ado-aw-debug reference

Dogfood pipelines only

Anything declared under ado-aw-debug: is not part of the regular agent surface and is not recommended for general use. These knobs exist so the team can validate githubnext/ado-aw changes against real Azure DevOps pipelines. Each knob bypasses or weakens a normal safety control.

The compiler accepts a top-level ado-aw-debug: block in agent front matter. Currently exposed knobs:

Knob	Purpose	Default
skip-integrity	Omit the “Verify pipeline integrity” step from the generated YAML. OR-ed with the --skip-integrity CLI flag.	false

Unrecognised keys under ado-aw-debug: cause a compile-time error (#[serde(deny_unknown_fields)]).

skip-integrity

Equivalent to passing --skip-integrity on the ado-aw compile CLI. Setting either OR setting both omits the Verify pipeline integrity step from the generated YAML.

The integrity step downloads the same ado-aw binary the pipeline was compiled with and runs ado-aw check against the committed pipeline file. Without it, a tampered *.yml won’t be caught at run time.

Use this only for short-lived dogfood pipelines where you’re iterating on the compiler and re-compiling frequently.

Example:

ado-aw-debug:
  skip-integrity: true

Retired: ado-aw-debug.create-issue

GitHub issue filing used to be a debug-only tool under ado-aw-debug:. It is now a regular, configured-only safe output named create-github-issue — deliberately distinct from the Azure DevOps create-work-item output:

safe-outputs:
  create-github-issue:
    target-repo: githubnext/ado-aw

A front-matter codemod (promote_debug_create_github_issue) migrates legacy ado-aw-debug.create-issue: configuration to safe-outputs.create-github-issue: automatically on the next compile. When the workflow has no explicit SafeOutputs GitHub auth, the codemod also adds github-token: "$(ADO_AW_DEBUG_GITHUB_TOKEN)" so the existing pipeline secret keeps working; new workflows should use the ADO_AW_GITHUB_TOKEN default or GitHub App auth instead.

The GitHub write credential is only ever read by Stage 3, after threat detection — it is never exposed to the agent or the detection engine.

See also

• Safe Outputs — regular safe-outputs surface, including create-github-issue and set-github-issue-type.
• CLI Commands — --skip-integrity CLI flag.
• Codemods — automatic front-matter migrations.
• Pipeline IR — typed pipeline IR and how debug-only choices such as integrity-check omission are represented in generated steps.