Hacktoberfest 2026：メンテナが10月に向けて印を付けた、オープンで初心者向けの issue。 Hacktoberfest の issue を見る

[integrity-audit] Integrity Filtering Audit — 2026-10-15

オープン
  • 何か問題がありますか？
#14,937 コメント 0 件 リアクション 0 件 担当者 0 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

まだ誰も着手していません。

評価

難易度
3/5
見積もり時間
半日
初心者へのやさしさ
15/100
issue の種類
バグ
明瞭さ
説明が足りない
活発さ
活発
技術スタック
github-actions, go, wasm
領域
devops, security

調査の方向性

The only concrete problem is the warning that the WASM compile cache at /tmp/gh-aw/wazero-cache failed with permission denied and fell back to in-memory compilation, which is logged during guard startup. The audit's own recommendations (fix the runner's cache directory permissions, or make the DIFC logs downloadable) are operational, not code changes, and need repository and runner access. A newcomer would have to confirm the desired outcome with maintainers before starting.

索引モデルが issue の本文から書いたものです。

説明

automation integrity-audit
Integrity Filtering Audit — github/gh-aw-mcpg

Audit period: Last 24 hours (sampled from the newest 30 completed runs, all from 05:33–05:54 UTC)
Runs analyzed: 30 listed; 1 agent job log inspected in depth (Issue Monster, run 38688320210)
Runs with artifacts: Artifact listings reviewed for 2 runs; artifact contents could not be downloaded (see Limitations)

Findings Summary
Severity Count Description
🔴 Critical 0 No data leaks or guard bypass observed
🟡 Warning 1 wazero-cache directory creation permission denied (in-memory fallback)
🟢 Info 3 Limited audit depth; many skipped runs; unrelated CI failures
Critical Findings

None observed in the inspected log.

Warnings

W-A: WASM compilation cache fallback (Issue Monster run 38688320210, agent job 116268604043)
[WARN] [startup] Falling back to in-memory WASM compilation cache after "/tmp/gh-aw/wazero-cache" failed: ... permission denied. Not a DIFC failure, but guard startup does a full WASM compile each time. Check directory ownership/permissions for the cache dir in the workflow runner.

Direct API bypass (W-1): none detected. The only api.github.com references in the agent job log are gateway/proxy-internal (Resolved GitHub API URL, githubhttp:client GET /repos/github/gh-aw for sink visibility verification). No chatgpt.com/openai.com references and no firewall block/deny entries.

Informational
  • Issue Monster agent job: guard registered for safeoutputs (write-sink, sink-visibility=public; runtime verification passed: configured=public, actual=public). GitHub proxy started with difcMode=filter and allow-only policy min-integrity=approved. ~159 DIFC-related log lines; no wasm error:, WASM guard trap, guard not initialized, unknown REST endpoint, or Phase ... failed entries. Agent started with empty secrecy/integrity tags as expected.
  • forcePublicRepos: GITHUB_REPOSITORY not set — skipping logged in the proxy stage (informational; policy was supplied explicitly).
  • Of 30 runs, 7 were skipped (Agentic Workqueue, AI Moderator, Squad, Q, Squad implement x2) and 5 failed (CJS, PR Code Quality Reviewer, Doc Build - Deploy x2, CGO x2, CWI) — these are CI/PR workflows; not assessed for DIFC.
  • Agentic runs observed as successful: Daily VulnHunter Scan (38688480314), Daily Safe Outputs Conformance Checker, Issue Monster, Daily PR Code Quality Review, Failure Investigator (6h), PR Sous Chef, Daily Trajectory Grader Implementer.
Runs Analyzed
Run Workflow Branch Agent Invoked DIFC Events Firewall Blocks Status
38688320210 Issue Monster main ✅ ~159 log lines (job log) 0 ⚠️ (cache warning)
38688480314 Daily VulnHunter Scan main ✅ (artifacts listed only) not inspected not inspected ✅
38688391715 Daily Safe Outputs Conformance Checker main ✅ not inspected not inspected ✅
Others see Info — — not inspected not inspected —
Limitations

gh is unauthenticated in this sandbox and the GitHub MCP tools expose artifact listings but not downloads of rpc-messages.jsonl; only the tail (last 1500 lines) of a single agent job log was analyzed. Per-run tag-scoping (approved:owner/repo) and filtered-count ratios could not be verified. The step-summary table was not produced.

Recommendations
  1. Make rpc-messages.jsonl / mcp-gateway.log available to the audit (e.g. a job-summary DIFC digest or a download-capable token) so tag scoping and filter ratios can be verified.
  2. Fix /tmp/gh-aw/wazero-cache permissions in the runner to restore the disk-backed WASM compile cache.
  3. No W-1 workflows to investigate; for reference, reusable routing constraint language lives in shared/mcp-api-routing.md.

Generated by Integrity Filtering Audit · copilot · auto · 39.5 AIC · ⊞ 13.3K · ◷

  • expires on Oct 22, 2026, 5:58 AM UTC
主要言語
Go
スター
181
フォーク
53
平均マージ
7時間 27分
マージ済み PR（30日）
204

環境構築

Codespaces で開く

このプロジェクトの開発コンテナを、あなたの GitHub アカウントでブラウザ上に起動します。

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

github/gh-aw-mcpg のほかの issue

github/gh-aw-mcpg の issue をすべて見る

似ている issue

Go の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。