[plan] Enable strict:true on all input-triggered workflows lacking sanitization

[github-actions]

Objective

Enable strict: true on all input-triggered workflows that receive untrusted data (issues, PRs, comments, discussions) but currently lack strict mode, as identified in discussion #26727.

Context

Per the Copilot CLI Deep Research report (discussion #26727), strict mode has improved to 66% (126/192 workflows) but 34% (66 workflows) remain without it. Input-triggered workflows without strict are potential prompt injection vectors — they process untrusted content without sanitization.

Approach

1. Find all workflows missing strict: true:

   grep -rL "strict: true" .github/workflows/*.md

2. For each workflow without strict, check its trigger in the frontmatter on: section:

   • If triggered by issues, pull_request, pull_request_review, discussion, issue_comment, discussion_comment → must have strict: true
   • If triggered only by schedule, workflow_dispatch with no untrusted inputs, push to protected branches → can remain without strict

3. Add strict: true to all input-triggered workflows missing it:

   strict: true

4. Cross-check: confirm that strict: true workflows also use $\{\{ steps.sanitized.outputs.text }} (or title/body) in their prompts rather than raw event data

5. Recompile: make recompile

6. Validate: make agent-finish

Files to Modify

• All .github/workflows/*.md files triggered by user-generated events that lack strict: true
• Corresponding .lock.yml files regenerated by make recompile

Acceptance Criteria

• All input-triggered workflows (issues, PRs, comments, discussions) have strict: true
• Workflows triggered only by schedule/dispatch/push are evaluated individually
• strict workflows use steps.sanitized.outputs.* expressions in prompts
• All modified workflows compile successfully
• make agent-finish passes

Generated by Plan Command for issue #discussion #26727 · ● 361.6K · ◷

• expires on Apr 18, 2026, 9:26 PM UTC

[github-actions]

🍪 Issue Monster has assigned this to Copilot!

I've identified this issue as a good candidate for automated resolution and assigned it to the Copilot coding agent.

The Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

🍪 Om nom nom by Issue Monster · ● 398.4K · ◷