[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AD6FHWTFECT87DYQZ3C5CE":3,"skill-same:01M6AD6FHWTFECT87DYQZ3C5CE":61},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":32,"linkOnly":33,"markdownContent":34,"markdownBody":35,"frontMatter":36,"refName":37,"commitSha":38,"skillDirectory":39,"forksCount":40,"repositoryHtmlUrl":41,"repositoryHomepageUrl":42,"ownerHtmlUrl":43,"ownerBlogUrl":44,"ownerDescription":45,"updatedAt":46,"install":47,"resources":60},"01M6AD6FHWTFECT87DYQZ3C5CE","http-mcp-headers",null,"Implement secret-safe HTTP headers for MCP transport in gh-aw.","github\u002Fgh-aw","github","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F9919?v=4","01M6AC83DS133TPXFSP1DHNCC6","GitHub","01M6AD3VCZ4WKQSFSRTPN7N9DN",5621,"MIT","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fgh-aw\u002Fblob\u002Fmain\u002F.github\u002Fskills\u002Fhttp-mcp-headers\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31],"MCP","http","http mcp headers","headers","safe","implement","gh","for","2026-11-10 10:12:30",false,"---\nname: http-mcp-headers\ndescription: Implement secret-safe HTTP headers for MCP transport in gh-aw.\n---\n\n\n# HTTP MCP Header Secret Support - Implementation Summary\n\nUse this reference for HTTP MCP header secret support in the copilot engine.\n\n## Problem Statement\n\nWhen HTTP MCP headers include GitHub Actions secrets, `mcp-config.json` must:\n\n1. Extract secrets from headers (e.g., `${{ secrets.DD_API_KEY }}`)\n2. Declare those env variables in the execution step\n3. Configure the MCP config's \"env\" section to passthrough those variables\n4. Use the passed variables in the headers section\n\n## Example Workflow\n\n```markdown\non:\n  workflow_dispatch:\npermissions:\n  contents: read\nengine: copilot\nmcp-servers:\n  datadog:\n    type: http\n    url: \"https:\u002F\u002Fmcp.datadoghq.com\u002Fapi\u002Funstable\u002Fmcp-server\u002Fmcp\"\n    headers:\n      DD_API_KEY: \"${{ secrets.DD_API_KEY }}\"\n      DD_APPLICATION_KEY: \"${{ secrets.DD_APPLICATION_KEY }}\"\n      DD_SITE: \"${{ secrets.DD_SITE || 'datadoghq.com' }}\"\n    allowed:\n      - search_datadog_dashboards\n      - search_datadog_slos\n      - search_datadog_metrics\n      - get_datadog_metric\n\n# Datadog Dashboard Search\n\nSearch for Datadog dashboards and provide a summary.\n```\n\n## Generated Output\n\n### 1. MCP Config (mcp-config.json)\n\n```json\n{\n  \"mcpServers\": {\n    \"datadog\": {\n      \"type\": \"http\",\n      \"url\": \"https:\u002F\u002Fmcp.datadoghq.com\u002Fapi\u002Funstable\u002Fmcp-server\u002Fmcp\",\n      \"headers\": {\n        \"DD_API_KEY\": \"${DD_API_KEY}\",\n        \"DD_APPLICATION_KEY\": \"${DD_APPLICATION_KEY}\",\n        \"DD_SITE\": \"${DD_SITE}\"\n      },\n      \"tools\": [\n        \"search_datadog_dashboards\",\n        \"search_datadog_slos\",\n        \"search_datadog_metrics\",\n        \"get_datadog_metric\"\n      ],\n      \"env\": {\n        \"DD_API_KEY\": \"\\\\${DD_API_KEY}\",\n        \"DD_APPLICATION_KEY\": \"\\\\${DD_APPLICATION_KEY}\",\n        \"DD_SITE\": \"\\\\${DD_SITE}\"\n      }\n    }\n  }\n}\n```\n\n### 2. Execution Step Environment Variables\n\n```yaml\nenv:\n  DD_API_KEY: ${{ secrets.DD_API_KEY }}\n  DD_APPLICATION_KEY: ${{ secrets.DD_APPLICATION_KEY }}\n  DD_SITE: ${{ secrets.DD_SITE || 'datadoghq.com' }}\n  COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}\n  # ... other env vars\n```\n\n`GH_AW_MCP_CONFIG` is intentionally NOT in the YAML `env:` block — it is exported from the run script (`export GH_AW_MCP_CONFIG=\"$HOME\u002F.copilot\u002Fmcp-config.json\"`) so `$HOME` is resolved at runtime. GitHub Actions does not shell-expand `env:` values, so the path must be set via `export` to work on self-hosted\u002Fcontainerized runners where `HOME` is not `\u002Fhome\u002Frunner`.\n\n## Implementation Details\n\n### Key Functions\n\n1. **extractSecretsFromValue(value string)** - Extracts secret expressions from a string\n   - Parses `${{ secrets.VAR_NAME }}` patterns\n   - Handles default values: `${{ secrets.VAR || 'default' }}`\n   - Returns map of variable names to full expressions\n\n2. **extractSecretsFromHeaders(headers map[string]string)** - Extracts all secrets from HTTP headers\n   - Iterates through all header values\n   - Collects all unique secret expressions\n   - Returns consolidated map of secrets\n\n3. **replaceSecretsWithEnvVars(value string, secrets map[string]string)** - Replaces secret expressions with env var references\n   - Transforms `${{ secrets.DD_API_KEY }}` to `${DD_API_KEY}`\n   - Used in MCP config headers rendering\n\n4. **collectHTTPMCPHeaderSecrets(tools map[string]any)** - Collects secrets from all HTTP MCP tools\n   - Scans all tools for HTTP MCP configurations\n   - Extracts secrets from each tool's headers\n   - Returns consolidated map for execution step env\n\n### Rendering Logic\n\n#### In renderSharedMCPConfig (mcp-config.go):\n\n1. **Extract secrets** when rendering HTTP MCP configs for copilot engine\n2. **Add env section** to property order when secrets are found\n3. **Render headers** with env var references instead of secret expressions\n4. **Render env** with passthrough syntax (`\\${VAR_NAME}`)\n\n#### In GetExecutionSteps (copilot_engine.go):\n\n1. **Collect all HTTP MCP header secrets** from workflow tools\n2. **Add to execution step env map** with secret expressions\n\n## Security Benefits\n\n1. **Secrets never appear in MCP config** - Only env var references\n2. **Proper GitHub Actions secret handling** - Uses `${{ secrets.* }}` syntax\n3. **Environment isolation** - Each MCP server receives only its required secrets\n4. **Consistent pattern** - Matches existing GitHub remote MCP server implementation\n\n## Test Coverage\n\n### Unit Tests (mcp_http_headers_test.go)\n- extractSecretsFromValue\n- extractSecretsFromHeaders\n- replaceSecretsWithEnvVars\n- collectHTTPMCPHeaderSecrets\n- renderSharedMCPConfig with HTTP headers\n\n### Integration Tests (copilot_mcp_http_integration_test.go)\n- Single HTTP MCP tool with secrets\n- Multiple HTTP MCP tools\n- HTTP MCP without secrets\n- Property ordering\n- Env variable sorting\n\nAll tests pass ✓\n","# HTTP MCP Header Secret Support - Implementation Summary\n\nUse this reference for HTTP MCP header secret support in the copilot engine.\n\n## Problem Statement\n\nWhen HTTP MCP headers include GitHub Actions secrets, `mcp-config.json` must:\n\n1. Extract secrets from headers (e.g., `${{ secrets.DD_API_KEY }}`)\n2. Declare those env variables in the execution step\n3. Configure the MCP config's \"env\" section to passthrough those variables\n4. Use the passed variables in the headers section\n\n## Example Workflow\n\n```markdown\non:\n  workflow_dispatch:\npermissions:\n  contents: read\nengine: copilot\nmcp-servers:\n  datadog:\n    type: http\n    url: \"https:\u002F\u002Fmcp.datadoghq.com\u002Fapi\u002Funstable\u002Fmcp-server\u002Fmcp\"\n    headers:\n      DD_API_KEY: \"${{ secrets.DD_API_KEY }}\"\n      DD_APPLICATION_KEY: \"${{ secrets.DD_APPLICATION_KEY }}\"\n      DD_SITE: \"${{ secrets.DD_SITE || 'datadoghq.com' }}\"\n    allowed:\n      - search_datadog_dashboards\n      - search_datadog_slos\n      - search_datadog_metrics\n      - get_datadog_metric\n\n# Datadog Dashboard Search\n\nSearch for Datadog dashboards and provide a summary.\n```\n\n## Generated Output\n\n### 1. MCP Config (mcp-config.json)\n\n```json\n{\n  \"mcpServers\": {\n    \"datadog\": {\n      \"type\": \"http\",\n      \"url\": \"https:\u002F\u002Fmcp.datadoghq.com\u002Fapi\u002Funstable\u002Fmcp-server\u002Fmcp\",\n      \"headers\": {\n        \"DD_API_KEY\": \"${DD_API_KEY}\",\n        \"DD_APPLICATION_KEY\": \"${DD_APPLICATION_KEY}\",\n        \"DD_SITE\": \"${DD_SITE}\"\n      },\n      \"tools\": [\n        \"search_datadog_dashboards\",\n        \"search_datadog_slos\",\n        \"search_datadog_metrics\",\n        \"get_datadog_metric\"\n      ],\n      \"env\": {\n        \"DD_API_KEY\": \"\\\\${DD_API_KEY}\",\n        \"DD_APPLICATION_KEY\": \"\\\\${DD_APPLICATION_KEY}\",\n        \"DD_SITE\": \"\\\\${DD_SITE}\"\n      }\n    }\n  }\n}\n```\n\n### 2. Execution Step Environment Variables\n\n```yaml\nenv:\n  DD_API_KEY: ${{ secrets.DD_API_KEY }}\n  DD_APPLICATION_KEY: ${{ secrets.DD_APPLICATION_KEY }}\n  DD_SITE: ${{ secrets.DD_SITE || 'datadoghq.com' }}\n  COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}\n  # ... other env vars\n```\n\n`GH_AW_MCP_CONFIG` is intentionally NOT in the YAML `env:` block — it is exported from the run script (`export GH_AW_MCP_CONFIG=\"$HOME\u002F.copilot\u002Fmcp-config.json\"`) so `$HOME` is resolved at runtime. GitHub Actions does not shell-expand `env:` values, so the path must be set via `export` to work on self-hosted\u002Fcontainerized runners where `HOME` is not `\u002Fhome\u002Frunner`.\n\n## Implementation Details\n\n### Key Functions\n\n1. **extractSecretsFromValue(value string)** - Extracts secret expressions from a string\n   - Parses `${{ secrets.VAR_NAME }}` patterns\n   - Handles default values: `${{ secrets.VAR || 'default' }}`\n   - Returns map of variable names to full expressions\n\n2. **extractSecretsFromHeaders(headers map[string]string)** - Extracts all secrets from HTTP headers\n   - Iterates through all header values\n   - Collects all unique secret expressions\n   - Returns consolidated map of secrets\n\n3. **replaceSecretsWithEnvVars(value string, secrets map[string]string)** - Replaces secret expressions with env var references\n   - Transforms `${{ secrets.DD_API_KEY }}` to `${DD_API_KEY}`\n   - Used in MCP config headers rendering\n\n4. **collectHTTPMCPHeaderSecrets(tools map[string]any)** - Collects secrets from all HTTP MCP tools\n   - Scans all tools for HTTP MCP configurations\n   - Extracts secrets from each tool's headers\n   - Returns consolidated map for execution step env\n\n### Rendering Logic\n\n#### In renderSharedMCPConfig (mcp-config.go):\n\n1. **Extract secrets** when rendering HTTP MCP configs for copilot engine\n2. **Add env section** to property order when secrets are found\n3. **Render headers** with env var references instead of secret expressions\n4. **Render env** with passthrough syntax (`\\${VAR_NAME}`)\n\n#### In GetExecutionSteps (copilot_engine.go):\n\n1. **Collect all HTTP MCP header secrets** from workflow tools\n2. **Add to execution step env map** with secret expressions\n\n## Security Benefits\n\n1. **Secrets never appear in MCP config** - Only env var references\n2. **Proper GitHub Actions secret handling** - Uses `${{ secrets.* }}` syntax\n3. **Environment isolation** - Each MCP server receives only its required secrets\n4. **Consistent pattern** - Matches existing GitHub remote MCP server implementation\n\n## Test Coverage\n\n### Unit Tests (mcp_http_headers_test.go)\n- extractSecretsFromValue\n- extractSecretsFromHeaders\n- replaceSecretsWithEnvVars\n- collectHTTPMCPHeaderSecrets\n- renderSharedMCPConfig with HTTP headers\n\n### Integration Tests (copilot_mcp_http_integration_test.go)\n- Single HTTP MCP tool with secrets\n- Multiple HTTP MCP tools\n- HTTP MCP without secrets\n- Property ordering\n- Env variable sorting\n\nAll tests pass ✓\n",{"name":5,"description":7},"main","8541229759617347888641eba917d3b0ad66a984",".github\u002Fskills\u002Fhttp-mcp-headers",625,"https:\u002F\u002Fgithub.com\u002Fgithub\u002Fgh-aw","https:\u002F\u002Fgh.io\u002Fgh-aw","https:\u002F\u002Fgithub.com\u002Fgithub","https:\u002F\u002Fgithub.com\u002Fabout","How people build software.","2026-11-12 03:23:28",{"source":8,"skillName":5,"commands":48,"prompt":58,"zipAvailable":59},[49,52,55],{"tool":50,"command":51},"npx","npx skills add github\u002Fgh-aw --skill http-mcp-headers",{"tool":53,"command":54},"bunx","bunx skills add github\u002Fgh-aw --skill http-mcp-headers",{"tool":56,"command":57},"pnpm","pnpm dlx skills add github\u002Fgh-aw --skill http-mcp-headers","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fgithub\u002Fgh-aw\u002Fblob\u002Fmain\u002F.github\u002Fskills\u002Fhttp-mcp-headers\u002FSKILL.md",true,[],[62,85,103,128,154,172],{"skillNo":63,"name":64,"nameZh":6,"description":65,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":66,"categories":67,"keywords":72,"publishedAt":32},"01M6ADC942STTXHFV410J4DH0X","GitHub Agentic Workflows","GitHub Agentic Workflows (`gh-aw`) is a GitHub CLI extension for writing Agentic Workflows in markdown and compiling them to GitHub Actions.","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fgh-aw\u002Fblob\u002Fmain\u002FSKILL.md",[68,71],{"categoryNo":69,"categoryName":70,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[9,73,74,75,76,77,30,78,31,79,80,81,82,83,84],"agentic","agentic workflows","github agentic workflows","workflows","github cli","extension","compiling","cli","writing","actions","github actions","markdown",{"skillNo":86,"name":87,"nameZh":6,"description":88,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":89,"categories":90,"keywords":91,"publishedAt":32},"01M6ADC6ZXSA46N9XD6VNAP1MS","windows-compatibility","Cross-platform path handling and command patterns","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fgh-aw\u002Fblob\u002Fmain\u002F.squad\u002Ftemplates\u002Fskills\u002Fwindows-compatibility\u002FSKILL.md",[],[92,93,94,95,96,97,98,99,100,101,102],"windows","windows compatibility","compatibility","bugs","path","high","platform","cross-platform","patterns","command","git",{"skillNo":104,"name":105,"nameZh":6,"description":106,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":107,"categories":108,"keywords":109,"publishedAt":32},"01M6ADC44957SVQF96R5YY247P","versioning-policy","Semver versioning rules for Squad SDK and CLI — prevents prerelease version incidents","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fgh-aw\u002Fblob\u002Fmain\u002F.squad\u002Ftemplates\u002Fskills\u002Fversioning-policy\u002FSKILL.md",[],[110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,31,126,80,127],"policy","versioning policy","versioning","incident","gate","implementation","version","Rules","workspace","pr","ci","npm","semver","release","squad","resolution","incidents","sdk",{"skillNo":129,"name":130,"nameZh":6,"description":131,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":132,"categories":133,"keywords":138,"publishedAt":32},"01M6ADC1PHMEAEVR87F8PDR89X","tiered-memory","Three-tier agent memory model (hot\u002Fcold\u002Fwiki) for context reduction per spawn","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fgh-aw\u002Fblob\u002Fmain\u002F.squad\u002Ftemplates\u002Fskills\u002Ftiered-memory\u002FSKILL.md",[134,137],{"categoryNo":135,"categoryName":136,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000015","视觉设计",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[139,140,141,142,31,143,144,145,146,147,148,149,150,151,152,153],"tiered memory","memory","memory-management","model","cold","proposal","runtime","three","spawn","management","context","wiki","agent memory","performance","design",{"skillNo":155,"name":156,"nameZh":6,"description":157,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":158,"categories":159,"keywords":163,"publishedAt":32},"01M6ADBZTDGFM0E25EWRQEMYEH","test-discipline","Update tests when changing APIs — no exceptions","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fgh-aw\u002Fblob\u002Fmain\u002F.squad\u002Ftemplates\u002Fskills\u002Ftest-discipline\u002FSKILL.md",[160],{"categoryNo":161,"categoryName":162,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",[164,165,166,167,168,97,169,113,170,171],"test discipline","discipline","test","sync","when","tests","quality","update",{"skillNo":173,"name":124,"nameZh":6,"description":174,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":175,"categories":176,"keywords":177,"publishedAt":32},"01M6ADBX5MJP4Z7CG4XTV8ZVT8","Squad's command catalog and interactive menu. Invoke via \u002Fsquad (slash command) or natural language (\"squad commands\", \"what can squad do\", \"show me squad options\"). Presents categorized operations (Install & Upgrade, Team Management, Issues & PRs, Plugins & Skills, Model & Cost, Sessions & State) as an interactive picker. Routes to the right squad CLI command or the Squad coordinator agent.","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fgh-aw\u002Fblob\u002Fmain\u002F.squad\u002Ftemplates\u002Fskills\u002Fsquad\u002FSKILL.md",[],[124,178,179,180,181,182,183,184,185,186,187,188,189,101,142,190,191,192,193,194,195,196,80],"show","interactive menu","invoke","coordinator","as","commands","upgrade","options","me","natural language","do","install","team","show me","plugins","issues","state","squad commands","sessions"]