Fix argument injection in npm/pip/docker package validators#23374
Fix argument injection in npm/pip/docker package validators#23374
Conversation
- Add npm package name regex validation (validateNpmPackageName) in name_validation.go - Add PyPI package name regex validation (validatePipPackageName) per PEP 508 in name_validation.go - Add -- end-of-options separator to npm view command in npm_validation.go - Apply npm name regex validation before invoking npm CLI - Apply pip name regex validation in validatePythonPackagesWithPip - Add tests for single-character names and injection-style names in argument_injection_test.go Closes #XXX Agent-Logs-Url: https://github.com/github/gh-aw/sessions/db1ddaab-af87-4f48-8b54-597c4bcbe3de Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
lpcox
force-pushed
the
copilot/fix-argument-injection-validation
branch
from
f059e80 to
4cc61c4
Compare
The npmPackageNameRE regex rejected valid npm package specifiers that include version suffixes (e.g. @sentry/mcp-server@0.29.0). This caused mcp-inspector.md to fail compilation in CI (177/178 instead of 178/178). Update the regex to accept an optional @Version suffix and add test cases for scoped+versioned, unscoped+versioned, caret ranges, and tags. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
There was a problem hiding this comment.
Pull request overview
Hardens gh aw compile --validate-packages against argument injection by validating npm/PyPI package names before invoking external CLIs and by using an end-of-options separator for npm invocations.
Changes:
- Add regex-based validators for npm and PyPI package names.
- Add a two-layer defense for npm validation (pre-validate +
npm view -- <pkg> name). - Add unit tests covering common injection-like patterns and valid/invalid name cases.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
pkg/workflow/name_validation.go |
Introduces npm/PyPI name regexes and helper validators used by package validation flows. |
pkg/workflow/npm_validation.go |
Validates npm package names before invoking npm; adds -- to prevent option parsing. |
pkg/workflow/pip_validation.go |
Adds PyPI name validation before running pip index versions. |
pkg/workflow/argument_injection_test.go |
Adds unit tests for the new npm/PyPI name validators. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| // - Unscoped: lowercase alphanumeric + hyphens + dots + underscores | ||
| // - Optional version suffix: @version (e.g. @1.2.3, @^1.0.0, @latest) | ||
| // This rejects any name that could be interpreted as a CLI flag. | ||
| var npmPackageNameRE = regexp.MustCompile(`^(@[a-z0-9][a-z0-9._-]*/)?[a-z0-9][a-z0-9._-]*(@[a-zA-Z0-9^~>=<.*|-]+)?$`) |
There was a problem hiding this comment.
npmPackageNameRE claims to allow an optional version suffix, but the character class for the suffix does not include +, which is valid in semver build metadata (and supported by npm's semver). This can incorrectly reject valid package specs like pkg@1.2.3+build. Consider expanding the suffix pattern (or delegating version parsing to a semver-aware check) to avoid false negatives.
| var npmPackageNameRE = regexp.MustCompile(`^(@[a-z0-9][a-z0-9._-]*/)?[a-z0-9][a-z0-9._-]*(@[a-zA-Z0-9^~>=<.*|-]+)?$`) | |
| var npmPackageNameRE = regexp.MustCompile(`^(@[a-z0-9][a-z0-9._-]*/)?[a-z0-9][a-z0-9._-]*(@[a-zA-Z0-9^~>=<.*|+-]+)?$`) |
| } | ||
|
|
||
| // validatePipPackageName returns an error if the package name does not conform | ||
| // to the PyPI naming rules (PEP 508). This prevents argument injection into pip/uv. |
There was a problem hiding this comment.
The docstring for validatePipPackageName says it prevents argument injection into "pip/uv", but this helper is only called from the pip-index-based validation path (validatePythonPackagesWithPip). The uv direct validation path uses uv pip show and does not call this helper, so the comment is currently misleading. Either apply the same name validation in the uv path as well, or adjust the comment to only mention pip (and uv-when-falling-back-to-pip).
| // to the PyPI naming rules (PEP 508). This prevents argument injection into pip/uv. | |
| // to the PyPI naming rules (PEP 508). This prevents argument injection into the pip CLI. |
During
gh aw compile --validate-packages, package/image names from frontmatter MCP configs are passed tonpm view,pip index versions,uv pip show, anddockerwithout format validation. A name like--registry=https://attacker.examplelands inargv[2]and is parsed as a flag by the downstream tool, making the validator's result meaningless.Changes
name_validation.go— Two new regex validators:validateNpmPackageName()— enforces npm naming rules (^(@[a-z0-9][a-z0-9._-]*/)?[a-z0-9][a-z0-9._-]*$)validatePipPackageName()— enforces PyPI/PEP 508 naming rules (^[A-Za-z0-9]([A-Za-z0-9._-]*[A-Za-z0-9])?$); pip doesn't universally honor--, so upfront validation is the right approachnpm_validation.go— Two-layer defence:validateNpmPackageName()before invoking npm (rejects injection names that don't start with-)--end-of-options separator:exec.Command("npm", "view", "--", pkg, "name")pip_validation.go— CallsvalidatePipPackageName()invalidatePythonPackagesWithPipafter the existing-prefix checkargument_injection_test.go—TestValidateNpmPackageNameandTestValidatePipPackageNamecovering valid names (including single-char),--flag=valueinjection patterns,=-containing names, names with spaces, and uppercase-rejected npm namesExample of what's now blocked at compile time:
Warning
Firewall rules blocked me from connecting to one or more addresses (expand for details)
I tried to connect to the following addresses, but was blocked by firewall rules:
https://api.github.com/graphql/usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw GOPROXY ache/node/24.14.--show-toplevel git rev-�� --show-toplevel /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linu-test.v=true /usr/bin/git /tmp/go-build380git ache/go/1.25.0/xrev-parse 64/pkg/tool/linu--show-toplevel git(http block)https://api.github.com/orgs/test-owner/actions/secrets/usr/bin/gh gh api /orgs/test-owner/actions/secrets --jq .secrets[].name -json GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet /pre�� -json GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet(http block)https://api.github.com/repos/actions/ai-inference/git/ref/tags/v1/usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq .object.sha user.name Test User /usr/bin/git on' --ignore-patgit GO111MODULE 0/x64/bin/git git rev-�� --show-toplevel ache/go/1.25.0/xremote.origin.url /usr/bin/git ./../pkg/workflogit GO111MODULE -d /usr/bin/git(http block)https://api.github.com/repos/actions/checkout/git/ref/tags/v3/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq .object.sha --write l 0/x64/bin/node --ignore-path ../../../.prettirev-parse x_amd64/vet 0/x64/bin/node -o 8766252/b458/scripts.test -importcfg 8766252/b458/importcfg.link -s -w -buildmode=exe ZXFjOiSQ6baL5/4PU8IGZ3xsiiK_VzgSGT/jqXiqKS2mm7rG7KRlb0f/T36gUPQZXFjOiSQ6baL5(http block)https://api.github.com/repos/actions/checkout/git/ref/tags/v5/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha /tmp/go-build3800051486/b025/vet.cfg GOPROXY cal/bin/git GOSUMDB GOWORK 64/bin/go /opt/hostedtoolcache/go/1.25.0/x-test.v=true /tmp�� GOMODCACHE ache/go/1.25.0/xGO111MODULE x_amd64/vet ignore GO111MODULE 64/bin/go x_amd64/vet(http block)/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha list --json /usr/bin/git --workflow nonexistent-workrev-parse --limit git rev-�� --show-toplevel x_amd64/vet /usr/bin/infocmp -json GO111MODULE t infocmp(http block)/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha --show-toplevel git /usr/bin/git 3916-31752/test-git HEAD ser.test git rev-�� --show-toplevel ser.test /usr/bin/git axlifetime=\(.*\git /opt/hostedtoolcrev-parse ache/go/1.25.0/x--show-toplevel git(http block)https://api.github.com/repos/actions/checkout/git/ref/tags/v6/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha --show-toplevel 64/pkg/tool/linu-buildtags /usr/bin/git kflow/pip_validagit GO111MODULE 64/pkg/tool/linu--show-toplevel git -C /tmp/gh-aw-test-runs/20260328-183916-31752/test-3035844307 status /opt/hostedtoolcache/node/24.14.0/x64/bin/node .github/workflowgit GO111MODULE 64/pkg/tool/linu--show-toplevel node(http block)/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha ts.result config /usr/bin/git remote.origin.urgit GO111MODULE 64/pkg/tool/linu--show-toplevel git rese�� HEAD .github/workflows/test.md /usr/bin/git json' --ignore-pgit GO111MODULE ache/go/1.25.0/x--show-toplevel git(http block)/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha --show-toplevel /opt/hostedtoolcache/go/1.25.0/xtest@example.com /usr/bin/git te '**/*.cjs' '*git go rgo/bin/sh git rev-�� --show-toplevel git /usr/bin/git rite '../../../*git diff ache/node/24.14.--show-toplevel git(http block)https://api.github.com/repos/actions/github-script/git/ref/tags/v8/usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha -json GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env h ../../../.prettierignore GO111MODULE modules/@npmcli/run-script/lib/node-gyp-bin/node GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linu-d(http block)/usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha h ../../../.pret.prettierignore GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linu../../../**/*.json .cfg�� w/js/**/*.json' --ignore-path GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linuTest User(http block)/usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha h ../../../.prettierignore GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linu-k deql�� .cfg GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linurev-parse(http block)https://api.github.com/repos/actions/setup-go/git/ref/tags/v4/usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq .object.sha GOMODCACHE 64/pkg/tool/linu-buildtags /usr/bin/git kflow/pip_validagit GO111MODULE 64/pkg/tool/linu--show-toplevel git add .github/workflows/test.md 64/pkg/tool/linu-tests /usr/bin/git json' --ignore-pgit GO111MODULE ules/.bin/pretti--show-toplevel git(http block)https://api.github.com/repos/actions/setup-node/git/ref/tags/v4/usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq .object.sha GOMODCACHE 64/pkg/tool/linu-buildtags /opt/hostedtoolcache/node/24.14.0/x64/bin/node kflow/pip_validagit GO111MODULE 64/pkg/tool/linu--show-toplevel node /tmp�� /home/REDACTED/work/gh-aw/gh-aw/.github/workflows/ace-editor.md 64/pkg/tool/linuconfig /usr/bin/git json' --ignore-pgit GO111MODULE 64/pkg/tool/linu--show-toplevel git(http block)https://api.github.com/repos/actions/upload-artifact/git/ref/tags/v4/usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq .object.sha "prettier" --write '**/*.cjs' '**/*.ts' '**/*.json' --ignore-pat-c=4 owner g_.a 0 -j ACCEPT node /opt�� ithub-script/git/ref/tags/v8 --write 0/x64/bin/node !../../../pkg/wogit --ignore-path ../../../.pretti--show-toplevel ache/go/1.25.0/x64/pkg/tool/linux_amd64/compile(http block)https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v0.1.2/usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0.1.2 --jq .object.sha -bool -buildtags(http block)https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.0.0/usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq .object.sha runs/20260328-183916-31752/test-2849486832/.github/workflows **/*.cjs 8766252/b376/vet.cfg l --ignore-path ../../../.pretti--show-toplevel sh -c "prettier" --write '../../../**/*.json' '!../../../pkg/workflow/js/**/*.json' ---exec l /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/vet rror GO111MODULE x_amd64/vet /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/vet(http block)https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.2.3/usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq .object.sha 3916-31752/test-3035844307 **/*.cjs /home/REDACTED/node_modules/.bin/sh **/*.json --ignore-path ../../../.pretti--show-toplevel sh -c UpdateDiscussionFieldEnforcement1822207958/001 x_amd64/vet /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/vet l GO111MODULE run-script/lib/n--show-toplevel /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linuv1.0.0(http block)https://api.github.com/repos/github/gh-aw/actions/runs/1/artifacts/usr/bin/gh gh run download 1 --dir test-logs/run-1 GO111MODULE n-dir/sh GOINSECURE GOMOD GOMODCACHE ache/go/1.25.0/x64/pkg/tool/linu--jq 0051�� */*.ts' '**/*.json' --ignore-path ../../../.pret.prettierignore GO111MODULE t GOINSECURE GOMOD GOMODCACHE /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linu../../../**/*.json(http block)https://api.github.com/repos/github/gh-aw/actions/runs/12345/artifacts/usr/bin/gh gh run download 12345 --dir test-logs/run-12345 GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet 0051�� */*.ts' '**/*.json' --ignore-path ../../../.prettierignore GO111MODULE 64/bin/sh GOINSECURE GOMOD GOMODCACHE /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linu../../../**/*.json(http block)https://api.github.com/repos/github/gh-aw/actions/runs/12346/artifacts/usr/bin/gh gh run download 12346 --dir test-logs/run-12346 GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet 0051�� */*.ts' '**/*.json' --ignore-path ../../../.prettierignore GO111MODULE /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linu../../../**/*.json(http block)https://api.github.com/repos/github/gh-aw/actions/runs/2/artifacts/usr/bin/gh gh run download 2 --dir test-logs/run-2 GO111MODULE 86_64/sh GOINSECURE GOMOD GOMODCACHE ache/go/1.25.0/x64/pkg/tool/linux_amd64/vet 0051�� */*.ts' '**/*.json' --ignore-path ../../../.pret.prettierignore GO111MODULE rgo/bin/git GOINSECURE GOMOD GOMODCACHE /opt/hostedtoolcache/go/1.25.0/xremote.origin.url(http block)https://api.github.com/repos/github/gh-aw/actions/runs/3/artifacts/usr/bin/gh gh run download 3 --dir test-logs/run-3 GO111MODULE alidatePipPackageName GOINSECURE GOMOD GOMODCACHE ache/go/1.25.0/x64/pkg/tool/linux_amd64/vet estl�� */*.ts' '**/*.json' --ignore-path ../../../.pret.prettierignore GO111MODULE nfig/composer/vendor/bin/git GOINSECURE GOMOD GOMODCACHE /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linu../../../**/*.json(http block)https://api.github.com/repos/github/gh-aw/actions/runs/4/artifacts/usr/bin/gh gh run download 4 --dir test-logs/run-4 GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet 0051�� */*.ts' '**/*.json' --ignore-path ../../../.pret.prettierignore GO111MODULE p/bin/git GOINSECURE GOMOD GOMODCACHE /opt/hostedtoolcache/go/1.25.0/xTest User(http block)https://api.github.com/repos/github/gh-aw/actions/runs/5/artifacts/usr/bin/gh gh run download 5 --dir test-logs/run-5 GO111MODULE 64/bin/sh GOINSECURE GOMOD GOMODCACHE ache/go/1.25.0/x64/pkg/tool/linutest@example.com 0051�� */*.ts' '**/*.json' --ignore-path ../../../.pret.prettierignore GO111MODULE tnet/tools/git GOINSECURE GOMOD GOMODCACHE /opt/hostedtoolcache/go/1.25.0/xtest@example.com(http block)https://api.github.com/repos/github/gh-aw/actions/workflows/usr/bin/gh gh workflow list --json name,state,path -json GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet /pre�� -json GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet(http block)/usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 100 GOMOD GOMODCACHE 64/pkg/tool/linu-buildtags /pre�� kflow/pip_valida-errorsas GO111MODULE 64/pkg/tool/linu-nilfunc GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linurev-parse(http block)/usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 6 GOMOD GOMODCACHE x_amd64/vet 0/x6�� -json GO111MODULE t GOINSECURE GOMOD GOMODCACHE /opt/hostedtoolc/tmp/go-build3528766252/b446/_testmain.go(http block)https://api.github.com/repos/github/gh-aw/git/ref/tags/v0.47.4/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v0.47.4 --jq .object.sha --show-toplevel x_amd64/compile /usr/bin/git(http block)https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.0.0/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq .object.sha y-test.md GO111MODULE p/bin/bash GOINSECURE GOMOD GOMODCACHE bash --no�� ithout_min-integrity535144417/001 GOPROXY tions/node_modules/.bin/node GOSUMDB GOWORK 64/bin/go /opt/hostedtoolcache/go/1.25.0/x-buildtags(http block)https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.2.3/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq .object.sha .cfg GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linu-buildtags .cfg�� -json GO111MODULE 64/pkg/tool/linu-nilfunc GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linuconfig(http block)https://api.github.com/repos/github/gh-aw/git/ref/tags/v2.0.0/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq .object.sha .cfg GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linu-buildtags env .cfg GO111MODULE 64/pkg/tool/linu-nilfunc GOINSECURE _value"]."\n"; GOMODCACHE 64/pkg/tool/linurev-parse(http block)/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq .object.sha .cfg GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linu-buildtags env .cfg GO111MODULE 64/pkg/tool/linu-nilfunc GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linuconfig(http block)/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq .object.sha w/js/**/*.json' --ignore-path GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linu-trimpath .cfg�� -json GO111MODULE ode_modules/.bin-lang=go1.25 GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linuconfig(http block)https://api.github.com/repos/github/gh-aw/git/ref/tags/v3.0.0/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq .object.sha .cfg GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linu-importcfg .cfg�� -json GO111MODULE 64/pkg/tool/linu-buildmode=exe GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linu-extld=gcc(http block)https://api.github.com/repos/nonexistent/action/git/ref/tags/v999.999.999/usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq .object.sha y-test.md GO111MODULE 0/x64/bin/sh GOINSECURE GOMOD GOMODCACHE /opt/hostedtoolcache/go/1.25.0/xrev-parse -fla�� ut1484626923/001 GOPROXY ules/.bin/node GOSUMDB GOWORK 64/bin/go /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linu-buildtags(http block)https://api.github.com/repos/nonexistent/repo/actions/runs/12345/usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion GOINSECURE GOMOD GOMODCACHE ache/go/1.25.0/xTest User tion�� 0051486/b355/vet.cfg GO111MODULE bin/sh GOINSECURE GOMOD GOMODCACHE /opt/hostedtoolcache/go/1.25.0/x-test.v=true(http block)https://api.github.com/repos/owner/repo/actions/workflows/usr/bin/gh gh workflow list --json name,state,path --repo owner/repo x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet /pre�� -json GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet(http block)/usr/bin/gh gh workflow list --json name,state,path --repo owner/repo x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env -json GO111MODULE 64/pkg/tool/linu../../../.prettierignore GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet(http block)https://api.github.com/repos/owner/repo/contents/file.md/tmp/go-build3528766252/b403/cli.test /tmp/go-build3528766252/b403/cli.test -test.testlogfile=/tmp/go-build3528766252/b403/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true GOINSECURE GOMOD GOMODCACHE x_amd64/vet env h ../../../.prettierignore GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linu../../../**/*.json(http block)https://api.github.com/repos/test-owner/test-repo/actions/secrets/usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name -json GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet /pre�� -json GO111MODULE(http block)If you need me to access, download, or install something from one of these locations, you can either:
📱 Kick off Copilot coding agent tasks wherever you are with GitHub Mobile, available on iOS and Android.