fix: add poutine:ignore untrusted_checkout_exec to all compiler bash run steps#48717
Conversation
Add `# poutine:ignore untrusted_checkout_exec` comment immediately above
every `run: bash "${RUNNER_TEMP}/gh-aw/actions/*.sh"` step emitted by the
compiler. These scripts run from the trusted ${RUNNER_TEMP} location (not
from checkout content), so poutine's untrusted_checkout_exec findings are
false positives.
Previously only a subset of steps had the suppression comment (save_base_
github_folders.sh, create_prompt_first.sh, validate_prompt_placeholders.sh,
print_prompt_summary.sh). This left 10 unflagged occurrences across
smoke-workflow-call.lock.yml and smoke-workflow-call-with-inputs.lock.yml.
Changes:
- compiler_activation_steps.go: check_oauth_tokens.sh,
log_runtime_features_summary.sh, ensure_gh_cli_min_version.sh
- observability_otlp.go: mask_otlp_headers.sh, mask_otlp_attributes.sh
- compiler_workflow_call.go: compute_artifact_prefix.sh
- engine_helpers.go: validate_multi_secret.sh
- compiler_yaml_runtime_setup.go: create_gh_aw_tmp_dir.sh,
configure_gh_for_ghe.sh
- copilot_engine_execution.go: copy_copilot_session_state.sh
- engine_firewall_support.go: print_firewall_logs.sh
- checkout_step_generator.go: configure_git_credentials.sh,
clean_git_credentials_checkout.sh
- compiler_github_mcp_steps.go: parse_guard_list.sh
- cache.go: create_cache_memory_dir.sh, setup_cache_memory_git.sh,
commit_cache_memory_git.sh, check_cache_memory_git_integrity.sh
- docker.go: download_docker_images.sh
- compiler_yaml_audit_step.go: audit_pre_agent_workspace.sh
- git_configuration_steps.go: configure_git_credentials.sh,
clean_git_credentials.sh
- inline_skill_step.go: restore_inline_skills.sh
- copilot_engine_installation.go: install_awf_binary.sh
- copilot_installer.go: install_copilot_cli.sh
- compiler_yaml_ai_execution.go: append_agent_step_summary.sh
- compiler_difc_proxy.go: stop_difc_proxy.sh, stop_cli_proxy.sh
- sub_agent_step.go: restore_inline_sub_agents.sh
- repo_memory.go: sanitize_repo_memory_filenames.sh,
clone_repo_memory_branch.sh
- antigravity_installer.go: install_antigravity_cli.sh
- pr.go: restore_base_github_folders.sh
Also adds TestActivationJobStepsHavePoutineIgnoreBeforeBashRun unit test.
Lock files regenerated via make recompile.
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
|
✅ Test Quality Sentinel completed test quality analysis. No test files were added or modified in this PR. Test Quality Sentinel skipped. |
|
🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅ |
|
✅ Design Decision Gate 🏗️ completed the design decision gate check. No ADR enforcement needed: PR #48717 does not have the 'implementation' label and has ≤100 new lines of code in business logic directories (67 additions detected, threshold is 100). |
|
✅ PR Code Quality Reviewer completed the code quality review. |
There was a problem hiding this comment.
Pull request overview
Adds Poutine suppression comments to compiler-emitted trusted ${RUNNER_TEMP} scripts and regenerates compiled workflows.
Changes:
- Adds suppression comments across compiler step generators.
- Regenerates 264 workflow lock files.
- Adds an activation-job regression test.
Show a summary per file
| File | Description |
|---|---|
pkg/workflow/antigravity_installer.go |
Annotates Antigravity installation. |
pkg/workflow/cache.go |
Annotates cache-memory scripts. |
pkg/workflow/checkout_step_generator.go |
Annotates credential scripts. |
pkg/workflow/compiler_activation_steps.go |
Annotates activation scripts. |
pkg/workflow/compiler_difc_proxy.go |
Annotates proxy cleanup scripts. |
pkg/workflow/compiler_github_mcp_steps.go |
Annotates guard parsing. |
pkg/workflow/compiler_workflow_call.go |
Annotates artifact-prefix generation. |
pkg/workflow/compiler_yaml_ai_execution.go |
Annotates summary generation. |
pkg/workflow/compiler_yaml_audit_step.go |
Annotates workspace auditing. |
pkg/workflow/compiler_yaml_runtime_setup.go |
Annotates runtime setup. |
pkg/workflow/copilot_engine_execution.go |
Annotates session-state copying. |
pkg/workflow/copilot_engine_installation.go |
Annotates AWF installation. |
pkg/workflow/copilot_installer.go |
Annotates Copilot installation. |
pkg/workflow/docker.go |
Annotates image downloads. |
pkg/workflow/engine_firewall_support.go |
Annotates firewall log parsing. |
pkg/workflow/engine_helpers.go |
Annotates secret validation. |
pkg/workflow/git_configuration_steps.go |
Annotates Git credential handling. |
pkg/workflow/inline_skill_step.go |
Annotates skill restoration. |
pkg/workflow/observability_otlp.go |
Annotates OTLP masking. |
pkg/workflow/pr.go |
Annotates configuration restoration. |
pkg/workflow/repo_memory.go |
Annotates repository-memory scripts. |
pkg/workflow/runtime_features_env_test.go |
Tests activation-step annotations. |
pkg/workflow/sub_agent_step.go |
Annotates sub-agent restoration. |
.github/workflows/*.lock.yml (264 files) |
Regenerates workflows with annotations. |
Review details
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 97/287 changed files
- Comments generated: 1
- Review effort level: Medium
| @@ -88,6 +89,7 @@ func buildRuntimeFeaturesSummaryStep() []string { | |||
| return []string{ | |||
| " - name: Log runtime features\n", | |||
| " if: ${{ contains(toJSON(vars), '\"GH_AW_RUNTIME_FEATURES\":') }}\n", | |||
| " # poutine:ignore untrusted_checkout_exec\n", | |||
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Verdict: Approve — mechanical false-positive suppression
Adds # poutine:ignore untrusted_checkout_exec comments above compiler-emitted run: bash "${RUNNER_TEMP}/gh-aw/actions/*.sh" steps and regenerates lock files. No logic changes; comment insertion is consistent across all ~23 generator sites and covered by a new regression test.
Notes
- Verified all
RUNNER_TEMP}/gh-aw/actions/run steps in pkg/workflow/*.go now have an adjacent poutine:ignore comment (checked programmatically). TestActivationJobStepsHavePoutineIgnoreBeforeBashRunonly covers the activation job path; other jobs (agent job, custom generators) are not asserted by a test, so future new steps in those paths could regress silently. Not blocking since the fix itself is correct and scoped to a security-scanner suppression, but worth a follow-up to broaden test coverage.- Scripts run from
${RUNNER_TEMP}, a trusted runner-local path populated by the compiler/setup action, not by checkout content, so the poutine:ignore is factually justified.
🔎 Code quality review by PR Code Quality Reviewer · sonnet50 · 25.1 AIC · ⌖ 4.3 AIC · ⊞ 7.4K
Comment /review to run again
There was a problem hiding this comment.
The changes look correct. Every run: bash "${RUNNER_TEMP}/gh-aw/actions/..." step across all regenerated lock files is now preceded by # poutine:ignore untrusted_checkout_exec. The suppression rationale is sound — scripts execute from the trusted ${RUNNER_TEMP} path, not from checkout content. No issues found.
🧵 Reviewed using Impeccable skills by Impeccable Skills Reviewer · sonnet46 · 29.2 AIC · ⌖ 5.62 AIC · ⊞ 5K
There was a problem hiding this comment.
Skills-Based Review 🧠
Applied /diagnosing-bugs and /tdd — requesting changes on three uncovered run: | blocks and missing agent-job test coverage.
📋 Key Themes & Highlights
Key Issues
run: |blocks not covered (correctness): Threebash "${RUNNER_TEMP}/gh-aw/actions/...calls inside multi-linerun: |blocks are missing the suppression comment on therun: |line itself — poutine flags therun:key, not the innerbashinvocation:compiler_difc_proxy.go:273—start_difc_proxy.shcompiler_difc_proxy.go:591—start_cli_proxy.shcompiler_yaml_ai_execution.go:163—stop_mcp_gateway.sh
- Test coverage gap (
/tdd):TestActivationJobStepsHavePoutineIgnoreBeforeBashRunonly guards the activation job; the agent job has many more bash-run steps with no equivalent regression test.
Positive Highlights
- ✅ Systematic, comprehensive fix across all 23 templates and 264 lock files
- ✅ New unit test for the activation job is a solid regression anchor
- ✅ PR description is clear about scope and rationale (trusted
RUNNER_TEMPscripts, false positives) - ✅ Consistent placement of the suppression comment immediately before each
run:line
🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer · sonnet46 · 86 AIC · ⌖ 5.03 AIC · ⊞ 6.7K
Comment /matt to run again
Comments that could not be inline-anchored
pkg/workflow/compiler_difc_proxy.go:273
[/diagnosing-bugs] Missing # poutine:ignore untrusted_checkout_exec before the run: | block for start_difc_proxy.sh — poutine flags the run: key, not the inner bash invocation, so the suppression needs to be on the line before run: |, not inside the block.
<details>
<summary>💡 Suggested fix</summary>
sb.WriteString(" # poutine:ignore untrusted_checkout_exec
")
sb.WriteString(" run: |
")
sb.WriteString(" bash \"${RUNNER_TEMP}/gh-aw/actions/start_di…
</details>
<details><summary>pkg/workflow/compiler_difc_proxy.go:591</summary>
**[/diagnosing-bugs]** Same issue: `run: |` block for `start_cli_proxy.sh` is also missing `# poutine:ignore untrusted_checkout_exec` immediately before the `run: |` line.
<details>
<summary>💡 Suggested fix</summary>
```go
sb.WriteString(" # poutine:ignore untrusted_checkout_exec
")
sb.WriteString(" run: |
")
sb.WriteString(" bash \"${RUNNER_TEMP}/gh-aw/actions/start_cli_proxy.sh\"
")</details>
@copilot please address this.
pkg/workflow/compiler_yaml_ai_execution.go:163
[/diagnosing-bugs] stop_mcp_gateway.sh is invoked inside a run: | multi-line block, and the run: | line has no # poutine:ignore untrusted_checkout_exec comment preceding it. This is the same gap as the proxy start steps.
<details>
<summary>💡 Suggested fix</summary>
yaml.WriteString(" # poutine:ignore untrusted_checkout_exec
")
yaml.WriteString(" run: |
")
yaml.WriteString(" bash \"${RUNNER_TEMP}/gh-aw/actions/stop_mcp_gateway.sh\" \"$GATEWAY_PID\"
")
…
</details>
<details><summary>pkg/workflow/runtime_features_env_test.go:205</summary>
**[/tdd]** The test only validates the activation job — the agent job has equally many `run: bash "${RUNNER_TEMP}/gh-aw/actions/...` steps (e.g. `start_difc_proxy.sh`, `stop_mcp_gateway.sh`) that could regress without a test catching it.
<details>
<summary>💡 Suggestion</summary>
Add a parallel `TestAgentJobStepsHavePoutineIgnoreBeforeBashRun` that calls `buildAgentJob` (or the equivalent agent-job builder) and applies the same assertion loop. This prevents future additions to the agent job f…
</details>
|
Hey What we're seeing:
This PR is ready for review and merges cleanly with the contribution guidelines.
|
Poutine reported 10
untrusted_checkout_execfindings acrosssmoke-workflow-call.lock.ymlandsmoke-workflow-call-with-inputs.lock.ymlbecause only a subset of compiler-emittedrun: bash "${RUNNER_TEMP}/gh-aw/actions/*.sh"steps had the suppression comment. These scripts run from the trusted${RUNNER_TEMP}location (not from checkout content), so all findings are false positives.Changes
# poutine:ignore untrusted_checkout_execimmediately above everyrun: bash "${RUNNER_TEMP}/gh-aw/actions/*.sh"step, covering:check_oauth_tokens.sh,log_runtime_features_summary.sh,ensure_gh_cli_min_version.sh,compute_artifact_prefix.sh,validate_multi_secret.shmask_otlp_headers.sh,create_gh_aw_tmp_dir.sh,configure_gh_for_ghe.sh,configure_git_credentials.sh,install_copilot_cli.sh,install_awf_binary.sh,install_antigravity_cli.sh,restore_base_github_folders.sh,restore_inline_sub_agents.sh,restore_inline_skills.sh,download_docker_images.sh,audit_pre_agent_workspace.sh,append_agent_step_summary.sh,print_firewall_logs.sh,stop_difc_proxy.sh,stop_cli_proxy.sh, cache memory steps, repo memory steps, and moremake recompileTestActivationJobStepsHavePoutineIgnoreBeforeBashRun— asserts every activation jobrun: bash "${RUNNER_TEMP}/gh-aw/actions/..."step is preceded by the suppression commentBefore (missing comment on "Log runtime features"):
After:
run: https://github.com/github/gh-aw/actions/runs/30401927723