[aw] Smoke Codex failed

[github-actions]

Workflow Failure

Workflow: Smoke Codex
Branch: docs/sync-image-tag-digest-format-3a5096c11b4a13d3
Run: https://github.com/github/gh-aw-firewall/actions/runs/24629144045
Pull Request: #2095

⚠️ Engine Failure: The codex engine terminated unexpectedly.

Last agent output:

GitHub write actions were attempted but blocked by permissions in this environment (`403` / GraphQL operation denied), so required PR comment, discussion comment, and label add were not completed.
2026-04-19T21:51:34.502685Z DEBUG opentelemetry_sdk:  name="PeriodReaderThreadExportingDueToFlush"
2026-04-19T21:51:34.502727Z DEBUG opentelemetry_sdk:  name="MeterProviderInvokingObservableCallbacks" count=0
2026-04-19T21:51:34.503112Z DEBUG opentelemetry_sdk:  name="PeriodicReaderMetricsCollected" count=12 time_taken_in_millis=0
2026-04-19T21:51:34.504687Z DEBUG opentelemetry-otlp:  name="HttpMetricsClient.ExportStarted"
2026-04-19T21:51:34.504737Z DEBUG opentelemetry-http:  name="ReqwestBlockingClient.Send"
2026-04-19T21:51:34.505774Z DEBUG opentelemetry-otlp:  name="HttpMetricsClient.ExportFailed" error="reqwest::Error { kind: Request, url: \"https://ab.chatgpt.com/otlp/v1/metrics\", source: hyper_util::client::legacy::Error(Connect, TunnelUnsuccessful) }"
2026-04-19T21:51:34.505959Z DEBUG opentelemetry_sdk:  name="PeriodReaderInvokedExport" export_result="Err(InternalFailure(\"reqwest::Error { kind: Request, url: \\\"https://ab.chatgpt.com/otlp/v1/metrics\\\", source: hyper_util::client::legacy::Error(Connect, TunnelUnsuccessful) }\"))"
2026-04-19T21:51:34.506196Z DEBUG opentelemetry_sdk:  name="PeriodReaderThreadAdjustingRemainingIntervalAfterFlush" remaining_interval=18
2026-04-19T21:51:34.506417Z DEBUG opentelemetry_sdk:  name="PeriodReaderThreadLoopAlive" Next export will happen after interval, unless flush or shutdown is triggered. interval_in_millisecs=18223

Action Required

Assign this issue to Copilot using the agentic-workflows sub-agent to automatically debug and fix the workflow failure.

Debug with any coding agent

Use this prompt with any coding agent (GitHub Copilot, Claude, Gemini, etc.):

Debug the agentic workflow failure using https://raw.githubusercontent.com/github/gh-aw/main/debug.md

The failed workflow run is at https://github.com/github/gh-aw-firewall/actions/runs/24629144045

Manually invoke the agent

Debug this workflow failure using your favorite Agent CLI and the agentic-workflows prompt.

• Start your agent
• Load the agentic-workflows prompt from .github/agents/agentic-workflows.agent.md or https://github.com/github/gh-aw/blob/main/.github/agents/agentic-workflows.agent.md
• Type debug the agentic workflow smoke-codex failure in https://github.com/github/gh-aw-firewall/actions/runs/24629144045

Tip

Stop reporting this workflow as a failure

To stop a workflow from creating failure issues, set report-failure-as-issue: false in its frontmatter:

safe-outputs:
  report-failure-as-issue: false

Generated from Smoke Codex · ◷

• expires on Apr 26, 2026, 9:52 PM UTC

[github-actions]

Agent job 24640001492 failed.

🔒 Lock File Out of Sync: The workflow could not start because its compiled lock file no longer matches the source markdown.

This means the workflow's .md file was edited but gh aw compile was not run afterwards to regenerate the corresponding .lock.yml file. The agent is prevented from running against a stale configuration to avoid unexpected behaviour.

To fix, recompile the workflow:

gh aw compile

Then commit and push the updated .lock.yml file.

More ways to recompile

Using the gh-aw MCP server (if configured):

{ "tool": "compile", "arguments": { "validate": true } }

Recompile all workflows at once:

gh aw compile --all

Verify the result:

gh aw compile --validate

How to investigate the mismatch

The workflow run logs contain a verbose debug pass that shows exactly what was hashed. Search the Check workflow lock file step logs for lines starting with [hash-debug] to see:

• The raw frontmatter text that was used as input
• Any imported files that were included in the hash
• The canonical JSON that was fed to SHA-256
• The resulting hash value

This makes it easy to spot accidental whitespace changes, encoding differences, or import path drift.

How to disable this check

[!CAUTION]
Disabling this check means the agent can run against an out-of-date compiled workflow. Only disable it if you have an alternative mechanism to keep lock files in sync.

Set stale-check: false in the on: section of your workflow frontmatter:

on:
  issues:
    types: [opened]
  stale-check: false

After editing, recompile the workflow: gh aw compile

Generated from Smoke Codex · ◷

[github-actions]

Agent job 24643780869 failed.

⚠️ Engine Failure: The codex engine terminated unexpectedly.

Last agent output:

44,526
2026-04-20T01:11:54.083717Z DEBUG opentelemetry_sdk:  name="PeriodReaderThreadExportingDueToFlush"
2026-04-20T01:11:54.083731Z DEBUG opentelemetry_sdk:  name="MeterProviderInvokingObservableCallbacks" count=0
2026-04-20T01:11:54.083962Z DEBUG opentelemetry_sdk:  name="PeriodicReaderMetricsCollected" count=7 time_taken_in_millis=0
2026-04-20T01:11:54.084496Z DEBUG opentelemetry-otlp:  name="HttpMetricsClient.ExportStarted"
2026-04-20T01:11:54.084505Z DEBUG opentelemetry-http:  name="ReqwestBlockingClient.Send"
2026-04-20T01:11:54.085577Z DEBUG opentelemetry-otlp:  name="HttpMetricsClient.ExportFailed" error="reqwest::Error { kind: Request, url: \"(ab.chatgpt.com/redacted), source: hyper_util::client::legacy::Error(Connect, TunnelUnsuccessful) }"
2026-04-20T01:11:54.085598Z DEBUG opentelemetry_sdk:  name="PeriodReaderInvokedExport" export_result="Err(InternalFailure(\"reqwest::Error { kind: Request, url: \\\"(ab.chatgpt.com/redacted), source: hyper_util::client::legacy::Error(Connect, TunnelUnsuccessful) }\"))"
2026-04-20T01:11:54.085610Z DEBUG opentelemetry_sdk:  name="PeriodReaderThreadAdjustingRemainingIntervalAfterFlush" remaining_interval=58
2026-04-20T01:11:54.085848Z DEBUG opentelemetry_sdk:  name="PeriodReaderThreadLoopAlive" Next export will happen after interval, unless flush or shutdown is triggered. interval_in_millisecs=58864

Generated from Smoke Codex · ◷

[github-actions]

Agent job 24667737914 failed.

⚠️ Engine Failure: The codex engine terminated unexpectedly.

Last agent output:

45,903
2026-04-20T13:00:17.205099Z DEBUG opentelemetry_sdk:  name="PeriodReaderThreadExportingDueToFlush"
2026-04-20T13:00:17.205108Z DEBUG opentelemetry_sdk:  name="MeterProviderInvokingObservableCallbacks" count=0
2026-04-20T13:00:17.205361Z DEBUG opentelemetry_sdk:  name="PeriodicReaderMetricsCollected" count=12 time_taken_in_millis=0
2026-04-20T13:00:17.206058Z DEBUG opentelemetry-otlp:  name="HttpMetricsClient.ExportStarted"
2026-04-20T13:00:17.206069Z DEBUG opentelemetry-http:  name="ReqwestBlockingClient.Send"
2026-04-20T13:00:17.207097Z DEBUG opentelemetry-otlp:  name="HttpMetricsClient.ExportFailed" error="reqwest::Error { kind: Request, url: \"(ab.chatgpt.com/redacted), source: hyper_util::client::legacy::Error(Connect, TunnelUnsuccessful) }"
2026-04-20T13:00:17.207119Z DEBUG opentelemetry_sdk:  name="PeriodReaderInvokedExport" export_result="Err(InternalFailure(\"reqwest::Error { kind: Request, url: \\\"(ab.chatgpt.com/redacted), source: hyper_util::client::legacy::Error(Connect, TunnelUnsuccessful) }\"))"
2026-04-20T13:00:17.207318Z DEBUG opentelemetry_sdk:  name="PeriodReaderThreadAdjustingRemainingIntervalAfterFlush" remaining_interval=30
2026-04-20T13:00:17.207328Z DEBUG opentelemetry_sdk:  name="PeriodReaderThreadLoopAlive" Next export will happen after interval, unless flush or shutdown is triggered. interval_in_millisecs=30965

Generated from Smoke Codex · ◷

[github-actions]

Agent job 24651284503 failed.

⚠️ Engine Failure: The codex engine terminated unexpectedly.

Last agent output:

GitHub write actions required by the workflow could not be completed from this runtime because safe-output tool interfaces (`add_comment`, `add_labels`, `noop`) were not available as callable tools, and direct REST write attempt returned 403.
2026-04-20T13:37:55.712633Z DEBUG opentelemetry_sdk:  name="PeriodReaderThreadExportingDueToFlush"
2026-04-20T13:37:55.712649Z DEBUG opentelemetry_sdk:  name="MeterProviderInvokingObservableCallbacks" count=0
2026-04-20T13:37:55.712974Z DEBUG opentelemetry_sdk:  name="PeriodicReaderMetricsCollected" count=7 time_taken_in_millis=0
2026-04-20T13:37:55.713471Z DEBUG opentelemetry-otlp:  name="HttpMetricsClient.ExportStarted"
2026-04-20T13:37:55.713485Z DEBUG opentelemetry-http:  name="ReqwestBlockingClient.Send"
2026-04-20T13:37:55.714959Z DEBUG opentelemetry-otlp:  name="HttpMetricsClient.ExportFailed" error="reqwest::Error { kind: Request, url: \"(ab.chatgpt.com/redacted), source: hyper_util::client::legacy::Error(Connect, TunnelUnsuccessful) }"
2026-04-20T13:37:55.714978Z DEBUG opentelemetry_sdk:  name="PeriodReaderInvokedExport" export_result="Err(InternalFailure(\"reqwest::Error { kind: Request, url: \\\"(ab.chatgpt.com/redacted), source: hyper_util::client::legacy::Error(Connect, TunnelUnsuccessful) }\"))"
2026-04-20T13:37:55.715194Z DEBUG opentelemetry_sdk:  name="PeriodReaderThreadAdjustingRemainingIntervalAfterFlush" remaining_interval=58
2026-04-20T13:37:55.715210Z DEBUG opentelemetry_sdk:  name="PeriodReaderThreadLoopAlive" Next export will happen after interval, unless flush or shutdown is triggered. interval_in_millisecs=58792

Generated from Smoke Codex · ◷

[github-actions]

Agent job 24672401893 failed.

🔒 Lock File Out of Sync: The workflow could not start because its compiled lock file no longer matches the source markdown.

This means the workflow's .md file was edited but gh aw compile was not run afterwards to regenerate the corresponding .lock.yml file. The agent is prevented from running against a stale configuration to avoid unexpected behaviour.

To fix, recompile the workflow:

gh aw compile

Then commit and push the updated .lock.yml file.

More ways to recompile

Using the gh-aw MCP server (if configured):

{ "tool": "compile", "arguments": { "validate": true } }

Recompile all workflows at once:

gh aw compile --all

Verify the result:

gh aw compile --validate

How to investigate the mismatch

The workflow run logs contain a verbose debug pass that shows exactly what was hashed. Search the Check workflow lock file step logs for lines starting with [hash-debug] to see:

• The raw frontmatter text that was used as input
• Any imported files that were included in the hash
• The canonical JSON that was fed to SHA-256
• The resulting hash value

This makes it easy to spot accidental whitespace changes, encoding differences, or import path drift.

How to disable this check

[!CAUTION]
Disabling this check means the agent can run against an out-of-date compiled workflow. Only disable it if you have an alternative mechanism to keep lock files in sync.

Set stale-check: false in the on: section of your workflow frontmatter:

on:
  issues:
    types: [opened]
  stale-check: false

After editing, recompile the workflow: gh aw compile

Generated from Smoke Codex · ◷

[github-actions]

Agent job 24670564593 failed.

🔒 Lock File Out of Sync: The workflow could not start because its compiled lock file no longer matches the source markdown.

This means the workflow's .md file was edited but gh aw compile was not run afterwards to regenerate the corresponding .lock.yml file. The agent is prevented from running against a stale configuration to avoid unexpected behaviour.

To fix, recompile the workflow:

gh aw compile

Then commit and push the updated .lock.yml file.

More ways to recompile

Using the gh-aw MCP server (if configured):

{ "tool": "compile", "arguments": { "validate": true } }

Recompile all workflows at once:

gh aw compile --all

Verify the result:

gh aw compile --validate

How to investigate the mismatch

The workflow run logs contain a verbose debug pass that shows exactly what was hashed. Search the Check workflow lock file step logs for lines starting with [hash-debug] to see:

• The raw frontmatter text that was used as input
• Any imported files that were included in the hash
• The canonical JSON that was fed to SHA-256
• The resulting hash value

This makes it easy to spot accidental whitespace changes, encoding differences, or import path drift.

How to disable this check

[!CAUTION]
Disabling this check means the agent can run against an out-of-date compiled workflow. Only disable it if you have an alternative mechanism to keep lock files in sync.

Set stale-check: false in the on: section of your workflow frontmatter:

on:
  issues:
    types: [opened]
  stale-check: false

After editing, recompile the workflow: gh aw compile

Generated from Smoke Codex · ◷

[github-actions]

Agent job 24670445408 failed.

🔒 Lock File Out of Sync: The workflow could not start because its compiled lock file no longer matches the source markdown.

This means the workflow's .md file was edited but gh aw compile was not run afterwards to regenerate the corresponding .lock.yml file. The agent is prevented from running against a stale configuration to avoid unexpected behaviour.

To fix, recompile the workflow:

gh aw compile

Then commit and push the updated .lock.yml file.

More ways to recompile

Using the gh-aw MCP server (if configured):

{ "tool": "compile", "arguments": { "validate": true } }

Recompile all workflows at once:

gh aw compile --all

Verify the result:

gh aw compile --validate

How to investigate the mismatch

The workflow run logs contain a verbose debug pass that shows exactly what was hashed. Search the Check workflow lock file step logs for lines starting with [hash-debug] to see:

• The raw frontmatter text that was used as input
• Any imported files that were included in the hash
• The canonical JSON that was fed to SHA-256
• The resulting hash value

This makes it easy to spot accidental whitespace changes, encoding differences, or import path drift.

How to disable this check

[!CAUTION]
Disabling this check means the agent can run against an out-of-date compiled workflow. Only disable it if you have an alternative mechanism to keep lock files in sync.

Set stale-check: false in the on: section of your workflow frontmatter:

on:
  issues:
    types: [opened]
  stale-check: false

After editing, recompile the workflow: gh aw compile

Generated from Smoke Codex · ◷

[github-actions]

Agent job 24670276110 failed.

🔒 Lock File Out of Sync: The workflow could not start because its compiled lock file no longer matches the source markdown.

This means the workflow's .md file was edited but gh aw compile was not run afterwards to regenerate the corresponding .lock.yml file. The agent is prevented from running against a stale configuration to avoid unexpected behaviour.

To fix, recompile the workflow:

gh aw compile

Then commit and push the updated .lock.yml file.

More ways to recompile

Using the gh-aw MCP server (if configured):

{ "tool": "compile", "arguments": { "validate": true } }

Recompile all workflows at once:

gh aw compile --all

Verify the result:

gh aw compile --validate

How to investigate the mismatch

The workflow run logs contain a verbose debug pass that shows exactly what was hashed. Search the Check workflow lock file step logs for lines starting with [hash-debug] to see:

• The raw frontmatter text that was used as input
• Any imported files that were included in the hash
• The canonical JSON that was fed to SHA-256
• The resulting hash value

This makes it easy to spot accidental whitespace changes, encoding differences, or import path drift.

How to disable this check

[!CAUTION]
Disabling this check means the agent can run against an out-of-date compiled workflow. Only disable it if you have an alternative mechanism to keep lock files in sync.

Set stale-check: false in the on: section of your workflow frontmatter:

on:
  issues:
    types: [opened]
  stale-check: false

After editing, recompile the workflow: gh aw compile

Generated from Smoke Codex · ◷

[github-actions]

Agent job 24673246721 failed.

🔒 Lock File Out of Sync: The workflow could not start because its compiled lock file no longer matches the source markdown.

This means the workflow's .md file was edited but gh aw compile was not run afterwards to regenerate the corresponding .lock.yml file. The agent is prevented from running against a stale configuration to avoid unexpected behaviour.

To fix, recompile the workflow:

gh aw compile

Then commit and push the updated .lock.yml file.

More ways to recompile

Using the gh-aw MCP server (if configured):

{ "tool": "compile", "arguments": { "validate": true } }

Recompile all workflows at once:

gh aw compile --all

Verify the result:

gh aw compile --validate

How to investigate the mismatch

The workflow run logs contain a verbose debug pass that shows exactly what was hashed. Search the Check workflow lock file step logs for lines starting with [hash-debug] to see:

• The raw frontmatter text that was used as input
• Any imported files that were included in the hash
• The canonical JSON that was fed to SHA-256
• The resulting hash value

This makes it easy to spot accidental whitespace changes, encoding differences, or import path drift.

How to disable this check

[!CAUTION]
Disabling this check means the agent can run against an out-of-date compiled workflow. Only disable it if you have an alternative mechanism to keep lock files in sync.

Set stale-check: false in the on: section of your workflow frontmatter:

on:
  issues:
    types: [opened]
  stale-check: false

After editing, recompile the workflow: gh aw compile

Generated from Smoke Codex · ◷

[github-actions]

Agent job 24673276323 failed.

🔒 Lock File Out of Sync: The workflow could not start because its compiled lock file no longer matches the source markdown.

This means the workflow's .md file was edited but gh aw compile was not run afterwards to regenerate the corresponding .lock.yml file. The agent is prevented from running against a stale configuration to avoid unexpected behaviour.

To fix, recompile the workflow:

gh aw compile

Then commit and push the updated .lock.yml file.

More ways to recompile

Using the gh-aw MCP server (if configured):

{ "tool": "compile", "arguments": { "validate": true } }

Recompile all workflows at once:

gh aw compile --all

Verify the result:

gh aw compile --validate

How to investigate the mismatch

The workflow run logs contain a verbose debug pass that shows exactly what was hashed. Search the Check workflow lock file step logs for lines starting with [hash-debug] to see:

• The raw frontmatter text that was used as input
• Any imported files that were included in the hash
• The canonical JSON that was fed to SHA-256
• The resulting hash value

This makes it easy to spot accidental whitespace changes, encoding differences, or import path drift.

How to disable this check

[!CAUTION]
Disabling this check means the agent can run against an out-of-date compiled workflow. Only disable it if you have an alternative mechanism to keep lock files in sync.

Set stale-check: false in the on: section of your workflow frontmatter:

on:
  issues:
    types: [opened]
  stale-check: false

After editing, recompile the workflow: gh aw compile

Generated from Smoke Codex · ◷

[github-actions]

Agent job 24673612666 failed.

🔒 Lock File Out of Sync: The workflow could not start because its compiled lock file no longer matches the source markdown.

This means the workflow's .md file was edited but gh aw compile was not run afterwards to regenerate the corresponding .lock.yml file. The agent is prevented from running against a stale configuration to avoid unexpected behaviour.

To fix, recompile the workflow:

gh aw compile

Then commit and push the updated .lock.yml file.

More ways to recompile

Using the gh-aw MCP server (if configured):

{ "tool": "compile", "arguments": { "validate": true } }

Recompile all workflows at once:

gh aw compile --all

Verify the result:

gh aw compile --validate

How to investigate the mismatch

The workflow run logs contain a verbose debug pass that shows exactly what was hashed. Search the Check workflow lock file step logs for lines starting with [hash-debug] to see:

• The raw frontmatter text that was used as input
• Any imported files that were included in the hash
• The canonical JSON that was fed to SHA-256
• The resulting hash value

This makes it easy to spot accidental whitespace changes, encoding differences, or import path drift.

How to disable this check

[!CAUTION]
Disabling this check means the agent can run against an out-of-date compiled workflow. Only disable it if you have an alternative mechanism to keep lock files in sync.

Set stale-check: false in the on: section of your workflow frontmatter:

on:
  issues:
    types: [opened]
  stale-check: false

After editing, recompile the workflow: gh aw compile

Generated from Smoke Codex · ◷