diff --git a/.github/workflows/daily-issues-report.lock.yml b/.github/workflows/daily-issues-report.lock.yml index 78dac715707..491c1e4c475 100644 --- a/.github/workflows/daily-issues-report.lock.yml +++ b/.github/workflows/daily-issues-report.lock.yml @@ -836,6 +836,7 @@ jobs: startup_timeout_sec = 120 tool_timeout_sec = 60 container = "ghcr.io/github/github-mcp-server:v0.31.0" + entrypointArgs = ["stdio", "--lockdown-mode"] env = { "GITHUB_LOCKDOWN_MODE" = "1", "GITHUB_PERSONAL_ACCESS_TOKEN" = "$GH_AW_GITHUB_TOKEN", "GITHUB_READ_ONLY" = "1", "GITHUB_TOOLSETS" = "context,repos,issues,pull_requests,discussions" } env_vars = ["GITHUB_LOCKDOWN_MODE", "GITHUB_PERSONAL_ACCESS_TOKEN", "GITHUB_READ_ONLY", "GITHUB_TOOLSETS"] @@ -853,6 +854,7 @@ jobs: "mcpServers": { "github": { "container": "ghcr.io/github/github-mcp-server:v0.31.0", + "entrypointArgs": ["stdio", "--lockdown-mode"], "env": { "GITHUB_LOCKDOWN_MODE": "1", "GITHUB_PERSONAL_ACCESS_TOKEN": "$GITHUB_MCP_SERVER_TOKEN", diff --git a/.github/workflows/discussion-task-miner.lock.yml b/.github/workflows/discussion-task-miner.lock.yml index 9a62842b369..cbd1e79e873 100644 --- a/.github/workflows/discussion-task-miner.lock.yml +++ b/.github/workflows/discussion-task-miner.lock.yml @@ -766,6 +766,7 @@ jobs: "github": { "type": "stdio", "container": "ghcr.io/github/github-mcp-server:v0.31.0", + "entrypointArgs": ["stdio", "--lockdown-mode"], "env": { "GITHUB_LOCKDOWN_MODE": "1", "GITHUB_PERSONAL_ACCESS_TOKEN": "\${GITHUB_MCP_SERVER_TOKEN}", diff --git a/.github/workflows/grumpy-reviewer.lock.yml b/.github/workflows/grumpy-reviewer.lock.yml index 190e65a57b2..2f19db9fc37 100644 --- a/.github/workflows/grumpy-reviewer.lock.yml +++ b/.github/workflows/grumpy-reviewer.lock.yml @@ -769,6 +769,7 @@ jobs: "github": { "type": "stdio", "container": "ghcr.io/github/github-mcp-server:v0.31.0", + "entrypointArgs": ["stdio", "--lockdown-mode"], "env": { "GITHUB_LOCKDOWN_MODE": "1", "GITHUB_PERSONAL_ACCESS_TOKEN": "\${GITHUB_MCP_SERVER_TOKEN}", diff --git a/.github/workflows/issue-arborist.lock.yml b/.github/workflows/issue-arborist.lock.yml index 484c4aeb17b..7278a8e9650 100644 --- a/.github/workflows/issue-arborist.lock.yml +++ b/.github/workflows/issue-arborist.lock.yml @@ -801,6 +801,7 @@ jobs: startup_timeout_sec = 120 tool_timeout_sec = 60 container = "ghcr.io/github/github-mcp-server:v0.31.0" + entrypointArgs = ["stdio", "--lockdown-mode"] env = { "GITHUB_LOCKDOWN_MODE" = "1", "GITHUB_PERSONAL_ACCESS_TOKEN" = "$GH_AW_GITHUB_TOKEN", "GITHUB_READ_ONLY" = "1", "GITHUB_TOOLSETS" = "issues" } env_vars = ["GITHUB_LOCKDOWN_MODE", "GITHUB_PERSONAL_ACCESS_TOKEN", "GITHUB_READ_ONLY", "GITHUB_TOOLSETS"] @@ -818,6 +819,7 @@ jobs: "mcpServers": { "github": { "container": "ghcr.io/github/github-mcp-server:v0.31.0", + "entrypointArgs": ["stdio", "--lockdown-mode"], "env": { "GITHUB_LOCKDOWN_MODE": "1", "GITHUB_PERSONAL_ACCESS_TOKEN": "$GITHUB_MCP_SERVER_TOKEN", diff --git a/.github/workflows/issue-monster.lock.yml b/.github/workflows/issue-monster.lock.yml index 596505bfcfa..8767e63886b 100644 --- a/.github/workflows/issue-monster.lock.yml +++ b/.github/workflows/issue-monster.lock.yml @@ -719,6 +719,7 @@ jobs: "github": { "type": "stdio", "container": "ghcr.io/github/github-mcp-server:v0.31.0", + "entrypointArgs": ["stdio", "--lockdown-mode"], "env": { "GITHUB_LOCKDOWN_MODE": "1", "GITHUB_PERSONAL_ACCESS_TOKEN": "\${GITHUB_MCP_SERVER_TOKEN}", diff --git a/.github/workflows/issue-triage-agent.lock.yml b/.github/workflows/issue-triage-agent.lock.yml index 955cedcd69b..3358a8339ba 100644 --- a/.github/workflows/issue-triage-agent.lock.yml +++ b/.github/workflows/issue-triage-agent.lock.yml @@ -659,6 +659,7 @@ jobs: "github": { "type": "stdio", "container": "ghcr.io/github/github-mcp-server:v0.31.0", + "entrypointArgs": ["stdio", "--lockdown-mode"], "env": { "GITHUB_LOCKDOWN_MODE": "1", "GITHUB_PERSONAL_ACCESS_TOKEN": "\${GITHUB_MCP_SERVER_TOKEN}", diff --git a/.github/workflows/org-health-report.lock.yml b/.github/workflows/org-health-report.lock.yml index 24cfc2f7728..0de5ad4b3fb 100644 --- a/.github/workflows/org-health-report.lock.yml +++ b/.github/workflows/org-health-report.lock.yml @@ -742,6 +742,7 @@ jobs: "github": { "type": "stdio", "container": "ghcr.io/github/github-mcp-server:v0.31.0", + "entrypointArgs": ["stdio", "--lockdown-mode"], "env": { "GITHUB_LOCKDOWN_MODE": "1", "GITHUB_PERSONAL_ACCESS_TOKEN": "\${GITHUB_MCP_SERVER_TOKEN}", diff --git a/.github/workflows/pr-triage-agent.lock.yml b/.github/workflows/pr-triage-agent.lock.yml index dbad5b000e7..1499f6fbc38 100644 --- a/.github/workflows/pr-triage-agent.lock.yml +++ b/.github/workflows/pr-triage-agent.lock.yml @@ -796,6 +796,7 @@ jobs: "github": { "type": "stdio", "container": "ghcr.io/github/github-mcp-server:v0.31.0", + "entrypointArgs": ["stdio", "--lockdown-mode"], "env": { "GITHUB_LOCKDOWN_MODE": "1", "GITHUB_PERSONAL_ACCESS_TOKEN": "\${GITHUB_MCP_SERVER_TOKEN}", diff --git a/.github/workflows/refiner.lock.yml b/.github/workflows/refiner.lock.yml index b68c193d733..daab4f2318e 100644 --- a/.github/workflows/refiner.lock.yml +++ b/.github/workflows/refiner.lock.yml @@ -744,6 +744,7 @@ jobs: "github": { "type": "stdio", "container": "ghcr.io/github/github-mcp-server:v0.31.0", + "entrypointArgs": ["stdio", "--lockdown-mode"], "env": { "GITHUB_LOCKDOWN_MODE": "1", "GITHUB_PERSONAL_ACCESS_TOKEN": "\${GITHUB_MCP_SERVER_TOKEN}", diff --git a/.github/workflows/stale-repo-identifier.lock.yml b/.github/workflows/stale-repo-identifier.lock.yml index f0bda3e962e..301465b6fde 100644 --- a/.github/workflows/stale-repo-identifier.lock.yml +++ b/.github/workflows/stale-repo-identifier.lock.yml @@ -811,6 +811,7 @@ jobs: "github": { "type": "stdio", "container": "ghcr.io/github/github-mcp-server:v0.31.0", + "entrypointArgs": ["stdio", "--lockdown-mode"], "env": { "GITHUB_LOCKDOWN_MODE": "1", "GITHUB_PERSONAL_ACCESS_TOKEN": "\${GITHUB_MCP_SERVER_TOKEN}", diff --git a/.github/workflows/weekly-issue-summary.lock.yml b/.github/workflows/weekly-issue-summary.lock.yml index 82f6ad52428..f18fac8503e 100644 --- a/.github/workflows/weekly-issue-summary.lock.yml +++ b/.github/workflows/weekly-issue-summary.lock.yml @@ -714,6 +714,7 @@ jobs: "github": { "type": "stdio", "container": "ghcr.io/github/github-mcp-server:v0.31.0", + "entrypointArgs": ["stdio", "--lockdown-mode"], "env": { "GITHUB_LOCKDOWN_MODE": "1", "GITHUB_PERSONAL_ACCESS_TOKEN": "\${GITHUB_MCP_SERVER_TOKEN}", diff --git a/.github/workflows/weekly-safe-outputs-spec-review.lock.yml b/.github/workflows/weekly-safe-outputs-spec-review.lock.yml index a27909fa13c..f98353b3a4f 100644 --- a/.github/workflows/weekly-safe-outputs-spec-review.lock.yml +++ b/.github/workflows/weekly-safe-outputs-spec-review.lock.yml @@ -671,6 +671,7 @@ jobs: "github": { "type": "stdio", "container": "ghcr.io/github/github-mcp-server:v0.31.0", + "entrypointArgs": ["stdio", "--lockdown-mode"], "env": { "GITHUB_LOCKDOWN_MODE": "1", "GITHUB_PERSONAL_ACCESS_TOKEN": "\${GITHUB_MCP_SERVER_TOKEN}", diff --git a/.github/workflows/workflow-generator.lock.yml b/.github/workflows/workflow-generator.lock.yml index 94e221e143c..ce796b4221c 100644 --- a/.github/workflows/workflow-generator.lock.yml +++ b/.github/workflows/workflow-generator.lock.yml @@ -799,6 +799,7 @@ jobs: "github": { "type": "stdio", "container": "ghcr.io/github/github-mcp-server:v0.31.0", + "entrypointArgs": ["stdio", "--lockdown-mode"], "env": { "GITHUB_LOCKDOWN_MODE": "1", "GITHUB_PERSONAL_ACCESS_TOKEN": "\${GITHUB_MCP_SERVER_TOKEN}", diff --git a/pkg/workflow/github_lockdown_integration_test.go b/pkg/workflow/github_lockdown_integration_test.go index d29d8cb36af..46f57c83efc 100644 --- a/pkg/workflow/github_lockdown_integration_test.go +++ b/pkg/workflow/github_lockdown_integration_test.go @@ -39,11 +39,12 @@ Test lockdown mode with local GitHub MCP. `, expected: []string{ `"type": "stdio"`, + `"entrypointArgs": ["stdio", "--lockdown-mode"]`, `"GITHUB_LOCKDOWN_MODE": "1"`, `"ghcr.io/github/github-mcp-server:`, }, notExpected: []string{}, - description: "Copilot with local mode and lockdown should render GITHUB_LOCKDOWN_MODE=1", + description: "Copilot with local mode and lockdown should render entrypointArgs with --lockdown-mode and GITHUB_LOCKDOWN_MODE=1", }, { name: "copilot engine with lockdown enabled in remote mode", @@ -90,13 +91,14 @@ tools: Test lockdown mode with Claude engine. `, expected: []string{ + `"entrypointArgs": ["stdio", "--lockdown-mode"]`, `"GITHUB_LOCKDOWN_MODE": "1"`, `"ghcr.io/github/github-mcp-server:`, }, notExpected: []string{ `"type": "stdio"`, // Claude doesn't include type field }, - description: "Claude with lockdown should render GITHUB_LOCKDOWN_MODE=1", + description: "Claude with lockdown should render entrypointArgs with --lockdown-mode and GITHUB_LOCKDOWN_MODE=1", }, { name: "codex engine with lockdown enabled", @@ -116,11 +118,12 @@ tools: Test lockdown mode with Codex engine. `, expected: []string{ + `entrypointArgs = ["stdio", "--lockdown-mode"]`, `"GITHUB_LOCKDOWN_MODE" = "1"`, `ghcr.io/github/github-mcp-server:`, }, notExpected: []string{}, - description: "Codex (TOML) with lockdown should render GITHUB_LOCKDOWN_MODE=1", + description: "Codex (TOML) with lockdown should render entrypointArgs with --lockdown-mode and GITHUB_LOCKDOWN_MODE=1", }, { name: "lockdown with read-only both enabled", @@ -141,6 +144,7 @@ tools: Test lockdown and read-only modes together. `, expected: []string{ + `"entrypointArgs": ["stdio", "--lockdown-mode"]`, `"GITHUB_LOCKDOWN_MODE": "1"`, `"GITHUB_READ_ONLY": "1"`, }, diff --git a/pkg/workflow/github_lockdown_test.go b/pkg/workflow/github_lockdown_test.go index 65b241c03a6..a13f44750e5 100644 --- a/pkg/workflow/github_lockdown_test.go +++ b/pkg/workflow/github_lockdown_test.go @@ -123,6 +123,7 @@ func TestRenderGitHubMCPDockerConfigWithLockdown(t *testing.T) { }, expected: []string{ `"type": "stdio"`, + `"entrypointArgs": ["stdio", "--lockdown-mode"]`, `"GITHUB_LOCKDOWN_MODE": "1"`, `"GITHUB_TOOLSETS": "default"`, `"container": "ghcr.io/github/github-mcp-server:latest"`, @@ -146,6 +147,7 @@ func TestRenderGitHubMCPDockerConfigWithLockdown(t *testing.T) { }, notFound: []string{ `"GITHUB_LOCKDOWN_MODE"`, + `"entrypointArgs"`, }, }, { @@ -160,6 +162,7 @@ func TestRenderGitHubMCPDockerConfigWithLockdown(t *testing.T) { }, expected: []string{ `"GITHUB_READ_ONLY": "1"`, + `"entrypointArgs": ["stdio", "--lockdown-mode"]`, `"GITHUB_LOCKDOWN_MODE": "1"`, `"container": "ghcr.io/github/github-mcp-server:v1.0.0"`, }, diff --git a/pkg/workflow/mcp_renderer.go b/pkg/workflow/mcp_renderer.go index 67eb9a3da58..af7c82113d4 100644 --- a/pkg/workflow/mcp_renderer.go +++ b/pkg/workflow/mcp_renderer.go @@ -557,6 +557,11 @@ func (r *MCPConfigRendererUnified) renderGitHubTOML(yaml *strings.Builder, githu yaml.WriteString("]\n") } + // Add entrypointArgs for lockdown mode + if lockdown { + yaml.WriteString(" entrypointArgs = [\"stdio\", \"--lockdown-mode\"]\n") + } + // Build environment variables envVars := make(map[string]string) envVars["GITHUB_PERSONAL_ACCESS_TOKEN"] = "$GH_AW_GITHUB_TOKEN" @@ -729,6 +734,11 @@ func RenderGitHubMCPDockerConfig(yaml *strings.Builder, options GitHubMCPDockerO // for Copilot (see convert_gateway_config_copilot.sh). This keeps the gateway // config compatible with the schema which doesn't have the tools field. + // Add entrypointArgs for explicit lockdown mode (not applicable when lockdown is determined at runtime) + if options.Lockdown && !options.LockdownFromStep { + yaml.WriteString(" \"entrypointArgs\": [\"stdio\", \"--lockdown-mode\"],\n") + } + // Add env section for GitHub MCP server environment variables yaml.WriteString(" \"env\": {\n")