copilot/arc-dind: export writable HOME before Copilot XDG/MCP path resolution

[Copilot]

Under runner.topology: arc-dind, Copilot path setup exported XDG_CONFIG_HOME/GH_AW_MCP_CONFIG while HOME still pointed at passwd home (/home/runner), causing XDG-aware tools to write to an unwritable location.
This change makes ARC/DinD path resolution consistent by setting the writable ARC/DinD home before Copilot config exports are evaluated.

• Path setup ordering fix (arc-dind only)

  • In Copilot AWF path setup, prepend:
    • export HOME=${RUNNER_TEMP}/gh-aw/home
  • Keep existing inner engine-command HOME export intact (defense-in-depth for in-container execution).

• Config export behavior preserved, resolution corrected

  • buildCopilotMCPConfigExport remains $HOME-based.
  • Because HOME is now set earlier for arc-dind, both:
    • XDG_CONFIG_HOME="$HOME"
    • GH_AW_MCP_CONFIG="$HOME/.copilot/mcp-config.json"
      resolve to the writable ARC/DinD home.

• Regression guard on generated run block

  • Extended arc-dind Copilot execution assertions to require that the first HOME export appears before:
    • Copilot settings setup
    • XDG_CONFIG_HOME export
    • GH_AW_MCP_CONFIG export

homeExport := ""
if isArcDindTopology(workflowData) {
    homeExport = fmt.Sprintf("export HOME=%s\n", awfArcDindHomePathExpr)
}
return homeExport +
    buildCopilotSettingsCleanupAndExitCodeTrap() +
    buildCopilotSettingsSetup(...) +
    buildCopilotMCPConfigExport(workflowData) +
    pathSetup

• Fixes copilot/arc-dind: XDG_CONFIG_HOME resolves to unwritable /home/runner #47802

---

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 12.3 AIC · ⌖ 5.94 AIC · ⊞ 7.2K · ◷
_{Comment /souschef to run again}

---

Run: https://github.com/github/gh-aw/actions/runs/30375513874

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 10.1 AIC · ⌖ 6.1 AIC · ⊞ 7.2K · ◷
_{Comment /souschef to run again}

---

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 9.86 AIC · ⌖ 6.19 AIC · ⊞ 7.2K · ◷
_{Comment /souschef to run again}

[Copilot]

Pull request overview

Fixes ARC/DinD Copilot configuration paths by exporting the writable sandbox HOME before $HOME-based setup.

Changes:

• Adds an early ARC/DinD HOME export.
• Adds regression assertions for export presence and ordering.

Show a summary per file

File	Description
pkg/workflow/copilot_engine_execution.go	Sets writable HOME before Copilot configuration exports.
pkg/workflow/firewall_args_test.go	Verifies ARC/DinD path export ordering.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 2/2 changed files
• Comments generated: 0
• Review effort level: Medium

[lpcox]

There is one remaining ARC/DinD path mismatch to address.

MCP config producer and consumer resolve different HOME values. The execution step now resets HOME before deriving GH_AW_MCP_CONFIG, so Copilot reads ${RUNNER_TEMP}/gh-aw/home/.copilot/mcp-config.json. However, the preceding MCP gateway/config creation step still writes $HOME/.copilot/mcp-config.json using that separate GitHub Actions step's original HOME (/home/runner). Step-local exports do not persist between Actions steps, so the file is written to the old path while Copilot is directed to the new one.

Please apply the same ARC/DinD HOME override in the MCP-config creation step and add a regression test covering the complete generated step sequence, ensuring the producer and consumer resolve the same path across separate steps.

[lpcox]

@copilot address review feedback

[Copilot]

There is one remaining ARC/DinD path mismatch to address.

MCP config producer and consumer resolve different HOME values. The execution step now resets HOME before deriving GH_AW_MCP_CONFIG, ...

Fixed in 60a9f64.

CopilotEngine.RenderMCPConfig now exports HOME=${RUNNER_TEMP}/gh-aw/home before mkdir -p "$HOME/.copilot" when both arc-dind topology and firewall are enabled. This mirrors the same condition in buildCopilotAWFPathSetup (which governs the execution step), so both steps independently resolve $HOME to the same daemon-visible writable path.

Added TestArcDind_ProducerConsumerHomeParity to guard the full sequence: it generates both the "Start MCP Gateway" (producer) and Copilot execution (consumer) steps and asserts that each exports HOME before any $HOME-derived config path is evaluated.

[pelikhan]

@copilot run pr-finisher skill

[Copilot]

@copilot run pr-finisher skill

Done. The verify-integration-build failure was caused by a missing //go:build !integration tag on copilot_home_expansion_test.go. The file referenced requireCopilotExecutionStep, which is defined in enable_api_proxy_test.go (tagged //go:build !integration). When building with the integration tag, enable_api_proxy_test.go was excluded while copilot_home_expansion_test.go was still compiled, resulting in an undefined symbol error.

Fixed in the latest commit by adding the matching //go:build !integration tag to copilot_home_expansion_test.go. Both go build ./pkg/workflow/... and go build -tags integration ./pkg/workflow/... now succeed, and local make agent-report-progress (fmt + lint + test-unit) passes.