Add allow list to Agentic Workflow by malmstein · Pull Request #8170 · duckduckgo/Android

malmstein · 2026-03-31T20:59:17Z

Task/Issue URL: https://app.asana.com/1/137249556945/project/1174433894299346/task/1213883965463238?focus=true

Description

Updated the maintenance worker workflow (android-maintenance-worker.md) to unblock Asana access from the GitHub Actions sandbox:

Allowlisted app.asana.com in the network config so the agent can reach the Asana API
Replaced the Asana MCP server with mcp-scripts that expose two read-only Asana tools (asana_get_section_tasks, asana_get_task) — lighter weight and no extra dependency
Removed the ddg-ai-config APM dependency that was no longer needed
Added GitHub App auth for ddg-ai-config APM package access
Auto-labels PRs created by the maintenance worker with agentic-maintenance
Added a new workflow (action-agentic-maintenance-pr.yaml) that moves the Asana task to "In Review" when a PR is opened or labeled with agentic-maintenance — this overcomes the agent's lack of Asana write permissions

Steps to test this PR

Worked in https://github.com/duckduckgo/Android/actions/runs/23839305109

UI changes

Before	After
No UI changes	No UI changes

Note

Medium Risk
Modifies GitHub Actions agent sandbox/networking and introduces new Asana-integrated automation using ASANA_ACCESS_TOKEN, which can affect CI behavior and external side effects if misconfigured.

Overview
Unblocks the Android agentic maintenance worker from reading Asana by allowlisting app.asana.com and wiring in a lightweight mcp-scripts HTTP server that exposes two read-only Asana tools (asana_get_section_tasks, asana_get_task) through the MCP gateway.

Maintenance PRs created by the worker are now automatically labeled agentic-maintenance, and a new action-agentic-maintenance-pr workflow reacts to that label/PR open to move the referenced Asana task to In Review using duckduckgo/native-github-asana-sync.

Updates the compiled android-maintenance-worker.lock.yml accordingly (MCP scripts startup, env/secret redaction, artifact upload) and adds microsoft/apm-action@v1.4.1 to the actions lockfile.

^{Written by Cursor Bugbot for commit cd99791. This will update automatically on new commits. Configure here.}

malmstein · 2026-03-31T20:59:31Z

Add allow list to Agentic Workflow #8170 👈 (View in Graphite)
develop

This stack of pull requests is managed by Graphite. Learn more about stacking.

daxmobile

Remaining comments which cannot be posted as a review comment to avoid GitHub Rate Limit

actionlint

📝 [actionlint] _{reported by reviewdog 🐶}
shellcheck reported issue in this script: SC2086:info:18:53: Double quote to prevent globbing and word splitting [shellcheck]

Android/.github/workflows/android-maintenance-worker.lock.yml

Line 494 in b3e65df

run: |

📝 [actionlint] _{reported by reviewdog 🐶}
shellcheck reported issue in this script: SC2086:info:1:6: Double quote to prevent globbing and word splitting [shellcheck]

Android/.github/workflows/android-maintenance-worker.lock.yml

Line 560 in b3e65df

run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh

📝 [actionlint] _{reported by reviewdog 🐶}
shellcheck reported issue in this script: SC2086:info:1:6: Double quote to prevent globbing and word splitting [shellcheck]

Android/.github/workflows/android-maintenance-worker.lock.yml

Line 679 in b3e65df

run: |

📝 [actionlint] _{reported by reviewdog 🐶}
shellcheck reported issue in this script: SC2086:info:1:6: Double quote to prevent globbing and word splitting [shellcheck]

Android/.github/workflows/android-maintenance-worker.lock.yml

Line 699 in b3e65df

run: bash ${RUNNER_TEMP}/gh-aw/actions/append_agent_step_summary.sh

📝 [actionlint] _{reported by reviewdog 🐶}
shellcheck reported issue in this script: SC2086:info:1:6: Double quote to prevent globbing and word splitting [shellcheck]

Android/.github/workflows/android-maintenance-worker.lock.yml

Line 943 in b3e65df

    
           run: bash ${RUNNER_TEMP}/gh-aw/actions/download_docker_images.sh ghcr.io/github/gh-aw-firewall/agent:0.25.4 ghcr.io/github/gh-aw-firewall/api-proxy:0.25.4 ghcr.io/github/gh-aw-firewall/squid:0.25.4

📝 [actionlint] _{reported by reviewdog 🐶}
shellcheck reported issue in this script: SC2086:info:1:6: Double quote to prevent globbing and word splitting [shellcheck]

Android/.github/workflows/android-maintenance-worker.lock.yml

Line 1002 in b3e65df

run: bash ${RUNNER_TEMP}/gh-aw/actions/install_awf_binary.sh v0.25.4

The maintenance worker was blocked by two issues: - The sandbox proxy rejected connections to app.asana.com - No Asana credentials were available in the agent environment Add Asana MCP server via mcp-servers frontmatter key, which securely passes ASANA_ACCESS_TOKEN without leaking it to the agent container. Import duckduckgo/ddg-ai-config as an APM package so the agent gets DDG's Asana skills, formatting rules, and data protection policies. Update the prompt to use MCP tools instead of curl. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

daxmobile

Remaining comments which cannot be posted as a review comment to avoid GitHub Rate Limit

actionlint

📝 [actionlint] _{reported by reviewdog 🐶}
shellcheck reported issue in this script: SC2086:info:1:6: Double quote to prevent globbing and word splitting [shellcheck]

Android/.github/workflows/android-maintenance-worker.lock.yml

Line 724 in 133e077

run: |

📝 [actionlint] _{reported by reviewdog 🐶}
shellcheck reported issue in this script: SC2086:info:1:6: Double quote to prevent globbing and word splitting [shellcheck]

Android/.github/workflows/android-maintenance-worker.lock.yml

Line 745 in 133e077

run: bash ${RUNNER_TEMP}/gh-aw/actions/append_agent_step_summary.sh

📝 [actionlint] _{reported by reviewdog 🐶}
shellcheck reported issue in this script: SC2086:info:1:6: Double quote to prevent globbing and word splitting [shellcheck]

Android/.github/workflows/android-maintenance-worker.lock.yml

Line 1019 in 133e077

    
           run: bash ${RUNNER_TEMP}/gh-aw/actions/download_docker_images.sh ghcr.io/github/gh-aw-firewall/agent:0.25.4 ghcr.io/github/gh-aw-firewall/api-proxy:0.25.4 ghcr.io/github/gh-aw-firewall/squid:0.25.4

📝 [actionlint] _{reported by reviewdog 🐶}
shellcheck reported issue in this script: SC2086:info:1:6: Double quote to prevent globbing and word splitting [shellcheck]

Android/.github/workflows/android-maintenance-worker.lock.yml

Line 1078 in 133e077

run: bash ${RUNNER_TEMP}/gh-aw/actions/install_awf_binary.sh v0.25.4

The APM step failed with "repository not found" because GITHUB_TOKEN only has access to the current repo, not the private ddg-ai-config repo. Use GitHub App authentication to mint a scoped token for the ddg-ai-config repository. Requires GH_AW_APP_ID (variable) and GH_AW_APP_PRIVATE_KEY (secret) to be configured in the repo settings. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Simplify the workflow to just the Asana MCP server with ASANA_ACCESS_TOKEN. The ddg-ai-config integration can be added later once APM auth is sorted out. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

daxmobile

Remaining comments which cannot be posted as a review comment to avoid GitHub Rate Limit

actionlint

📝 [actionlint] _{reported by reviewdog 🐶}
shellcheck reported issue in this script: SC2086:info:1:6: Double quote to prevent globbing and word splitting [shellcheck]

Android/.github/workflows/android-maintenance-worker.lock.yml

Line 586 in ad72537

run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh

📝 [actionlint] _{reported by reviewdog 🐶}
shellcheck reported issue in this script: SC2086:info:1:6: Double quote to prevent globbing and word splitting [shellcheck]

Android/.github/workflows/android-maintenance-worker.lock.yml

Line 705 in ad72537

run: |

📝 [actionlint] _{reported by reviewdog 🐶}
shellcheck reported issue in this script: SC2086:info:1:6: Double quote to prevent globbing and word splitting [shellcheck]

Android/.github/workflows/android-maintenance-worker.lock.yml

Line 726 in ad72537

run: bash ${RUNNER_TEMP}/gh-aw/actions/append_agent_step_summary.sh

📝 [actionlint] _{reported by reviewdog 🐶}
shellcheck reported issue in this script: SC2086:info:1:6: Double quote to prevent globbing and word splitting [shellcheck]

Android/.github/workflows/android-maintenance-worker.lock.yml

Line 970 in ad72537

    
           run: bash ${RUNNER_TEMP}/gh-aw/actions/download_docker_images.sh ghcr.io/github/gh-aw-firewall/agent:0.25.4 ghcr.io/github/gh-aw-firewall/api-proxy:0.25.4 ghcr.io/github/gh-aw-firewall/squid:0.25.4

📝 [actionlint] _{reported by reviewdog 🐶}
shellcheck reported issue in this script: SC2086:info:1:6: Double quote to prevent globbing and word splitting [shellcheck]

Android/.github/workflows/android-maintenance-worker.lock.yml

Line 1029 in ad72537

run: bash ${RUNNER_TEMP}/gh-aw/actions/install_awf_binary.sh v0.25.4

daxmobile · 2026-04-01T08:08:24Z

@@ -125,19 +125,19 @@ jobs:
        run: |


📝 [actionlint] _{reported by reviewdog 🐶}
shellcheck reported issue in this script: SC2086:info:1:6: Double quote to prevent globbing and word splitting [shellcheck]

daxmobile · 2026-04-01T08:08:26Z

📝 [actionlint] _{reported by reviewdog 🐶}
shellcheck reported issue in this script: SC2086:info:1:1: Double quote to prevent globbing and word splitting [shellcheck]

Android/.github/workflows/android-maintenance-worker.lock.yml

Line 90 in ad72537

run: ${RUNNER_TEMP}/gh-aw/actions/validate_multi_secret.sh ANTHROPIC_API_KEY 'Claude Code' https://github.github.com/gh-aw/reference/engines/#anthropic-claude-code

daxmobile · 2026-04-01T08:08:27Z

📝 [actionlint] _{reported by reviewdog 🐶}
shellcheck reported issue in this script: SC2086:info:1:6: Double quote to prevent globbing and word splitting [shellcheck]

Android/.github/workflows/android-maintenance-worker.lock.yml

Line 226 in ad72537

run: bash ${RUNNER_TEMP}/gh-aw/actions/validate_prompt_placeholders.sh

daxmobile · 2026-04-01T08:08:27Z

📝 [actionlint] _{reported by reviewdog 🐶}
shellcheck reported issue in this script: SC2086:info:1:6: Double quote to prevent globbing and word splitting [shellcheck]

Android/.github/workflows/android-maintenance-worker.lock.yml

Line 231 in ad72537

run: bash ${RUNNER_TEMP}/gh-aw/actions/print_prompt_summary.sh

Replace MCP server and curl-based Asana access with two inline mcp-scripts that run outside the sandbox: asana_get_section_tasks and asana_get_task. This avoids strict mode restrictions on passing secrets to the agent container. Remove all Asana write operations (move task, leave comments) from the workflow since mcp-scripts are read-only. The agent now fetches the task URL and details, implements the work, and opens a draft PR. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

daxmobile

Remaining comments which cannot be posted as a review comment to avoid GitHub Rate Limit

actionlint

📝 [actionlint] _{reported by reviewdog 🐶}
shellcheck reported issue in this script: SC2086:info:1:6: Double quote to prevent globbing and word splitting [shellcheck]

Android/.github/workflows/android-maintenance-worker.lock.yml

Line 857 in 6621d33

run: bash ${RUNNER_TEMP}/gh-aw/actions/append_agent_step_summary.sh

📝 [actionlint] _{reported by reviewdog 🐶}
shellcheck reported issue in this script: SC2086:info:1:6: Double quote to prevent globbing and word splitting [shellcheck]

Android/.github/workflows/android-maintenance-worker.lock.yml

Line 1111 in 6621d33

    
           run: bash ${RUNNER_TEMP}/gh-aw/actions/download_docker_images.sh ghcr.io/github/gh-aw-firewall/agent:0.25.4 ghcr.io/github/gh-aw-firewall/api-proxy:0.25.4 ghcr.io/github/gh-aw-firewall/squid:0.25.4

📝 [actionlint] _{reported by reviewdog 🐶}
shellcheck reported issue in this script: SC2086:info:1:6: Double quote to prevent globbing and word splitting [shellcheck]

Android/.github/workflows/android-maintenance-worker.lock.yml

Line 1170 in 6621d33

run: bash ${RUNNER_TEMP}/gh-aw/actions/install_awf_binary.sh v0.25.4

daxmobile · 2026-04-01T08:25:36Z

📝 [actionlint] _{reported by reviewdog 🐶}
shellcheck reported issue in this script: SC2086:info:1:6: Double quote to prevent globbing and word splitting [shellcheck]

Android/.github/workflows/android-maintenance-worker.lock.yml

Line 280 in 6621d33

run: bash ${RUNNER_TEMP}/gh-aw/actions/configure_gh_for_ghe.sh

cursor · 2026-04-01T09:30:54Z

+            startHttpServer(configPath, {
+              port: port,
+              stateless: true,
+              logDir: "${RUNNER_TEMP}/gh-aw/mcp-scripts/logs"


API key read but never passed to server

Medium Severity

In the generated mcp-server.cjs, the apiKey variable is read from process.env.GH_AW_MCP_SCRIPTS_API_KEY but never passed to startHttpServer(). The options object only includes port, stateless, and logDir — missing the apiKey. This means the MCP scripts HTTP server likely won't validate the Authorization header on incoming requests, even though the MCP Gateway is configured to send one. Depending on the startHttpServer implementation, this could mean the server accepts unauthenticated requests from any process on the host network.

_{Please tell me if this was useful or not with a 👍 or 👎.}

daxmobile

Remaining comments which cannot be posted as a review comment to avoid GitHub Rate Limit

actionlint

📝 [actionlint] _{reported by reviewdog 🐶}
shellcheck reported issue in this script: SC2086:info:1:6: Double quote to prevent globbing and word splitting [shellcheck]

Android/.github/workflows/daily-repo-status.lock.yml

Line 334 in 7492548

    
           run: bash ${RUNNER_TEMP}/gh-aw/actions/download_docker_images.sh ghcr.io/github/gh-aw-firewall/agent:0.25.4 ghcr.io/github/gh-aw-firewall/api-proxy:0.25.4 ghcr.io/github/gh-aw-firewall/squid:0.25.4 ghcr.io/github/gh-aw-mcpg:v0.2.9 ghcr.io/github/github-mcp-server:v0.32.0 node:lts-alpine

📝 [actionlint] _{reported by reviewdog 🐶}
shellcheck reported issue in this script: SC2086:info:1:10: Double quote to prevent globbing and word splitting [shellcheck]

Android/.github/workflows/daily-repo-status.lock.yml

Line 336 in 7492548

run: |

📝 [actionlint] _{reported by reviewdog 🐶}
shellcheck reported issue in this script: SC2086:info:4:7: Double quote to prevent globbing and word splitting [shellcheck]

Android/.github/workflows/daily-repo-status.lock.yml

Line 336 in 7492548

run: |

📝 [actionlint] _{reported by reviewdog 🐶}
shellcheck reported issue in this script: SC2086:info:104:6: Double quote to prevent globbing and word splitting [shellcheck]

Android/.github/workflows/daily-repo-status.lock.yml

Line 344 in 7492548

run: |

📝 [actionlint] _{reported by reviewdog 🐶}
shellcheck reported issue in this script: SC2086:info:10:7: Double quote to prevent globbing and word splitting [shellcheck]

Android/.github/workflows/daily-repo-status.lock.yml

Line 344 in 7492548

run: |

📝 [actionlint] _{reported by reviewdog 🐶}
shellcheck reported issue in this script: SC2086:info:1:7: Double quote to prevent globbing and word splitting [shellcheck]

Android/.github/workflows/daily-repo-status.lock.yml

Line 344 in 7492548

run: |

📝 [actionlint] _{reported by reviewdog 🐶}
shellcheck reported issue in this script: SC2086:info:9:6: Double quote to prevent globbing and word splitting [shellcheck]

Android/.github/workflows/daily-repo-status.lock.yml

Line 476 in 7492548

run: |

📝 [actionlint] _{reported by reviewdog 🐶}
shellcheck reported issue in this script: SC2086:info:18:53: Double quote to prevent globbing and word splitting [shellcheck]

Android/.github/workflows/daily-repo-status.lock.yml

Line 496 in 7492548

run: |

📝 [actionlint] _{reported by reviewdog 🐶}
shellcheck reported issue in this script: SC2086:info:1:6: Double quote to prevent globbing and word splitting [shellcheck]

Android/.github/workflows/daily-repo-status.lock.yml

Line 562 in 7492548

run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh

📝 [actionlint] _{reported by reviewdog 🐶}
shellcheck reported issue in this script: SC2086:info:1:6: Double quote to prevent globbing and word splitting [shellcheck]

Android/.github/workflows/daily-repo-status.lock.yml

Line 681 in 7492548

run: |

📝 [actionlint] _{reported by reviewdog 🐶}
shellcheck reported issue in this script: SC2086:info:1:6: Double quote to prevent globbing and word splitting [shellcheck]

Android/.github/workflows/daily-repo-status.lock.yml

Line 700 in 7492548

run: bash ${RUNNER_TEMP}/gh-aw/actions/append_agent_step_summary.sh

📝 [actionlint] _{reported by reviewdog 🐶}
shellcheck reported issue in this script: SC2086:info:1:6: Double quote to prevent globbing and word splitting [shellcheck]

Android/.github/workflows/daily-repo-status.lock.yml

Line 935 in 7492548

    
           run: bash ${RUNNER_TEMP}/gh-aw/actions/download_docker_images.sh ghcr.io/github/gh-aw-firewall/agent:0.25.4 ghcr.io/github/gh-aw-firewall/api-proxy:0.25.4 ghcr.io/github/gh-aw-firewall/squid:0.25.4

📝 [actionlint] _{reported by reviewdog 🐶}
shellcheck reported issue in this script: SC2086:info:1:6: Double quote to prevent globbing and word splitting [shellcheck]

Android/.github/workflows/daily-repo-status.lock.yml

Line 994 in 7492548

run: bash ${RUNNER_TEMP}/gh-aw/actions/install_awf_binary.sh v0.25.4

When a PR is created or labeled with `agentic-maintenance`, this workflow extracts the Asana task from the PR body and moves it to the In Review section of the Agentic Backlog. Requires repo variables GH_AGENTIC_BACKLOG_PROJECT_ID and GH_AGENTIC_BACKLOG_IN_REVIEW_SECTION_ID to be configured. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

daxmobile

Remaining comments which cannot be posted as a review comment to avoid GitHub Rate Limit

actionlint

📝 [actionlint] _{reported by reviewdog 🐶}
shellcheck reported issue in this script: SC2086:info:1:6: Double quote to prevent globbing and word splitting [shellcheck]

Android/.github/workflows/daily-repo-status.lock.yml

Line 700 in 6a093dd

run: bash ${RUNNER_TEMP}/gh-aw/actions/append_agent_step_summary.sh

📝 [actionlint] _{reported by reviewdog 🐶}
shellcheck reported issue in this script: SC2086:info:1:6: Double quote to prevent globbing and word splitting [shellcheck]

Android/.github/workflows/daily-repo-status.lock.yml

Line 935 in 6a093dd

    
           run: bash ${RUNNER_TEMP}/gh-aw/actions/download_docker_images.sh ghcr.io/github/gh-aw-firewall/agent:0.25.4 ghcr.io/github/gh-aw-firewall/api-proxy:0.25.4 ghcr.io/github/gh-aw-firewall/squid:0.25.4

📝 [actionlint] _{reported by reviewdog 🐶}
shellcheck reported issue in this script: SC2086:info:1:6: Double quote to prevent globbing and word splitting [shellcheck]

Android/.github/workflows/daily-repo-status.lock.yml

Line 994 in 6a093dd

run: bash ${RUNNER_TEMP}/gh-aw/actions/install_awf_binary.sh v0.25.4

The previous Step 1 relied on persistent repo memory as the primary gate, which is unreliable in CI (memory may not persist between runs or may be stale). It also lacked an explicit stop for the common case of a healthy open PR, letting the agent fall through to Step 2. Now Step 1 checks live state first: it queries the Asana In Progress section and lists open [Android Maintenance] PRs. Only if both are empty does it proceed to pick a new task. Memory is kept as a hint to locate the task/PR faster, not as the decision mechanism. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

There are 2 total unresolved issues (including 1 from previous review).

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

daxmobile

Remaining comments which cannot be posted as a review comment to avoid GitHub Rate Limit

actionlint

📝 [actionlint] _{reported by reviewdog 🐶}
shellcheck reported issue in this script: SC2086:info:1:6: Double quote to prevent globbing and word splitting [shellcheck]

Android/.github/workflows/android-maintenance-worker.lock.yml

Line 1113 in cd99791

    
           run: bash ${RUNNER_TEMP}/gh-aw/actions/download_docker_images.sh ghcr.io/github/gh-aw-firewall/agent:0.25.4 ghcr.io/github/gh-aw-firewall/api-proxy:0.25.4 ghcr.io/github/gh-aw-firewall/squid:0.25.4

📝 [actionlint] _{reported by reviewdog 🐶}
shellcheck reported issue in this script: SC2086:info:1:6: Double quote to prevent globbing and word splitting [shellcheck]

Android/.github/workflows/android-maintenance-worker.lock.yml

Line 1172 in cd99791

run: bash ${RUNNER_TEMP}/gh-aw/actions/install_awf_binary.sh v0.25.4

daxmobile · 2026-04-01T13:55:16Z

+          {"create_pull_request":{"base_branch":"develop","draft":true,"github-token":"${{ secrets.GT_DAXMOBILE }}","labels":["agentic-maintenance"],"max":1,"max_patch_size":1024,"protected_files":["package.json","bun.lockb","bunfig.toml","deno.json","deno.jsonc","deno.lock","global.json","NuGet.Config","Directory.Packages.props","mix.exs","mix.lock","go.mod","go.sum","stack.yaml","stack.yaml.lock","pom.xml","build.gradle","build.gradle.kts","settings.gradle","settings.gradle.kts","gradle.properties","package-lock.json","yarn.lock","pnpm-lock.yaml","npm-shrinkwrap.json","requirements.txt","Pipfile","Pipfile.lock","pyproject.toml","setup.py","setup.cfg","Gemfile","Gemfile.lock","uv.lock","CODEOWNERS"],"protected_path_prefixes":[".github/",".agents/"],"title_prefix":"[Android Maintenance] "},"mentions":{"enabled":false},"missing_data":{},"missing_tool":{},"noop":{"max":1,"report-as-issue":"true"}}
+          GH_AW_SAFE_OUTPUTS_CONFIG_876e01d037e1f83a_EOF
      - name: Write Safe Outputs Tools
        run: |


📝 [actionlint] _{reported by reviewdog 🐶}
shellcheck reported issue in this script: SC2086:info:107:6: Double quote to prevent globbing and word splitting [shellcheck]

daxmobile · 2026-04-01T13:55:16Z

+          {"create_pull_request":{"base_branch":"develop","draft":true,"github-token":"${{ secrets.GT_DAXMOBILE }}","labels":["agentic-maintenance"],"max":1,"max_patch_size":1024,"protected_files":["package.json","bun.lockb","bunfig.toml","deno.json","deno.jsonc","deno.lock","global.json","NuGet.Config","Directory.Packages.props","mix.exs","mix.lock","go.mod","go.sum","stack.yaml","stack.yaml.lock","pom.xml","build.gradle","build.gradle.kts","settings.gradle","settings.gradle.kts","gradle.properties","package-lock.json","yarn.lock","pnpm-lock.yaml","npm-shrinkwrap.json","requirements.txt","Pipfile","Pipfile.lock","pyproject.toml","setup.py","setup.cfg","Gemfile","Gemfile.lock","uv.lock","CODEOWNERS"],"protected_path_prefixes":[".github/",".agents/"],"title_prefix":"[Android Maintenance] "},"mentions":{"enabled":false},"missing_data":{},"missing_tool":{},"noop":{"max":1,"report-as-issue":"true"}}
+          GH_AW_SAFE_OUTPUTS_CONFIG_876e01d037e1f83a_EOF
      - name: Write Safe Outputs Tools
        run: |


📝 [actionlint] _{reported by reviewdog 🐶}
shellcheck reported issue in this script: SC2086:info:10:7: Double quote to prevent globbing and word splitting [shellcheck]

daxmobile · 2026-04-01T13:55:16Z

+          {"create_pull_request":{"base_branch":"develop","draft":true,"github-token":"${{ secrets.GT_DAXMOBILE }}","labels":["agentic-maintenance"],"max":1,"max_patch_size":1024,"protected_files":["package.json","bun.lockb","bunfig.toml","deno.json","deno.jsonc","deno.lock","global.json","NuGet.Config","Directory.Packages.props","mix.exs","mix.lock","go.mod","go.sum","stack.yaml","stack.yaml.lock","pom.xml","build.gradle","build.gradle.kts","settings.gradle","settings.gradle.kts","gradle.properties","package-lock.json","yarn.lock","pnpm-lock.yaml","npm-shrinkwrap.json","requirements.txt","Pipfile","Pipfile.lock","pyproject.toml","setup.py","setup.cfg","Gemfile","Gemfile.lock","uv.lock","CODEOWNERS"],"protected_path_prefixes":[".github/",".agents/"],"title_prefix":"[Android Maintenance] "},"mentions":{"enabled":false},"missing_data":{},"missing_tool":{},"noop":{"max":1,"report-as-issue":"true"}}
+          GH_AW_SAFE_OUTPUTS_CONFIG_876e01d037e1f83a_EOF
      - name: Write Safe Outputs Tools
        run: |


📝 [actionlint] _{reported by reviewdog 🐶}
shellcheck reported issue in this script: SC2086:info:1:7: Double quote to prevent globbing and word splitting [shellcheck]

daxmobile · 2026-04-01T13:55:16Z

          bash ${RUNNER_TEMP}/gh-aw/actions/start_safe_outputs_server.sh

+      - name: Setup MCP Scripts Config
+        run: |


📝 [actionlint] _{reported by reviewdog 🐶}
shellcheck reported issue in this script: SC2086:info:1:10: Double quote to prevent globbing and word splitting [shellcheck]

daxmobile · 2026-04-01T13:55:16Z

          bash ${RUNNER_TEMP}/gh-aw/actions/start_safe_outputs_server.sh

+      - name: Setup MCP Scripts Config
+        run: |


📝 [actionlint] _{reported by reviewdog 🐶}
shellcheck reported issue in this script: SC2086:info:2:7: Double quote to prevent globbing and word splitting [shellcheck]

daxmobile · 2026-04-01T13:55:16Z

          bash ${RUNNER_TEMP}/gh-aw/actions/start_safe_outputs_server.sh

+      - name: Setup MCP Scripts Config
+        run: |


📝 [actionlint] _{reported by reviewdog 🐶}
shellcheck reported issue in this script: SC2086:info:53:7: Double quote to prevent globbing and word splitting [shellcheck]

daxmobile · 2026-04-01T13:55:16Z

          bash ${RUNNER_TEMP}/gh-aw/actions/start_safe_outputs_server.sh

+      - name: Setup MCP Scripts Config
+        run: |


📝 [actionlint] _{reported by reviewdog 🐶}
shellcheck reported issue in this script: SC2086:info:68:10: Double quote to prevent globbing and word splitting [shellcheck]

daxmobile · 2026-04-01T13:55:16Z

+          chmod +x ${RUNNER_TEMP}/gh-aw/mcp-scripts/mcp-server.cjs
+
+      - name: Setup MCP Scripts Tool Files
+        run: |


📝 [actionlint] _{reported by reviewdog 🐶}
shellcheck reported issue in this script: SC2086:info:17:7: Double quote to prevent globbing and word splitting [shellcheck]

daxmobile · 2026-04-01T13:55:16Z

+          chmod +x ${RUNNER_TEMP}/gh-aw/mcp-scripts/mcp-server.cjs
+
+      - name: Setup MCP Scripts Tool Files
+        run: |


📝 [actionlint] _{reported by reviewdog 🐶}
shellcheck reported issue in this script: SC2086:info:1:7: Double quote to prevent globbing and word splitting [shellcheck]

daxmobile · 2026-04-01T13:55:16Z

+          GH_AW_MCP_SCRIPTS_PORT: ${{ steps.mcp-scripts-config.outputs.mcp_scripts_port }}
+          GH_AW_MCP_SCRIPTS_API_KEY: ${{ steps.mcp-scripts-config.outputs.mcp_scripts_api_key }}
+          ASANA_ACCESS_TOKEN: ${{ secrets.ASANA_ACCESS_TOKEN }}
+        run: |


📝 [actionlint] _{reported by reviewdog 🐶}
shellcheck reported issue in this script: SC2086:info:6:6: Double quote to prevent globbing and word splitting [shellcheck]

daxmobile · 2026-04-01T13:55:19Z

📝 [actionlint] _{reported by reviewdog 🐶}
shellcheck reported issue in this script: SC2086:info:1:6: Double quote to prevent globbing and word splitting [shellcheck]

Android/.github/workflows/android-maintenance-worker.lock.yml

Line 282 in cd99791

run: bash ${RUNNER_TEMP}/gh-aw/actions/configure_gh_for_ghe.sh

daxmobile · 2026-04-01T13:55:20Z

📝 [actionlint] _{reported by reviewdog 🐶}
shellcheck reported issue in this script: SC2086:info:1:6: Double quote to prevent globbing and word splitting [shellcheck]

Android/.github/workflows/android-maintenance-worker.lock.yml

Line 317 in cd99791

run: bash ${RUNNER_TEMP}/gh-aw/actions/install_awf_binary.sh v0.25.4

daxmobile · 2026-04-01T13:55:21Z

📝 [actionlint] _{reported by reviewdog 🐶}
shellcheck reported issue in this script: SC2086:info:1:6: Double quote to prevent globbing and word splitting [shellcheck]

Android/.github/workflows/android-maintenance-worker.lock.yml

Line 331 in cd99791

run: bash ${RUNNER_TEMP}/gh-aw/actions/download_docker_images.sh ghcr.io/github/gh-aw-firewall/agent:0.25.4 ghcr.io/github/gh-aw-firewall/api-proxy:0.25.4 ghcr.io/github/gh-aw-firewall/squid:0.25.4 ghcr.io/github/gh-aw-mcpg:v0.2.9 ghcr.io/github/github-mcp-server:v0.32.0 node:lts-alpine

daxmobile · 2026-04-01T13:55:22Z

📝 [actionlint] _{reported by reviewdog 🐶}
shellcheck reported issue in this script: SC2086:info:1:10: Double quote to prevent globbing and word splitting [shellcheck]

Android/.github/workflows/android-maintenance-worker.lock.yml

Line 333 in cd99791

run: |

daxmobile · 2026-04-01T13:55:22Z

📝 [actionlint] _{reported by reviewdog 🐶}
shellcheck reported issue in this script: SC2086:info:4:7: Double quote to prevent globbing and word splitting [shellcheck]

Android/.github/workflows/android-maintenance-worker.lock.yml

Line 333 in cd99791

run: |

daxmobile · 2026-04-01T13:55:23Z

📝 [actionlint] _{reported by reviewdog 🐶}
shellcheck reported issue in this script: SC2086:info:9:6: Double quote to prevent globbing and word splitting [shellcheck]

Android/.github/workflows/android-maintenance-worker.lock.yml

Line 476 in cd99791

run: |

daxmobile · 2026-04-01T13:55:24Z

📝 [actionlint] _{reported by reviewdog 🐶}
shellcheck reported issue in this script: SC2086:info:18:53: Double quote to prevent globbing and word splitting [shellcheck]

Android/.github/workflows/android-maintenance-worker.lock.yml

Line 638 in cd99791

run: |

daxmobile · 2026-04-01T13:55:25Z

📝 [actionlint] _{reported by reviewdog 🐶}
shellcheck reported issue in this script: SC2086:info:1:6: Double quote to prevent globbing and word splitting [shellcheck]

Android/.github/workflows/android-maintenance-worker.lock.yml

Line 718 in cd99791

run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh

daxmobile · 2026-04-01T13:55:26Z

📝 [actionlint] _{reported by reviewdog 🐶}
shellcheck reported issue in this script: SC2086:info:1:6: Double quote to prevent globbing and word splitting [shellcheck]

Android/.github/workflows/android-maintenance-worker.lock.yml

Line 838 in cd99791

run: |

daxmobile · 2026-04-01T13:55:27Z

📝 [actionlint] _{reported by reviewdog 🐶}
shellcheck reported issue in this script: SC2086:info:1:6: Double quote to prevent globbing and word splitting [shellcheck]

Android/.github/workflows/android-maintenance-worker.lock.yml

Line 859 in cd99791

run: bash ${RUNNER_TEMP}/gh-aw/actions/append_agent_step_summary.sh

Add allow list to Agentic Workflow

b3e65df

daxmobile reviewed Mar 31, 2026

View reviewed changes

daxmobile reviewed Apr 1, 2026

View reviewed changes

malmstein and others added 2 commits April 1, 2026 09:58

Remove ddg-ai-config APM dependency

ad72537

Simplify the workflow to just the Asana MCP server with ASANA_ACCESS_TOKEN. The ddg-ai-config integration can be added later once APM auth is sorted out. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

daxmobile reviewed Apr 1, 2026

View reviewed changes

malmstein marked this pull request as ready for review April 1, 2026 09:22

cursor bot reviewed Apr 1, 2026

View reviewed changes

add PR label in safe outputs

7492548

daxmobile reviewed Apr 1, 2026

View reviewed changes

cursor bot reviewed Apr 1, 2026

View reviewed changes

Comment thread .github/workflows/android-maintenance-worker.lock.yml

Fix SC2129 shellcheck error in both lock files

cd99791

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

daxmobile reviewed Apr 1, 2026

View reviewed changes

Conversation

malmstein commented Mar 31, 2026 • edited by cursor bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Steps to test this PR

UI changes

Uh oh!

malmstein commented Mar 31, 2026

Uh oh!

daxmobile left a comment

Choose a reason for hiding this comment

Uh oh!

daxmobile left a comment

Choose a reason for hiding this comment

Uh oh!

daxmobile left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

daxmobile left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cursor bot Apr 1, 2026

Choose a reason for hiding this comment

API key read but never passed to server

Uh oh!

daxmobile left a comment

Choose a reason for hiding this comment

Uh oh!

daxmobile left a comment

Choose a reason for hiding this comment

Uh oh!

cursor bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

daxmobile left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

malmstein commented Mar 31, 2026 •

edited by cursor bot

Loading