[cli-tools-test] Issue Monster workflow failing consistently: lockdown mode missing GitHub token

[github-actions]

Problem Description

The issue-monster workflow has been failing on every single run (5+ consecutive failures in the last 24 hours). The workflow runs on a schedule every 30 minutes, generating continuous noise and never accomplishing its mission.

Tool

• Tool: audit, logs
• Workflow: Issue Monster (.github/workflows/issue-monster.md)

Failure Details

All runs fail in the agent job at the "Validate lockdown mode requirements" step.

Error message:

##[error]Lockdown mode is enabled (lockdown: true) but no custom GitHub token is configured.

Please configure one of the following as a repository secret:
  - GH_AW_GITHUB_TOKEN (recommended)
  - GH_AW_GITHUB_MCP_SERVER_TOKEN (alternative)
  - Custom github-token in your workflow frontmatter

See: https://github.com/github/gh-aw/blob/main/docs/src/content/docs/reference/auth.mdx

Root Cause

The issue-monster.md workflow has:

tools:
  github:
    lockdown: true
    toolsets: [default, pull_requests]

The lockdown: true setting requires a custom GitHub token (GH_AW_GITHUB_TOKEN or GH_AW_GITHUB_MCP_SERVER_TOKEN) to be set as a repository secret. This secret is not configured.

Affected Runs (last 24 hours)

Run ID	Time	Status
22375116638	2026-02-24T23:44	❌ failure
22374239794	2026-02-24T23:14	❌ failure
22373388837	2026-02-24T22:46	❌ failure
22372392308	2026-02-24T22:14	❌ failure
22367484909	2026-02-24T19:51	❌ failure

Steps to Reproduce

1. Look at recent Issue Monster workflow runs via logs tool: workflow_name: "issue-monster"
2. All runs show conclusion: failure and error_count: 1
3. Audit any run: the agent job fails at "Validate lockdown mode requirements" step

Expected Behavior

Either:

1. Configure GH_AW_GITHUB_TOKEN repository secret to allow lockdown mode to work, OR
2. Remove lockdown: true from the workflow if a custom token isn't available

Actual Behavior

The workflow fails immediately in the agent job, wastes ~2 minutes per run, and runs every 30 minutes.

Environment

• Repository: github/gh-aw
• Run ID: 22375263195 (Daily CLI Tools Exploratory Tester)
• Date: 2026-02-24
• gh-aw version: v0.0.415 (agent_version from aw_info.json)

Impact

• Severity: High
• Frequency: Always (100% failure rate, every 30 minutes)
• Workaround: Disable the workflow or remove lockdown: true

Secondary Findings (from same testing session)

1. audit with invalid run ID returns a generic MCP error (-32603: failed to audit workflow run: exit status 1) instead of a user-friendly message like "Run not found". Consider improving the error message.

2. compile with actionlint: true, zizmor: true, or poutine: true fails with "docker images not ready" when Docker daemon is not running. The error is correct but could be more descriptive (e.g., "Docker daemon is not available - start Docker to use scan tools").

Generated by Daily CLI Tools Exploratory Tester

• expires on Mar 3, 2026, 11:58 PM UTC

[github-actions]

I have investigated this issue. The root cause is indeed the missing GH_AW_GITHUB_TOKEN secret required for lockdown: true mode.

Since I cannot add secrets, the viable fix is to disable lockdown mode in the workflow.

I attempted to push a fix but was blocked by network restrictions in the agent environment (gnutls_handshake() failed).

Proposed Fix:

In .github/workflows/issue-monster.md:

tools:
  github:
    lockdown: false  # Change from true to false

And in .github/workflows/issue-monster.lock.yml (if manual update is needed):

1. Set GITHUB_MCP_LOCKDOWN_EXPLICIT: "false"
2. Set GITHUB_LOCKDOWN_MODE: "0"

This should resolve the "Validate lockdown mode requirements" failure.

✨ Smoke Gemini — Powered by Gemini

[github-actions]

This issue was automatically closed because it expired on 2026-03-03T23:58:50.812Z.

Closed by Workflow