Harden Windows Defender release scans by dsyme · Pull Request #58115 · github/gh-aw

dsyme · 2026-09-03T03:09:46Z

Summary

verify release-time Windows binaries against the generated checksum manifest before Defender scans
let the recurring Defender workflow scan an explicitly selected release tag as well as the latest stable release
verify downloaded release assets against the published checksums.txt
preserve scan reports on successful and failed runs and correlate Defender detection history
route checksum-valid release classifications to a deduplicated security tracking issue rather than assuming a source-code fix

Validation

gh aw compile release.md daily-windows-defender-scan.md --strict with actionlint enabled
embedded PowerShell scripts parsed successfully with the Windows PowerShell parser
make recompile
make agent-report-progress
make agent-report-progress-no-test
workflow lock-file drift check passed

Closes #58114

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 22.6 AIC · ⌖ 8.6 AIC · ⊞ 9.2K · ◷
_{Comment /souschef to run again}

Copilot

Copilot review overview

🟡 Changes recommended

Detection-history results and early failures can bypass findings, reporting, and security follow-up.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review tier: Balanced
Findings: 2

New issues introduced by this change (2)

Severity	Finding
	`.github/workflows/daily-windows-defender-scan.md` — The correlation result is report-only: neither returned detections nor the catch-path error is…
	`.github/workflows/daily-windows-defender-scan.md` — `always()` only schedules the upload step; it does not guarantee that a report exists. The…

What changed in this PR

Hardens Windows release scanning with checksum verification, selectable release tags, persistent reports, and Defender detection correlation.

Changes:

Verifies Windows binaries against published checksums.
Supports scanning a selected release tag.
Adds persistent reports and security issue creation.

File	Description
`.github/workflows/release.md`	Adds pre-scan checksum verification.
`.github/workflows/release.lock.yml`	Regenerates the compiled release workflow.
`.github/workflows/daily-windows-defender-scan.md`	Adds tag selection, checksums, reports, detection history, and issue routing.
`.github/workflows/daily-windows-defender-scan.lock.yml`	Regenerates the compiled recurring workflow.

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

+            Get-MpThreatCatalog | ForEach-Object {
+              $threatNames[[string]$_.ThreatID] = $_.ThreatName
+            }
+            $detections = @(



      - name: Upload Defender report
-        if: steps.scan.outputs.has_findings == 'true'
+        if: always()


gh-aw-bot · 2026-09-03T04:57:25Z

@copilot Please address the current review feedback on this PR.

Copilot review identified two findings in .github/workflows/daily-windows-defender-scan.md around detection-history/error handling and guaranteeing a report exists for upload.
Please update the implementation to ensure findings and early failures cannot bypass reporting or security follow-up.
After making the fixes, run the pr-finisher skill and summarize any remaining maintainer-facing blocker.

Generated by PR Sous Chef: https://github.com/github/gh-aw/actions/runs/33716533730

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 26.7 AIC · ⌖ 8.7 AIC · ⊞ 9K · ◷
_{Comment /souschef to run again}

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot · 2026-09-03T05:11:48Z

@copilot Please address the current review feedback on this PR.

Copilot review identified two findings in .github/workflows/daily-windows-defender-scan.md around detection-history/error handling ...

Addressed in 055d8de. Release acquisition failures now produce a release error record, detection-history detections and query errors are added to findings, and an always-run finalization step guarantees report creation and follow-up outputs even when scanning fails.

gh-aw-bot · 2026-09-03T05:41:35Z

@copilot Please address the remaining review feedback on this PR.

Your latest update says the detection-history/reporting issues were fixed at 055d8de, but the blocking Copilot review still reflects the pre-fix state.
Please request or trigger a fresh review pass, confirm the current head still includes the reporting/follow-up guarantees, and run the pr-finisher skill before handing back to maintainers.
Summarize any remaining maintainer-facing blocker if one still exists.

Generated by PR Sous Chef: https://github.com/github/gh-aw/actions/runs/33719354085

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 36.8 AIC · ⌖ 8.71 AIC · ⊞ 8.9K · ◷
_{Comment /souschef to run again}

Copilot · 2026-09-03T05:54:09Z

@copilot Please address the remaining review feedback on this PR.

Your latest update says the detection-history/reporting issues were fixed at 055d8de, but the blocking Copilot review still refle...

Confirmed the current head is 055d8de and still contains the safeguards: Defender detections and detection-history errors are added to findings, outputs come from the always-run finalization step, and missing/failed acquisition still creates report.json for upload. A fresh review pass found no changed-file issues; local PR-finisher validation passed.

gh-aw-bot · 2026-09-03T09:50:42Z

@copilot Please take the next forward-progress pass on this PR.

Your latest update says head 055d8de already includes the Defender detection-history/reporting safeguards and that a fresh review pass found no changed-file issues.
Please run the pr-finisher skill, reconcile the stale blocking Copilot review against the current head, and restate the exact remaining maintainer-facing blocker, if any.
If the only remaining work is maintainer review/state refresh, say that explicitly.

Generated by PR Sous Chef: https://github.com/github/gh-aw/actions/runs/33740403993

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 29.2 AIC · ⌖ 8.78 AIC · ⊞ 9.2K · ◷
_{Comment /souschef to run again}

Copilot · 2026-09-03T10:02:24Z

@copilot Please take the next forward-progress pass on this PR.

Your latest update says head 055d8de already includes the Defender detection-history/reporting safeguards and that a fresh review p...

Confirmed head 055d8de still contains the Defender safeguards and the review thread query is clear (no unresolved threads). The only remaining maintainer-facing work is refreshing/re-triggering PR state and CI; no further code changes are needed.

gh-aw-bot · 2026-09-03T11:50:31Z

@copilot Please take the next forward-progress pass on this PR.

Recent follow-up says the current head already contains the Defender reporting safeguards, unresolved review threads are clear, and no further code changes are needed.
Please run the pr-finisher skill and restate the exact remaining maintainer-facing blocker in concise terms.
If the only remaining work is maintainer review or PR-state/CI refresh, say that explicitly.

Generated by PR Sous Chef: https://github.com/github/gh-aw/actions/runs/33751044673

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 18.5 AIC · ⌖ 10.9 AIC · ⊞ 8.9K · ◷
_{Comment /souschef to run again}

Copilot · 2026-09-03T12:04:42Z

@copilot Please take the next forward-progress pass on this PR.

Recent follow-up says the current head already contains the Defender reporting safeguards, unresolved review threads are clear, and n...

Ran the PR-finisher pass. Head 055d8de is clean and retains the detection-history findings and always-run report finalization safeguards; no unresolved review threads remain. The only remaining maintainer-facing blocker is PR-state/CI refresh: a maintainer must re-trigger CI and complete review before merge.

github-actions · 2026-09-03T20:36:40Z

🎉 This pull request is included in a new release.

Release: v0.88.3

Harden Windows Defender release scans

42f27d0

Copilot AI balanced review requested due to automatic review settings September 3, 2026 03:09

dsyme mentioned this pull request Sep 3, 2026

Harden recurring Microsoft Defender checks for released Windows binaries #58114

Closed

12 tasks

Copilot started reviewing on behalf of dsyme September 3, 2026 03:10 View session

Copilot AI reviewed Sep 3, 2026

View reviewed changes

github-actions Bot mentioned this pull request Sep 3, 2026

[pr-sous-chef] PR Sous Chef run report #58057

Closed

Copilot started work on behalf of gh-aw-bot September 3, 2026 04:57 View session

Copilot AI and others added 2 commits September 3, 2026 05:04

Ensure Defender failures produce findings

219a975

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Finalize Defender reports after scan errors

055d8de

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot finished work on behalf of gh-aw-bot September 3, 2026 05:13

Copilot AI requested a review from gh-aw-bot September 3, 2026 05:13

Copilot started work on behalf of gh-aw-bot September 3, 2026 05:42 View session

Copilot finished work on behalf of gh-aw-bot September 3, 2026 05:54

github-actions Bot mentioned this pull request Sep 3, 2026

[pr-review] Daily PR Code Quality Review — 33721066215 #58172

Closed

Copilot started work on behalf of gh-aw-bot September 3, 2026 09:51 View session

Copilot finished work on behalf of gh-aw-bot September 3, 2026 10:02

Copilot started work on behalf of gh-aw-bot September 3, 2026 11:51 View session

Copilot finished work on behalf of gh-aw-bot September 3, 2026 12:05

pelikhan merged commit 6807d79 into main Sep 3, 2026
4 checks passed

pelikhan deleted the fix/defender-release-scanning branch September 3, 2026 14:33

Navigation Menu

Uh oh!

Harden Windows Defender release scans - #58115

Harden Windows Defender release scans#58115
pelikhan merged 3 commits into
mainfrom
fix/defender-release-scanning

dsyme commented Sep 3, 2026 •

edited by github-actions Bot

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

gh-aw-bot commented Sep 3, 2026

Uh oh!

Copilot AI commented Sep 3, 2026

Uh oh!

gh-aw-bot commented Sep 3, 2026

Uh oh!

Copilot AI commented Sep 3, 2026

Uh oh!

gh-aw-bot commented Sep 3, 2026

Uh oh!

Copilot AI commented Sep 3, 2026

Uh oh!

gh-aw-bot commented Sep 3, 2026

Uh oh!

Copilot AI commented Sep 3, 2026

Uh oh!

Uh oh!

github-actions Bot commented Sep 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Uh oh!

Conversation

dsyme commented Sep 3, 2026 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Validation

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

gh-aw-bot commented Sep 3, 2026

Uh oh!

Copilot AI commented Sep 3, 2026

Uh oh!

gh-aw-bot commented Sep 3, 2026

Uh oh!

Copilot AI commented Sep 3, 2026

Uh oh!

gh-aw-bot commented Sep 3, 2026

Uh oh!

Copilot AI commented Sep 3, 2026

Uh oh!

gh-aw-bot commented Sep 3, 2026

Uh oh!

Copilot AI commented Sep 3, 2026

Uh oh!

Uh oh!

github-actions Bot commented Sep 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

dsyme commented Sep 3, 2026 •

edited by github-actions Bot

Loading