application/ports/bugbot_git_ports.ts`](../src/application/ports/bugbot_git_ports.ts) · [`src/application/usecases/steps/commit/bugbot/commit_and_push_preflight.ts`](../src/application/usecases/steps/commit/bugbot/commit_and_push_preflight.ts) · [`src/application/usecases/steps/commit/bugbot/verify_command_runner.ts`](../src/application/usecases/steps/commit/bugbot/verify_command_runner.ts) · [`src/domain/closed_issue_reconciliation.ts`](../src/domain/closed_issue_reconciliation.ts) · [`src/application/errors/closed_issue_reconciliation_error.ts`](../src/application/errors/closed_issue_reconciliation_error.ts) · [`src/application/policies/verification_setup_policy.ts`](../src/application/policies/verification_setup_policy.ts) · [`src/application/ports/verification_setup_ports.ts`](../src/application/ports/verification_setup_ports.ts) · [`src/infrastructure/verification_setup_snapshot.ts`](../src/infrastructure/verification_setup_snapshot.ts) · [`src/infrastructure/verification_setup_result.ts`](../src/infrastructure/verification_setup_result.ts) · [`src/infrastructure/verification_setup_runner.ts`](../src/infrastructure/verification_setup_runner.ts) · [`src/infrastructure/native_verification_protocol.ts`](../src/infrastructure/native_verification_protocol.ts) · [`src/infrastructure/native_verification_candidate.ts`](../src/infrastructure/native_verification_candidate.ts) · [`src/infrastructure/native_verification_staging.ts`](../src/infrastructure/native_verification_staging.ts) · [`src/infrastructure/native_verification_controller.ts`](../src/infrastructure/native_verification_controller.ts) · [`src/infrastructure/native_verification_profiles.ts`](../src/infrastructure/native_verification_profiles.ts) · [`src/infrastructure/native_verification_redaction.ts`](../src/infrastructure/native_verification_redaction.ts) · [`scripts/generate-native-verification-workflows.cjs`](../scripts/generate-native-verification-workflows.cjs) · [`src/infrastructure/verification_executable.ts`](../src/infrastructure/verification_executable.ts) · [`src/infrastructure/native_verification_source_runtime.ts`](../src/infrastructure/native_verification_source_runtime.ts) · [`scripts/prepare-native-source-action.cjs`](../scripts/prepare-native-source-action.cjs) · [`src/domain/copilot_comment_workflow.ts`](../src/domain/copilot_comment_workflow.ts) · [`src/infrastructure/copilot_comment_inputs.json`](../src/infrastructure/copilot_comment_inputs.json) · [`scripts/validate-comment-workflows.cjs`](../scripts/validate-comment-workflows.cjs) · [`src/domain/verification_failure.ts`](../src/domain/verification_failure.ts) · [`src/application/policies/source_verification_dependency_policy.ts`](../src/application/policies/source_verification_dependency_policy.ts) · [`src/infrastructure/source_verification_dependencies.ts`](../src/infrastructure/source_verification_dependencies.ts) · [`src/application/policies/branch_sync_relationship_retirement_policy.ts`](../src/application/policies/branch_sync_relationship_retirement_policy.ts) · [`src/application/usecases/actions/retire_unrelated_branch_sync_cards.ts`](../src/application/usecases/actions/retire_unrelated_branch_sync_cards.ts) -- Tests: [`src/application/policies/__tests__/branch_sync_notification_policy.test.ts`](../src/application/policies/__tests__/branch_sync_notification_policy.test.ts) · [`src/application/usecases/actions/__tests__/observe_branch_sync_use_case.test.ts`](../src/application/usecases/actions/__tests__/observe_branch_sync_use_case.test.ts) · [`src/application/usecases/branch_sync/__tests__/sync_branch_use_case.test.ts`](../src/application/usecases/branch_sync/__tests__/sync_branch_use_case.test.ts) · [`src/application/usecases/__tests__/push_single_action_contexts.test.ts`](../src/application/usecases/__tests__/push_single_action_contexts.test.ts) · [`src/application/usecases/steps/common/__tests__/transition_notification_workflow.test.ts`](../src/application/usecases/steps/common/__tests__/transition_notification_workflow.test.ts) · [`src/data/repository/branch_sync/__tests__/branch_dependency_policy.test.ts`](../src/data/repository/branch_sync/__tests__/branch_dependency_policy.test.ts) · [`src/data/repository/branch_sync/__tests__/branch_dependency_repository.test.ts`](../src/data/repository/branch_sync/__tests__/branch_dependency_repository.test.ts) · [`src/infrastructure/__tests__/branch_sync_workspace_adapter.test.ts`](../src/infrastructure/__tests__/branch_sync_workspace_adapter.test.ts) · [`src/infrastructure/composition/__tests__/push_single_action_capability_port_binding.test.ts`](../src/infrastructure/composition/__tests__/push_single_action_capability_port_binding.test.ts) · [`src/application/usecases/branch_sync/__tests__/branch_sync_execution_policy.test.ts`](../src/application/usecases/branch_sync/__tests__/branch_sync_execution_policy.test.ts) · [`src/application/errors/__tests__/application_error.test.ts`](../src/application/errors/__tests__/application_error.test.ts) · [`src/application/policies/__tests__/application_error_presentation_policy.test.ts`](../src/application/policies/__tests__/application_error_presentation_policy.test.ts) · [`src/infrastructure/__tests__/git_commit_adapter.test.ts`](../src/infrastructure/__tests__/git_commit_adapter.test.ts) · [`src/infrastructure/__tests__/branch_sync_sdd_catalog.test.ts`](../src/infrastructure/__tests__/branch_sync_sdd_catalog.test.ts) · [`src/infrastructure/__tests__/branch_sync_generated_bundle_validation.test.ts`](../src/infrastructure/__tests__/branch_sync_generated_bundle_validation.test.ts) · [`src/application/policies/__tests__/branch_sync_lifecycle_recovery.test.ts`](../src/application/policies/__tests__/branch_sync_lifecycle_recovery.test.ts) · [`src/infrastructure/__tests__/branch_sync_resolved_workspace.test.ts`](../src/infrastructure/__tests__/branch_sync_resolved_workspace.test.ts) · [`src/infrastructure/__tests__/branch_sync_communication_budget.test.ts`](../src/infrastructure/__tests__/branch_sync_communication_budget.test.ts) · [`src/application/usecases/actions/__tests__/retire_branch_sync_use_case.test.ts`](../src/application/usecases/actions/__tests__/retire_branch_sync_use_case.test.ts) · [`src/application/usecases/__tests__/pull_request_use_case.test.ts`](../src/application/usecases/__tests__/pull_request_use_case.test.ts) · [`src/actions/__tests__/common_action.test.ts`](../src/actions/__tests__/common_action.test.ts) · [`src/actions/__tests__/github_action.test.ts`](../src/actions/__tests__/github_action.test.ts) · [`src/tooling/__tests__/validate_workflow_contract.test.ts`](../src/tooling/__tests__/validate_workflow_contract.test.ts) · [`src/data/repository/__tests__/reply_request_repository.test.ts`](../src/data/repository/__tests__/reply_request_repository.test.ts) · [`src/infrastructure/composition/__tests__/reply_request_composition_root.test.ts`](../src/infrastructure/composition/__tests__/reply_request_composition_root.test.ts) · [`src/application/policies/__tests__/verification_runtime_policy.test.ts`](../src/application/policies/__tests__/verification_runtime_policy.test.ts) · [`src/infrastructure/__tests__/verification_runtime_preflight.test.ts`](../src/infrastructure/__tests__/verification_runtime_preflight.test.ts) · [`src/infrastructure/__tests__/verification_runtime_branch_sync.test.ts`](../src/infrastructure/__tests__/verification_runtime_branch_sync.test.ts) · [`src/infrastructure/__tests__/untrusted_command_environment.test.ts`](../src/infrastructure/__tests__/untrusted_command_environment.test.ts) · [`src/application/usecases/steps/commit/bugbot/__tests__/verify_command_runner.test.ts`](../src/application/usecases/steps/commit/bugbot/__tests__/verify_command_runner.test.ts) · [`src/application/usecases/steps/commit/bugbot/__tests__/commit_verification_workspace.test.ts`](../src/application/usecases/steps/commit/bugbot/__tests__/commit_verification_workspace.test.ts) · [`src/tooling/__tests__/verification_runtime_guidance.test.ts`](../src/tooling/__tests__/verification_runtime_guidance.test.ts) · [`src/application/policies/__tests__/verification_setup_policy.test.ts`](../src/application/policies/__tests__/verification_setup_policy.test.ts) · [`src/infrastructure/__tests__/verification_setup_snapshot.test.ts`](../src/infrastructure/__tests__/verification_setup_snapshot.test.ts) · [`src/infrastructure/__tests__/verification_setup_runner.test.ts`](../src/infrastructure/__tests__/verification_setup_runner.test.ts) · [`src/infrastructure/__tests__/verification_setup_configuration.test.ts`](../src/infrastructure/__tests__/verification_setup_configuration.test.ts) · [`src/infrastructure/__tests__/verification_setup_sync.test.ts`](../src/infrastructure/__tests__/verification_setup_sync.test.ts) · [`src/infrastructure/__tests__/native_verification_runner.test.ts`](../src/infrastructure/__tests__/native_verification_runner.test.ts) · [`src/infrastructure/__tests__/native_verification_protocol.test.ts`](../src/infrastructure/__tests__/native_verification_protocol.test.ts) · [`src/infrastructure/__tests__/native_verification_controller.test.ts`](../src/infrastructure/__tests__/native_verification_controller.test.ts) · [`src/infrastructure/__tests__/native_verification_redaction.test.ts`](../src/infrastructure/__tests__/native_verification_redaction.test.ts) · [`src/infrastructure/__tests__/native_verification_workflow.test.ts`](../src/infrastructure/__tests__/native_verification_workflow.test.ts) · [`src/infrastructure/__tests__/native_verification_profiles.test.ts`](../src/infrastructure/__tests__/native_verification_profiles.test.ts) · [`src/infrastructure/__tests__/verification_executable.test.ts`](../src/infrastructure/__tests__/verification_executable.test.ts) · [`src/infrastructure/__tests__/native_verification_post.test.ts`](../src/infrastructure/__tests__/native_verification_post.test.ts) · [`src/infrastructure/__tests__/native_verification_source_runtime.test.ts`](../src/infrastructure/__tests__/native_verification_source_runtime.test.ts) · [`src/domain/__tests__/copilot_comment_workflow.test.ts`](../src/domain/__tests__/copilot_comment_workflow.test.ts) · [`src/domain/__tests__/verification_failure.test.ts`](../src/domain/__tests__/verification_failure.test.ts) · [`src/infrastructure/__tests__/source_verification_dependencies.test.ts`](../src/infrastructure/__tests__/source_verification_dependencies.test.ts) · [`src/application/usecases/actions/__tests__/retire_unrelated_branch_sync_cards.test.ts`](../src/application/usecases/actions/__tests__/retire_unrelated_branch_sync_cards.test.ts) +- Core code: [`src/domain/branch_sync_command.ts`](../src/domain/branch_sync_command.ts) · [`src/application/ports/branch_sync_ports.ts`](../src/application/ports/branch_sync_ports.ts) · [`src/application/policies/branch_sync_message_catalog.ts`](../src/application/policies/branch_sync_message_catalog.ts) · [`src/application/policies/branch_sync_notification_policy.ts`](../src/application/policies/branch_sync_notification_policy.ts) · [`src/application/usecases/branch_sync/branch_sync_execution_policy.ts`](../src/application/usecases/branch_sync/branch_sync_execution_policy.ts) · [`src/application/usecases/actions/observe_branch_sync_use_case.ts`](../src/application/usecases/actions/observe_branch_sync_use_case.ts) · [`src/application/usecases/push_single_action_contexts.ts`](../src/application/usecases/push_single_action_contexts.ts) · [`src/application/usecases/steps/common/transition_notification_workflow.ts`](../src/application/usecases/steps/common/transition_notification_workflow.ts) · [`src/data/repository/branch_sync/branch_dependency_policy.ts`](../src/data/repository/branch_sync/branch_dependency_policy.ts) · [`src/data/repository/branch_sync/branch_dependency_repository.ts`](../src/data/repository/branch_sync/branch_dependency_repository.ts) · [`src/infrastructure/composition/main_run_route_composition_root.ts`](../src/infrastructure/composition/main_run_route_composition_root.ts) · [`src/infrastructure/composition/push_single_action_capability_port_binding.ts`](../src/infrastructure/composition/push_single_action_capability_port_binding.ts) · [`src/infrastructure/branch_sync_workspace_adapter.ts`](../src/infrastructure/branch_sync_workspace_adapter.ts) · [`src/prompts/branch_sync_conflicts.ts`](../src/prompts/branch_sync_conflicts.ts) · [`src/data/model/application_error.ts`](../src/data/model/application_error.ts) · [`src/application/policies/application_error_message_catalog.ts`](../src/application/policies/application_error_message_catalog.ts) · [`src/infrastructure/git_commit_adapter.ts`](../src/infrastructure/git_commit_adapter.ts) · [`src/infrastructure/branch_sync_sdd_catalog.ts`](../src/infrastructure/branch_sync_sdd_catalog.ts) · [`src/domain/branch_sync_validation.ts`](../src/domain/branch_sync_validation.ts) · [`src/application/policies/lifecycle_state_policy.ts`](../src/application/policies/lifecycle_state_policy.ts) · [`src/infrastructure/branch_sync_communication_budget.ts`](../src/infrastructure/branch_sync_communication_budget.ts) · [`src/application/usecases/actions/retire_branch_sync_use_case.ts`](../src/application/usecases/actions/retire_branch_sync_use_case.ts) · [`src/application/ports/issue_completion_ports.ts`](../src/application/ports/issue_completion_ports.ts) · [`src/application/usecases/pull_request_workflow.ts`](../src/application/usecases/pull_request_workflow.ts) · [`src/application/usecases/pull_request_workflow_context.ts`](../src/application/usecases/pull_request_workflow_context.ts) · [`src/infrastructure/composition/pull_request_use_case_composition_root.ts`](../src/infrastructure/composition/pull_request_use_case_composition_root.ts) · [`src/actions/common_action.ts`](../src/actions/common_action.ts) · [`src/actions/github_action.ts`](../src/actions/github_action.ts) · [`scripts/validate-workflow-contract.cjs`](../scripts/validate-workflow-contract.cjs) · [`src/application/ports/reply_request_read_ports.ts`](../src/application/ports/reply_request_read_ports.ts) · [`src/domain/reply_request_digest.ts`](../src/domain/reply_request_digest.ts) · [`src/infrastructure/composition/reply_request_composition_root.ts`](../src/infrastructure/composition/reply_request_composition_root.ts) · [`src/data/repository/reply_request_repository.ts`](../src/data/repository/reply_request_repository.ts) · [`src/application/policies/verification_runtime_policy.ts`](../src/application/policies/verification_runtime_policy.ts) · [`src/infrastructure/verification_runtime_manifest.ts`](../src/infrastructure/verification_runtime_manifest.ts) · [`src/infrastructure/verification_runtime_preflight.ts`](../src/infrastructure/verification_runtime_preflight.ts) · [`src/infrastructure/untrusted_command_environment.ts`](../src/infrastructure/untrusted_command_environment.ts) · [`src/application/ports/git_ports.ts`](../src/application/ports/git_ports.ts) · [`src/application/ports/bugbot_git_ports.ts`](../src/application/ports/bugbot_git_ports.ts) · [`src/application/usecases/steps/commit/bugbot/commit_and_push_preflight.ts`](../src/application/usecases/steps/commit/bugbot/commit_and_push_preflight.ts) · [`src/application/usecases/steps/commit/bugbot/verify_command_runner.ts`](../src/application/usecases/steps/commit/bugbot/verify_command_runner.ts) · [`src/domain/closed_issue_reconciliation.ts`](../src/domain/closed_issue_reconciliation.ts) · [`src/application/errors/closed_issue_reconciliation_error.ts`](../src/application/errors/closed_issue_reconciliation_error.ts) · [`src/application/policies/verification_setup_policy.ts`](../src/application/policies/verification_setup_policy.ts) · [`src/application/ports/verification_setup_ports.ts`](../src/application/ports/verification_setup_ports.ts) · [`src/infrastructure/verification_setup_snapshot.ts`](../src/infrastructure/verification_setup_snapshot.ts) · [`src/infrastructure/verification_setup_result.ts`](../src/infrastructure/verification_setup_result.ts) · [`src/infrastructure/verification_setup_runner.ts`](../src/infrastructure/verification_setup_runner.ts) · [`src/infrastructure/native_verification_protocol.ts`](../src/infrastructure/native_verification_protocol.ts) · [`src/infrastructure/native_verification_candidate.ts`](../src/infrastructure/native_verification_candidate.ts) · [`src/infrastructure/native_verification_staging.ts`](../src/infrastructure/native_verification_staging.ts) · [`src/infrastructure/native_verification_controller.ts`](../src/infrastructure/native_verification_controller.ts) · [`src/infrastructure/native_verification_profiles.ts`](../src/infrastructure/native_verification_profiles.ts) · [`src/infrastructure/native_verification_redaction.ts`](../src/infrastructure/native_verification_redaction.ts) · [`scripts/generate-native-verification-workflows.cjs`](../scripts/generate-native-verification-workflows.cjs) · [`src/infrastructure/verification_executable.ts`](../src/infrastructure/verification_executable.ts) · [`src/infrastructure/native_verification_source_runtime.ts`](../src/infrastructure/native_verification_source_runtime.ts) · [`scripts/prepare-native-source-action.cjs`](../scripts/prepare-native-source-action.cjs) · [`src/domain/copilot_comment_workflow.ts`](../src/domain/copilot_comment_workflow.ts) · [`src/infrastructure/copilot_comment_inputs.json`](../src/infrastructure/copilot_comment_inputs.json) · [`scripts/validate-comment-workflows.cjs`](../scripts/validate-comment-workflows.cjs) · [`src/domain/verification_failure.ts`](../src/domain/verification_failure.ts) · [`src/application/policies/source_verification_dependency_policy.ts`](../src/application/policies/source_verification_dependency_policy.ts) · [`src/infrastructure/source_verification_dependencies.ts`](../src/infrastructure/source_verification_dependencies.ts) · [`src/application/policies/branch_sync_relationship_retirement_policy.ts`](../src/application/policies/branch_sync_relationship_retirement_policy.ts) · [`src/application/usecases/actions/retire_unrelated_branch_sync_cards.ts`](../src/application/usecases/actions/retire_unrelated_branch_sync_cards.ts) · [`src/infrastructure/private_jvm_environment.ts`](../src/infrastructure/private_jvm_environment.ts) · [`src/tooling/__tests__/fixtures/verification_jvm_gradle_probe.cjs`](../src/tooling/__tests__/fixtures/verification_jvm_gradle_probe.cjs) · [`src/tooling/__tests__/fixtures/verification_jvm_gradle_container_fixture.ts`](../src/tooling/__tests__/fixtures/verification_jvm_gradle_container_fixture.ts) · [`src/tooling/__tests__/fixtures/verification_native_fixture.ts`](../src/tooling/__tests__/fixtures/verification_native_fixture.ts) +- Tests: [`src/application/policies/__tests__/branch_sync_notification_policy.test.ts`](../src/application/policies/__tests__/branch_sync_notification_policy.test.ts) · [`src/application/usecases/actions/__tests__/observe_branch_sync_use_case.test.ts`](../src/application/usecases/actions/__tests__/observe_branch_sync_use_case.test.ts) · [`src/application/usecases/branch_sync/__tests__/sync_branch_use_case.test.ts`](../src/application/usecases/branch_sync/__tests__/sync_branch_use_case.test.ts) · [`src/application/usecases/__tests__/push_single_action_contexts.test.ts`](../src/application/usecases/__tests__/push_single_action_contexts.test.ts) · [`src/application/usecases/steps/common/__tests__/transition_notification_workflow.test.ts`](../src/application/usecases/steps/common/__tests__/transition_notification_workflow.test.ts) · [`src/data/repository/branch_sync/__tests__/branch_dependency_policy.test.ts`](../src/data/repository/branch_sync/__tests__/branch_dependency_policy.test.ts) · [`src/data/repository/branch_sync/__tests__/branch_dependency_repository.test.ts`](../src/data/repository/branch_sync/__tests__/branch_dependency_repository.test.ts) · [`src/infrastructure/__tests__/branch_sync_workspace_adapter.test.ts`](../src/infrastructure/__tests__/branch_sync_workspace_adapter.test.ts) · [`src/infrastructure/composition/__tests__/push_single_action_capability_port_binding.test.ts`](../src/infrastructure/composition/__tests__/push_single_action_capability_port_binding.test.ts) · [`src/application/usecases/branch_sync/__tests__/branch_sync_execution_policy.test.ts`](../src/application/usecases/branch_sync/__tests__/branch_sync_execution_policy.test.ts) · [`src/application/errors/__tests__/application_error.test.ts`](../src/application/errors/__tests__/application_error.test.ts) · [`src/application/policies/__tests__/application_error_presentation_policy.test.ts`](../src/application/policies/__tests__/application_error_presentation_policy.test.ts) · [`src/infrastructure/__tests__/git_commit_adapter.test.ts`](../src/infrastructure/__tests__/git_commit_adapter.test.ts) · [`src/infrastructure/__tests__/branch_sync_sdd_catalog.test.ts`](../src/infrastructure/__tests__/branch_sync_sdd_catalog.test.ts) · [`src/infrastructure/__tests__/branch_sync_generated_bundle_validation.test.ts`](../src/infrastructure/__tests__/branch_sync_generated_bundle_validation.test.ts) · [`src/application/policies/__tests__/branch_sync_lifecycle_recovery.test.ts`](../src/application/policies/__tests__/branch_sync_lifecycle_recovery.test.ts) · [`src/infrastructure/__tests__/branch_sync_resolved_workspace.test.ts`](../src/infrastructure/__tests__/branch_sync_resolved_workspace.test.ts) · [`src/infrastructure/__tests__/branch_sync_communication_budget.test.ts`](../src/infrastructure/__tests__/branch_sync_communication_budget.test.ts) · [`src/application/usecases/actions/__tests__/retire_branch_sync_use_case.test.ts`](../src/application/usecases/actions/__tests__/retire_branch_sync_use_case.test.ts) · [`src/application/usecases/__tests__/pull_request_use_case.test.ts`](../src/application/usecases/__tests__/pull_request_use_case.test.ts) · [`src/actions/__tests__/common_action.test.ts`](../src/actions/__tests__/common_action.test.ts) · [`src/actions/__tests__/github_action.test.ts`](../src/actions/__tests__/github_action.test.ts) · [`src/tooling/__tests__/validate_workflow_contract.test.ts`](../src/tooling/__tests__/validate_workflow_contract.test.ts) · [`src/data/repository/__tests__/reply_request_repository.test.ts`](../src/data/repository/__tests__/reply_request_repository.test.ts) · [`src/infrastructure/composition/__tests__/reply_request_composition_root.test.ts`](../src/infrastructure/composition/__tests__/reply_request_composition_root.test.ts) · [`src/application/policies/__tests__/verification_runtime_policy.test.ts`](../src/application/policies/__tests__/verification_runtime_policy.test.ts) · [`src/infrastructure/__tests__/verification_runtime_preflight.test.ts`](../src/infrastructure/__tests__/verification_runtime_preflight.test.ts) · [`src/infrastructure/__tests__/verification_runtime_branch_sync.test.ts`](../src/infrastructure/__tests__/verification_runtime_branch_sync.test.ts) · [`src/infrastructure/__tests__/untrusted_command_environment.test.ts`](../src/infrastructure/__tests__/untrusted_command_environment.test.ts) · [`src/application/usecases/steps/commit/bugbot/__tests__/verify_command_runner.test.ts`](../src/application/usecases/steps/commit/bugbot/__tests__/verify_command_runner.test.ts) · [`src/application/usecases/steps/commit/bugbot/__tests__/commit_verification_workspace.test.ts`](../src/application/usecases/steps/commit/bugbot/__tests__/commit_verification_workspace.test.ts) · [`src/tooling/__tests__/verification_runtime_guidance.test.ts`](../src/tooling/__tests__/verification_runtime_guidance.test.ts) · [`src/application/policies/__tests__/verification_setup_policy.test.ts`](../src/application/policies/__tests__/verification_setup_policy.test.ts) · [`src/infrastructure/__tests__/verification_setup_snapshot.test.ts`](../src/infrastructure/__tests__/verification_setup_snapshot.test.ts) · [`src/infrastructure/__tests__/verification_setup_runner.test.ts`](../src/infrastructure/__tests__/verification_setup_runner.test.ts) · [`src/infrastructure/__tests__/verification_setup_configuration.test.ts`](../src/infrastructure/__tests__/verification_setup_configuration.test.ts) · [`src/infrastructure/__tests__/verification_setup_sync.test.ts`](../src/infrastructure/__tests__/verification_setup_sync.test.ts) · [`src/infrastructure/__tests__/native_verification_runner.test.ts`](../src/infrastructure/__tests__/native_verification_runner.test.ts) · [`src/infrastructure/__tests__/native_verification_protocol.test.ts`](../src/infrastructure/__tests__/native_verification_protocol.test.ts) · [`src/infrastructure/__tests__/native_verification_controller.test.ts`](../src/infrastructure/__tests__/native_verification_controller.test.ts) · [`src/infrastructure/__tests__/native_verification_redaction.test.ts`](../src/infrastructure/__tests__/native_verification_redaction.test.ts) · [`src/infrastructure/__tests__/native_verification_workflow.test.ts`](../src/infrastructure/__tests__/native_verification_workflow.test.ts) · [`src/infrastructure/__tests__/native_verification_profiles.test.ts`](../src/infrastructure/__tests__/native_verification_profiles.test.ts) · [`src/infrastructure/__tests__/verification_executable.test.ts`](../src/infrastructure/__tests__/verification_executable.test.ts) · [`src/infrastructure/__tests__/native_verification_post.test.ts`](../src/infrastructure/__tests__/native_verification_post.test.ts) · [`src/infrastructure/__tests__/native_verification_source_runtime.test.ts`](../src/infrastructure/__tests__/native_verification_source_runtime.test.ts) · [`src/domain/__tests__/copilot_comment_workflow.test.ts`](../src/domain/__tests__/copilot_comment_workflow.test.ts) · [`src/domain/__tests__/verification_failure.test.ts`](../src/domain/__tests__/verification_failure.test.ts) · [`src/infrastructure/__tests__/source_verification_dependencies.test.ts`](../src/infrastructure/__tests__/source_verification_dependencies.test.ts) · [`src/application/usecases/actions/__tests__/retire_unrelated_branch_sync_cards.test.ts`](../src/application/usecases/actions/__tests__/retire_unrelated_branch_sync_cards.test.ts) · [`src/infrastructure/__tests__/private_jvm_environment.test.ts`](../src/infrastructure/__tests__/private_jvm_environment.test.ts) - User documentation: [`docs/issues/branch-synchronization.mdx`](../docs/issues/branch-synchronization.mdx) · [`docs/issues/comment-commands.mdx`](../docs/issues/comment-commands.mdx) · [`docs/issues/notifications-and-auto-close.mdx`](../docs/issues/notifications-and-auto-close.mdx) · [`docs/development/architecture.mdx`](../docs/development/architecture.mdx) · [`docs/security-operations/operations/verification.mdx`](../docs/security-operations/operations/verification.mdx) · [`docs/security-operations/operations/troubleshooting.mdx`](../docs/security-operations/operations/troubleshooting.mdx) · [`docs/agents/repository-collaboration.mdx`](../docs/agents/repository-collaboration.mdx) ### `pull-request-lifecycle` — Pull request lifecycle and enrichment @@ -214,12 +214,12 @@ debt or convert unknown historic intent into a design decision. ### `agent-runtime` — Agent runtime, provider, model, and role routing - Owner: Copilot maintainers -- Last verified: 2026-10-24 +- Last verified: 2026-10-29 - Specifications: [`specs/agent-runtime-provider-and-model-routing.md`](./agent-runtime-provider-and-model-routing.md) · [`specs/agent-execution-policy-hardening.md`](./agent-execution-policy-hardening.md) - Workflows: [`setup/workflows/agent-cli-provisioning.yml`](../setup/workflows/agent-cli-provisioning.yml) · [`.github/workflows/setup_platform_smoke.yml`](../.github/workflows/setup_platform_smoke.yml) · [`.github/workflows/copilot_commit.yml`](../.github/workflows/copilot_commit.yml) · [`.github/workflows/copilot_issue.yml`](../.github/workflows/copilot_issue.yml) · [`.github/workflows/copilot_pull_request.yml`](../.github/workflows/copilot_pull_request.yml) · [`.github/workflows/copilot_issue_comment.yml`](../.github/workflows/copilot_issue_comment.yml) · [`.github/workflows/copilot_pull_request_comment.yml`](../.github/workflows/copilot_pull_request_comment.yml) · [`.github/workflows/copilot_pull_request_review_state.yml`](../.github/workflows/copilot_pull_request_review_state.yml) · [`.github/workflows/copilot_close_inactive_issues.yml`](../.github/workflows/copilot_close_inactive_issues.yml) · [`.github/workflows/copilot_runner_diagnostics.yml`](../.github/workflows/copilot_runner_diagnostics.yml) - Entrypoints: [`src/actions/agent_configuration_builder.ts`](../src/actions/agent_configuration_builder.ts) · [`src/actions/github_action_runtime.ts`](../src/actions/github_action_runtime.ts) -- Core code: [`src/domain/agent.ts`](../src/domain/agent.ts) · [`src/domain/agent_execution_plan.ts`](../src/domain/agent_execution_plan.ts) · [`src/application/policies/agent_executable_policy.ts`](../src/application/policies/agent_executable_policy.ts) · [`src/application/policies/agent_task_activation_policy.ts`](../src/application/policies/agent_task_activation_policy.ts) · [`src/application/policies/agent_configuration_validation_policy.ts`](../src/application/policies/agent_configuration_validation_policy.ts) · [`src/application/policies/setup_configuration_plan.ts`](../src/application/policies/setup_configuration_plan.ts) · [`src/application/policies/agent_execution/agent_execution_policy_dispatcher.ts`](../src/application/policies/agent_execution/agent_execution_policy_dispatcher.ts) · [`src/application/policies/agent_execution/codex_execution_plan_policy.ts`](../src/application/policies/agent_execution/codex_execution_plan_policy.ts) · [`src/application/policies/agent_execution/codex_output_schema_policy.ts`](../src/application/policies/agent_execution/codex_output_schema_policy.ts) · [`src/application/policies/agent_execution/strict_output_schema_policy.ts`](../src/application/policies/agent_execution/strict_output_schema_policy.ts) · [`src/application/policies/agent_response_schemas.ts`](../src/application/policies/agent_response_schemas.ts) · [`src/application/usecases/actions/progress_response.ts`](../src/application/usecases/actions/progress_response.ts) · [`src/application/ports/agent_execution_observation_ports.ts`](../src/application/ports/agent_execution_observation_ports.ts) · [`src/infrastructure/agents/agent_execution_planner.ts`](../src/infrastructure/agents/agent_execution_planner.ts) · [`src/infrastructure/agents/agent_executable_file.ts`](../src/infrastructure/agents/agent_executable_file.ts) · [`src/infrastructure/agents/agent_executable_invocation.ts`](../src/infrastructure/agents/agent_executable_invocation.ts) · [`src/infrastructure/agents/windows_runtime_acl.ts`](../src/infrastructure/agents/windows_runtime_acl.ts) · [`src/infrastructure/agents/windows_executable_acl_policy.ts`](../src/infrastructure/agents/windows_executable_acl_policy.ts) · [`src/infrastructure/agents/windows_executable_trust.cjs`](../src/infrastructure/agents/windows_executable_trust.cjs) · [`src/infrastructure/agents/windows_system_root.cjs`](../src/infrastructure/agents/windows_system_root.cjs) · [`src/infrastructure/agents/agent_trusted_system_tools.ts`](../src/infrastructure/agents/agent_trusted_system_tools.ts) · [`src/infrastructure/agents/agent_runtime_manifest.ts`](../src/infrastructure/agents/agent_runtime_manifest.ts) · [`src/infrastructure/agents/agent_official_installer.ts`](../src/infrastructure/agents/agent_official_installer.ts) · [`src/infrastructure/agents/agent_private_install_root.ts`](../src/infrastructure/agents/agent_private_install_root.ts) · [`src/infrastructure/agents/agent_official_version.ts`](../src/infrastructure/agents/agent_official_version.ts) · [`src/infrastructure/agents/agent-runtime-manifest.json`](../src/infrastructure/agents/agent-runtime-manifest.json) · [`src/data/repository/agent_cli_provisioner.ts`](../src/data/repository/agent_cli_provisioner.ts) · [`src/data/repository/agent_cli_exit_diagnostic.ts`](../src/data/repository/agent_cli_exit_diagnostic.ts) · [`src/data/repository/agent_cli_execution.ts`](../src/data/repository/agent_cli_execution.ts) · [`src/data/repository/agent_credential_policy.ts`](../src/data/repository/agent_credential_policy.ts) · [`scripts/verify-agent-clis.cjs`](../scripts/verify-agent-clis.cjs) · [`scripts/verify-windows-job-npm.cjs`](../scripts/verify-windows-job-npm.cjs) · [`scripts/smoke-test-npm-package.cjs`](../scripts/smoke-test-npm-package.cjs) · [`scripts/validate-workflow-contract.cjs`](../scripts/validate-workflow-contract.cjs) · [`src/application/policies/agent_execution_failure_policy.ts`](../src/application/policies/agent_execution_failure_policy.ts) · [`src/infrastructure/untrusted_command_environment.ts`](../src/infrastructure/untrusted_command_environment.ts) · [`scripts/diagnose-windows-powershell-startup.cjs`](../scripts/diagnose-windows-powershell-startup.cjs) · [`scripts/diagnose-windows-sandbox-prerequisites.cjs`](../scripts/diagnose-windows-sandbox-prerequisites.cjs) · [`src/infrastructure/logging/logger_agent_execution_observer_adapter.ts`](../src/infrastructure/logging/logger_agent_execution_observer_adapter.ts) · [`scripts/coverage-budgets.json`](../scripts/coverage-budgets.json) -- Tests: [`src/actions/__tests__/agent_configuration_builder.test.ts`](../src/actions/__tests__/agent_configuration_builder.test.ts) · [`src/actions/__tests__/github_action_runtime.test.ts`](../src/actions/__tests__/github_action_runtime.test.ts) · [`src/application/policies/__tests__/agent_executable_policy.test.ts`](../src/application/policies/__tests__/agent_executable_policy.test.ts) · [`src/application/policies/__tests__/agent_task_activation_policy.test.ts`](../src/application/policies/__tests__/agent_task_activation_policy.test.ts) · [`src/application/policies/__tests__/setup_configuration_policy.test.ts`](../src/application/policies/__tests__/setup_configuration_policy.test.ts) · [`src/data/repository/__tests__/agent_cli_client.test.ts`](../src/data/repository/__tests__/agent_cli_client.test.ts) · [`src/data/repository/__tests__/agent_cli_exit_diagnostic.test.ts`](../src/data/repository/__tests__/agent_cli_exit_diagnostic.test.ts) · [`src/data/repository/__tests__/agent_cli_provisioner.test.ts`](../src/data/repository/__tests__/agent_cli_provisioner.test.ts) · [`src/application/policies/__tests__/agent_execution_plan_policy.test.ts`](../src/application/policies/__tests__/agent_execution_plan_policy.test.ts) · [`src/application/policies/__tests__/codex_output_schema_policy.test.ts`](../src/application/policies/__tests__/codex_output_schema_policy.test.ts) · [`src/application/policies/__tests__/agent_response_schemas.test.ts`](../src/application/policies/__tests__/agent_response_schemas.test.ts) · [`src/application/policies/__tests__/strict_output_schema_policy.test.ts`](../src/application/policies/__tests__/strict_output_schema_policy.test.ts) · [`src/application/usecases/steps/commit/bugbot/__tests__/schema.test.ts`](../src/application/usecases/steps/commit/bugbot/__tests__/schema.test.ts) · [`src/infrastructure/agents/__tests__/agent_execution_planner.test.ts`](../src/infrastructure/agents/__tests__/agent_execution_planner.test.ts) · [`src/infrastructure/agents/__tests__/agent_executable_file.test.ts`](../src/infrastructure/agents/__tests__/agent_executable_file.test.ts) · [`src/infrastructure/agents/__tests__/agent_executable_invocation.test.ts`](../src/infrastructure/agents/__tests__/agent_executable_invocation.test.ts) · [`src/infrastructure/agents/__tests__/agent_windows_runtime.test.ts`](../src/infrastructure/agents/__tests__/agent_windows_runtime.test.ts) · [`src/infrastructure/agents/__tests__/windows_system_root.test.ts`](../src/infrastructure/agents/__tests__/windows_system_root.test.ts) · [`src/infrastructure/agents/__tests__/windows_executable_acl_policy.test.ts`](../src/infrastructure/agents/__tests__/windows_executable_acl_policy.test.ts) · [`src/infrastructure/agents/__tests__/agent_runtime_manifest.test.ts`](../src/infrastructure/agents/__tests__/agent_runtime_manifest.test.ts) · [`src/infrastructure/agents/__tests__/agent_official_installer.test.ts`](../src/infrastructure/agents/__tests__/agent_official_installer.test.ts) · [`src/infrastructure/agents/__tests__/agent_installer_recovery.test.ts`](../src/infrastructure/agents/__tests__/agent_installer_recovery.test.ts) · [`src/infrastructure/agents/__tests__/agent_official_version.test.ts`](../src/infrastructure/agents/__tests__/agent_official_version.test.ts) · [`src/tooling/__tests__/verify_agent_clis.test.ts`](../src/tooling/__tests__/verify_agent_clis.test.ts) · [`src/tooling/__tests__/validate_workflow_contract.test.ts`](../src/tooling/__tests__/validate_workflow_contract.test.ts) · [`src/data/repository/ai/__tests__/agent_capability_adapters.test.ts`](../src/data/repository/ai/__tests__/agent_capability_adapters.test.ts) · [`src/infrastructure/__tests__/untrusted_command_environment.test.ts`](../src/infrastructure/__tests__/untrusted_command_environment.test.ts) · [`src/infrastructure/agents/__tests__/windows_acl_probe_contract.test.ts`](../src/infrastructure/agents/__tests__/windows_acl_probe_contract.test.ts) · [`src/infrastructure/logging/__tests__/logger_agent_execution_observer_adapter.test.ts`](../src/infrastructure/logging/__tests__/logger_agent_execution_observer_adapter.test.ts) +- Core code: [`src/domain/agent.ts`](../src/domain/agent.ts) · [`src/domain/agent_execution_plan.ts`](../src/domain/agent_execution_plan.ts) · [`src/application/policies/agent_executable_policy.ts`](../src/application/policies/agent_executable_policy.ts) · [`src/application/policies/agent_task_activation_policy.ts`](../src/application/policies/agent_task_activation_policy.ts) · [`src/application/policies/agent_configuration_validation_policy.ts`](../src/application/policies/agent_configuration_validation_policy.ts) · [`src/application/policies/setup_configuration_plan.ts`](../src/application/policies/setup_configuration_plan.ts) · [`src/application/policies/agent_execution/agent_execution_policy_dispatcher.ts`](../src/application/policies/agent_execution/agent_execution_policy_dispatcher.ts) · [`src/application/policies/agent_execution/codex_execution_plan_policy.ts`](../src/application/policies/agent_execution/codex_execution_plan_policy.ts) · [`src/application/policies/agent_execution/codex_output_schema_policy.ts`](../src/application/policies/agent_execution/codex_output_schema_policy.ts) · [`src/application/policies/agent_execution/strict_output_schema_policy.ts`](../src/application/policies/agent_execution/strict_output_schema_policy.ts) · [`src/application/policies/agent_response_schemas.ts`](../src/application/policies/agent_response_schemas.ts) · [`src/application/usecases/actions/progress_response.ts`](../src/application/usecases/actions/progress_response.ts) · [`src/application/ports/agent_execution_observation_ports.ts`](../src/application/ports/agent_execution_observation_ports.ts) · [`src/infrastructure/agents/agent_execution_planner.ts`](../src/infrastructure/agents/agent_execution_planner.ts) · [`src/infrastructure/agents/agent_executable_file.ts`](../src/infrastructure/agents/agent_executable_file.ts) · [`src/infrastructure/agents/agent_executable_invocation.ts`](../src/infrastructure/agents/agent_executable_invocation.ts) · [`src/infrastructure/agents/windows_runtime_acl.ts`](../src/infrastructure/agents/windows_runtime_acl.ts) · [`src/infrastructure/agents/windows_executable_acl_policy.ts`](../src/infrastructure/agents/windows_executable_acl_policy.ts) · [`src/infrastructure/agents/windows_executable_trust.cjs`](../src/infrastructure/agents/windows_executable_trust.cjs) · [`src/infrastructure/agents/windows_system_root.cjs`](../src/infrastructure/agents/windows_system_root.cjs) · [`src/infrastructure/agents/agent_trusted_system_tools.ts`](../src/infrastructure/agents/agent_trusted_system_tools.ts) · [`src/infrastructure/agents/agent_runtime_manifest.ts`](../src/infrastructure/agents/agent_runtime_manifest.ts) · [`src/infrastructure/agents/agent_official_installer.ts`](../src/infrastructure/agents/agent_official_installer.ts) · [`src/infrastructure/agents/agent_private_install_root.ts`](../src/infrastructure/agents/agent_private_install_root.ts) · [`src/infrastructure/agents/agent_official_version.ts`](../src/infrastructure/agents/agent_official_version.ts) · [`src/infrastructure/agents/agent-runtime-manifest.json`](../src/infrastructure/agents/agent-runtime-manifest.json) · [`src/data/repository/agent_cli_provisioner.ts`](../src/data/repository/agent_cli_provisioner.ts) · [`src/data/repository/agent_cli_exit_diagnostic.ts`](../src/data/repository/agent_cli_exit_diagnostic.ts) · [`src/data/repository/agent_cli_execution.ts`](../src/data/repository/agent_cli_execution.ts) · [`src/data/repository/agent_credential_policy.ts`](../src/data/repository/agent_credential_policy.ts) · [`scripts/verify-agent-clis.cjs`](../scripts/verify-agent-clis.cjs) · [`scripts/verify-windows-job-npm.cjs`](../scripts/verify-windows-job-npm.cjs) · [`scripts/smoke-test-npm-package.cjs`](../scripts/smoke-test-npm-package.cjs) · [`scripts/validate-workflow-contract.cjs`](../scripts/validate-workflow-contract.cjs) · [`src/application/policies/agent_execution_failure_policy.ts`](../src/application/policies/agent_execution_failure_policy.ts) · [`src/infrastructure/untrusted_command_environment.ts`](../src/infrastructure/untrusted_command_environment.ts) · [`scripts/diagnose-windows-powershell-startup.cjs`](../scripts/diagnose-windows-powershell-startup.cjs) · [`scripts/diagnose-windows-sandbox-prerequisites.cjs`](../scripts/diagnose-windows-sandbox-prerequisites.cjs) · [`src/infrastructure/logging/logger_agent_execution_observer_adapter.ts`](../src/infrastructure/logging/logger_agent_execution_observer_adapter.ts) · [`scripts/coverage-budgets.json`](../scripts/coverage-budgets.json) · [`src/infrastructure/private_jvm_environment.ts`](../src/infrastructure/private_jvm_environment.ts) +- Tests: [`src/actions/__tests__/agent_configuration_builder.test.ts`](../src/actions/__tests__/agent_configuration_builder.test.ts) · [`src/actions/__tests__/github_action_runtime.test.ts`](../src/actions/__tests__/github_action_runtime.test.ts) · [`src/application/policies/__tests__/agent_executable_policy.test.ts`](../src/application/policies/__tests__/agent_executable_policy.test.ts) · [`src/application/policies/__tests__/agent_task_activation_policy.test.ts`](../src/application/policies/__tests__/agent_task_activation_policy.test.ts) · [`src/application/policies/__tests__/setup_configuration_policy.test.ts`](../src/application/policies/__tests__/setup_configuration_policy.test.ts) · [`src/data/repository/__tests__/agent_cli_client.test.ts`](../src/data/repository/__tests__/agent_cli_client.test.ts) · [`src/data/repository/__tests__/agent_cli_exit_diagnostic.test.ts`](../src/data/repository/__tests__/agent_cli_exit_diagnostic.test.ts) · [`src/data/repository/__tests__/agent_cli_provisioner.test.ts`](../src/data/repository/__tests__/agent_cli_provisioner.test.ts) · [`src/application/policies/__tests__/agent_execution_plan_policy.test.ts`](../src/application/policies/__tests__/agent_execution_plan_policy.test.ts) · [`src/application/policies/__tests__/codex_output_schema_policy.test.ts`](../src/application/policies/__tests__/codex_output_schema_policy.test.ts) · [`src/application/policies/__tests__/agent_response_schemas.test.ts`](../src/application/policies/__tests__/agent_response_schemas.test.ts) · [`src/application/policies/__tests__/strict_output_schema_policy.test.ts`](../src/application/policies/__tests__/strict_output_schema_policy.test.ts) · [`src/application/usecases/steps/commit/bugbot/__tests__/schema.test.ts`](../src/application/usecases/steps/commit/bugbot/__tests__/schema.test.ts) · [`src/infrastructure/agents/__tests__/agent_execution_planner.test.ts`](../src/infrastructure/agents/__tests__/agent_execution_planner.test.ts) · [`src/infrastructure/agents/__tests__/agent_executable_file.test.ts`](../src/infrastructure/agents/__tests__/agent_executable_file.test.ts) · [`src/infrastructure/agents/__tests__/agent_executable_invocation.test.ts`](../src/infrastructure/agents/__tests__/agent_executable_invocation.test.ts) · [`src/infrastructure/agents/__tests__/agent_windows_runtime.test.ts`](../src/infrastructure/agents/__tests__/agent_windows_runtime.test.ts) · [`src/infrastructure/agents/__tests__/windows_system_root.test.ts`](../src/infrastructure/agents/__tests__/windows_system_root.test.ts) · [`src/infrastructure/agents/__tests__/windows_executable_acl_policy.test.ts`](../src/infrastructure/agents/__tests__/windows_executable_acl_policy.test.ts) · [`src/infrastructure/agents/__tests__/agent_runtime_manifest.test.ts`](../src/infrastructure/agents/__tests__/agent_runtime_manifest.test.ts) · [`src/infrastructure/agents/__tests__/agent_official_installer.test.ts`](../src/infrastructure/agents/__tests__/agent_official_installer.test.ts) · [`src/infrastructure/agents/__tests__/agent_installer_recovery.test.ts`](../src/infrastructure/agents/__tests__/agent_installer_recovery.test.ts) · [`src/infrastructure/agents/__tests__/agent_official_version.test.ts`](../src/infrastructure/agents/__tests__/agent_official_version.test.ts) · [`src/tooling/__tests__/verify_agent_clis.test.ts`](../src/tooling/__tests__/verify_agent_clis.test.ts) · [`src/tooling/__tests__/validate_workflow_contract.test.ts`](../src/tooling/__tests__/validate_workflow_contract.test.ts) · [`src/data/repository/ai/__tests__/agent_capability_adapters.test.ts`](../src/data/repository/ai/__tests__/agent_capability_adapters.test.ts) · [`src/infrastructure/__tests__/untrusted_command_environment.test.ts`](../src/infrastructure/__tests__/untrusted_command_environment.test.ts) · [`src/infrastructure/agents/__tests__/windows_acl_probe_contract.test.ts`](../src/infrastructure/agents/__tests__/windows_acl_probe_contract.test.ts) · [`src/infrastructure/logging/__tests__/logger_agent_execution_observer_adapter.test.ts`](../src/infrastructure/logging/__tests__/logger_agent_execution_observer_adapter.test.ts) · [`src/infrastructure/__tests__/private_jvm_environment.test.ts`](../src/infrastructure/__tests__/private_jvm_environment.test.ts) - User documentation: [`docs/configuration-checklist.mdx`](../docs/configuration-checklist.mdx) · [`docs/agents/cli-configuration.mdx`](../docs/agents/cli-configuration.mdx) · [`docs/agents/codex-openai.mdx`](../docs/agents/codex-openai.mdx) · [`docs/agents/cursor.mdx`](../docs/agents/cursor.mdx) · [`docs/agents/execution-contract.mdx`](../docs/agents/execution-contract.mdx) · [`docs/agents/runtime-selection.mdx`](../docs/agents/runtime-selection.mdx) · [`docs/agents/model-selection.mdx`](../docs/agents/model-selection.mdx) · [`docs/agents/model-allowlists.mdx`](../docs/agents/model-allowlists.mdx) · [`docs/agents/failure-policy.mdx`](../docs/agents/failure-policy.mdx) · [`docs/agents/input-reference.mdx`](../docs/agents/input-reference.mdx) · [`docs/agents/opencode.mdx`](../docs/agents/opencode.mdx) · [`docs/security-operations/operations/cli-runners.mdx`](../docs/security-operations/operations/cli-runners.mdx) · [`docs/security-operations/operations/cli-provisioning.mdx`](../docs/security-operations/operations/cli-provisioning.mdx) · [`docs/security-operations/operations/provisioning.mdx`](../docs/security-operations/operations/provisioning.mdx) · [`docs/security-operations/operations/version-pinning.mdx`](../docs/security-operations/operations/version-pinning.mdx) · [`docs/security-operations/security/self-hosted-runners.mdx`](../docs/security-operations/security/self-hosted-runners.mdx) · [`docs/security-operations/operations/upgrade-rollback.mdx`](../docs/security-operations/operations/upgrade-rollback.mdx) · [`docs/security-operations/operations/smoke-tests.mdx`](../docs/security-operations/operations/smoke-tests.mdx) · [`docs/development/testing.mdx`](../docs/development/testing.mdx) ### `cli-and-single-actions` — CLI and single-action execution diff --git a/specs/agent-execution-policy-hardening.md b/specs/agent-execution-policy-hardening.md index 0c280caed..6ac95926e 100644 --- a/specs/agent-execution-policy-hardening.md +++ b/specs/agent-execution-policy-hardening.md @@ -805,6 +805,15 @@ Run `38270745319` completed full macOS and Ubuntu verification, but Windows was 2026-10-12 retirement above. General hosted three-platform coverage remains required; new Codex integration runs target macOS and Ubuntu only. +### Private repository JVM/Gradle discovery — issue #775 + +The [verification runtime amendment](./repository-verification-runtime-prerequisites.md#21-private-jvm-and-gradle-discovery--issue-775-2026-10-29) +owns private JVM user.home and Gradle user-home derivation for repository +verification, its additional test budget and actual Linux runtime/native +acceptance. These host-derived values do not admit inherited tool options or +change provider credential environments. No universal Java prerequisite, +verification bypass or new caller configuration is introduced. + ### Complete manual fixture selection (2026-10-13) Dogfooding issue [#496](https://github.com/vypdev/copilot/issues/496) found that diff --git a/specs/catalog.json b/specs/catalog.json index fe3d07370..ab7bf6d02 100644 --- a/specs/catalog.json +++ b/specs/catalog.json @@ -934,7 +934,7 @@ "status": "implemented", "scope": "Plan, validate, provision, and audit a repository installation without exposing credentials", "owner": "Copilot maintainers", - "lastVerified": "2026-10-24", + "lastVerified": "2026-10-29", "specs": [ "specs/setup-configuration-credentials-and-doctor.md", "specs/setup-doctor-architecture-hardening.md", @@ -1126,7 +1126,8 @@ "src/application/usecases/steps/commit/bugbot/verify_command_runner.ts", "src/cli/setup_config_file.ts", "src/domain/copilot_comment_workflow.ts", - "src/infrastructure/copilot_comment_inputs.json" + "src/infrastructure/copilot_comment_inputs.json", + "src/infrastructure/private_jvm_environment.ts" ], "tests": [ "src/data/repository/__tests__/repository_version_tags_query_repository.test.ts", @@ -1259,7 +1260,8 @@ "src/tooling/__tests__/verification_runtime_guidance.test.ts", "src/infrastructure/__tests__/verification_setup_configuration.test.ts", "src/domain/__tests__/copilot_comment_workflow.test.ts", - "src/tooling/__tests__/credential_health_transport.test.ts" + "src/tooling/__tests__/credential_health_transport.test.ts", + "src/infrastructure/__tests__/private_jvm_environment.test.ts" ], "documentation": [ "README.md", @@ -2192,7 +2194,7 @@ "status": "implemented", "scope": "Observe parent drift with one localized status card and transition-only notifications, then safely merge a parent branch into a linked working branch", "owner": "Copilot maintainers", - "lastVerified": "2026-10-27", + "lastVerified": "2026-10-29", "specs": [ "specs/branch-synchronization-and-conflict-recovery.md", "specs/repository-verification-runtime-prerequisites.md", @@ -2279,7 +2281,11 @@ "src/application/policies/source_verification_dependency_policy.ts", "src/infrastructure/source_verification_dependencies.ts", "src/application/policies/branch_sync_relationship_retirement_policy.ts", - "src/application/usecases/actions/retire_unrelated_branch_sync_cards.ts" + "src/application/usecases/actions/retire_unrelated_branch_sync_cards.ts", + "src/infrastructure/private_jvm_environment.ts", + "src/tooling/__tests__/fixtures/verification_jvm_gradle_probe.cjs", + "src/tooling/__tests__/fixtures/verification_jvm_gradle_container_fixture.ts", + "src/tooling/__tests__/fixtures/verification_native_fixture.ts" ], "tests": [ "src/application/policies/__tests__/branch_sync_notification_policy.test.ts", @@ -2331,7 +2337,8 @@ "src/domain/__tests__/copilot_comment_workflow.test.ts", "src/domain/__tests__/verification_failure.test.ts", "src/infrastructure/__tests__/source_verification_dependencies.test.ts", - "src/application/usecases/actions/__tests__/retire_unrelated_branch_sync_cards.test.ts" + "src/application/usecases/actions/__tests__/retire_unrelated_branch_sync_cards.test.ts", + "src/infrastructure/__tests__/private_jvm_environment.test.ts" ], "documentation": [ "docs/issues/branch-synchronization.mdx", @@ -2447,7 +2454,7 @@ "status": "implemented", "scope": "Resolve, provision, authenticate, authorize, and execute only the agent roles reachable by a run", "owner": "Copilot maintainers", - "lastVerified": "2026-10-24", + "lastVerified": "2026-10-29", "specs": [ "specs/agent-runtime-provider-and-model-routing.md", "specs/agent-execution-policy-hardening.md" @@ -2508,7 +2515,8 @@ "scripts/diagnose-windows-powershell-startup.cjs", "scripts/diagnose-windows-sandbox-prerequisites.cjs", "src/infrastructure/logging/logger_agent_execution_observer_adapter.ts", - "scripts/coverage-budgets.json" + "scripts/coverage-budgets.json", + "src/infrastructure/private_jvm_environment.ts" ], "tests": [ "src/actions/__tests__/agent_configuration_builder.test.ts", @@ -2539,7 +2547,8 @@ "src/data/repository/ai/__tests__/agent_capability_adapters.test.ts", "src/infrastructure/__tests__/untrusted_command_environment.test.ts", "src/infrastructure/agents/__tests__/windows_acl_probe_contract.test.ts", - "src/infrastructure/logging/__tests__/logger_agent_execution_observer_adapter.test.ts" + "src/infrastructure/logging/__tests__/logger_agent_execution_observer_adapter.test.ts", + "src/infrastructure/__tests__/private_jvm_environment.test.ts" ], "documentation": [ "docs/configuration-checklist.mdx", diff --git a/specs/repository-verification-runtime-prerequisites.md b/specs/repository-verification-runtime-prerequisites.md index c766ae01d..6c9aeecf8 100644 --- a/specs/repository-verification-runtime-prerequisites.md +++ b/specs/repository-verification-runtime-prerequisites.md @@ -199,10 +199,13 @@ irreversible partial success because preflight runs before commit/push. ## 11. Security, permissions, and privacy -Preserve only JAVA_HOME as additional runtime metadata; PATH remains allowlisted. -JAVA_TOOL_OPTIONS, JDK_JAVA_OPTIONS, NODE_OPTIONS, MAVEN_OPTS, GRADLE_USER_HOME, -credentials and auth-store references remain stripped. HOME/temp/profile paths stay -private. Build tools must not depend on inherited user-home credentials/settings. +Preserve JAVA_HOME as additional runtime metadata; PATH remains allowlisted. +Inherited JAVA_TOOL_OPTIONS, JDK_JAVA_OPTIONS, NODE_OPTIONS, MAVEN_OPTS, +GRADLE_USER_HOME, credentials and auth-store references remain stripped. +The issue #775 amendment below derives fresh JDK_JAVA_OPTIONS and +GRADLE_USER_HOME from the private verification profile; it never admits the +inherited values. HOME/temp/profile paths stay private. Build tools must not +depend on inherited user-home credentials/settings. Manifest reads reject symbolic/hard links, unsafe parents, oversized and changed file identities with bounded reads. Device/inode identities MUST use exact 64-bit comparisons (BigInt), including values beyond JavaScript number precision. This is not a sandbox against a concurrently @@ -326,3 +329,189 @@ The [repository-owned setup contract](./repository-verification-setup-hooks.md) ### Source candidate dependency correction — #746 The [source candidate readiness amendment](./branch-synchronization-and-conflict-recovery.md#candidate-dependency-readiness-and-failure-facts--746-2026-10-27) owns the incremental source-only frozen-pnpm preparation and closed sync failure facts. Source runtime bootstrap remains before the Action; source dependencies move to each actual candidate verifier boundary after optional native setup and runtime probes. Consumer setup opt-in, runtime-only declarations and generic no-installer behavior remain unchanged. The amendment owns its incremental test budget and separately authorized default-runtime rollout; do not double count it here. + +## 21. Private JVM and Gradle discovery — issue #775 (2026-10-29) + +### Decision, evidence and boundaries + +Status: implementation contract. Owner: Copilot maintainers. Review gates: +runtime security, native workflow compatibility, architecture, testing and +operator documentation. No material design decision remains open. + +[Issue #775](https://github.com/vypdev/copilot/issues/775) reports an actual +macOS/JDK 17 observation: changing HOME alone leaves Java user.home at the OS +account home. A successful Gradle run with up-to-date tasks and a global init +message does not prove private discovery or freshly executed tests. No consumer +native continuation was activated by that report. + +A separate Linux/aarch64 exploration with the official Gradle 9.8.2/JDK 17 +image, pinned to digest +`sha256:2ec771e6a429a3aca72d38aca70a4ea05b41bf4098e4e22868b425a215fa4d0f`, +reproduces the gap using only a disposable account's harmless init/properties +sentinels. Explicit derived-variable controls isolate discovery and preserve +the candidate bytes. Eight additional JDK launcher experiments preserve exact +synthetic property values containing spaces, quotes and Windows-style +backslashes. These are exploration controls, not a completed production/native +acceptance claim. + +Primary contracts: [JDK 17 launcher/JDK_JAVA_OPTIONS](https://docs.oracle.com/en/java/javase/17/docs/specs/man/java.html), +[Gradle user home](https://docs.gradle.org/current/userguide/directory_layout.html), +[initialization scripts](https://docs.gradle.org/current/userguide/init_scripts.html) +and [build environment](https://docs.gradle.org/current/userguide/build_environment.html). +Their discovery rules motivate explicit private locations; they do not establish +an OS sandbox. Gradle distribution-level initialization, deliberate candidate +overrides, concurrent same-user access and project verification failures retain +their existing trust boundaries. No wrapper rewrite, skipped command, +credential grant, universal Java installer or new configuration input is added. + +### Required behavior and architecture + +```text +Admitted verification -> fresh private profile -> derive JVM/Gradle locations + -> optional native setup -> fixed runtime probes -> configured command + -> existing workspace/head/publication guards -> owned post cleanup +``` + +Text equivalent: each command receives a fresh profile and derived locations; +native setup and the verifier share that profile, and ordinary guards and +cleanup still decide publication. + +1. The infrastructure environment builder MUST derive exactly one JDK launcher + property assigning user.home to its canonical private HOME and an absolute + GRADLE_USER_HOME inside that same profile. Both apply with setup enabled or + disabled, before prerequisite probes and the configured command. +2. It MUST keep rejecting inherited tool-option injection, including arbitrary + JDK_JAVA_OPTIONS/GRADLE_USER_HOME. JAVA_TOOL_OPTIONS, _JAVA_OPTIONS, + GRADLE_OPTS, MAVEN_OPTS, NODE_OPTIONS, credentials and auth-store paths do not + become allowed inputs. Existing JAVA_HOME/PATH provisioning remains. +3. JVM option encoding MUST preserve the entire path as one property argument, + including whitespace, either quote and literal backslashes. It uses the JDK + launcher's own grammar, not shell or JSON escaping. NUL/CR/LF input is rejected + with a fixed diagnostic before execution; failure to prepare a profile MUST + clean the newly owned directory and withhold verification/publication. +4. Native pending outputs and canonical setup steps MUST forward only these two + host-derived values alongside existing runtime metadata. Setup-result parsing + remains closed to approved PATH/JAVA_HOME; consumer or ambient option values + MUST NOT replace the worker's derived values or be forwarded as Node + continuation controls. +5. Every later verification command MUST get a different private profile and + Gradle state. Cleanup includes the derived Gradle/JVM state and retains native + profiles until deferred posts finish. No shared readiness/cache authority or + durable configuration is introduced. + +The OS/process-specific encoder and environment builder belong to infrastructure; +they do not add filesystem/process dependencies to domain/application policies. +Existing Git execution ports, setup/session binding, prerequisite checks, +candidate/remote-head fences and localized result presenters remain owners. +Canonical workflow generation and structural mutation checks enforce the closed +native metadata boundary. Agent-provider environments are a separate contract. + +### Product journey, configuration and recovery + +| State | Existing primary surface and next action | +|---|---| +| Pending | Preparing repository verification; wait for native setup and probes | +| Action required | Declared Java unavailable: provision it in this job or review the trusted setup; retry the original operation | +| Blocked | Private profile/setup/probe failed: verification and publication withheld; inspect the linked run | +| Partial | Candidate prepared but verification failed: existing sync recovery and retained-state report remain authoritative | +| Complete | Configured checks passed in the private profile; existing publication guards decide the final result | +| Canceled/retried | Existing cancellation cleanup; a fresh admitted retry creates new state | + +Representative existing result: “Repository setup completed; runtime preflight +and verification may proceed.” Technical acceptance output MAY report only +booleans such as “JVM home is private: true” and “candidate unchanged: true”. It +MUST NOT copy account paths, real properties/init contents or credentials into +issues, summaries or evidence. There are no new comments, labels or operator UI; +existing localized text/fallback, plain-text status, descriptive run/docs links +and narrow/light/dark rendering stay authoritative. + +Recommended setup remains explicit same-job Java 17 provisioning (or a reviewed +native composite), with verification commands unchanged. The supported +alternative is a non-JVM project with no Java declaration/installer. Derived +private locations have no caller override and no persistence across commands. +Upgrade the Action and its canonical coordinator/generated callbacks together +so native setup receives the derived fields. Consumer-owned setup assets remain +preserved. Older in-flight jobs retain their original snapshot; retry after the +upgrade. Rollback restores the old discovery limitation and does not migrate or +delete account caches. No automatic retry is added. + +### Risk-derived test budget and acceptance + +Allocate **32 additional distinct Jest cases** before source implementation: + +| Area | Minimum | Risks | +|---|---:|---| +| JVM argument grammar | 12 | spaces, both quotes, backslashes, Unicode, injection-like suffixes and forbidden controls | +| Profile/environment security | 8 | inherited injection excluded, canonical containment, unique profiles, owned cleanup and preparation failures | +| Native protocol/continuation | 6 | derived outputs, malformed fields, foreign values/replay and unchanged closed response | +| Workflow/setup structure | 4 | missing/changed derived bindings and option leakage into continuation | +| Git/prerequisite integration | 2 | same environment/order, failure withholding and legacy non-JVM behavior | +| **Total** | **32** | no repeated-run or existing-case double counting | + +New pure encoding targets 100% statements/branches/functions/lines. Changed +environment/native adapters retain at least 95% statements/lines and 90% +branches/functions. All global, module, setup, extension and benchmark budgets, +case selections and timeouts remain unchanged. Unit tests use deterministic +fixtures; normal Node tests gain no Java/Gradle prerequisite or silent skip. + +Additional required native observations, separate from the Jest case count: + +- Actual source-wired Linux JDK 17/Gradle execution in a disposable OS account + demonstrates the legacy global-sentinel gap and the corrected private JVM, + Gradle properties/init/cache discovery, without real user configuration. +- Actual Linux GitHub native setup provisions the tools, resumes the existing + operation, passes runtime preflight and executes offline Java compilation and + verification in the private profile. A Java home guard precedes Gradle startup + on hosted runners. A container is not claimed as native Actions emulation. +- Candidate source/action bytes remain unchanged, inherited injection stays + excluded, fresh profiles do not share state, and deferred native posts clean + the owned profiles. Existing failure/no-publication fences stay covered. + +| Requirement | Executable evidence | Documentation | +|---|---|---| +| Exact private property and Gradle location | Grammar/environment suites; real JDK/Gradle fixture | Verification environment/reference | +| Same native profile, closed continuation | Controller/generator mutation tests and native Linux job | Native setup and upgrade guidance | +| Failure, freshness and cleanup | Environment/Git integration and native post acceptance | Existing recovery and isolation limits | +| No account secrets or candidate mutation | Disposable sentinels, boolean-only reports and identity assertions | Security/operator trust boundary | + +Update this owner, native-setup companion, catalog evidence, verification and +agent/contributor guidance together; regenerate canonical workflows and catalog. +DoD requires the case floor, actual source/native observations, all unchanged +coverage/architecture/docs/workflow/spec/build/package checks, Graphify update, +normal hooks and exact-head CI/three-platform/Codecov/review without findings +before the authorized normal merge to develop. + +### Executed observations and bounded workflow representation + +The source-wired disposable Linux runs use the same pinned JDK 17/Gradle image, +candidate probe and actual GitCommitAdapter before and after the correction. +Each version completes two fresh compilations and JavaExec verifications with +unchanged source and excluded inherited injection. The baseline discovers the +disposable account's global sentinels; the corrected version discovers only the +private properties/init script and private JVM/Gradle homes. The corrected probe +also checks the actual JDK 17 specification version. No real account data is +mounted or inspected, and no consumer execution is claimed. + +All 42 additional distinct regression cases pass in the full current-source +run: 16 grammar, eight profile, ten protocol, six workflow and two Git cases. Encoding +and environment construction reach 100% on every metric. Native-controller +coverage is 95.39% statements, 97.68% lines, 90% branches and 100% functions; +the new per-module budgets enforce these floors without relying on an aggregate. + +Adding the native metadata exposed the existing 100,000-byte workflow review +limit: the first full run rejected the 101,210-byte smoke workflow, producing 40 +setup/CLI failures from that one cause. The workflow now shares 43 identical +native steps using GitHub-supported YAML anchors. Its 59,394-byte representation +parses to the exact same jobs, steps, inputs, conditions and permissions; all 233 +focused setup/CLI/workflow cases pass. The per-file/aggregate review limits, +runner routes, phase count and timeouts are unchanged. Required full and native +remote verification remain separate acceptance gates. + +After the workflow representation correction, the full current-source run passes +790 suites and 14,655 tests, with the same 35 existing skips, in 477.661 seconds. +Global coverage is 97.29% statements, 95% branches, 97.95% functions and 98.06% +lines. Every prior and new module budget passes. The setup ledger remains +336/350 passing with 14 explicitly open cases; no open case is represented as +implemented here. Extension verification passes all 267 cases with 100% on every +metric. Native GitHub Linux acceptance and final PR checks still require their +own successful exact-head evidence before merge. diff --git a/specs/repository-verification-setup-hooks.md b/specs/repository-verification-setup-hooks.md index 6fbb7e512..6c7c9420a 100644 --- a/specs/repository-verification-setup-hooks.md +++ b/specs/repository-verification-setup-hooks.md @@ -314,3 +314,14 @@ setup execution contract; no cross-job candidate transport is introduced. ### Source candidate dependency correction — #746 The [source candidate readiness amendment](./branch-synchronization-and-conflict-recovery.md#candidate-dependency-readiness-and-failure-facts--746-2026-10-27) owns the incremental source-only frozen-pnpm preparation and closed sync failure facts. Source runtime bootstrap remains before the Action; source dependencies move to each actual candidate verifier boundary after optional native setup and runtime probes. Consumer setup opt-in, runtime-only declarations and generic no-installer behavior remain unchanged. The amendment owns its incremental test budget and separately authorized default-runtime rollout; do not double count it here. + +### Derived JVM/Gradle discovery — issue #775 + +The [private discovery amendment](./repository-verification-runtime-prerequisites.md#21-private-jvm-and-gradle-discovery--issue-775-2026-10-29) +owns the additional 32-case budget and actual JVM/Gradle acceptance. Native +setup receives host-derived JDK_JAVA_OPTIONS and GRADLE_USER_HOME for the current +private profile. They are output metadata, not new caller inputs or accepted +setup-result overrides; the response remains approved PATH/JAVA_HOME only. +Canonical setup bindings carry them, while Node continuation and provider-secret +boundaries remain unchanged. Each subsequent command uses a new private profile; +existing candidate/session/publication guards and post cleanup still apply. diff --git a/src/application/policies/repository_agent_guidance_policy.ts b/src/application/policies/repository_agent_guidance_policy.ts index 34f3bd2d8..9b2b14e1f 100644 --- a/src/application/policies/repository_agent_guidance_policy.ts +++ b/src/application/policies/repository_agent_guidance_policy.ts @@ -200,7 +200,7 @@ Never expose credentials, tokens, private keys, or other secrets in issues, comm The setup runner profile selects placement; it does not install the project's language runtimes. An operator must provision the project's required runtimes and dependencies in every job that runs file-changing or branch-sync verification, before the Copilot step. A separate application CI job does not prepare this job. -Declare reviewed version prefixes in \`.copilot/verification-prerequisites.json\` (schemaVersion 1, runtimes such as java 17, node 24, pnpm 10). Copilot checks declared versions in the credential-free verification environment before each configured verification command; a missing or incompatible runtime blocks publication. Without this optional declaration, existing verification behavior remains and no language is inferred. Java provisioning may use \`actions/setup-java\`; \`JAVA_HOME\` and \`PATH\` survive isolation, while agent credentials and tool-option injection variables do not. Do not add an unreviewed bootstrap or weaken verification to work around a missing runtime. Read [verification prerequisites and same-job setup](https://docs.page/vypdev/copilot/security-operations/operations/verification#repository-verification-prerequisites). +Declare reviewed version prefixes in \`.copilot/verification-prerequisites.json\` (schemaVersion 1, runtimes such as java 17, node 24, pnpm 10). Copilot checks declared versions in the credential-free verification environment before each configured verification command; a missing or incompatible runtime blocks publication. Without this optional declaration, existing verification behavior remains and no language is inferred. Java provisioning may use \`actions/setup-java\`; \`JAVA_HOME\` and \`PATH\` survive isolation. Repository verification derives \`JDK_JAVA_OPTIONS\` for its private JVM user.home and \`GRADLE_USER_HOME\` inside the same fresh profile; inherited tool options, account caches and agent credentials remain excluded. Do not add an unreviewed bootstrap or weaken verification to work around a missing runtime. Read [verification prerequisites and same-job setup](https://docs.page/vypdev/copilot/security-operations/operations/verification#repository-verification-prerequisites). The optional repository-owned composite action prepares each candidate before verification. Setup creates .github/actions/copilot-verification-setup/action.yml only if missing and preserves an existing consumer action and its assets. The shared terminal/web assistant offers explicit activation, disabled by default. Customize the generated failing placeholder before enabling; setup generation and installer PRs do not prove runtime readiness. Review \`.github/actions/copilot-verification-setup/action.yml\` and its assets onto trusted main, update generated workflows, then enable \`VERIFICATION_SETUP=true\` (Action input \`verification-setup\`, disabled by default). GitHub Actions executes the trusted snapshot before each command with a fresh private HOME; candidate changes cannot replace it. Native post steps finish before profile cleanup. Setup failure blocks verification and commit/push. The local CLI cannot execute composite actions and fails closed when opted in. Read [repository-owned setup](https://docs.page/vypdev/copilot/security-operations/operations/verification#repository-owned-setup). diff --git a/src/infrastructure/__tests__/git_commit_adapter.test.ts b/src/infrastructure/__tests__/git_commit_adapter.test.ts index a7b6ee402..add2d0cd4 100644 --- a/src/infrastructure/__tests__/git_commit_adapter.test.ts +++ b/src/infrastructure/__tests__/git_commit_adapter.test.ts @@ -143,6 +143,42 @@ describe('GitCommitAdapter', () => { expect(fs.existsSync(home)).toBe(false); }); + it('retries a failed prerequisite in a fresh private JVM/Gradle profile before allowing one verifier', async () => { + const environments: Record[] = []; + const execute = jest.fn(async (_program, _args, options) => { + expect(options.env).toBe(environments[1]); + expect(options.env.GRADLE_USER_HOME).toBe(path.join(options.env.HOME, '.gradle')); + return 0; + }); + const check = (environment: Record): void => { + environments.push(environment); + expect(environment.JDK_JAVA_OPTIONS).toMatch(/^-Duser\.home=/u); + if (environments.length === 1) throw new Error('fixture-prerequisite-blocked'); + }; + const adapter = new GitCommitAdapter(execute, check, undefined, async () => {}); + await expect(adapter.execute('node', ['verification.js'], { untrusted: true, verifyRuntimePrerequisites: true })).rejects.toThrow('fixture-prerequisite-blocked'); + expect(execute).not.toHaveBeenCalled(); + expect(fs.existsSync(environments[0].HOME)).toBe(false); + await adapter.execute('node', ['verification.js'], { untrusted: true, verifyRuntimePrerequisites: true }); + expect(environments[1].HOME).not.toBe(environments[0].HOME); + expect(environments[1].GRADLE_USER_HOME).not.toBe(environments[0].GRADLE_USER_HOME); + expect(environments.every(environment => !fs.existsSync(environment.HOME))).toBe(true); + expect(execute).toHaveBeenCalledTimes(1); + }); + it('keeps non-JVM verification available without adding a Java prerequisite', async () => { + let home = ''; + const check = jest.fn(() => { throw new Error('must-not-probe'); }); + const execute = jest.fn(async (_program, _args, options) => { + home = options.env.HOME; + expect(options.env.GRADLE_USER_HOME).toBe(path.join(home, '.gradle')); + expect(options.env.JDK_JAVA_OPTIONS).toMatch(/^-Duser\.home=/u); + return 0; + }); + await new GitCommitAdapter(execute, check).execute('node', ['verification.js'], { untrusted: true }); + expect(check).not.toHaveBeenCalled(); + expect(execute).toHaveBeenCalledTimes(1); + expect(fs.existsSync(home)).toBe(false); + }); it('rejects preflight outside isolation and does not probe during ordinary trusted git or hook-isolated commits', async () => { const execute = jest.fn().mockResolvedValue(0); const check = jest.fn(); diff --git a/src/infrastructure/__tests__/native_verification_controller.test.ts b/src/infrastructure/__tests__/native_verification_controller.test.ts index fa35164ec..798cdc495 100644 --- a/src/infrastructure/__tests__/native_verification_controller.test.ts +++ b/src/infrastructure/__tests__/native_verification_controller.test.ts @@ -29,9 +29,27 @@ describe('native Actions phase controller', () => { expect(core.setOutput).toHaveBeenCalledWith('verification-request', f.id); expect(core.setOutput).toHaveBeenCalledWith('verification-home', f.runtime.environment.HOME); }); - it.each([{id: 'wrong'}, {sourceSha: 'wrong'}, {environment: {}}, {environment: {HOME: '\nsecret'}}])('rejects malformed pending request %j', async edit => { + it.each(['JDK_JAVA_OPTIONS', 'GRADLE_USER_HOME'])('emits the current profile-derived %s for native setup', async key => { + request(); await awaitNativeBoundary(f.session); + expect(core.setOutput).toHaveBeenCalledWith(`verification-${key.toLowerCase()}`, f.runtime.environment[key]); + }); + it.each(['JDK_JAVA_OPTIONS', 'GRADLE_USER_HOME'].flatMap(key => ['missing', 'foreign'].map(kind => [key, kind])))( + 'rejects %s %s before emitting any native metadata', async (key, kind) => { + const environment = { ...f.runtime.environment }; + if (kind === 'missing') delete environment[key]; + else environment[key] = '/foreign/unapproved'; + request({ environment }); + await expect(awaitNativeBoundary(f.session)).rejects.toThrow('handoff-invalid'); + expect(core.setOutput).not.toHaveBeenCalled(); + }); + it.each([{id: 'wrong'}, {sourceSha: 'wrong'}, {environment: {}}, {environment: {HOME: '\nsecret'}}, {environment: {HOME: 'relative'}}])('rejects malformed pending request %j', async edit => { request(edit); await expect(awaitNativeBoundary(f.session)).rejects.toThrow('handoff-invalid'); }); + it.each([7, 'invalid\nruntime-metadata'])('rejects malformed ordinary runtime metadata %j after validating the private locations', async value => { + request({ environment: { ...f.runtime.environment, PATH: value } }); + await expect(awaitNativeBoundary(f.session)).rejects.toThrow('handoff-invalid'); + expect(core.setOutput).not.toHaveBeenCalledWith('verification-path', value); + }); it('reports completion and copies native action outputs into the current step', async () => { process.env.GITHUB_OUTPUT = join(f.session, 'parent-output'); fs.writeFileSync(join(f.session, 'worker-output'), 'telemetry=value\n'); done(); await awaitNativeBoundary(f.session); @@ -53,6 +71,14 @@ describe('native Actions phase controller', () => { it('bounds the operation wait without restarting the agent', async () => { await expect(awaitNativeBoundary(f.session, 0)).rejects.toThrow('timeout'); }); + it('waits for a live worker before publishing the late request with its current private profile', async () => { + jest.spyOn(process, 'kill').mockReturnValue(true); + const pause = jest.spyOn(protocol, 'nativePause').mockImplementation(async () => { request(); }); + await awaitNativeBoundary(f.session); + expect(pause).toHaveBeenCalledWith(100); + expect(core.setOutput).toHaveBeenCalledWith('verification-gradle_user_home', f.runtime.environment.GRADLE_USER_HOME); + expect(core.setOutput).toHaveBeenCalledWith('verification-setup-pending', 'true'); + }); it('detects a worker that exited before a result or handoff', async () => { jest.spyOn(process, 'kill').mockImplementation(() => { throw new Error('not alive'); }); await expect(awaitNativeBoundary(f.session)).rejects.toThrow('process-failed'); @@ -75,7 +101,10 @@ describe('native Actions phase controller', () => { it.each(['success', 'failure', 'cancelled', 'skipped'])('delivers native %s and waits for the existing operation', async outcome => { request(); const write = protocol.writeNativeRecord; jest.spyOn(protocol, 'writeNativeRecord').mockImplementation((root, name, value) => { write(root, name, value); if (name.startsWith('response-')) write(root, 'done.json', { exitCode: 0 }); }); - await continueNativeVerification(f.session, f.id, outcome, { PATH: 'approved', JAVA_HOME: 'java' }); + await continueNativeVerification(f.session, f.id, outcome, { + PATH: 'approved', JAVA_HOME: 'java', + JDK_JAVA_OPTIONS: '-Duser.home=/foreign', GRADLE_USER_HOME: '/foreign/gradle', + }); expect(protocol.readNativeRecord(f.session, `response-${f.id}.json`)).toEqual({ id: f.id, success: outcome === 'success', path: 'approved', javaHome: 'java' }); expect(fs.existsSync(join(f.session, 'request.json'))).toBe(false); }); diff --git a/src/infrastructure/__tests__/native_verification_workflow.test.ts b/src/infrastructure/__tests__/native_verification_workflow.test.ts index 2e2ccc87b..3bc123114 100644 --- a/src/infrastructure/__tests__/native_verification_workflow.test.ts +++ b/src/infrastructure/__tests__/native_verification_workflow.test.ts @@ -35,6 +35,20 @@ describe('encapsulated native verification workflow contract', () => { expect(workflow).toEqual(runtimeWorkflow()); expect(() => assertNativeVerificationWorkflow(file, workflow)).not.toThrow(); }); + it.each(['JDK_JAVA_OPTIONS', 'GRADLE_USER_HOME'].flatMap(key => ['missing', 'foreign'].map(kind => [key, kind])))( + 'rejects %s %s native profile binding', (key, kind) => { + const { file, workflow } = read('.github/workflows', RUNTIME); + const setup = workflow.jobs.copilot.steps.find((step: any) => step.id === 'verification_setup_1'); + if (kind === 'missing') delete setup.env[key]; + else setup.env[key] = '${{ env.UNREVIEWED_OPTIONS }}'; + expect(() => assertNativeVerificationWorkflow(file, workflow)).toThrow(/native/u); + }); + it.each(['JDK_JAVA_OPTIONS', 'GRADLE_USER_HOME'])('rejects forwarding setup-only %s as a Node continuation control', key => { + const { file, workflow } = read('.github/workflows', RUNTIME); + const continuation = workflow.jobs.copilot.steps.find((step: any) => step.id === 'verification_continue_1'); + continuation.env[key] = 'foreign-options'; + expect(() => assertNativeVerificationWorkflow(file, workflow)).toThrow(/native/u); + }); it.each(['.github/workflows', 'setup/workflows'])('accepts a reviewed group route in %s without changing other boundaries', directory => { const { file, workflow } = read(directory, 'copilot_issue_comment.yml'); const job = Object.values(workflow.jobs)[0] as any; @@ -67,7 +81,7 @@ describe('encapsulated native verification workflow contract', () => { expect(credentialSteps.map((step: any) => step.id)).toEqual(['copilot']); for (const step of job.steps.filter((step: any) => step.uses === './.git/copilot-verification-setup')) { expect(step.with).toBeUndefined(); - expect(Object.keys(step.env).sort()).toEqual(['HOME', 'USERPROFILE', 'APPDATA', 'LOCALAPPDATA', 'PATH', 'JAVA_HOME', 'TMP', 'TEMP', 'TMPDIR'].sort()); + expect(Object.keys(step.env).sort()).toEqual(['HOME', 'USERPROFILE', 'APPDATA', 'LOCALAPPDATA', 'PATH', 'JAVA_HOME', 'JDK_JAVA_OPTIONS', 'GRADLE_USER_HOME', 'TMP', 'TEMP', 'TMPDIR'].sort()); } }); it.each(['timeout', 'env', 'condition', 'reference', 'request', 'outcome', 'finish', 'extra', 'remove', 'prepare', 'initial-source', 'credential-scope'])( diff --git a/src/infrastructure/__tests__/private_jvm_environment.test.ts b/src/infrastructure/__tests__/private_jvm_environment.test.ts new file mode 100644 index 000000000..41952d2f4 --- /dev/null +++ b/src/infrastructure/__tests__/private_jvm_environment.test.ts @@ -0,0 +1,104 @@ +import fs from 'node:fs'; +import * as privateRoots from '../agents/agent_private_install_root'; +import { tmpdir } from 'node:os'; +import { existsSync, realpathSync } from 'node:fs'; +import { join } from 'node:path'; +import { prepareUntrustedCommandEnvironment } from '../untrusted_command_environment'; +import { privateJvmHomeOption } from '../private_jvm_environment'; + +describe('JDK launcher private property grammar', () => { + it.each([ + ['plain', '/tmp/plain', '-Duser.home=/tmp/plain'], + ['space', '/tmp/private profile', '-Duser.home=/tmp/private" "profile'], + ['single quote', "/tmp/with'single", "-Duser.home=/tmp/with\"'\"single"], + ['double quote', '/tmp/with"double', "-Duser.home=/tmp/with'\"'double"], + ['both quotes', '/tmp/a\'" b', '-Duser.home=/tmp/a' + "\"'\"" + "'\"'" + '" "b'], + ['tab', '/tmp/a\tb', '-Duser.home=/tmp/a"\t"b'], + ['form feed', '/tmp/a\fb', '-Duser.home=/tmp/a"\f"b'], + ['Unicode', '/tmp/ñ東京', '-Duser.home=/tmp/ñ東京'], + ['Windows separators', 'C:\\Users\\Fixture Name\\run', '-Duser.home=C:\\Users\\Fixture" "Name\\run'], + ['trailing separator', 'C:\\private dir\\', '-Duser.home=C:\\private" "dir\\'], + ['backslash beside quote', '/tmp/a\\"b', '-Duser.home=/tmp/a\\' + "'\"'" + 'b'], + ['option-like suffix', '/tmp/a -DcopilotInjectedFlag=yes', '-Duser.home=/tmp/a" "-DcopilotInjectedFlag=yes'], + ])('preserves %s as one property argument', (_name, home, expected) => { + expect(privateJvmHomeOption(home)).toBe(expected); + }); + it.each(['', '/tmp/a\0b', '/tmp/a\rb', '/tmp/a\nb'])('rejects an invalid home without disclosing it', home => { + expect(() => privateJvmHomeOption(home)).toThrow('Private JVM home is invalid.'); + }); +}); + +describe('private verification JVM and Gradle discovery', () => { + it.each(['linux', 'darwin', 'win32'])('derives current private locations on %s instead of inheriting tool options', platform => { + const runtime = prepareUntrustedCommandEnvironment({ + PATH: '/tools/bin', JAVA_HOME: '/tools/jdk17', + JDK_JAVA_OPTIONS: '-javaagent:/foreign/agent.jar -Duser.home=/foreign/account', + GRADLE_USER_HOME: '/foreign/gradle', JAVA_TOOL_OPTIONS: '-Dsecret=foreign', + _JAVA_OPTIONS: '-Dsecret=foreign', GRADLE_OPTS: '-Dsecret=foreign', + }, platform); + const home = runtime.environment.HOME; + try { + expect(home).toBe(realpathSync(home)); + expect(runtime.environment.GRADLE_USER_HOME).toBe(join(home, '.gradle')); + expect(existsSync(runtime.environment.GRADLE_USER_HOME)).toBe(true); + expect(runtime.environment.JDK_JAVA_OPTIONS).toEqual(expect.stringMatching(/^-Duser\.home=/u)); + expect(JSON.stringify(runtime.environment)).not.toContain('foreign'); + for (const key of ['JAVA_TOOL_OPTIONS', '_JAVA_OPTIONS', 'GRADLE_OPTS']) expect(runtime.environment).not.toHaveProperty(key); + } finally { runtime.cleanup(); } + expect(existsSync(home)).toBe(false); + }); + it('does not share Gradle caches between commands using the same source metadata', () => { + const source = { GRADLE_USER_HOME: '/foreign/gradle', JDK_JAVA_OPTIONS: '-Duser.home=/foreign' }; + const first = prepareUntrustedCommandEnvironment(source); + const second = prepareUntrustedCommandEnvironment(source); + try { + fs.writeFileSync(join(first.environment.GRADLE_USER_HOME, 'owned-cache'), 'first'); + expect(second.environment.HOME).not.toBe(first.environment.HOME); + expect(second.environment.GRADLE_USER_HOME).not.toBe(first.environment.GRADLE_USER_HOME); + expect(existsSync(join(second.environment.GRADLE_USER_HOME, 'owned-cache'))).toBe(false); + expect(second.environment.JDK_JAVA_OPTIONS).not.toBe(first.environment.JDK_JAVA_OPTIONS); + } finally { first.cleanup(); second.cleanup(); } + }); + it('derives values without mutating the frozen caller environment', () => { + const source = Object.freeze({ JDK_JAVA_OPTIONS: '-Dforeign=true', GRADLE_USER_HOME: '/foreign', JAVA_HOME: '/jdk17' }); + const runtime = prepareUntrustedCommandEnvironment(source); + try { + expect(source).toEqual({ JDK_JAVA_OPTIONS: '-Dforeign=true', GRADLE_USER_HOME: '/foreign', JAVA_HOME: '/jdk17' }); + expect(runtime.environment.JAVA_HOME).toBe('/jdk17'); + expect(runtime.environment.JDK_JAVA_OPTIONS).not.toContain('foreign'); + } finally { runtime.cleanup(); } + }); + it('removes only the newly owned root when JVM home encoding fails', () => { + const parent = fs.mkdtempSync(join(tmpdir(), 'copilot-775-invalid-home-')); + const root = join(parent, 'owned-profile'); + fs.mkdirSync(root); + const mocked = jest.spyOn(privateRoots, 'createPrivateVerificationRuntimeRoot').mockReturnValue(root); + const canonical = jest.spyOn(fs, 'realpathSync').mockImplementationOnce(() => root + '\ninvalid'); + try { + expect(() => prepareUntrustedCommandEnvironment()).toThrow('Private JVM home is invalid.'); + expect(existsSync(root)).toBe(false); + expect(existsSync(parent)).toBe(true); + } finally { canonical.mockRestore(); mocked.mockRestore(); fs.rmSync(parent, { recursive: true, force: true }); } + }); + it('removes the owned profile if creating private Gradle state fails', () => { + const root = fs.mkdtempSync(join(tmpdir(), 'copilot-775-mkdir-')); + const mocked = jest.spyOn(privateRoots, 'createPrivateVerificationRuntimeRoot').mockReturnValue(root); + const failure = new Error('fixture-private-directory-failed'); + const mkdir = jest.spyOn(fs, 'mkdirSync').mockImplementationOnce(() => { throw failure; }); + try { + expect(() => prepareUntrustedCommandEnvironment()).toThrow(failure); + expect(existsSync(root)).toBe(false); + } finally { mkdir.mockRestore(); mocked.mockRestore(); fs.rmSync(root, { recursive: true, force: true }); } + }); + it('cleans Gradle state idempotently without following a link to other owned test data', () => { + const outside = fs.mkdtempSync(join(tmpdir(), 'copilot-775-outside-')); + fs.writeFileSync(join(outside, 'marker'), 'preserved'); + const runtime = prepareUntrustedCommandEnvironment(); + try { + fs.symlinkSync(outside, join(runtime.environment.GRADLE_USER_HOME, 'link'), process.platform === 'win32' ? 'junction' : 'dir'); + runtime.cleanup(); runtime.cleanup(); + expect(fs.readFileSync(join(outside, 'marker'), 'utf8')).toBe('preserved'); + expect(existsSync(runtime.environment.HOME)).toBe(false); + } finally { runtime.cleanup(); fs.rmSync(outside, { recursive: true, force: true }); } + }); +}); diff --git a/src/infrastructure/__tests__/untrusted_command_environment.test.ts b/src/infrastructure/__tests__/untrusted_command_environment.test.ts index be59eb163..58d4a0608 100644 --- a/src/infrastructure/__tests__/untrusted_command_environment.test.ts +++ b/src/infrastructure/__tests__/untrusted_command_environment.test.ts @@ -74,7 +74,9 @@ describe('prepareUntrustedCommandEnvironment', () => { expect(JSON.stringify(runtime.environment)).not.toContain('secret'); expect(runtime.environment).not.toHaveProperty('CODEX_HOME'); expect(runtime.environment).not.toHaveProperty('OPENCODE_AUTH_FILE'); - for (const key of ['JAVA_TOOL_OPTIONS', 'JDK_JAVA_OPTIONS', 'GRADLE_USER_HOME', 'MAVEN_OPTS', 'NODE_OPTIONS']) { + expect(runtime.environment.GRADLE_USER_HOME).toBe(join(runtime.environment.HOME, '.gradle')); + expect(runtime.environment.JDK_JAVA_OPTIONS).not.toContain('password'); + for (const key of ['JAVA_TOOL_OPTIONS', 'MAVEN_OPTS', 'NODE_OPTIONS']) { expect(runtime.environment).not.toHaveProperty(key); } } finally { diff --git a/src/infrastructure/native_verification_controller.ts b/src/infrastructure/native_verification_controller.ts index 9f712516c..d74b87b41 100644 --- a/src/infrastructure/native_verification_controller.ts +++ b/src/infrastructure/native_verification_controller.ts @@ -5,7 +5,8 @@ import { removeNativeVerificationProfiles } from './native_verification_profiles import * as core from '@actions/core'; import { spawn, spawnSync } from 'node:child_process'; import { appendFileSync, closeSync, existsSync, openSync, readSync, realpathSync, rmSync, statSync, writeFileSync } from 'node:fs'; -import { join } from 'node:path'; +import { isAbsolute, join } from 'node:path'; +import { privateJvmHomeOption } from './private_jvm_environment'; import { createPrivateVerificationRuntimeRoot } from './agents/agent_private_install_root'; import { trustedWindowsSystemTool } from './agents/agent_trusted_system_tools'; import { getGithubActionInput } from './github_action_input'; @@ -74,12 +75,16 @@ export async function awaitNativeBoundary(root: string, timeoutMs = 7_200_000): if (request) { if (!/^[a-f0-9-]{36}$/u.test(request.id) || !/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/u.test(request.sourceSha) || !/^[a-f0-9]{64}$/u.test(request.digest) || !request.environment || typeof request.environment.HOME !== 'string') throw new VerificationSetupError('handoff-invalid'); + const home = request.environment.HOME; + if (!isAbsolute(home) || /[\r\n\0]/u.test(home) + || request.environment.JDK_JAVA_OPTIONS !== privateJvmHomeOption(home) + || request.environment.GRADLE_USER_HOME !== join(home, '.gradle')) throw new VerificationSetupError('handoff-invalid'); core.setOutput('verification-request', request.id); core.setOutput('verification-source', request.sourceSha); core.setOutput('verification-digest', request.digest); core.saveState('native-verification-digest', request.digest); core.saveState('native-verification-source', request.sourceSha); - for (const key of ['HOME', 'USERPROFILE', 'APPDATA', 'LOCALAPPDATA', 'PATH', 'JAVA_HOME', 'TMP', 'TEMP', 'TMPDIR']) { + for (const key of ['HOME', 'USERPROFILE', 'APPDATA', 'LOCALAPPDATA', 'PATH', 'JAVA_HOME', 'JDK_JAVA_OPTIONS', 'GRADLE_USER_HOME', 'TMP', 'TEMP', 'TMPDIR']) { const value = request.environment[key] ?? ''; if (typeof value !== 'string' || /[\r\n\0]/u.test(value)) throw new VerificationSetupError('handoff-invalid'); core.setOutput(`verification-${key.toLowerCase()}`, value); diff --git a/src/infrastructure/private_jvm_environment.ts b/src/infrastructure/private_jvm_environment.ts new file mode 100644 index 000000000..9a8b52ac2 --- /dev/null +++ b/src/infrastructure/private_jvm_environment.ts @@ -0,0 +1,10 @@ +/** Encode one JDK launcher argument, independently of shell/JSON/Windows argv quoting. */ +export function privateJvmHomeOption(home: string): string { + if (!home || /[\0\r\n]/u.test(home)) throw new Error('Private JVM home is invalid.'); + const value = Array.from(home, character => { + if (character === '"') return "'\"'"; + if (/[\s']/u.test(character)) return '"' + character + '"'; + return character; + }).join(''); + return '-Duser.home=' + value; +} diff --git a/src/infrastructure/untrusted_command_environment.ts b/src/infrastructure/untrusted_command_environment.ts index 57b5045c8..f4a55a72c 100644 --- a/src/infrastructure/untrusted_command_environment.ts +++ b/src/infrastructure/untrusted_command_environment.ts @@ -1,6 +1,7 @@ import { mkdirSync, realpathSync, rmSync } from 'node:fs'; import { join } from 'node:path'; import { createPrivateVerificationRuntimeRoot } from './agents/agent_private_install_root'; +import { privateJvmHomeOption } from './private_jvm_environment'; export interface PreparedUntrustedCommandEnvironment { environment: Record; @@ -45,26 +46,35 @@ export function prepareUntrustedCommandEnvironment( source: NodeJS.ProcessEnv = process.env, platform: NodeJS.Platform = process.platform, ): PreparedUntrustedCommandEnvironment { - const runtimeHome = realpathSync(createPrivateVerificationRuntimeRoot()); - const environment: Record = { HOME: runtimeHome }; - for (const variable of ALLOWED_VARIABLES) { - const value = source[variable]; - if (value !== undefined) environment[variable] = value; + const ownedRoot = createPrivateVerificationRuntimeRoot(); + try { + const runtimeHome = realpathSync(ownedRoot); + const environment: Record = { HOME: runtimeHome }; + for (const variable of ALLOWED_VARIABLES) { + const value = source[variable]; + if (value !== undefined) environment[variable] = value; + } + // These are derived, never inherited tool-option or account-cache settings. + environment.JDK_JAVA_OPTIONS = privateJvmHomeOption(runtimeHome); + environment.GRADLE_USER_HOME = join(runtimeHome, '.gradle'); + mkdirSync(environment.GRADLE_USER_HOME, { mode: 0o700 }); + // Nested fixtures/installers stay inside this command's owned profile. + const runtimeTemp = join(runtimeHome, 'temp'); + mkdirSync(runtimeTemp, { mode: 0o700 }); + for (const key of ['TMP', 'TEMP', 'TMPDIR', 'RUNNER_TEMP']) environment[key] = runtimeTemp; + if (platform === 'win32') { + environment.USERPROFILE = runtimeHome; + environment.APPDATA = join(runtimeHome, 'roaming'); + environment.LOCALAPPDATA = join(runtimeHome, 'local'); + for (const directory of [environment.APPDATA, environment.LOCALAPPDATA]) mkdirSync(directory, { mode: 0o700 }); + environment.PSModuleAnalysisCachePath = join(environment.LOCALAPPDATA, 'powershell-module-analysis.cache'); + } + return { + environment, + cleanup: () => rmSync(runtimeHome, { recursive: true, force: true }), + }; + } catch (error) { + rmSync(ownedRoot, { recursive: true, force: true }); + throw error; } - // Nested fixtures/installers must not fall back into host temp directories - // whose ancestors may be replaceable by another Windows principal. - const runtimeTemp = join(runtimeHome, 'temp'); - mkdirSync(runtimeTemp, { mode: 0o700 }); - for (const key of ['TMP', 'TEMP', 'TMPDIR', 'RUNNER_TEMP']) environment[key] = runtimeTemp; - if (platform === 'win32') { - environment.USERPROFILE = runtimeHome; - environment.APPDATA = join(runtimeHome, 'roaming'); - environment.LOCALAPPDATA = join(runtimeHome, 'local'); - for (const directory of [environment.APPDATA, environment.LOCALAPPDATA]) mkdirSync(directory, { mode: 0o700 }); - environment.PSModuleAnalysisCachePath = join(environment.LOCALAPPDATA, 'powershell-module-analysis.cache'); - } - return { - environment, - cleanup: () => rmSync(runtimeHome, { recursive: true, force: true }), - }; } diff --git a/src/tooling/__tests__/fixtures/verification_jvm_gradle_container_fixture.ts b/src/tooling/__tests__/fixtures/verification_jvm_gradle_container_fixture.ts new file mode 100644 index 000000000..32a1b4c57 --- /dev/null +++ b/src/tooling/__tests__/fixtures/verification_jvm_gradle_container_fixture.ts @@ -0,0 +1,49 @@ +/** Real production adapter acceptance; this is not an Actions YAML emulator. */ +import assert from 'node:assert/strict'; +import { mkdirSync, readFileSync, writeFileSync } from 'node:fs'; +import { join } from 'node:path'; +import { GitCommitAdapter } from '../../../infrastructure/git_commit_adapter'; + +let stage = 'account'; +async function verify(): Promise { + assert.equal(process.platform, 'linux'); + assert.equal(process.getuid?.(), 1000); + const candidate = '/tmp/copilot-candidate'; + mkdirSync(join(candidate, '.copilot'), { recursive: true }); + writeFileSync(join(candidate, '.copilot/verification-prerequisites.json'), JSON.stringify({ schemaVersion: 1, runtimes: { java: '17' } })); + writeFileSync(join(candidate, 'candidate-marker'), 'unchanged'); + process.chdir(candidate); + for (const name of ['JDK_JAVA_OPTIONS', 'JAVA_TOOL_OPTIONS', '_JAVA_OPTIONS', 'GRADLE_OPTS', 'MAVEN_OPTS', 'NODE_OPTIONS']) { + process.env[name] = '-DcopilotForeignInjection=true'; + } + process.env.GRADLE_USER_HOME = '/foreign/unapproved-gradle'; + const reports: string[] = []; + stage = 'adapter-construct'; + const adapter = new GitCommitAdapter(); + for (let index = 0; index < 2; index++) { + stage = 'adapter-execute'; + let output = ''; + try { + await adapter.execute(process.execPath, ['/fixture/probe.cjs', process.argv[2] ?? 'private'], { + untrusted: true, verifyRuntimePrerequisites: true, + stdout: bytes => { output += bytes.toString('utf8'); }, + }); + } catch (error) { + const reason = /^FIXTURE_FAILURE:fixture-[a-z-]+$/mu.exec(output)?.[0]; + if (reason) process.stderr.write(reason + '\n'); + throw error; + } + assert.equal(readFileSync(join(candidate, 'candidate-marker'), 'utf8'), 'unchanged'); + reports.push(output.trim()); + } + for (const report of reports) process.stdout.write(report + '\n'); + process.stdout.write('PRODUCTION_ADAPTER_TWO_FRESH_VERIFICATIONS:true\n'); +} + +void verify().catch((error: unknown) => { + const name = error instanceof Error && /^[A-Za-z]{1,64}$/u.test(error.name) ? error.name : 'Unknown'; + const code = error && typeof error === 'object' && 'code' in error && typeof error.code === 'string' + && /^[A-Za-z0-9.-]{1,64}$/u.test(error.code) ? error.code : 'none'; + process.stderr.write('Production JVM/Gradle acceptance failed: ' + stage + '/' + name + '/' + code + '; no publication authorized.\n'); + process.exitCode = 1; +}); diff --git a/src/tooling/__tests__/fixtures/verification_jvm_gradle_probe.cjs b/src/tooling/__tests__/fixtures/verification_jvm_gradle_probe.cjs new file mode 100644 index 000000000..cb84037c9 --- /dev/null +++ b/src/tooling/__tests__/fixtures/verification_jvm_gradle_probe.cjs @@ -0,0 +1,94 @@ +/** Candidate verifier used by real native Linux and disposable-account acceptance. */ +const assert = require('node:assert/strict'); +const fs = require('node:fs'); +const os = require('node:os'); +const path = require('node:path'); +const cp = require('node:child_process'); + +function run(program, args, cwd) { + const result = cp.spawnSync(program, args, { + cwd, env: process.env, encoding: 'utf8', timeout: 120_000, + maxBuffer: 1_048_576, shell: false, + }); + assert.equal(result.error, undefined, 'fixture-process-start'); + assert.equal(result.status, 0, program === 'gradle' ? 'fixture-gradle-exit' : 'fixture-java-exit'); + return result.stdout; +} + +function verify() { + const legacy = process.argv[2] === 'disposable-legacy'; + // Legacy discovery is permitted only in the explicitly owned container account. + if (legacy) { + assert.equal(process.getuid(), 1000, 'fixture-account'); + assert.equal(os.userInfo().homedir, '/home/gradle', 'fixture-account-home'); + assert.equal(fs.readFileSync('/home/gradle/copilot-disposable-fixture', 'utf8'), 'owned', 'fixture-account-marker'); + } + const home = fs.realpathSync(process.env.HOME); + const project = path.join(home, 'jvm-gradle-project'); + const privateGradle = path.join(home, '.gradle'); + fs.mkdirSync(path.join(project, 'src/main/java'), { recursive: true }); + fs.mkdirSync(path.join(privateGradle, 'init.d'), { recursive: true }); + fs.writeFileSync(path.join(privateGradle, 'gradle.properties'), 'copilotPrivateProperty=present\n'); + fs.writeFileSync(path.join(privateGradle, 'init.d/private.gradle'), "println 'PROBE_PRIVATE_INIT:true'\n"); + const javaSource = [ + 'class HomeProbe { public static void main(String[] args) {', + ' System.out.println("PROBE_JVM_PRIVATE:" + System.getProperty("user.home").equals(System.getenv("HOME")));', + ' System.out.println("PROBE_JDK_17:" + "17".equals(System.getProperty("java.specification.version")));', + '} }', + ].join('\n'); + fs.writeFileSync(path.join(project, 'src/main/java/HomeProbe.java'), javaSource); + const java = path.join(process.env.JAVA_HOME, 'bin/java'); + const jvm = run(java, [path.join(project, 'src/main/java/HomeProbe.java')], project); + assert.equal(jvm.includes('PROBE_JDK_17:true'), true, 'fixture-java-version'); + assert.equal(jvm.includes('PROBE_JVM_PRIVATE:true'), !legacy, 'fixture-jvm-home'); + if (!legacy) { + assert.equal(fs.realpathSync(process.env.GRADLE_USER_HOME), privateGradle, 'fixture-gradle-home'); + assert.match(process.env.JDK_JAVA_OPTIONS, /^-Duser\.home=/u, 'fixture-derived-option'); + } + for (const key of ['JAVA_TOOL_OPTIONS', '_JAVA_OPTIONS', 'GRADLE_OPTS', 'MAVEN_OPTS', 'NODE_OPTIONS']) { + assert.equal(process.env[key], undefined, 'fixture-inherited-option-excluded'); + } + fs.writeFileSync(path.join(project, 'settings.gradle'), "rootProject.name = 'copilot-private-jvm-fixture'\n"); + fs.writeFileSync(path.join(project, 'build.gradle'), [ + "plugins { id 'java' }", + 'java { sourceCompatibility = JavaVersion.VERSION_17; targetCompatibility = JavaVersion.VERSION_17 }', + "tasks.register('verifyIsolation', JavaExec) {", + " dependsOn classes; classpath = sourceSets.main.runtimeClasspath; mainClass = 'HomeProbe'", + ' doFirst {', + " println 'PROBE_GRADLE_PRIVATE:' + gradle.gradleUserHomeDir.equals(new File(System.getenv('HOME'), '.gradle'))", + " println 'PROBE_PRIVATE_PROPERTY:' + providers.gradleProperty('copilotPrivateProperty').isPresent()", + " println 'PROBE_GLOBAL_PROPERTY:' + providers.gradleProperty('copilotGlobalProperty').isPresent()", + ' }', + '}', + ].join('\n')); + const before = fs.readFileSync(path.join(project, 'build.gradle')); + const output = run('gradle', ['--offline', '--no-daemon', '--console=plain', '--project-dir', project, + '--project-cache-dir', path.join(home, 'project-cache'), 'verifyIsolation'], project); + for (const marker of ['PROBE_GRADLE_PRIVATE:', 'PROBE_PRIVATE_PROPERTY:', 'PROBE_PRIVATE_INIT:', 'PROBE_JVM_PRIVATE:']) { + assert.equal(output.includes(marker + 'true'), !legacy, 'fixture-private-discovery'); + } + assert.equal(output.includes('PROBE_GLOBAL_PROPERTY:true'), legacy, 'fixture-global-property'); + assert.equal(output.includes('PROBE_GLOBAL_INIT:true'), legacy, 'fixture-global-init'); + assert.equal(output.includes('PROBE_JDK_17:true'), true, 'fixture-javaexec-version'); + assert.match(output, /> Task :compileJava(?:\r?\n)/u, 'fixture-fresh-java-compilation'); + assert.equal(output.includes(':compileJava UP-TO-DATE'), false, 'fixture-no-reused-classes'); + assert.equal(output.includes(':compileJava FROM-CACHE'), false, 'fixture-no-reused-build-cache'); + assert.deepEqual(fs.readFileSync(path.join(project, 'build.gradle')), before, 'fixture-source-preserved'); + process.stdout.write(JSON.stringify({ + fixture: legacy ? 'disposable-legacy-discovery' : 'private-jvm-gradle', + jvmHomePrivate: !legacy, gradleHomePrivate: !legacy, + privateConfigurationUsed: !legacy, disposableGlobalConfigurationUsed: legacy, + freshJavaCompilation: true, javaExecVerified: true, inheritedOptionsExcluded: true, + sourceUnchanged: true, + }) + '\n'); +} + +try { verify(); } +catch (error) { + // No Java/Gradle output, account paths or arbitrary thrown values leave this verifier. + const first = error instanceof assert.AssertionError ? error.message.split(/\r?\n/u)[0] : ''; + const reason = /^fixture-[a-z-]+$/u.test(first) ? first : 'fixture-verification'; + process.stdout.write('FIXTURE_FAILURE:' + reason + '\n'); + process.stderr.write('JVM/Gradle fixture failed: ' + reason + '\n'); + process.exitCode = 1; +} diff --git a/src/tooling/__tests__/fixtures/verification_native_fixture.ts b/src/tooling/__tests__/fixtures/verification_native_fixture.ts index 3f8f77ec2..a026aaf75 100644 --- a/src/tooling/__tests__/fixtures/verification_native_fixture.ts +++ b/src/tooling/__tests__/fixtures/verification_native_fixture.ts @@ -1,7 +1,7 @@ /** Native CI acceptance: the real Actions runner executes the reviewed YAML between candidate and verifier. */ import * as core from '@actions/core'; import { execFileSync } from 'node:child_process'; -import { mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs'; +import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs'; import { join } from 'node:path'; import { runNativeVerificationEntry } from '../../../infrastructure/native_verification_controller'; import { captureVerificationSetup } from '../../../infrastructure/verification_setup_snapshot'; @@ -12,6 +12,17 @@ const yaml = `name: Native setup acceptance runs: using: composite steps: + - uses: actions/setup-java@v6 + if: runner.os == 'Linux' + with: + distribution: temurin + java-version: '17' + - uses: gradle/actions/setup-gradle@v6 + if: runner.os == 'Linux' + with: + gradle-version: '9.8.2' + cache-provider: basic + cache-disabled: true - uses: actions/setup-python@v6 id: python with: @@ -56,6 +67,8 @@ async function fixture(): Promise { const marker = join(process.cwd(), '.copilot-native-candidate'); const testFile = join(process.cwd(), 'test_copilot_native_candidate.py'); const requirements = join(process.cwd(), 'requirements-native-fixture.txt'); + const prerequisites = join(process.cwd(), '.copilot/verification-prerequisites.json'); + const originalPrerequisites = process.platform === 'linux' && existsSync(prerequisites) ? readFileSync(prerequisites) : undefined; const candidateYaml = 'runs:\n using: composite\n steps:\n - run: exit 99\n shell: bash\n'; mkdirSync(candidateAction, { recursive: true }); writeFileSync(join(candidateAction, 'action.yml'), candidateYaml); @@ -63,12 +76,24 @@ async function fixture(): Promise { writeFileSync(requirements, 'pytest==8.4.2\n'); writeFileSync(testFile, 'from pathlib import Path\ndef test_candidate():\n assert Path(".copilot-native-candidate").read_text() == "after-agent"\n'); try { + if (process.platform === 'linux') { + mkdirSync(join(process.cwd(), '.copilot'), { recursive: true }); + writeFileSync(prerequisites, JSON.stringify({ schemaVersion: 1, runtimes: { java: '17', node: '24', pnpm: '10' } })); + } const adapter = new GitCommitAdapter(undefined, undefined, setup); await adapter.execute('python', ['-m', 'pytest', '-q', testFile, '-p', 'no:cacheprovider'], { untrusted: true, verifyRuntimePrerequisites: true }); await adapter.execute('pnpm', ['--version'], { untrusted: true, verifyRuntimePrerequisites: true }); + if (process.platform === 'linux') { + const before = git('status', '--porcelain=v1', '--untracked-files=all'); + await adapter.execute(process.execPath, [join(process.cwd(), 'src/tooling/__tests__/fixtures/verification_jvm_gradle_probe.cjs')], { + untrusted: true, verifyRuntimePrerequisites: true, + }); + if (git('status', '--porcelain=v1', '--untracked-files=all') !== before) throw new Error('JVM/Gradle verifier changed candidate files'); + core.info('Native Linux JVM/Gradle acceptance passed: private homes/configuration, offline fresh Java compilation and JavaExec, candidate unchanged.'); + } if (readFileSync(VERIFICATION_SETUP_PATH, 'utf8') !== candidateYaml) throw new Error('Candidate action was not restored'); writeFileSync(join(process.cwd(), '.github/actions/copilot-native-fixture/dist/index.js'), 'throw new Error("Candidate runtime must never execute during continuation or post");'); - core.info('Native composite acceptance passed: candidate manifests, trusted snapshot, Python/pytest and Node/pnpm, two fresh profiles.'); + core.info('Native composite acceptance passed: candidate manifests, trusted snapshot, Python/pytest and Node/pnpm, ' + (process.platform === 'linux' ? 'JVM/Gradle and three' : 'two') + ' fresh profiles.'); } catch (error) { // This controlled fixture contains no credentials. File names, rather than file contents, // identify dependency installers that unexpectedly alter the publishable candidate. @@ -76,6 +101,10 @@ async function fixture(): Promise { core.info(`Native fixture tracked changes: ${git('diff', '--no-ext-diff', '--no-textconv', '--numstat', 'HEAD', '--').slice(0, 8_192)}`); throw error; } finally { + if (process.platform === 'linux') { + if (originalPrerequisites) writeFileSync(prerequisites, originalPrerequisites); + else rmSync(prerequisites, { force: true }); + } rmSync(candidateAction, { recursive: true, force: true }); rmSync(marker, { force: true }); rmSync(testFile, { force: true }); rmSync(requirements, { force: true }); rmSync(join(process.cwd(), '__pycache__'), { recursive: true, force: true }); git('update-ref', '-d', 'refs/remotes/origin/copilot-native-fixture', commit); From 4c30600aef0930f1ee2ee5089a6991ab43fcefc0 Mon Sep 17 00:00:00 2001 From: Efra Espada Date: Thu, 29 Oct 2026 19:28:03 +0100 Subject: [PATCH 2/4] bugfix-775-private-verification-home-does-not-redirect-jvmgradle-account-level-configuration: diagnose native JVM setup ownership and cover continuation boundaries --- ...tory-verification-runtime-prerequisites.md | 11 +++++ .../native_verification_controller.test.ts | 41 +++++++++++++++++++ .../fixtures/verification_native_fixture.ts | 41 ++++++++++++++++++- 3 files changed, 91 insertions(+), 2 deletions(-) diff --git a/specs/repository-verification-runtime-prerequisites.md b/specs/repository-verification-runtime-prerequisites.md index 6c9aeecf8..382aeb4f7 100644 --- a/specs/repository-verification-runtime-prerequisites.md +++ b/specs/repository-verification-runtime-prerequisites.md @@ -515,3 +515,14 @@ lines. Every prior and new module budget passes. The setup ledger remains implemented here. Extension verification passes all 267 cases with 100% on every metric. Native GitHub Linux acceptance and final PR checks still require their own successful exact-head evidence before merge. + +The first GitHub run passed all 790 suites and 14,655 cases, but the controller +branch budget failed at 88% on Linux/macOS. Add six protocol cases before the +next run: absent inherited runtime exports, missing request, malformed snapshot +digest, delayed worker-session publication, continuation entry routing, and an +exhausted boundary that blocks publication and cancels its pending worker. +These supplement the 42 cases above; the new distinct-case count is 48. Keep +the 90% branch floor. The native Linux job separately rejected setup metadata +before preflight; fixture-only diagnostics classify tool/root ownership using +closed enums and booleans, without printing runtime paths or accepting more roots. +That rejection requires a resolved cause and successful native rerun before merge. diff --git a/src/infrastructure/__tests__/native_verification_controller.test.ts b/src/infrastructure/__tests__/native_verification_controller.test.ts index 798cdc495..04537c6d1 100644 --- a/src/infrastructure/__tests__/native_verification_controller.test.ts +++ b/src/infrastructure/__tests__/native_verification_controller.test.ts @@ -112,6 +112,21 @@ describe('native Actions phase controller', () => { request(); protocol.writeNativeRecord(f.session, `response-${f.id}.json`, {}); await expect(continueNativeVerification(f.session, f.id, 'success')).rejects.toThrow('handoff-invalid'); }); + it('delivers a continuation without inherited PATH or JAVA_HOME as an empty closed result', async () => { + request(); const write = protocol.writeNativeRecord; + jest.spyOn(protocol, 'writeNativeRecord').mockImplementation((root, name, value) => { write(root, name, value); if (name.startsWith('response-')) write(root, 'done.json', { exitCode: 0 }); }); + await continueNativeVerification(f.session, f.id, 'success', {}); + expect(protocol.readNativeRecord(f.session, `response-${f.id}.json`)).toEqual({ id: f.id, success: true, path: '' }); + }); + it('rejects continuation after the request has disappeared without writing a response', async () => { + await expect(continueNativeVerification(f.session, f.id, 'success', {})).rejects.toThrow('handoff-invalid'); + expect(fs.existsSync(join(f.session, `response-${f.id}.json`))).toBe(false); + }); + it('rejects a malformed snapshot digest before emitting setup metadata', async () => { + request({ digest: 'invalid' }); + await expect(awaitNativeBoundary(f.session)).rejects.toThrow('handoff-invalid'); + expect(core.setOutput).not.toHaveBeenCalled(); + }); it('rejects a stale request before signaling the worker', async () => { request(); await expect(continueNativeVerification(f.session, 'wrong', 'success')).rejects.toThrow('handoff-invalid'); }); @@ -151,6 +166,14 @@ describe('native Actions phase controller', () => { fs.rmSync(join(f.session, 'session.json')); let now = 0; jest.spyOn(Date, 'now').mockImplementation(() => now++ ? 30_001 : 0); await expect(runNativeVerificationEntry(jest.fn())).rejects.toThrow('timeout'); }); + it('starts the worker callback after its owner publishes the session', async () => { + const session = protocol.nativeSession(f.session); fs.rmSync(join(f.session, 'session.json')); + const pause = jest.spyOn(protocol, 'nativePause').mockImplementation(async () => { protocol.writeNativeRecord(f.session, 'session.json', session); }); + const run = jest.fn().mockResolvedValue(undefined); + await runNativeVerificationEntry(run); + expect(pause).toHaveBeenCalledWith(10); expect(run).toHaveBeenCalledTimes(1); + expect(protocol.readNativeRecord(f.session, 'done.json')).toEqual({ exitCode: 0 }); + }); it('rejects a native continuation without a ticket', async () => { delete process.env.COPILOT_NATIVE_WORKER_SESSION; process.env.GITHUB_ACTIONS = 'true'; process.env.COPILOT_NATIVE_PHASE = 'continue'; delete process.env.COPILOT_NATIVE_TICKET; await expect(runNativeVerificationEntry(jest.fn())).rejects.toThrow('handoff-invalid'); @@ -167,6 +190,24 @@ describe('native Actions phase controller', () => { delete process.env.COPILOT_NATIVE_WORKER_SESSION; process.env.GITHUB_ACTIONS = 'true'; process.env.COPILOT_NATIVE_PHASE = 'finish'; process.env.COPILOT_NATIVE_TICKET = f.session; done(1); await runNativeVerificationEntry(jest.fn()); expect(core.setFailed).toHaveBeenCalled(); }); + it('routes a native continuation to the existing worker without replaying the operation', async () => { + request(); delete process.env.COPILOT_NATIVE_WORKER_SESSION; + process.env.GITHUB_ACTIONS = 'true'; process.env.COPILOT_NATIVE_PHASE = 'continue'; process.env.COPILOT_NATIVE_TICKET = f.session; + process.env.COPILOT_NATIVE_REQUEST = f.id; process.env.COPILOT_NATIVE_OUTCOME = 'success'; + const write = protocol.writeNativeRecord; + jest.spyOn(protocol, 'writeNativeRecord').mockImplementation((root, name, value) => { write(root, name, value); if (name.startsWith('response-')) write(root, 'done.json', { exitCode: 0 }); }); + const run = jest.fn(); await runNativeVerificationEntry(run); + expect(run).not.toHaveBeenCalled(); + expect(protocol.readNativeRecord(f.session, `response-${f.id}.json`)).toMatchObject({ id: f.id, success: true }); + }); + it('blocks publication at an exhausted boundary and cancels the pending worker', async () => { + delete process.env.COPILOT_NATIVE_WORKER_SESSION; process.env.GITHUB_ACTIONS = 'true'; process.env.COPILOT_NATIVE_PHASE = 'finish'; process.env.COPILOT_NATIVE_TICKET = f.session; + jest.spyOn(protocol, 'nativePause').mockImplementation(async () => { done(1); }); + const run = jest.fn(); await runNativeVerificationEntry(run); + expect(run).not.toHaveBeenCalled(); expect(core.setFailed).toHaveBeenCalledWith(expect.stringContaining('Pending verification and subsequent publication are blocked')); + expect(protocol.readNativeRecord(f.session, 'cancel.json')).toEqual({ cancelled: true }); + expect(fs.existsSync(f.session)).toBe(true); + }); it('uses the post phase only for cleanup', async () => { jest.mocked(core.getState).mockImplementation(key => key === 'copilot-native-post' || key === 'native-verification-owner' ? 'true' : key === 'native-verification-ticket' ? f.session : ''); done(); const run = jest.fn(); await runNativeVerificationEntry(run); expect(run).not.toHaveBeenCalled(); expect(fs.existsSync(f.session)).toBe(false); diff --git a/src/tooling/__tests__/fixtures/verification_native_fixture.ts b/src/tooling/__tests__/fixtures/verification_native_fixture.ts index a026aaf75..c783fc6bc 100644 --- a/src/tooling/__tests__/fixtures/verification_native_fixture.ts +++ b/src/tooling/__tests__/fixtures/verification_native_fixture.ts @@ -1,12 +1,48 @@ /** Native CI acceptance: the real Actions runner executes the reviewed YAML between candidate and verifier. */ import * as core from '@actions/core'; import { execFileSync } from 'node:child_process'; -import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs'; -import { join } from 'node:path'; +import { existsSync, lstatSync, mkdirSync, readFileSync, realpathSync, rmSync, writeFileSync } from 'node:fs'; +import { isAbsolute, join, relative, sep } from 'node:path'; import { runNativeVerificationEntry } from '../../../infrastructure/native_verification_controller'; import { captureVerificationSetup } from '../../../infrastructure/verification_setup_snapshot'; import { GitCommitAdapter } from '../../../infrastructure/git_commit_adapter'; import { VERIFICATION_SETUP_DIRECTORY, VERIFICATION_SETUP_PATH } from '../../../application/policies/verification_setup_policy'; +import { nativeVerificationProfilePaths } from '../../../infrastructure/native_verification_profiles'; +import type { PreparedVerificationSetup } from '../../../application/ports/verification_setup_ports'; + +/** Fixture-only closed facts: never print runtime paths or arbitrary setup metadata. */ +function nativeRuntimeRejectionFacts(setup: PreparedVerificationSetup): void { + const session = process.env.COPILOT_NATIVE_WORKER_SESSION; + if (!session || setup.kind !== 'ready') return; + try { + const home = nativeVerificationProfilePaths(session).at(-1); + if (!home) return; + const file = join(home, 'native-setup-result.json'); + const stat = lstatSync(file); + if (!stat.isFile() || stat.isSymbolicLink() || stat.nlink !== 1 || stat.size > 16_384) return; + const result = JSON.parse(readFileSync(file, 'utf8')); + const roots = [{ role: 'profile', path: home }, { role: 'workspace', path: setup.workspace }, + ...(setup.toolRoot ? [{ role: 'tool-cache', path: setup.toolRoot }] : [])]; + const rootRole = (value: string): string => roots.find(root => { + const part = relative(root.path, value); + return part === '' || part !== '..' && !part.startsWith('..' + sep) && !isAbsolute(part); + })?.role ?? 'outside'; + const classify = (value: unknown): Record => { + if (typeof value !== 'string') return { kind: 'invalid' }; + const tool = /gradle/iu.test(value) ? 'gradle' : /java|jdk/iu.test(value) ? 'java' + : /python|venv/iu.test(value) ? 'python' : /pnpm/iu.test(value) ? 'pnpm' : 'other'; + try { + const actual = realpathSync(value); + return { tool, lexicalRoot: rootRole(value), canonicalRoot: rootRole(actual), directory: lstatSync(actual).isDirectory() }; + } catch { return { tool, lexicalRoot: rootRole(value), canonicalRoot: 'unreadable', directory: false }; } + }; + core.info('Native runtime rejection facts: ' + JSON.stringify({ + pathCount: Array.isArray(result.path) ? result.path.length : 'invalid', + paths: Array.isArray(result.path) ? result.path.slice(0, 8).map(classify) : [], + javaHome: classify(result.environment?.JAVA_HOME), + })); + } catch { core.info('Native runtime rejection facts: unavailable'); } +} const yaml = `name: Native setup acceptance runs: @@ -95,6 +131,7 @@ async function fixture(): Promise { writeFileSync(join(process.cwd(), '.github/actions/copilot-native-fixture/dist/index.js'), 'throw new Error("Candidate runtime must never execute during continuation or post");'); core.info('Native composite acceptance passed: candidate manifests, trusted snapshot, Python/pytest and Node/pnpm, ' + (process.platform === 'linux' ? 'JVM/Gradle and three' : 'two') + ' fresh profiles.'); } catch (error) { + nativeRuntimeRejectionFacts(setup); // This controlled fixture contains no credentials. File names, rather than file contents, // identify dependency installers that unexpectedly alter the publishable candidate. core.info(`Native fixture candidate status: ${git('status', '--porcelain=v1').slice(0, 8_192)}`); From e9a2370f957f591ac2f9d5bdb0ec36c29ca1aeda Mon Sep 17 00:00:00 2001 From: Efra Espada Date: Thu, 29 Oct 2026 19:36:29 +0100 Subject: [PATCH 3/4] bugfix-775-private-verification-home-does-not-redirect-jvmgradle-account-level-configuration: provision the native JDK within its owned verification profile --- specs/repository-verification-runtime-prerequisites.md | 8 ++++++++ .../__tests__/fixtures/verification_native_fixture.ts | 4 ++++ 2 files changed, 12 insertions(+) diff --git a/specs/repository-verification-runtime-prerequisites.md b/specs/repository-verification-runtime-prerequisites.md index 382aeb4f7..b55887c4b 100644 --- a/specs/repository-verification-runtime-prerequisites.md +++ b/specs/repository-verification-runtime-prerequisites.md @@ -526,3 +526,11 @@ the 90% branch floor. The native Linux job separately rejected setup metadata before preflight; fixture-only diagnostics classify tool/root ownership using closed enums and booleans, without printing runtime paths or accepting more roots. That rejection requires a resolved cause and successful native rerun before merge. + +The native diagnostic identified the rejected JDK: its lexical tool-cache entry +resolved outside all approved roots, while Python and pnpm stayed within the +current private profile. Keep rejecting that alias. The controlled setup-java +step now uses a step-local RUNNER_TOOL_CACHE beneath the current HOME, so its +real JDK installation is owned by that profile. This changes only native test +provisioning; it does not widen result roots, forward the temporary cache setting +to continuation, change the selected JDK 17, or claim a successful rerun yet. diff --git a/src/tooling/__tests__/fixtures/verification_native_fixture.ts b/src/tooling/__tests__/fixtures/verification_native_fixture.ts index c783fc6bc..f5b96b81c 100644 --- a/src/tooling/__tests__/fixtures/verification_native_fixture.ts +++ b/src/tooling/__tests__/fixtures/verification_native_fixture.ts @@ -50,6 +50,10 @@ runs: steps: - uses: actions/setup-java@v6 if: runner.os == 'Linux' + env: + # Hosted tool-cache JDK entries may link to account/system installations. + # Provision inside the current owned profile instead of accepting those links. + RUNNER_TOOL_CACHE: \${{ env.HOME }}/native-java-tool-cache with: distribution: temurin java-version: '17' From a9d7de1f156bd1693e9a69611c94b89064174c28 Mon Sep 17 00:00:00 2001 From: Efra Espada Date: Thu, 29 Oct 2026 19:48:53 +0100 Subject: [PATCH 4/4] bugfix-775-private-verification-home-does-not-redirect-jvmgradle-account-level-configuration: download a real JDK into the approved native tool cache --- ...pository-verification-runtime-prerequisites.md | 15 ++++++++++----- .../fixtures/verification_native_fixture.ts | 6 ++---- 2 files changed, 12 insertions(+), 9 deletions(-) diff --git a/specs/repository-verification-runtime-prerequisites.md b/specs/repository-verification-runtime-prerequisites.md index b55887c4b..9ca5bb2d6 100644 --- a/specs/repository-verification-runtime-prerequisites.md +++ b/specs/repository-verification-runtime-prerequisites.md @@ -529,8 +529,13 @@ That rejection requires a resolved cause and successful native rerun before merg The native diagnostic identified the rejected JDK: its lexical tool-cache entry resolved outside all approved roots, while Python and pnpm stayed within the -current private profile. Keep rejecting that alias. The controlled setup-java -step now uses a step-local RUNNER_TOOL_CACHE beneath the current HOME, so its -real JDK installation is owned by that profile. This changes only native test -provisioning; it does not widen result roots, forward the temporary cache setting -to continuation, change the selected JDK 17, or claim a successful rerun yet. +current private profile. Keep rejecting that alias. A step-local RUNNER_TOOL_CACHE +override was ineffective: GitHub reserves RUNNER_* variables. The controlled +setup-java step instead uses its supported force-download input to replace the +alias with a real installation inside the already approved tool cache. JVM and +Gradle account configuration still use each fresh private profile; JDK binaries +are tool-cache assets. This changes only native test provisioning; it does not +widen result roots, change the selected JDK 17, or claim a successful rerun yet. +The exact setup-java revision observed in CI, b843ebf9b913146b38da2eaa7aeddf76074ae1ad, +declares this input and bypasses both installed and restored JDK cache entries +before downloading/installing the distribution. diff --git a/src/tooling/__tests__/fixtures/verification_native_fixture.ts b/src/tooling/__tests__/fixtures/verification_native_fixture.ts index f5b96b81c..3a06d04da 100644 --- a/src/tooling/__tests__/fixtures/verification_native_fixture.ts +++ b/src/tooling/__tests__/fixtures/verification_native_fixture.ts @@ -50,13 +50,11 @@ runs: steps: - uses: actions/setup-java@v6 if: runner.os == 'Linux' - env: - # Hosted tool-cache JDK entries may link to account/system installations. - # Provision inside the current owned profile instead of accepting those links. - RUNNER_TOOL_CACHE: \${{ env.HOME }}/native-java-tool-cache with: distribution: temurin java-version: '17' + # Replace a hosted cache alias with a real install inside the approved cache. + force-download: true - uses: gradle/actions/setup-gradle@v6 if: runner.os == 'Linux' with: