Suppress RGS-004 runner-guard false positives for activation-gated jobs - #50370
Merged
Conversation
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copilot
AI
changed the title
[WIP] Fix comment-triggered workflow without author authorization check
Suppress RGS-004 runner-guard false positives for activation-gated jobs
Aug 4, 2026
pelikhan
marked this pull request as ready for review
August 4, 2026 19:50
Contributor
There was a problem hiding this comment.
Pull request overview
Adds filtering for runner-guard RGS-004 false positives on activation-gated compiled workflows.
Changes:
- Parses finding job IDs and filters gated RGS-004 findings.
- Reconstructs transitive workflow job dependencies.
- Adds filtering, path-resolution, and dependency tests.
Show a summary per file
| File | Description |
|---|---|
pkg/cli/runner_guard.go |
Integrates filtering and strict-mode handling. |
pkg/cli/runner_guard_activation_gate.go |
Implements gate detection and finding suppression. |
pkg/cli/runner_guard_activation_gate_test.go |
Tests gate propagation and fail-safe behavior. |
.github/skills/agentic-workflows/SKILL.md |
Removes an invalid documentation reference. |
Review details
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 4/4 changed files
- Comments generated: 3
- Review effort level: Balanced
Comment on lines
+174
to
+176
| // Exit code 1 with no remaining findings means every reported finding was | ||
| // a known false positive that was filtered out, so the scan passes. | ||
| return nil |
Comment on lines
+138
to
+139
| if hasAuthorAssociationCheck(job.If) || anyJobGated(gated, jobNeeds(job.Needs)) { | ||
| gated[jobID] = true |
|
|
||
| gatedJobs, ok := gatedJobsByFile[finding.File] | ||
| if !ok { | ||
| gatedJobs = authorAssociationGatedJobs(resolveRunnerGuardFilePath(gitRoot, finding.File)) |
Contributor
|
🎉 This pull request is included in a new release. Release: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
runner-guard's RGS-004 rule reports 113 findings against
ai-moderator.lock.yml, claiming comment-triggered jobs access secrets without an author authorization check.Verdict: false positive
The compiled job graph is:
pre_activationcarries a static guard compiled fromskip-author-associations:Every other job transitively
needs: pre_activation, so all downstream jobs are skipped when the gate fails. Probing runner-guard 3.1.5 with synthetic workflows confirms it recognizes a step-levelif:referencingauthor_association, but ignores job-levelif:conditions and never followsneeds:edges. No step ordering fix is required.Changes
pkg/cli/runner_guard.go— parsejob_idfrom findings; filter before display and before the strict-mode count. Strict mode no longer errors on exit code 1 when every finding was filtered.pkg/cli/runner_guard_activation_gate.go(new) — reconstructs the job dependency graph from the lock file and computes the transitive closure of jobs gated by anauthor_associationcheck. Drops RGS-004 findings for gated jobs only.pkg/cli/runner_guard_activation_gate_test.go(new) — gate propagation throughneeds:, ungated workflows retaining findings, unresolvable/escaping paths,needs:scalar/list normalization.Generalized across all compiled workflows rather than hardcoded for
ai-moderator, and fail-safe: findings are retained whenever the lock file cannot be resolved, read, or parsed, and paths are validated to stay within the git root.Replaying the real scan output through the filter yields 118 → 5 findings: all 113 RGS-004 suppressed, the 5 unrelated RGS-005 ("Excessive Permissions on Untrusted Trigger") findings retained. Those are pre-existing and out of scope here.