Clarify intentional OpenFile mode for append-only GITHUB_ENV writes

Copilot · lpcox · web-flow · commit 0ed4820bc2fa · 2026-04-17T22:43:11.000Z
Agent-Logs-Url: https://github.com/github/gh-aw-mcpg/sessions/8c6049c3-8a7e-4abf-93b8-615d1b4fb45a Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
diff --git a/internal/cmd/proxy.go b/internal/cmd/proxy.go
@@ -335,6 +335,7 @@ func configureTLSTrustEnvironment(caCertPath string) error {
 	}
 
 	// Best-effort append: the proxy should still start even if GITHUB_ENV cannot be opened.
+	// Mode is intentionally 0 because O_CREATE is not used (existing runner-managed file only).
 	f, err := os.OpenFile(githubEnvPath, os.O_APPEND|os.O_WRONLY, 0)
 	if err != nil {
 		logger.LogWarn("startup", "Skipping GITHUB_ENV TLS trust export: open failed for %s: %v", githubEnvPath, err)

Original file line number	Diff line number	Diff line change
`@@ -335,6 +335,7 @@ func configureTLSTrustEnvironment(caCertPath string) error {`
`335`	`335`	`}`
`336`	`336`
`337`	`337`	`// Best-effort append: the proxy should still start even if GITHUB_ENV cannot be opened.`
	`338`	`+ // Mode is intentionally 0 because O_CREATE is not used (existing runner-managed file only).`
`338`	`339`	`f, err := os.OpenFile(githubEnvPath, os.O_APPEND\|os.O_WRONLY, 0)`
`339`	`340`	`if err != nil {`
`340`	`341`	`logger.LogWarn("startup", "Skipping GITHUB_ENV TLS trust export: open failed for %s: %v", githubEnvPath, err)`