[awf] agent/entrypoint: hostedtoolcache find-prepend overwrites setup-* PATH ordering

[lpcox]

Problem

The agent harness rebuilds PATH by prepending every */bin directory found under /opt/hostedtoolcache via a blunt find command. This discards the version ordering already established by $GITHUB_PATH from setup-* actions (e.g., ruby/setup-ruby). The wrong Ruby version wins the PATH race, causing bundle exec to fail with a version mismatch on the first invocation. The agent then spends 6+ tool calls diagnosing before manually prepending the correct toolcache bin on every subsequent Ruby command.

Context

Original report: github/gh-aw#32044

Versions: gh-aw-firewall v0.25.41, engine copilot/claude-sonnet-4.6, ruby/setup-ruby@v1.307.0.

Root Cause

In containers/agent/entrypoint.sh, the sandbox PATH-rebuild logic uses:

export PATH="$(find /opt/hostedtoolcache /home/runner/work/_tool -maxdepth 4 -type d -name bin | tr '\n' ':')$PATH"

This prepends all discovered bin dirs in filesystem traversal order, overriding the toolchain priority already written to $GITHUB_PATH by setup-* actions (gh-aw-firewall#1359 propagates $GITHUB_PATH, but this find prepend runs after and clobbers it).

Proposed Solution

In containers/agent/entrypoint.sh, skip the find-prepend when $GITHUB_PATH is non-empty, or append discovered bins after $PATH rather than prepending them. This preserves setup-* action priority while still making other toolcache bins available.

Generated by Firewall Issue Dispatcher · ● 8.1M · ◷