[aw-compat] Add gh aw fix codemod to auto-set checkout: false for safe pull_request_target workflows#30596
Merged
pelikhan merged 4 commits intoMay 6, 2026
Conversation
Agent-Logs-Url: https://github.com/github/gh-aw/sessions/8fc72079-dcdf-4017-a453-b3bf2e95c81d Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copilot
AI
changed the title
[WIP] Codemod proposal to auto-add checkout: false for pull_request_target workflows
[aw-compat] Add May 6, 2026
gh aw fix codemod to auto-set checkout: false for safe pull_request_target workflows
Collaborator
|
@copilot do not apply on strict: false |
Agent-Logs-Url: https://github.com/github/gh-aw/sessions/c0473d4c-ba64-497f-8db3-2996c6cf034a Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
Implemented in 92a85e2. The codemod now exits early when frontmatter explicitly sets Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
Contributor
There was a problem hiding this comment.
Pull request overview
Adds a new gh aw fix codemod to automatically enforce checkout: false for safe pull_request_target workflows, along with registry and test updates to ensure deterministic inclusion and ordering.
Changes:
- Added
pull-request-target-checkout-falsecodemod to insert/normalizecheckout: falsewhenon.pull_request_targetis present and no explicit checkout usage is detected. - Registered the new codemod in
GetAllCodemods()and updated registry tests (count, inclusion, order). - Added focused unit tests covering apply/skip scenarios for the new codemod.
Show a summary per file
| File | Description |
|---|---|
| pkg/cli/fix_codemods.go | Registers the new codemod in the global codemod list (deterministic order). |
| pkg/cli/fix_codemods_test.go | Updates registry tests to account for the new codemod (count/inclusion/order). |
| pkg/cli/codemod_pull_request_target_checkout_false.go | Implements the new codemod logic and safety gating. |
| pkg/cli/codemod_pull_request_target_checkout_false_test.go | Adds unit tests for apply/skip behavior of the new codemod. |
Copilot's findings
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 4/4 changed files
- Comments generated: 2
Comment on lines
+154
to
+162
| if idx := strings.Index(valueAndComment, "#"); idx >= 0 { | ||
| comment = valueAndComment[idx:] | ||
| } | ||
|
|
||
| if comment == "" { | ||
| return "checkout: false", true | ||
| } | ||
|
|
||
| return "checkout: false" + comment, true |
Comment on lines
+81
to
+88
|
|
||
| func hasExplicitCheckoutCommands(content string) bool { | ||
| lowerContent := strings.ToLower(content) | ||
|
|
||
| unsafeCheckoutPatterns := []string{ | ||
| "actions/checkout", | ||
| "uses: actions/checkout", | ||
| "gh pr checkout", |
Collaborator
|
@copilot review all comments |
Agent-Logs-Url: https://github.com/github/gh-aw/sessions/0073254c-cad5-42a7-99c7-3a3e8d2e370b Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Daily cross-repo compile audits show
pull_request_targetwithoutcheckout: falseas the top failure mode, andgh aw fixdid not remediate it. This PR adds a targeted codemod so safe cases are auto-fixed duringgh aw fix --write.What changed
pull-request-target-checkout-false.on.pull_request_targetis presentcheckout: falseis missing (orcheckout: true)checkout: false.Safety gating (no auto-fix in risky/ambiguous cases)
actions/checkoutgh pr checkoutgit checkoutrefs/pull/strict: falseRegistry + coverage updates
GetAllCodemods()in deterministic order.strict: falseno-op behavior.> [!WARNING]
>
>