Repository navigation
fix(gh-aw): preserve Windows/XDG gh extension env in verifier and align quickstart safe-update docs - #2433
Merged
Conversation
…gn quickstart safe-update docs - Preserve APPDATA, GH_DATA_DIR, LOCALAPPDATA, SystemRoot, TEMP, TMP, USERPROFILE, XDG_CONFIG_HOME, and XDG_DATA_HOME in squad-install-verifier.mjs spawnChecked() so strict-compile on Windows finds the pinned gh-aw extension instead of falling back to an unpinned install. - Update the first-install safe-update allowlist in the GH-AW guide and gh-aw-enlistment skill to include GH_AW_GITHUB_READ_APP_PRIVATE_KEY alongside SQUAD_GITHUB_APP_PRIVATE_KEY, SQUAD_GITHUB_TOKEN, and github/squad/.github/actions/squad-init. - Scope preflight gh auth status to --hostname github.com so multi-host setups do not fail under set -euo pipefail. - Refresh workflows/squad-workflows.manifest.json and embedded verifier digests. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Contributor
🟠 Impact Analysis — PR #2433Risk tier: 🟠 HIGH 📊 Summary
🎯 Risk Factors
📦 Modules Affecteddocs (1 file)
root (7 files)
squad-cli (1 file)
squad-sdk (1 file)
templates (1 file)
tests (1 file)
This report is generated automatically for every PR. See #733 for details. |
Contributor
🛫 PR Readiness Check
PR Scope: 🔧 Infrastructure
|
| Status | Check | Details |
|---|---|---|
| ❌ | Single commit | 2 commits — consider squashing before review |
| ✅ | Not in draft | Ready for review |
| ✅ | Branch up to date | Up to date with dev |
| ❌ | Copilot review | No Copilot review yet — it may still be processing |
| ✅ | Changeset present | Changeset file found |
| ✅ | Scope clean | No .squad/ or docs/proposals/ files |
| ✅ | No merge conflicts | No merge conflicts |
| ❌ | Copilot threads resolved | 1 unresolved Copilot thread(s) — fix and resolve before merging |
| ✅ | CI passing | All checks passing |
Files Changed (12 files, +131 −77)
| File | +/− |
|---|---|
.changeset/gh-aw-windows-verifier-and-quickstart.md |
+6 −0 |
.squad-templates/skills/gh-aw-enlistment/SKILL.md |
+11 −11 |
docs/src/content/docs/guide/gh-aw.md |
+10 −8 |
packages/squad-cli/templates/skills/gh-aw-enlistment/SKILL.md |
+11 −11 |
packages/squad-sdk/templates/skills/gh-aw-enlistment/SKILL.md |
+11 −11 |
templates/skills/gh-aw-enlistment/SKILL.md |
+11 −11 |
test/gh-aw-enlistment-skill.test.ts |
+27 −4 |
workflows/package/squad-bootstrap.md |
+1 −1 |
workflows/shared/squad-install-verifier.mjs |
+24 −1 |
workflows/skills/gh-aw-enlistment/SKILL.md |
+11 −11 |
workflows/squad-bootstrap.md |
+1 −1 |
workflows/squad-workflows.manifest.json |
+7 −7 |
Total: +131 −77
This check runs automatically on every push. Fix any ❌ items and push again.
See CONTRIBUTING.md and PR Requirements for details.
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
The bundled template changes lack a required changeset or CHANGELOG.md update, causing the changelog CI gate to fail unless the documented skip-changelog exemption is granted.
1 open issue
What changed in this PR
This PR addresses GH-AW onboarding issues by preserving Windows/XDG environment settings during verification and aligning Squad’s installation guidance with the expected safe-update report.
Changes:
- Preserve environment variables needed for extension discovery and refresh verifier-related digests.
- Document all three restricted secrets and scope authentication checks to
github.comacross enlistment skills. - Clarify optional editor-file staging and update regression assertions.
| File | Description |
|---|---|
workflows/squad-workflows.manifest.json |
Refresh verifier, skill, and bootstrap hashes. |
workflows/squad-bootstrap.md |
Update the embedded verifier digest. |
workflows/skills/gh-aw-enlistment/SKILL.md |
Align packaged authentication and safe-update guidance. |
workflows/shared/squad-install-verifier.mjs |
Expand the subprocess environment allowlist. |
workflows/package/squad-bootstrap.md |
Synchronize the packaged verifier digest. |
test/gh-aw-enlistment-skill.test.ts |
Assert environment keys and revised documentation contracts. |
templates/skills/gh-aw-enlistment/SKILL.md |
Synchronize root template guidance. |
packages/squad-sdk/templates/skills/gh-aw-enlistment/SKILL.md |
Synchronize SDK template guidance. |
packages/squad-cli/templates/skills/gh-aw-enlistment/SKILL.md |
Synchronize CLI template guidance. |
docs/src/content/docs/guide/gh-aw.md |
Update preflight, safe-update, and editor-file instructions. |
.squad-templates/skills/gh-aw-enlistment/SKILL.md |
Update canonical enlistment guidance. |
Review effort: Balanced (auto)
|
|
||
| <!-- allowlist-start --> | ||
| - Restricted secrets: **`SQUAD_GITHUB_APP_PRIVATE_KEY`** and **`SQUAD_GITHUB_TOKEN`** | ||
| - Restricted secrets: **`GH_AW_GITHUB_READ_APP_PRIVATE_KEY`**, **`SQUAD_GITHUB_APP_PRIVATE_KEY`**, and **`SQUAD_GITHUB_TOKEN`** |
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
tamirdresher
added a commit
that referenced
this pull request
Nov 9, 2026
Updates the approved SQUAD_SHA in the GH-AW guide to the merge commit of #2433 (�37155bef49c8e2ff6a211dfe71bda53157bc92f), which includes the Windows verifier environment fix and updated safe-update allowlist. Co-authored-by: Copilot <Copilot@users.noreply.github.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes newcomer bugs found during the live GH-AW Quick Start end-to-end run:
workflows/shared/squad-install-verifier.mjs): PreservesAPPDATA,GH_DATA_DIR,LOCALAPPDATA,SystemRoot,TEMP,TMP,USERPROFILE,XDG_CONFIG_HOME, andXDG_DATA_HOMEinspawnChecked()so--strict-compileon Windows resolves the pinnedgh-awextension in%LOCALAPPDATA%\GitHub CLI\extensions\gh-aw. Updatesworkflows/squad-workflows.manifest.jsonand embedded digests.docs/src/content/docs/guide/gh-aw.mdandgh-aw-enlistmentskill): Documents all three restricted secrets (GH_AW_GITHUB_READ_APP_PRIVATE_KEY,SQUAD_GITHUB_APP_PRIVATE_KEY,SQUAD_GITHUB_TOKEN) reported bygh aw addundergh-aw v0.91.5.gh auth status: Usesgh auth status --hostname github.comso machines with additional GHE hosts inhosts.ymldo not exit 1 underset -euo pipefail..vscode/settings.jsoncallout: Explicitly notes in the Quick Start Step 7 callout that.vscode/settings.jsonis intentionally left untracked.