Replace runtime observer curl access with a constrained HTTP helper

[vitek-karas]

Motivation

The runtime failure observer has been unable to complete its scans because its agent-generated curl commands are denied before they reach the public Azure DevOps and Helix endpoints. This has affected repeated runs, including 31344723626 and 31387864364.

The observer only needs a small set of specific read operations, so it should not require generic curl:* authorization. This change tries a purpose-built repository tool instead: the agent selects an operation and supplies constrained identifiers, while the helper constructs and performs the request.

Changes

• Add runtime-failure-observer-http, an executable Python urllib helper with fixed subcommands for Azure DevOps build lists, timelines, task logs, Helix work-item lists, and work-item console logs.
• Limit requests to the public endpoint families used by the observer, GET requests, bounded response sizes and timeouts, validated redirects, and outputs below /tmp/gh-aw/agent/.
• Install the helper before agent execution and authorize only runtime-failure-observer-http:*; remove curl from the agent shell allowlist.
• Update the observer instructions to use the helper throughout while preserving the existing blocked-scan failure reporting behavior.
• Add focused tests for URL and output-path validation, redirect handling, size limits, HTTP errors, and Helix console traversal.
• Regenerate the committed gh-aw lock workflow.

Validation

• python3 .github/workflows/tests/test_runtime_failure_observer_http.py
• gh aw compile .github/workflows/runtime-failure-observer.agent.md --schedule-seed dotnet/xharness --validate
• Confirmed the compiled Copilot arguments allow shell(runtime-failure-observer-http:*) and do not allow curl, python, or python3.

[Copilot]

Pull request overview

This PR updates the runtime failure observer workflow to stop using agent-generated curl commands (which are being denied by the harness) and instead route all required Azure DevOps/Helix reads through a repository-owned, constrained HTTP helper that constructs allow-listed URLs and enforces size/time/path limits.

Changes:

• Added a new executable helper (runtime-failure-observer-http) that performs a small set of GET-only AzDO/Helix read operations with strict URL, redirect, size, timeout, and output-path validation.
• Updated the observer agent instructions/workflow to install and authorize only the helper (runtime-failure-observer-http:*) and remove curl from the shell allowlist.
• Added targeted unit tests for URL/output validation, redirect handling, response size limiting, HTTP errors, and Helix console traversal; regenerated the compiled lock workflow.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
.github/workflows/runtime-failure-observer-http	New constrained HTTP helper implementing fixed AzDO/Helix GET subcommands with validation and bounded I/O.
.github/workflows/tests/test_runtime_failure_observer_http.py	New unit tests for helper validation, redirects, size limits, and Helix console resolution.
.github/workflows/runtime-failure-observer.agent.md	Switches observer instructions from curl to the helper; adds a pre-agent install step and tool authorization changes.
.github/workflows/runtime-failure-observer.agent.lock.yml	Regenerated workflow lockfile reflecting the helper install step and allowlist updates.
.gitattributes	Ensures LF line endings for the new helper script.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.