From 387f1eefdb6b00a4762961431437b49d5d07926c Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
<41898282+github-actions[bot]@users.noreply.github.com>
Date: Thu, 27 Aug 2026 01:50:02 +0000
Subject: [PATCH] chore: publish from main
---
.../advanced-copilot-cli-sync.lock.yml | 1695 +++++++++++++++++
.../workflows/advanced-copilot-cli-sync.md | 149 ++
website/astro.config.mjs | 18 +
.../03-copilot-work-surfaces.png | Bin 0 -> 1550872 bytes
.../03-delegation-handoff-flow.png | Bin 0 -> 957729 bytes
.../03-remote-control-flow.png | Bin 0 -> 1180583 bytes
.../03-test-backed-workflow.png | Bin 0 -> 1077139 bytes
.../03-test-evidence-loop.png | Bin 0 -> 1403910 bytes
.../advanced-copilot-cli/00-prerequisites.md | 109 ++
.../01-working-with-copilot-cli.md | 324 ++++
.../02-building-ai-infrastructure.md | 274 +++
.../03-test-suite-remote-delegation.md | 234 +++
.../04-lifecycle-hooks.md | 367 ++++
.../05-add-feature-barcode.md | 282 +++
.../advanced-copilot-cli/06-modernize-apps.md | 365 ++++
.../07-manage-infrastructure.md | 304 +++
.../advanced-copilot-cli/08-wrap-up.md | 86 +
.../advanced-copilot-cli/index.md | 90 +
.../src/content/docs/learning-hub/index.md | 2 +-
19 files changed, 4298 insertions(+), 1 deletion(-)
create mode 100644 .github/workflows/advanced-copilot-cli-sync.lock.yml
create mode 100644 .github/workflows/advanced-copilot-cli-sync.md
create mode 100644 website/public/images/learning-hub/advanced-copilot-cli/03-copilot-work-surfaces.png
create mode 100644 website/public/images/learning-hub/advanced-copilot-cli/03-delegation-handoff-flow.png
create mode 100644 website/public/images/learning-hub/advanced-copilot-cli/03-remote-control-flow.png
create mode 100644 website/public/images/learning-hub/advanced-copilot-cli/03-test-backed-workflow.png
create mode 100644 website/public/images/learning-hub/advanced-copilot-cli/03-test-evidence-loop.png
create mode 100644 website/src/content/docs/learning-hub/advanced-copilot-cli/00-prerequisites.md
create mode 100644 website/src/content/docs/learning-hub/advanced-copilot-cli/01-working-with-copilot-cli.md
create mode 100644 website/src/content/docs/learning-hub/advanced-copilot-cli/02-building-ai-infrastructure.md
create mode 100644 website/src/content/docs/learning-hub/advanced-copilot-cli/03-test-suite-remote-delegation.md
create mode 100644 website/src/content/docs/learning-hub/advanced-copilot-cli/04-lifecycle-hooks.md
create mode 100644 website/src/content/docs/learning-hub/advanced-copilot-cli/05-add-feature-barcode.md
create mode 100644 website/src/content/docs/learning-hub/advanced-copilot-cli/06-modernize-apps.md
create mode 100644 website/src/content/docs/learning-hub/advanced-copilot-cli/07-manage-infrastructure.md
create mode 100644 website/src/content/docs/learning-hub/advanced-copilot-cli/08-wrap-up.md
create mode 100644 website/src/content/docs/learning-hub/advanced-copilot-cli/index.md
diff --git a/.github/workflows/advanced-copilot-cli-sync.lock.yml b/.github/workflows/advanced-copilot-cli-sync.lock.yml
new file mode 100644
index 00000000..e0bdae8b
--- /dev/null
+++ b/.github/workflows/advanced-copilot-cli-sync.lock.yml
@@ -0,0 +1,1695 @@
+# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"84d335b3a809f564fbd2f8edd493ebe6d52f770e32ef0ec29ad37b4c1216b594","body_hash":"286af4ebf9cdaad5ea54400415ed98d2c244c019fd888e06a2450f1a54ab104d","compiler_version":"v0.84.3","strict":true,"agent_id":"copilot","engine_versions":{"copilot":"1.0.77"}}
+# gh-aw-manifest: {"version":1,"secrets":["COPILOT_GITHUB_TOKEN","GH_AW_CI_TRIGGER_TOKEN","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/cache/restore","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/cache/save","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/checkout","sha":"3d3c42e5aac5ba805825da76410c181273ba90b1","version":"v7.0.1"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"820762786026740c76f36085b0efc47a31fe5020","version":"v7.0.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"},{"repo":"github/gh-aw-actions/setup","sha":"c863074b673419603d146aab585e2986ef08deec","version":"v0.84.3"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.27.43","digest":"sha256:04e2d1987a565000a8f114b89d806ae7a3864dd4f944be65275b28c93d8690e6","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.27.43@sha256:04e2d1987a565000a8f114b89d806ae7a3864dd4f944be65275b28c93d8690e6"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.43","digest":"sha256:d85f57975af5ea23af4996e41ed73fbc8f5b4a47402472bfe82e508f352cb0c1","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.43@sha256:d85f57975af5ea23af4996e41ed73fbc8f5b4a47402472bfe82e508f352cb0c1"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.27.43","digest":"sha256:26be5e0b8c8f4c41c8a59126b29bb5d80b07253597472ded2a16bdd75abcbf9d","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.27.43@sha256:26be5e0b8c8f4c41c8a59126b29bb5d80b07253597472ded2a16bdd75abcbf9d"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.4.7","digest":"sha256:7545220a9aca134b71e51193ee0eaf4c50756ebf8fbd25a63ae7556e62815c00","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.4.7@sha256:7545220a9aca134b71e51193ee0eaf4c50756ebf8fbd25a63ae7556e62815c00"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:0d9f1fb5fd6610c0ac1f5194a38e45a8a1e81f8a390d5142d8e4e6f26a4b3196","pinned_image":"ghcr.io/github/gh-aw-node@sha256:0d9f1fb5fd6610c0ac1f5194a38e45a8a1e81f8a390d5142d8e4e6f26a4b3196"},{"image":"ghcr.io/github/github-mcp-server:v1.8.0","digest":"sha256:d5a18c04b92714c309eb46a2305087e91a4dbd80420f6e462656699f95093520","pinned_image":"ghcr.io/github/github-mcp-server:v1.8.0@sha256:d5a18c04b92714c309eb46a2305087e91a4dbd80420f6e462656699f95093520"}]}
+# This file was automatically generated by gh-aw (v0.84.3). DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md
+#
+# ___ _ _
+# / _ \ | | (_)
+# | |_| | __ _ ___ _ __ | |_ _ ___
+# | _ |/ _` |/ _ \ '_ \| __| |/ __|
+# | | | | (_| | __/ | | | |_| | (__
+# \_| |_/\__, |\___|_| |_|\__|_|\___|
+# __/ |
+# _ _ |___/
+# | | | | / _| |
+# | | | | ___ _ __ _ __| |_| | _____ ____
+# | |/\| |/ _ \ '__| |/ /| _| |/ _ \ \ /\ / / ___|
+# \ /\ / (_) | | | | ( | | | | (_) \ V V /\__ \
+# \/ \/ \___/|_| |_|\_\|_| |_|\___/ \_/\_/ |___/
+#
+#
+# To update this file, edit the corresponding .md file and run:
+# gh aw compile
+# Not all edits will cause changes to this file.
+#
+# For more information: https://github.github.com/gh-aw/introduction/overview/
+#
+# Weekly check for updates to github-samples/advanced-copilot-cli. Opens a PR to keep the Learning Hub mirror aligned when substantive upstream course changes are detected.
+#
+# Secrets used:
+# - COPILOT_GITHUB_TOKEN
+# - GH_AW_CI_TRIGGER_TOKEN
+# - GH_AW_GITHUB_MCP_SERVER_TOKEN
+# - GH_AW_GITHUB_TOKEN
+# - GITHUB_TOKEN
+#
+# Custom actions used:
+# - actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+# - actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+# - actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+# - actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+# - actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+# - actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 (source v9)
+# - actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+# - actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+# - github/gh-aw-actions/setup@c863074b673419603d146aab585e2986ef08deec # v0.84.3
+#
+# Container images used:
+# - ghcr.io/github/gh-aw-firewall/agent:0.27.43@sha256:04e2d1987a565000a8f114b89d806ae7a3864dd4f944be65275b28c93d8690e6
+# - ghcr.io/github/gh-aw-firewall/api-proxy:0.27.43@sha256:d85f57975af5ea23af4996e41ed73fbc8f5b4a47402472bfe82e508f352cb0c1
+# - ghcr.io/github/gh-aw-firewall/squid:0.27.43@sha256:26be5e0b8c8f4c41c8a59126b29bb5d80b07253597472ded2a16bdd75abcbf9d
+# - ghcr.io/github/gh-aw-mcpg:v0.4.7@sha256:7545220a9aca134b71e51193ee0eaf4c50756ebf8fbd25a63ae7556e62815c00
+# - ghcr.io/github/gh-aw-node@sha256:0d9f1fb5fd6610c0ac1f5194a38e45a8a1e81f8a390d5142d8e4e6f26a4b3196
+# - ghcr.io/github/github-mcp-server:v1.8.0@sha256:d5a18c04b92714c309eb46a2305087e91a4dbd80420f6e462656699f95093520
+
+name: "Advanced Copilot CLI Content Sync"
+on:
+ schedule:
+ - cron: "39 14 * * 4" # Friendly format: weekly (scattered)
+ workflow_dispatch:
+ inputs:
+ aw_context:
+ default: ""
+ description: "Agent caller context (used internally by Agentic Workflows)."
+ required: false
+ type: string
+
+permissions: {}
+
+concurrency:
+ group: "gh-aw-${{ github.workflow }}"
+
+run-name: "Advanced Copilot CLI Content Sync"
+
+jobs:
+ activation:
+ runs-on: ubuntu-slim
+ permissions:
+ actions: read
+ contents: read
+ env:
+ GH_AW_MAX_DAILY_AI_CREDITS: ${{ vars.GH_AW_DEFAULT_MAX_DAILY_AI_CREDITS || '5000' }}
+ GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }}
+ outputs:
+ comment_id: ""
+ comment_repo: ""
+ daily_ai_credits_exceeded: ${{ steps.daily-effective-workflow-guardrail.outputs.daily_ai_credits_exceeded == 'true' }}
+ daily_ai_credits_threshold: ${{ steps.daily-effective-workflow-guardrail.outputs.daily_ai_credits_threshold || '' }}
+ daily_ai_credits_total_effective_tokens: ${{ steps.daily-effective-workflow-guardrail.outputs.daily_ai_credits_total_effective_tokens || '' }}
+ engine_id: ${{ steps.generate_aw_info.outputs.engine_id }}
+ lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }}
+ model: ${{ steps.generate_aw_info.outputs.model }}
+ oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }}
+ setup-parent-span-id: ${{ steps.setup.outputs.parent-span-id || steps.setup.outputs.span-id }}
+ setup-span-id: ${{ steps.setup.outputs.span-id }}
+ setup-trace-id: ${{ steps.setup.outputs.trace-id }}
+ stale_lock_file_failed: ${{ steps.check-lock-file.outputs.stale_lock_file_failed == 'true' }}
+ steps:
+ - name: Setup Scripts
+ id: setup
+ uses: github/gh-aw-actions/setup@c863074b673419603d146aab585e2986ef08deec # v0.84.3
+ with:
+ destination: ${{ runner.temp }}/gh-aw/actions
+ job-name: ${{ github.job }}
+ safe-output-artifact-client: ${{ env.GH_AW_MAX_DAILY_AI_CREDITS != '' }}
+ env:
+ GH_AW_SETUP_WORKFLOW_NAME: "Advanced Copilot CLI Content Sync"
+ GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/advanced-copilot-cli-sync.lock.yml@${{ github.ref }}
+ GH_AW_INFO_VERSION: "1.0.77"
+ GH_AW_INFO_AWF_VERSION: "v0.27.43"
+ GH_AW_INFO_ENGINE_ID: "copilot"
+ - name: Generate agentic run info
+ id: generate_aw_info
+ env:
+ GH_AW_INFO_ENGINE_ID: "copilot"
+ GH_AW_INFO_ENGINE_NAME: "GitHub Copilot CLI"
+ GH_AW_INFO_MODEL: ${{ vars.GH_AW_MODEL_AGENT_COPILOT || vars.GH_AW_DEFAULT_MODEL_COPILOT || 'auto' }}
+ GH_AW_INFO_VERSION: "1.0.77"
+ GH_AW_INFO_AGENT_VERSION: "1.0.77"
+ GH_AW_INFO_CLI_VERSION: "v0.84.3"
+ GH_AW_INFO_WORKFLOW_NAME: "Advanced Copilot CLI Content Sync"
+ GH_AW_INFO_EXPERIMENTAL: "false"
+ GH_AW_INFO_SUPPORTS_TOOLS_ALLOWLIST: "true"
+ GH_AW_INFO_STAGED: "false"
+ GH_AW_INFO_ALLOWED_DOMAINS: '["defaults"]'
+ GH_AW_INFO_FIREWALL_ENABLED: "true"
+ GH_AW_INFO_AWF_VERSION: "v0.27.43"
+ GH_AW_INFO_AWMG_VERSION: ""
+ GH_AW_INFO_FIREWALL_TYPE: "squid"
+ GH_AW_COMPILED_STRICT: "true"
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ with:
+ script: |
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require('${{ runner.temp }}/gh-aw/actions/generate_aw_info.cjs');
+ await main(core, context);
+ - name: Restore daily AIC usage cache
+ id: restore-daily-aic-cache
+ if: ${{ env.GH_AW_MAX_DAILY_AI_CREDITS != '' }}
+ continue-on-error: true
+ uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+ with:
+ key: agentic-workflow-usage-advancedcopilotclisync-${{ github.run_id }}
+ restore-keys: agentic-workflow-usage-advancedcopilotclisync-
+ path: /tmp/gh-aw/agentic-workflow-usage-cache.jsonl
+ - name: Restore daily AIC usage cache (artifact fallback)
+ id: restore-daily-aic-cache-fallback
+ if: ${{ env.GH_AW_MAX_DAILY_AI_CREDITS != '' }}
+ continue-on-error: true
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_RESTORE_DAILY_AIC_CACHE_HIT: ${{ steps.restore-daily-aic-cache.outputs.cache-hit }}
+ GH_AW_RESTORE_DAILY_AIC_CACHE_MATCHED_KEY: ${{ steps.restore-daily-aic-cache.outputs.cache-matched-key }}
+ with:
+ github-token: ${{ secrets.GITHUB_TOKEN }}
+ script: |
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require('${{ runner.temp }}/gh-aw/actions/restore_aic_usage_cache_fallback.cjs');
+ await main();
+ - name: Check daily workflow token guardrail
+ id: daily-effective-workflow-guardrail
+ if: ${{ env.GH_AW_MAX_DAILY_AI_CREDITS != '' }}
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_WORKFLOW_NAME: "Advanced Copilot CLI Content Sync"
+ GH_AW_WORKFLOW_ID: "advanced-copilot-cli-sync"
+ GH_AW_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+ GH_AW_WORKFLOW_DISPATCH_AW_CONTEXT: ${{ github.event.inputs.aw_context || '' }}
+ GH_AW_HAS_SLASH_COMMAND: "false"
+ GH_AW_HAS_LABEL_COMMAND: "false"
+ GH_AW_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+ GH_AW_MAX_DAILY_AI_CREDITS: ${{ vars.GH_AW_DEFAULT_MAX_DAILY_AI_CREDITS || '5000' }}
+ with:
+ github-token: ${{ secrets.GITHUB_TOKEN }}
+ script: |
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require('${{ runner.temp }}/gh-aw/actions/check_daily_aic_workflow_guardrail.cjs');
+ await main();
+ - name: Check for OAuth tokens
+ id: check-oauth-tokens
+ run: bash "${RUNNER_TEMP}/gh-aw/actions/check_oauth_tokens.sh"
+ env:
+ COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
+ GH_AW_GITHUB_TOKEN: ${{ secrets.GH_AW_GITHUB_TOKEN }}
+ GH_AW_GITHUB_MCP_SERVER_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN }}
+ - name: Checkout .github and .agents folders
+ uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+ with:
+ persist-credentials: false
+ sparse-checkout: |
+ .github
+ .agents
+ .antigravity
+ .claude
+ .codex
+ .gemini
+ .opencode
+ .pi
+ sparse-checkout-cone-mode: true
+ fetch-depth: 1
+ - name: Save agent config folders for base branch restoration
+ env:
+ GH_AW_AGENT_FOLDERS: ".agents .antigravity .claude .codex .gemini .github .opencode .pi"
+ GH_AW_AGENT_FILES: "AGENTS.md ANTIGRAVITY.md CLAUDE.md GEMINI.md PI.md opencode.jsonc"
+ # poutine:ignore untrusted_checkout_exec
+ run: bash "${RUNNER_TEMP}/gh-aw/actions/save_base_github_folders.sh"
+ - name: Check workflow lock file
+ id: check-lock-file
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_WORKFLOW_FILE: "advanced-copilot-cli-sync.lock.yml"
+ GH_AW_CONTEXT_WORKFLOW_REF: "${{ github.workflow_ref }}"
+ with:
+ script: |
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require('${{ runner.temp }}/gh-aw/actions/check_workflow_timestamp_api.cjs');
+ await main();
+ - name: Check compile-agentic version
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_COMPILED_VERSION: "v0.84.3"
+ with:
+ script: |
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require('${{ runner.temp }}/gh-aw/actions/check_version_updates.cjs');
+ await main();
+ - name: Log runtime features
+ if: ${{ contains(toJSON(vars), '"GH_AW_RUNTIME_FEATURES":') }}
+ run: bash "${RUNNER_TEMP}/gh-aw/actions/log_runtime_features_summary.sh"
+ - name: Create prompt with built-in context
+ env:
+ GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
+ GH_AW_SAFE_OUTPUTS: ${{ runner.temp }}/gh-aw/safeoutputs/outputs.jsonl
+ GH_AW_EXPR_1A3A194A: ${{ github.event.discussion.number || (fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_type == 'discussion' && fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_number) }}
+ GH_AW_EXPR_463A214A: ${{ github.event.pull_request.number || (fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_type == 'pull_request' && fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_number) }}
+ GH_AW_EXPR_802A9F6A: ${{ github.event.issue.number || (fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_type == 'issue' && fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_number) }}
+ GH_AW_EXPR_FF1D34CE: ${{ github.event.comment.id || fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').comment_id }}
+ GH_AW_GITHUB_ACTOR: ${{ github.actor }}
+ GH_AW_GITHUB_REPOSITORY: ${{ github.repository }}
+ GH_AW_GITHUB_RUN_ID: ${{ github.run_id }}
+ GH_AW_GITHUB_WORKSPACE: ${{ github.workspace }}
+ # poutine:ignore untrusted_checkout_exec
+ run: |
+ bash "${RUNNER_TEMP}/gh-aw/actions/create_prompt_first.sh"
+ {
+ cat << 'GH_AW_PROMPT_3142e03166035497_EOF'
+
+ GH_AW_PROMPT_3142e03166035497_EOF
+ cat "${RUNNER_TEMP}/gh-aw/prompts/xpia.md"
+ cat "${RUNNER_TEMP}/gh-aw/prompts/temp_folder_prompt.md"
+ cat "${RUNNER_TEMP}/gh-aw/prompts/markdown.md"
+ cat "${RUNNER_TEMP}/gh-aw/prompts/cache_memory_prompt.md"
+ cat "${RUNNER_TEMP}/gh-aw/prompts/safe_outputs_prompt.md"
+ cat << 'GH_AW_PROMPT_3142e03166035497_EOF'
+
+ Tools: create_pull_request, missing_tool, missing_data, noop
+ GH_AW_PROMPT_3142e03166035497_EOF
+ cat "${RUNNER_TEMP}/gh-aw/prompts/safe_outputs_create_pull_request.md"
+ cat << 'GH_AW_PROMPT_3142e03166035497_EOF'
+
+ GH_AW_PROMPT_3142e03166035497_EOF
+ cat "${RUNNER_TEMP}/gh-aw/prompts/mcp_cli_tools_prompt.md"
+ cat << 'GH_AW_PROMPT_3142e03166035497_EOF'
+
+ The following GitHub context information is available for this workflow:
+ {{#if github.actor}}
+ - **actor**: __GH_AW_GITHUB_ACTOR__
+ {{/if}}
+ {{#if github.repository}}
+ - **repository**: __GH_AW_GITHUB_REPOSITORY__
+ {{/if}}
+ {{#if github.workspace}}
+ - **workspace**: __GH_AW_GITHUB_WORKSPACE__
+ {{/if}}
+ {{#if github.event.issue.number || (github.aw.context.item_type == 'issue' && github.aw.context.item_number)}}
+ - **issue-number**: #__GH_AW_EXPR_802A9F6A__
+ {{/if}}
+ {{#if github.event.discussion.number || (github.aw.context.item_type == 'discussion' && github.aw.context.item_number)}}
+ - **discussion-number**: #__GH_AW_EXPR_1A3A194A__
+ {{/if}}
+ {{#if github.event.pull_request.number || (github.aw.context.item_type == 'pull_request' && github.aw.context.item_number)}}
+ - **pull-request-number**: #__GH_AW_EXPR_463A214A__
+ {{/if}}
+ {{#if github.event.comment.id || github.aw.context.comment_id}}
+ - **comment-id**: __GH_AW_EXPR_FF1D34CE__
+ {{/if}}
+ {{#if github.run_id}}
+ - **workflow-run-id**: __GH_AW_GITHUB_RUN_ID__
+ {{/if}}
+
+
+ GH_AW_PROMPT_3142e03166035497_EOF
+ cat "${RUNNER_TEMP}/gh-aw/prompts/github_mcp_tools_with_safeoutputs_prompt.md"
+ cat << 'GH_AW_PROMPT_3142e03166035497_EOF'
+
+ {{#runtime-import .github/workflows/advanced-copilot-cli-sync.md}}
+ GH_AW_PROMPT_3142e03166035497_EOF
+ } > "$GH_AW_PROMPT"
+ - name: Interpolate variables and render templates
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
+ GH_AW_ENGINE_ID: "copilot"
+ with:
+ script: |
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require('${{ runner.temp }}/gh-aw/actions/interpolate_prompt.cjs');
+ await main();
+ - name: Substitute placeholders
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
+ GH_AW_ALLOWED_EXTENSIONS: ''
+ GH_AW_CACHE_DESCRIPTION: ''
+ GH_AW_CACHE_DIR: '/tmp/gh-aw/cache-memory/'
+ GH_AW_EXPR_1A3A194A: ${{ github.event.discussion.number || (fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_type == 'discussion' && fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_number) }}
+ GH_AW_EXPR_463A214A: ${{ github.event.pull_request.number || (fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_type == 'pull_request' && fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_number) }}
+ GH_AW_EXPR_802A9F6A: ${{ github.event.issue.number || (fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_type == 'issue' && fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_number) }}
+ GH_AW_EXPR_FF1D34CE: ${{ github.event.comment.id || fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').comment_id }}
+ GH_AW_GITHUB_ACTOR: ${{ github.actor }}
+ GH_AW_GITHUB_REPOSITORY: ${{ github.repository }}
+ GH_AW_GITHUB_RUN_ID: ${{ github.run_id }}
+ GH_AW_GITHUB_WORKSPACE: ${{ github.workspace }}
+ GH_AW_MCP_CLI_SERVERS_LIST: "- `github` — run `github --help` to see available tools\n- `safeoutputs` — run `safeoutputs --help` to see available tools"
+ with:
+ script: |
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+ setupGlobals(core, github, context, exec, io, getOctokit);
+
+ const substitutePlaceholders = require('${{ runner.temp }}/gh-aw/actions/substitute_placeholders.cjs');
+
+ // Call the substitution function
+ return await substitutePlaceholders({
+ file: process.env.GH_AW_PROMPT,
+ substitutions: {
+ GH_AW_ALLOWED_EXTENSIONS: process.env.GH_AW_ALLOWED_EXTENSIONS,
+ GH_AW_CACHE_DESCRIPTION: process.env.GH_AW_CACHE_DESCRIPTION,
+ GH_AW_CACHE_DIR: process.env.GH_AW_CACHE_DIR,
+ GH_AW_EXPR_1A3A194A: process.env.GH_AW_EXPR_1A3A194A,
+ GH_AW_EXPR_463A214A: process.env.GH_AW_EXPR_463A214A,
+ GH_AW_EXPR_802A9F6A: process.env.GH_AW_EXPR_802A9F6A,
+ GH_AW_EXPR_FF1D34CE: process.env.GH_AW_EXPR_FF1D34CE,
+ GH_AW_GITHUB_ACTOR: process.env.GH_AW_GITHUB_ACTOR,
+ GH_AW_GITHUB_REPOSITORY: process.env.GH_AW_GITHUB_REPOSITORY,
+ GH_AW_GITHUB_RUN_ID: process.env.GH_AW_GITHUB_RUN_ID,
+ GH_AW_GITHUB_WORKSPACE: process.env.GH_AW_GITHUB_WORKSPACE,
+ GH_AW_MCP_CLI_SERVERS_LIST: process.env.GH_AW_MCP_CLI_SERVERS_LIST
+ }
+ });
+ - name: Validate prompt placeholders
+ env:
+ GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
+ # poutine:ignore untrusted_checkout_exec
+ run: bash "${RUNNER_TEMP}/gh-aw/actions/validate_prompt_placeholders.sh"
+ - name: Print prompt
+ env:
+ GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
+ # poutine:ignore untrusted_checkout_exec
+ run: bash "${RUNNER_TEMP}/gh-aw/actions/print_prompt_summary.sh"
+ - name: Upload activation artifact
+ if: success()
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+ with:
+ name: activation
+ include-hidden-files: true
+ path: |
+ /tmp/gh-aw/aw_info.json
+ /tmp/gh-aw/models.json
+ /tmp/gh-aw/aw-prompts/prompt.txt
+ /tmp/gh-aw/aw-prompts/prompt-template.txt
+ /tmp/gh-aw/aw-prompts/prompt-import-tree.json
+ /tmp/gh-aw/github_rate_limits.jsonl
+ /tmp/gh-aw/base
+ /tmp/gh-aw/.github/agents
+ /tmp/gh-aw/.github/skills
+ if-no-files-found: ignore
+ retention-days: 1
+
+ agent:
+ needs: activation
+ if: needs.activation.outputs.daily_ai_credits_exceeded != 'true'
+ runs-on: ubuntu-latest
+ permissions:
+ contents: read
+ copilot-requests: write
+ concurrency:
+ group: "gh-aw-copilot-${{ github.workflow }}"
+ queue: max
+ env:
+ DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+ GH_AW_ASSETS_ALLOWED_EXTS: ""
+ GH_AW_ASSETS_BRANCH: ""
+ GH_AW_ASSETS_MAX_SIZE_KB: 0
+ GH_AW_MCP_LOG_DIR: /tmp/gh-aw/mcp-logs/safeoutputs
+ GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }}
+ GH_AW_WORKFLOW_ID_SANITIZED: advancedcopilotclisync
+ outputs:
+ agentic_engine_timeout: ${{ steps.detect-agent-errors.outputs.agentic_engine_timeout || 'false' }}
+ ai_credits_rate_limit_error: ${{ steps.parse-mcp-gateway.outputs.ai_credits_rate_limit_error || 'false' }}
+ aic: ${{ steps.parse-mcp-gateway.outputs.aic }}
+ ambient_context: ${{ steps.parse-mcp-gateway.outputs.ambient_context }}
+ cache_memory_restore_0_cache_hit: ${{ steps.restore_cache_memory_0.outputs.cache-hit || 'false' }}
+ cache_memory_restore_0_matched_key: ${{ steps.restore_cache_memory_0.outputs.cache-matched-key || '' }}
+ checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
+ effective_tokens: ${{ steps.parse-mcp-gateway.outputs.effective_tokens }}
+ has_patch: ${{ steps.collect_output.outputs.has_patch }}
+ http_400_response_error: ${{ steps.detect-agent-errors.outputs.http_400_response_error || 'false' }}
+ inference_access_error: ${{ steps.detect-agent-errors.outputs.inference_access_error || 'false' }}
+ invocation_cap_exceeded: ${{ steps.detect-agent-errors.outputs.invocation_cap_exceeded || 'false' }}
+ max_cache_misses_exceeded: ${{ steps.detect-agent-errors.outputs.max_cache_misses_exceeded || 'false' }}
+ mcp_policy_error: ${{ steps.detect-agent-errors.outputs.mcp_policy_error || 'false' }}
+ missing_model_pricing_error: ${{ steps.detect-agent-errors.outputs.missing_model_pricing_error || 'false' }}
+ missing_model_pricing_model_name: ${{ steps.detect-agent-errors.outputs.missing_model_pricing_model_name || '' }}
+ model: ${{ needs.activation.outputs.model }}
+ model_not_supported_error: ${{ steps.detect-agent-errors.outputs.model_not_supported_error || 'false' }}
+ output: ${{ steps.collect_output.outputs.output }}
+ output_types: ${{ steps.collect_output.outputs.output_types }}
+ setup-parent-span-id: ${{ steps.setup.outputs.parent-span-id || steps.setup.outputs.span-id }}
+ setup-span-id: ${{ steps.setup.outputs.span-id }}
+ setup-trace-id: ${{ steps.setup.outputs.trace-id }}
+ unknown_model_ai_credits: ${{ steps.parse-mcp-gateway.outputs.unknown_model_ai_credits || 'false' }}
+ steps:
+ - name: Setup Scripts
+ id: setup
+ uses: github/gh-aw-actions/setup@c863074b673419603d146aab585e2986ef08deec # v0.84.3
+ with:
+ destination: ${{ runner.temp }}/gh-aw/actions
+ job-name: ${{ github.job }}
+ trace-id: ${{ needs.activation.outputs.setup-trace-id }}
+ parent-span-id: ${{ needs.activation.outputs.setup-parent-span-id || needs.activation.outputs.setup-span-id }}
+ env:
+ GH_AW_SETUP_WORKFLOW_NAME: "Advanced Copilot CLI Content Sync"
+ GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/advanced-copilot-cli-sync.lock.yml@${{ github.ref }}
+ GH_AW_INFO_VERSION: "1.0.77"
+ GH_AW_INFO_AWF_VERSION: "v0.27.43"
+ GH_AW_INFO_ENGINE_ID: "copilot"
+ - name: Set runtime paths
+ id: set-runtime-paths
+ run: |
+ {
+ echo "GH_AW_SAFE_OUTPUTS=${RUNNER_TEMP}/gh-aw/safeoutputs/outputs.jsonl"
+ echo "GH_AW_SAFE_OUTPUTS_CONFIG_PATH=${RUNNER_TEMP}/gh-aw/safeoutputs/config.json"
+ echo "GH_AW_SAFE_OUTPUTS_TOOLS_PATH=${RUNNER_TEMP}/gh-aw/safeoutputs/tools.json"
+ } >> "$GITHUB_OUTPUT"
+ - name: Checkout repository
+ uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+ with:
+ persist-credentials: false
+ - name: Create gh-aw temp directory
+ run: bash "${RUNNER_TEMP}/gh-aw/actions/create_gh_aw_tmp_dir.sh"
+ - name: Configure gh CLI for GitHub Enterprise
+ run: bash "${RUNNER_TEMP}/gh-aw/actions/configure_gh_for_ghe.sh"
+ env:
+ GH_TOKEN: ${{ github.token }}
+ - name: Download activation artifact
+ uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+ with:
+ name: activation
+ path: /tmp/gh-aw
+ # Cache memory file share configuration from frontmatter processed below
+ - name: Create cache-memory directory
+ run: bash "${RUNNER_TEMP}/gh-aw/actions/create_cache_memory_dir.sh"
+ - name: Restore cache-memory file share data
+ id: restore_cache_memory_0
+ uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+ with:
+ key: memory-none-nopolicy-${{ env.GH_AW_WORKFLOW_ID_SANITIZED }}-${{ github.run_id }}
+ path: /tmp/gh-aw/cache-memory
+ restore-keys: |
+ memory-none-nopolicy-${{ env.GH_AW_WORKFLOW_ID_SANITIZED }}-
+ - name: Setup cache-memory git repository
+ env:
+ GH_AW_CACHE_DIR: /tmp/gh-aw/cache-memory
+ GH_AW_MIN_INTEGRITY: none
+ run: bash "${RUNNER_TEMP}/gh-aw/actions/setup_cache_memory_git.sh"
+ - name: Configure Git credentials
+ env:
+ GITHUB_REPOSITORY: ${{ github.repository }}
+ GITHUB_SERVER_URL: ${{ github.server_url }}
+ GITHUB_TOKEN: ${{ github.token }}
+ run: bash "${RUNNER_TEMP}/gh-aw/actions/configure_git_credentials.sh"
+ - name: Checkout PR branch
+ id: checkout-pr
+ if: |
+ github.event.pull_request || github.event.issue.pull_request || github.event_name == 'workflow_dispatch' && fromJSON(github.event.inputs.aw_context || '{}').item_type == 'pull_request'
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+ with:
+ github-token: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+ script: |
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require('${{ runner.temp }}/gh-aw/actions/checkout_pr_branch.cjs');
+ await main();
+ - name: Install GitHub Copilot CLI
+ run: bash "${RUNNER_TEMP}/gh-aw/actions/install_copilot_cli.sh"
+ env:
+ GH_HOST: github.com
+ GH_AW_COMPILED_VERSION: v0.84.3
+ - name: Install AWF binary
+ run: bash "${RUNNER_TEMP}/gh-aw/actions/install_awf_binary.sh" v0.27.43 --rootless
+ - name: Determine automatic lockdown mode for GitHub MCP Server
+ id: determine-automatic-lockdown
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 (source v9)
+ env:
+ GH_AW_GITHUB_TOKEN: ${{ secrets.GH_AW_GITHUB_TOKEN }}
+ GH_AW_GITHUB_MCP_SERVER_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN }}
+ with:
+ script: |
+ const determineAutomaticLockdown = require('${{ runner.temp }}/gh-aw/actions/determine_automatic_lockdown.cjs');
+ await determineAutomaticLockdown(github, context, core);
+ - name: Restore agent config folders from base branch
+ if: steps.checkout-pr.outcome == 'success'
+ env:
+ GH_AW_AGENT_FOLDERS: ".agents .antigravity .claude .codex .gemini .github .opencode .pi"
+ GH_AW_AGENT_FILES: "AGENTS.md ANTIGRAVITY.md CLAUDE.md GEMINI.md PI.md opencode.jsonc"
+ run: bash "${RUNNER_TEMP}/gh-aw/actions/restore_base_github_folders.sh"
+ - name: Restore inline sub-agents from activation artifact
+ env:
+ GH_AW_SUB_AGENT_DIR: ".github/agents"
+ GH_AW_SUB_AGENT_EXT: ".agent.md"
+ run: bash "${RUNNER_TEMP}/gh-aw/actions/restore_inline_sub_agents.sh"
+ - name: Restore inline skills from activation artifact
+ env:
+ GH_AW_SKILL_DIR: ".github/skills"
+ run: bash "${RUNNER_TEMP}/gh-aw/actions/restore_inline_skills.sh"
+ - name: Download container images
+ run: bash "${RUNNER_TEMP}/gh-aw/actions/download_docker_images.sh" ghcr.io/github/gh-aw-firewall/agent:0.27.43@sha256:04e2d1987a565000a8f114b89d806ae7a3864dd4f944be65275b28c93d8690e6 ghcr.io/github/gh-aw-firewall/api-proxy:0.27.43@sha256:d85f57975af5ea23af4996e41ed73fbc8f5b4a47402472bfe82e508f352cb0c1 ghcr.io/github/gh-aw-firewall/squid:0.27.43@sha256:26be5e0b8c8f4c41c8a59126b29bb5d80b07253597472ded2a16bdd75abcbf9d ghcr.io/github/gh-aw-mcpg:v0.4.7@sha256:7545220a9aca134b71e51193ee0eaf4c50756ebf8fbd25a63ae7556e62815c00 ghcr.io/github/gh-aw-node@sha256:0d9f1fb5fd6610c0ac1f5194a38e45a8a1e81f8a390d5142d8e4e6f26a4b3196 ghcr.io/github/github-mcp-server:v1.8.0@sha256:d5a18c04b92714c309eb46a2305087e91a4dbd80420f6e462656699f95093520
+ - name: Generate Safe Outputs Config
+ run: |
+ mkdir -p "${RUNNER_TEMP}/gh-aw/safeoutputs"
+ mkdir -p /tmp/gh-aw/safeoutputs
+ mkdir -p /tmp/gh-aw/mcp-logs/safeoutputs
+ cat > "${RUNNER_TEMP}/gh-aw/safeoutputs/config.json" << 'GH_AW_SAFE_OUTPUTS_CONFIG_de9e9697a4e82056_EOF'
+ {"create_pull_request":{"base_branch":"main","labels":["automated-update","learning-hub","advanced-copilot-cli"],"max":1,"max_patch_files":100,"max_patch_size":4096,"protect_top_level_dot_folders":true,"protected_files":["package.json","bun.lockb","bunfig.toml","deno.json","deno.jsonc","deno.lock","global.json","NuGet.Config","Directory.Packages.props","mix.exs","mix.lock","go.mod","go.sum","stack.yaml","stack.yaml.lock","pom.xml","build.gradle","build.gradle.kts","settings.gradle","settings.gradle.kts","gradle.properties","package-lock.json","yarn.lock","pnpm-lock.yaml","npm-shrinkwrap.json","requirements.txt","Pipfile","Pipfile.lock","pyproject.toml","setup.py","setup.cfg","Gemfile","Gemfile.lock","uv.lock","CODEOWNERS","DESIGN.md","README.md","CONTRIBUTING.md","CHANGELOG.md","SECURITY.md","CODE_OF_CONDUCT.md","AGENTS.md","CLAUDE.md","GEMINI.md"],"protected_files_policy":"request_review","title_prefix":"[bot] "},"create_report_incomplete_issue":{},"missing_data":{},"missing_tool":{},"noop":{"max":1,"report-as-issue":"true"},"report_incomplete":{}}
+ GH_AW_SAFE_OUTPUTS_CONFIG_de9e9697a4e82056_EOF
+ - name: Generate Safe Outputs Tools
+ env:
+ GH_AW_TOOLS_META_JSON: |
+ {
+ "description_suffixes": {
+ "create_pull_request": " CONSTRAINTS: Maximum 1 pull request(s) can be created. Title will be prefixed with \"[bot] \". Labels [\"automated-update\" \"learning-hub\" \"advanced-copilot-cli\"] will be automatically added."
+ },
+ "repo_params": {},
+ "dynamic_tools": []
+ }
+ GH_AW_VALIDATION_JSON: |
+ {
+ "create_pull_request": {
+ "defaultMax": 1,
+ "fields": {
+ "base": {
+ "type": "string",
+ "sanitize": true,
+ "maxLength": 128
+ },
+ "body": {
+ "required": true,
+ "type": "string",
+ "sanitize": true,
+ "maxLength": 65000
+ },
+ "branch": {
+ "required": true,
+ "type": "string",
+ "sanitize": true,
+ "maxLength": 256
+ },
+ "draft": {
+ "type": "boolean"
+ },
+ "labels": {
+ "type": "array",
+ "itemType": "string",
+ "itemSanitize": true,
+ "itemMaxLength": 128
+ },
+ "repo": {
+ "type": "string",
+ "maxLength": 256
+ },
+ "title": {
+ "required": true,
+ "type": "string",
+ "sanitize": true,
+ "maxLength": 128
+ }
+ }
+ },
+ "missing_data": {
+ "defaultMax": 20,
+ "fields": {
+ "alternatives": {
+ "type": "string",
+ "sanitize": true,
+ "maxLength": 256
+ },
+ "context": {
+ "type": "string",
+ "sanitize": true,
+ "maxLength": 256
+ },
+ "data_type": {
+ "type": "string",
+ "sanitize": true,
+ "maxLength": 128
+ },
+ "reason": {
+ "type": "string",
+ "sanitize": true,
+ "maxLength": 256
+ }
+ }
+ },
+ "missing_tool": {
+ "defaultMax": 20,
+ "fields": {
+ "alternatives": {
+ "type": "string",
+ "sanitize": true,
+ "maxLength": 512
+ },
+ "reason": {
+ "required": true,
+ "type": "string",
+ "sanitize": true,
+ "maxLength": 256
+ },
+ "tool": {
+ "type": "string",
+ "sanitize": true,
+ "maxLength": 128
+ }
+ }
+ },
+ "noop": {
+ "defaultMax": 1,
+ "fields": {
+ "message": {
+ "required": true,
+ "type": "string",
+ "sanitize": true,
+ "maxLength": 65000
+ }
+ }
+ },
+ "report_incomplete": {
+ "defaultMax": 5,
+ "fields": {
+ "details": {
+ "type": "string",
+ "sanitize": true,
+ "maxLength": 65000
+ },
+ "reason": {
+ "required": true,
+ "type": "string",
+ "sanitize": true,
+ "maxLength": 1024
+ }
+ }
+ }
+ }
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ with:
+ script: |
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require('${{ runner.temp }}/gh-aw/actions/generate_safe_outputs_tools.cjs');
+ await main();
+ - name: Start MCP Gateway
+ id: start-mcp-gateway
+ env:
+ GH_AW_POLICY_ALLOW_CREATE_PULL_REQUEST: ${{ vars.GH_AW_POLICY_ALLOW_CREATE_PULL_REQUEST || 'true' }}
+ GH_AW_SAFE_OUTPUTS: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS }}
+ GH_AW_SAFE_OUTPUTS_CONFIG_PATH: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS_CONFIG_PATH }}
+ GH_AW_SAFE_OUTPUTS_TOOLS_PATH: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS_TOOLS_PATH }}
+ GH_AW_SINK_VISIBILITY: ${{ steps.determine-automatic-lockdown.outputs.visibility }}
+ GITHUB_MCP_GUARD_MIN_INTEGRITY: ${{ steps.determine-automatic-lockdown.outputs.min_integrity }}
+ GITHUB_MCP_GUARD_REPOS: ${{ steps.determine-automatic-lockdown.outputs.repos }}
+ GITHUB_MCP_SERVER_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+ GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+ run: |
+ set -eo pipefail
+ mkdir -p "${RUNNER_TEMP}/gh-aw/mcp-config"
+
+ # Export gateway environment variables for MCP config and gateway script
+ export MCP_GATEWAY_PORT="8080"
+ export MCP_GATEWAY_DOMAIN="awmg-mcpg"
+ export MCP_GATEWAY_HOST_DOMAIN="localhost"
+ MCP_GATEWAY_API_KEY=$(openssl rand -base64 45 | tr -d '/+=')
+ echo "::add-mask::${MCP_GATEWAY_API_KEY}"
+ export MCP_GATEWAY_API_KEY
+ export MCP_GATEWAY_PAYLOAD_DIR="/tmp/gh-aw/mcp-payloads"
+ mkdir -p "${MCP_GATEWAY_PAYLOAD_DIR}"
+ export MCP_GATEWAY_PAYLOAD_SIZE_THRESHOLD="524288"
+ export DEBUG="*"
+
+ export GH_AW_ENGINE="copilot"
+ MCP_GATEWAY_UID=$(id -u 2>/dev/null || echo '0')
+ MCP_GATEWAY_GID=$(id -g 2>/dev/null || echo '0')
+ source "${RUNNER_TEMP}/gh-aw/actions/resolve_docker_socket_gid.sh"
+ export MCP_GATEWAY_DOCKER_COMMAND='docker run -i --rm --network bridge -p 127.0.0.1:'"${MCP_GATEWAY_PORT}"':'"${MCP_GATEWAY_PORT}"' --name awmg-mcpg --add-host host.docker.internal:host-gateway --user '"${MCP_GATEWAY_UID}"':'"${MCP_GATEWAY_GID}"' --group-add '"${DOCKER_SOCK_GID}"' -v '"${DOCKER_SOCK_PATH}"':/var/run/docker.sock -e MCP_GATEWAY_PORT -e MCP_GATEWAY_DOMAIN -e MCP_GATEWAY_API_KEY -e MCP_GATEWAY_PAYLOAD_DIR -e MCP_GATEWAY_PAYLOAD_SIZE_THRESHOLD -e DOCKER_HOST=unix:///var/run/docker.sock -e DEBUG -e MCP_GATEWAY_LOG_DIR -e GH_AW_MCP_LOG_DIR -e GH_AW_SAFE_OUTPUTS -e GH_AW_SAFE_OUTPUTS_CONFIG_PATH -e GH_AW_SAFE_OUTPUTS_TOOLS_PATH -e GH_AW_POLICY_ALLOW_CREATE_PULL_REQUEST -e GH_AW_ASSETS_BRANCH -e GH_AW_ASSETS_MAX_SIZE_KB -e GH_AW_ASSETS_ALLOWED_EXTS -e DEFAULT_BRANCH -e GITHUB_MCP_SERVER_TOKEN -e GITHUB_MCP_GUARD_MIN_INTEGRITY -e GITHUB_MCP_GUARD_REPOS -e GH_AW_SINK_VISIBILITY -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e GITHUB_SHA -e GITHUB_WORKSPACE -e GITHUB_TOKEN -e GITHUB_RUN_ID -e GITHUB_RUN_NUMBER -e GITHUB_RUN_ATTEMPT -e GITHUB_JOB -e GITHUB_ACTION -e GITHUB_EVENT_NAME -e GITHUB_EVENT_PATH -e GITHUB_ACTOR -e GITHUB_ACTOR_ID -e GITHUB_TRIGGERING_ACTOR -e GITHUB_WORKFLOW -e GITHUB_WORKFLOW_REF -e GITHUB_WORKFLOW_SHA -e GITHUB_REF -e GITHUB_REF_NAME -e GITHUB_REF_TYPE -e GITHUB_HEAD_REF -e GITHUB_BASE_REF -e RUNNER_TEMP -v /tmp/gh-aw/mcp-payloads:/tmp/gh-aw/mcp-payloads:rw -v /opt:/opt:ro -v /tmp:/tmp:rw -v '"${GITHUB_WORKSPACE}"':'"${GITHUB_WORKSPACE}"':rw -v '"${RUNNER_TEMP}"'/gh-aw/safeoutputs:'"${RUNNER_TEMP}"'/gh-aw/safeoutputs:rw ghcr.io/github/gh-aw-mcpg:v0.4.7'
+
+ mkdir -p "$HOME/.copilot"
+ GH_AW_NODE=$(which node 2>/dev/null || command -v node 2>/dev/null || echo node)
+ cat << GH_AW_MCP_CONFIG_803efe5dd620c71c_EOF | "$GH_AW_NODE" "${RUNNER_TEMP}/gh-aw/actions/start_mcp_gateway.cjs"
+ {
+ "mcpServers": {
+ "github": {
+ "type": "stdio",
+ "container": "ghcr.io/github/github-mcp-server:v1.8.0",
+ "env": {
+ "GITHUB_FEATURES": "fields_param",
+ "GITHUB_HOST": "${GITHUB_SERVER_URL}",
+ "GITHUB_PERSONAL_ACCESS_TOKEN": "${GITHUB_MCP_SERVER_TOKEN}",
+ "GITHUB_READ_ONLY": "1",
+ "GITHUB_TOOLSETS": "repos"
+ },
+ "guard-policies": {
+ "allow-only": {
+ "min-integrity": "$GITHUB_MCP_GUARD_MIN_INTEGRITY",
+ "repos": "$GITHUB_MCP_GUARD_REPOS"
+ }
+ }
+ },
+ "safeoutputs": {
+ "type": "stdio",
+ "container": "ghcr.io/github/gh-aw-node",
+ "mounts": ["\${GITHUB_WORKSPACE}:\${GITHUB_WORKSPACE}:rw", "${RUNNER_TEMP}/gh-aw/safeoutputs:${RUNNER_TEMP}/gh-aw/safeoutputs:rw", "/tmp/gh-aw:/tmp/gh-aw:rw"],
+ "args": ["-w", "\${GITHUB_WORKSPACE}"],
+ "entrypoint": "sh",
+ "entrypointArgs": ["-c", "sh ${RUNNER_TEMP}/gh-aw/safeoutputs/start_safe_outputs_mcp.sh"],
+ "env": {
+ "DEBUG": "*",
+ "DEFAULT_BRANCH": "\${DEFAULT_BRANCH}",
+ "GH_AW_ASSETS_ALLOWED_EXTS": "\${GH_AW_ASSETS_ALLOWED_EXTS}",
+ "GH_AW_ASSETS_BRANCH": "\${GH_AW_ASSETS_BRANCH}",
+ "GH_AW_ASSETS_MAX_SIZE_KB": "\${GH_AW_ASSETS_MAX_SIZE_KB}",
+ "GH_AW_MCP_LOG_DIR": "\${GH_AW_MCP_LOG_DIR}",
+ "GH_AW_SAFE_OUTPUTS": "\${GH_AW_SAFE_OUTPUTS}",
+ "GH_AW_SAFE_OUTPUTS_CONFIG_PATH": "\${GH_AW_SAFE_OUTPUTS_CONFIG_PATH}",
+ "GH_AW_SAFE_OUTPUTS_TOOLS_PATH": "\${GH_AW_SAFE_OUTPUTS_TOOLS_PATH}",
+ "GH_AW_POLICY_ALLOW_CREATE_PULL_REQUEST": "\${GH_AW_POLICY_ALLOW_CREATE_PULL_REQUEST}",
+ "GITHUB_REPOSITORY": "\${GITHUB_REPOSITORY}",
+ "GITHUB_SHA": "\${GITHUB_SHA}",
+ "GITHUB_TOKEN": "\${GITHUB_TOKEN}",
+ "GITHUB_WORKSPACE": "\${GITHUB_WORKSPACE}",
+ "RUNNER_TEMP": "\${RUNNER_TEMP}"
+ },
+ "guard-policies": {
+ "write-sink": {
+ "accept": [
+ "*"
+ ],
+ "sink-visibility": "${GH_AW_SINK_VISIBILITY}"
+ }
+ }
+ }
+ },
+ "gateway": {
+ "port": $MCP_GATEWAY_PORT,
+ "domain": "${MCP_GATEWAY_DOMAIN}",
+ "apiKey": "${MCP_GATEWAY_API_KEY}",
+ "payloadDir": "${MCP_GATEWAY_PAYLOAD_DIR}",
+ "startupTimeout": 120
+ }
+ }
+ GH_AW_MCP_CONFIG_803efe5dd620c71c_EOF
+ - name: Mount MCP servers as CLIs
+ id: mount-mcp-clis
+ continue-on-error: true
+ env:
+ MCP_GATEWAY_API_KEY: ${{ steps.start-mcp-gateway.outputs.gateway-api-key }}
+ MCP_GATEWAY_DOMAIN: ${{ steps.start-mcp-gateway.outputs.gateway-domain }}
+ MCP_GATEWAY_PORT: ${{ steps.start-mcp-gateway.outputs.gateway-port }}
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ with:
+ script: |
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+ setupGlobals(core, github, context, exec, io);
+ const { main } = require('${{ runner.temp }}/gh-aw/actions/mount_mcp_as_cli.cjs');
+ await main();
+ - name: Clean credentials
+ continue-on-error: true
+ run: bash "${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh"
+ - name: Audit pre-agent workspace
+ id: pre_agent_audit
+ continue-on-error: true
+ run: bash "${RUNNER_TEMP}/gh-aw/actions/audit_pre_agent_workspace.sh"
+ - name: Execute GitHub Copilot CLI
+ id: agentic_execution
+ # Copilot CLI tool arguments (sorted):
+ timeout-minutes: 20
+ run: |
+ set -o pipefail
+ printf '%s' "$(date +%s%3N)" > /tmp/gh-aw/agent_cli_start_ms.txt
+ trap 'gh_aw_exit_code=$?; mkdir -p /tmp/gh-aw >/dev/null 2>&1 || true; printf "%s" "$gh_aw_exit_code" > /tmp/gh-aw/agent_execution_exit_code.txt || true; rm -f "$HOME/.copilot/settings.json"' EXIT
+ mkdir -p "$HOME/.copilot"
+ printf '%s' '{"builtInAgents":{"rubberDuck":false}}' > "$HOME/.copilot/settings.json"
+ export XDG_CONFIG_HOME="$HOME"
+ export GH_AW_MCP_CONFIG="$HOME/.copilot/mcp-config.json"
+ touch /tmp/gh-aw/agent-step-summary.md
+ GH_AW_NODE_BIN=$(command -v node 2>/dev/null || true)
+ export GH_AW_NODE_BIN
+ export COPILOT_API_KEY="$COPILOT_DUMMY_BYOK"
+ (umask 177 && touch /tmp/gh-aw/agent-stdio.log)
+ GH_AW_MAX_AI_CREDITS="${GH_AW_MAX_AI_CREDITS:-1000}"
+ printf '%s\n' "{\"\$schema\":\"https://github.com/github/gh-aw-firewall/releases/download/v0.27.43/awf-config.schema.json\",\"network\":{\"allowDomains\":[\"api.business.githubcopilot.com\",\"api.enterprise.githubcopilot.com\",\"api.github.com\",\"api.githubcopilot.com\",\"api.individual.githubcopilot.com\",\"api.snapcraft.io\",\"archive.ubuntu.com\",\"azure.archive.ubuntu.com\",\"crl.geotrust.com\",\"crl.globalsign.com\",\"crl.identrust.com\",\"crl.sectigo.com\",\"crl.thawte.com\",\"crl.usertrust.com\",\"crl.verisign.com\",\"crl3.digicert.com\",\"crl4.digicert.com\",\"crls.ssl.com\",\"github.com\",\"host.docker.internal\",\"json-schema.org\",\"json.schemastore.org\",\"keyserver.ubuntu.com\",\"ocsp.digicert.com\",\"ocsp.geotrust.com\",\"ocsp.globalsign.com\",\"ocsp.identrust.com\",\"ocsp.sectigo.com\",\"ocsp.ssl.com\",\"ocsp.thawte.com\",\"ocsp.usertrust.com\",\"ocsp.verisign.com\",\"packagecloud.io\",\"packages.cloud.google.com\",\"packages.microsoft.com\",\"ppa.launchpad.net\",\"raw.githubusercontent.com\",\"registry.npmjs.org\",\"s.symcb.com\",\"s.symcd.com\",\"security.ubuntu.com\",\"telemetry.enterprise.githubcopilot.com\",\"ts-crl.ws.symantec.com\",\"ts-ocsp.ws.symantec.com\",\"www.googleapis.com\"],\"isolation\":true,\"topologyAttach\":[\"awmg-mcpg\"]},\"apiProxy\":{\"enabled\":true,\"enableTokenSteering\":true,\"maxRuns\":500,\"maxAiCredits\":${GH_AW_MAX_AI_CREDITS},\"maxCacheMisses\":5,\"models\":{\"agent\":[\"sonnet-6x\",\"gpt-5.4\",\"gpt-5.5\",\"gpt-5.6\",\"gpt-5.3\",\"gemini-pro\",\"any\"],\"antigravity\":[\"copilot/antigravity*\",\"google/antigravity*\",\"gemini/antigravity*\"],\"any\":[\"copilot/*\",\"anthropic/*\",\"openai/*\",\"google/*\",\"gemini/*\"],\"auto\":[\"copilot/auto\",\"large\"],\"claude\":[\"agent\"],\"codex\":[\"agent\"],\"coding\":[\"copilot/gpt-5*codex*\",\"openai/gpt-5*codex*\",\"gpt-5-codex\",\"kimi\"],\"computer-use\":[\"copilot/*computer-use*\",\"google/*computer-use*\",\"gemini/*computer-use*\",\"openai/*computer-use*\"],\"copilot\":[\"agent\"],\"deep-research\":[\"copilot/deep-research*\",\"copilot/o3-deep-research*\",\"copilot/o4-mini-deep-research*\",\"google/deep-research*\",\"gemini/deep-research*\",\"openai/o3-deep-research*\",\"openai/o4-mini-deep-research*\"],\"detection\":[\"small\"],\"evals\":[\"small\"],\"fable\":[\"copilot/*fable*\",\"anthropic/*fable*\"],\"gemini\":[\"agent\"],\"gemini-3-flash\":[\"copilot/gemini-3*flash*\",\"google/gemini-3*flash*\",\"gemini/gemini-3*flash*\"],\"gemini-3-pro\":[\"copilot/gemini-3*pro*\",\"google/gemini-3*pro*\",\"google/nano-banana*\",\"gemini/gemini-3*pro*\"],\"gemini-3.1-flash\":[\"copilot/gemini-3.1*flash*\",\"google/gemini-3.1*flash*\",\"gemini/gemini-3.1*flash*\"],\"gemini-3.1-pro\":[\"copilot/gemini-3.1*pro*\",\"google/gemini-3.1*pro*\",\"gemini/gemini-3.1*pro*\"],\"gemini-3.5-flash\":[\"copilot/gemini-3.5*flash*\",\"google/gemini-3.5*flash*\",\"gemini/gemini-3.5*flash*\"],\"gemini-3.6-flash\":[\"copilot/gemini-3.6*flash*\",\"google/gemini-3.6*flash*\",\"gemini/gemini-3.6*flash*\"],\"gemini-flash\":[\"copilot/gemini-*flash*\",\"google/gemini-*flash*\",\"gemini/gemini-*flash*\"],\"gemini-flash-lite\":[\"copilot/gemini-*flash*lite*\",\"google/gemini-*flash*lite*\",\"gemini/gemini-*flash*lite*\"],\"gemini-omni\":[\"copilot/gemini-omni*\",\"google/gemini-omni*\",\"gemini/gemini-omni*\"],\"gemini-pro\":[\"copilot/gemini-*pro*\",\"google/gemini-*pro*\",\"gemini/gemini-*pro*\"],\"gemma\":[\"copilot/gemma*\",\"google/gemma*\",\"gemini/gemma*\"],\"gpt-5\":[\"copilot/gpt-5*\",\"openai/gpt-5*\"],\"gpt-5-codex\":[\"copilot/gpt-5*codex*\",\"openai/gpt-5*codex*\"],\"gpt-5-mini\":[\"copilot/gpt-5*mini*\",\"openai/gpt-5*mini*\"],\"gpt-5-nano\":[\"copilot/gpt-5*nano*\",\"openai/gpt-5*nano*\"],\"gpt-5-pro\":[\"copilot/gpt-5*pro*\",\"openai/gpt-5*pro*\"],\"gpt-5.1\":[\"copilot/gpt-5.1*\",\"openai/gpt-5.1*\"],\"gpt-5.2\":[\"copilot/gpt-5.2*\",\"openai/gpt-5.2*\"],\"gpt-5.3\":[\"copilot/gpt-5.3*\",\"openai/gpt-5.3*\"],\"gpt-5.4\":[\"copilot/gpt-5.4*\",\"openai/gpt-5.4*\"],\"gpt-5.5\":[\"copilot/gpt-5.5*\",\"openai/gpt-5.5*\"],\"gpt-5.6\":[\"copilot/gpt-5.6*\",\"openai/gpt-5.6*\"],\"grok\":[\"copilot/*grok*\",\"openai/*grok*\"],\"haiku\":[\"copilot/*haiku*\",\"anthropic/*haiku*\"],\"image-generation\":[\"copilot/gpt-image*\",\"openai/gpt-image*\",\"openai/chatgpt-image*\",\"copilot/gemini-*image*\",\"google/gemini-*image*\",\"gemini/gemini-*image*\",\"google/imagen*\"],\"kimi\":[\"copilot/kimi*\",\"openai/kimi*\"],\"kiwi\":[\"copilot/kiwi*\",\"openai/kiwi*\"],\"large\":[\"sonnet\",\"gpt-5-pro\",\"gpt-5\",\"gemini-pro\"],\"lyria\":[\"google/lyria*\",\"gemini/lyria*\",\"copilot/lyria*\"],\"mai-code\":[\"copilot/MAI-Code*\",\"copilot/mai-code*\",\"openai/MAI-Code*\"],\"mai-code-1-flash-picker\":[\"copilot/MAI-Code-1-Flash-picker*\",\"copilot/mai-code-1-flash-picker*\",\"openai/MAI-Code-1-Flash-picker*\"],\"mini\":[\"haiku\",\"gpt-5-mini\",\"gpt-5-nano\",\"gemini-flash-lite\"],\"nano-banana\":[\"copilot/nano-banana*\",\"google/nano-banana*\",\"gemini/nano-banana*\"],\"opus\":[\"copilot/*opus*\",\"anthropic/*opus*\"],\"opusplan\":[\"opus?effort=high\"],\"raptor-mini\":[\"copilot/raptor*\",\"openai/raptor*\"],\"reasoning\":[\"copilot/o1*\",\"copilot/o3*\",\"copilot/o4*\",\"openai/o1*\",\"openai/o3*\",\"openai/o4*\"],\"robotics\":[\"copilot/*robotics*\",\"google/*robotics*\",\"gemini/*robotics*\"],\"small\":[\"mini\"],\"small-agent\":[\"haiku\",\"gpt-5-mini\",\"gemini-flash\"],\"sonnet\":[\"copilot/*sonnet*\",\"anthropic/*sonnet*\"],\"sonnet-6x\":[\"copilot/*sonnet-4.5*\",\"copilot/*sonnet-4.6*\",\"copilot/*sonnet-5*\",\"copilot/*sonnet-4-5-*\",\"anthropic/*sonnet-4-5-*\",\"copilot/*sonnet-4-6*\",\"anthropic/*sonnet-4-6*\",\"anthropic/*sonnet-5*\"],\"summarization\":[\"haiku\",\"gpt-5-mini\",\"gemini-flash-lite\",\"mini\"],\"veo\":[\"google/veo*\",\"gemini/veo*\"],\"vision\":[\"copilot/gemini-*image*\",\"google/gemini-*image*\",\"gemini/gemini-*image*\",\"copilot/gemini-*flash*\",\"google/gemini-*flash*\",\"gemini/gemini-*flash*\"]}},\"container\":{\"imageTag\":\"0.27.43,squid=sha256:26be5e0b8c8f4c41c8a59126b29bb5d80b07253597472ded2a16bdd75abcbf9d,agent=sha256:04e2d1987a565000a8f114b89d806ae7a3864dd4f944be65275b28c93d8690e6,api-proxy=sha256:d85f57975af5ea23af4996e41ed73fbc8f5b4a47402472bfe82e508f352cb0c1,cli-proxy=sha256:65c45ea2967984d0024f3df61bc71335658a77ede96c8d9665da7a5f33a795ab\"},\"logging\":{\"proxyLogsDir\":\"/tmp/gh-aw/sandbox/firewall/logs\",\"auditDir\":\"/tmp/gh-aw/sandbox/firewall/audit\"}}" > "${RUNNER_TEMP}/gh-aw/awf-config.json"
+ cp "${RUNNER_TEMP}/gh-aw/awf-config.json" /tmp/gh-aw/awf-config.json
+ export GH_AW_MODELS_JSON_PATH="/tmp/gh-aw/models.json"
+ GH_AW_DOCKER_HOST=""
+ if [[ "${DOCKER_HOST:-}" =~ ^tcp:// ]]; then
+ GH_AW_DOCKER_HOST="${DOCKER_HOST}"
+ fi
+ if [[ "${DOCKER_HOST:-}" =~ ^tcp:// ]]; then
+ GH_AW_CHROOT_BINARIES_SOURCE_PATH="${RUNNER_TEMP}/gh-aw" GH_AW_CHROOT_IDENTITY_HOME="${RUNNER_TEMP}/gh-aw/home" node "${RUNNER_TEMP}/gh-aw/actions/patch_awf_chroot_config.cjs"
+ fi
+ GH_AW_TOOL_CACHE_MOUNT=""
+ GH_AW_TOOL_CACHE="${RUNNER_TOOL_CACHE:?RUNNER_TOOL_CACHE must be set}"
+ if [ -d "$GH_AW_TOOL_CACHE" ]; then
+ if [[ "$GH_AW_TOOL_CACHE" != /opt/* ]]; then
+ GH_AW_TOOL_CACHE_MOUNT="$GH_AW_TOOL_CACHE:$GH_AW_TOOL_CACHE:ro"
+ fi
+ fi
+ # shellcheck disable=SC1003,SC2016,SC2086
+ awf --config "${RUNNER_TEMP}/gh-aw/awf-config.json" --container-workdir "${GITHUB_WORKSPACE}" --mount "${RUNNER_TEMP}/gh-aw:${RUNNER_TEMP}/gh-aw:ro" --mount "${RUNNER_TEMP}/gh-aw:/host${RUNNER_TEMP}/gh-aw:ro" ${GH_AW_TOOL_CACHE_MOUNT:+--mount "$GH_AW_TOOL_CACHE_MOUNT"} ${GH_AW_DOCKER_HOST:+--docker-host "$GH_AW_DOCKER_HOST"} --env-all --exclude-env COPILOT_GITHUB_TOKEN --exclude-env GITHUB_MCP_SERVER_TOKEN --exclude-env MCP_GATEWAY_API_KEY --log-level info --skip-pull \
+ -- /bin/bash -c 'set +o histexpand; export PATH="${RUNNER_TEMP}/gh-aw/mcp-cli/bin:$PATH" && : "${RUNNER_TOOL_CACHE:?RUNNER_TOOL_CACHE must be set}"; GH_AW_TOOL_CACHE="$RUNNER_TOOL_CACHE"; export PATH="$(find "$GH_AW_TOOL_CACHE" -maxdepth 5 -type d -name bin 2>/dev/null | tr '\''\n'\'' '\'':'\'')$PATH"; [ -n "$GOROOT" ] && export PATH="$GOROOT/bin:$PATH" || true; [ -n "$ERLANG_HOME" ] && export PATH="$ERLANG_HOME/bin:$PATH" || true && GH_AW_NODE_EXEC="${GH_AW_NODE_BIN:-}"; if [ -z "$GH_AW_NODE_EXEC" ] || [ ! -x "$GH_AW_NODE_EXEC" ]; then GH_AW_NODE_EXEC="$(command -v node 2>/dev/null || true)"; fi; if [ -z "$GH_AW_NODE_EXEC" ]; then echo "node runtime missing on this runner — check runtimes.node in workflow YAML" >&2; exit 127; fi; GH_AW_NPM_GLOBAL_ROOT="$(npm root -g 2>/dev/null || true)"; if [ -n "$GH_AW_NPM_GLOBAL_ROOT" ]; then export NODE_PATH="${GH_AW_NPM_GLOBAL_ROOT}${NODE_PATH:+:${NODE_PATH}}"; fi; "$GH_AW_NODE_EXEC" ${RUNNER_TEMP}/gh-aw/actions/copilot_harness.cjs /usr/local/bin/copilot --add-dir /tmp/gh-aw/ --log-level all --log-dir /tmp/gh-aw/sandbox/agent/logs/ --disable-builtin-mcps --no-ask-user --allow-all-tools --add-dir /tmp/gh-aw/cache-memory/ --allow-all-paths --add-dir "${GITHUB_WORKSPACE}" --prompt-file /tmp/gh-aw/aw-prompts/prompt.txt' 2>&1 | tee -a /tmp/gh-aw/agent-stdio.log
+ env:
+ AWF_REFLECT_ENABLED: 1
+ COPILOT_AGENT_RUNNER_TYPE: STANDALONE
+ COPILOT_DUMMY_BYOK: dummy-byok-key-for-offline-mode
+ COPILOT_GITHUB_TOKEN: ${{ github.token }}
+ COPILOT_MODEL: ${{ vars.GH_AW_MODEL_AGENT_COPILOT || vars.GH_AW_DEFAULT_MODEL_COPILOT || 'auto' }}
+ GH_AW_LLM_PROVIDER: github
+ GH_AW_MAX_AI_CREDITS: ${{ vars.GH_AW_DEFAULT_MAX_AI_CREDITS || '1000' }}
+ GH_AW_MAX_TURNS: ${{ vars.GH_AW_DEFAULT_MAX_TURNS || '' }}
+ GH_AW_PHASE: agent
+ GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
+ GH_AW_SAFE_OUTPUTS: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS }}
+ GH_AW_TIMEOUT_MINUTES: 20
+ GH_AW_VERSION: v0.84.3
+ GITHUB_API_URL: ${{ github.api_url }}
+ GITHUB_AW: true
+ GITHUB_COPILOT_INTEGRATION_ID: agentic-workflows
+ GITHUB_HEAD_REF: ${{ github.head_ref }}
+ GITHUB_MCP_SERVER_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+ GITHUB_REF_NAME: ${{ github.ref_name }}
+ GITHUB_SERVER_URL: ${{ github.server_url }}
+ GITHUB_STEP_SUMMARY: /tmp/gh-aw/agent-step-summary.md
+ GITHUB_WORKSPACE: ${{ github.workspace }}
+ GIT_AUTHOR_EMAIL: github-actions[bot]@users.noreply.github.com
+ GIT_AUTHOR_NAME: github-actions[bot]
+ GIT_COMMITTER_EMAIL: github-actions[bot]@users.noreply.github.com
+ GIT_COMMITTER_NAME: github-actions[bot]
+ RUNNER_TEMP: ${{ runner.temp }}
+ S2STOKENS: true
+ TRACEPARENT: ${{ env.GITHUB_AW_OTEL_TRACE_ID != '' && env.GITHUB_AW_OTEL_PARENT_SPAN_ID != '' && format('00-{0}-{1}-01', env.GITHUB_AW_OTEL_TRACE_ID, env.GITHUB_AW_OTEL_PARENT_SPAN_ID) || '' }}
+ - name: Detect agent errors
+ if: always()
+ id: detect-agent-errors
+ continue-on-error: true
+ run: node "${RUNNER_TEMP}/gh-aw/actions/detect_agent_errors.cjs"
+ - name: Configure Git credentials
+ env:
+ GITHUB_REPOSITORY: ${{ github.repository }}
+ GITHUB_SERVER_URL: ${{ github.server_url }}
+ GITHUB_TOKEN: ${{ github.token }}
+ run: bash "${RUNNER_TEMP}/gh-aw/actions/configure_git_credentials.sh"
+ - name: Copy Copilot session state files to logs
+ if: always()
+ continue-on-error: true
+ run: bash "${RUNNER_TEMP}/gh-aw/actions/copy_copilot_session_state.sh"
+ - name: Stop MCP Gateway
+ if: always()
+ continue-on-error: true
+ env:
+ MCP_GATEWAY_PORT: ${{ steps.start-mcp-gateway.outputs.gateway-port }}
+ MCP_GATEWAY_API_KEY: ${{ steps.start-mcp-gateway.outputs.gateway-api-key }}
+ GATEWAY_PID: ${{ steps.start-mcp-gateway.outputs.gateway-pid }}
+ run: |
+ bash "${RUNNER_TEMP}/gh-aw/actions/stop_mcp_gateway.sh" "$GATEWAY_PID"
+ - name: Redact secrets in logs
+ if: always()
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ with:
+ script: |
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require('${{ runner.temp }}/gh-aw/actions/redact_secrets.cjs');
+ await main();
+ env:
+ GH_AW_SECRET_NAMES: 'GH_AW_GITHUB_MCP_SERVER_TOKEN,GH_AW_GITHUB_TOKEN,GITHUB_TOKEN'
+ SECRET_GH_AW_GITHUB_MCP_SERVER_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN }}
+ SECRET_GH_AW_GITHUB_TOKEN: ${{ secrets.GH_AW_GITHUB_TOKEN }}
+ SECRET_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+ - name: Append agent step summary
+ if: always()
+ run: bash "${RUNNER_TEMP}/gh-aw/actions/append_agent_step_summary.sh"
+ - name: Copy Safe Outputs
+ if: always()
+ env:
+ GH_AW_SAFE_OUTPUTS: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS }}
+ run: |
+ mkdir -p /tmp/gh-aw
+ cp "$GH_AW_SAFE_OUTPUTS" /tmp/gh-aw/safeoutputs.jsonl 2>/dev/null || true
+ - name: Ingest agent output
+ id: collect_output
+ if: always()
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_SAFE_OUTPUTS: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS }}
+ GH_AW_ALLOWED_DOMAINS: "api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,github.com,host.docker.internal,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,ppa.launchpad.net,raw.githubusercontent.com,registry.npmjs.org,s.symcb.com,s.symcd.com,security.ubuntu.com,telemetry.enterprise.githubcopilot.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com,www.googleapis.com"
+ GITHUB_SERVER_URL: ${{ github.server_url }}
+ GITHUB_API_URL: ${{ github.api_url }}
+ with:
+ script: |
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require('${{ runner.temp }}/gh-aw/actions/collect_ndjson_output.cjs');
+ await main();
+ - name: Parse agent logs for step summary
+ if: always()
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_AGENT_OUTPUT: /tmp/gh-aw/sandbox/agent/logs/
+ GH_AW_SAFE_OUTPUTS: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS }}
+ with:
+ script: |
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require('${{ runner.temp }}/gh-aw/actions/parse_copilot_log.cjs');
+ await main();
+ - name: Parse MCP Gateway logs for step summary
+ if: always()
+ id: parse-mcp-gateway
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ with:
+ script: |
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require('${{ runner.temp }}/gh-aw/actions/parse_mcp_gateway_log.cjs');
+ await main();
+ - name: Print firewall logs
+ if: always()
+ continue-on-error: true
+ env:
+ AWF_LOGS_DIR: /tmp/gh-aw/sandbox/firewall/logs
+ run: bash "${RUNNER_TEMP}/gh-aw/actions/print_firewall_logs.sh" --rootless
+ - name: Parse token usage for step summary
+ if: always()
+ continue-on-error: true
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ with:
+ script: |
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require('${{ runner.temp }}/gh-aw/actions/parse_token_usage.cjs');
+ await main();
+ - name: Print AWF reflect summary
+ if: always()
+ continue-on-error: true
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ with:
+ script: |
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require('${{ runner.temp }}/gh-aw/actions/awf_reflect_summary.cjs');
+ await main();
+ - name: Write agent output placeholder if missing
+ if: always()
+ run: |
+ if [ ! -f /tmp/gh-aw/agent_output.json ]; then
+ echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
+ fi
+ - name: Commit cache-memory changes
+ if: always()
+ env:
+ GH_AW_CACHE_DIR: /tmp/gh-aw/cache-memory
+ run: bash "${RUNNER_TEMP}/gh-aw/actions/commit_cache_memory_git.sh"
+ - name: Check cache-memory git integrity
+ if: always()
+ continue-on-error: true
+ env:
+ GH_AW_CACHE_DIR: /tmp/gh-aw/cache-memory
+ run: bash "${RUNNER_TEMP}/gh-aw/actions/check_cache_memory_git_integrity.sh"
+ - name: Upload cache-memory data as artifact
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+ if: always()
+ with:
+ name: cache-memory
+ include-hidden-files: true
+ path: /tmp/gh-aw/cache-memory
+ - name: Upload agent artifacts
+ if: always()
+ continue-on-error: true
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+ with:
+ name: agent
+ path: |
+ /tmp/gh-aw/aw-prompts/prompt.txt
+ /tmp/gh-aw/sandbox/agent/logs/
+ /tmp/gh-aw/redacted-urls.log
+ /tmp/gh-aw/mcp-logs/
+ /tmp/gh-aw/agent_usage.json
+ /tmp/gh-aw/agent-stdio.log
+ /tmp/gh-aw/pre-agent-audit.txt
+ /tmp/gh-aw/agent/
+ /tmp/gh-aw/github_rate_limits.jsonl
+ /tmp/gh-aw/safeoutputs.jsonl
+ /tmp/gh-aw/agent_output.json
+ /tmp/gh-aw/aw-*.patch
+ /tmp/gh-aw/aw-*.bundle
+ /tmp/gh-aw/awf-config.json
+ /tmp/gh-aw/sandbox/firewall/logs/
+ /tmp/gh-aw/sandbox/firewall/audit/
+ /tmp/gh-aw/sandbox/firewall/awf-reflect.json
+ if-no-files-found: ignore
+
+ conclusion:
+ needs:
+ - activation
+ - agent
+ - detection
+ - safe_outputs
+ - update_cache_memory
+ if: >
+ always() && (needs.agent.result != 'skipped' || needs.activation.outputs.lockdown_check_failed == 'true' ||
+ needs.activation.outputs.oauth_token_check_failed == 'true' || needs.activation.outputs.stale_lock_file_failed == 'true' ||
+ needs.activation.outputs.daily_ai_credits_exceeded == 'true')
+ runs-on: ubuntu-slim
+ permissions:
+ contents: write
+ issues: write
+ pull-requests: write
+ concurrency:
+ group: "gh-aw-conclusion-advanced-copilot-cli-sync"
+ cancel-in-progress: false
+ queue: max
+ env:
+ GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }}
+ outputs:
+ incomplete_count: ${{ steps.report_incomplete.outputs.incomplete_count }}
+ noop_message: ${{ steps.noop.outputs.noop_message }}
+ tools_reported: ${{ steps.missing_tool.outputs.tools_reported }}
+ total_count: ${{ steps.missing_tool.outputs.total_count }}
+ steps:
+ - name: Setup Scripts
+ id: setup
+ uses: github/gh-aw-actions/setup@c863074b673419603d146aab585e2986ef08deec # v0.84.3
+ with:
+ destination: ${{ runner.temp }}/gh-aw/actions
+ job-name: ${{ github.job }}
+ trace-id: ${{ needs.activation.outputs.setup-trace-id }}
+ parent-span-id: ${{ needs.activation.outputs.setup-parent-span-id || needs.activation.outputs.setup-span-id }}
+ env:
+ GH_AW_SETUP_WORKFLOW_NAME: "Advanced Copilot CLI Content Sync"
+ GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/advanced-copilot-cli-sync.lock.yml@${{ github.ref }}
+ GH_AW_INFO_VERSION: "1.0.77"
+ GH_AW_INFO_AWF_VERSION: "v0.27.43"
+ GH_AW_INFO_ENGINE_ID: "copilot"
+ - name: Download agent output artifact
+ id: download-agent-output
+ continue-on-error: true
+ uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+ with:
+ name: agent
+ path: /tmp/gh-aw/
+ - name: Setup agent output environment variable
+ id: setup-agent-output-env
+ if: steps.download-agent-output.outcome == 'success'
+ run: |
+ mkdir -p /tmp/gh-aw/
+ find "/tmp/gh-aw/" -type f -print
+ echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT"
+ - name: Download safe outputs items manifest
+ id: download-safe-outputs-manifest
+ if: always()
+ continue-on-error: true
+ uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+ with:
+ name: safe-outputs-items
+ path: /tmp/gh-aw/
+ - name: Collect usage artifact files
+ if: always()
+ continue-on-error: true
+ run: bash "${RUNNER_TEMP}/gh-aw/actions/collect_usage_artifact_files.sh"
+ - name: Upload usage artifact
+ if: always()
+ continue-on-error: true
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+ with:
+ name: usage
+ path: |
+ /tmp/gh-aw/usage/aw_info.json
+ /tmp/gh-aw/usage/aw-info.jsonl
+ /tmp/gh-aw/usage/agent_usage.json
+ /tmp/gh-aw/usage/agent_usage.jsonl
+ /tmp/gh-aw/usage/detection_usage.jsonl
+ /tmp/gh-aw/usage/evals.jsonl
+ /tmp/gh-aw/usage/github_rate_limits.jsonl
+ /tmp/gh-aw/usage/agent/token_usage.jsonl
+ /tmp/gh-aw/usage/detection/token_usage.jsonl
+ /tmp/gh-aw/usage/activity/summary.json
+ if-no-files-found: ignore
+ - name: Restore daily AIC usage cache
+ id: restore-daily-aic-cache-conclusion
+ if: always()
+ continue-on-error: true
+ uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+ with:
+ key: agentic-workflow-usage-advancedcopilotclisync-${{ github.run_id }}
+ restore-keys: agentic-workflow-usage-advancedcopilotclisync-
+ path: /tmp/gh-aw/agentic-workflow-usage-cache.jsonl
+ - name: Write daily AIC usage cache entry
+ id: write-daily-aic-cache
+ if: always()
+ continue-on-error: true
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ with:
+ github-token: ${{ github.token }}
+ script: |
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+ setupGlobals(core, github, context);
+ const { main } = require('${{ runner.temp }}/gh-aw/actions/write_daily_aic_usage_cache.cjs');
+ await main();
+ - name: Save daily AIC usage cache
+ id: save-daily-aic-cache
+ if: always()
+ continue-on-error: true
+ uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+ with:
+ key: agentic-workflow-usage-advancedcopilotclisync-${{ github.run_id }}
+ path: /tmp/gh-aw/agentic-workflow-usage-cache.jsonl
+ - name: Upload daily AIC usage cache artifact
+ id: upload-daily-aic-cache
+ if: always()
+ continue-on-error: true
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+ with:
+ name: aic-usage-cache
+ path: /tmp/gh-aw/agentic-workflow-usage-cache.jsonl
+ if-no-files-found: ignore
+ retention-days: 7
+ - name: Process no-op messages
+ id: noop
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }}
+ GH_AW_NOOP_MAX: "1"
+ GH_AW_WORKFLOW_NAME: "Advanced Copilot CLI Content Sync"
+ GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/${{ github.repository }}/blob/${{ github.ref_name }}/.github/workflows/advanced-copilot-cli-sync.md"
+ GH_AW_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+ GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }}
+ GH_AW_NOOP_REPORT_AS_ISSUE: "true"
+ GH_AW_AIC: ${{ needs.agent.outputs.aic }}
+ GH_AW_THREAT_DETECTION_AIC: ${{ needs.detection.outputs.aic }}
+ GH_AW_AMBIENT_CONTEXT: ${{ needs.agent.outputs.ambient_context }}
+ GH_AW_WORKFLOW_ID: "advanced-copilot-cli-sync"
+ with:
+ github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+ script: |
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require('${{ runner.temp }}/gh-aw/actions/handle_noop_message.cjs');
+ await main();
+ - name: Log detection run
+ id: detection_runs
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }}
+ GH_AW_WORKFLOW_NAME: "Advanced Copilot CLI Content Sync"
+ GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/${{ github.repository }}/blob/${{ github.ref_name }}/.github/workflows/advanced-copilot-cli-sync.md"
+ GH_AW_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+ GH_AW_DETECTION_CONCLUSION: ${{ needs.detection.outputs.detection_conclusion }}
+ GH_AW_DETECTION_REASON: ${{ needs.detection.outputs.detection_reason }}
+ with:
+ github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+ script: |
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require('${{ runner.temp }}/gh-aw/actions/handle_detection_runs.cjs');
+ await main();
+ - name: Record missing tool
+ id: missing_tool
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }}
+ GH_AW_MISSING_TOOL_CREATE_ISSUE: "true"
+ GH_AW_WORKFLOW_NAME: "Advanced Copilot CLI Content Sync"
+ GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/${{ github.repository }}/blob/${{ github.ref_name }}/.github/workflows/advanced-copilot-cli-sync.md"
+ with:
+ github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+ script: |
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require('${{ runner.temp }}/gh-aw/actions/missing_tool.cjs');
+ await main();
+ - name: Record incomplete
+ id: report_incomplete
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }}
+ GH_AW_REPORT_INCOMPLETE_CREATE_ISSUE: "true"
+ GH_AW_WORKFLOW_NAME: "Advanced Copilot CLI Content Sync"
+ GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/${{ github.repository }}/blob/${{ github.ref_name }}/.github/workflows/advanced-copilot-cli-sync.md"
+ with:
+ github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+ script: |
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require('${{ runner.temp }}/gh-aw/actions/report_incomplete_handler.cjs');
+ await main();
+ - name: Handle agent failure
+ id: handle_agent_failure
+ if: always()
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }}
+ GH_AW_WORKFLOW_NAME: "Advanced Copilot CLI Content Sync"
+ GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/${{ github.repository }}/blob/${{ github.ref_name }}/.github/workflows/advanced-copilot-cli-sync.md"
+ GH_AW_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+ GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }}
+ GH_AW_WORKFLOW_ID: "advanced-copilot-cli-sync"
+ GH_AW_ACTION_FAILURE_ISSUE_EXPIRES_HOURS: "168"
+ GH_AW_ENGINE_ID: "copilot"
+ GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+ GH_AW_EFFECTIVE_TOKENS: ${{ needs.agent.outputs.effective_tokens || '' }}
+ GH_AW_AI_CREDITS_RATE_LIMIT_ERROR: ${{ needs.agent.outputs.ai_credits_rate_limit_error || 'false' }}
+ GH_AW_UNKNOWN_MODEL_AI_CREDITS: ${{ needs.agent.outputs.unknown_model_ai_credits || 'false' }}
+ GH_AW_AIC: ${{ needs.agent.outputs.aic }}
+ GH_AW_THREAT_DETECTION_AIC: ${{ needs.detection.outputs.aic }}
+ GH_AW_MAX_AI_CREDITS: ${{ vars.GH_AW_DEFAULT_MAX_AI_CREDITS || '1000' }}
+ GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+ GH_AW_MCP_POLICY_ERROR: ${{ needs.agent.outputs.mcp_policy_error }}
+ GH_AW_AGENTIC_ENGINE_TIMEOUT: ${{ needs.agent.outputs.agentic_engine_timeout }}
+ GH_AW_MODEL_NOT_SUPPORTED_ERROR: ${{ needs.agent.outputs.model_not_supported_error }}
+ GH_AW_HTTP_400_RESPONSE_ERROR: ${{ needs.agent.outputs.http_400_response_error }}
+ GH_AW_MAX_CACHE_MISSES_EXCEEDED: ${{ needs.agent.outputs.max_cache_misses_exceeded }}
+ GH_AW_MISSING_MODEL_PRICING_ERROR: ${{ needs.agent.outputs.missing_model_pricing_error }}
+ GH_AW_MISSING_MODEL_PRICING_MODEL_NAME: ${{ needs.agent.outputs.missing_model_pricing_model_name }}
+ GH_AW_ENGINE_API_HOSTS: "api.enterprise.githubcopilot.com,api.githubcopilot.com,api.business.githubcopilot.com,api.individual.githubcopilot.com"
+ GH_AW_CODE_PUSH_FAILURE_ERRORS: ${{ needs.safe_outputs.outputs.code_push_failure_errors }}
+ GH_AW_CODE_PUSH_FAILURE_COUNT: ${{ needs.safe_outputs.outputs.code_push_failure_count }}
+ GH_AW_LOCKDOWN_CHECK_FAILED: ${{ needs.activation.outputs.lockdown_check_failed }}
+ GH_AW_OAUTH_TOKEN_CHECK_FAILED: ${{ needs.activation.outputs.oauth_token_check_failed }}
+ GH_AW_STALE_LOCK_FILE_FAILED: ${{ needs.activation.outputs.stale_lock_file_failed }}
+ GH_AW_DAILY_AI_CREDITS_EXCEEDED: ${{ needs.activation.outputs.daily_ai_credits_exceeded }}
+ GH_AW_DAILY_AI_CREDITS_TOTAL_EFFECTIVE_TOKENS: ${{ needs.activation.outputs.daily_ai_credits_total_effective_tokens }}
+ GH_AW_DAILY_AI_CREDITS_THRESHOLD: ${{ needs.activation.outputs.daily_ai_credits_threshold }}
+ GH_AW_GROUP_REPORTS: "false"
+ GH_AW_FAILURE_REPORT_AS_ISSUE: "true"
+ GH_AW_MISSING_TOOL_REPORT_AS_FAILURE: "true"
+ GH_AW_MISSING_DATA_REPORT_AS_FAILURE: "true"
+ GH_AW_TIMEOUT_MINUTES: "20"
+ GH_AW_CACHE_MEMORY_ENABLED: "true"
+ GH_AW_CACHE_MEMORY_RESTORE_0_MATCHED_KEY: ${{ needs.agent.outputs.cache_memory_restore_0_matched_key || '' }}
+ GH_AW_CACHE_MEMORY_RESTORE_0_CACHE_HIT: ${{ needs.agent.outputs.cache_memory_restore_0_cache_hit || 'false' }}
+ with:
+ github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+ script: |
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require('${{ runner.temp }}/gh-aw/actions/handle_agent_failure.cjs');
+ await main();
+
+ detection:
+ needs:
+ - activation
+ - agent
+ if: always() && needs.agent.result != 'skipped'
+ runs-on: ubuntu-latest
+ permissions:
+ contents: read
+ copilot-requests: write
+ env:
+ GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }}
+ outputs:
+ aic: ${{ steps.parse_detection_token_usage.outputs.aic }}
+ detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
+ detection_reason: ${{ steps.detection_conclusion.outputs.reason }}
+ detection_success: ${{ steps.detection_conclusion.outputs.success }}
+ steps:
+ - name: Setup Scripts
+ id: setup
+ uses: github/gh-aw-actions/setup@c863074b673419603d146aab585e2986ef08deec # v0.84.3
+ with:
+ destination: ${{ runner.temp }}/gh-aw/actions
+ job-name: ${{ github.job }}
+ trace-id: ${{ needs.activation.outputs.setup-trace-id }}
+ parent-span-id: ${{ needs.activation.outputs.setup-parent-span-id || needs.activation.outputs.setup-span-id }}
+ env:
+ GH_AW_SETUP_WORKFLOW_NAME: "Advanced Copilot CLI Content Sync"
+ GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/advanced-copilot-cli-sync.lock.yml@${{ github.ref }}
+ GH_AW_INFO_VERSION: "1.0.77"
+ GH_AW_INFO_AWF_VERSION: "v0.27.43"
+ GH_AW_INFO_ENGINE_ID: "copilot"
+ - name: Download agent output artifact
+ id: download-agent-output
+ continue-on-error: true
+ uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+ with:
+ name: agent
+ path: /tmp/gh-aw/
+ - name: Setup agent output environment variable
+ id: setup-agent-output-env
+ if: steps.download-agent-output.outcome == 'success'
+ run: |
+ mkdir -p /tmp/gh-aw/
+ find "/tmp/gh-aw/" -type f -print
+ echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT"
+ - name: Checkout repository for patch context
+ if: needs.agent.outputs.has_patch == 'true'
+ uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+ with:
+ persist-credentials: false
+ # --- Threat Detection ---
+ - name: Clean stale firewall files from agent artifact
+ run: |
+ rm -rf /tmp/gh-aw/sandbox/firewall/logs
+ rm -rf /tmp/gh-aw/sandbox/firewall/audit
+ - name: Download container images
+ run: bash "${RUNNER_TEMP}/gh-aw/actions/download_docker_images.sh" ghcr.io/github/gh-aw-firewall/agent:0.27.43@sha256:04e2d1987a565000a8f114b89d806ae7a3864dd4f944be65275b28c93d8690e6 ghcr.io/github/gh-aw-firewall/api-proxy:0.27.43@sha256:d85f57975af5ea23af4996e41ed73fbc8f5b4a47402472bfe82e508f352cb0c1 ghcr.io/github/gh-aw-firewall/squid:0.27.43@sha256:26be5e0b8c8f4c41c8a59126b29bb5d80b07253597472ded2a16bdd75abcbf9d
+ - name: Check if detection needed
+ id: detection_guard
+ if: always()
+ env:
+ OUTPUT_TYPES: ${{ needs.agent.outputs.output_types }}
+ HAS_PATCH: ${{ needs.agent.outputs.has_patch }}
+ run: |
+ if [[ -n "$OUTPUT_TYPES" || "$HAS_PATCH" == "true" ]]; then
+ echo "run_detection=true" >> "$GITHUB_OUTPUT"
+ echo "Detection will run: output_types=$OUTPUT_TYPES, has_patch=$HAS_PATCH"
+ else
+ echo "run_detection=false" >> "$GITHUB_OUTPUT"
+ echo "Detection skipped: no agent outputs or patches to analyze"
+ fi
+ - name: Clear MCP Config for detection
+ if: always() && steps.detection_guard.outputs.run_detection == 'true'
+ run: |
+ rm -f "${RUNNER_TEMP}/gh-aw/mcp-config/mcp-servers.json"
+ rm -f "$HOME/.copilot/mcp-config.json"
+ rm -f "$GITHUB_WORKSPACE/.gemini/settings.json"
+ - name: Prepare threat detection files
+ if: always() && steps.detection_guard.outputs.run_detection == 'true'
+ run: |
+ mkdir -p /tmp/gh-aw/threat-detection/aw-prompts
+ rm -f /tmp/gh-aw/agent_usage.json
+ cp /tmp/gh-aw/aw-prompts/prompt.txt /tmp/gh-aw/threat-detection/aw-prompts/prompt.txt 2>/dev/null || true
+ if [ ! -s /tmp/gh-aw/threat-detection/aw-prompts/prompt.txt ]; then
+ echo "::warning::ERR_VALIDATION: Missing or empty detection context prompt at /tmp/gh-aw/threat-detection/aw-prompts/prompt.txt. Ensure the agent artifact includes /tmp/gh-aw/aw-prompts/prompt.txt. Detection will continue with fallback workflow context."
+ fi
+ cp /tmp/gh-aw/agent_output.json /tmp/gh-aw/threat-detection/agent_output.json 2>/dev/null || true
+ for f in /tmp/gh-aw/aw-*.patch; do
+ if [ -f "$f" ]; then
+ cp "$f" /tmp/gh-aw/threat-detection/ 2>/dev/null || true
+ fi
+ done
+ for f in /tmp/gh-aw/aw-*.bundle; do
+ if [ -f "$f" ]; then
+ cp "$f" /tmp/gh-aw/threat-detection/ 2>/dev/null || true
+ fi
+ done
+ echo "Prepared threat detection files:"
+ ls -la /tmp/gh-aw/threat-detection/ 2>/dev/null || true
+ - name: Setup threat detection
+ if: always() && steps.detection_guard.outputs.run_detection == 'true'
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ WORKFLOW_NAME: "Advanced Copilot CLI Content Sync"
+ WORKFLOW_DESCRIPTION: "Weekly check for updates to github-samples/advanced-copilot-cli. Opens a PR to keep the Learning Hub mirror aligned when substantive upstream course changes are detected."
+ HAS_PATCH: ${{ needs.agent.outputs.has_patch }}
+ GH_AW_DETECTION_CONTINUE_ON_ERROR: "true"
+ with:
+ script: |
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require('${{ runner.temp }}/gh-aw/actions/setup_threat_detection.cjs');
+ await main();
+ - name: Ensure threat-detection directory and log
+ if: always() && steps.detection_guard.outputs.run_detection == 'true'
+ run: |
+ mkdir -p /tmp/gh-aw/threat-detection
+ touch /tmp/gh-aw/threat-detection/detection.log
+ - name: Setup Node.js
+ uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+ with:
+ node-version: '24'
+ package-manager-cache: false
+ - name: Install GitHub Copilot CLI
+ run: bash "${RUNNER_TEMP}/gh-aw/actions/install_copilot_cli.sh"
+ env:
+ GH_HOST: github.com
+ GH_AW_COMPILED_VERSION: v0.84.3
+ - name: Install AWF binary
+ run: bash "${RUNNER_TEMP}/gh-aw/actions/install_awf_binary.sh" v0.27.43
+ - name: Execute GitHub Copilot CLI
+ if: always() && steps.detection_guard.outputs.run_detection == 'true'
+ continue-on-error: true
+ id: detection_agentic_execution
+ # Copilot CLI tool arguments (sorted):
+ timeout-minutes: 20
+ run: |
+ set -o pipefail
+ printf '%s' "$(date +%s%3N)" > /tmp/gh-aw/agent_cli_start_ms.txt
+ trap 'gh_aw_exit_code=$?; mkdir -p /tmp/gh-aw >/dev/null 2>&1 || true; printf "%s" "$gh_aw_exit_code" > /tmp/gh-aw/agent_execution_exit_code.txt || true; rm -f "$HOME/.copilot/settings.json"' EXIT
+ mkdir -p "$HOME/.copilot"
+ printf '%s' '{"builtInAgents":{"rubberDuck":false}}' > "$HOME/.copilot/settings.json"
+ export XDG_CONFIG_HOME="$HOME"
+ touch /tmp/gh-aw/agent-step-summary.md
+ GH_AW_NODE_BIN=$(command -v node 2>/dev/null || true)
+ export GH_AW_NODE_BIN
+ export COPILOT_API_KEY="$COPILOT_DUMMY_BYOK"
+ (umask 177 && touch /tmp/gh-aw/threat-detection/detection.log)
+ GH_AW_MAX_AI_CREDITS="${GH_AW_MAX_AI_CREDITS:-400}"
+ printf '%s\n' "{\"\$schema\":\"https://github.com/github/gh-aw-firewall/releases/download/v0.27.43/awf-config.schema.json\",\"network\":{\"allowDomains\":[\"api.business.githubcopilot.com\",\"api.enterprise.githubcopilot.com\",\"api.github.com\",\"api.githubcopilot.com\",\"api.individual.githubcopilot.com\",\"github.com\",\"host.docker.internal\",\"registry.npmjs.org\",\"telemetry.enterprise.githubcopilot.com\"]},\"apiProxy\":{\"enabled\":true,\"enableTokenSteering\":true,\"maxRuns\":500,\"maxAiCredits\":${GH_AW_MAX_AI_CREDITS},\"maxCacheMisses\":5,\"models\":{\"agent\":[\"sonnet-6x\",\"gpt-5.4\",\"gpt-5.5\",\"gpt-5.6\",\"gpt-5.3\",\"gemini-pro\",\"any\"],\"antigravity\":[\"copilot/antigravity*\",\"google/antigravity*\",\"gemini/antigravity*\"],\"any\":[\"copilot/*\",\"anthropic/*\",\"openai/*\",\"google/*\",\"gemini/*\"],\"auto\":[\"copilot/auto\",\"large\"],\"claude\":[\"agent\"],\"codex\":[\"agent\"],\"coding\":[\"copilot/gpt-5*codex*\",\"openai/gpt-5*codex*\",\"gpt-5-codex\",\"kimi\"],\"computer-use\":[\"copilot/*computer-use*\",\"google/*computer-use*\",\"gemini/*computer-use*\",\"openai/*computer-use*\"],\"copilot\":[\"agent\"],\"deep-research\":[\"copilot/deep-research*\",\"copilot/o3-deep-research*\",\"copilot/o4-mini-deep-research*\",\"google/deep-research*\",\"gemini/deep-research*\",\"openai/o3-deep-research*\",\"openai/o4-mini-deep-research*\"],\"detection\":[\"small\"],\"evals\":[\"small\"],\"fable\":[\"copilot/*fable*\",\"anthropic/*fable*\"],\"gemini\":[\"agent\"],\"gemini-3-flash\":[\"copilot/gemini-3*flash*\",\"google/gemini-3*flash*\",\"gemini/gemini-3*flash*\"],\"gemini-3-pro\":[\"copilot/gemini-3*pro*\",\"google/gemini-3*pro*\",\"google/nano-banana*\",\"gemini/gemini-3*pro*\"],\"gemini-3.1-flash\":[\"copilot/gemini-3.1*flash*\",\"google/gemini-3.1*flash*\",\"gemini/gemini-3.1*flash*\"],\"gemini-3.1-pro\":[\"copilot/gemini-3.1*pro*\",\"google/gemini-3.1*pro*\",\"gemini/gemini-3.1*pro*\"],\"gemini-3.5-flash\":[\"copilot/gemini-3.5*flash*\",\"google/gemini-3.5*flash*\",\"gemini/gemini-3.5*flash*\"],\"gemini-3.6-flash\":[\"copilot/gemini-3.6*flash*\",\"google/gemini-3.6*flash*\",\"gemini/gemini-3.6*flash*\"],\"gemini-flash\":[\"copilot/gemini-*flash*\",\"google/gemini-*flash*\",\"gemini/gemini-*flash*\"],\"gemini-flash-lite\":[\"copilot/gemini-*flash*lite*\",\"google/gemini-*flash*lite*\",\"gemini/gemini-*flash*lite*\"],\"gemini-omni\":[\"copilot/gemini-omni*\",\"google/gemini-omni*\",\"gemini/gemini-omni*\"],\"gemini-pro\":[\"copilot/gemini-*pro*\",\"google/gemini-*pro*\",\"gemini/gemini-*pro*\"],\"gemma\":[\"copilot/gemma*\",\"google/gemma*\",\"gemini/gemma*\"],\"gpt-5\":[\"copilot/gpt-5*\",\"openai/gpt-5*\"],\"gpt-5-codex\":[\"copilot/gpt-5*codex*\",\"openai/gpt-5*codex*\"],\"gpt-5-mini\":[\"copilot/gpt-5*mini*\",\"openai/gpt-5*mini*\"],\"gpt-5-nano\":[\"copilot/gpt-5*nano*\",\"openai/gpt-5*nano*\"],\"gpt-5-pro\":[\"copilot/gpt-5*pro*\",\"openai/gpt-5*pro*\"],\"gpt-5.1\":[\"copilot/gpt-5.1*\",\"openai/gpt-5.1*\"],\"gpt-5.2\":[\"copilot/gpt-5.2*\",\"openai/gpt-5.2*\"],\"gpt-5.3\":[\"copilot/gpt-5.3*\",\"openai/gpt-5.3*\"],\"gpt-5.4\":[\"copilot/gpt-5.4*\",\"openai/gpt-5.4*\"],\"gpt-5.5\":[\"copilot/gpt-5.5*\",\"openai/gpt-5.5*\"],\"gpt-5.6\":[\"copilot/gpt-5.6*\",\"openai/gpt-5.6*\"],\"grok\":[\"copilot/*grok*\",\"openai/*grok*\"],\"haiku\":[\"copilot/*haiku*\",\"anthropic/*haiku*\"],\"image-generation\":[\"copilot/gpt-image*\",\"openai/gpt-image*\",\"openai/chatgpt-image*\",\"copilot/gemini-*image*\",\"google/gemini-*image*\",\"gemini/gemini-*image*\",\"google/imagen*\"],\"kimi\":[\"copilot/kimi*\",\"openai/kimi*\"],\"kiwi\":[\"copilot/kiwi*\",\"openai/kiwi*\"],\"large\":[\"sonnet\",\"gpt-5-pro\",\"gpt-5\",\"gemini-pro\"],\"lyria\":[\"google/lyria*\",\"gemini/lyria*\",\"copilot/lyria*\"],\"mai-code\":[\"copilot/MAI-Code*\",\"copilot/mai-code*\",\"openai/MAI-Code*\"],\"mai-code-1-flash-picker\":[\"copilot/MAI-Code-1-Flash-picker*\",\"copilot/mai-code-1-flash-picker*\",\"openai/MAI-Code-1-Flash-picker*\"],\"mini\":[\"haiku\",\"gpt-5-mini\",\"gpt-5-nano\",\"gemini-flash-lite\"],\"nano-banana\":[\"copilot/nano-banana*\",\"google/nano-banana*\",\"gemini/nano-banana*\"],\"opus\":[\"copilot/*opus*\",\"anthropic/*opus*\"],\"opusplan\":[\"opus?effort=high\"],\"raptor-mini\":[\"copilot/raptor*\",\"openai/raptor*\"],\"reasoning\":[\"copilot/o1*\",\"copilot/o3*\",\"copilot/o4*\",\"openai/o1*\",\"openai/o3*\",\"openai/o4*\"],\"robotics\":[\"copilot/*robotics*\",\"google/*robotics*\",\"gemini/*robotics*\"],\"small\":[\"mini\"],\"small-agent\":[\"haiku\",\"gpt-5-mini\",\"gemini-flash\"],\"sonnet\":[\"copilot/*sonnet*\",\"anthropic/*sonnet*\"],\"sonnet-6x\":[\"copilot/*sonnet-4.5*\",\"copilot/*sonnet-4.6*\",\"copilot/*sonnet-5*\",\"copilot/*sonnet-4-5-*\",\"anthropic/*sonnet-4-5-*\",\"copilot/*sonnet-4-6*\",\"anthropic/*sonnet-4-6*\",\"anthropic/*sonnet-5*\"],\"summarization\":[\"haiku\",\"gpt-5-mini\",\"gemini-flash-lite\",\"mini\"],\"veo\":[\"google/veo*\",\"gemini/veo*\"],\"vision\":[\"copilot/gemini-*image*\",\"google/gemini-*image*\",\"gemini/gemini-*image*\",\"copilot/gemini-*flash*\",\"google/gemini-*flash*\",\"gemini/gemini-*flash*\"]}},\"container\":{\"imageTag\":\"0.27.43,squid=sha256:26be5e0b8c8f4c41c8a59126b29bb5d80b07253597472ded2a16bdd75abcbf9d,agent=sha256:04e2d1987a565000a8f114b89d806ae7a3864dd4f944be65275b28c93d8690e6,api-proxy=sha256:d85f57975af5ea23af4996e41ed73fbc8f5b4a47402472bfe82e508f352cb0c1,cli-proxy=sha256:65c45ea2967984d0024f3df61bc71335658a77ede96c8d9665da7a5f33a795ab\"},\"logging\":{\"proxyLogsDir\":\"/tmp/gh-aw/sandbox/firewall/logs\",\"auditDir\":\"/tmp/gh-aw/sandbox/firewall/audit\"}}" > "${RUNNER_TEMP}/gh-aw/awf-config.json"
+ cp "${RUNNER_TEMP}/gh-aw/awf-config.json" /tmp/gh-aw/awf-config.json
+ export GH_AW_MODELS_JSON_PATH="/tmp/gh-aw/models.json"
+ GH_AW_DOCKER_HOST=""
+ if [[ "${DOCKER_HOST:-}" =~ ^tcp:// ]]; then
+ GH_AW_DOCKER_HOST="${DOCKER_HOST}"
+ fi
+ if [[ "${DOCKER_HOST:-}" =~ ^tcp:// ]]; then
+ _GH_AW_CHROOT_JSON=$(jq -c --arg src "${RUNNER_TEMP}/gh-aw" --arg user "$(id -un)" --argjson uid "$(id -u)" --argjson gid "$(id -g)" --arg home "${RUNNER_TEMP}/gh-aw/home" '.chroot={"binariesSourcePath":$src,"identity":{"user":$user,"uid":$uid,"gid":$gid,"home":$home}}' "${RUNNER_TEMP}/gh-aw/awf-config.json") || { echo "chroot config patch failed" >&2; exit 1; }
+ printf '%s\n' "$_GH_AW_CHROOT_JSON" > "${RUNNER_TEMP}/gh-aw/awf-config.json"
+ printf '%s\n' "$_GH_AW_CHROOT_JSON" > "${RUNNER_TEMP}/gh-aw/awf-config.json"
+ fi
+ GH_AW_TOOL_CACHE_MOUNT=""
+ GH_AW_TOOL_CACHE="${RUNNER_TOOL_CACHE:?RUNNER_TOOL_CACHE must be set}"
+ if [ -d "$GH_AW_TOOL_CACHE" ]; then
+ if [[ "$GH_AW_TOOL_CACHE" != /opt/* ]]; then
+ GH_AW_TOOL_CACHE_MOUNT="$GH_AW_TOOL_CACHE:$GH_AW_TOOL_CACHE:ro"
+ fi
+ fi
+ # shellcheck disable=SC1003,SC2016,SC2086
+ awf --config "${RUNNER_TEMP}/gh-aw/awf-config.json" --container-workdir "${GITHUB_WORKSPACE}" --mount "${RUNNER_TEMP}/gh-aw:${RUNNER_TEMP}/gh-aw:ro" --mount "${RUNNER_TEMP}/gh-aw:/host${RUNNER_TEMP}/gh-aw:ro" ${GH_AW_TOOL_CACHE_MOUNT:+--mount "$GH_AW_TOOL_CACHE_MOUNT"} ${GH_AW_DOCKER_HOST:+--docker-host "$GH_AW_DOCKER_HOST"} --env-all --exclude-env COPILOT_GITHUB_TOKEN --log-level info --skip-pull \
+ -- /bin/bash -c 'set +o histexpand; : "${RUNNER_TOOL_CACHE:?RUNNER_TOOL_CACHE must be set}"; GH_AW_TOOL_CACHE="$RUNNER_TOOL_CACHE"; export PATH="$(find "$GH_AW_TOOL_CACHE" -maxdepth 5 -type d -name bin 2>/dev/null | tr '\''\n'\'' '\'':'\'')$PATH"; [ -n "$GOROOT" ] && export PATH="$GOROOT/bin:$PATH" || true; [ -n "$ERLANG_HOME" ] && export PATH="$ERLANG_HOME/bin:$PATH" || true && GH_AW_NODE_EXEC="${GH_AW_NODE_BIN:-}"; if [ -z "$GH_AW_NODE_EXEC" ] || [ ! -x "$GH_AW_NODE_EXEC" ]; then GH_AW_NODE_EXEC="$(command -v node 2>/dev/null || true)"; fi; if [ -z "$GH_AW_NODE_EXEC" ]; then echo "node runtime missing on this runner — check runtimes.node in workflow YAML" >&2; exit 127; fi; GH_AW_NPM_GLOBAL_ROOT="$(npm root -g 2>/dev/null || true)"; if [ -n "$GH_AW_NPM_GLOBAL_ROOT" ]; then export NODE_PATH="${GH_AW_NPM_GLOBAL_ROOT}${NODE_PATH:+:${NODE_PATH}}"; fi; "$GH_AW_NODE_EXEC" ${RUNNER_TEMP}/gh-aw/actions/copilot_harness.cjs /usr/local/bin/copilot --add-dir /tmp/gh-aw/ --log-level all --log-dir /tmp/gh-aw/sandbox/agent/logs/ --disable-builtin-mcps --no-ask-user --allow-all-tools --add-dir "${GITHUB_WORKSPACE}" --prompt-file /tmp/gh-aw/aw-prompts/prompt.txt' 2>&1 | tee -a /tmp/gh-aw/threat-detection/detection.log
+ env:
+ AWF_REFLECT_ENABLED: 1
+ COPILOT_AGENT_RUNNER_TYPE: STANDALONE
+ COPILOT_DUMMY_BYOK: dummy-byok-key-for-offline-mode
+ COPILOT_GITHUB_TOKEN: ${{ github.token }}
+ COPILOT_MODEL: detection
+ GH_AW_LLM_PROVIDER: github
+ GH_AW_MAX_AI_CREDITS: ${{ vars.GH_AW_DEFAULT_DETECTION_MAX_AI_CREDITS || '400' }}
+ GH_AW_MAX_TURNS: ${{ vars.GH_AW_DEFAULT_MAX_TURNS || '' }}
+ GH_AW_PHASE: detection
+ GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
+ GH_AW_TIMEOUT_MINUTES: 20
+ GH_AW_VERSION: v0.84.3
+ GITHUB_API_URL: ${{ github.api_url }}
+ GITHUB_AW: true
+ GITHUB_COPILOT_INTEGRATION_ID: agentic-workflows
+ GITHUB_HEAD_REF: ${{ github.head_ref }}
+ GITHUB_REF_NAME: ${{ github.ref_name }}
+ GITHUB_SERVER_URL: ${{ github.server_url }}
+ GITHUB_STEP_SUMMARY: /tmp/gh-aw/agent-step-summary.md
+ GITHUB_WORKSPACE: ${{ github.workspace }}
+ GIT_AUTHOR_EMAIL: github-actions[bot]@users.noreply.github.com
+ GIT_AUTHOR_NAME: github-actions[bot]
+ GIT_COMMITTER_EMAIL: github-actions[bot]@users.noreply.github.com
+ GIT_COMMITTER_NAME: github-actions[bot]
+ RUNNER_TEMP: ${{ runner.temp }}
+ S2STOKENS: true
+ TRACEPARENT: ${{ env.GITHUB_AW_OTEL_TRACE_ID != '' && env.GITHUB_AW_OTEL_PARENT_SPAN_ID != '' && format('00-{0}-{1}-01', env.GITHUB_AW_OTEL_TRACE_ID, env.GITHUB_AW_OTEL_PARENT_SPAN_ID) || '' }}
+ - name: Parse threat detection token usage for step summary
+ id: parse_detection_token_usage
+ if: always()
+ continue-on-error: true
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_TOKEN_USAGE_SUMMARY_TITLE: Threat Detection Token Usage
+ with:
+ script: |
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require('${{ runner.temp }}/gh-aw/actions/parse_token_usage.cjs');
+ await main();
+ - name: Upload threat detection log
+ if: always() && steps.detection_guard.outputs.run_detection == 'true'
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+ with:
+ name: detection
+ path: /tmp/gh-aw/threat-detection/detection.log
+ if-no-files-found: ignore
+ - name: Parse and conclude threat detection
+ id: detection_conclusion
+ if: always()
+ continue-on-error: true
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ RUN_DETECTION: ${{ steps.detection_guard.outputs.run_detection }}
+ DETECTION_AGENTIC_EXECUTION_OUTCOME: ${{ steps.detection_agentic_execution.outcome }}
+ GH_AW_DETECTION_CONTINUE_ON_ERROR: "true"
+ with:
+ script: |
+ try {
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require('${{ runner.temp }}/gh-aw/actions/parse_threat_detection_results.cjs');
+ await main();
+ } catch (loadErr) {
+ const continueOnError = process.env.GH_AW_DETECTION_CONTINUE_ON_ERROR !== 'false';
+ const detectionExecutionFailed = process.env.DETECTION_AGENTIC_EXECUTION_OUTCOME === 'failure';
+ const msg = 'ERR_SYSTEM: \u274C Unexpected error loading threat detection module: ' + (loadErr && loadErr.message ? loadErr.message : String(loadErr));
+ core.error(msg);
+ core.setOutput('reason', 'parse_error');
+ if (continueOnError && !detectionExecutionFailed) {
+ core.warning('\u26A0\uFE0F ' + msg);
+ core.setOutput('conclusion', 'warning');
+ core.setOutput('success', 'false');
+ } else {
+ core.setOutput('conclusion', 'failure');
+ core.setOutput('success', 'false');
+ core.setFailed(msg);
+ }
+ }
+
+ safe_outputs:
+ needs:
+ - activation
+ - agent
+ - detection
+ if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
+ runs-on: ubuntu-slim
+ permissions:
+ contents: write
+ issues: write
+ pull-requests: write
+ timeout-minutes: 45
+ env:
+ GH_AW_AGENT_AIC: ${{ needs.agent.outputs.aic }}
+ GH_AW_AIC: ${{ needs.agent.outputs.aic }}
+ GH_AW_AMBIENT_CONTEXT: ${{ needs.agent.outputs.ambient_context }}
+ GH_AW_CALLER_WORKFLOW_ID: "${{ github.repository }}/advanced-copilot-cli-sync"
+ GH_AW_DETECTION_CONCLUSION: ${{ needs.detection.outputs.detection_conclusion }}
+ GH_AW_DETECTION_REASON: ${{ needs.detection.outputs.detection_reason }}
+ GH_AW_EFFECTIVE_TOKENS: ${{ needs.agent.outputs.effective_tokens }}
+ GH_AW_ENGINE_ID: "copilot"
+ GH_AW_ENGINE_MODEL: ${{ needs.agent.outputs.model }}
+ GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }}
+ GH_AW_THREAT_DETECTION_AIC: ${{ needs.detection.outputs.aic }}
+ GH_AW_WORKFLOW_ID: "advanced-copilot-cli-sync"
+ GH_AW_WORKFLOW_NAME: "Advanced Copilot CLI Content Sync"
+ GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/${{ github.repository }}/blob/${{ github.ref_name }}/.github/workflows/advanced-copilot-cli-sync.md"
+ outputs:
+ code_push_failure_count: ${{ steps.process_safe_outputs.outputs.code_push_failure_count }}
+ code_push_failure_errors: ${{ steps.process_safe_outputs.outputs.code_push_failure_errors }}
+ create_discussion_error_count: ${{ steps.process_safe_outputs.outputs.create_discussion_error_count }}
+ create_discussion_errors: ${{ steps.process_safe_outputs.outputs.create_discussion_errors }}
+ created_pr_number: ${{ steps.process_safe_outputs.outputs.created_pr_number }}
+ created_pr_url: ${{ steps.process_safe_outputs.outputs.created_pr_url }}
+ process_safe_outputs_processed_count: ${{ steps.process_safe_outputs.outputs.processed_count }}
+ process_safe_outputs_temporary_id_map: ${{ steps.process_safe_outputs.outputs.temporary_id_map }}
+ steps:
+ - name: Setup Scripts
+ id: setup
+ uses: github/gh-aw-actions/setup@c863074b673419603d146aab585e2986ef08deec # v0.84.3
+ with:
+ destination: ${{ runner.temp }}/gh-aw/actions
+ job-name: ${{ github.job }}
+ trace-id: ${{ needs.activation.outputs.setup-trace-id }}
+ parent-span-id: ${{ needs.activation.outputs.setup-parent-span-id || needs.activation.outputs.setup-span-id }}
+ env:
+ GH_AW_SETUP_WORKFLOW_NAME: "Advanced Copilot CLI Content Sync"
+ GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/advanced-copilot-cli-sync.lock.yml@${{ github.ref }}
+ GH_AW_INFO_VERSION: "1.0.77"
+ GH_AW_INFO_AWF_VERSION: "v0.27.43"
+ GH_AW_INFO_ENGINE_ID: "copilot"
+ - name: Download agent output artifact
+ id: download-agent-output
+ continue-on-error: true
+ uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+ with:
+ name: agent
+ path: /tmp/gh-aw/
+ - name: Setup agent output environment variable
+ id: setup-agent-output-env
+ if: steps.download-agent-output.outcome == 'success'
+ run: |
+ mkdir -p /tmp/gh-aw/
+ find "/tmp/gh-aw/" -type f -print
+ echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT"
+ - name: Download patch artifact
+ continue-on-error: true
+ uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+ with:
+ name: agent
+ path: /tmp/gh-aw/
+ - name: Checkout repository
+ if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
+ uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+ with:
+ persist-credentials: true
+ token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+ - name: Configure Git credentials
+ if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request')
+ env:
+ GITHUB_REPOSITORY: ${{ github.repository }}
+ GITHUB_SERVER_URL: ${{ github.server_url }}
+ GIT_TOKEN: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+ run: bash "${RUNNER_TEMP}/gh-aw/actions/configure_git_credentials.sh"
+ - name: Configure GH_HOST for enterprise compatibility
+ id: ghes-host-config
+ shell: bash
+ run: | # zizmor: ignore[github-env] - GITHUB_SERVER_URL is set by GitHub Actions, not user input.
+ # Derive GH_HOST from GITHUB_SERVER_URL so the gh CLI targets the correct
+ # GitHub instance (GHES/GHEC). On github.com this is a harmless no-op.
+ GH_HOST="${GITHUB_SERVER_URL#https://}"
+ GH_HOST="${GH_HOST#http://}"
+ echo "GH_HOST=${GH_HOST}" >> "$GITHUB_ENV"
+ - name: Process Safe Outputs
+ id: process_safe_outputs
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ env:
+ GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }}
+ GH_AW_COMMENT_ID: ${{ needs.activation.outputs.comment_id }}
+ GH_AW_ALLOWED_DOMAINS: "api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,github.com,host.docker.internal,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,ppa.launchpad.net,raw.githubusercontent.com,registry.npmjs.org,s.symcb.com,s.symcd.com,security.ubuntu.com,telemetry.enterprise.githubcopilot.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com,www.googleapis.com"
+ GITHUB_SERVER_URL: ${{ github.server_url }}
+ GITHUB_API_URL: ${{ github.api_url }}
+ GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"create_pull_request\":{\"base_branch\":\"main\",\"labels\":[\"automated-update\",\"learning-hub\",\"advanced-copilot-cli\"],\"max\":1,\"max_patch_files\":100,\"max_patch_size\":4096,\"protect_top_level_dot_folders\":true,\"protected_files\":[\"package.json\",\"bun.lockb\",\"bunfig.toml\",\"deno.json\",\"deno.jsonc\",\"deno.lock\",\"global.json\",\"NuGet.Config\",\"Directory.Packages.props\",\"mix.exs\",\"mix.lock\",\"go.mod\",\"go.sum\",\"stack.yaml\",\"stack.yaml.lock\",\"pom.xml\",\"build.gradle\",\"build.gradle.kts\",\"settings.gradle\",\"settings.gradle.kts\",\"gradle.properties\",\"package-lock.json\",\"yarn.lock\",\"pnpm-lock.yaml\",\"npm-shrinkwrap.json\",\"requirements.txt\",\"Pipfile\",\"Pipfile.lock\",\"pyproject.toml\",\"setup.py\",\"setup.cfg\",\"Gemfile\",\"Gemfile.lock\",\"uv.lock\",\"CODEOWNERS\",\"DESIGN.md\",\"README.md\",\"CONTRIBUTING.md\",\"CHANGELOG.md\",\"SECURITY.md\",\"CODE_OF_CONDUCT.md\",\"AGENTS.md\",\"CLAUDE.md\",\"GEMINI.md\"],\"protected_files_policy\":\"request_review\",\"title_prefix\":\"[bot] \"},\"create_report_incomplete_issue\":{},\"missing_data\":{},\"missing_tool\":{},\"noop\":{\"max\":1,\"report-as-issue\":\"true\"},\"report_incomplete\":{}}"
+ GH_AW_CI_TRIGGER_TOKEN: ${{ secrets.GH_AW_CI_TRIGGER_TOKEN }}
+ with:
+ github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+ script: |
+ const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+ setupGlobals(core, github, context, exec, io, getOctokit);
+ const { main } = require('${{ runner.temp }}/gh-aw/actions/process_safe_outputs.cjs');
+ await main();
+ - name: Upload Safe Outputs Items
+ if: always()
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+ with:
+ name: safe-outputs-items
+ path: |
+ /tmp/gh-aw/safe-output-items.jsonl
+ /tmp/gh-aw/temporary-id-map.json
+ /tmp/gh-aw/process-safe-outputs.stdout.log
+ /tmp/gh-aw/process-safe-outputs.stderr.log
+ if-no-files-found: ignore
+
+ update_cache_memory:
+ needs:
+ - activation
+ - agent
+ - detection
+ if: always() && needs.detection.result == 'success' && needs.agent.result == 'success'
+ runs-on: ubuntu-slim
+ permissions:
+ actions: write
+ env:
+ GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }}
+ GH_AW_WORKFLOW_ID_SANITIZED: advancedcopilotclisync
+ steps:
+ - name: Setup Scripts
+ id: setup
+ uses: github/gh-aw-actions/setup@c863074b673419603d146aab585e2986ef08deec # v0.84.3
+ with:
+ destination: ${{ runner.temp }}/gh-aw/actions
+ job-name: ${{ github.job }}
+ trace-id: ${{ needs.activation.outputs.setup-trace-id }}
+ parent-span-id: ${{ needs.activation.outputs.setup-parent-span-id || needs.activation.outputs.setup-span-id }}
+ env:
+ GH_AW_SETUP_WORKFLOW_NAME: "Advanced Copilot CLI Content Sync"
+ GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/advanced-copilot-cli-sync.lock.yml@${{ github.ref }}
+ GH_AW_INFO_VERSION: "1.0.77"
+ GH_AW_INFO_AWF_VERSION: "v0.27.43"
+ GH_AW_INFO_ENGINE_ID: "copilot"
+ - name: Download cache-memory artifact (default)
+ id: download_cache_default
+ uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+ continue-on-error: true
+ with:
+ name: cache-memory
+ path: /tmp/gh-aw/cache-memory
+ - name: Check if cache-memory folder has content (default)
+ id: check_cache_default
+ shell: bash
+ run: |
+ if [ -d "/tmp/gh-aw/cache-memory" ] && [ "$(ls -A /tmp/gh-aw/cache-memory 2>/dev/null)" ]; then
+ echo "has_content=true" >> "$GITHUB_OUTPUT"
+ else
+ echo "has_content=false" >> "$GITHUB_OUTPUT"
+ fi
+ - name: Save cache-memory to cache (default)
+ if: steps.check_cache_default.outputs.has_content == 'true'
+ uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+ with:
+ key: memory-none-nopolicy-${{ env.GH_AW_WORKFLOW_ID_SANITIZED }}-${{ github.run_id }}
+ path: /tmp/gh-aw/cache-memory
diff --git a/.github/workflows/advanced-copilot-cli-sync.md b/.github/workflows/advanced-copilot-cli-sync.md
new file mode 100644
index 00000000..1b9408aa
--- /dev/null
+++ b/.github/workflows/advanced-copilot-cli-sync.md
@@ -0,0 +1,149 @@
+---
+name: "Advanced Copilot CLI Content Sync"
+description: "Weekly check for updates to github-samples/advanced-copilot-cli. Opens a PR to keep the Learning Hub mirror aligned when substantive upstream course changes are detected."
+on:
+ schedule: weekly
+permissions:
+ contents: read
+ copilot-requests: write
+tools:
+ github:
+ toolsets: [repos]
+ cache-memory: true
+safe-outputs:
+ create-pull-request:
+ labels: [automated-update, learning-hub, advanced-copilot-cli]
+ title-prefix: "[bot] "
+ base-branch: main
+ allowed-files:
+ - "website/src/content/docs/learning-hub/advanced-copilot-cli/**"
+ - "website/public/images/learning-hub/advanced-copilot-cli/**"
+ - "website/astro.config.mjs"
+ - "website/src/content/docs/learning-hub/index.md"
+---
+
+# Advanced Copilot CLI Content Sync
+
+You are a documentation sync agent for the **awesome-copilot** Learning Hub. Your job is to check whether the upstream source repository [`github-samples/advanced-copilot-cli`](https://github.com/github-samples/advanced-copilot-cli) has received any meaningful updates since your last run, and — if it has — update the Learning Hub mirror so it stays aligned with the upstream course.
+
+## Step 1 — Determine what's new in the upstream repo
+
+1. Read `cache-memory` and look for a file named `advanced-copilot-cli-sync-state.json`. It may contain:
+ - `last_synced_sha` — the most recent commit SHA you processed on your previous run
+ - `last_synced_at` — a filesystem-safe timestamp in the format `YYYY-MM-DD-HH-MM-SS`
+
+2. Use GitHub tools to fetch recent commits from `github-samples/advanced-copilot-cli` (default branch):
+ - If `last_synced_sha` exists, list commits **since that SHA** (stop once you reach it).
+ - If no cached state exists, list commits from the **past 7 days**.
+
+3. Identify which files changed across those commits. Focus on:
+ - Markdown files under `content/` — the course module content
+ - Supporting assets referenced by the course material, especially screenshots and GIFs under `content/images/`
+ - Any configuration or metadata files that materially affect the course content or navigation
+
+4. If **no commits** were found since the last sync, stop here and call the `noop` safe output with a message like: "No new commits found in `github-samples/advanced-copilot-cli` since last sync (``). No action needed." Then update the cache with the latest SHA.
+
+## Step 2 — Read the changed upstream content
+
+For each file that changed in the upstream repo, use GitHub tools to fetch the **current file contents** from `github-samples/advanced-copilot-cli`. Pay close attention to:
+
+- New sections, commands, flags, or concepts introduced
+- Renamed or restructured sections
+- Deprecated commands or workflows that have been removed
+- Updated screenshots, GIFs, image references, or code examples
+- Links to new official documentation or resources
+
+## Step 3 — Compare against the local Learning Hub content
+
+Read the local files in the canonical Learning Hub course folder `website/src/content/docs/learning-hub/advanced-copilot-cli/`:
+
+```
+website/src/content/docs/learning-hub/advanced-copilot-cli/
+├── index.md
+├── 00-prerequisites.md
+├── 01-working-with-copilot-cli.md
+├── 02-building-ai-infrastructure.md
+├── 03-test-suite-remote-delegation.md
+├── 04-lifecycle-hooks.md
+├── 05-add-feature-barcode.md
+├── 06-modernize-apps.md
+├── 07-manage-infrastructure.md
+└── 08-wrap-up.md
+```
+
+The upstream module files under `content/` map to local pages by matching filename, so `content/00-prerequisites.md` mirrors `00-prerequisites.md`, and so on. The upstream `README.md` maps to the local `index.md` overview page.
+
+Also inspect local course assets in `website/public/images/learning-hub/advanced-copilot-cli/` when upstream changes touch screenshots, banners, or GIFs.
+
+If the upstream changes alter course structure or navigation, you may also need to inspect:
+
+- `website/astro.config.mjs`
+- `website/src/content/docs/learning-hub/index.md`
+
+Map the upstream changes to the relevant local file(s). Ask yourself:
+
+- Is the local mirror missing any upstream content, structure, assignments, examples, or visuals?
+- Is any existing Learning Hub content now outdated or incorrect based on upstream changes?
+- Do local route rewrites, repo-link rewrites, or asset paths need updating so the mirrored pages still work on the website?
+- Do the Astro frontmatter fields (especially `lastUpdated`) need updating because the mirrored page changed?
+
+If the local content is already fully consistent with the upstream changes — or the upstream changes are non-substantive (e.g., only CI config, typo fixes, or internal tooling changes) — stop here and call the `noop` safe output with a brief explanation. Still update the cache with the latest commit SHA.
+
+## Step 4 — Update the Learning Hub files
+
+For each local file that needs updating:
+
+1. Edit the relevant local docs, assets, and supporting navigation files so the website remains a **source-faithful mirror** of the upstream course:
+ - Add or update missing concepts, commands, flags, steps, assignments, demos, and visuals
+ - Correct or remove outdated information
+ - Localize newly added screenshots or GIFs into `website/public/images/learning-hub/advanced-copilot-cli/`
+ - Bump the `lastUpdated` frontmatter field to today's date (`YYYY-MM-DD`) for any page whose mirrored content changed
+
+2. Keep a **mirror-first** approach:
+ - Preserve upstream wording, headings, section order, assignments, and overall module flow as closely as practical
+ - Do not summarize, reinterpret, or "website-optimize" the course into a different learning experience
+ - Only adapt what the website requires: Astro frontmatter, route-safe internal links, GitHub repo links, local asset paths, and minor HTML/CSS hooks needed for presentation
+ - The upstream module files carry no Astro frontmatter and use reference-style navigation and cross-module links; when mirroring, add the Astro frontmatter and rewrite reference-style links that point at sibling module files (for example `[next-lesson]: ./01-working-with-copilot-cli.md`) into route-safe links to the mirrored page (for example `[next-lesson]: ../01-working-with-copilot-cli/`)
+ - Rewrite local image references (for example ``) to the localized website path `/images/learning-hub/advanced-copilot-cli/`
+ - Convert repo-root relative links that are invalid on the published website into absolute links to `https://github.com/github-samples/advanced-copilot-cli` (use `/tree/main/...` for directories and `/blob/main/...` for files)
+
+3. If upstream adds, removes, or renames major sections or modules:
+ - Create, delete, or rename the corresponding markdown files in `website/src/content/docs/learning-hub/advanced-copilot-cli/`
+ - Update `website/astro.config.mjs` if the sidebar module list must change
+ - Update `website/src/content/docs/learning-hub/index.md` only if the landing page's course entry must change
+
+## Step 5 — Update the sync state cache
+
+Before opening the PR, write an updated `advanced-copilot-cli-sync-state.json` to `cache-memory` with:
+
+```json
+{
+ "last_synced_sha": "",
+ "last_synced_at": "",
+ "files_reviewed": [""],
+ "files_updated": [""]
+}
+```
+
+## Step 6 — Open a pull request
+
+Create a pull request with your changes using the `create-pull-request` safe output. Use `main` as the base branch for all work related to this workflow. The PR body must include:
+
+1. **What changed upstream** — a concise summary of the commits and file changes found in `github-samples/advanced-copilot-cli`
+2. **What was updated locally** — list each mirrored Learning Hub file or asset you edited and what changed
+3. **Source links** — links to the relevant upstream commits or files
+4. A note that the markdown body of this workflow can be edited directly on GitHub.com without recompilation
+
+If there is nothing to change after your analysis, do **not** open a PR. Instead, call the `noop` safe output.
+
+## Guidelines
+
+- The canonical course content lives in `website/src/content/docs/learning-hub/advanced-copilot-cli/`; do not recreate legacy duplicates elsewhere
+- Prefer changes within the course docs and `website/public/images/learning-hub/advanced-copilot-cli/`
+- Only edit `website/astro.config.mjs` or `website/src/content/docs/learning-hub/index.md` when upstream course structure or navigation truly requires it
+- Preserve existing frontmatter fields; only update `lastUpdated` and `description` if genuinely warranted
+- Keep the course source-faithful; avoid summaries or interpretive rewrites
+- Use `main` as the base branch for any branch or PR created by this workflow
+- Do not auto-merge; the PR is for human review
+- If you are uncertain whether an upstream change warrants a Learning Hub update, err on the side of creating the PR — a human reviewer can always decline
+- Always call either `create-pull-request` or `noop` at the end of your run so the workflow clearly signals its outcome
diff --git a/website/astro.config.mjs b/website/astro.config.mjs
index 6c11bef2..80e63448 100644
--- a/website/astro.config.mjs
+++ b/website/astro.config.mjs
@@ -154,6 +154,24 @@ export default defineConfig({
"learning-hub/cli-for-beginners/07-putting-it-all-together",
],
},
+ {
+ label: "Advanced Copilot CLI",
+ items: [
+ {
+ label: "Overview",
+ link: "/learning-hub/advanced-copilot-cli/",
+ },
+ "learning-hub/advanced-copilot-cli/00-prerequisites",
+ "learning-hub/advanced-copilot-cli/01-working-with-copilot-cli",
+ "learning-hub/advanced-copilot-cli/02-building-ai-infrastructure",
+ "learning-hub/advanced-copilot-cli/03-test-suite-remote-delegation",
+ "learning-hub/advanced-copilot-cli/04-lifecycle-hooks",
+ "learning-hub/advanced-copilot-cli/05-add-feature-barcode",
+ "learning-hub/advanced-copilot-cli/06-modernize-apps",
+ "learning-hub/advanced-copilot-cli/07-manage-infrastructure",
+ "learning-hub/advanced-copilot-cli/08-wrap-up",
+ ],
+ },
{
label: "Copilot Workshops",
items: [
diff --git a/website/public/images/learning-hub/advanced-copilot-cli/03-copilot-work-surfaces.png b/website/public/images/learning-hub/advanced-copilot-cli/03-copilot-work-surfaces.png
new file mode 100644
index 0000000000000000000000000000000000000000..e18b7b9155abcb78c46444e8616693383e227cd4
GIT binary patch
literal 1550872
zcmXt9c{~)(`*#)PN-DRlR4U}Ya%`p2h03SgHmSC(+T6!pq)2j<%56y{xk7Gs-M3vz
z*1cFP7HchgAHTkT{Qh`e@Au3+&mZ%enP+C+ubKFpj`p&9RriXBh{#^Oa`Co^$nJks
z{EgKAz>A+1_zy&bZrfiFDZ{C+{3~31=z8^$gM-NFe_TpLH13Ir#Q$9Wnd(3L7n&z3
zBK{9W|5ukM_W!NBMe@Y|pNqfwpQC}h%0Us4b0SwSp8qdgbgfxB=6LthFW0YCh6;sH
zFVN)vOEava`!c?-Zm8UrFJHeC_{~UBNkRHgjnG`v0Jj$Y;fT
zGe(a5m;|6ko>{gEPd15)OVEu&mAf7p-K&B4koPH7@vt)aKK+jBD}Yc)U~CpXs>1Nr
zxu+fY2~T%4$Lzm65b~}@zx>~14xTfcADTFOAF%q|@yu3uPrMLJ`we!OPg^{25IFW&
zT8&+4lyD|nVd7`sq&1_-KUFJJ%{iC+b^x4fIGY0gtum4w?pY#MT*U0u2TrQtYK8fT
zO1UQ+srd&t-X#P(L&vana=Taln!eR;aU1>^^Bj>)#qW27#>2v1Do>UQZw}7S2L$03
zeYzg?eXeF}bUie`jNsD3oYrvLOA)MJ5z8=h$gxj$MM33$kG%A%q1mEupdVqO%OgIT
zDy!Xuu`TEy-_pZ@MyEA2FT<`Pw%5lNCm}y!SOQCV%=XU{tEAmFX@xQw1U(+$Q&u%izOhHTd~1)blbeZUuQ@dHWSVj16k
zKkZRj%_sv<=f|3~1rmrhb|3wTwdGNWpC_klS4VT)y~OR~wgUk`^mY9vMsm0}kyiDFmsp&JtI0BF?Z@S
zBC(v&Q&Wi0t>D|8?2<1#qxFzpKCtvTr_8Q?;|YN~0)9p;yz@1qMOH1k>w-Xa(y`P=
zXHAB=IaYBzx_Mf)D1osa!7)zmsc>;^yRF84rV(!P*m0c`@K%!e$
zU01fX71hEF8}uyqqC?3Gd}7LRQzKji;+m3Gq2|M*3)5&ugK>U|%44nX7+fl6
zEGI5Oz2jKsy)4@%?AtPy#%TG|Zw!Z;1SzM$>m9
zAasIBo7-S5M^~orO(WYc)menFyYJk(QkZYaV#qkAZz=aV&a#{Fh5oh2H$Hna#hUL3
zXNJZrJi)b+uaNoGomO(O2ljbD;!V*3EYkyCiRh_~#;D;VhhDyZ^lkRZ+4gOw_mv8#
zM(&HK*c2z)sC@UBT9&FdT6!+<{Kkixb>^IcXwFq)%F;cfy4WrEUn=eO0lS%%e=u8<
zrtdR}<16GZA=oBO@g{eM@t=fl`Ha7KiumlumKlCS5=h)Ou=2n8QQUlmd@#qrVqQhU
z_(TpfdB<1Ln^a-0+^$rRk{^Jru|0lSr=3%%
zh3@QjscgjTu2BFH3&+&YU-<6aSuXoarC!@9F?^?xb5@D}SKYg3QoOQ+sVJg+Zi#lM
zJ(<5-M3y00HGJ<#q-_YvPHC>|c$)MJDIlY%XtUjb7ZMsL*HWO}d7>r-hdBC{VJ)%-
zu@359ULknZ)3S~oo@GEPAbOXcOdm7bJ%`w;8)t2kHK(>8^{5VO_Y6kMN0udPr&E-H
zJW)w%o_s*iCjCQ*$947m_)-(e?2aPc>TM+}+GSdC`%eKR^
zrcW|Kgdnh&G+<&lj0$oJWy%v<-#m@M{xF(
zuWMyTR;Co?yRf;uIfy@i9$$lM_&>6_-UtceS6KJjYISw7E}DGH?%$FoBF*vQ^d*Sn
zV1!Bh-;T7n?dphASj*Ny*Z#~Kv)sVI1HOBjuN(_y)oje*mDlwl0TTc#&n%wB{kT?m
zCDc{^H}a|aUF0K8-%M)Njo>9UZL3rBV^p6S`MWYUN<&=#AI5l%h$W|;IR{jxi@?o$
zz}XIfjhCBIH?rt{frY^R#@LE5Jmvi{kf!g&A^MdYgaY7>3-{E~Q!nwBQl_7n2f85Z
zg4HW)Fc4%rhueSAvbdi;GFfHAjNcp4MZ9u%<*6T#D_%6C%!zh1>H{+ul#Vf<1J5J|a!7fiPL
zOg-KVOttZ!`|Cv!t0QK{TNWq}b?Xsc9td4B@-MAE7|bXp>{K5zI5uV78Gg5<@z}jw
zaC$+pI(tdfS{=WArnGZ5(#yWSZ}x(VOjBam7I|0Q6kvCxwI*`$FACADyD*T@gVzdd
z38FcRSZHgu9O-F`j4ye;r>fTS8*W0z5Gnb!CWz?Zy>E7sLNZrLJ9dLOmX;b4n)ER?
zurn3%@1Su_atHbP#0`X_pVj`-Vi~=9gf+%(N`01XcQN*kCBHh;zNvIaf!IRe9bb|v
z>yvl^Hi?6l;Bn)$6>)q}GQe@{11#r2@(fG!eRJS5Wbr0jQ?F}~bXjx~nK`YV`Gi;x
zC7vC{*!10aU$6Bali@~LK#V!zB2Ksl)U_B5OnDPV1B=gOj4b_vzQQ6l)#s@agL?NTD<9LBYYOt^&Lvf~>mqh$Y8T
z3?pfqOF`;GCEchNdcQ|sG!Da~Y8GeiKe;{G<>SopGOl>5WYz_q`v5
zGJ;#Dbg<3sFC#DV6F87p}OjrM0{*l<2t1>l_GA%v}EK79Nv5z2WZ34>MM(
zYa6VCGG;r^X|$QoQ2dil`E)II$xzefLC~(;>S|dKCnTbOS~;lHZ_YsZ_{fC3q@|L^Eu*&zYr2W=rX!b5oQ;fYf$et?Zw8?0SytPQ
z?hc*7&%C8@k-;yD9FA25Uu%DuXU`*>i?vx@%nV;Uu6#tL
zk`@lyLeHs(*U_hzHmYq5IM{_8I4;$dI~U|IXF3<%XL<9ON%!HzHVr^km~ouaKE{Hw
zk<0A!CLQGcm-_pGC}?*jbi12<`9#g@Cnr4OD@Fp2e+K)uY)uU$=cQeUe9uvIKd7B7
z!+MIkc^fr^9~UJlGEd&$+nr*;7`M}UY%vzq{Kz>spxbuZLEthaG4^BU%Bu*0+zxjJ
z`nh-Zz(QOM(~N|-u0Fu^!93_Jd=DuUhFKFz`wiu;0@ZRN?soyoj*cm`YkK}1th{Az
ze{+pShNh64(WR{1(AKQBe(yIF#BCUuc{dA#Z`t7e@!!rx5BRSCs)vT%Ae|NOCn;T@
z4-~#eSY)4inEm4guDWhnCHZZ&_DseD<7;`_ssqE?&iDJWltXLv7Y7N4I*ntHN!I2*
zI%ldGmO7z8rp=2q?8{BNqb~w;UMeOKJ>Se7sp78Y%AKi}Ua+(Cd_SdH#rzvBUF8YB
z+5|JdxQR4;t85+N{N8UKg4Vz9f5>31zR*7iC(+4#*AnW5QxSjS;BGtb=&SEEFL|)S
zQu2OcvL6%aZzIWd5u+AfDc5!&gqgi-?(TB*v>^s54k=Ms4>6<1Tbu0xoWb<#H&-Ge
z74xC+k~g>TKaM*jbXVNGW`~BA3}(KU{(_2hNyw~d?Y`wIz59^H)=o#xq-p2{wvTdI!yzbX`
z^}dy@#zT32OqGAxh-Q*#6eiOfv^IBiN*OB|`Q&i#b4Ebuc5f18J8Ak}&e4vgXUzlT
zpkstILhifm_T&ybW9xhU$p^AyrEcQj-&%d+ESlWOqNX*u<|3&NMmf(1ILAIQwsr-P
zSZONzvb!xZ2dt7o+P(R8cj25Y_gM|z!a1m)u6+G|5Q1x%60R*_aklww(%d3j^uXD_
ze)tlnV+ocq@t^d)%WTN5LqR+BGrckYQN<-f!)L3#4{3BMygYJ#v1)Nn8)@;&^+@kk
zpK6#!6IW&RQFG8bB(&7-ncgKOWAd#ad?A;yx(2RTUwT@;S>QtYvRRh4>%Uo&rmjTW
zXp?`h%0?!@IN(@_zzw+CeidMv1%#;)b_oZKbjJ7FznKafcK)%buNPtc0$SS445(PD
zkJg=Q%ovY5PZM&eKvSZE3uoVAG^>#~$lU8_FmpBKA*aBUGgVvxuKb{IETQJz0V~VK
zFs-{KlaGGK(VqJ^UzQnP@^}|KA?uf`0WiG@SsXNh+`q48#-41lj3;jMgKc5
zLvvQML)wi+=0sJRwON9Ya#MwUCU8l8dxEG#rOExd3dQmScC%iodGq)zO|@7o8~7YF
zckaDlLAH0^LcBOeOAcAOc;Evnjo4UwqYpaEoYu$h0z`vP7O3utTANV3{U&SkAl>V2gy_kJVGT0vQK9<{mKJ1M)6
zp$xW&4cVFV&()1VjX%|Wc0YgRur@nXm{guXc>5{oDq+2-IGuyQ)*9r~YG6
zKCFwW`n&;<#*2P^`ZdPzL~{M^(K<+bTlmSe^@NUgk`!Ry9gwc>G$^F1GB>iwDRxF3
zTBb8J;Yff`*S?*(1^6^P$^{h3Reu>7uu+>_hTpqb$G~7$?&QDunnbUgh#wk71mONN
zK8ExEJ97|NC%?vz8
zf+Dz#sEN!)ttQ8Ixi~S=71qX_Dfou%5?48W$U0M%9(jgWSq@sftC_#Hj$A_xeWnG?5Nmmpit|
z#?oK7@kSJD#J*D~D7SfATwKE9Gz~=C*{RHIi1Y2OkTTezR_6qb8_LVvf4m+OlSd7b
z+W`jqp^|J@E>;SU<9UaDfv!*GXI^~I879S2JcRqDfHu9&f!xhH;f0LiSzgpxcNID6
ziErIIBb6oS@l_<3fh-5Mlk79Fw)*!5dn6Pz)hkbS-STste~2jYARVaRG-&Du^TQ_@
z7}JQ$PRHWSzzPm$HGcnrIh4#v-L(){2`rklFHXjQDk`Eo<>yixX}e!;EgZWO7xLJd
zR|+OKGyncgotjhOPk0KGP-R(Grc+a6fAsIp=>k5sG>m*nG9^zcY+RiA-oS
zp!%<56W=FC%Wu9|o~YsCbhJ#;LB;0+2ooLP^koMHM?Th-i3e0d9alh_YDE+kt{cjH
zZjy?W>5RyJk{n;WqjQUqb&4_rI!{dUe86?N&bT_R3GbXq$F*6(NnAm`@{*6f&8MO{
zTadh??8$)=$|LsbntM=XOHjAfk{xzeDTi3kR_x~-xyXBqTD|cDp#)&
zb@u+|o!P=o^=EYEcaPVX&N({{t}A>y`T6j*La~i^InlS_3H2>9Loy*X5RG
zB}-+wNzJwq3pcRs&br2-Xs0g&Zqrl|CAG3%w*qoRz+)aO5_MS4VNK=EbH+llj%u}>
zZI377XiQ)5&UcsNsl|{isS{YiR$Gff>Zh^&hpYnDDwF`p?Sb#0$yt!d*FoU}Hmulj
zGYLSQ2JB4jtr(%6GsMdB*Jk9)|2+8VwPxMESzj2?fz5;6P2J=2=h=zG_!F;fz2B5*
zoc1*}0Ou52YGW$C);Ou9Xlq~QBgUGd!z~;>n2vZmWSbjF?0;MCrs}UMu9{uX-{c<^
z4v)CrcMT)DotW(Fof#YH`egX+rF>0rVeRX7*D~m0)GqA9^eB=h&N
z=*6A55YY-^u}SZpc%Yw8^O*WUGR;oQp1HaCC%;Gr_C{p|OjVUZQoK4zVRys7utt)n
z%Toe=9xSU@4FZe5sLWk5Sn1eJ3Jf(&6&fvjKdyWG&cyVF6Bmy3P02XSL@&asOm?C+I;k;z2#!I$wB99ik1ywy-4TE<7N>_>
zDc#qLVXbi_b}%I~;XCQ?V!Q)@Ihdd`AIy(tyr2f1#}7z`KiB*GcV9c`W~mbH;wxZ7
zA8>4^)!X#-{VkKipK&K?0(>
z6E%#B3+_GD?>gMdt^y-peWi^z-?REc!KL+D+e(|?Q@3k^VJ>V0t{i>vRR2*aWorTcAGYz>56_D|uqT@c
zZ&ymR^_{Om@(goC4c`F`o`!UC?+$!`~a09GPlGmM
zpG}v?z`_g2M$j{90f91IhDBK{$uzUaz{tYcD!`kL;8gCE)tvL6zmqm(m!|^)g7q~h
zs_2p6mgE9`spM_1f554}0PoYgZ?NoAR38v(*g4#h>o@1ifED=e#61Is-ZBM6<6&|)
znKw$s6Y`jzF|A!7>aTOfghS5}n}5AaXLPzup9JBDhc@>wse7`FcMmvblb1Cn<)Hyi
z#c$VDECy(#w8!Ct_HyDq?N=_J#)F=RcGUjt7&OjD4dq`7Kx`*NOtr#0G5JRrL7_J0As7g}vdDX$&yzOlPzt?+eJ
z61D!yRI8Q5i4-iBBCT4W-jC-L>uaQ~3~Dw%b(!l)~jw|?!4c$VCI^waKG
zHBju%lQ4xz+rti{iq9<`$=;__pEwBSu|%>Xb1Y;Be!G~DaK;?rfA0g~(OhxiXmUf(
zyFav>$J(0rewBx`#W|@Q0#x+6U0yF7|5gQh&<=+4D_{AYE8MMKnV2j3?yxWS=gS3_
z2MNsH^HBYVzpvK0sNbTTQK$Va0Y9H7<=1F|cAHdV<;40$rv6>>$7HUHU2v41&8=H9
z2Soq`mh_?kl03juF$VpX{X|&41Ke`5cBTkTW<};8mpHsVSv*ey;
zdz2%y6Cj^X&gvH-Ps@&vx`0!~-2`DxOp-P>NUzDbiJ8i{!7}B!9vfG~GOM1I;e5sj
zC##9FSlb$;PtHX|zHS>{adEjyN=L`jDUC4es#ohM248t1>7ST`j;cy_m3
zk9B`DD9cC(bM2BYVoZc-+yxk@^cWur+FcWnb1dL6G!17lN4G)4rJ%CyrITo2DElR
zl}THD6Pun;;S{Xh{>7JyGif%T%l+z`4SJ9qep~&8ny+(Abk9$&z3Z>N589GNf@Jue
zas99}nh`T*LXP(5FXkb)#J1Vef9!>exhYPC_CUaEb5gf@3%3qW3e-`rJS3PE2$rs6
z^zDGF{QaDG5+WDc!$q=Z)8NOhqhg#E`3Jf82(oKi2nzCj#0
zr_EFzH#41VoJ<@S1e(lX#($w(uMF;c?xbeKG+!DG0F>4%#p~7XnHWgPEvEa`nr`uJ
zgzc!oYIGE#U}a(7y>jWQ(qmQ`qsiR811x9fR{g1iTZ^l$+&!yWsQ0y(0Q~o%i(gJn
z>x>Lf>kv;bKG4RH!{37RW+bK|OQ5lB;qYr*k}dIFH#Xu@lHZxK^f1I?4+8(}V8OJS
zaD&>-r?Zv15-T+0A)f{T`~!XHdg76>0)C2Y64S|6{1v!bGF6hbM7Y){TH_XNQ#Km+
z(7=N#Zjl9|V4H5eP{%E6;B%)Q7oIFeu9!+-&%tM@RiPDfeYsyRb8o+?>SkZH8dzTt
z*-so({*0|L$D|+FG@RK{`67Mn=yLNL_OhBR3>|`_ErI3lh?!}^wu;bS-iZEMq*)#S
z{=8no&lg*y{oHeXHyy8flWy4pV~w$2yh;r6FEI=p+#`R+kYNAdk_~$^kDD!=?HTr-
zavhQhP)^Yx%(}Ir3FzhSL%^V?O35L-y*8_t&xHSc+f|925bGmH$3;u!X;Qnp_xsP}
zLTQsIf7D+w+H(5Qq;C_>X7Fi>pxKa``fB);A_z)W7<$4kF7ILT7+5B;9YvsG4lf6DRE!W1C-?H}th+YJ
zNa71M>ao)&R=kLryYV$Xb!uq!s&X$8Vz-g+8%?bs!?FzVhVbmL&6HE6
zr9I>v+A{P0)~zR-?S|2{fYj8@5OLXoi1!iUa?~%4bLP!rnYEmx*}m`{@$ALg*u4hP
zXJA0}PzOO3l4M?k!3}mIX<32m>*7^G6*m0+;hU!^^SiNVkQ`xC<67rOxi?!jkJdDf
z`L&GAM6A}F@L46&B^!oO%S7%T76!G!#LqvZ^N$=^Dw4`HByFM*8$jqQ?lNfIKsb$7
zf6B;}7k2taZaT?|?`&^col7&zUOiA%GqLu#l$Z?$&f^3J3G0)>zsR*=X9eYV!618z
z<@VlX;fFC-QJ(shZ2VK43wJ^d_UJy(IsB)~z4`sdZgE!7U7rUd@sdvx<>?nQD(YYN
zN#?lL)MSgpHL?@vkbt_~`#x5iiCqp*)wsymlrrAbs2;G_My_c}rv#1h<_77~8AhsD
z^2~#gDth2{
zb+xc*pC)rIDJh^9)wzF2BC|YqVX4oJ#pWzR`Cm*{Z#m6(E%v6Z5b5wjr{%-WQiZ6G
z=3V{4ch`+~-z)@3(rTP+NI=6saT`_uB)7QG_`8bZTAwCD7r#Q^rdP>dyT0fKUuh0~
zx;N=pFW(2UE1Qz-L{7MF5jylWGceym>-dcqN2G{l=BD#!lq8Zabi?nF;d;nNn{mxF
zyW5XDt+5!b)@ES;99f)jaE3PD5gQZTtY8WI?0)uv|dkdRZh<1Je*{Rom
zUY&-jf0W^POh38F%CY%`{+}JPXcV7LGZf61A;&K&@Pj};pM{h#mO3y0u~QIg3?75MAyHam;r0$xzUlGTPIxjYWwo5~nv*N~hD<3qxo=Cr48*26oM0
zebMrDMuJAk1FO4CtGIg)Y1-BfS{sJHg)`=5^0v;qVK`8LkDgC`I3g!R#D4gEQqIV*
zn!-ByKU3bI;#;lQ?`MIVX3gBsb>rSgT$cS;V6ecc`oy78igaK2+AQ>Yw^
zV@vZMoI%fdq}NG9ZI|W)CZKkXv)RNq!GirCQX+Pfr4@^u%NcstYQQ|@*LwDCiZScW
zl2!#9o6_IE^a9S|Y99~kXxueXMR$r}(zO5d(`v9xwKM4HCztysScSw{edOM=O!jZ5
z%u5GRTWi00ku|x%m8_7VTDW-B?o~w*l`TNjK9#yvnz$R$eM8ZRtzs+GoxV32sn8Q}
zA4PY#!jlRdKx~;C{(Y;t9dgkpEX;dT8Or*qGj;E2tZs--|CjL)n+q?UdLG-fe7&h&
zZ)mr>5FjNFn|G+;0T`*gFA90)5@(E9D9+(?_8J{la4#;f>{u3U|&cUwS)C3pvF5Mi(X_rV3
zT6L?{-b-HW1=7&#=Fk{(p*I0b4%*<+IXUO@!u&S~2WH4cfo#UDmf?a+Y@VwtFWXlW
zkT~i;kyQb|1g}rd{^+W(yorziKtLhAwr>8v)~BE?M>}-RBn>^JkB>LS+yICsotI`(
zUg;dp#A)bl@6nB3I=L=Bzu6lEJn6kzJ;gVwI@2Lvkm52{ih}g;hg`qIa!X2u?|sf{
z!JUP!VZt^`cEqjAAEkm&#}D&A*gqqke^+kTRh;#FUefAAtYee!)8u7_HvOn=Qm>@8
zdV?q8tls!%FgoAJyZfNltg&XcAQMJAeJIGDHExQu)*d}@=r{8GbJD#1`)&)zYH3yq
zV)IR)K{BBeg4GjAT53=5-t1QsFisl+s9pU-ku7V%50gNw05jsTJC9^no$uR?b$y4>
zCujTP0e{lC@0M$%`We0Qt*+Cc2s(HgDADT*WL0Tk@^dh}i>Z#+Jr;2Wv)&LeCw(-t!&>yR
z=^U&~Vw}5~_h0*onUwhAJvZ30kE|R$k4U}blh`dHVj_NzlZ$BeaqK(E6;^5c*1>J$
zh%cU-E#}-*sQ5XoA+EI4
z&nIdi)Bfy?T;^#qd8rk!?Us)}OUyba1xs*>B+(~vqKUnUT7pdF4w_5Y#3%wyp*1;_
zVf~+~wZe;ud%sz_#J~d{LCW>;wWapRfKO0D(B?c8wMJD@*)%-L^eu3Jx@p<$FP~iX
zfP$xP<%XMqffe%qR!g+U?ChGPYNPlJ-rQ&@xy|GH=YgH2kJ9O=>YkE^hLWMT7raL<
zqx?5-NcvhN6F%zm(~yT>p6^&YsZy#{(*bB=~D
zsG+v9&pp-A%-n2o5gc{U!8ZQgXGtP*+LYmyIR}onTkjhEP_Ex+R&|0RV!LAywvBuM
z3Q}S4;|3d?5UrAGX7s+Fr178T=4lp+c@8xJ+h^YB@vjTpZ}Js+zttcqZm1TW#6|rV
zo4$4AJGF{Z`)q#rNIA(-J#OzL-M!*Y&7`L;_nvEBoY@Tj_tI_LF@q0yUETK+)f~sw(=H)@Qr#Aqv#UNod@1l-091v9!#ksP;`GoIRc%G{`
zkzApabea6uALm6Z%EQI``J@-aSXuI_u`nG?BIwX*N!sYJ{kQz`1W|pDnyo;r}w`gHG;|yMV33s
z*LB}9)dHajgOzP!boI?oWYk*L!K<90Ejf^D1zunE!*t|A)S$tcJ^0+iljjUrIZrrU
zuR4$E_Y*1N&-_ag)h$vZOq2KQPre$$QwFwUNsaOeWyjCP;*|!4I&*OgFcy_9Kdh91
zH5Eut_{IutCZyMP2#its47MIa7M8Nii7*gm!V0@ioFH-UHcx_bg+J)bRblS4d8_5#
zta6MnBS=TUy+crXg9VU?X)6c}m2Wi({E@q~KGn29YF$Yk&a^pkXdp~~ph?cg+d|6a
zCup;(<-!*M(rnWZv(-JRbCPUooykzT$>L1(uMr+lPTI{E6<87t!|z|$z=07i5P#Nr
z{PPUMI)Nb_SZw#Azy@}(y@Mo-lVK^DN9Ir-3gZ?It)OmaV!Z{Zh-mz89NT6PwX=bB
zW1~WHP$9F8=hsx|=^Pl^zDF3r2TNj>TewJgD<^VuiKygpQKP
zzif;q9-()Csqg_65#YikoMS@LX#36;DcEeb
zDS4+mLcSNg=Rt4z)V5hl)9S_rf0<%1B*@Gp{k<_=fzIhkp
zw3AqYnNgadZ1#5#EQ@bfArR*U1We5g@$;5O71OI01fAg!8NxHLZP??vpwYEVj>Iit
z?ITIJ^d<^V=DJn?%08u^yk#x3kBPKdZO?1lQ`q+emtVYynZXg71EmVz;JP?QIw2
zzLpf{f^fyL-`9D^X0TOh!tp#|&G$Cbf>Z^U)m~f66+AKoMb+S$d-V`Ghci`e$IOMl1Mhm{ovQg9?8~r=z6X96-D7_5MF5ckHUC_^JsrRr*
z`R}VU7222Q!@a)AP=dV_zaADInq?1>nm|#o=cDDb{b<7U#^8fzZe8JmUBoXHBlaRZ
zjt=Swx?Y1BR+m!18){}!4-n~CnsAy){K53Vpe{}?_-;2L2WMQ*?8=(+4wZfN0Wk7U
zhJX?u^3nB?1TKWL^H3WTa01lj-%V8gw-dNxDKIKlid)FW!X$YTdHrAz?1z~*F=Eev
zd6$PjRgM9GIyQaNgFl*NQl31?wgsw7j+FlaJZY~4)jssOUIQN-lpi`CMud*(d!R@~
z*j$F1WG9b;6)qqw^$eciQu9qO_`S=~uMCaT7?xG8R05Y4`0n-IBX=%A@Zw<*xg7yf
zm07Y0_hsm#SkwO`&Nu=4pxt@v;4%?d$hb8|$>7)9oadcLSH}TKF0d!6WVNhg<7z$M
zzODSPMV&kX0w?beBSuWRx!hYvt@D67bTbw`)X9I
z@GW=Nc25Zgx=7{!-h?h$^xA?<05f4YVjDMUdi+PwB&HfUU;NYf-C)f-m-QN?4j#Jm
zky*ti1m0nHr9medszTT=H8icc0!0y2@u0X;FbN_FD*ZPK^(YD^Ik}6LVFNW19JNOs
z*Tl@@bhCE)X3eEyXgX2eKUu%kbvdnG1G5gt;x1cO^&j-eN|7HiG#KzCbaZ`s5Ob)h
zoUFK{OrLnp=ci~|LtR;$qJtXjpXaTx`?^(4xfAL33pf2IeO~>{s`C5T9dOoF`n8&i
z4xK!j$P#b{1-I}_%NeQQr!&k3)_emBKZzxD{_UC?_RN7$J-N9Q7#^jEiclr;VKWUB
z(#%>fQXgZO5l?x%Fqm>@yu4WfRbIb}H8%$ZOdC_L)$of$il3-+%i@dB|K#qU!sg3t
zBAu8Zgjo-IOu;}faxIpN>*P%EdXOnUQehKlLAgtfv06pHV
zm&fZ6h^nAmD<}R5Odp3ciaJkhqSjl3#%r+@=8e1a+)f0u^&>kMawiw8q4Faw9n4$o
zwEw489vGdGKiSh$SI(_qfyN2Z^E!hp&$6>r`SBO<8hB8MFp0246_sQ-+hxiHk|kEs~!{PkvZBO9Q_{
zRkk{Dgtq_!dcIhDfbJvw`_{NKD8Y4kllsp`&iy%2G(`I^=IY>QX|Jw|?uCZ%=L=Fz
z&2>oi+O98Iwf=vIIp54Bn|stMhRs#S+{AtfLWdTKMsC`>JIy
z70&2a;YU!`&oa_TPJmcYlHz67>FlI!Y2{U`9jCWU_ptOrnp_Iml=LWt%trO+BA2^w
z_j`E7D>o}9Kjk{PhkMP6n3#gsj^4cYkUbf^rV&=L1eD!zY~qcq(X-o3;9}`<7!6GC
zm$CZx!&!43Y{h^qVEVSN
z#e<{5`T*U6*h2nDT*T}18v$Frk7a|;=l#e0{l{dtH5Evguh_xK?ng@b3|Nq1isK+|
z&TxR^ansjg*zW62nKI{4+Fq+t*$}47AWQdG)Erm`hHa4#;0U#VHP1Az*0lR9xZr5|
zL%dxyo$+7t>5{_zv-&)V-0!@)t{>Hw9>pJkjPaNEyqpmI&{y4toZ_oE7BymjWOt?S
z2YpWYv@5ys7Wi+I(ewBI5v4Q4JV2YGn4AOZmakx|AB1GBfSd0@SW_RhnUbFr{LVW|
zK1x1@qr~cXj;^IXbo~ZG%4Fv%eufuJN;Dj6cr_g{G6q_sh0d{7S3FIE?o>DI{$!IL
zu7)2NONT@hc(#tfD3Dw*q82qb8Ih&;rcpeNjGgQ{ebSzp(;vw^@10v2^Zf$Z&D4B?
zyvRMKs|4guwdfczx?luBwxx2|)s`vkN_ID79tN;}!VylehPnqQJB;mfjUvkZlF*l8
z(a>bCnkOk0=X6b6nIz@aW%Yr2YAL0-?jc|*b&=zCD@f0N*7bBDZRi$MXAQGy)3~;3
zEfKFz^?kOvl6J_^;Aw-0mV8M7cqVt`(>7ryXk%)KA@(4b+T|NFdh{%~JCrd8Sj)7f
z$LJ*!Vz8@cT9cCRD9H8kKXI?Wt9YKdHGtrO
zk#uEaUTI+wx+%
z1?lTe8ckbUnAU(LwGtV5TZVGklNct$t|wy<2e4nN00H-p^v@aU@zt
zSbo$xlsLn;VW%=a{b5xYUlLdgrf=#RKSEoN1xN1LoH$7>FB4fCK8_$io1cOM;EIMqyk`hhZGL5us6U^w*mZh6q;4A8Qzr
zD@D}@?qXA1Y-KcTS|0)UvsA%0VxY(df#ahp>p_fELd-6(d82=IFTYl!SIeY9jPQcq
zPZ~ebEw2*0HMmCq;W(u;bE^!bV*_AOg0P`p2pp|*w&VjRlSf@+quK~7Oh1g}gU9r`&0d9iN<{Bu$3K)@+0%|m<&7qxg
zzM}V|TP~<`#%7^jA-OX_eRH9Vvh7rI=(yyIslq7Lu(gBb^%K_#<7A_(j$-*A3DgaP
z^f&dvX{EL?`Yn@w#bpiM>c*l{ip
zXztPKn}#F;N}q2>dLWma_`YS_0r!FEk2tqZlC5V=`ndG6NzE~j-#|)h5CC1&%i*)m
zor|R^ZUumj+AsA`{MIO#=G-G!qr{UjUwBP6G1}%@4JPH?mo`8vmBLZ}I~49x68*n`d^O$+hW#2Sv!`(G$AAq^Of@My
z4Qa@Wsi1eYg=GK1jzK&ulYp3|jT`DbO<96ws{2=YA@tk%oOp6RdOKQ(7H*~5vV`Ly
zM=0kd!Lo|IW=o7CDWj7TmdV+`8b&@Ih1mGPUx?9^5Uc?eeED|kVzN-3e%PwQkj2*5jkSKhdtUuY}KB#=X|CFC@5)t?SN
z?4CS2QB!PLrg47a$+fQM+i&!K_(iN#C2{T^l?(;$$y^>VFOzyX!==tZEU8-x_Ak4N
zFw;uJjV3CZ=!1J)w%JK?f_5RUCkI@Ym!vXva8jIGuXM5^UUp1ku{$rhd6}>rj
zCIYk-qRGi@_?}z`v!L;^@5KO+^s1
z;OJW?6lEFSs8zANh?tB-DZ8uBJ;|mVf1tWb|Jxww*x8N;NVljot#$?g?qoM^EeCuM9CsR*hmPTPz7Xc^
zv4&2GY*DrCX1|*JxjvduE7Y}5Rd5%=F6
zD1@#9st^zF_mc`j|C|^jd^6k_FWfp1wjmxspT;B4F<7Az!f83)gO%K+JUp1h!35Z&c*V?C6!RmP3{
z&RsgQaUM8JvHQO9=BncKSprgA1YVtfMgO&^gM4PdcI+9qrccCPvs+WO7!4ClzD}Ur
ze=SR?V7j>fEjRkn?RI$~1+=ZG>a5O?yDuc+v8))BoUUZ1P{E)h(Ngw_M##yRaO$w+
zR5kJ16gKUXxu6-89C!1*FtsTnFj0UHR=AOldNEQ-O>O^sZ92%?*c{t`VuMvK1OGS@
z9@K|KUpZI;WT5|#rgQ&i`u+bnIVGW}oQ;Tz9Fj8|MN+bQtDMcDB4?JfnL|!FQ_d_A
z$(iJQJ|9O8a~?M46lU0rZC{@szJJ2&cD-)T>v}$~`{RCn`p+fn@_O(18N=U{@ROFZ
z_b<3t7gm&XkAy&U)a9JBr;V7bCNr~VcvkjD+fd8*pT6imz%oQRSM?rUd(8I#E&$wD
z$2h9XpY?jN{LZ%}vV#nBElV1uu-%E$OTy6T90
zn7fa2fXNQv=TQz-bpKUU@OjUn!g^VXcEq`(`Ss0lw>z!cO~Jkw
zO;(Gb-dMshXJY!}+uocR3qCGL&fY#~d5L8Dz>Uzrs0bUEc=z08a!94tv#p9#7!}P^=%yhMhnOpS^EgOT2wnPK*zYU*BzhPF
zVfgqB#bA_%O`>GS1S+q#JI~h}UHD|wb%!|%+D~73-dF|B2wi&nTepuS>#<=lL`#W8
zkR>B@kR9L?S|1oh*|(=SEX(>!Gu){=in&8H{w1yJ4VEF@qYY0T^)C8fX~bw5vh8fN
z#4M7-;kd`#O4}Ao#|RT<>fG2!1>@3v9Bs
zU95w_^Na(bga`1+v4n%yk5#w|oH|9_jStx8-?+Y#iIl{D%7ID`+f)FT1uEw|>EouG
z+S2JGU(T!#d{^1x=cl_2y_8^xNHD;wOj1ghBki^9vbbC!Te;V;6h~4ZOC_?)dlkgG
zb29mrz~+fTQkET;Kl>nfQa?&NL%Fz<()X1GU|3?-0duxC?UNDWwgR7RSHM<^m}alf
z9y(=@xhO$2bah#%&kAlH!~K~vtL$^lQh3Mq5_7?#^o8Cwj6&#IL7_92GLxm%8_*NTE^go+TV@jad
zGGu+PRXJ0*c(+0-{_Bi++q`XGznl+c?PT3R=$@7z2p)K$sw~Tu|oBWcR?%C;8cK35n^4yLU
z1ukyHr+^EM`g*^Dl@%xw@TKHY0&`Fjsb%*ErE-e`6AUV^DLDjF&C#H6enT?Oiz_|}h8eJ5Z_WWwcOzUApTGC9zty)pZf
z-F8rq>~93%yXhTf2HJDq@y!^l37i#!)|}r~?Z2Zf|0(B_8M(nICr#526Q8$zJs+G)9BydVE&Q!c7392^-8^2Fa<1`A_;D=i)>
z`=#Ar!U^b0A0FL>uM)1NUj?NzZN-+75*<%
zj=gd@0sQlv75@^L=;?XoLTw?4ayZ0Eqn?Wk*n>1bzvOiN>xhCK(2>SL$#Gq~4np6&
zVuBkOS_1ZJopG$K?HPG3<5)EQ;IQd^k8I0`8;|&g5GdKiCmT387IMWc|i8$bnB(FcIBIL=BORNn`_%vz%fsQi=B2dmi)4a?Hpx`dirD5
zJ6kT#ft!`rlK(@**!!WrmHZ=p-S-@sZ66Qmoh62CHEJ|PSeN=7D01?4`b8PF|Iu5m
zHRW#kK03fBAV?XYI$U0)D|!Z129Yhd)Gq?K#58m5QS-?ngmrQ$
zxT+w*UBlR%n~fzmWB|9^74y$Zl#$mK^)_$>#lfi}_uMW9q$Bvbw0cAI^iLj>^3fi&->Jj$6zq0!bsl7c*B&USifA5#WU4Ann
zonG|SAXegiuNW8kT_4Iu>22!fdqv7F*)aP~FiIKW>q~`5f9=%&tSG)Gzh?gjI6b)P
zsZ#q>X^0ey{;F{lY3DC@;sMjmR9E>*@5G7!VcjcuqZ4kM-{NftCNLNzu?l$;Z
zgAtfg)^@r&>vYli)~;TygPpJf-!;l+I3~&w89oBb;N+EpQlvjuy>&#!d8}5RY#k&w
z3HH>%-@J`_le(_~Fm}7L_&LF4&wiT2;zH~*o}IhE9O;GCH(y@Ry>mTlLAIBh)k?+R
zvfJJ{N$3LR$}T%S+~3uncpNV;_Q-@Udi-|kQL)|5G@tfB)xHi|tuy>0x^-?E-ntxW
z`S{?6e~#YBJQ%V)ej1Xy-w
z1O*Q#Sk#ZB@oN7ck|eMDf-++wbw%
z$b&5nWf$_%Qj^D5HzkV>b(
zRmuCBIcJHIU58FPr-3E;wpk@mLXj9a7aQAJen<2^8mCT4=buORY9foLGp;MxD7`Wt
z>W+#V){L|bY{iXSN{?Ok;mlWSEZ5Z3cnJk`L*o6%`|YC8Z^vvF8=Ya}5t77vP(5Hp
z{Yh9Ek#G{X8HCg!Q~&lrkozkUf7h)mj-?8
zbwJmFRD@g-@v`7};JQ+~Ml0l1*QfM*wTTLT77&fr&~obSU*+BP<;5YjZPDNQyPo~Y
z@B0Ffp}vnHr=7ZwD%6uievDoZYq6f{*XPN7jC1j_4GY2d^;`EslXKa#jNazQB+W^yvMJEP4{3u3~@#@QT0XQ
z-Dn+qmv^5>J!aYD3h_(4@~L-bltq263j#qY1!Dg8^6Z^Q@_)9*Gd_}4{C?|&W1+0j
zqB8j3@Rwx_Z+?JsUR(gCB*tWVB`)GP^w43O0c=H6RZ8MYbMqAsn{W77sdI@KiM9r>
z9_N(VIncK&u5SDN1T<@-Kx_Rh#XPyYiu+u(N+1aM`;wDbzIJY$am!ktuh)Ud79}-y
z^nre(E8zKUOdQJWVYV^Pj*Y%hx8JJ=3SB1P=ntiMs2kg0#+qO!l%#B>f&x1SuxBeu
zjCjkdE2k+k8#imlztrS4t)S9F-pwS8{EeJe>l;&4up{1Y`~$0y#g*GA*L&$=C(&~`
zY-J6oWJrSG3880*aB@#~VAFT=O5%?_g^@MUwAcI>Y!k8<|D_GY!o?)V5A9Gnwc$Yj
zHwFhix86{ylroT%Ld767=xn1^3lJbA47pd6FwkvF#LP!~bEeoAH0X^7Q#{EY9WaIV
z>;R|qQ?>Dlc>$-=KVm~1+xE9EO$S*#uoe~P_%4@#Oy)0V6BOwh
zQFbA|q;Mt<(~koMXE0c?)%(YO&3^wR^GVCo+nDZaL(Z_FN}{B&3$^ZyRSsdNrBKiV
zvyBgTs(;%xyj{a4CEor;x}7h2@L2Bhznztdd
zyyqH6tL9aCAZ0Hae>vm^ti&;K6sDEQ?@_(W>np#W3&5m2_$iP
zAe;P)pbU%C}ZbOC5Gq%NrS9=gKHy=j%gW&4pIPShu!NSk$dm3a-py+~piT0F9nk;C0>aA-Zka}&^*J--~)CyH5*|z
zk=VzNNykFDKovlcmg9d9*HxLGefFRdjta;AaNo2E`fcz5i5l4#`j?+&vWzX|{1so8
z=SMcV`8j
zm)7U*dE0cVQtj&I1lWoVWSCrqjR~#a&N#e0Pj0z8ZQ0-dgCIkLx@(2sSGPCl?ff;V
z32(-fxA_g*ES7M(N6DQZFKFGuRySrm-%Qo`HBk)|S_NngGIG1mfN_esl}7pZ5RgoD
z?M6e0BRX?%z+j4aRI8c6cR$2TVZPMV(h?h7Vo&xA;&aQ6{umPc5OU)DXl((KJu;Qj
zr&zo07yR9F@_G@aM>6$`n+DPKUtRnVIPUW_dQ`vav?*X#!O7I!$K~$jN6PO40M~nz
z00BI?iPAQ{o|kf?`~+Ef7Bi2~ZD(w>o7VRi?hmg3rfUlDSro4i^z+UF5yloL0$t7~
z?*GhV#|Kp9`IC>-KquOto_fO>v{Lzn_PVPtD&ASayI-hLW=-mbcdPkc6fg$j#0-OY
zY*W4NXchKnNcxh#AOijcl0Y`gBrgz+T67xTyb{#q$?BH!#_rl_MvKya-xSPdtjFtr
zTY;T~kCOy_v5@nuGeLFLPc@PnFI9S+QGzmeF>HIMRdU3A`m+cY4L9Of^Ck15ye!-uj5)H9Zt6iA-s{y{-9M
zk}GMiJ4$5x*P){})WB+vMbPN2hiCv7TEY1XWlFVv2~d9hyW)XKv`fW+PO7G1j*$`R
zuj{tc66*zovhB*#<}cI$N#G@=X9MZV0Y*sOXT{kp%HY!Kg6ECWTSsFXx0b#anvS5qW-Y*xIlPe
z+1&n>gRwAj(J;u_)(6t!n5qMa&kXm`IaS3ML&-v)xEpA3LIHd9=eK(~yho_Gbk|td
zYhmD^2^Qugw~KxUI2$mBR`kFY#;f|dYbBBDQRnbO{|QSY@@m(+q8)F)lvc+N&F?2M
z#S09)p92uqa({(y^O^iD!uD03EKx@9aDQ1jyA&mSZdUGNp6F7X>Z^x*F
zC<7|17AD;8v8o~5?6@LTQ?7?zbB=eA87lA+6OC)BHDSr@hM&&fuB|QV8(J?jtIClMdc;RppzxdJeysbN47W65
zS8L8mV9})zk4kJ79eke#u(p+C{s}=F(%&ij5>r^%_rC}f6Kd&Xrf=+qwf&-p*_$rO
z_8255x>i$CCm3;9tK5bIwM?i=xt%ryOr=+>Z+$St;@l-|uh*Zz?5}n!3$F)x{B)k0
z4;bsSUtQV37D!po7v(~!cYigHV%QijtRts1*Vj28`1u-#pT@dob8ffT@4;r%gPFXN
zz(GU%@8(BTRCoCn2~S~#gepFC4ELS7RiA%T8#uj6PmV7+dtv#DsT<17_aFxxzR#yi
z2}e+rQMY6x7fE{$TOcdcw9Dxm0<2M-rf5c5ZD*R>;r?-Xc-mXZ$O8PXqbo4L0wYc$
z3?gjC)@QG2wGMqe^)Qf3Xhv4Sd9$93mYp=XmbL22jC2!$i}F0zG&Lo6aHQ*qR*is-
z0H$5VKO-L`i6LWhXh>RH;+9&?H|Vz7*^H$9k&W^T=m8{$DBKKF%DpoB(H0s%0jh4<
zp$FLw3JJaB&n;p3K0i@j0sQYs%Mx(9WxJ_pYa$ux!D2LO-BAnl*ZYJI3zP3syKjF#MdJxGgs^e3+;;FGA$?Pn_~_#!IJC4Q~pN$&nJ
z5PVB)W5V`O8mAWhn7D0`duMd_ycDfEUQ!`UHQz9__OvWzN}6!UE?wbUPM4dx!FZe9
zjnPWOrEu}na8grx#Iks=Nb+Kmt>^7V>V6+3g~o77J6y-0sbV0ZQJ-(T)bcddq7P<-
z3-5r}e`j?!`b8WVG>^&sWw@~vKT}$ySi{#QL3G@=7g7sr{21@*N;1tGL5n_q<}vm1
z)xR19awUNodb?NclLsjtpUHt7`|h;fyW-;LeD*_m6Y_qZE*_*Hec698eOU+uu~6&}
z>(l3Xdp*a@MjB*+g0kFY>WakIQ>g+GAPjGKG!Y{ha_G-5OYnk2-1
zxGGPN9h_}0`dY3mgUBsyejX2G5s1JJu`s&cIns!BsrR1bwl!v<@zF%)y+AF4xs+!N
z7N8CO6lv479wy6Kl-sWB15BS%EP}mY_h=fLZjg*T>AoiPszScC)TrnPY}&zP$5>|O
zv{nQ(uK-jnhuv~teV1LzjHqYhV7;no9QeW@&RJo&T;nhec-gtRm-RnNlkODV^|tDG
zH(MUiioZqD{g(TY&?`xVx8B3!+|j4Qov(v?z66b&deFo6$7B9Fh|szE%U?0DvRm)s
zxOp-FZ@ZQiF_b_~^E)5C!>MO(pba=a3*qaLO>dUr=@=b{m;rg;SoLwWuY5*w&mV&X
zb6D1T^&8La^j2SUfRjVW
z=D_X}Y?kW=z(P@p)!#60Jk9CftZIpeghI?wX5`t-?8i6V`v-wP;;4?oQIb3SNqijB
z4SMB&KPd;*3l7{O=Grkz^FRstWi1~~wiQ+UxFSVFqr$@
zL2p9-JDN&W%>JW_b5{*9tN~u&!}dz{tyGEepzRM5q(@GU2_$~yuSn-aQgU}jA$
z!`JRqpMHFkER>La@lzHrMr`SHJxqpyVyR%Xu~>t3yIr2|Zz0(rlChv8P|=^Q8ensH
zr5dQ+0Wkc5ZMZ4#H(Vv*;s2~6<+OWVzcAJb(Q+2oksP?GJo7R7?y_#yq4n1a6Ak>E
z$iT!~GuxO1Nn<{i3*`9Xjl?
z@bfcT)*9yY(e?#<;RE;FuDFQ{zlj-rd;Ue`1K0ugmF>QnrRADSztvMe@f%q`^{jmE
zmzx6Lhc)}UN$}$BL!;K<8*mGnWJ~MfXG{_2nJ#BNx6;ZUB^~(+ap8}mbu0tQO
zYH75RIU(%676hhT;qR7kKh9_O0^EUcGN+~?%@ZI%5^&nV`p&e^WIThJyWKL?kP{yr
zatKXHL5cV2oA0G{dxCGpYbGEM)VH~o&pMC&mPsA$CGA4zQ{ut2R+?*Tei0rjWZ)5=7VDQs@f?#(=`h~!
zd!v8l_$iMJJ3EA6EBB6P23HzGg-#^n(}^nhi3IXu)9f`PG|Q6F&;sc2g?5kX?rW)5
zds?_z`ns)akkbW)s-DT+Y)R#B=MC@i$dK?as$Al;b~(%faSnYJ{UK;)<=GX%%iDrdr
zocEmIU07ds<$#^AHk4uIdHFhoG%{g!v2GE`uCIE(oO(y(xTK26C1~F*#8+3aT@Fd@
zRfgbljmXIajPnMd%j5oU=GD+C6u>|3l(S_TAGb?fuKQ~;Bgx<1ds$+^#Bc;SJP-$g
zk9$C+)T}!d-sEO3K~*Gbp5*l#N|H%%I+J#n$I*0po;R+(+B1fVCI7n3<24ib%=EJC
zFTSrzsyN0VeC)q8PFfe_@T}w;JqVzH=v`B~i$M?Qj-k-GYys*_FX*O9>PsDQ
zb|WqdpK4kOy#fk(+#++WB{5RfQ~8eyGPqqKDmu1?XiJI}Xm*>HHwn1uX?gOz>>0sF
zrulR~?=|cthoklTw>jPGHCN$=N7z0;+psztHpydo{(ZUJi>14``jWDZ-HPd}qGta3
zS0@jFoQSr-H_`Kq#f!478e`FbTfN%$F+wV}xcD`z%#6V1CnE`g1<3NvJJR5%
zqoA`7Dl(kaw`AwnIqanekd68BNQ&y6tS*F;$;wM+mNeR%!~o1)R$?6Tv+vcPxw~1z
z`2Fp@A%R~|_V4r9fAJ^xC;l9BgQcWFPiF4R?3Mj!)r2gh&~j^}c=<;5#9nQT;FL@t
zuqW{4uikr2-qBeO*ra6T%T(qKDPyT`EQl%E4wD0y!BviFtB0o&=t35WP)`?Z9Jm7L
z+3V?%miDn)wsT3nHeBKAdpfJ;Va_(#K<^ZqLcL*?uIr_SuY9iIH}`qHPv^>Mf|@Nu
zS3rE+8iR9d2c-|RAHpimw~vLZbm!t&b1*3v~$HOICx+HP#y
z*mz-{`|SQyY+Di;a7M+ViOB5}KiCy|(Mmf43-$Psp~X(Q@_fE3F;c7ZbSaS~tLx)=
z4YOtA^XCgS4e)MoH9uMia9xdd$#WUNqW$lN{yY$_$9VKN0S)TfC?Zi$ndB?HT`!87
z3C&--mK7+yLsVq``Jl6>(>$rPHg$J`KIEz#eBqh-Z}4uSyQY23NdelNE`^rZAo@OR
z_&o#|2MBGpPLY;>G=J}>LhsC(>yK>MZq1VX1zmtigx{OMQoFRYUzrmmbI3sOqw@tY9SO-eXpM
zb9F{1snt>HH0eX&M?iT8ZrCWG_5~mT71%K!V1Jmjr-}VFds`+{wFm#4Qn7Et8N%ci
zJZtbKyhB#SjNfxLWzt>}H~zj+?v_sGLif1iU5$~f>#6fdlFY+VaBm6|)$Ds8`bmb0
zhH=NptRNmGEF5U{A&LAKJ$(rik9G=-_53&@c
zpKdlR(65XZ_aG5>N9($$n>x^gmJs{Z#`nic$i>-{`{aSh5b5*MB!-k2U%cIxjkX_oJvbgS33)PRjR3_f*PsK_9k
zsaDL2)5K{$e%A;a6iLBWgh=ue5bbpRB=qFEn??xY@TcObU+*f&GkG3l(z_aClW+#p
z^y?4UJPGYwhviOr??d+MmCM*G-9xtSc1FUX%hLpQL>+e9G}n%6BHN99nk6#AXzO7V
zks;S*^i>wmyLO8;0_Vb|<<=b8NtuF@F8T&;6d{SWL4Th->i5n5p;Lg7T9D(Nh(yAS
zM=(Oy7DEG99}FwBzx7x)W${5|wI?GJkYSnW)21N-H@Ypf-YI`vVXL)s@oWW{)hh(J
z7~+rcE@Ee^zbgLJ=tauysL!+|Ozn1j?@j>2M3<17bM~!2wX
zo#2KH-c6kJgIbmhrqzV1aZ^y0(6mC}pIfD_(BFTE+2nqCMgzCXI@!eh^!hw%1cl=pi4zwTM^m1C1I)M!jx_k)x6IX6$O
zXxeh!kcm_$$YWGb1=Gy}$cm+61}{IAe*Mxo)E4^5Iin#ra0xrk_=gwNz<)~%v(^0@
zms-YbsuprD;#3!9OB7noM3}2fwn=5e<$HGjt0CzWuuS{g<2qCuf3Q
zYar^ql@sgg1}Avk7+&n2d(CrKxGr|UQd{m$fR73|ope0mA#`qQjUkBBNWCv@q4No-!o|K;q58AXQ=t%vX8yh7oJ3t*%DS;PDOHwbE(2q+&;CBpzr>a?d*1^Ev?M=T(?(8Me+gELgS^
zjh0GXTG}7X=A8n=)kwTU)&9Fq5xdvuF`*hRJ|0dYK|VYy-3C75FQ;@8^8=nNoQz|8
z)MY9<#DkU`iiP$xBOq3ihnqh9g{ep^OGmP0g~8cM?dopbLcHh($%8QgWO3nlu*tEk
zZhvby^B30yz-Rf<=!=#7Q+;+H!kiK#NctU_0b$fS&brplBu@?q&psylGz^_xVyqRe
zSlzav?Tu8bR(kAxpglI&ygFhI!>`P_Ti*XZ57o~Jx)NnEYV7Q9)jIjJv>-hH;wG5&
zAVf&`n@^ta&0aCaCk#TE+EEG@j7i!e-OJt2p~I6B%)~<5Y3UeX>C=34z_5^d)w20_
zAty&X=7vAY-AEMwis^Rx5-c+2Sk8}~#ZxHr)1ybX5C7xeygDg*`XQpW6PWpa)CbY_
zEx;|cq>-fjAH4MSNB=iWr_b+R>2{M{wA;G%Qx!jpZ#X;fo^KQj$tadR+nj$|+3f$e
z2euuHi8G3Xes9CJ3IhU8Uus%UPu`qcbn~4s;Tkao5+gq@^F0fkIl1OF{H>0|(WRyH
zAd9YTi}q(TzF*AJ!?OjF&49GoOgEx&pP6vn!5LwFhZCA$tA}k4Mtk|JK{z=aaa!Mv
zbif^-*3GGKG6G-1PVFyMMrpl2#fU{hpT-5S#%(&)H9MqjgDLY<3uFVWp6s|VQ`gGq~
zC<6jD|HJHrlV}ZQWo)!w!l+A(I?`c&rF-~~QXM{I6M6D6Ju99L_>oajJMR#M23gJY
z^~qRuoP_=K?+O)Coy)!+##DxhKh`ea`1$Fe4}{s1?&esSP~T`DGMRrT`5Pinv2E^#
zju9%ms*%KvJMkHJuz2Qe=j5TpJI#TLKIUT_gsGlnCOJX09j8C8TH2{2)@@4X>$fG(
znMiU%nwA~cLn*<%jVWN@aqPGzey)%s+I{%s&VSKh!?kLko+pvKT`m3fc|h~hR@?t3
z%VrmP|MRk)E;gAKNdYVz$Qe~^kCAs+hC;1M1MaYB_67hWbtPLK+f(rYW|l1S|Jg|!
z#swM5$a~2By}q$WE>SqI^38sIt@^Ev=$WP^U{7BzM92|%x>Cz=?dv5)$y_r~1BX()
z?N)*hpJ(ILd=P^*I|EdBWRf96_tSceNwy{YxzzPI81d)b+uH@DpT1xpEbIiJmc`uo
zv7o0|@TF#q8+jlM;&tIz=!IU7SJ1OnI`ziRmUq4>B(EcE(8eSakpuu_!tpGzRhG`>!8bae@eL5CbRe^T&_s(LsTdIrJ(f
zjHkzS8r`F2Cd)+?M?`V|ZM_5!Qt6R1cD)z-DoD+l(>2(fIs^q92cn{lc5sb>vi!*=cC=5wvynDjfh1+&j
z@d8XQ5>h~;E$313$Zzd+>^@gdDaEA9<}{IP+Si-xb70yZ{P}L-eUB4JW6>d7(h96+
zh937x?+TaKE06wUTG+=`7;zb3D_%>|GIG-wdEoD2hVa^Radqa048A!$$yHan*AoG
zohOxiTl-O*bxO9q;$?Ym*C^l~ldz(5tK-tdmWzw_X=gj4wT9&_=<2zEym|AZd8rN)
z0Vi0^*%Bo4Lher8m`@wK-?3u
zC>|eYUOb}pf~f?x6v`I{KMqwm2?5MeH?0UNvA)k2LbDCT2xs{(k*%(y2#feGrqc>i
z)A`>Yw9uw3+#;@`IPlvZ)_P*&zMTBQx5Lbs_V~no_2mvs{u({9R>Ksx39F2zmq+`
zWBLrFTRN?f*36$T`G$D5AHxQA2>Ny-{Y-Yf+nniv6N2%&zwbWZ#GwDDjg(j<rl`xKB1h*oDtewA$j)yW<8ZhHQIm*z25m
z_~iGCcSQo2*1LLCA^v@}z!1G__NkdV1JtVb*_n2K(7J2RHnTB(vf>sXj|Sn&>*LwC
z|F94F%D(L)!1BXU+kJ=8g1-W)jjgv#6235lAh#3cQ6SY0@Q0c;{G+$d@vq^>k}!4w
zv`Su*soiQ81VJBC`lcxp6)=~3Ni#O#Z-Hi3X%Y32BkaO0VU2AH_JH(a6go}1#05e2
zN>9(KQlekZw2o1#;)Bs;r2YDf-$#fJd;Z!AoLlr)oVNr*W^*LU?W_z|I1y7qgsLRe
z&}WPJnpqanQiQ~}uefC4tEUK+ye8ROs^GicJv9l7c^S6cg)H#X+c}Wn^Q&Q
zhkr6j`k{~`_=PjdspRGE362Im2tx@^3l#jWCDh1vSM}!Zs4uy~1;irA9z?Pw3BCxk
zUb$2jhXfvjF6#WycBIU^wUH?Tt#Xykw#6SZGyGcZK4mgabhwebTrNEXFtn*VBri%$
zdy2dh)LcqWeOL}ScoT17CAFm*GSz+N9V#@kUj*OfX^`y7hNXZbkQ^V*^1aPoMcsKc
zw}_j3<<^!Qof~LY+FG^<+P_M#P)VswqK*>;j;NOc)xnRce7TycuLD{x+mtU&>iwN&i+Q-ozA>Kk72C(+Eb~p+
zf3Phh78ICV$2b>>jZUFSOA$!6$k0
zh7vHvC4Rp^i)(rzfYIeTI%+wZ*_TC8l`ow+5wyLA*sHR9Jo_W}L!jWf7QwP8l#q4C
zd#Zt7@!0Z$M&8M#&~FjERq|*GfvL~APxC5_<-
zY%ZZg$bT8EvSA5(5Hk_DC65SW*4M1AU*Pm1=cMK#{2f5|75|ffsaSY`)zZ(e8mYzF
z@zdf}~EP{23yXeyCcG
zpY{-`y|-`so0&W9O%MBl!e#>5Am}CH{QGnN72P;}hiOAq4DLf=M7^pb_~gpZ#Qezh
zkMvW=RNKMzD*wxOmUvfHlpXgpt~>yQlxM&*Awe;!x%_Ep#?=dnX)IN7Wy%=1eEIbv
zl`e6stA+Ng{emN16_Ss<(y6PiS91x?8iJfly=7g^u}#Aql~m_8h)@+6EW?bngMXM%5|67WCvA_MeMCcEoM$7qRgvUj!t1L}i4XMY`lMa$GS8JLVM{9>jbJr%YkF44+V@BYo}u
z`3$Le!>4dEhhJR0P5H3n?^Ew+CbeR>+BgA=gDyIvY@}_k`F78LF3zhHv4)0;D5e%X
zwE6;&oW8_#ex9ET_v!11zbehc$Vt`+TXVYmeu8Dx>UiMk`mND}miAI(AzQzFoaiT1
zm*&@+vk0DNSBYY0YdTJ0P)908U4AOFnedU?UP#3{39oYY@)!Q{c^Kmrf1zrjfV%0-
zNRr%l)PN1Lco84wJqh@hz^|ZET51;u^Yzd}ZmYg=bJ2P56B9n=IUFsxHp;FfIsKR|
z1_XX#YpiVH=nA}6D{fGcO?dSRsI3~cjhK$Hy+$A<%Th)B1tE8byq1jVLL;~xTKH%+
z5k9@sUgd3d6qTtF{4IhJ0{;7dYKSJARO
zOq?LI(XE!dbDqbSM6=s_eIlabE}V7SV$9o0T@YgF9Ov4jork6gra|z_7r)mgqB4g$
zi(WWg>zd=Ow@mvLebMzjkBz!%yR2*C%L(Y^{K|(TlJ9HP@-K|hJ`Z5URJ1aQ3)-~6
z{44|+P1md3t?Ugf%%tQhUi&IejMHH#?q6HDwLAEF^gs?8lu^wAj!MkgXntvJLZ%_n
zv~t?6G7R?Jvo59^K5~oT}*7G-3y9<#wG8@eg&F
z=p#4Qpw9gd^>}Msdo0LVibZt
z9{9WQTbTUShFIK{%2DrUXATG~$2+m(ZhpFnHxS%bokRN%@a+xA-l%;jai5mt#r{$c
z^h3tyMe&t$ii=`1VWm4K=@@!awLST?`>22JHozh!d&J-IqrArKLrgw-xa&>3eBc1?
z^5`Sj^d0!H$Z)y$fovqAsm-wy$JGxuy|MBw66H`(efY}aFUjF|)x_Yg;rILG5jxBH
zB(s~uC!;nd0^gZ{@jp*$f2~`KR{9hW^PGm8icE3HR1U|WsC+fO>O5ngw`HyA4Iy9h
z&1ye%i|Ma9T@j7mumP$#Bbu?kr#ecChHMFsPhOP$OZfz^(uC+EaD7pSOJT_^U9jDG
z&yIC=-@o-w^VE{}Nj~fy`il%432mCIH(3~Rjx-Ppqf&W0hW=KtkfUEg+m&CcpST_I
z4$%WPNxmv=RQ$Xwd_#G8smfPfKblE;eKvIT+ilf~r=FIls@t=GaN+ufnZ--oJawtv
znvel&68|Y(4au@XpW2~J5p;0pH4*FYvwAs?sg{YJ8S3cYBSqR*6YVekor9SZKu|
zjQ;zXTO7%g7Xqh`R0VTk=7ah~y>Jf5B09QqN%EKzwjMel7)sE64ew$~*8;H8Dw
z+Ui4py13*zg$invzY^3VW%iEHhIda^a9&Y~>1}a9hYw-vgE`!bkrA
zIv~8Z4siJFWyL?3AW~jv8ej^vH4K2cDglim!Xt)DjD8*6enf|Q8DE6YsGH{Ei@;kw
zh&7}P)wb|1Q6t%w=3h`G*}tTq8Z6+u#wd}>hIYC{M8i#cm&z&6i@&!+RvvSTLZ8vU
zoV4t>fisw+aRlaN#}C_$)sf|O`mLU2pasCGQC$9=chfw|S_f((T2=^4glcGVB=kYt
z$%xoAozd48UsQuzM?@_&=om5#fm6-|InUv+fZm$lVB6L=t(3^baHs~(=jeTyIqk%v
znQ$8Q1WjD|x64S2y?B!LR+8tFvY{?lf>sV=Q(0w=>gFnxT_#B3rf)j_M-BGkLe|3<
zVF>JsB#naoOBdU==_V`x9}l=r>21x}{zJsm)Rdl4D-4U1H`yH&cz>D&5fvc{7N3??
z&3rsGe`}RLP6$5Hv{X~X*`|fFyQg7yQU|=j9?$4{<9PF>v
zp3YX-5fc@zePEgLRV>lTII%vGjqP%gSFZ0CyP6jSc6Xmm1NBmM3zckXM>1)ds9ED;
zc@9_tH5ANH_iaD8kHxK?k$y)pUUZC1v8c(Kl^5q-l3WL7#w7+GnCVuo(Q0{PcfA|_5)t&8asN*3h9>VQ>IMzfy6-)0@|1qfw+)X%Qk
zkEy9R$?Wt^;x|+zv8$tY9+nqmjHY7`%MfxyrE)yNX#Zoouc5T+ddHUAR)eWv4;z2D&l6J;)
z(fg#BaY89wE}lo3M;mcKmFsW
zDt{f(7LdVj*mA>-y6#*&nuN2fUsUIkFPya)mA%)rJ@n=Uul^`jF|G;}@8Hd}&wUg`
z9tqI>lfWp1XjSYYt*3Ac!~cGoJt@71{T!Zvte*~Jkk?JFbK4(GFtEB+Jv#W6J2-C^
z)Igoq3;q&g=VTG&9It^|1K-qj!u4Oop|t1l_OMxZ+ZOyS{N&*_}OnB4q^S!z;V5w!-P%P=6b;I|9qc}?77g-WbQU7nuko{bZh52XNQJHwmF~0
zOU;}GA-#vdm?YGs{7e-$Q=J2+Y
z^gQmD%bt2*t%BkaGW;PrAGMMZ62-tw^#djks0Jd;^SLxMn46m)8v?%6wBYB`#cv`5
zeLRkqR06yzE11d18Or(raaGIXG-cY!s6XN7`8%M!F|*`HpevX%fmYG)2vh~;4JbO)
z(vV-xXNv|^GU8$sUc+v?|TQ}Nh(VR?ce(P%110|
zU1dKWiC=xBP{r*A*TziSed4s1it)~HI$jZ3`ASm`Fa#Jtg=!k@8HaQ
zF$FAk7W5c7_43ocIl<=J!g*wk%}T)teQOu66se>R_p2YLxJmjH7tDqflf
z`QJq2f^@C#$J3H%+}3x}@kP@&^$~glQ`#HH@6_VHncD2p@?rod
zi(*sSc*BYQpC6wTA0jzV%k&ZYG;*@+TfZ1#zEy|z=JRSm{qpb6Z^H3>xEE;T`PuVBDr};OeazoyFcp91f36pA3IaL*6z|;f^V1IR
z=V|KU@BaUxw_!Oi-mvDL{(J2M@cE-D03XAH?Uaw!es5)=^
zxo<#UnXS%sYt5&=?ghk%Gb@}Zd$47kqkV5Okbj1{h`;O$G
zhrM6DWWBK<6Biio>
z15fj8R{mk5x4l_?n{T#M{Hee5Ztqv_F~=Bx_k!yL#BUVjpK6ln{YcH(hqr&TjL-HY
zi)G&YoC5$ixwY#hod;pBi=V{k_nIhk0_8Iu4Xu{$32PY=+URaJ*FNI-xelJVg>i&8
z40^7wnRh*%^O>Oa+MM;tf@Ep$!e5}mPY0YSU`A_&m7_~){@@)dA}DxaJgMNTuGJXU
zJ)TU(a6P-427H~lzHm-2)%_|}i9`I>T}E$_gSXOQ4`z$aPyJ)jD5+8p3fa4z$apG1
z()MukCkD>=gzv~NTZ~O)#A7#k!b)hvLYFRz8
zWBE9MFdnsiO{R!No*5>ZJ*Q9PBz%1*`-d}ip4ZhR{y!L^ofcHqwhN_?{tifirF!tj
zLNcz_IM1ALiQqS&Xq@w3dp^$39T+Ix$;HlA_@j@)VU+a^_g)hG;f!!Cc#jd^c=F>C
zZ_ht_hQn=C3vvBg``PEvQw_)U7q|c{G&uhB`OT!|5C~0;rmK<3$CFc5*W_%P<9itP
zy?S~6OXRAN1FZf7syw_Ih!W$nejk!H{9}+povsb{uF`A>N#eUb5sE_Ph
z-am`;n~Qh8<(OU=0M5!e6Q{cdG_f+jYZ&fd2S5MwwRPddwsgG`%=HzLV>+xJ@ZST>
zhrW!QA8D_F3VqjW_xKg|YZfI$^QZV9>bd6?y?-mmDaPyzoS?*telU8_B9*)bT(K9|oW$?oO9R`2-6rX1|*>1ZOA#cA}
z-3^@YPDVJGt(#0$gSkKbA3sk5{9WYl%{)D*Io3zBJ7-&g@vz@@vxbbZhPYTkZvUS65y2lw`9JSQxw&%D38nflS19<%pB=;(!ZpS(Wn&7PDm!(8fU
zwp*JVa{2}O4W@VU%jX)(J$r)Ff$eq7tE0FFqWAooh6i2tOY0!fLnEG)^6YIQK?W0b9LO0sr^GN-}i(szi*5Gu-2O=WJqT7sek9;_M5&)RW<
z4DoDtKTNXQ!iJz^_&DYzM7ggX>(~$2JyojHsi!dPZr=eCLW^H`$uk-3Tw*Vw&
z7!&MV*C*JK;YtEQt?;u3yS*pAy>(m9xM*wv#;L&wv}^{J>+~*2YctyB7ghG?|R|WUyGCs
zSvJ;(uYozqPW_1eF!1I2Aas-}#Ds55KR?Q87BSY@tn^V4RLMwNAOZ?+}J+Z6XMw*|d
z{N}%HM5Bl1Tsc2fNIw5_PJ5O^;N^B{I`}n_;^aoldjyG1;2%yG)?C8kKXI*aVXsGo
zqQ}l9p64GE0ec|L@V#O~ec53_6diX7%}b7H2bCK6Np?42h7J|?zSz9Etp`r7!ty@9
zo-ofoI?((AX8*yGh*u;ds;?cz_oYjrqoxZ3u_K!Dt+bm;vaRr$t8%%Do3e
z!x|jev*-LYnDYf!kUrNnoqhRyMf~&nML1tR;WzZzx9IVMQH-1~`2gyluRjMI#!*b{
z=@|@P4|?JQt=M2$WhBQu-T?2A3MTl->gCF&f@Jto8)XA3&&yfuNPo$3!0-4J)cib3{G)wAK^@gvM0~%5uq&4`YZ~H^zoiW!|q*c
z`K|jMzc8$c9kSOCe5@2!m-NK6kbYulQQm+?M73=cCo*sBQJW(f!2
z#=Dm9TOU~7pNx)+lJC;A%0CO6uLR^Ex4(w1jriGb1oTKftM`d3j27qn?|%o3mBBaN
z#Sfqci(<$9d3OAD0~VC6E_0C#cXR
zu%1Oe)->PTc97J59j?EuQwaKbLOXv$sSy4{#5DlQ9hn!kTY;me9_o&KH_>|Kym@^E
zlq(D&Yj#b9i(*>t##-UL$EYV?AmbHIeh1}^c*^&=3`BFntVV?}sGA{fjHb!5N4v%de2jZ72qD(e^
zJS2bp0+Es$@o#wL!_`f6wGP=D%#ZJpvE$WsGI`0japFzy`uJ%DjaO?N;`1~6la}Vv
zPangKXT721Bo1eKTZ6lUTv1+p*QdKk$Z(dNkKq?T_JfT+*sfF$U(C4{x$x&2x%m$`
z6d&EgMDUz7!riC(q8(qNuFyI;$VD`PMi;6Dnr1E+@aoESN8?5yqki66GyR$!Jfy8Sbf#(%4yH#~U5W!f(X7{lCC
zQ%{oo-Jz4iU~spz#AJW$6`Jt1nTG1Xobs+d8Irro7;rTG!+)=tb$3h8#rQY8u6-~#
zd2kXt9*RBQ2Zi&z4lX$kUVQ4#$PU;-$kK_SbNW-L-t-H!Smu{U;OP5}$2UJcLV({{
z>z#+!?*!H!Kl_xUe1J9J8up==SY01+BJ=aksdGzUdMu7!&(&%TH^}*{1xJhdl0C;iC`Kn3^0j2CQ~MkMR#4
zA?vZoI*a5zJ`sE!v;UB-+vl0)<@zCZ^H0eDlM>g`F2Ie6n~c5!8;37VzMkoRhSxmM
zky=6Cl}Os(O3qq1KM$)Hl3uoHhCT6+@iN)9jK)JDKY2p^_z8g=J#BXKfSRRd?TD6se5xo
z2M)Ua|2cdOzyn$ZYKzN?Ue-2FYj@w)!TNk8nIHs0;Fvh~nBM&FkNx?lY>OM8Szjsr
z!Z*d=arP*ZCp6QwxYC9eu$g^McZq+5kJ__%0MVw0$H`j%h;e=1P@I40^+)hyH}8Ot
z)XjRGXLYWT2lW#TT)s|}j*PkY?gksIVzV30DQepYeomdMOnP5_9{kNPqUQGbP&n|biv@9G9*t)S`p01j3e*5#+p@
zBDOew+r-as2el#sCcS{aal5f(CZK1WED~T{jUH_zM=E_JQ>py>p^_2*-?)h1khdR1Z0C+
zjP@btfA~WeSg+(q(Y!Tt*K^HbTZifjrVH60(HWj?W_^ms&NI(B!CRnZT+ciOvVmOq
z?~7#U|9O7;zfF;LSIoPV2AT_{j$B-BQ}v
zZUAqMl6HMaaQ&}W&y+!&Yi2oEJZs|EJJ$fMKMb|wvp#x_hnAf1t;03hYuoW$qvlsH
zwFB0WZuS&DiKg!mfGxCM9R1XT1og)b7MpWPI{YV&Lu0nrO1^riTZS>P3y)p@db9H!
zgl)X!8)^RO68ON%rhnoe5|7cZFB1o=u{Tm;-DAVj^FQkn-E+p)ZnZRXo_xl@dE?j*
zCi#;s{FAEt8}iEuz56Qz8;jabvgTwO9(~S6><93%{EU+~nYdbil#iB_70h{0KCu2|
ztOaWZ`S~1>^JJF~r#EB})W2ciu3p#QdWiEl@dR@|>nG~^0cjZW+`pw*|KtwjwOae@UKQulVt(&8`5EZ&;)34-05jj|jSJQz+CQ%G?EGw9AtGAlKEp@-
ziEY1qzK%jILEtg`#g11v{-mG$-%tMw3l2R(JT$zAn#W%rxUBt?%CLk#ds#aIa1*z^
zwS-BrU4Wl>b5+lAI11)9Mt~f-7TX-YfU0HTk_a#-DI}+Pm(aIMpK^`6uXg3@TXt_UPa%
zL^F6!3k&BC5{DigEFH%dxHgvm4}z%Kzx_wk^#oKkcZDZe(DceKACk4#uRPg<#E%~S
zxSZJ-t|yw&pdEdJNDi+#RIC3-!|F?fJxE`b2zNbK+v-gmzOHZV#>sr@#a}T)njatT
z@B_)3y@(t^dN}<8_!k4t$+LRR4&O9^P$%#9$R2*I?!~eNfbcfuea(PB8pMqY6w_ll
zLbcVL%fj=;(9GyHAC{I_@SFbR!T!J+DJMt~9S37q?+^5p@a67TWv`EwhKZS`fo{ul
zAo+uDcZUa`cx5d3fk%j-0jf_MY}XPrz8?4dhdbDPevCxwuN;{6V0n?=^XJ{@{g4_$
zXiACnH)4Epq_luw(Tj^LzyAJvza29li8bIb>5(166`uq3<4QbxI|Mt2fA%!S-Fzgq
zIQk>OA3(G3=@B*ir~kK&;v6izU6^S7pce=DCnP=^pLkh!EM5X
zNA6*2N!&-RZEOCJA?R3YXPtWMmv!_NJHwn~om%hW=HvD5zJ^L|;!SHYXU+4JF>3DA
z--58I1unaD;*?>Z=3<#Lnuxdv_#LwiVxP-z|9H`cnS6Yc)D|IsV!`sm_gS=4Pcjp0
zrj%6tyw(@U_vpmRKw)w4?v0bJfOU0vDABLa*}>I5oXF^Cg!h8o*mdbNX~5#3$l=_b
znLHfOO0)L|C;4joYnWp2`Fp*KS0H&)i;u(=%X1bWyn4uauD`hf@?dH_YYcq7Hi|J&
zgkhP3*HQSRZ-1XPkx~Gx@sv{@GfVei(Y)437+_+?*uu`kF=_$R*e2(xapDENF^I3;
z>c^io&ta>>Ejk(X)|;Mct&r>++*>R7^mz-jc547@O=%kk-uG^67*443dCyYW1GIkk
zZvj+aQ)>Uz3+2}DJ-C$CsAL_h<=XATy*)SyxnBX<)9u@yTjAqpFL?~(3#6vXA@
z4KV`6K+i@AxQ`b*&ZJfdJjU#;o6c#0_&c@^a`@$!-}If8G$cbJkqPT)P1}&iki88&
zSozK&N{n>mOI1bdv=5VC%m{?a1_76(z0GB^mEEi3VfrMv3
z9bFU8&;8s!(03l!m44EbNzUIDSB6IRc6;&G!`d%W5Vc;JPZ`su7Q0upX2KZXTy3g12>a9b`8qGHobFN3w+*)>>
zQ$Gwpbok8o;vZ!vtmeKWJ6+A>WbhLqc>+#Nb`M89?vvjn9~v;`t`oZUYDH&#+$wiX
zT~!hdcU0^HGtXwQ5BDJAOiUF#7<`;vcJy8s(b!K3We@PB`s{u%c;I>eq~#oP`ihJ=
z2><)xydvRRTtvxr;!nDP3?)~d&tAAil3UC5VLmpJ8hoDG8vEcdG@PygCdvmhT(>RV!j8OHsQPfb{FG(hp&Z_e&iFF-sYd=NiWB~pgX?mZGz(=03TU%
z?3p*wcbG#y7a-;L9()L2zU#u&qh8@L;I?iQ%Lfx2nCqYS)&ogn1Q(J03oTvb8c>bT
zlZBUIJFQc5&?DV~kNDZ=gHPR
zGvfVl9;Zd|xaziCqFPet6JSk=*{?l+;M;iykn72{n4CE0hW{rcIfHMzWDrO-R>xV*
z<(yg4u~ZWU^f(dgIh=u0tJ+Mv!7oqmtN3gWvebU(2J=f|Mc){TL(F03}tJton-vjM@10Q!{=SXuDd=b
zQJ93wZ+&vprEup*sFmw?*?(RLo0QAI;E5e_n*J~;omUR
z@?fbk+~H@}&1B5t_CLnc)k-kOxU+f|Zx4?S4bTdE++S!oq(A(+Bl}B|FWSL<2I59D
z4Tr^%^Rnkx+XqwaCfIqju6!SRTa4@R8bJB0sF+S48|m}%O&I?WsGxnj#tMJw=JPN0
z-Tdi0c*8$9F><}4|Ear1j_%$w5NuEwTT|LN$B74?g2NfsgX??N*sjBr+=)NkZ*)(=
z<-EeIo6wW@?N(qDKo%DZq;AW(p6SfOd*D#v+UQW(izV@^<_-Q#u3|Hk)gTrhFtF>`nf8xe}wLx4w^nR#N@1OuXefFrf
z^dZZ228RwfW{%N34#k3V6!*XoLb@}q`J{BN%W_U=i_YXEOZ2?5&iacc=O6^;eNA+_
zQ0R}I9KQbi9;P}`H4dOzmR^3aNTv6EBPI5soqBT~TAIVYhUIvDWXb2qPyaCM?Ik&X
z%6)3;HnmO?qTxO9^;&&;AjlBltZmzCo>yvi*SN#Yne&l+uJ7#00MYT$jl};f75ePg
z+g3Wb)x|nLRqt{mT-^&Nq@G6QB4>c#EyCRKC;C_=_)CIqUzse)^GNlQVk^v@n#Tex?Jd
z-cATJr)-;M#mZUI#HU`g6j-0Id&+@3k}$8EmyNr-zO?b_Ua>r^;#VEB0tOm;V?YQZD4=PemL*wGlje0pa@Tpr-VLiUx-D
zV(;29hLFeha#pbBSFgZaix~2sIBig%hZ7##^)$ZPqK*cS)N4K2)VDFkgI|Do`R)7M
zFG@ki{OO0Hqt1teM3an_EzEt3_|Xr_DFw)&7waDz4I$@L{9ir)K;e3JPV=e1R41zl
zas)IudMTejZI|y@;f3Pzh^-(x>x+n7*6U`E$Bds6Zhz19M6iSE58ic#d*icvev3z&
zv79lI&ublWeu80bEVYd!-*5bnLK}*KYdfchgx3*P*1jXBg%>xozC|yFECA
z@g1H#z|PP&DD(;Zw?F<+P5peO7`lw~@%i~HVm`A&8Ovc6P~Op#lk3ZhnyF>~$B^;7
zfM|WpSw;yf_yORyAI%r#VmUZ|nuP37`EdPVclgFg$$H%by}CzR(A*n=8)LVz#GB72
zzgeeuIEQAB!&+J2^*YVaq&!jdPY&ERKM=)7@9mAi*`L*<`DGiwf{^bT%;6@j>&Tu&
z!Ns^B0gNugVI$?uem-}Aa{!6T-lzW6Pd#0~IHg;Lk`fb8=ei1jZ37{3E9SuVH@*rkB=@VkZqzc|EB5nuUJkofF?lN;@G
zKrGg6NA_>}Bl^mqRq}1;fvy79@1gDs|vL!4v!A&*4@mHi!>eoO*XZ*6dXKfP5B$^5
zJtw=;zMhEJar+4Xw)g9ZBx&hZez{4sgvFx$&96Z6B}c3D^IvwlI_l%-y1(jbf={e+
zSu9t3TCZW1%L^it!ranwGO%46_ZQCRWD-MjdqtFScG~3lj3Hu~7S9wyST?*2>EQ>6
zJNG?h?0l~zwB4g-mx^uTeLlQ#Mby*#S`L!iG&%YwhcfeAwy|84=wV@A)!bnhqDPNd
zFyP{D(9Bf3h^x2Y?zilpt0s;eUFL^VjB`}zYNulJ
zEzlgA=&o?jgz?!=%;z98&Xd19xCgKG>?0-|EbBpLz(GsknnMt>5e3Hu<*d@11)_C+!2I-PJj#3W-vo!UV&45=xd;bdr~1E
zHOra%Aa!~(B{9tQ)?AmNZ%)1i0Pw@e&kX~YnA+2V^+vwi7QCsgf5k9|!$qASMJzrY
zFcW9(_x}lM&3hjF00Mtg*aPejV~G=RP92tKb^Jhkx?!`1AI>(?&B+O7nPWQgrkW5h
zXW9Ks1pIysraI;nWIY{D?qZ<3ZfE?g%~THh=kl}$>%FBq0}w#vO!CLxxtNVR>j1`I
zJQq^Q!tM)W;=_#N3_w*_d_6bam()v5*)O2Gj>fenfr&fNgLR3`8U2~oueK3BuiOm5
zyC$vOQ%R|FMsS5Ujbd_qlp|Ld96__IVV%xO*xu+Y3YYT}Omg`I;&3oNuBmb0>oJ`)6g=ylcgJ&ar5KVnH|RaWUkKgA0?+li^=5Mc
zQd>2NF>Lnyf%_hm)JD&=l;a(y9WGrVw0(I}O-`H~E+kX9cuPB&*mJ6S|
z7dGRH<5}Dx?1Rf*7+q?vSA&96(0o8zu>Qcv5j($0!s`f+>Y1y0%xj1WKF7Vba=oms
zi3x4W!?SSgY2Uu`Ir`&yTN3=ozi9*gM+l
zKK0=3o-UUF@wE=yz`8H!w5;SXUrq&xF12AbqMG#x>EnoRX9gl^{%OLA1_?CjCoK3N2PPx;
zGj@GRnRs=)Pexy!_e`ko=L5qyoIS0_`A?SAQ5;irR2zn|EIMTG_23bf!{SJ`kACe>#Nk$S
zd#X0U!uTN~_tyHs<`ISE$^68;AKep8H%Hg>P`|nUshntX+K^k6_`>&U)Ozo$)oE_40AvQfIW#&$#;3vYv<;GF*GLUp{ns
z)8^P--NST7XWrVJ3%$>KXiAbgU;KK&IbCZ2l7qZ1JY26bS&XU;*uU$s@uD4uI%a0*U`n~Cb@zJ##CeF$^@#CP!>1gqVb<85sbboz=
zDA!T60>|RK(O+~09TzG%9pzuHagruE
zwr|F)Hp)W4qt!*qo^S#zIGZ#Wjte#}1z3V971FkQeeXz>_LDoiuAlIpDi~<8X_&Z|+4IXK+`ajPj9#
z&C#6tGP8d5P+%P2vz{-U?x{4--U#ay0^~dhqxYP>mJeRmWYECZLhrf3t5A*e%yF_-BT9fkwfTQokVzWjbZNJoU
zuJ}!s{XRh+WpiYaqMXGxzxhZ`^*3L6I9taD{=u$Z=K_wF!Kqy?>*Asm{nJQ4tavT6
z?~$a|B;6W(T8N%)`=YcMtZ}r&qOJO3b4;h&&Ax~VAGU^!sK$&&ZY)=k$d9}H_%b>jPi5IS>y8nkD!WUVlX*B8g{0Z
z#PgGgg*FZge!R?HWn-%sjO$X6xWjxhlR<4C^}17m9L$p`3NZ79DaFMD)IK!$h@h!O
z6q-KxoirdB{{r8-4jF7s8uJJtgN{T#oYsX?!GdFMsM6#>L{#^^`qR
zR5lp@K&2L}(HY;SKLI#mKT;m$VuFA7>(u7hz22s~d0*V0Uo#xuJ*6IE?%hc_T});C-<&8ax+EN_i)Z+*qLKNQCwF1?FS
zR{h&^A?xhQ>da>~-|v2jbp2>$ua=KY@Lhd!Vyjr^_c#5czWp^E0#T>597)Er+Ki8XGp*5K*m;8|fX
z5cJF;y&4Zh5C2D+-VcRaTN$>g-^z049AlczDODT))?j|
zk=NlZCmm?bHast`!K9z^WnlY$(TX_ryHHES=W7oev@oe1{fnLNBq-dIaPASj#`4)f
zuMh0>;m9ciYkXr9cD$0&tnq3@Bzd=IN|zp7{`*R@c{PDyxJS*_M1KK-S}#BGtrZ~X
zBbnWAgV>9(W`K5owcZ|$w|2e>5WYCA)8mXLqf5H?I6>)$p#RDam)RnWv(c~tM>@wV8DDmGKL
zMfC`VJ`dJB7^{bG!l28ZBDr|5)SzozpXc{yfCk9-R3Jo;>3vwgJ`j~Rh?t*G2>kyT
zdF_*Z^d3H1`SU;Yp90qx5Z2Ul)>*E#697X0`#hLEvC|l93iRe!p3T|!+(Y9#w~eH7
z9_wIhan{tC^XC0i-R>q38_pw}k#&qy6M@E!;lQYtL*0+n7r^u~f8-Yco0sqm=RLCm
zj-_Y62KCoSxfTx=JmeK8j$=5ro(2f~&cC&t#V4IH;EYu~^(KSi6gyM%`f(5B({TPQ
z57v6F|MUI$+v`Lk;{Ncg-d2$E|r@9z+8JWKP@r=@%i
z>J?THn$}x%iReR(V-GgW_QNq0&@OIsvz6>3ogerCpQYkJcyB8J=k`*E`AG5Oz{?Kk
zqXq4J4i7(HdqrvYnM;oA$P&YaR^?9J(+l8Gj5SL{pFhut^ih8sF>%`Xd~P)}UcU3m
z?|K&t$k!yxGaj8h*D2zS=+xq!M(bQpC+VP-6JW_z;QO40Bx8Hc*|87GE|4H}%=JV4
z+eEL;M*~O%^S&mZ-y!R;M1`FFBCLTOsE>l@a}WEuTn6@#TyF^8J=f&pE*k&nSI*ai
z5cr)!v+uf56i6lVJC@mP9F7?63k(Bu`;*t-sc~9h4z_DJ&VlZ;9`5B(E&3mLou|~1
zdj<^vV7$g`H`51V7=A7MIrA-2zG2D#!+47$XfBExoeVkah;xQM?};~Qxzx_bM~K&3
zBJ**&ayCqSH8hRqWR|LMLExcm7>`|IHaG>GzwHmWB-b#q=KT2|Ez0MMWD!{%co?fRx!Q;P`%tr>xw7P4&
z`|kus9G>=Ue={3jvZGcWODa0CnD)xI@Ttk?fb#&3nptG9eoV!%>Nx@Zgn+(dvig{P
zUM09UqfIH^XIyL7F6?BGrUovplgIgz(MT`?m`jNx!}J<;R50ZL&xb|vvX+~?){cOW
z_`<4IVz2}@H_Mk}kFUpg`vn+ojeqi0NprcLxO4rg5GqX_ET~S8Q|ryMQg1JbrLJ(o
zdpOPIY4F$gtWOP(&r1sWFUH|X-!%%$+;ktzyZ}k$@*bp!xBtg46}Wu(c~79jHzWD*
zWk+v(zOb)9ZRI+mNN+jcy>|gTzvM5Z)5vEfIg7?GU@`e^$C)+CcPvaztX-Rgu;NL2
z7{oSDi!{d%!vXF!0uFZJg0#*EUpqi9f8l^1Ong|=WuL(B8pJ<+r*K~Id3
zH)a2G{?HrWnjAhx&-3GRO|I<$cj+3mPMzDykj)bSOmdbaBTw)*BHM7rg;GO3s3Z6YhFMQ*Wk(tlebe%!WacYqE
z;V2CIAP0m7M<3v+g-0~XcRYLo)~GfdOW?}%n@OdsLu3|BE^(YST;Up&l
zBN30maeX#=V0UkO(^GE<-5<<;(1QfpQZANIwL
zoCoW*SJp0rT1&TH*Lm(mZ}|?$MEp0FH8!Yl$4gE3{9^xE-{Q$W;)lcYr^ltmL^EF{
zi`YFSx1zpIT1QkqU+1Ns)IHhM-Bf7PydFEh-N17N;rIS%Cg$FheZ5nOYmuZ^(=@#L
za686x({lgpo*b6g!CS+k3p
zFJ$xU&;IMEyr`Jt+_qBBwB{E#^?zzP+}^3nwVnJq$2l+SuAK6%&}u$2-PTe*7&gpV;|$m9=y?MDvNU|)*jd}
z^oD@-aeWgIhXF3y7k~Dnad2SfH{HHnFCa3O)1{!@+R|U}!!kQA%t!x-=yB?*PI&S*
zo;f*gzuB{J-~R63qxL=_Mv)p|U9YXrbzRxZrk*cO$j5UQD-lPYGfp~V$j2#g-&(tV
zd`CeG8z_Zqj;-08v!~z26wRu7?D1a5Inpp7UVHHd+4ugx`>{HcEwws9^|OxX)wy+X
zALQ##6z(|f;cVmNJ>&7yli9*i4?^2Rt}5?e5RMUNL^g5kSKl(ir9YyJhvk>PS|(4G
zn)hPi1M)wo