[cao-evolution:compiler-security] Resolve target-owned gh-aw compiler and runner-guard findings

Abierto
  • ¿Algo no está bien?
#20,025 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
15/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
github-actions, shell
Área
ci-cd, security

Línea de trabajo

Read .github/workflows/shared/control.md lines ~213, ~318, ~553-555 to fix SC2129 and undefined inputs.* refs. Edit daily-repo-status.md and verify cgo.yml:123 and session-archive.yml:60 runner-guard flags. Use gh-aw MCP fix/compile tools; never edit .lock.yml. Done when recompile reports zero target-owned findings.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

cao-evolution cao-evolution:compiler-security

The full gh-aw compile and security scan of githubnext/gh-cao (76 workflow sources, 76 lock files) exited 1 with result findings. Target-owned actionable findings: 3 groups (actionlint shellcheck SC2129 and inputs.* expression errors, both in shared/control.md, and runner-guard RGS-006/RGS-018 on two non-agentic workflows). Upstream-owned context: 4 groups, with no target remediation. Unavailable evidence: none (Grant policy is available). Highest-severity target-owned finding: runner-guard high (RGS-006/RGS-018 in cgo.yml and session-archive.yml, where the remote download is already sha256-verified, so these may be false positives that need an explicit suppression or restructure). Recommended action: fix the shared/control.md sources, then recompile.

Action: Assign this issue to Copilot using Agent prompt below; review its pull request and merge only after rerunning the full compiler and security scan confirms that the target-owned actionable findings are resolved.

Failure details
  • Target repository: githubnext/gh-cao
  • Compiler exit code: 1
  • Workflow sources checked: 76
  • Generated lock files checked: 76
  • Result: findings
  • Grant license-policy evidence: available
  • Target-owned actionable findings: 3
  • Upstream-owned context findings: 4
Tool Workflow / image Owner Ownership Severity Finding Target remediation
actionlint (shellcheck) all 64 *.lock.yml, e.g. cao-evolution-compiler-security.lock.yml:519 githubnext/gh-cao (.github/workflows/shared/control.md) target-owned actionable error (SC2129 style) Consecutive >> "$GITHUB_OUTPUT" redirects (control.md lines ~553-555) Group the three echo writes in one { ...; } >> "$GITHUB_OUTPUT" block in shared/control.md; recompile.
actionlint (expression) 128 hits: inputs.target_repos (e.g. bug-bash.lock.yml:1781); 6 hits in daily-repo-status.lock.yml for central_repo, control_plane_run_url, correlation_id githubnext/gh-cao (shared/control.md lines ~213, ~318; daily-repo-status.md) target-owned actionable error Property not defined in the workflow's inputs type, because worker and some workflows do not declare target_repos or the correlation inputs Make the ${{ inputs.* }} references conditional on the declared inputs, or declare the inputs in the importing workflows; recompile.
runner-guard .github/workflows/cgo.yml:123, .github/workflows/session-archive.yml:60 githubnext/gh-cao target-owned actionable high (RGS-006 curl-pipe-bash, RGS-018 payload pattern) Both steps curl a pinned release artifact and verify it with sha256sum --check before use (no pipe to a shell) Confirm pattern is a false positive; restructure (separate download/verify/extract steps) or add a reviewed runner-guard suppression.
grant, grype/syft ghcr.io/github/gh-aw-firewall/{api-proxy,cli-proxy,squid}:0.29.0 github/gh-aw-firewall upstream-owned context Critical (e.g. CVE-2026-111497 brotli-libs, CVE-2026-87866/86411/94265 curl) Compiler-selected firewall images; Grant reported 1291 license findings in container images None. Route to github/gh-aw-firewall.
zizmor all lock files github/gh-aw compiler upstream-owned context Medium/Low (secrets-outside-env 4662, overprovisioned-secrets 960, artipacked 54, template-injection 48, undocumented-permissions 451, obfuscation 1173) Compiler-generated lock-file patterns None. Route to github/gh-aw.
compiler outdated actions actions/[email protected], [email protected], [email protected] github/gh-aw upstream-owned context warning Compiler-pinned action versions None.
poutine / others .poutine.yml untracked, actions-lock.json +5 lines written by the scan n/a upstream-owned context unknown Scan side effects, not findings None.
Agent prompt
  1. Assign this issue to Copilot.
  2. Configure its MCP client to launch gh aw mcp-server over stdio from the target repository, then give it the prompt below. Require the server's fix and compile tools; never allow direct edits to generated .lock.yml files.
  3. Review the resulting pull request and rerun the same full compiler and security scan before merge. Require the target-owned actionable findings to be resolved; separately retained upstream-owned or unavailable evidence does not authorize target changes. If a target-owned finding needs human action, require the agent to stop and explain it.

Agent prompt

Fix only the target-owned actionable gh-aw compiler and security findings identified in this issue. Change only .github/workflows/*.md sources and directly related target-owned files; never edit generated .lock.yml files. Use the gh-aw MCP server's fix and compile tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until the target-owned findings are resolved. Review generated lock-file diffs and preserve existing behavior. Do not add or change .grant.yaml unless a separately reviewed target license-policy decision already requires it. Do not rebuild, modify, or make dependency decisions for upstream images or components; leave upstream-owned context unchanged and stop with a concise ownership explanation if the remaining finding cannot be fixed safely in this repository.

Targets: (1) in .github/workflows/shared/control.md combine the consecutive >> "$GITHUB_OUTPUT" writes (SC2129) and make inputs.target_repos references valid for workers that do not declare it; (2) fix the daily-repo-status.md undefined inputs.central_repo, control_plane_run_url, correlation_id references; (3) resolve or justify runner-guard RGS-006/RGS-018 in .github/workflows/cgo.yml and .github/workflows/session-archive.yml without weakening the sha256 verification.

Raw evidence

Actionlint summary: 76 workflows checked, 201 errors (shellcheck 64, expression 137). Runner-guard reported 3 high errors (cgo.yml:123 RGS-006 and RGS-018, session-archive.yml:60 RGS-018). Grant strict mode: 1291 license policy findings in container images. Image CVEs: 35 Critical, 140 High reported across firewall images. Diff stat: .github/aw/actions-lock.json | 5 +++++; untracked .poutine.yml. Target SHA 62b29686c16eb2ab31744a21ee1ebe2d18687e00.

Control plane context

Generated by 🛡️ CAO Evolution / AW Compiler Security · copilot · auto · ~37 AIC · ⌖ ~1 AIC · ⊞ 6.9K · ◷

  • expires on Nov 14, 2026, 8:19 AM UTC
Lenguaje dominante
JavaScript
Estrellas
14
Forks
5
Merge medio
3 h 29 min
PR fusionados (30 d)
761

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de githubnext/gh-cao

Todos los issues de githubnext/gh-cao

Issues similares

Más issues de JavaScript

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.