Mitigate `github-env` injection risk in `dev-hawk` by switching GH_HOST propagation to step outputs by Copilot · Pull Request #27219 · github/gh-aw

Copilot · 2026-04-19T20:02:50Z

The static-analysis report flagged a high-severity github-env finding in dev-hawk: GH_HOST was written to $GITHUB_ENV, creating cross-step env injection risk. This change scopes host derivation to step output wiring instead of global job env mutation.

ghes-host-config: replace global env write with step output
- GH_HOST derivation from GITHUB_SERVER_URL remains unchanged.
- Output is now emitted via $GITHUB_OUTPUT as gh_host.
Process Safe Outputs: consume scoped host output
- Adds GH_HOST: ${{ steps.ghes-host-config.outputs.gh_host }} in step env.
- Preserves downstream host behavior while removing dependency on $GITHUB_ENV mutation.

Illustrative diff

- echo "GH_HOST=${GH_HOST}" >> "$GITHUB_ENV"
+ echo "gh_host=${GH_HOST}" >> "$GITHUB_OUTPUT"

  - name: Process Safe Outputs
    env:
+     GH_HOST: ${{ steps.ghes-host-config.outputs.gh_host }}
      GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }}

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

https://api.github.com/graphql
- Triggering command: /usr/bin/gh gh repo view --json owner,name --jq .owner.login + "/" + .name 64/pkg/tool/linux_amd64/vet GOINSECURE ntio/asm/keyset GOMODCACHE 64/pkg/tool/linux_amd64/vet (http block)
- Triggering command: /usr/bin/gh gh repo view owner/repo env 0296086/b211/_pkg_.a d2UJ/DbmGN00V4XBV3gqgd2UJ ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet stlo�� 0296086/b072/importcfg SgUm/-evxfJf9jMJ1iP8YSgUm cfg -n1 --format=format:config --end-of-options--get-regexp ache/go/1.25.8/x^remote\..*\.gh-resolved$ (http block)
- Triggering command: /usr/bin/gh gh repo view owner/repo env 729692799 hxms/bWOB0OjYPOs06SIChxms cfg GOINSECURE g/x/text/transforev-parse GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linu-buildtags -c t3995678989/.github/workflows _isA/iz-VlEV3Z-CBIoY6_isA cfg -n1 --format=format:config --end-of-options--get-regexp ache/go/1.25.8/x^remote\..*\.gh-resolved$ (http block)
https://api.github.com/orgs/test-owner/actions/secrets
- Triggering command: /usr/bin/gh gh api /orgs/test-owner/actions/secrets --jq .secrets[].name -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
- Triggering command: /usr/bin/gh gh api /orgs/test-owner/actions/secrets --jq .secrets[].name -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env 38e31520e5ec228f-d GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
https://api.github.com/repos/actions/ai-inference/git/ref/tags/v1
- Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq [.object.sha, .object.type] | @tsv -v 64/pkg/tool/linux_amd64/vet /usr/bin/gh 511239593/.githugit GO111MODULE 64/pkg/tool/linu--show-toplevel gh repo�� view owner/repo /usr/bin/git 729692799 hxms/bWOB0OjYPOsinstall cfg git (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq [.object.sha, .object.type] | @tsv --show-toplevel go /usr/bin/git mLsRemoteWithReagit mLsRemoteWithRearev-parse tions/setup/js/n--show-toplevel git rev-�� --show-toplevel go /usr/bin/git -json GO111MODULE 64/pkg/tool/linu--package-lock-only git (http block)
https://api.github.com/repos/actions/checkout/git/ref/tags/v3
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq [.object.sha, .object.type] | @tsv thImports1121821336/001 x_amd64/compile /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/link -json GO111MODULE x_amd64/vet /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/link -o /tmp/go-build827741142/b449/styles.test -importcfg /usr/bin/git -s -w -buildmode=exe git (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq [.object.sha, .object.type] | @tsv --bare --initial-branch=master /usr/bin/git -json GO111MODULE /sh git -C /tmp/gh-aw-test-runs/20260419-201710-79363/test-3462411020/.github/workflows rev-parse /usr/bin/git ath ../../../.prgit GO111MODULE 64/bin/go git (http block)
https://api.github.com/repos/actions/checkout/git/ref/tags/v5
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq [.object.sha, .object.type] | @tsv MAg8cFm05 741142/b103/vet.cfg ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet -p slices -lang=go1.25 ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet stlo�� /tmp/go-build1520296086/b186/_pkg_.a tmain.go 64/pkg/tool/linux_amd64/compile -p crypto/ed25519 -lang=go1.25 64/pkg/tool/linux_amd64/compile (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq [.object.sha, .object.type] | @tsv --show-toplevel til.test /usr/bin/git 68/001/test-simpgit 741142/b052/vet.rev-parse 64/pkg/tool/linu--show-toplevel git rev-�� --show-toplevel 64/pkg/tool/linu^remote\..*\.gh-resolved$ /usr/bin/git 936/001/stabilitgit o rtcfg.link git (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq [.object.sha, .object.type] | @tsv --show-toplevel /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/vet 64/bin/node -bool -buildtags ache/go/1.25.8/x--show-toplevel git 1/x6�� --show-toplevel ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet /usr/bin/git run --auto 1/x64/bin/node git (http block)
https://api.github.com/repos/actions/checkout/git/ref/tags/v6
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv f1es/1UYObWDf37qxec6Bf1es x_amd64/compile 1/x64/bin/node -json x86.go x_amd64/compile 1/x64/bin/node rev-�� k/gh-aw/gh-aw/pkg/styles/huh_theme.go k/gh-aw/gh-aw/pkg/styles/theme.go om/myorg/repo.git 01 GO111MODULE layTitle git (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv ../../../.pretti-json sh .git "prettier" --wrigit git 64/bin/go git rev-�� -aw/git/ref/tags/v2.0.0 go ache/node/24.14.1/x64/bin/node -json GO111MODULE 64/bin/go ache/node/24.14.1/x64/bin/node (http block)
https://api.github.com/repos/actions/github-script/git/ref/tags/v8
- Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq [.object.sha, .object.type] | @tsv --show-toplevel ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet /usr/bin/git se 741142/b243/vet.rev-parse tartedAt,updatedHEAD git rev-�� --show-toplevel ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet /usr/bin/git /tmp/go-build152git -trimpath 1/x64/bin/node git (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq [.object.sha, .object.type] | @tsv --show-toplevel go /usr/bin/git vaScript21255025git GO111MODULE .cfg git rev-�� --show-toplevel go /usr/bin/git CompiledOutput35git GO111MODULE ache/go/1.25.8/x--show-toplevel git (http block)
https://api.github.com/repos/actions/github-script/git/ref/tags/v9
- Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE x_amd64/asm GOINSECURE GOMOD GOMODCACHE x_amd64/asm env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv -json 1.5.0/internal/mcpgodebug/mcpgodebug.go x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json GO111MODULE x_amd64/vet GOINSECURE jsonrpc2 GOMODCACHE x_amd64/vet (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet (http block)
https://api.github.com/repos/actions/setup-go/git/ref/tags/v4
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --git-dir x_amd64/vet /opt/hostedtoolcache/node/24.14.1/x64/bin/node _.a GO111MODULE 64/pkg/tool/linu--show-toplevel node /tmp�� /home/REDACTED/work/gh-aw/gh-aw/.github/workflows/api-consumption-report.md 64/pkg/tool/linux_amd64/vet /usr/bin/git dfWiE9R6S om/goccy/go-yamlrev-parse 64/pkg/tool/linu--show-toplevel git (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --show-toplevel go /usr/bin/git -json GO111MODULE 64/bin/go git rev-�� --show-toplevel go /usr/bin/git 64/001/test-emptgit GO111MODULE 86_64/node git (http block)
https://api.github.com/repos/actions/setup-node/git/ref/tags/v4
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv user.name Test User 741142/b470/vet.cfg SaeZgGgAk GO111MODULE 64/pkg/tool/linu--show-toplevel node /tmp�� /home/REDACTED/work/gh-aw/gh-aw/.github/workflows/ai-moderator.md 64/pkg/tool/linux_amd64/vet /usr/bin/git 0296086/b074/_pkgit cfg 64/pkg/tool/linu--show-toplevel git (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --show-toplevel go /usr/bin/git -json GO111MODULE x_amd64/vet git rev-�� --show-toplevel x_amd64/vet /usr/bin/git -json GO111MODULE 1/x64/lib/node_m--show-toplevel git (http block)
https://api.github.com/repos/actions/upload-artifact/git/ref/tags/v4
- Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv /tmp/go-build827741142/b434/_pkg_.a -trimpath 741142/b432/vet.cfg -p main -lang=go1.25 git conf�� runs/20260419-200953-52022/test-1802791344 s/4/artifacts 741142/b453/vet.cfg s/test.md -c=4 -nolocalimports gh (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv licyMinIntegrityOnlymin-integrity_only_defaults_repo123494660/00remote.origin.url **/*.cjs /usr/bin/git l --ignore-path ../../../.pretti--show-toplevel git stat�� --porcelain go /bin/sh -json GO111MODULE 64/bin/go /bin/sh (http block)
https://api.github.com/repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b
- Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq [.object.sha, .object.type] | @tsv --count st/suppress-warnmain $name) { hasDiscussionsEnabled } } README.md ion-test..token--c k/node_modules/.git config user.name 'Test User' st/dist/workers/-dwarf=false show�� --verify 38ba552c odules/npm/node_-nolocalimports token-test.txt (http block)
- Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq [.object.sha, .object.type] | @tsv --count 38ba552c..HEAD k/gh-aw/gh-aw/actions/node_modules/.bin/git README.md ion-test..token-add ode_modules/.bin. git show�� --verify 38ba552c tnet/tools/git token-test.txt (http block)
- Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq [.object.sha, .object.type] | @tsv latted/flatted.go :latest $name) { hasDiscussionsEnabled } } l ings.cjs 1/x64/bin/git git -C ithub/workflows show /usr/bin/git a81a71f9491c0e85git iles,SysoFiles,C-C DiscussionsEnabl/home/REDACTED/work/gh-aw/gh-aw/.github/workflows git (http block)
https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v0.1.2
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0.1.2 --jq [.object.sha, .object.type] | @tsv -aw/git/ref/tags/v1.0.0 test@example.com bject.type] | @tsv -h gh-aw.wasm |git 1Yg0zHCmd 64/pkg/tool/linu--show-toplevel node /tmp�� /home/REDACTED/work/gh-aw/gh-aw/.github/workflows/agent-performance-analyzer.md 64/pkg/tool/linux_amd64/vet /usr/bin/gh ortcfg cfg 64/pkg/tool/linu--show-toplevel gh (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0.1.2 --jq [.object.sha, .object.type] | @tsv user.name Test User /usr/bin/git -json GO111MODULE x_amd64/vet git rev-�� --show-toplevel x_amd64/vet /usr/bin/git -json GO111MODULE 1/x64/bin/npx git (http block)
https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.0.0
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq [.object.sha, .object.type] | @tsv list --json /usr/bin/git 137364025/001' 137364025/001' -importcfg git -C /tmp/compile-all-instructions-test-3895228015/.github/workflows s/test.md /opt/hostedtoolcache/node/24.14.1/x64/bin/node -json age/common.go x_amd64/compile node (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq [.object.sha, .object.type] | @tsv licyMinIntegrityOnlyCompiledOutput2295310345/001 sh /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/vet l ache/go/1.25.8/xrev-parse 64/bin/go /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/vet -V=f�� /node go /usr/bin/git -json GO111MODULE 64/bin/go git (http block)
https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.2.3
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq [.object.sha, .object.type] | @tsv r-test557434323/existing.md -trimpath ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile -p main -lang=go1.25 ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile remo�� 741142/b469/_pkg_.a -dwarf=false 741142/b469=> go1.25.8 b/gh-aw/scripts -nolocalimports node (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq [.object.sha, .object.type] | @tsv 1710-79363/test-2090338310 --check /bin/sh --ignore-path .prettierignore 64/bin/go /bin/sh -c k/gh-aw/gh-aw go /usr/lib/git-core/git -json GO111MODULE 64/bin/go /usr/lib/git-core/git (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/1/artifacts
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/1/artifacts --jq .artifacts[].name GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE fips140 GOMODCACHE 64/pkg/tool/linux_amd64/vet env 0296086/b218/_pkg_.a i2Jk/kxQktkbJrdZm0O72i2Jk x_amd64/compile GOINSECURE g/x/text/unicoderev-parse GOMODCACHE x_amd64/compile (http block)
- Triggering command: /usr/bin/gh gh run download 1 --dir test-logs/run-1 cfg 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD 0296086/b012/sym--show-toplevel 64/pkg/tool/linux_amd64/vet ache�� 0296086/b255/_pkg_.a fWCy/na03iXLzDBM34i--fWCy ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet (http block)
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/1/artifacts --jq .artifacts[].name go om/owner/repo.git -json GO111MODULE 64/bin/go node /tmp�� /home/REDACTED/work/gh-aw/gh-aw/.github/workflows/artifacts-summary.md go /usr/bin/git -json GO111MODULE 64/bin/go git (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/12345/artifacts
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12345/artifacts --jq .artifacts[].name cfg 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet env ithub/workflows GO111MODULE ache/go/1.25.8/x64/pkg/tool/linu-nilfunc GOINSECURE GOMOD 0296086/b078/sym--show-toplevel ache/go/1.25.8/x64/pkg/tool/linuorigin (http block)
- Triggering command: /usr/bin/gh gh run download 12345 --dir test-logs/run-12345 GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linu-buildtags env 1138447800 QuTc/8J1aAAdvjhK-ifaceassert 64/pkg/tool/linu-nilfunc GOINSECURE fips140/tls13 GOMODCACHE 64/pkg/tool/linu-tests (http block)
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12345/artifacts --jq .artifacts[].name config (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/12346/artifacts
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12346/artifacts --jq .artifacts[].name GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE 0296086/b078/ GOMODCACHE 64/pkg/tool/linux_amd64/vet env ithub/workflows l_test.go cfg GOINSECURE GOMOD 0296086/b078/sym--show-toplevel ache/go/1.25.8/x64/pkg/tool/linutest@example.com (http block)
- Triggering command: /usr/bin/gh gh run download 12346 --dir test-logs/run-12346 GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linu/tmp/go-build827741142/b114/vet.cfg env 1138447800 GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE fips140/mlkem GOMODCACHE 64/pkg/tool/linux_amd64/compile (http block)
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12346/artifacts --jq .artifacts[].name remote /usr/bin/gh ath ../../../.prgit GO111MODULE 64/bin/go gh api /repos/actions/github-script/git/ref/tags/v9 --jq /usr/bin/git -json GO111MODULE 64/bin/go git (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/2/artifacts
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/2/artifacts --jq .artifacts[].name GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE fips140/sha256 GOMODCACHE 64/pkg/tool/linuTest User env 0296086/b206/_pkg_.a t2Bi/LbyKJAzlPTfrrG8ct2Bi cfg GOINSECURE hpke GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linu-test.v=true (http block)
- Triggering command: /usr/bin/gh gh run download 2 --dir test-logs/run-2 cfg 64/pkg/tool/linux_amd64/vet GOINSECURE (http block)
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/2/artifacts --jq .artifacts[].name show /usr/bin/gh -json GO111MODULE 64/bin/go gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq /usr/bin/infocmp -json GO111MODULE 64/bin/go infocmp (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/3/artifacts
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/3/artifacts --jq .artifacts[].name GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE fips140/sha3 GOMODCACHE 64/pkg/tool/linutest@example.com env 3553878033 Ldjv/q8rDzC5dO2KyVIFwLdjv 64/pkg/tool/linux_amd64/vet GOINSECURE g/x/text/unicoderev-parse GOMODCACHE 64/pkg/tool/linux_amd64/vet (http block)
- Triggering command: /usr/bin/gh gh run download 3 --dir test-logs/run-3 cfg 64/pkg/tool/linux_amd64/vet GOINSECURE hlite 0296086/b007/symabis 64/pkg/tool/linux_amd64/vet ache�� 0296086/b241/_pkg_.a _zAe/m6K4S-499xrKjIdi_zAe ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet GOINSECURE t/internal/langurev-parse GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet (http block)
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/3/artifacts --jq .artifacts[].name rev-parse om/org2/repo.git -json GO111MODULE 64/bin/go infocmp -1 xterm-color go /usr/bin/git -json GO111MODULE 64/bin/go git (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/4/artifacts
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/4/artifacts --jq .artifacts[].name GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE randutil GOMODCACHE 64/pkg/tool/linux_amd64/vet env 3553878033 SZyr/UNQkpBpW_IvLZuHOSZyr 64/pkg/tool/linux_amd64/vet GOINSECURE g/x/text/secure/rev-parse GOMODCACHE 64/pkg/tool/linux_amd64/vet (http block)
- Triggering command: /usr/bin/gh gh run download 4 --dir test-logs/run-4 cfg 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD 0296086/b007/symuser.name 64/pkg/tool/linuTest User env 0296086/b245/_pkg_.a r73k/ZR15bOYtzO_sNGC5r73k ck GOINSECURE t/internal/strinrev-parse GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet (http block)
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/4/artifacts --jq .artifacts[].name remote /opt/hostedtoolcache/node/24.14.1/x64/bin/node -json GO111MODULE 64/bin/go node /tmp�� /home/REDACTED/work/gh-aw/gh-aw/.github/workflows/artifacts-summary.md go /usr/bin/gh -json GO111MODULE 64/bin/go gh (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/5/artifacts
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/5/artifacts --jq .artifacts[].name GO111MODULE 64/pkg/tool/linu-nolocalimports GOINSECURE fips140/sha512 GOMODCACHE 64/pkg/tool/linu/tmp/go-build827741142/b451/_testmain.go env 3553878033 ZDcH/WlCyhVRj9mWQyquJZDcH cfg GOINSECURE GOMOD GOMODCACHE ylQP4Z8/vCNYLdc7D8RXanEmFBss (http block)
- Triggering command: /usr/bin/gh gh run download 5 --dir test-logs/run-5 cfg 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet env 0296086/b253/_pkg_.a GO111MODULE ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet GOINSECURE /semver GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet (http block)
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/5/artifacts --jq .artifacts[].name l /opt/hostedtoolcache/node/24.14.1/x64/bin/node remote.origin.urgit GO111MODULE 64/bin/go node /tmp�� /home/REDACTED/work/gh-aw/gh-aw/.github/workflows/architecture-guardian.md go (http block)
https://api.github.com/repos/github/gh-aw/actions/workflows
- Triggering command: /usr/bin/gh gh workflow list --json name,state,path 137364025/001' 137364025/001' -importcfg /tmp/go-build827741142/b418/importcfg -pack /home/REDACTED/work/gh-aw/gh-aw/pkg/fileutil/fileutil.go /home/REDACTED/work/gh-aw/gh-aw/pkg/fileutil/tar.go env -json age/common.go x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
- Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 100 GOMOD GOMODCACHE x_amd64/vet env -json GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet (http block)
- Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 6 ntio/asm/cpu/cpuinit GOMODCACHE 64/pkg/tool/linux_amd64/vet env edOutput4239551748/001 GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE b/gh-aw/pkg/strirev-parse GOMODCACHE 64/pkg/tool/linux_amd64/vet (http block)
https://api.github.com/repos/github/gh-aw/contents/.github/workflows/shared/reporting.md
- Triggering command: /tmp/go-build827741142/b403/cli.test /tmp/go-build827741142/b403/cli.test -test.testlogfile=/tmp/go-build827741142/b403/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
- Triggering command: /tmp/go-build2561330876/b403/cli.test /tmp/go-build2561330876/b403/cli.test -test.testlogfile=/tmp/go-build2561330876/b403/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
https://api.github.com/repos/github/gh-aw/git/ref/tags/v0.47.4
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v0.47.4 --jq [.object.sha, .object.type] | @tsv --show-toplevel ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet /usr/bin/git 9R6S/LibFNih3wtfgit pkg/mod/github.crev-parse cfg git rev-�� --show-toplevel ache/go/1.25.8/x64/pkg/tool/linumyorg /usr/bin/git ExpressionCompills -trimpath ache/go/1.25.8/x/tmp/gh-aw/aw-feature-branch.patch git (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v0.47.4 --jq [.object.sha, .object.type] | @tsv --show-toplevel go /usr/bin/git vaScript21255025git GO111MODULE 1/x64/bin/node git rev-�� 81847732/001 go clusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle SameOutput298687ls GO111MODULE ache/go/1.25.8/x/tmp/gh-aw/aw-feature-branch.patch git (http block)
https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.0.0
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq [.object.sha, .object.type] | @tsv 3325533966/001 HCmd/oMQac4bC0uy1Yg0zHCmd ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env -json GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.2.3
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env -json GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go 0886�� -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
https://api.github.com/repos/github/gh-aw/git/ref/tags/v2.0.0
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env flags="-w -s" -o gh-aw.wasm ./cmd/gh-aw-wasm GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env lGitmain_branch4137364025/001' lGitmain_branch4137364025/001' x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq [.object.sha, .object.type] | @tsv bytealg/indexbyte_wasm.s GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env g_.a GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet (http block)
https://api.github.com/repos/github/gh-aw/git/ref/tags/v3.0.0
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE x_amd64/vet GOINSECURE jsonrpc2 GOMODCACHE x_amd64/vet env -json GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go 0886�� -json GO111MODULE ode_modules/.bin/node GOINSECURE GOMOD GOMODCACHE go (http block)
https://api.github.com/repos/nonexistent/action/git/ref/tags/v999.999.999
- Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq [.object.sha, .object.type] | @tsv zu3u/WYeMzep8SbKgk88dzu3u cfg ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linu-trimpath (http block)
- Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env -json GO111MODULE de_modules/.bin/node GOINSECURE GOMOD GOMODCACHE go (http block)
https://api.github.com/repos/nonexistent/repo/actions/runs/12345
- Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet env 3325533966/001 G1PQ/JYbkfQ24WgmEFuVqG1PQ 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet (http block)
- Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion -json GO111MODULE 64/bin/go git rev-�� --show-toplevel go /usr/bin/git -json GO111MODULE 64/bin/go git (http block)
https://api.github.com/repos/owner/repo/actions/workflows
- Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
- Triggering command: /usr/bin/gh gh workflow list --repo owner/repo --json name,path,state cfg GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet (http block)
- Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo 64/bin/go GOINSECURE GOMOD GOMODCACHE go env e53be12a4b6ee6d0-d GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
https://api.github.com/repos/test-owner/test-repo/actions/secrets
- Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json 1.5.0/internal/jsonrpc2/conn.go x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
- Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name d GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env h ../../../.prettierignore GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
https://api.github.com/repos/test/repo
- Triggering command: /usr/bin/gh gh api /repos/test/repo --jq .default_branch 2560941815/.github/workflows 0296086/b012/importcfg ache/go/1.25.8/x64/pkg/tool/linu-nolocalimports GOINSECURE b/gh-aw/pkg/actirev-parse GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linuconfig (http block)
- Triggering command: /usr/bin/gh gh api /repos/test/repo --jq .default_branch test.txt go /usr/bin/git json' --ignore-pgh GO111MODULE 64/bin/go git rev-�� --show-toplevel go /usr/bin/git 67/001 GO111MODULE x_amd64/vet git (http block)
invalid.example.invalid
- Triggering command: /usr/lib/git-core/git-remote-https /usr/lib/git-core/git-remote-https origin https://invalid.example.invalid/nonexistent-repo.git git conf�� --local --get ode_modules/.bin/git cal/bin/git git /git git add . git tions/setup/node_modules/.bin/git -M main bin/git git (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

…_HOST Agent-Logs-Url: https://github.com/github/gh-aw/sessions/73e3406c-65a5-448c-aca0-0bb10f880f8c Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

github-actions · 2026-04-19T21:09:45Z

Hey @Copilot 👋 — nice catch on the github-env injection risk in dev-hawk! Switching GH_HOST propagation to step outputs is the right security hardening move here, and the PR body clearly explains the static-analysis finding and the fix.

One thing to consider before marking this ready:

Tests / verification note — the change is a workflow YAML fix (no Go/JS code), so traditional unit tests don't apply directly. However, it would help reviewers to confirm the dev-hawk workflow still runs end-to-end after the change. Consider adding a brief note in the PR body confirming the workflow was tested (or a link to a passing run with the change applied), so maintainers can verify the output propagation wiring is correct.

Here's a prompt you can give your coding agent if you'd like to automate the verification:

For PR #27219 (Mitigate github-env injection risk in dev-hawk by switching GH_HOST propagation to step outputs):

1. Review the changed steps in .github/workflows/dev-hawk.lock.yml to confirm:
   a. The step that previously wrote `GH_HOST` to $GITHUB_ENV now writes it to $GITHUB_OUTPUT instead.
   b. The consuming step reads GH_HOST via `$\{\{ steps.<step_id>.outputs.GH_HOST }}` (or equivalent).
2. If there is a companion source .md file for dev-hawk, verify it is also updated (or note why it doesn't need changes).
3. Add a short "Verification" section to the PR body noting:
   - The static-analysis rule that triggered this change
   - How the GH_HOST value is now safely propagated
   - Confirmation that no other steps in this workflow write sensitive values to $GITHUB_ENV
4. Run `make recompile` to ensure lock files are up to date with any source changes.

Generated by Contribution Check · ● 1.9M · ◷

pelikhan · 2026-04-19T21:12:47Z

@lpcox fyi

Initial plan

c89f804

Copilot AI assigned Copilot and pelikhan Apr 19, 2026

Copilot started work on behalf of pelikhan April 19, 2026 20:02 View session

Copilot AI linked an issue Apr 19, 2026 that may be closed by this pull request

[static-analysis] Report - 2026-04-19 #27218

Closed

6 tasks

fix(workflows): use step output instead of GITHUB_ENV for dev-hawk GH…

8460d0c

…_HOST Agent-Logs-Url: https://github.com/github/gh-aw/sessions/73e3406c-65a5-448c-aca0-0bb10f880f8c Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Update static analysis report for 2026-04-19 findings~~ Mitigate github-env injection risk in dev-hawk by switching GH_HOST propagation to step outputs Apr 19, 2026

Copilot AI requested a review from pelikhan April 19, 2026 20:25

Copilot finished work on behalf of pelikhan April 19, 2026 20:25

github-actions Bot added the needs-work label Apr 19, 2026

This comment has been minimized.

Sign in to view

github-actions Bot mentioned this pull request Apr 19, 2026

[Contribution Check Report] Contribution Check — 2026-04-19 #27132

Closed

github-actions Bot mentioned this pull request Apr 19, 2026

[aw] No-Op Runs #27099

Closed

pelikhan closed this Apr 19, 2026

github-actions Bot deleted the copilot/static-analysis-report-2026-04-19 branch June 3, 2026 14:30

github-actions Bot mentioned this pull request Sep 5, 2026

[static-analysis] Report - 2026-09-05 #58730

Open

Navigation Menu

Uh oh!

Mitigate `github-env` injection risk in `dev-hawk` by switching GH_HOST propagation to step outputs - #27219

Mitigate `github-env` injection risk in `dev-hawk` by switching GH_HOST propagation to step outputs#27219
pelikhan with Copilot wants to merge 2 commits into
mainfrom
copilot/static-analysis-report-2026-04-19

Copilot AI commented Apr 19, 2026 •

edited

Loading

Uh oh!

This comment has been minimized.

github-actions Bot commented Apr 19, 2026

Uh oh!

pelikhan commented Apr 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

Copilot AI commented Apr 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

This comment has been minimized.

github-actions Bot commented Apr 19, 2026

Uh oh!

pelikhan commented Apr 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Copilot AI commented Apr 19, 2026 •

edited

Loading