Rename frontmatter `sandbox.agent.network-isolation` → `sandbox.agent.default-route` by Copilot · Pull Request #41302 · github/gh-aw

Copilot · 2026-06-24T21:20:34Z

network-isolation is replaced by default-route with inverted semantics: setting default-route: false enables AWF network isolation mode (--network-isolation), omitting or setting default-route: true means normal mode. The AWF runtime flag and behavior are unchanged.

Changes

Schema (main_workflow_schema.json): property renamed to default-route with updated description.
Extraction (frontmatter_extraction_security.go): reads default-route key, inverts to internal NetworkIsolation field (NetworkIsolation = !defaultRouteBool); all three cases documented inline.
Struct (sandbox.go): yaml tag updated to default-route; comment clarifies the inversion.
Tests: integration test workflows use default-route: false; extraction unit test renamed/expanded to cover both values; assertion strings updated throughout.
Log messages/comments: production code references updated in awf_helpers.go, copilot_engine_installation.go, engine_firewall_support.go.
Changeset: minor entry with migration note.

Migration

# Before
sandbox:
  agent:
    network-isolation: true

# After
sandbox:
  agent:
    default-route: false

…h inverted semantics Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

pelikhan · 2026-06-24T21:22:45Z

@copilot rename default-route to root-mode

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-06-24T21:32:17Z

@copilot rename default-route to root-mode

Done. Renamed default-route → root-mode across schema, extraction logic, struct tag, log messages, all tests, and the changeset file.

pelikhan · 2026-06-24T21:41:09Z

@copilot enable flag on 30% of agentic workflows in this repo

pelikhan · 2026-06-24T21:46:49Z

@copilot rename field to sudo - no legacy support for previous names

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-06-24T21:58:02Z

@copilot enable flag on 30% of agentic workflows in this repo

Done. Added root-mode: false to 64 of 215 eligible agentic workflows (~30%), selected evenly across the alphabetical list. Lock files were recompiled and all tests pass.

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-06-24T22:10:20Z

@copilot rename field to sudo - no legacy support for previous names

Done. Renamed root-mode → sudo with no legacy support: schema, extraction logic (agentObj["sudo"]), struct yaml tag, log messages, all test files, changeset, and the 64 workflow files that had root-mode: false (now sudo: false). Lock files recompiled, all tests pass.

pelikhan · 2026-06-24T22:15:27Z

@copilot merge main and recompile

Copilot

Pull request overview

Updates gh-aw workflow frontmatter and compilation behavior to represent AWF “network isolation / rootless” mode via a new boolean field (currently implemented as sandbox.agent.sudo, with inverted semantics) and propagates that change through schema, extraction, tests, and many repository workflows/lockfiles.

Changes:

Renames the sandbox agent frontmatter knob from network-isolation to a new boolean field with inverted meaning (implemented as sudo: false ⇒ enable internal NetworkIsolation).
Updates the main workflow JSON schema and Go frontmatter extraction to recognize the new field and produce rootless AWF invocation/install output (--rootless, no sudo -E awf).
Refreshes numerous workflow specs and generated .lock.yml files to use the new frontmatter field and reflect the resulting compiled YAML changes.

Show a summary per file

File	Description
pkg/workflow/sandbox.go	Updates `AgentSandboxConfig` field tagging/commentary for the new frontmatter control (currently via `sudo`).
pkg/workflow/sandbox_network_isolation_rootless_test.go	Updates integration test workflow fixture and assertions to use `sandbox.agent.sudo: false`.
pkg/workflow/sandbox_custom_agent_test.go	Updates unit tests for AWF install step generation in network isolation/rootless mode.
pkg/workflow/mcp_setup_generator_test.go	Updates MCP setup generator test workflow fixture to use `sandbox.agent.sudo: false`.
pkg/workflow/frontmatter_extraction_security.go	Changes sandbox agent extraction to read `sudo` and invert into internal `NetworkIsolation`.
pkg/workflow/frontmatter_extraction_security_test.go	Renames/expands extraction tests to cover `sudo: false` and `sudo: true`.
pkg/workflow/engine_firewall_support.go	Updates comments for firewall log parsing step behavior under rootless/network isolation mode.
pkg/workflow/engine_firewall_support_test.go	Updates assertion strings to reflect `sudo: false` semantics.
pkg/workflow/copilot_engine_installation.go	Updates comments describing when `--rootless` is passed to the AWF installer.
pkg/workflow/awf_helpers.go	Updates log messages/comments to refer to `sandbox.agent.sudo`-driven rootless behavior.
pkg/workflow/awf_helpers_test.go	Updates test names/assertions around rootless AWF command prefix behavior.
pkg/parser/schemas/main_workflow_schema.json	Renames schema property from `network-isolation` to `sudo` with updated description.
.github/workflows/weekly-safe-outputs-spec-review.md	Updates workflow frontmatter to explicit agent object + `sudo: false`.
.github/workflows/weekly-blog-post-writer.md	Updates workflow frontmatter to explicit agent object + `sudo: false`.
.github/workflows/unbloat-docs.md	Updates workflow frontmatter to explicit agent object + `sudo: false`.
.github/workflows/typist.md	Adds sandbox frontmatter with `sudo: false`.
.github/workflows/test-project-url-default.md	Adds sandbox frontmatter with `sudo: false`.
.github/workflows/test-project-url-default.lock.yml	Regenerates compiled workflow with rootless/network isolation outputs.
.github/workflows/super-linter.md	Adds sandbox frontmatter with `sudo: false`.
.github/workflows/static-analysis-report.md	Adds sandbox frontmatter with `sudo: false`.
.github/workflows/spec-librarian.md	Adds sandbox frontmatter with `sudo: false`.
.github/workflows/smoke-workflow-call-with-inputs.md	Adds sandbox frontmatter with `sudo: false`.
.github/workflows/smoke-service-ports.md	Adds sandbox frontmatter with `sudo: false`.
.github/workflows/smoke-opencode.md	Adds sandbox frontmatter with `sudo: false`.
.github/workflows/smoke-opencode.lock.yml	Regenerates compiled workflow with rootless/network isolation outputs.
.github/workflows/smoke-copilot.md	Adds sandbox frontmatter with `sudo: false`.
.github/workflows/smoke-copilot-aoai-entra.md	Adds sandbox frontmatter with `sudo: false`.
.github/workflows/smoke-claude-on-copilot.md	Adds sandbox frontmatter with `sudo: false`.
.github/workflows/smoke-antigravity.md	Adds sandbox frontmatter with `sudo: false`.
.github/workflows/smoke-agent-public-approved.md	Adds sandbox frontmatter with `sudo: false`.
.github/workflows/skillet.md	Adds sandbox frontmatter with `sudo: false`.
.github/workflows/security-compliance.md	Adds sandbox frontmatter with `sudo: false`.
.github/workflows/schema-consistency-checker.md	Adds sandbox frontmatter with `sudo: false`.
.github/workflows/schema-consistency-checker.lock.yml	Regenerates compiled workflow with rootless/network isolation outputs.
.github/workflows/repository-quality-improver.md	Adds sandbox frontmatter with `sudo: false`.
.github/workflows/refiner.md	Adds sandbox frontmatter with `sudo: false`.
.github/workflows/python-data-charts.md	Adds sandbox frontmatter with `sudo: false`.
.github/workflows/pr-nitpick-reviewer.md	Adds sandbox frontmatter with `sudo: false`.
.github/workflows/poem-bot.md	Adds sandbox frontmatter with `sudo: false`.
.github/workflows/poem-bot.lock.yml	Regenerates compiled workflow with rootless/network isolation outputs.
.github/workflows/outcome-collector.md	Adds sandbox frontmatter with `sudo: false`.
.github/workflows/mergefest.md	Adds sandbox frontmatter with `sudo: false`.
.github/workflows/lockfile-stats.md	Adds sandbox frontmatter with `sudo: false`.
.github/workflows/jsweep.md	Adds sandbox frontmatter with `sudo: false`.
.github/workflows/instructions-janitor.md	Adds sandbox frontmatter with `sudo: false`.
.github/workflows/grumpy-reviewer.md	Adds sandbox frontmatter with `sudo: false`.
.github/workflows/grumpy-reviewer.lock.yml	Regenerates compiled workflow with rootless/network isolation outputs.
.github/workflows/glossary-maintainer.md	Adds sandbox frontmatter with `sudo: false`.
.github/workflows/github-mcp-structural-analysis.md	Adds sandbox frontmatter with `sudo: false`.
.github/workflows/example-workflow-analyzer.md	Adds sandbox frontmatter with `sudo: false`.
.github/workflows/discussion-task-miner.md	Adds sandbox frontmatter with `sudo: false`.
.github/workflows/dev.md	Adds sandbox frontmatter with `sudo: false`.
.github/workflows/deployment-incident-monitor.md	Adds sandbox frontmatter with `sudo: false`.
.github/workflows/dead-code-remover.md	Adds sandbox frontmatter with `sudo: false`.
.github/workflows/daily-testify-uber-super-expert.md	Adds sandbox frontmatter with `sudo: false`.
.github/workflows/daily-skill-optimizer.md	Adds sandbox frontmatter with `sudo: false`.
.github/workflows/daily-skill-optimizer.lock.yml	Regenerates compiled workflow with rootless/network isolation outputs.
.github/workflows/daily-agent-of-the-day-blog-writer.md	Updates workflow frontmatter to explicit agent object + `sudo: false`.
.github/workflows/copilot-pr-prompt-analysis.md	Updates workflow frontmatter to explicit agent object + `sudo: false`.
.github/workflows/copilot-opt.md	Adds sandbox frontmatter with `sudo: false`.
.github/workflows/constraint-solving-potd.md	Adds sandbox frontmatter with `sudo: false`.
.github/workflows/constraint-solving-potd.lock.yml	Regenerates compiled workflow with rootless/network isolation outputs.
.github/workflows/daily-security-observability.md	Adds sandbox frontmatter with `sudo: false`.
.github/workflows/daily-safe-outputs-conformance.md	Adds sandbox frontmatter with `sudo: false`.
.github/workflows/daily-rendering-scripts-verifier.md	Adds sandbox frontmatter with `sudo: false`.
.github/workflows/daily-observability-report.md	Adds sandbox frontmatter with `sudo: false`.
.github/workflows/daily-model-resolution.md	Adds sandbox frontmatter with `sudo: false`.
.github/workflows/daily-malicious-code-scan.md	Adds sandbox frontmatter with `sudo: false`.
.github/workflows/daily-geo-optimizer.md	Adds sandbox frontmatter with `sudo: false`.
.github/workflows/daily-file-diet.md	Adds sandbox frontmatter with `sudo: false`.
.github/workflows/daily-doc-healer.md	Adds sandbox frontmatter with `sudo: false`.
.github/workflows/daily-compiler-quality.md	Adds sandbox frontmatter with `sudo: false`.
.github/workflows/daily-cli-performance.md	Adds sandbox frontmatter with `sudo: false`.
.github/workflows/daily-byok-ollama-test.md	Adds sandbox frontmatter with `sudo: false`.
.github/workflows/daily-byok-ollama-test.lock.yml	Regenerates compiled workflow with rootless/network isolation outputs.
.github/workflows/daily-astrostylelite-markdown-spellcheck.md	Adds sandbox frontmatter with `sudo: false`.
.github/workflows/code-scanning-fixer.md	Adds sandbox frontmatter with `sudo: false`.
.github/workflows/cli-consistency-checker.md	Adds sandbox frontmatter with `sudo: false`.
.github/workflows/cli-consistency-checker.lock.yml	Regenerates compiled workflow with rootless/network isolation outputs.
.github/workflows/changeset.md	Adds sandbox frontmatter with `sudo: false`.
.github/workflows/blog-auditor.md	Adds sandbox frontmatter with `sudo: false`.
.github/workflows/auto-triage-issues.md	Adds sandbox frontmatter with `sudo: false`.
.github/workflows/archie.md	Adds sandbox frontmatter with `sudo: false`.
.github/workflows/ai-moderator.md	Adds sandbox frontmatter with `sudo: false`.
.github/workflows/ab-testing-advisor.md	Adds sandbox frontmatter with `sudo: false`.
.changeset/minor-rename-network-isolation-to-sudo.md	Adds a release note/migration entry for the frontmatter rename (currently marked minor).

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 89/141 changed files
Comments generated: 3

+                    "sudo": {
                      "type": "boolean",
-                      "description": "Enable AWF network topology egress mode (--network-isolation). In this mode, MCP sidecars run as bridge containers and AWF attaches them to its internal awf-net network."
+                      "description": "Controls whether AWF runs in root mode. When set to false, AWF runs without sudo in network-isolation topology egress mode (--network-isolation): MCP sidecars run as bridge containers and AWF attaches them to its internal awf-net network. Defaults to true (sudo enabled, normal mode)."
                    },


+---
+"gh-aw": minor
+---


+	Type             SandboxType                           `yaml:"type,omitempty"`           // Sandbox type: "awf" or "srt" (legacy, use ID instead)
+	Version          string                                `yaml:"version,omitempty"`        // AWF version override used to install and run the matching firewall version
+	Platform         string                                `yaml:"platform,omitempty"`       // AWF platform.type override (github.com, ghes, ghec, ghec-self-hosted)
+	NetworkIsolation bool                                  `yaml:"sudo,omitempty"`           // Internal: true = isolation mode (AWF --network-isolation). Frontmatter sudo: false maps to NetworkIsolation=true; sudo: true or omitted maps to NetworkIsolation=false.


…k-isolation-to-default-root Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-06-24T22:26:18Z

@copilot merge main and recompile

Done. Merged main (resolved lock file conflicts by recompiling from sources) and recompiled all 251 workflows successfully — commit fa7c6a8.

Copilot AI and others added 2 commits June 24, 2026 21:16

feat: rename frontmatter field network-isolation to default-route wit…

2d1e39f

…h inverted semantics Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

docs: improve comments for default-route field and extraction logic

be27408

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI assigned Copilot and pelikhan Jun 24, 2026

Copilot AI changed the title ~~Rename frontmatter field network-isolation to default-route~~ Rename frontmatter sandbox.agent.network-isolation → sandbox.agent.default-route Jun 24, 2026

Copilot finished work on behalf of pelikhan June 24, 2026 21:21

Copilot AI requested a review from pelikhan June 24, 2026 21:21

Copilot created this pull request from a session on behalf of pelikhan June 24, 2026 21:21 View session

Copilot started work on behalf of pelikhan June 24, 2026 21:23 View session

Rename frontmatter sandbox.agent.default-route → sandbox.agent.root-mode

cfc7948

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan June 24, 2026 21:32

Copilot started work on behalf of pelikhan June 24, 2026 21:42 View session

feat: enable root-mode: false on 30% of agentic workflows

7608808

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan June 24, 2026 21:58

Copilot started work on behalf of pelikhan June 24, 2026 21:58 View session

feat: rename root-mode → sudo across schema, code, tests, and workflows

1d18b0c

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan June 24, 2026 22:10

pelikhan marked this pull request as ready for review June 24, 2026 22:15

Copilot AI review requested due to automatic review settings June 24, 2026 22:15

Copilot started work on behalf of pelikhan June 24, 2026 22:15 View session

Copilot started reviewing on behalf of pelikhan June 24, 2026 22:15 View session

Copilot AI reviewed Jun 24, 2026

View reviewed changes

Merge remote-tracking branch 'origin/main' into copilot/rename-networ…

fa7c6a8

…k-isolation-to-default-root Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

chore: merge main and recompile workflows

6c14041

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan June 24, 2026 22:26

pelikhan merged commit cb2c0f2 into main Jun 24, 2026
29 checks passed

pelikhan deleted the copilot/rename-network-isolation-to-default-root branch June 24, 2026 22:36

github-actions Bot mentioned this pull request Jun 26, 2026

[gh-aw-upgrade] gh-aw upgrade available: v0.80.9 → v0.81.4 elastic/ai-github-actions#1429

Closed

6 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Rename frontmatter `sandbox.agent.network-isolation` → `sandbox.agent.default-route` - #41302

Rename frontmatter `sandbox.agent.network-isolation` → `sandbox.agent.default-route`#41302
pelikhan merged 7 commits into
mainfrom
copilot/rename-network-isolation-to-default-root

Copilot AI commented Jun 24, 2026 •

edited

Loading

Uh oh!

pelikhan commented Jun 24, 2026

Uh oh!

Copilot AI commented Jun 24, 2026

Uh oh!

pelikhan commented Jun 24, 2026

Uh oh!

pelikhan commented Jun 24, 2026

Uh oh!

Copilot AI commented Jun 24, 2026

Uh oh!

Copilot AI commented Jun 24, 2026

Uh oh!

pelikhan commented Jun 24, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI commented Jun 24, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

Copilot AI commented Jun 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Migration

Uh oh!

pelikhan commented Jun 24, 2026

Uh oh!

Copilot AI commented Jun 24, 2026

Uh oh!

pelikhan commented Jun 24, 2026

Uh oh!

pelikhan commented Jun 24, 2026

Uh oh!

Copilot AI commented Jun 24, 2026

Uh oh!

Copilot AI commented Jun 24, 2026

Uh oh!

pelikhan commented Jun 24, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Copilot's findings

Uh oh!

Copilot AI commented Jun 24, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Jun 24, 2026 •

edited

Loading