[q] Add raw MCP handshake canary job to github-remote-mcp-auth-test

[github-actions]

Q Workflow Optimization Report

Context

Triggered from a comment on discussion #55296 ("[auth-test] GitHub Remote MCP Tools Not Available"), which reports that github-remote-mcp-auth-test failed with Error [-32602]: unknown tool "get_repository". Request: add a job that tests GitHub remote MCP without any AW feature (canary to isolate whether the bug is in AW runtime/compiler), and include an MCP handshake message summary.

Changes Made

github-remote-mcp-auth-test (.github/workflows/github-remote-mcp-auth-test.md)

• Added a new custom job raw_mcp_canary (plain runs-on: ubuntu-latest, no tools:/engine:/agentic prompt) that speaks the GitHub remote MCP streamable-HTTP protocol directly with curl/jq:
  • Sends the JSON-RPC initialize request to https://api.githubcopilot.com/mcp/ with Authorization, Accept, and MCP-Protocol-Version headers, using the same token fallback chain (GH_AW_GITHUB_MCP_SERVER_TOKEN || GH_AW_GITHUB_TOKEN || GITHUB_TOKEN) already used elsewhere in the compiler.
  • Extracts the Mcp-Session-Id response header and parses the (possibly SSE-framed) JSON body.
  • Sends notifications/initialized, then calls tools/call for get_repository.
  • Writes a $GITHUB_STEP_SUMMARY with HTTP status codes, session ID, and a condensed handshake/tool response summary (server info, protocol version, capabilities, tool call result/error).
  • Fails the job (non-zero exit) if the handshake or tool call doesn't succeed, so the job's pass/fail status is directly comparable to the agentic test in the same run.
• Updated the agent prompt with a short section explaining the canary job and instructing the agent to check its outcome/summary and mention a one-line comparison ("Raw MCP canary: ✅/❌") plus handshake summary when reporting success or failure.

No .lock.yml changes are included; compilation is left to the post-merge automation.

Why this helps

If raw_mcp_canary fails independently of any gh-aw runtime/compiler code path, that strongly indicates the root cause is in GitHub's remote MCP server or the token — not in gh-aw. If it succeeds while the agentic test still fails, that points at the AW runtime/compiler or engine-specific MCP client behavior instead. This directly isolates the two hypotheses raised in discussion #55296.

Validation

Compiled github-remote-mcp-auth-test with the local gh-aw build; compilation succeeded with only pre-existing, unrelated warnings (cloud-hypervisor sandbox runtime notice and Copilot billing tip). Reverted the generated .lock.yml before committing, per policy (only .md files are part of this PR).

• ✅ github-remote-mcp-auth-test

References

• Discussion: [auth-test] GitHub Remote MCP Tools Not Available #55296
• Original failing run: https://github.com/github/gh-aw/actions/runs/32694090465

---

Warning

Protected Files — Push Permission Denied

This was originally intended as a pull request, but the patch modifies protected files. A human must create the pull request manually.

Protected files

• .github/workflows/github-remote-mcp-auth-test.md

The push was rejected because GitHub Actions does not have workflows permission to push these changes, and is never allowed to make such changes, or other authorization being used does not have this permission.

Create the pull request manually

# Download the patch from the workflow run
gh run download 32726221560 -n agent -D /tmp/agent-32726221560

# Create a new branch
git checkout -b gh-aw/pre-created/32726221560-1 main

# Apply the patch (--3way handles cross-repo patches)
git am --3way /tmp/agent-32726221560/aw-q-raw-mcp-canary-job.patch

# Push the branch and create the pull request
git push origin gh-aw/pre-created/32726221560-1
gh pr create --title '[q] Add raw MCP handshake canary job to github-remote-mcp-auth-test' --base main --head gh-aw/pre-created/32726221560-1 --repo github/gh-aw

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• proxy.golang.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "proxy.golang.org"

See Network Configuration for more information.

🎩 Equipped by Q · copilot · auto · 72.4 AIC · ⌖ 6.48 AIC · ⊞ 12.2K · ◷
_{Comment /q to run again}

• expires on Aug 26, 2026, 4:26 AM UTC-08:00