Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

[cao-evolution:compiler-security] Fix undefined workflow inputs in shared control step

Abierto
  • ¿Algo no está bien?
#19,600 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
34/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
github-actions, javascript
Área
ci-cd, security

Línea de trabajo

Start with .github/workflows/shared/control.md near lines 225 and 303, then inspect importing workflow sources to see which inputs they declare. Use the gh-aw MCP fix and compile tools with strict validation and actionlint; do not edit generated lock files. Done means actionlint no longer reports undeclared input references and the full compiler and security scan confirms the target-owned findings are resolved while behavior stays unchanged.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

cao-evolution cao-evolution:compiler-security

The full gh-aw compile and scanner run for githubnext/gh-cao (73 workflows, 73 lock files) exited 1 with findings. There is 1 target-owned actionable finding group: actionlint reports 124 [expression] errors because .github/workflows/shared/control.md reads inputs.target_repos, inputs.correlation_id, inputs.central_repo and inputs.control_plane_run_url. Some importing workflows do not declare those inputs. The highest-severity finding is that actionlint error. Several upstream-owned items are listed as context only. Grant policy evidence is available.

Action: Assign this issue to Copilot using Agent prompt below; review its pull request and merge only after rerunning the full compiler and security scan confirms that the target-owned actionable findings are resolved.

<b>Failure details</b>
  • Target repository: githubnext/gh-cao
  • Compiler exit code: 1
  • Workflow sources checked: 73
  • Generated lock files checked: 73
  • Result: findings
  • Grant license-policy evidence: available (.grant.yaml exists, but the grant run reported ✗ grant failed on upstream image licenses)
  • Target-owned actionable findings: 1
  • Upstream-owned context findings: 5 groups
Tool Workflow or image Owner Ownership Severity Finding Target remediation
actionlint 40+ *.lock.yml (e.g. cao-evolution.lock.yml, bug-bash.lock.yml, daily-repo-status.lock.yml), from .github/workflows/shared/control.md lines 225 and 303 githubnext/gh-cao target-owned actionable unknown (reported as error; 98+22+2+2 target_repos, 2 each for correlation_id, central_repo, control_plane_run_url) inputs.target_repos and other inputs.* are not defined in the object type of the workflow's declared inputs Make the shared control step reference only declared inputs. For example, declare the inputs in every importing workflow, or read them through github.event.inputs or an env fallback. Recompile.
actionlint/shellcheck 62 lock files gh-aw compiler (generated step) upstream-owned context unknown SC2129 style: use { cmd1; cmd2; } >> file None. Route to gh-aw.
actionlint self-care-dashboard-performance, self-care-pages-health, self-care-* (3 findings) gh-aw compiler / safe-outputs generation (ownership not confirmed) upstream-owned context unknown steps.safe-outputs-app-token is not defined in the step context None. Route to gh-aw.
grype ghcr.io/github/gh-aw-mcpg:v0.4.35 github/gh-aw-mcpg upstream-owned context Critical (GO-2026-6612), 13 High Go [email protected] vulnerabilities, fixed in 1.26.9 or later None. Route to gh-aw-mcpg.
grype/grant ghcr.io/github/gh-aw-firewall/*:0.28.62, ghcr.io/github/gh-aw-node github/gh-aw-firewall, gh-aw upstream-owned context various Image license-policy violations (hundreds of packages) None. Route to image publishers.
grype/syft/grant node:lts-alpine (pinned in .github/aw/actions-lock.json) Docker Node image publisher; compiler-selected upstream-owned context High (brace-expansion, ip-address, http-cache-semantics), Medium and Unknown OpenSSL and musl CVEs Vulnerable packages and license-policy violations in the base image None. The pin is generated by gh aw, not by an editable target source.

Other signals, with no remediation owned by the target: 926 zizmor overprovisioned-secrets and about 3,000 secrets-outside-env Medium warnings on generated lock files (gh-aw output); 51 zizmor artipacked Medium warnings; 1 runner-guard RGS-005 warning on .github/workflows/agentic_commands.yml; outdated action version notices; and an observed-model refresh that failed because gh was unauthenticated. The run wrote a diff to .github/aw/actions-lock.json (+5 lines) and created .poutine.yml.

<b>Agent prompt</b>
  1. Assign this issue to Copilot.
  2. Configure its MCP client to launch gh aw mcp-server over stdio from the target repository, then give it the prompt below. Require the server's fix and compile tools; never allow direct edits to generated .lock.yml files.
  3. Review the resulting pull request and rerun the same full compiler and security scan before merge. Require the target-owned actionable findings to be resolved; separately retained upstream-owned or unavailable evidence does not authorize target changes. If a target-owned finding needs human action, require the agent to stop and explain it.

Agent prompt

Fix only the target-owned actionable gh-aw compiler and security findings identified in this issue. Change only .github/workflows/*.md sources and directly related target-owned files; never edit generated .lock.yml files. Use the gh-aw MCP server's fix and compile tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until the target-owned findings are resolved. Review generated lock-file diffs and preserve existing behavior. Do not add or change .grant.yaml unless a separately reviewed target license-policy decision already requires it. Do not rebuild, modify, or make dependency decisions for upstream images or components; leave upstream-owned context unchanged and stop with a concise ownership explanation if the remaining finding cannot be fixed safely in this repository.

Specific target finding: in .github/workflows/shared/control.md (steps near lines 225 and 303), inputs.target_repos, inputs.correlation_id, inputs.central_repo and inputs.control_plane_run_url are referenced in workflows whose workflow_dispatch inputs do not declare them, which makes actionlint report [expression] property ... is not defined. Resolve this in the shared source without widening any policy or authority, and keep orchestrator, worker and standalone behavior unchanged.

<b>Raw evidence</b>
  • Target SHA: f3ff17a81968dfb3c49cbfba57a4aef85dc03bf5; report digest cf2deb8799b7e249f2c3c9b2bd7e325db09dcaae4d572cd60dfc8ef6409ac11c; scanComplete: true.
  • Compiler summary: ✓ Checked 73 workflow(s), ⚠ Found 195 issue(s) (195 error(s)), ✗ grant failed.
  • Sample: bug-bash-investigation.lock.yml:2188:40: error: [expression] property "target_repos" is not defined in object type {aw_context: string; batch_label: string; central_repo: string; control_plane_run_url: string; correlation_id: string; max_repos: number; rollout_percent: number; safe_output_mode: string; safe_output_repo: string; target_repo: string}.
  • Sample: ghcr.io/github/gh-aw-mcpg:v0.4.35:1:1: error: [Critical] GO-2026-6612: [email protected] (fix: 1.26.9).
  • Duplicate check: a search of open issues returned 2 items that integrity policy hid, so a matching open issue could not be ruled out.
Control plane context

Generated by 🛡️ CAO Evolution / AW Compiler Security · copilot · auto · 35.1 AIC · ⌖ 0.835 AIC · ⊞ 17K · ◷

  • expires on Nov 6, 2026, 12:21 AM UTC
Lenguaje dominante
JavaScript
Estrellas
8
Forks
5
Merge medio
2 h 17 min
PR fusionados (30 d)
855

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de githubnext/gh-cao

Todos los issues de githubnext/gh-cao

Issues similares

Más issues de JavaScript

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.