[side-quest] feat: side quest — ephemeral and JIT runners, proxy and network isolation

[github-actions]

Caution

Protected files were modified in this change.
This pull request is in request_review mode and requires explicit human scrutiny before merge.

Protected files: README.md

What this PR does

Source file mined: workshop/24-self-hosted-runners.md

Side quest extracted: The <details> block titled "Advanced: ephemeral and isolated runners" — a focused primer on ephemeral runners, just-in-time (JIT) runners, proxy environment variables, and network isolation requirements for agentic workflows.

Changes

• New file: workshop/side-quest-24-01-ephemeral-jit-runners.md — Self-contained side quest covering ephemeral runners, JIT runners, proxy configuration, and network isolation. Includes a checkpoint and a return link to Step 24.
• Updated: workshop/24-self-hosted-runners.md — Replaced the collapsed <details> block with a concise TIP callout linking to the new side quest. The main path is unchanged.
• Updated: workshop/README.md — New side quest listed in the Optional Side Quests section, noting it branches from Step 24.

Routing for learners

Learners on the main path see a short tip in Step 24 pointing to the side quest. Learners who need proxy or ephemeral runner guidance follow the link and return to Step 24 via the return link at the bottom of the side quest.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by 🗺️ Side Quest · 92 AIC · ⌖ 6.76 AIC · ⊞ 5.2K · ◷

• expires on Jul 22, 2026, 2:31 PM UTC

---

Note

This was originally intended as a pull request, but the git push operation failed.

Original error: pushSignedCommits: refusing unsigned push for branch 'side-quest-24-ephemeral-jit-runners-ff29321c0c8d3077': Signed-commit payload violates file-protection policy (request_review): workshop/README.md

Workflow Run: View run details and download bundle artifact

The bundle file is available in the agent artifact in the workflow run linked above.

To create a pull request with the changes:

# Download the artifact from the workflow run
gh run download 29838557525 -n agent -D /tmp/agent-29838557525

# Fetch the bundle into a temporary ref, then update the local branch
git fetch /tmp/agent-29838557525/aw-side-quest-24-ephemeral-jit-runners.bundle refs/heads/side-quest-24-ephemeral-jit-runners:refs/bundles/create-pr-side-quest-24-ephemeral-jit-runners-ff29321c0c8d3077-698a0658
git update-ref refs/heads/side-quest-24-ephemeral-jit-runners-ff29321c0c8d3077 refs/bundles/create-pr-side-quest-24-ephemeral-jit-runners-ff29321c0c8d3077-698a0658
git checkout side-quest-24-ephemeral-jit-runners-ff29321c0c8d3077
# Ensure the working tree matches the updated branch
git reset --hard
# Remove the temporary bundle ref
git update-ref -d refs/bundles/create-pr-side-quest-24-ephemeral-jit-runners-ff29321c0c8d3077-698a0658

# Push the branch to origin
git push origin side-quest-24-ephemeral-jit-runners-ff29321c0c8d3077

# Create the pull request
gh pr create --title '[side-quest] feat: side quest — ephemeral and JIT runners, proxy and network isolation' --base main --head side-quest-24-ephemeral-jit-runners-ff29321c0c8d3077 --repo githubnext/gh-aw-workshop