Hacktoberfest 2026：メンテナが10月に向けて印を付けた、オープンで初心者向けの issue。 Hacktoberfest の issue を見る

[cao-evolution:compiler-security] Fix undefined workflow inputs in shared control step

オープン
  • 何か問題がありますか？
#19,600 コメント 0 件 リアクション 0 件 担当者 0 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

まだ誰も着手していません。

評価

難易度
4/5
見積もり時間
3〜5日
初心者へのやさしさ
34/100
issue の種類
バグ
明瞭さ
明確に書かれている
活発さ
活発
技術スタック
github-actions, javascript
領域
ci-cd, security

調査の方向性

Start with .github/workflows/shared/control.md near lines 225 and 303, then inspect importing workflow sources to see which inputs they declare. Use the gh-aw MCP fix and compile tools with strict validation and actionlint; do not edit generated lock files. Done means actionlint no longer reports undeclared input references and the full compiler and security scan confirms the target-owned findings are resolved while behavior stays unchanged.

索引モデルが issue の本文から書いたものです。

説明

cao-evolution cao-evolution:compiler-security

The full gh-aw compile and scanner run for githubnext/gh-cao (73 workflows, 73 lock files) exited 1 with findings. There is 1 target-owned actionable finding group: actionlint reports 124 [expression] errors because .github/workflows/shared/control.md reads inputs.target_repos, inputs.correlation_id, inputs.central_repo and inputs.control_plane_run_url. Some importing workflows do not declare those inputs. The highest-severity finding is that actionlint error. Several upstream-owned items are listed as context only. Grant policy evidence is available.

Action: Assign this issue to Copilot using Agent prompt below; review its pull request and merge only after rerunning the full compiler and security scan confirms that the target-owned actionable findings are resolved.

<b>Failure details</b>
  • Target repository: githubnext/gh-cao
  • Compiler exit code: 1
  • Workflow sources checked: 73
  • Generated lock files checked: 73
  • Result: findings
  • Grant license-policy evidence: available (.grant.yaml exists, but the grant run reported ✗ grant failed on upstream image licenses)
  • Target-owned actionable findings: 1
  • Upstream-owned context findings: 5 groups
Tool Workflow or image Owner Ownership Severity Finding Target remediation
actionlint 40+ *.lock.yml (e.g. cao-evolution.lock.yml, bug-bash.lock.yml, daily-repo-status.lock.yml), from .github/workflows/shared/control.md lines 225 and 303 githubnext/gh-cao target-owned actionable unknown (reported as error; 98+22+2+2 target_repos, 2 each for correlation_id, central_repo, control_plane_run_url) inputs.target_repos and other inputs.* are not defined in the object type of the workflow's declared inputs Make the shared control step reference only declared inputs. For example, declare the inputs in every importing workflow, or read them through github.event.inputs or an env fallback. Recompile.
actionlint/shellcheck 62 lock files gh-aw compiler (generated step) upstream-owned context unknown SC2129 style: use { cmd1; cmd2; } >> file None. Route to gh-aw.
actionlint self-care-dashboard-performance, self-care-pages-health, self-care-* (3 findings) gh-aw compiler / safe-outputs generation (ownership not confirmed) upstream-owned context unknown steps.safe-outputs-app-token is not defined in the step context None. Route to gh-aw.
grype ghcr.io/github/gh-aw-mcpg:v0.4.35 github/gh-aw-mcpg upstream-owned context Critical (GO-2026-6612), 13 High Go [email protected] vulnerabilities, fixed in 1.26.9 or later None. Route to gh-aw-mcpg.
grype/grant ghcr.io/github/gh-aw-firewall/*:0.28.62, ghcr.io/github/gh-aw-node github/gh-aw-firewall, gh-aw upstream-owned context various Image license-policy violations (hundreds of packages) None. Route to image publishers.
grype/syft/grant node:lts-alpine (pinned in .github/aw/actions-lock.json) Docker Node image publisher; compiler-selected upstream-owned context High (brace-expansion, ip-address, http-cache-semantics), Medium and Unknown OpenSSL and musl CVEs Vulnerable packages and license-policy violations in the base image None. The pin is generated by gh aw, not by an editable target source.

Other signals, with no remediation owned by the target: 926 zizmor overprovisioned-secrets and about 3,000 secrets-outside-env Medium warnings on generated lock files (gh-aw output); 51 zizmor artipacked Medium warnings; 1 runner-guard RGS-005 warning on .github/workflows/agentic_commands.yml; outdated action version notices; and an observed-model refresh that failed because gh was unauthenticated. The run wrote a diff to .github/aw/actions-lock.json (+5 lines) and created .poutine.yml.

<b>Agent prompt</b>
  1. Assign this issue to Copilot.
  2. Configure its MCP client to launch gh aw mcp-server over stdio from the target repository, then give it the prompt below. Require the server's fix and compile tools; never allow direct edits to generated .lock.yml files.
  3. Review the resulting pull request and rerun the same full compiler and security scan before merge. Require the target-owned actionable findings to be resolved; separately retained upstream-owned or unavailable evidence does not authorize target changes. If a target-owned finding needs human action, require the agent to stop and explain it.

Agent prompt

Fix only the target-owned actionable gh-aw compiler and security findings identified in this issue. Change only .github/workflows/*.md sources and directly related target-owned files; never edit generated .lock.yml files. Use the gh-aw MCP server's fix and compile tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until the target-owned findings are resolved. Review generated lock-file diffs and preserve existing behavior. Do not add or change .grant.yaml unless a separately reviewed target license-policy decision already requires it. Do not rebuild, modify, or make dependency decisions for upstream images or components; leave upstream-owned context unchanged and stop with a concise ownership explanation if the remaining finding cannot be fixed safely in this repository.

Specific target finding: in .github/workflows/shared/control.md (steps near lines 225 and 303), inputs.target_repos, inputs.correlation_id, inputs.central_repo and inputs.control_plane_run_url are referenced in workflows whose workflow_dispatch inputs do not declare them, which makes actionlint report [expression] property ... is not defined. Resolve this in the shared source without widening any policy or authority, and keep orchestrator, worker and standalone behavior unchanged.

<b>Raw evidence</b>
  • Target SHA: f3ff17a81968dfb3c49cbfba57a4aef85dc03bf5; report digest cf2deb8799b7e249f2c3c9b2bd7e325db09dcaae4d572cd60dfc8ef6409ac11c; scanComplete: true.
  • Compiler summary: ✓ Checked 73 workflow(s), ⚠ Found 195 issue(s) (195 error(s)), ✗ grant failed.
  • Sample: bug-bash-investigation.lock.yml:2188:40: error: [expression] property "target_repos" is not defined in object type {aw_context: string; batch_label: string; central_repo: string; control_plane_run_url: string; correlation_id: string; max_repos: number; rollout_percent: number; safe_output_mode: string; safe_output_repo: string; target_repo: string}.
  • Sample: ghcr.io/github/gh-aw-mcpg:v0.4.35:1:1: error: [Critical] GO-2026-6612: [email protected] (fix: 1.26.9).
  • Duplicate check: a search of open issues returned 2 items that integrity policy hid, so a matching open issue could not be ruled out.
Control plane context

Generated by 🛡️ CAO Evolution / AW Compiler Security · copilot · auto · 35.1 AIC · ⌖ 0.835 AIC · ⊞ 17K · ◷

  • expires on Nov 6, 2026, 12:21 AM UTC
主要言語
JavaScript
スター
8
フォーク
5
平均マージ
2時間 28分
マージ済み PR（30日）
849

環境構築

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

githubnext/gh-cao のほかの issue

githubnext/gh-cao の issue をすべて見る

似ている issue

JavaScript の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。