Add `blocked` deny list for assign-to-user and unassign-from-user safe outputs by Copilot · Pull Request #16628 · github/gh-aw

Copilot · 2026-02-18T19:36:18Z

Implementation Complete: `blocked` deny list for `assign-to-user` safe output

Latest Changes

Deduplicated glob pattern matching implementation to eliminate code duplication:

Refactored glob_pattern_helpers.cjs:

Added escapeRegexChars() internal helper for consistent special character escaping
Enhanced globPatternToRegex() with optional options parameter:
- pathMode (default: true): Controls how * is interpreted
- caseSensitive (default: true): Controls case sensitivity
Simplified simpleGlobToRegex() to call globPatternToRegex() with pathMode: false
Fixed TypeScript type annotations for optional parameters

Updated callers:

parseGlobPatterns() - Uses arrow function to pass pattern correctly
push_repo_memory.cjs - Updated map call to use arrow function
Test files - Updated to use arrow functions with map

Benefits:

Single source of truth for regex escaping logic
Reduced code duplication by ~15 lines
More maintainable and consistent behavior
TypeScript type safety maintained

Original prompt

This section details on the original issue you should resolve

<issue_title>Feature request: blocked deny list for assign-to-user safe output</issue_title>
<issue_description>🤖 Filed with agentic-workflows agent mid-design conversation

Problem

The assign-to-user safe output currently supports assignees: [list] (allowlist) and max: N (count cap), but has no way to deny specific users or patterns from being assigned.

In workflows that process untrusted public input (e.g., issue triage on microsoft/vscode), a prompt injection attack could attempt to trick the agent into assigning copilot or other bot accounts to issues — which would trigger Copilot coding agent sessions or other unintended automated actions. Currently this can only be prevented via prompt-level instructions ("never assign copilot"), which is not a reliable defense against adversarial input.

Maintaining an exhaustive allowlist is also impractical when the set of valid assignees changes as team members rotate.

Proposed Solution

Add a blocked: field to assign-to-user (and potentially unassign-from-user) safe outputs:
safe-outputs:
  assign-to-user:
    blocked: ["copilot", "*[bot]"]   # deny specific users or patterns
    max: 1
This should support:

Exact user matches (e.g., copilot)

Pattern matching for bot accounts (e.g., *[bot] to deny all bot suffixed accounts)

Why This Matters

For workflows processing untrusted content, the safe-outputs config is the hard security boundary. A compromised agent that assigns copilot to an issue could trigger an autonomous coding agent session on attacker-controlled issue content — escalating a prompt injection from "triage manipulation" to "code execution." Being able to deny dangerous assignees at the infrastructure layer would close this escalation path.

Related

This is the assign-to-user counterpart to #16625 (blocked patterns for add-labels).

Current Workaround

Prompt-level instructions telling the agent not to assign bot accounts. Works under normal conditions but is not a reliable defense against adversarial input.</issue_description>

Comments on the Issue (you are @copilot in this section)

Fixes Feature request: blocked deny list for assign-to-user safe output #16626

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

✨ PR Review Safe Output Test - Run 22157554498

💥 [THE END] — Illustrated by Smoke Claude

Changeset

Type: patch
Description: Added blocked deny-list support for the assign-to-user and unassign-from-user safe outputs so workflows can refuse risky assignees via glob patterns.

Generated by Changeset Generator

…outputs Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

…assign-from-user Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

pelikhan · 2026-02-18T19:57:11Z

actions/setup/js/safe_output_helpers.cjs

+
+  // Simple glob pattern matching
+  // Convert glob pattern to regex: "*[bot]" -> "^.*\[bot\]$"
+  const regexPattern = pattern


@copilot review for security

Refactored in commit 7102cba. The regex pattern escaping now uses the generic simpleGlobToRegex() function from glob_pattern_helpers.cjs, which properly escapes all special regex characters except *.

pelikhan · 2026-02-18T19:57:24Z

actions/setup/js/safe_output_helpers.cjs

+    .replace(/[.+?^${}()|[\]\\]/g, "\\$&") // Escape special regex chars except *
+    .replace(/\*/g, ".*"); // Convert * to .*
+
+  const regex = new RegExp(`^${regexPattern}$`, "i"); // Case-insensitive


@copilot review for security

Refactored in commit 7102cba. The regex construction is now delegated to matchesSimpleGlob() in glob_pattern_helpers.cjs, which handles case-insensitive matching by default.

actions/setup/js/safe_output_helpers.cjs

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

pelikhan · 2026-02-18T20:27:46Z

actions/setup/js/glob_pattern_helpers.cjs

  return patterns.some(pattern => pattern.test(filePath));
 }

+/**


@copilot deduplicate with globPatternToRegex

Deduplicated in commit 0626e1a. The simpleGlobToRegex() function now reuses globPatternToRegex() with pathMode: false option, sharing the same escaping logic through a new escapeRegexChars() helper.

…e globPatternToRegex Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot

Pull request overview

This PR adds a blocked deny list feature to assign-to-user and unassign-from-user safe outputs to provide defense-in-depth against prompt injection attacks. The feature allows workflow authors to block specific users or patterns (e.g., copilot, *[bot]) from being assigned to issues, preventing attackers from escalating prompt injection attacks into triggering automated agent sessions.

Changes:

Added blocked field to AssignToUserConfig and UnassignFromUserConfig structs with pattern matching support
Implemented generic glob pattern matching helpers with deduplication of regex escaping logic
Updated safe output processing pipeline to filter blocked items after allowed filtering
Added comprehensive test coverage for pattern matching and the assign-to-user handler
Updated JSON schema and documentation with clear examples and security context

Reviewed changes

Copilot reviewed 16 out of 16 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
`pkg/workflow/assign_to_user.go`	Added `Blocked` field to config struct with YAML tag and documentation
`pkg/workflow/unassign_from_user.go`	Added `Blocked` field to config struct with YAML tag and documentation
`pkg/workflow/safe_outputs_config_generation_helpers.go`	Created `generateMaxWithAllowedAndBlockedConfig` helper function
`pkg/workflow/safe_outputs_config_generation.go`	Updated config generation to use new helper with blocked parameter
`pkg/parser/schemas/main_workflow_schema.json`	Added `blocked` field schema with clear descriptions for both handlers
`docs/src/content/docs/reference/safe-outputs.md`	Updated documentation with examples and security explanation
`actions/setup/js/glob_pattern_helpers.cjs`	Refactored with `escapeRegexChars()` helper and enhanced `globPatternToRegex()` with options
`actions/setup/js/safe_output_processor.cjs`	Added `filterByBlocked()` function and integrated into `processItems` pipeline
`actions/setup/js/safe_output_helpers.cjs`	Added `matchesBlockedPattern()` and `isUsernameBlocked()` helper functions
`actions/setup/js/assign_to_user.cjs`	Updated to extract and use blocked configuration
`actions/setup/js/unassign_from_user.cjs`	Updated to extract and use blocked configuration
`actions/setup/js/glob_pattern_helpers.test.cjs`	Added comprehensive tests for simple glob matching
`actions/setup/js/safe_output_helpers.test.cjs`	Added tests for blocked pattern matching functions
`actions/setup/js/assign_to_user.test.cjs`	Added comprehensive tests for blocked pattern filtering
`actions/setup/js/push_repo_memory.cjs`	Updated to use arrow function syntax for pattern mapping
`actions/setup/js/push_repo_memory.test.cjs`	Updated test to use arrow function syntax

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-02-18T20:45:51Z

actions/setup/js/unassign_from_user.cjs

 async function main(config = {}) {
  // Extract configuration
  const allowedAssignees = config.allowed || [];
+  const blockedAssignees = config.blocked || [];


The unassign_from_user.test.cjs file is missing test coverage for the new blocked patterns feature. While assign_to_user.test.cjs has comprehensive tests for blocked patterns (lines 487-587), the unassign_from_user handler should have similar test coverage to ensure the blocked filtering works correctly for unassignments as well.

Consider adding tests for:

Filtering out blocked users by exact match

Filtering out blocked users by pattern (e.g., *[bot])

Combining allowed and blocked filters

Handling empty results when all users are blocked

Copilot · 2026-02-18T20:45:51Z

actions/setup/js/safe_output_processor.cjs

+ * @param {string[]|undefined} blockedPatterns - Blocked patterns list (undefined means no blocking)
+ * @returns {string[]} Filtered items with blocked items removed
+ */
+function filterByBlocked(items, blockedPatterns) {


The safe_output_processor.test.cjs file is missing test coverage for the new filterByBlocked function. The function is exported from the module and used in the processItems pipeline, but there are no direct tests to verify its behavior.

Consider adding tests for:

Filtering items with exact pattern matches

Filtering items with glob patterns

Handling empty or undefined blocked patterns

Integration with the processItems pipeline

github-actions · 2026-02-18T21:04:52Z

🧪 Smoke Project is now testing project operations...

github-actions · 2026-02-18T21:04:59Z

📰 BREAKING: Smoke Copilot is now investigating this pull request. Sources say the story is developing...

github-actions · 2026-02-18T21:05:02Z

🎬 THE END — Smoke Claude MISSION: ACCOMPLISHED! The hero saves the day! ✨

github-actions · 2026-02-18T21:05:03Z

🧪 Smoke Temporary ID is now testing temporary ID functionality...

github-actions · 2026-02-18T21:05:03Z

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

github-actions · 2026-02-18T21:07:47Z

Agent Container Tool Check

Tool	Status	Version
bash	✅	5.2.21
sh	✅	available
git	✅	2.52.0
jq	✅	1.7
yq	✅	4.52.2
curl	✅	8.5.0
gh	✅	2.86.0
node	✅	20.20.0
python3	✅	3.12.3
go	✅	1.24.13
java	✅	21.0.10
dotnet	✅	10.0.102

Result: 12/12 tools available ✅

Overall Status: PASS

🔧 Tool validation by Agent Container Smoke Test for issue #16628

github-actions · 2026-02-18T21:07:57Z

✅ Smoke Temporary ID completed successfully. Temporary ID validation passed.

github-actions · 2026-02-18T21:07:59Z

✅ Smoke Project completed successfully. All project operations validated.

github-actions · 2026-02-18T21:10:38Z

Smoke test results
PR titles: Update test expectations for roles-to-on-roles codemod; Fix missing global.context setup in submit_pr_review.test.cjs
GitHub MCP ✅
Serena MCP ✅
Playwright ✅
File write ✅
Bash cat ✅
Build ✅
Overall: PASS

🔮 The oracle has spoken through Smoke Codex for issue #16628

github-actions · 2026-02-18T21:11:00Z

Smoke Test: Copilot - 22157553390 ⚠️ PARTIAL PASS (10/11)

Test	Status
GitHub MCP	✅
Safe Inputs GH CLI	✅
Serena MCP	❌
Playwright	✅
File Writing + Bash	✅
Discussion Interaction	✅
Build gh-aw	✅
Discussion Creation	✅
Workflow Dispatch	✅
PR Review	✅

Failure: Serena MCP — uvx not installed.

@pelikhan — PR reviewed, smoke-copilot label added.

📰 BREAKING: Report filed by Smoke Copilot for issue #16628

github-actions

This PR adds blocked assignee support to assign_to_user.cjs. The implementation is clean and the test coverage is solid. Two minor suggestions added as inline comments. Overall looks good!

📰 BREAKING: Report filed by Smoke Copilot for issue #16628

github-actions · 2026-02-18T21:11:01Z

actions/setup/js/assign_to_user.cjs

 async function main(config = {}) {
  // Extract configuration
  const allowedAssignees = config.allowed || [];
+  const blockedAssignees = config.blocked || [];


Nice addition of blockedAssignees support. Consider adding a comment here explaining that blocked takes precedence over allowed to clarify the filtering priority for future readers.

github-actions · 2026-02-18T21:11:01Z

actions/setup/js/assign_to_user.test.cjs

+  describe("blocked patterns", () => {
+    it("should filter out blocked users by exact match", async () => {
+      const { main } = require("./assign_to_user.cjs");
+      const handler = await main({


Good test coverage for blocked patterns. It would also be worth adding a test case that verifies an empty blocked array (the default) doesn't filter any valid assignees.

github-actions · 2026-02-18T21:11:18Z

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

github-actions · 2026-02-18T21:12:45Z

Smoke Test Results — Run §22157554498

Core Tests #1-10: ✅✅✅✅✅✅✅✅✅✅ All pass
PR Review Tests #11-17: ✅✅✅⚠️✅⚠️⚠️ (10 pass, 3 skipped)

Overall: PARTIAL (all non-skipped tests passed)

💥 [THE END] — Illustrated by Smoke Claude for issue #16628

github-actions

💥 Automated smoke test review - all systems nominal!

💥 [THE END] — Illustrated by Smoke Claude for issue #16628

Initial plan

4a1514a

Copilot AI assigned Copilot and pelikhan Feb 18, 2026

Copilot started work on behalf of pelikhan February 18, 2026 19:36 View session

Copilot AI and others added 2 commits February 18, 2026 19:44

Add blocked deny list for assign-to-user and unassign-from-user safe …

b4cf858

…outputs Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Update JSON schema to include blocked field for assign-to-user and un…

deefded

…assign-from-user Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Add blocked deny list for assign-to-user output~~ Add blocked deny list for assign-to-user and unassign-from-user safe outputs Feb 18, 2026

Copilot finished work on behalf of pelikhan February 18, 2026 19:55

pelikhan reviewed Feb 18, 2026

View reviewed changes

Copilot started work on behalf of pelikhan February 18, 2026 19:58 View session

Refactor pattern matching to use generic glob_pattern_helpers

7102cba

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan February 18, 2026 20:05

pelikhan reviewed Feb 18, 2026

View reviewed changes

Copilot started work on behalf of pelikhan February 18, 2026 20:27 View session

Deduplicate pattern matching by refactoring simpleGlobToRegex to reus…

0626e1a

…e globPatternToRegex Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan February 18, 2026 20:35

pelikhan marked this pull request as ready for review February 18, 2026 20:41

Copilot AI review requested due to automatic review settings February 18, 2026 20:41

Copilot started reviewing on behalf of pelikhan February 18, 2026 20:42 View session

Copilot AI reviewed Feb 18, 2026

View reviewed changes

pelikhan added the smoke label Feb 18, 2026

This was referenced Feb 18, 2026

[smoke-temporary-id] Test Parent: Temporary ID Validation #16644

Closed

[smoke-temporary-id] Sub-Issue 1: Test Temporary ID References #16646

Closed

[smoke-temporary-id] Sub-Issue 2: Test Different ID Length #16647

Closed

github-actions bot added smoke-codex and removed smoke labels Feb 18, 2026

github-actions bot mentioned this pull request Feb 18, 2026

Smoke Test: Copilot - 22157553390 #16650

Closed

github-actions bot added the smoke-copilot label Feb 18, 2026

github-actions bot reviewed Feb 18, 2026

View reviewed changes

github-actions bot mentioned this pull request Feb 18, 2026

Smoke Test: Claude - 22157554498 #16652

Closed

github-actions bot added the smoke-claude label Feb 18, 2026

github-actions bot reviewed Feb 18, 2026

View reviewed changes

Add changeset [skip-ci]

183941f

pelikhan merged commit bdbe553 into main Feb 18, 2026

pelikhan deleted the copilot/add-blocked-deny-list-feature branch February 18, 2026 21:35

github-actions bot mentioned this pull request Feb 19, 2026

[instructions] Sync github-agentic-workflows.md with v0.46.1 #16675

Merged

6 tasks

Conversation

Copilot AI commented Feb 18, 2026 • edited by github-actions bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Implementation Complete: blocked deny list for assign-to-user safe output

Latest Changes

Problem

Proposed Solution

Why This Matters

Related

Current Workaround

Comments on the Issue (you are @copilot in this section)

Changeset

Uh oh!

pelikhan Feb 18, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 18, 2026

Choose a reason for hiding this comment

Uh oh!

pelikhan Feb 18, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 18, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

pelikhan Feb 18, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 18, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Feb 18, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 18, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Feb 18, 2026

Uh oh!

github-actions bot commented Feb 18, 2026

Uh oh!

github-actions bot commented Feb 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Feb 18, 2026

Uh oh!

github-actions bot commented Feb 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Feb 18, 2026

Agent Container Tool Check

Uh oh!

github-actions bot commented Feb 18, 2026

Uh oh!

github-actions bot commented Feb 18, 2026

Uh oh!

github-actions bot commented Feb 18, 2026

Uh oh!

github-actions bot commented Feb 18, 2026

Uh oh!

github-actions bot left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions bot Feb 18, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions bot Feb 18, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Feb 18, 2026

Uh oh!

github-actions bot commented Feb 18, 2026

Smoke Test Results — Run §22157554498

Uh oh!

Copilot AI commented Feb 18, 2026 •

edited by github-actions bot

Loading

Implementation Complete: `blocked` deny list for `assign-to-user` safe output

github-actions bot commented Feb 18, 2026 •

edited

Loading

github-actions bot commented Feb 18, 2026 •

edited

Loading