Enable sandbox.agent.sudo: false on 20 agentic workflows

.github/workflows/artifacts-summary.md

@@ -18,7 +18,9 @@ network:
     - defaults
     - node
 sandbox:
-  agent: awf  # Firewall enabled (migrated from network.firewall)
+  agent:
+    id: awf
+    sudo: false
 tools:
   cli-proxy: true
   edit:

.github/workflows/audit-workflows.md

@@ -38,6 +38,9 @@ imports:
   - shared/otlp.md
 features:
   gh-aw-detection: true
+sandbox:
+  agent:
+    sudo: false
 ---
 
 # Agentic Workflow Audit Agent

.github/workflows/avenger.md

@@ -32,6 +32,7 @@ tools:
 sandbox:
   agent:
     id: awf
+    sudo: false
     mounts:
       - "/usr/bin/make:/usr/bin/make:ro"
       - "/usr/bin/go:/usr/bin/go:ro"

.github/workflows/ci-coach.md

@@ -52,6 +52,9 @@ experiments:
     issue: 32335
 features:
   gh-aw-detection: true
+sandbox:
+  agent:
+    sudo: false
 ---
 
 # CI Optimization Coach

.github/workflows/copilot-pr-nlp-analysis.md

@@ -27,7 +27,9 @@ network:
     - node
 
 sandbox:
-  agent: awf  # Firewall enabled (migrated from network.firewall)
+  agent:
+    id: awf
+    sudo: false
 imports:
   - uses: shared/daily-audit-base.md
     with:

.github/workflows/daily-hippo-learn.md

@@ -34,7 +34,9 @@ network:
     - node
 
 sandbox:
-  agent: awf
+  agent:
+    id: awf
+    sudo: false
 
 tools:
   cli-proxy: true

.github/workflows/daily-news.md

@@ -55,7 +55,9 @@ network:
     - node
 
 sandbox:
-  agent: awf  # Firewall enabled (migrated from network.firewall)
+  agent:
+    id: awf
+    sudo: false
 safe-outputs:
   upload-artifact:
     max-uploads: 3

.github/workflows/daily-repo-chronicle.md

@@ -25,7 +25,9 @@ network:
     - python
     - node
 sandbox:
-  agent: awf  # Firewall enabled (migrated from network.firewall)
+  agent:
+    id: awf
+    sudo: false
 tools:
   cli-proxy: true
   edit:

.github/workflows/design-decision-gate.md

@@ -41,6 +41,8 @@ safe-outputs:
     run-failure: "❌ [{workflow_name}]({run_url}) {status} during design decision gate check."
 timeout-minutes: 15
 sandbox:
+  agent:
+    sudo: false
   mcp:
     keepalive-interval: 60
 imports:

.github/workflows/firewall-escape.md

@@ -35,7 +35,9 @@ network:
     - node
 
 sandbox:
-  agent: awf  # Firewall enabled (migrated from network.firewall)
+  agent:
+    id: awf
+    sudo: false
 
 safe-outputs:
   create-discussion:

.github/workflows/firewall.md

@@ -19,7 +19,9 @@ network:
     - node
 
 sandbox:
-  agent: awf  # Firewall enabled (migrated from network.firewall)
+  agent:
+    id: awf
+    sudo: false
 imports:
   - shared/otlp.md
 tools:

.github/workflows/glossary-maintainer.md

@@ -88,7 +88,7 @@ steps:
 
 sandbox:
   agent:
-    sudo: true
+    sudo: false
 ---
 
 # Glossary Maintainer

.github/workflows/hippo-embed.md

@@ -30,7 +30,9 @@ network:
     - node
 
 sandbox:
-  agent: awf
+  agent:
+    id: awf
+    sudo: false
 
 tools:
   cli-proxy: true

.github/workflows/hourly-ci-cleaner.md

@@ -34,6 +34,7 @@ tools:
 sandbox:
   agent:
     id: awf
+    sudo: false
     mounts:
       - "/usr/bin/make:/usr/bin/make:ro"
       - "/usr/bin/go:/usr/bin/go:ro"

.github/workflows/mcp-inspector.md

@@ -20,7 +20,9 @@ network:
     - node-cdns
     - fonts
 sandbox:
-  agent: awf  # Firewall enabled (migrated from network.firewall)
+  agent:
+    id: awf
+    sudo: false
 timeout-minutes: 20
 strict: false
 imports:

.github/workflows/research.md

@@ -23,7 +23,9 @@ network:
     - node
 
 sandbox:
-  agent: awf  # Firewall enabled (migrated from network.firewall)
+  agent:
+    id: awf
+    sudo: false
 imports:
   - shared/mcp/tavily.md
   - shared/reporting.md

.github/workflows/smoke-claude.md

@@ -39,6 +39,7 @@ network:
     - playwright
 sandbox:
   agent:
+    sudo: false
     config:
       filesystem:
         allowWrite:

.github/workflows/smoke-pi.md

@@ -24,6 +24,7 @@ engine:
 strict: true
 sandbox:
   agent:
+    sudo: false
     config:
       filesystem:
         allowWrite:

.github/workflows/step-name-alignment.md

@@ -51,6 +51,7 @@ engine:
 # generated by the deterministic pre-agent step in restricted execution modes.
 sandbox:
   agent:
+    sudo: false
     config:
       filesystem:
         allowWrite:

.github/workflows/weekly-issue-summary.md

@@ -18,7 +18,9 @@ network:
     - python
     - node
 sandbox:
-  agent: awf  # Firewall enabled (migrated from network.firewall)
+  agent:
+    id: awf
+    sudo: false
 tools:
   cli-proxy: true
   edit: