Add model policy frontmatter + import unioning + env policy overrides#41824
Add model policy frontmatter + import unioning + env policy overrides#41824Copilot wants to merge 8 commits into
Conversation
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
There was a problem hiding this comment.
Pull request overview
Adds end-to-end “model policy” support to gh-aw workflows, allowing authors (and centralized operators via env vars) to control which models are permitted/blocked, and ensuring policies compose safely across imported workflows before being emitted into the generated AWF config.
Changes:
- Extended workflow frontmatter
modelsto supportallowed,disallowed, andblockedpolicy lists (alongside optional pricing providers). - Propagated model policy through import extraction and merged policies across imports + main workflow using union semantics.
- Emitted effective model policy to AWF config (
apiProxy.allowedModels/apiProxy.disallowedModels) with env override precedence.
Show a summary per file
| File | Description |
|---|---|
| pkg/workflow/workflow_builder.go | Extracts main workflow model policy and unions it with imported policy sets into WorkflowData. |
| pkg/workflow/workflow_builder_model_policy_test.go | Adds unit tests for policy extraction and union merge behavior. |
| pkg/workflow/model_aliases_test.go | Verifies frontmatter parsing populates parsed model policy lists. |
| pkg/workflow/frontmatter_types.go | Adds parsed frontmatter fields for model policy lists. |
| pkg/workflow/frontmatter_parsing.go | Parses model policy lists from raw frontmatter into typed config. |
| pkg/workflow/compilerenv/manager.go | Adds env-driven policy overrides for allowed/blocked model sets. |
| pkg/workflow/compilerenv/manager_test.go | Tests env override parsing and “unset” behavior. |
| pkg/workflow/compiler_types.go | Plumbs merged model policy into WorkflowData. |
| pkg/workflow/awf_config.go | Maps effective model policy (with env precedence) into AWF apiProxy config. |
| pkg/workflow/awf_config_test.go | Tests AWF config emission and env override precedence. |
| pkg/parser/schemas/main_workflow_schema.json | Updates schema for models to include policy fields and make providers optional. |
| pkg/parser/import_processor.go | Extends ImportsResult to carry extracted model policy sets. |
| pkg/parser/import_field_extractor.go | Extracts model policy from imported workflows and avoids treating policy keys as aliases. |
| pkg/parser/import_field_extractor_test.go | Adds tests ensuring model policy is extracted (and not misinterpreted as aliases) and can coexist with model costs. |
Review details
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comments suppressed due to low confidence (2)
pkg/parser/import_field_extractor.go:639
- When an imported workflow has
models.providersplus model policy keys (allowed/disallowed/blocked), this appends the entirerawModelsobject intoacc.modelCosts. That will later flow intoWorkflowData.ModelCostsand into GH_AW_INFO_MODEL_COSTS, leaking policy keys into a payload that is expected to match the models.json pricing structure (providers-only). This can break downstream cost merging/parsing.
if _, hasProviders := rawModels["providers"]; hasProviders {
acc.modelCosts = append(acc.modelCosts, rawModels)
if providers, ok := rawModels["providers"].(map[string]any); ok {
parserLog.Printf("Extracted model costs from import: providers=%d", len(providers))
} else {
pkg/workflow/workflow_builder.go:166
- Now that
modelsfrontmatter can contain policy keys (allowed/disallowed/blocked) withoutproviders,toolsResult.parsedFrontmatter.ModelCostsmay be non-empty even when there is no pricing data (because it unmarshals the wholemodelsobject).extractMainModelCostsOverlaycurrently returns that map as a cost overlay, which can cause policy-onlymodelsto be emitted as GH_AW_INFO_MODEL_COSTS and/or pollute the providers overlay with policy keys.
}
return workflowData
}
- Files reviewed: 14/14 changed files
- Comments generated: 0
- Review effort level: Low
github-actions
Bot
added
enhancement
🤖 PR Triage
Score breakdown: Impact 35 · Urgency 5 · Quality 10 New model policy frontmatter controls (
|
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
|
Hey The PR is well-structured:
This looks ready for review. 🚀
|
|
@copilot merge main and recompile |
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
|
/review |
|
✅ PR Code Quality Reviewer completed the code quality review. |
|
@copilot please run the
|
|
@copilot please run the
|
Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>
PR Triage Update — §28289524040
|
|
@copilot remove "blocked" since dissallow is the same field |
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
|
@copilot please run the
|
|
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
|
@copilot please run the
|
…er-models-fields # Conflicts: # .github/workflows/smoke-claude.lock.yml Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>
🤖 PR Triage (updated)
Score breakdown: Impact 40 + Urgency 15 + Quality 14 = 69 Assessment: Significant feature introducing model policy frontmatter controls ( Run §28298156610
|
|
@copilot Review the AWF specification to see if it supports wildcards. |
This change introduces model policy controls in workflow frontmatter (
models.allowed,models.disallowed,models.blocked) and maps them to AWF’sallowedModels/disallowedModelsconfig. It also makes policy behavior import-safe by unioning model sets across composed workflows, with centralized environment overrides taking precedence.Frontmatter + schema support
modelsfrontmatter schema to support policy fields alongside optional pricing providers.models.allowedmodels.disallowedmodels.blockedImport compatibility (union semantics)
disallowedandblockedinto a single blocked set for runtime policy emission.Centralized policy overrides
GHAW_POLICY_MODELS_ALLOWEDGHAW_POLICY_MODELS_BLOCKEDAWF config mapping
apiProxy.allowedModelsapiProxy.disallowedModelspr-sous-chef run: https://github.com/github/gh-aw/actions/runs/28287576045
pr-sous-chef run: https://github.com/github/gh-aw/actions/runs/28288509195
https://github.com/github/gh-aw/actions/runs/28293057253