fix(safe_jobs): hoist expression env vars into step `env:` block to prevent run-script guardrail failure#32532

Merged

pelikhan merged 11 commits into

mainfrom

copilot/aw-compat-daily-summary-2026-05-16

May 16, 2026

Commits on May 16, 2026

Initial plan
Copilot
authored
Initial plan: fix safe_jobs.go to hoist GitHub expressions from run scripts into env blocks

Copilot
and
pelikhan
authored
fix(safe_jobs): hoist GitHub expression env vars into step env block to avoid run script inline expressions

Copilot
and
pelikhan
authored
fix(safe_jobs): simplify env key classification to single-pass with sorted slices

Copilot
and
pelikhan
authored
fix(safe_jobs): never write expression-based env vars to GITHUB_OUTPUT to prevent secret leaks

Copilot
and
pelikhan
authored
test(safe_jobs): add integration test verifying expressions never written to GITHUB_OUTPUT in compiled lock file

Copilot
and
pelikhan
authored
fix(safe_jobs): eliminate $GITHUB_OUTPUT writes entirely — inject all env vars directly into step env: blocks

Copilot
and
pelikhan
authored
chore: recompile lock files with updated safe-jobs env var injection

Copilot
and
pelikhan
authored
fix(safe_jobs): remove now-unnecessary Configure Safe Outputs Job Environment Variables step

Copilot
and
pelikhan
authored
Add changeset for safe jobs fix
github-actions[bot]
authored
Merge branch 'main' into copilot/aw-compat-daily-summary-2026-05-16
github-actions[bot]
authored