workflows: Pre-install just and gh-aw for drafter and fix

.github/workflows/drafter.md

@@ -20,6 +20,8 @@ engine:
   id: claude
 imports:
   - shared/network.md
+  # just and the gh-aw CLI, for recompiling lock files
+  - shared/workflow-tools.md
 tools:
   bash: ["*"]
   github:
@@ -151,6 +153,8 @@ implementation.
    lockfiles before opening the pull request: run `just setup && just
    compile` (this recompiles *all* workflows, not just the one you touched —
    every `.lock.yml` must stay in sync with its `.md` source).
+   `just` and the pinned gh-aw CLI are already installed; the sandbox
+   can't install them itself.
 6. Check if the originating issue #${{ github.event.issue.number }} has the
    `agent/workflow-edits-allowed` label by reading its labels. If it does,
    you must propagate this label to the pull request so that subsequent

.github/workflows/fix.md

@@ -51,6 +51,8 @@ engine:
   id: claude
 imports:
   - shared/network.md
+  # just and the gh-aw CLI, for recompiling lock files
+  - shared/workflow-tools.md
 tools:
   bash: ["*"]
   github:
@@ -214,6 +216,8 @@ manually: this workflow removes `agent/fixme` itself via `remove-labels`
    workflows, not just the one you touched — every `.lock.yml` must stay in
    sync with its `.md` source). Include the resulting `.lock.yml` changes in
    your commit.
+   `just` and the pinned gh-aw CLI are already installed; the sandbox
+   can't install them itself.
 8. Push your fix as a new commit on the same branch via the
    `push-to-pull-request-branch` safe-output. Do not open a new PR.
 

.github/workflows/shared/workflow-tools.md

@@ -0,0 +1,24 @@
+---
+description: just and the gh-aw CLI for recompiling lock files, installed before the agent starts
+# Tools the drafter and fix agents need to recompile lock files
+# (`just setup && just compile`). They're installed on the runner before the
+# agent starts because the agent can't install them from inside the AWF
+# sandbox: it has no GitHub token for `gh extension install`, and
+# api.github.com isn't on its network allowlist. AWF exposes the host's
+# binaries and $HOME (where gh keeps extensions) to the agent, so no custom
+# runner or container image is needed. See
+# https://github.github.com/gh-aw/reference/sandbox/#host-binaries
+#
+# The gh-aw runtime installs the CLI at the version that compiled the lock
+# file, which ci.yml keeps equal to .github/aw/gh-aw-version.
+runtimes:
+  gh-aw: {}
+# Custom steps run outside the sandbox, after checkout; see
+# https://github.github.com/gh-aw/reference/steps-jobs/
+steps:
+  - name: Install just
+    run: |
+      set -euo pipefail
+      sudo apt-get update -q
+      sudo apt-get install -y -q just
+---

justfile

@@ -8,13 +8,16 @@ setup:
     #!/usr/bin/env bash
     set -euo pipefail
     wanted="{{ gh_aw_version }}"
-    if gh extension list 2>/dev/null | grep -q 'github/gh-aw'; then
-        installed=$(gh aw version 2>&1 | awk '{print $NF}')
+    # Ask gh-aw itself: `gh extension list` needs gh to be logged in, and it
+    # isn't in the agent sandbox, where the CLI is pre-installed (see
+    # .github/workflows/shared/workflow-tools.md).
+    if version=$(gh aw version 2>&1); then
+        installed=$(awk '{print $NF}' <<<"$version")
         if [ "$installed" = "$wanted" ]; then
             echo "gh-aw $wanted already installed."
             exit 0
         fi
-        echo "gh-aw installed at ${installed:-unknown}, re-pinning to $wanted..."
+        echo "gh-aw installed at $installed, re-pinning to $wanted..."
         gh extension remove gh-aw
     fi
     gh extension install github/gh-aw --pin "$wanted"