fix: remove shell quoting (@Q) from gateway-api-key step output

[Copilot]

MCP gateway /close teardown fails with Authentication failed: invalid API key because ${MCP_GATEWAY_API_KEY@Q} writes a shell-quoted value (e.g., 'abc123') to GITHUB_OUTPUT. stop_mcp_gateway.sh then sends that quoted string verbatim as the Authorization header, which doesn't match the actual key.

Change

• actions/setup/sh/start_mcp_gateway.sh: Remove @Q from the gateway-api-key output so the raw key is written to GITHUB_OUTPUT.

# Before — writes 'abc123' (with quotes) to GITHUB_OUTPUT
echo "gateway-api-key=${MCP_GATEWAY_API_KEY@Q}"

# After — writes abc123
echo "gateway-api-key=${MCP_GATEWAY_API_KEY}"

@Q is appropriate when a value will be re-evaluated by a shell; writing to GITHUB_OUTPUT requires the raw value.

Original prompt

---

This section details on the original issue you should resolve

<issue_title>MCP gateway /close teardown fails with invalid API key (gateway-api-key output quoted)</issue_title>
<issue_description>## Summary
gh aw Codex workflows can fail during teardown when calling MCP gateway /close with:

Authentication failed: invalid API key, path=/close

This causes the main agent step to fail and can skip downstream safe-output processing.

Observed Runs

From aaronspindler/aaronspindler.com:

• https://github.com/aaronspindler/aaronspindler.com/actions/runs/22464734422?target=https://github.com
• https://github.com/aaronspindler/aaronspindler.com/actions/runs/22469650280?target=https://github.com
• https://github.com/aaronspindler/aaronspindler.com/actions/runs/22469711399?target=https://github.com

All three fail at the end of Execute Codex / teardown, with /close auth failure.

Likely Cause

In actions/setup/sh/start_mcp_gateway.sh, gateway API key output is written with shell quoting:

echo "gateway-api-key=${MCP_GATEWAY_API_KEY@Q}"

Later, stop_mcp_gateway.sh uses the output directly as Authorization header:

-H "Authorization: ${MCP_GATEWAY_API_KEY}"

If the output includes shell quotes, /close sees a mismatched key and returns invalid API key.

Workaround (local)

We mitigated by patching start_mcp_gateway.sh in a pre-agent custom step to remove @Q from the emitted output.

Expected

stop_mcp_gateway.sh should authenticate successfully against /close with the key emitted by start_mcp_gateway.sh without requiring local patching.

Environment

• gh aw CLI: v0.50.5 and v0.50.6
• Engine: codex
  </issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes MCP gateway /close teardown fails with invalid API key (gateway-api-key output quoted) #18714

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.