Adding new mention workflow variants that disable the agent sandbox is the right fix, and it should be implemented as additive -no-sandbox workflows (not replacements) for both issue and PR mentions.

Recommendation

Implement two new reusable workflows and matching trigger examples:

gh-aw-mention-in-issue-no-sandbox (source + compiled lock + example trigger)
gh-aw-mention-in-pr-no-sandbox (source + compiled lock + example trigger)

Use gh-aw frontmatter sandbox config (sandbox.agent: false) for the new variants only, while keeping existing mention-in-issue / mention-in-pr unchanged as the safe default.

Findings

Current mention workflows do not expose any sandbox toggle input to callers.
- .github/workflows/gh-aw-mention-in-issue.lock.yml:51-83 (workflow_call.inputs includes model, setup-commands, etc., but no sandbox input)
- .github/workflows/gh-aw-mention-in-pr.lock.yml:54-80 (same pattern)
Current mention source workflows define strict: false but no explicit sandbox frontmatter.
- .github/workflows/gh-aw-mention-in-issue.md:81
- .github/workflows/gh-aw-mention-in-pr.md:79
Trigger examples are wired only to the current lock workflows.
- gh-agent-workflows/mention-in-issue/example.yml:18-20
- gh-agent-workflows/mention-in-pr/example.yml:20-22
Dogfood triggers in this repo are also wired only to current variants.
- .github/workflows/trigger-mention-in-issue.yml:20-24
- .github/workflows/trigger-mention-in-pr.yml:22-25
Discovery/install surfaces currently only list the existing mention workflows.
- scripts/quick-setup.sh:121-126 (default list)
- docs/workflows/gh-agent-workflows.md:43-45 (human-coordinated table)
- mkdocs.yml:22-24 (nav entries)
Related history checked:
- #14 introduced mention workflows (merged)
- #57 refined mention-in-pr behavior (merged, linked to #55)
- #220 adjusted mention-in-pr setup behavior (merged)
- No existing issue/PR was found that already adds sandbox-disabled mention variants.
Upstream gh-aw syntax supports explicit sandbox configuration (for the workflow source frontmatter), including disabling agent sandbox via sandbox: { agent: false } (reference: github/gh-aw docs reference/sandbox.md and reference/frontmatter-full.md).

Verification

I ran repository workflow linting to ensure current baseline is healthy:

make lint-workflows

Result: passed (exit code 0), including trigger files for mention workflows:

.github/workflows/trigger-mention-in-issue.yml
.github/workflows/trigger-mention-in-pr.yml

I also verified the mention workflow sources/locks contain no sandbox frontmatter field today (only existing defaults), based on direct file inspection listed above.

Detailed Action Plan

Add two new workflow source files (do not modify existing behavior):
- Copy .github/workflows/gh-aw-mention-in-issue.md → .github/workflows/gh-aw-mention-in-issue-no-sandbox.md
- Copy .github/workflows/gh-aw-mention-in-pr.md → .github/workflows/gh-aw-mention-in-pr-no-sandbox.md
- In each new file, set frontmatter sandbox config to disable agent sandbox (sandbox.agent: false), keeping all other behavior aligned with original workflow.
Add user-facing trigger templates for the new variants:
- New directories:
  - gh-agent-workflows/mention-in-issue-no-sandbox/
  - gh-agent-workflows/mention-in-pr-no-sandbox/
- Add README.md, example.yml, and dogfood-with.yml patterned after existing mention workflows, but uses: should target the new *-no-sandbox.lock.yml workflows.
Wire dogfood trigger generation:
- Ensure scripts/dogfood.sh includes new workflow folders so generated triggers appear under .github/workflows/trigger-mention-in-issue-no-sandbox.yml and .github/workflows/trigger-mention-in-pr-no-sandbox.yml.
Update docs/navigation/install surfaces:
- Add both variants to workflow catalog docs and explain security tradeoff (sandbox disabled, broader host capabilities including Docker use-cases).
- Update mkdocs.yml nav to include the two new workflow pages.
- Decide whether scripts/quick-setup.sh includes them by default or as opt-in only (recommended opt-in to preserve safer defaults).
Compile and validate:
- Run make compile to generate new lock files.
- Run make lint (or at minimum make lint-workflows) to confirm all generated triggers and workflow files validate.
Safety note in docs/READMEs for new variants:
- Explicitly document that these are less isolated than default mention workflows and should be used only when host/container access is required.

Type	Link	Relevance
Issue	#366	Current request
PR	#14	Introduced mention-in-issue / mention-in-pr workflows
PR	#57	Prior mention-in-pr behavior refinement
PR	#220	Prior mention-in-pr runtime adjustment
File	`.github/workflows/gh-aw-mention-in-issue.md:81`	Current source has no explicit sandbox config
File	`.github/workflows/gh-aw-mention-in-pr.md:79`	Current source has no explicit sandbox config
File	`gh-agent-workflows/mention-in-issue/example.yml:18-20`	Current trigger template wiring
File	`gh-agent-workflows/mention-in-pr/example.yml:20-22`	Current trigger template wiring
File	`scripts/quick-setup.sh:121-126`	Default workflow install list
Web	https://github.github.com/gh-aw/reference/sandbox/	Upstream sandbox frontmatter reference

Add mention-in-issue and mention-in-pr with sandbox: false #366

Description

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions