Pin threat-detect artifacts to independent SHA-256 digests by Copilot · Pull Request #58310 · github/gh-aw

Copilot · 2026-09-03T21:31:11Z

The installer previously verified threat-detect against a checksum downloaded from the same release, coupling the artifact and trust source.

Independent verification
- Embed SHA-256 digests for v0.5.1 Linux amd64 and arm64 artifacts in the immutable setup action.
- Select the expected digest using the detected architecture.
- Stop downloading release-hosted checksums.txt.
Fail-closed behavior
- Reject unsupported versions without explicit valid digests before downloading.
- Reject digest mismatches before installation.
- Preserve existing compiled workflow invocations for the pinned version.
Custom artifact verification
- Allow callers to supply independently managed digests:

install_threat_detect_binary.sh v1.0.0 \
  --sha256-amd64 "$AMD64_SHA256" \
  --sha256-arm64 "$ARM64_SHA256"

Documentation
- Document the independent, architecture-specific verification model.

Fixes Support independently pinned threat-detect artifacts #57792

pr-sous-chef https://github.com/github/gh-aw/actions/runs/33831313247

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 40.5 AIC · ⌖ 8.81 AIC · ⊞ 8.9K · ◷
_{Comment /souschef to run again}

pr-sous-chef https://github.com/github/gh-aw/actions/runs/33834943677

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

github.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "github.com"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 41.7 AIC · ⌖ 8.84 AIC · ⊞ 8.9K · ◷
_{Comment /souschef to run again}

pr-sous-chef https://github.com/github/gh-aw/actions/runs/33865510093

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

github.com
registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "github.com"
    - "registry.npmjs.org"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 18.6 AIC · ⌖ 8.56 AIC · ⊞ 8.7K · ◷
_{Comment /souschef to run again}

Run: https://github.com/github/gh-aw/actions/runs/33875422710

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

github.com
registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "github.com"
    - "registry.npmjs.org"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 18.9 AIC · ⌖ 8.77 AIC · ⊞ 8.7K · ◷
_{Comment /souschef to run again}

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 54.6 AIC · ⌖ 9.63 AIC · ⊞ 9.2K · ◷
_{Comment /souschef to run again}

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

github.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "github.com"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 69.5 AIC · ⌖ 8.75 AIC · ⊞ 8.9K · ◷
_{Comment /souschef to run again}

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

This reverts commit 15d3823. Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot

Copilot wasn't able to review any files in this pull request.

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

pelikhan · 2026-09-03T23:15:27Z

@copilot fix https://github.com/github/gh-aw/actions/runs/33809941495/job/100840175260?pr=58310

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-09-03T23:31:33Z

@copilot fix https://github.com/github/gh-aw/actions/runs/33809941495/job/100840175260?pr=58310

Fixed in b38c832. The Dependabot manifest tests now use a deterministic local failing npm stub instead of contacting the registry; the focused tests passed 10 consecutive runs and the final impacted Go tests passed.

gh-aw-bot · 2026-09-03T23:37:31Z

@copilot The last maintainer request points at a failing unit-test job, and your follow-up says the root cause was fixed on a newer head.

Please refresh the branch state if needed, re-run the pr-finisher skill on the current head, and summarize in maintainer-facing terms:

the exact root cause you fixed,
the concrete validation you ran on HEAD, and
whether any blocker remains beyond CI re-running on the updated commit.

Failed check to reconcile:

Unit tests (D-G): https://github.com/github/gh-aw/actions/runs/33809941495/job/100840175260

Generated by 👨🍳 PR Sous Chef

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 32.7 AIC · ⌖ 9.85 AIC · ⊞ 9.2K · ◷
_{Comment /souschef to run again}

Copilot · 2026-09-03T23:56:59Z

@copilot The last maintainer request points at a failing unit-test job, and your follow-up says the root cause was fixed on a newer head.

Please refresh the branch state if needed, re-run the `pr-fin...

Current head is b3edf93; no refresh was needed. Root cause: TestGenerateDependabotManifests_WithDependencies invoked the real npm registry, leaving npm install blocked until the package-wide 3-minute timeout. The fix uses a deterministic local failing npm stub for both non-strict and strict paths.

Validated on HEAD: make lint, make test-unit, full make test, 12 installer tests, and the two Dependabot tests for 10 consecutive runs; all passed. The working tree is clean, there are no review threads or merge conflicts, and no code blocker remains. Current-head CI is action_required, so checks still need maintainer approval/re-run on b3edf93.

…detect-artifac

pelikhan · 2026-09-04T00:07:57Z

@copilot merge main and recompile

Copilot · 2026-09-04T00:29:47Z

@copilot merge main and recompile

Completed in merge commit 30352e2. Its second parent is current origin/main (0d11aae). Recompiled all 298 workflows successfully; no lock-file changes were needed. Final make agent-report-progress passed, workflow locks are in sync, and the working tree is clean.

github-actions · 2026-09-04T18:37:46Z

Category: bug | Risk: high | Score: 73 (impact 38 urgency 20 quality 15) | Action: fast_track | Batch: workflow-reliability

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

api.github.com

[!TIP]
api.github.com is blocked because GitHub API access uses the built-in GitHub tools by default. Instead of adding api.github.com to network.allowed, use tools.github.mode: gh-proxy for direct pre-authenticated GitHub CLI access without requiring network access to api.github.com:

tools:
  github:
    mode: gh-proxy

See GitHub Tools for more information on gh-proxy mode.

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.github.com"

See Network Configuration for more information.

Generated by 🔧 PR Triage Agent · copilot · mai10 · 25.2 AIC · ⌖ 2.93 AIC · ⊞ 15.1K · ◷

gh-aw-bot · 2026-09-04T19:03:43Z

pr-sous-chef

@copilot The branch state on this PR appears code-complete, but it is still stuck behind waiting/action-required workflow handling.

Please reconcile the current waiting/action-required runs on HEAD with the current branch state.
If no code changes are needed and the remaining blocker is only maintainer workflow approval / CI re-trigger plus mergeability refresh, say that explicitly.
After that, run the pr-finisher skill and provide a concise maintainer-facing status handoff.

Generated by PR Sous Chef: https://github.com/github/gh-aw/actions/runs/33908460692

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 33.4 AIC · ⌖ 8.81 AIC · ⊞ 9.2K · ◷
_{Comment /souschef to run again}

Copilot · 2026-09-04T19:08:54Z

pr-sous-chef
```...

Reconciled the current state on HEAD 25edcb8. The branch is clean and current with main; the latest addressing-comment run is in progress, while the prior CGO/Docs and smoke runs are action_required (maintainer approval/handling), not code failures. The deterministic npm-stub fix and workflow-lock refresh are already present. No code changes are needed; remaining work is maintainer CI approval/re-trigger and GitHub mergeability refresh.

gh-aw-bot · 2026-09-04T21:26:22Z

pr-sous-chef

@copilot Please take the next forward-progress pass on this PR.

Review the latest branch state, outstanding feedback, and any failing checks on current HEAD.
Refresh the branch if needed, then run the pr-finisher skill and provide a concise maintainer-facing status handoff.
If no code changes are needed and the remaining blocker is only maintainer approval, stale review state, or routine CI handling, say that explicitly.

Generated by PR Sous Chef: https://github.com/github/gh-aw/actions/runs/33920455377

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 24.6 AIC · ⌖ 8.73 AIC · ⊞ 9.2K · ◷
_{Comment /souschef to run again}

Copilot · 2026-09-04T21:31:17Z

pr-sous-chef
```...

Completed the finisher pass on current HEAD 25edcb8. The branch is clean, current with main, and no source changes are needed. The latest addressing-comment workflow is still in progress; prior addressing-comment runs succeeded, while CI workflows remain subject to maintainer handling. No code-side blocker remains. Remaining handoff: maintainer approval/re-trigger of CI and GitHub mergeability refresh.

github-actions · 2026-09-05T01:05:21Z

Generated by 🔧 PR Triage Agent · copilot · mai10 · 24 AIC · ⌖ 2.63 AIC · ⊞ 15.1K · ◷

…detect-artifac

gh-aw-bot · 2026-09-05T03:04:40Z

pr-sous-chef

@copilot Please take the next forward-progress pass on this PR.

Current head appears code-complete, but this PR is still waiting on a maintainer-facing closeout of the latest branch/check state.
Please reconcile the current workflow/check status on HEAD, run the pr-finisher skill again, and restate clearly whether the only remaining blocker is maintainer approval / routine CI handling.
If no code changes are needed, say that explicitly in maintainer-facing terms.

Generated by PR Sous Chef: https://github.com/github/gh-aw/actions/runs/33940432105

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

github.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "github.com"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 69.5 AIC · ⌖ 8.75 AIC · ⊞ 8.9K · ◷
_{Comment /souschef to run again}

Copilot · 2026-09-05T03:09:26Z

pr-sous-chef
```...

Completed the finisher pass on current HEAD ea3140d. The branch is clean and includes the latest main merge; the PR’s three source files remain unchanged and no code changes are needed. Current Docs/CGO workflows are action_required, while the latest addressing-comment workflow is still in progress. No code-side blocker remains; the remaining handoff is maintainer CI approval/re-trigger and mergeability refresh.

gh-aw-bot · 2026-09-05T04:30:31Z

pr-sous-chef

@copilot Current HEAD ea3140d still appears code-complete, but this PR remains stuck behind waiting/action-required workflow handling.

Please reconcile the current waiting/action-required Docs/CGO runs on this HEAD with the branch state.
If no code changes are needed and the remaining blocker is only maintainer workflow approval / CI re-trigger plus mergeability refresh, say that explicitly.
After that, run the pr-finisher skill and provide a concise maintainer-facing status handoff.

Generated by PR Sous Chef: https://github.com/github/gh-aw/actions/runs/33944404705

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 25.4 AIC · ⌖ 9.6 AIC · ⊞ 9K · ◷
_{Comment /souschef to run again}

Copilot · 2026-09-05T04:35:08Z

pr-sous-chef
```...

Reconciled HEAD ea3140d: the branch is clean and current with main; Docs and CGO runs on this HEAD are action_required, and the latest addressing-comment run is in progress. The prior addressing run succeeded, with no code failure indicated. No code changes are needed. Remaining handoff is maintainer workflow approval/re-trigger and GitHub mergeability refresh.

github-actions · 2026-09-05T06:44:17Z

test comment

Generated by 🔧 PR Triage Agent · copilot · mai10 · 22.9 AIC · ⌖ 2.86 AIC · ⊞ 15.4K · ◷

github-actions · 2026-09-05T06:44:19Z

Category: bug | Risk: high | Total: 78 (impact 40 + urgency 24 + quality 14)
Recommended action: fast_track | Batch: workflow-reliability

Generated by 🔧 PR Triage Agent · copilot · mai10 · 22.9 AIC · ⌖ 2.86 AIC · ⊞ 15.4K · ◷

Initial plan

f5e8fcf

Copilot AI assigned Copilot and pelikhan Sep 3, 2026

Copilot started work on behalf of pelikhan September 3, 2026 21:31 View session

Copilot AI linked an issue Sep 3, 2026 that may be closed by this pull request

Support independently pinned threat-detect artifacts #57792

Open

Copilot AI and others added 2 commits September 3, 2026 21:36

Plan threat-detect artifact pinning

15d3823

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Revert "Plan threat-detect artifact pinning"

c0277bd

This reverts commit 15d3823. Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

pelikhan marked this pull request as ready for review September 3, 2026 21:48

Copilot AI balanced review requested due to automatic review settings September 3, 2026 21:48

Copilot AI reviewed Sep 3, 2026

View reviewed changes

Pin threat-detect artifact digests

72821dc

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Support independently pinned threat-detect artifacts~~ Pin threat-detect artifacts to independent SHA-256 digests Sep 3, 2026

Copilot finished work on behalf of pelikhan September 3, 2026 21:51

Copilot AI requested a review from pelikhan September 3, 2026 21:51

github-actions Bot mentioned this pull request Sep 3, 2026

[pr-sous-chef] PR Sous Chef run report #58057

Closed

Copilot started work on behalf of pelikhan September 3, 2026 23:15 View session

Make Dependabot tests network independent

b3edf93

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan September 3, 2026 23:32

Copilot started work on behalf of gh-aw-bot September 3, 2026 23:37 View session

Copilot finished work on behalf of gh-aw-bot September 3, 2026 23:57

Copilot AI requested a review from gh-aw-bot September 3, 2026 23:57

Merge branch 'main' into copilot/support-independently-pinned-threat-…

30352e2

…detect-artifac

Copilot started work on behalf of pelikhan September 4, 2026 00:08 View session

Copilot finished work on behalf of pelikhan September 4, 2026 00:30

github-actions Bot added pr-batch:workflow-reliability pr-priority:high pr-risk:high pr-type:bug labels Sep 4, 2026

github-actions Bot mentioned this pull request Sep 4, 2026

[PR Triage Report] PR triage report: Copilot PRs for 2026-09-04 #58581

Closed

Copilot started work on behalf of gh-aw-bot September 4, 2026 19:04 View session

Copilot finished work on behalf of gh-aw-bot September 4, 2026 19:09

Copilot started work on behalf of gh-aw-bot September 4, 2026 21:26 View session

Copilot finished work on behalf of gh-aw-bot September 4, 2026 21:31

This was referenced Sep 5, 2026

[PR Triage Report] PR triage report 2026-09-05 #58681

Closed

[pr-sous-chef] PR Sous Chef run report #58638

Open

Merge branch 'main' into copilot/support-independently-pinned-threat-…

ea3140d

…detect-artifac

Copilot started work on behalf of gh-aw-bot September 5, 2026 03:05 View session

Copilot finished work on behalf of gh-aw-bot September 5, 2026 03:09

Copilot started work on behalf of gh-aw-bot September 5, 2026 04:31 View session

Copilot finished work on behalf of gh-aw-bot September 5, 2026 04:35

github-actions Bot mentioned this pull request Sep 5, 2026

[pr-review] Daily PR Code Quality Review — 33947957003 #58744

Open

github-actions Bot mentioned this pull request Sep 5, 2026

[PR Triage Report] PR triage report — 2026-09-05 #58749

Open

Uh oh!

Conversation

Copilot AI commented Sep 3, 2026 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

pelikhan commented Sep 3, 2026

Uh oh!

Copilot AI commented Sep 3, 2026

Uh oh!

gh-aw-bot commented Sep 3, 2026

Uh oh!

Copilot AI commented Sep 3, 2026

Uh oh!

pelikhan commented Sep 4, 2026

Uh oh!

Copilot AI commented Sep 4, 2026

Uh oh!

github-actions Bot commented Sep 4, 2026

Uh oh!

gh-aw-bot commented Sep 4, 2026

Uh oh!

Copilot AI commented Sep 4, 2026

Uh oh!

gh-aw-bot commented Sep 4, 2026

Uh oh!

Copilot AI commented Sep 4, 2026

Uh oh!

github-actions Bot commented Sep 5, 2026

Uh oh!

gh-aw-bot commented Sep 5, 2026

Uh oh!

Copilot AI commented Sep 5, 2026

Uh oh!

gh-aw-bot commented Sep 5, 2026

Uh oh!

Copilot AI commented Sep 5, 2026

Uh oh!

github-actions Bot commented Sep 5, 2026

Uh oh!

github-actions Bot commented Sep 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Copilot AI commented Sep 3, 2026 •

edited by github-actions Bot

Loading