Repository navigation
Tags
Tags
Mitigate secret argv exposure and harden remote include write boundar… …ies (github#48318) * Initial plan * Fix secret argv exposure and include write boundary checks Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> * docs(adr): add draft ADR-48318 for secret stdin delivery and include write boundaries * Fix --body - flag in secret set calls and fix ValidatePathWithinBase symlink ancestor bypass Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> * Thread ctx through uploadSecretToRepo, replace fetchIncludeFromSource global with parameter, add .. guard and nested traversal test Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
[eslint-miner] fix(eslint): extend require-fetch-try-catch to detect … …member-chained fetch calls (github#47967) * fix(eslint): extend require-fetch-try-catch to detect member-chained fetch calls Previously, isAwaitFetchCall only matched bare `await fetch(url)` expressions. Any method chain on the result (`await fetch(url).then(...)`, `.catch(...)`, `.json()`) had a MemberExpression callee and silently escaped detection. This change: - Adds getRootFetchCall() to walk call/member chains and identify fetch at the root - Adds chainHasRejectionHandler() to recognize .catch(handler) and two-arg .then() as satisfying the error-handling requirement (no flag emitted for those) - Updates the AwaitExpression visitor to use these new helpers - Adds test cases covering chained-fetch valid/invalid patterns Closes github#47950, relates to github#47932 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix(eslint): address review feedback on require-fetch-try-catch rule Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> * chore: merge main into fix branch Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> * style(eslint): apply prettier formatting to require-fetch-try-catch.ts Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> Co-authored-by: Peli de Halleux <pelikhan@users.noreply.github.com>
Pin docker/build-push-action to commit SHA (CodeQL alert github#625) (g… …ithub#47334) * Initial plan * fix: pin docker/build-push-action to commit SHA to resolve alert github#625 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> Co-authored-by: Peli de Halleux <pelikhan@users.noreply.github.com>
[aw] Reduce Daily VulnHunter Scan AI credit usage by switching to Son… …net model (github#47002) * Initial plan * Optimize Daily VulnHunter scan model cost Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
fix: propagate tools.startup-timeout to gateway.startupTimeout (preve… …nts safeoutputs eviction on slow runners) (github#46875) * Initial plan * fix: propagate tools.startup-timeout to gateway.startupTimeout to prevent safeoutputs timeout Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> * docs(adr): add draft ADR-46875 for always emitting gateway.startupTimeout Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
fix: populate SafeItemsCount in run_summary.json so audits report acc… …urate safe-output write counts (github#46360) * Initial plan * fix: populate SafeItemsCount in run_summary.json for accurate safe-output write metrics Three complementary fixes: 1. Add json:"safe_items_count,omitempty" tag to WorkflowRun.SafeItemsCount so it serializes with the snake_case key expected by downstream audit tools. 2. Add flattenSafeOutputsItemsArtifact() to move safe-output-items.jsonl and temporary-id-map.json from safe-outputs-items/ subdirectory to the run root where extractCreatedItemsFromManifest and loadResolvedTemporaryIDTargets look. 3. Persist healed SafeItemsCount back to run_summary.json after cache-hit backfill so downstream readers see the correct count without falling back to activity summary. Closes github#46268 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> * fix: use modern octal literal notation in test file (0o755, 0o644) Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> * docs(adr): add draft ADR-46360 for SafeItemsCount fix in run_summary.json --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Peli de Halleux <pelikhan@users.noreply.github.com>
fix: exclude job-output credential env vars from agent sandbox (--exc… …lude-env) (github#46076)
[aw] Decouple Process Safe Outputs client token from project-specific… … token (github#45999) * Initial plan * Fix safe-outputs handler step token precedence Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> * chore: outline plan for safe-output token pollution tests Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> * test: cover handler-manager token isolation across safe outputs Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> * fix: preserve project handler token isolation at runtime Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> * test: clarify project token handler assertions and mocks Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> * fix: restore global github state in project handler wrapper Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> * refactor: extract project github client rebinding helper Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> * refactor: centralize project handler github-token config key Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> * test: tighten safe-output handler token isolation coverage Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com> * test: avoid vacuous handler iteration assertions Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com> * chore: start CI failure triage Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> * fix cjs typecheck for handler manager global github binding Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> * test: align mentions config spy expectations with handler client arg Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com> Co-authored-by: Peli de Halleux <pelikhan@users.noreply.github.com>
PreviousNext