Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

[cao-evolution:compiler-security] Fix undefined workflow input references in shared control import

Abierto
  • ¿Algo no está bien?
#19,583 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
35/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
github-actions, javascript, yaml
Área
ci-cd, security

Línea de trabajo

Start with .github/workflows/shared/control.md at the inputs.target_repos reference and inspect the imported workflow inputs, including daily-repo-status.lock.yml as an example of affected workflows. Use the gh-aw MCP server's fix and compile tools with strict validation and the listed security checks; do not edit generated lock files. Done means the target-owned undefined input errors are resolved without widening control-plane authority or changing default review-mode behavior.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

cao-evolution cao-evolution:compiler-security

githubnext/gh-cao compiled 73 workflows (73 locks) with exit code 1. Actionlint reports 133 expression errors; 124 come from one editable source line, inputs.target_repos in .github/workflows/shared/control.md, where workflows that don't declare that input reference it. Grant failed with 1283 container-image license findings. These come from compiler-selected upstream images, so they are context only. Highest target-owned severity: actionlint error (tool-reported). Unavailable evidence: none. Grant policy is available.

Action: Assign this issue to Copilot using Agent prompt below; review its pull request and merge only after rerunning the full compiler and security scan confirms that the target-owned actionable findings are resolved.

<b>Failure details</b>
  • Target repository: githubnext/gh-cao
  • Compiler exit code: 1
  • Workflow sources checked: 73
  • Generated lock files checked: 73
  • Result: findings
  • Grant license-policy evidence: available
  • Target-owned actionable findings: 1
  • Upstream-owned context findings: 5 groups
Tool Workflow or image Owner Ownership Severity Finding Target remediation
actionlint shared/control.md lines 225 and 303, imported by all *.lock.yml (124 findings) githubnext/gh-cao target-owned actionable error property "target_repos" is not defined in the workflow_dispatch/call inputs object type Declare the target_repos input where needed, or guard or remove the reference in the shared source.
actionlint daily-repo-status.lock.yml (lines 2117-2206, 6 findings) githubnext/gh-cao target-owned actionable (same root cause: control inputs central_repo, control_plane_run_url, correlation_id, target_repos not declared) error Undefined input properties Declare the inputs or adjust the control import for this workflow.
actionlint/shellcheck 62 generated .lock.yml gh-aw compiler (github/gh-aw) upstream-owned context error SC2129 style at the compiler-generated step None. Route to gh-aw.
grype gh-aw-mcpg v0.4.35, firewall images, gh-aw-node, github-mcp-server, alpine, node (about 132 High, 18 Critical) gh-aw / image publishers upstream-owned context High/Critical Go stdlib, npm and OS package CVEs None. Route to the image publishers.
grant 9 compiler-selected images image publishers upstream-owned context unknown 1283 license findings None.
runner-guard agentic_commands.yml gh-aw generated (header gh-aw-commands) upstream-owned context medium RGS-005 write permissions on untrusted trigger None unless target-controlled.

zizmor findings were Low or Medium advisory (overprovisioned-secrets, secrets-outside-env, artipacked). They are generated-lock patterns and not separately actionable here.

<b>Agent prompt</b>
  1. Assign this issue to Copilot.
  2. Configure its MCP client to launch gh aw mcp-server over stdio from the target repository, then give it the prompt below. Require the server's fix and compile tools; never allow direct edits to generated .lock.yml files.
  3. Review the resulting pull request and rerun the same full compiler and security scan before merge. Require the target-owned actionable findings to be resolved; separately retained upstream-owned or unavailable evidence does not authorize target changes. If a target-owned finding needs human action, require the agent to stop and explain it.

Agent prompt

Fix only the target-owned actionable gh-aw compiler and security findings identified in this issue. Change only .github/workflows/*.md sources and directly related target-owned files; never edit generated .lock.yml files. Use the gh-aw MCP server's fix and compile tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until the target-owned findings are resolved. Review generated lock-file diffs and preserve existing behavior. Do not add or change .grant.yaml unless a separately reviewed target license-policy decision already requires it. Do not rebuild, modify, or make dependency decisions for upstream images or components; leave upstream-owned context unchanged and stop with a concise ownership explanation if the remaining finding cannot be fixed safely in this repository. Specifically, resolve the actionlint errors for undefined inputs.target_repos, central_repo, control_plane_run_url and correlation_id references that originate in .github/workflows/shared/control.md and affect the workflows that import it, without widening any control-plane authority or changing default review-mode behavior.

<b>Raw evidence</b>
  • Actionlint summary: 195 errors (133 expression, 62 shellcheck).
  • Example: .github/workflows/cao-evolution-compiler-security.lock.yml:2181:40: error: [expression] property "target_repos" is not defined in object type {aw_context, batch_label, central_repo, control_plane_run_url, correlation_id, max_repos, rollout_percent, safe_output_mode, safe_output_repo, target_repo} at CAO_TARGET_REPOSITORIES: ${{ inputs.target_repos || '' }}.
  • Git status after compile: M .github/aw/actions-lock.json (+5 lines), ?? .poutine.yml.
  • Outdated actions: upload-artifact v7.0.1, download-artifact v8.0.1, setup-go v5.0.2.
  • Grant: 1283 license findings in 9 images. Syft scanned 9 images successfully.
Control plane context

Generated by 🛡️ CAO Evolution / AW Compiler Security · copilot · auto · 32.5 AIC · ⌖ 0.827 AIC · ⊞ 17K · ◷

  • expires on Nov 5, 2026, 9:20 PM UTC
Lenguaje dominante
JavaScript
Estrellas
8
Forks
5
Merge medio
2 h 16 min
PR fusionados (30 d)
857

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de githubnext/gh-cao

Todos los issues de githubnext/gh-cao

Issues similares

Más issues de JavaScript

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.