[cao-evolution:compiler-security] Resolve target-owned gh-aw compiler and runner-guard findings

Aperta
  • Qualcosa non va?
#20,025 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
15/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
github-actions, shell
Ambito
ci-cd, security

Direzione di ricerca

Read .github/workflows/shared/control.md lines ~213, ~318, ~553-555 to fix SC2129 and undefined inputs.* refs. Edit daily-repo-status.md and verify cgo.yml:123 and session-archive.yml:60 runner-guard flags. Use gh-aw MCP fix/compile tools; never edit .lock.yml. Done when recompile reports zero target-owned findings.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

cao-evolution cao-evolution:compiler-security

The full gh-aw compile and security scan of githubnext/gh-cao (76 workflow sources, 76 lock files) exited 1 with result findings. Target-owned actionable findings: 3 groups (actionlint shellcheck SC2129 and inputs.* expression errors, both in shared/control.md, and runner-guard RGS-006/RGS-018 on two non-agentic workflows). Upstream-owned context: 4 groups, with no target remediation. Unavailable evidence: none (Grant policy is available). Highest-severity target-owned finding: runner-guard high (RGS-006/RGS-018 in cgo.yml and session-archive.yml, where the remote download is already sha256-verified, so these may be false positives that need an explicit suppression or restructure). Recommended action: fix the shared/control.md sources, then recompile.

Action: Assign this issue to Copilot using Agent prompt below; review its pull request and merge only after rerunning the full compiler and security scan confirms that the target-owned actionable findings are resolved.

Failure details
  • Target repository: githubnext/gh-cao
  • Compiler exit code: 1
  • Workflow sources checked: 76
  • Generated lock files checked: 76
  • Result: findings
  • Grant license-policy evidence: available
  • Target-owned actionable findings: 3
  • Upstream-owned context findings: 4
Tool Workflow / image Owner Ownership Severity Finding Target remediation
actionlint (shellcheck) all 64 *.lock.yml, e.g. cao-evolution-compiler-security.lock.yml:519 githubnext/gh-cao (.github/workflows/shared/control.md) target-owned actionable error (SC2129 style) Consecutive >> "$GITHUB_OUTPUT" redirects (control.md lines ~553-555) Group the three echo writes in one { ...; } >> "$GITHUB_OUTPUT" block in shared/control.md; recompile.
actionlint (expression) 128 hits: inputs.target_repos (e.g. bug-bash.lock.yml:1781); 6 hits in daily-repo-status.lock.yml for central_repo, control_plane_run_url, correlation_id githubnext/gh-cao (shared/control.md lines ~213, ~318; daily-repo-status.md) target-owned actionable error Property not defined in the workflow's inputs type, because worker and some workflows do not declare target_repos or the correlation inputs Make the ${{ inputs.* }} references conditional on the declared inputs, or declare the inputs in the importing workflows; recompile.
runner-guard .github/workflows/cgo.yml:123, .github/workflows/session-archive.yml:60 githubnext/gh-cao target-owned actionable high (RGS-006 curl-pipe-bash, RGS-018 payload pattern) Both steps curl a pinned release artifact and verify it with sha256sum --check before use (no pipe to a shell) Confirm pattern is a false positive; restructure (separate download/verify/extract steps) or add a reviewed runner-guard suppression.
grant, grype/syft ghcr.io/github/gh-aw-firewall/{api-proxy,cli-proxy,squid}:0.29.0 github/gh-aw-firewall upstream-owned context Critical (e.g. CVE-2026-111497 brotli-libs, CVE-2026-87866/86411/94265 curl) Compiler-selected firewall images; Grant reported 1291 license findings in container images None. Route to github/gh-aw-firewall.
zizmor all lock files github/gh-aw compiler upstream-owned context Medium/Low (secrets-outside-env 4662, overprovisioned-secrets 960, artipacked 54, template-injection 48, undocumented-permissions 451, obfuscation 1173) Compiler-generated lock-file patterns None. Route to github/gh-aw.
compiler outdated actions actions/[email protected], [email protected], [email protected] github/gh-aw upstream-owned context warning Compiler-pinned action versions None.
poutine / others .poutine.yml untracked, actions-lock.json +5 lines written by the scan n/a upstream-owned context unknown Scan side effects, not findings None.
Agent prompt
  1. Assign this issue to Copilot.
  2. Configure its MCP client to launch gh aw mcp-server over stdio from the target repository, then give it the prompt below. Require the server's fix and compile tools; never allow direct edits to generated .lock.yml files.
  3. Review the resulting pull request and rerun the same full compiler and security scan before merge. Require the target-owned actionable findings to be resolved; separately retained upstream-owned or unavailable evidence does not authorize target changes. If a target-owned finding needs human action, require the agent to stop and explain it.

Agent prompt

Fix only the target-owned actionable gh-aw compiler and security findings identified in this issue. Change only .github/workflows/*.md sources and directly related target-owned files; never edit generated .lock.yml files. Use the gh-aw MCP server's fix and compile tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until the target-owned findings are resolved. Review generated lock-file diffs and preserve existing behavior. Do not add or change .grant.yaml unless a separately reviewed target license-policy decision already requires it. Do not rebuild, modify, or make dependency decisions for upstream images or components; leave upstream-owned context unchanged and stop with a concise ownership explanation if the remaining finding cannot be fixed safely in this repository.

Targets: (1) in .github/workflows/shared/control.md combine the consecutive >> "$GITHUB_OUTPUT" writes (SC2129) and make inputs.target_repos references valid for workers that do not declare it; (2) fix the daily-repo-status.md undefined inputs.central_repo, control_plane_run_url, correlation_id references; (3) resolve or justify runner-guard RGS-006/RGS-018 in .github/workflows/cgo.yml and .github/workflows/session-archive.yml without weakening the sha256 verification.

Raw evidence

Actionlint summary: 76 workflows checked, 201 errors (shellcheck 64, expression 137). Runner-guard reported 3 high errors (cgo.yml:123 RGS-006 and RGS-018, session-archive.yml:60 RGS-018). Grant strict mode: 1291 license policy findings in container images. Image CVEs: 35 Critical, 140 High reported across firewall images. Diff stat: .github/aw/actions-lock.json | 5 +++++; untracked .poutine.yml. Target SHA 62b29686c16eb2ab31744a21ee1ebe2d18687e00.

Control plane context

Generated by 🛡️ CAO Evolution / AW Compiler Security · copilot · auto · ~37 AIC · ⌖ ~1 AIC · ⊞ 6.9K · ◷

  • expires on Nov 14, 2026, 8:19 AM UTC
Lingua principale
JavaScript
Stelle
14
Fork
5
Merge medio
3h 24m
PR unite (30g)
796

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di githubnext/gh-cao

Tutte le issue di githubnext/gh-cao

Issue simili

Altre issue su JavaScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.