Repository navigation
Use default integrity filtering for smoke GitHub reads - #1282
Merged
Merged
Conversation
Contributor
There was a problem hiding this comment.
🔵 Needs a closer look
Security-sensitive workflow changes require maintainer verification, and digest publication sizing remains unresolved.
1 open finding
What changed in this PR
Moves public GitHub metadata handling outside workflow agents to reduce prompt-injection exposure in the digest and detector smoke workflows.
Changes:
- Replace the agent-driven digest with deterministic API publication and cached recovery.
- Validate smoke metadata on the host, disable agent GitHub tools, and regenerate locks.
- Add offline tests and document the metadata boundaries.
| File | Description |
|---|---|
| scripts/test/issue-digest-test.sh | Run offline digest tests. |
| scripts/test/issue-digest-test.py | Cover publication, recovery, and escaping. |
| scripts/test/check-smoke-github-metadata-test.sh | Test fixed boolean output. |
| scripts/issue-digest.py | Collect, escape, and publish digest metadata. |
| scripts/check-smoke-github-metadata.sh | Validate PR numbers outside agents. |
| README.md | Document isolation and digest behavior. |
| .github/workflows/smoke-copilot-standalone.md | Move metadata checks outside Copilot. |
| .github/workflows/smoke-copilot-standalone.lock.yml | Regenerate Copilot workflow. |
| .github/workflows/smoke-codex-standalone.md | Move metadata checks outside Codex. |
| .github/workflows/smoke-codex-standalone.lock.yml | Regenerate Codex workflow. |
| .github/workflows/smoke-claude-standalone.md | Move metadata checks outside Claude. |
| .github/workflows/smoke-claude-standalone.lock.yml | Regenerate Claude workflow. |
| .github/workflows/gh-aw-issue-digest.yml | Schedule deterministic publication and state persistence. |
| .github/workflows/gh-aw-issue-digest.md | Remove the agent-driven digest definition. |
🧠 Review effort: Max
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+96
to
+111
| for item in issues: | ||
| number = item["number"] | ||
| labels = [escaped(label) for label in item["labels"] if label != "threat-detection"] | ||
| suffix = f", labels: {', '.join(labels)}" if labels else "" | ||
| lines.append( | ||
| f"- [#{number}](https://github.com/{UPSTREAM}/issues/{number}) — " | ||
| f"{escaped(item['title'])} — {item['state']}, opened {item['created']} " | ||
| f"by @{escaped(item['author'])}{suffix}" | ||
| ) | ||
| lines.extend([ | ||
| "", "## Why this matters", "", | ||
| "This repository ships the threat-detect binary consumed by gh-aw; these issues may require follow-up here.", | ||
| "", f"Scanned: {run_url}", "", | ||
| "<!-- gh-aw-issue-digest:v1 numbers=" + ",".join(str(item["number"]) for item in issues) + " -->", | ||
| ]) | ||
| return "\n".join(lines) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Use
min-integrity: approved, the public-repository default, for GitHub reads in all three standalone smoke workflows. Keep GitHub tools,gh-proxymode, the repository allowlist, and the existing PR metadata smoke requirements unchanged. Recompile the locks with gh-aw v0.92.0.defaultis not a supported literal policy value. The pinned gateway v0.4.31 assigns approved integrity to collaborator-authored PRs and direct PRs whose head and base repositories match. The recent repository PRs, including the Dependabot PRs, meet those rules. See the pinned integrity specification.The issue digest remains an agentic workflow with its existing scoped
min-integrity: none, since it must inventory issues from unaffiliated authors. The proposed deterministic digest, host smoke checks, tests, and documentation changes have all been reverted; there is no net digest or script change.Validation:
make fmt lint build testpassed. All seven agentic workflows compiled successfully; only the unchanged statistics concurrency warning remains. Hosted smoke behavior has not yet been exercised with this policy.