timeout-minutes on agent step not enforced inside AWF container

[Mossaka]

Bug

When a workflow sets timeout-minutes on the step that executes the Copilot CLI agent inside the AWF firewall container, the timeout is not enforced. The agent process continues running indefinitely past the configured timeout, until it hits the GitHub Actions 6-hour job timeout (or 72-hour workflow timeout).

Expected behavior

The agent step should be terminated after timeout-minutes expires, just like any other GitHub Actions step.

Actual behavior

The agent step ignores timeout-minutes and runs until the job-level or workflow-level timeout. This appears to be caused by signal delivery (SIGTERM/SIGKILL) not reaching the process inside the AWF Docker container.

Impact

Runaway agents consume expensive runner time with no way to cap execution duration at the step level. The only workaround is manually cancelling the workflow run.

Reproduction

1. Create a workflow with an agent step that has timeout-minutes: 10
2. Point it at a project with a very large build/test suite that will take longer than 10 minutes
3. Observe that the agent step runs well past 10 minutes without being killed

[Mossaka]

/plan research and validate if this bug is valid.

[github-actions]

✅ Plan Command completed successfully!

[lpcox]

🔗 AWF tracking issue: https://github.com/github/gh-aw-firewall/issues/github/gh-aw-firewall#1590

Generated by Firewall Issue Dispatcher · ◷

Generated by Firewall Issue Dispatcher · ◷