fix: provision uv and Python for feature-assess workflow - #4193
Merged
Conversation
The feature-assess agentic workflow installs and runs the Spec Kit CLI via `uv`/`python3`, but its job had no `steps:` to provision them, so `uv`/`uv tool install`/`python3` were unavailable inside the gh-aw firewall agent container (only Node is preinstalled). This mirrors the `bug-test` workflow, which already sets up uv + Python. Add `Setup uv` (astral-sh/setup-uv) and `Set up Python` (actions/setup-python) steps to feature-assess.md, recompile the lock file, and note in Step 1 that both are preinstalled by the setup steps. Assisted-by: GitHub Copilot (model: Claude Opus 4.8, autonomous) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Provisions uv and Python for the feature-assess agent workflow.
Changes:
- Adds pinned uv and Python 3.14 setup actions.
- Updates agent instructions and recompiles the workflow lock file.
Show a summary per file
| File | Description |
|---|---|
.github/workflows/feature-assess.md |
Adds runtime provisioning and updates setup guidance. |
.github/workflows/feature-assess.lock.yml |
Includes generated setup steps and manifest entries. |
Review details
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
- Files reviewed: 2/2 changed files
- Comments generated: 3
- Review effort level: Balanced
| checkout: | ||
| fetch-depth: 0 | ||
|
|
||
| steps: |
| # gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"49f48fbf92ee513b77a599afb7df6a9e43d894bfe7a87df3246e7aa4f9e25cda","body_hash":"638ad2f6bcd43ab6d0cadabdc9fdb901a207b6fef0935a8c816d0de39163dabc","compiler_version":"v0.79.8","strict":true,"agent_id":"copilot","engine_versions":{"copilot":"1.0.60"}} | ||
| # gh-aw-manifest: {"version":1,"secrets":["COPILOT_GITHUB_TOKEN","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/checkout","sha":"df4cb1c069e1874edd31b4311f1884172cec0e10","version":"v6.0.3"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e","version":"v6.4.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"},{"repo":"github/gh-aw-actions/setup","sha":"c0338fef4749d08c21f8f975fb0e37efa17dda47","version":"v0.79.8"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.27.2","digest":"sha256:f88e5b17b6b7a600117bc121114d6ce2155c88c983c0c939c5df884f730fa1d6","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.27.2@sha256:f88e5b17b6b7a600117bc121114d6ce2155c88c983c0c939c5df884f730fa1d6"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.2","digest":"sha256:ee39841d980878ebbb87592903b06d31a1af500c71525c9616f7e8e2a27041a4","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.2@sha256:ee39841d980878ebbb87592903b06d31a1af500c71525c9616f7e8e2a27041a4"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.27.2","digest":"sha256:2e3a717e5f19a654cd9a2263beb52012b56bcb68562ec5ae2e42f9d156b49591","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.27.2@sha256:2e3a717e5f19a654cd9a2263beb52012b56bcb68562ec5ae2e42f9d156b49591"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.3.25","digest":"sha256:c10331ad17668ef89f38f5e356678788a40b0cd5fef96e8f92e1d9c1de47cbaa","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.3.25@sha256:c10331ad17668ef89f38f5e356678788a40b0cd5fef96e8f92e1d9c1de47cbaa"},{"image":"ghcr.io/github/github-mcp-server:v1.1.2","digest":"sha256:30197479d8036c7811892bc07e06f9a05c9ef3cdd79bc59f256d50647f95788c","pinned_image":"ghcr.io/github/github-mcp-server:v1.1.2@sha256:30197479d8036c7811892bc07e06f9a05c9ef3cdd79bc59f256d50647f95788c"}]} | ||
| # gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"d4b11e8834194e5ba08dc1227894d0541d7922c4ceb6e82e77cca7eff16303ae","body_hash":"7770cfec9b7854f5c835b8e4645396ba2b0c212ff4a27df2ec03865d6186fc47","compiler_version":"v0.79.8","strict":true,"agent_id":"copilot","engine_versions":{"copilot":"1.0.60"}} | ||
| # gh-aw-manifest: {"version":1,"secrets":["COPILOT_GITHUB_TOKEN","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/checkout","sha":"df4cb1c069e1874edd31b4311f1884172cec0e10","version":"v6.0.3"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e","version":"v6.4.0"},{"repo":"actions/setup-python","sha":"5fda3b95a4ea91299a34e894583c3862153e4b97","version":"5fda3b95a4ea91299a34e894583c3862153e4b97"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"},{"repo":"astral-sh/setup-uv","sha":"c771a70e6277c0a99b617c7a806ffedaca235ff9","version":"c771a70e6277c0a99b617c7a806ffedaca235ff9"},{"repo":"github/gh-aw-actions/setup","sha":"c0338fef4749d08c21f8f975fb0e37efa17dda47","version":"v0.79.8"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.27.2","digest":"sha256:f88e5b17b6b7a600117bc121114d6ce2155c88c983c0c939c5df884f730fa1d6","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.27.2@sha256:f88e5b17b6b7a600117bc121114d6ce2155c88c983c0c939c5df884f730fa1d6"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.2","digest":"sha256:ee39841d980878ebbb87592903b06d31a1af500c71525c9616f7e8e2a27041a4","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.2@sha256:ee39841d980878ebbb87592903b06d31a1af500c71525c9616f7e8e2a27041a4"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.27.2","digest":"sha256:2e3a717e5f19a654cd9a2263beb52012b56bcb68562ec5ae2e42f9d156b49591","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.27.2@sha256:2e3a717e5f19a654cd9a2263beb52012b56bcb68562ec5ae2e42f9d156b49591"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.3.25","digest":"sha256:c10331ad17668ef89f38f5e356678788a40b0cd5fef96e8f92e1d9c1de47cbaa","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.3.25@sha256:c10331ad17668ef89f38f5e356678788a40b0cd5fef96e8f92e1d9c1de47cbaa"},{"image":"ghcr.io/github/github-mcp-server:v1.1.2","digest":"sha256:30197479d8036c7811892bc07e06f9a05c9ef3cdd79bc59f256d50647f95788c","pinned_image":"ghcr.io/github/github-mcp-server:v1.1.2@sha256:30197479d8036c7811892bc07e06f9a05c9ef3cdd79bc59f256d50647f95788c"}]} |
Comment on lines
+38
to
+44
| steps: | ||
| - name: Setup uv | ||
| uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0 | ||
| - name: Set up Python | ||
| uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 | ||
| with: | ||
| python-version: "3.14" |
mnriem
added a commit
that referenced
this pull request
Aug 18, 2026
…st setup steps (#4195) The prior fix (#4193) added setup-uv/setup-python actions but the CLI was still installed by the agent at runtime, which fails: inside the gh-aw firewall container `uv` is not on PATH, bare `python3` resolves to PyPy, and the Copilot permission gate blocks ad-hoc interpreter/installer fallbacks. As a result `specify` never installed and the assess skills only "worked" by the agent reading raw command files. Move provisioning into host setup steps that run before the agent starts (full network, working PATH): - Install the CLI with `uv pip install --system` so the `specify` entry point lands in the tool-cache Python bin the agent container adds to PATH. - Run `specify init --here --integration copilot` and `specify extension add assess` on the host so the five `speckit.assess.*` skills exist when the agent runs. Rewrite intro + Step 1 so the agent confirms (not installs) the preinstalled environment, and renumber the pipeline steps accordingly. Mark the setup steps `continue-on-error` so a provisioning failure still lets the agent start and post the operational-failure comment instead of hard-failing the job. Recompile feature-assess.lock.yml. Assisted-by: GitHub Copilot (model: Claude Opus 4.8, autonomous) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: ed10e45c-6fce-48c8-815f-cf905a4e553f
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The
feature-assessagentic workflow installs and runs the Spec Kit CLI viauv/uv tool install/python3, but its agent job had nosteps:to provision them. The Copilot agent runs inside the gh-aw firewall container (ghcr.io/github/gh-aw-firewall/agent), which only preinstalls Node — souv,uvx, andpython3were unavailable and the run failed at Step 1 (uv tool install specify-cli).Observed in a live run: https://github.com/github/spec-kit/actions/runs/32171106335/job/95822422096
Fix
Mirror the existing
bug-testworkflow, which already provisions uv + Python:steps:block to.github/workflows/feature-assess.md:astral-sh/setup-uv@v9.0.0actions/setup-python@v7.0.0(Python 3.14)curl | shfallback is kept as a safety net)..github/workflows/feature-assess.lock.ymlviagh aw compile(v0.79.8, the repo-pinned compiler). The lock diff is minimal — only the two setup steps plus manifest entries.Validation
tests/test_github_workflows.pypasses (SHA-pin / consistency checks).git diff --checkis clean..gitattributes-whitespaceexemption for generated lock files is preserved (a stray rewrite from the compiler was reverted).🤖 Opened by GitHub Copilot (model: Claude Opus 4.8) on behalf of @mnriem.