fix(workflows): harden community submission workflows - #4510
Conversation
…view
Address two hardening suggestions from a GitHub Security Lab PVR against the
community catalog submission workflows (bundle, extension, preset):
1. Validate the sanitized event snapshot instead of the live issue. Step 1 now
consumes ${{ steps.sanitized.outputs.text }} — the documented gh-aw sanitized
full-context output — rather than instructing the agent to re-fetch the issue
body, which could change between the maintainer applying the label and the
agent reading it. This ties validation to the triggering submission.
2. Make threat detection block safe outputs. Add
safe-outputs.threat-detection.continue-on-error: false so a detected threat
fails the run instead of only warning and still producing a draft PR.
Recompiled the three .lock.yml files with gh-aw v0.79.8.
(Finding #2, create-pull-request allowed-files, is already implemented on all
three workflows upstream, so no change was needed there.)
Assisted-by: GitHub Copilot (model: Claude Opus 4.8, autonomous)
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
Sanitization corrupts accepted external URLs, generated locks downgrade actions unexpectedly, and fail-closed behavior lacks regression coverage.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Review tier: Balanced
Findings: 2
New issues introduced by this change (6)
| Severity | Finding |
|---|---|
 |
.github/workflows/add-community-bundle.md — This sanitized text cannot preserve all fields this workflow accepts. gh-aw v0.79.8 redacts HTTPS… |
|
.github/workflows/add-community-extension.md — This is not a lossless snapshot of extension submissions. In gh-aw v0.79.8, the sanitized output… |
 |
.github/workflows/add-community-bundle.lock.yml — The regenerated lock unexpectedly downgrades actions/checkout from v7.0.1 to v6.0.3 and… |
|
.github/workflows/add-community-extension.lock.yml — The regenerated lock unexpectedly downgrades actions/checkout from v7.0.1 to v6.0.3 and… |
|
.github/workflows/add-community-preset.lock.yml — The regenerated lock unexpectedly downgrades actions/checkout from v7.0.1 to v6.0.3 and… |
 |
.github/workflows/add-community-extension.md — The new fail-closed contract has no regression assertion even though… |
What changed in this PR
Hardens community submission workflows by using triggering-event snapshots and fail-closed threat detection.
Changes:
- Uses sanitized issue snapshots as authoritative inputs.
- Blocks safe outputs when threat detection fails.
- Regenerates corresponding lock workflows.
| File | Description |
|---|---|
.github/workflows/add-community-bundle.md |
Adds snapshot parsing and fail-closed detection. |
.github/workflows/add-community-bundle.lock.yml |
Regenerates the bundle workflow. |
.github/workflows/add-community-extension.md |
Adds snapshot parsing and fail-closed detection. |
.github/workflows/add-community-extension.lock.yml |
Regenerates the extension workflow. |
.github/workflows/add-community-preset.md |
Adds snapshot parsing and fail-closed detection. |
.github/workflows/add-community-preset.lock.yml |
Regenerates the preset workflow. |
💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| threat-detection: | ||
| continue-on-error: false |
Address PR review feedback: - Restore actions/checkout (v7.0.1) and actions/setup-node (v7.0.0) pins in the three regenerated lock files. A local recompile had resolved older cached pins; the lock files now differ from the base only by the intended snapshot and threat-detection changes. - Add a regression test asserting each community submission workflow enables threat detection with continue-on-error: false in source and compiles to the fail-closed detection gate, so a later regeneration cannot silently restore warning-only behavior. Assisted-by: GitHub Copilot (model: Claude Opus 4.8, autonomous) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
…tion The regenerated sanitized snapshot (steps.sanitized.outputs.text) redacts any HTTPS host absent from the workflow's allowed-domains list. These submission workflows record off-allowlist URLs verbatim (extension homepage/documentation/ changelog, bundle required component catalogs, and the proposed catalog-entry JSON), so a snapshot input would corrupt otherwise-valid submissions. Revert Step 1 to reading the triggering issue and keep the separate maintainer PR review as the control for issue edits. The fail-closed threat-detection change (continue-on-error: false) and its regression test are retained. Recompiled the three lock files; action pins and the pin database are unchanged from the base. Assisted-by: GitHub Copilot (model: Claude Opus 4.8, autonomous) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
|
Thanks for the review — addressed in a6d5207 (and the two preceding commits). Sanitized-snapshot input (High, bundle + extension). You're right that the regenerated snapshot redacts HTTPS hosts outside the workflow's allowed-domains list. These workflows record off-allowlist URLs verbatim (extension homepage/documentation/changelog, bundle required component catalogs, and the proposed catalog-entry JSON), so the snapshot would corrupt valid submissions. I reverted the snapshot change and kept reading the triggering issue; the separate maintainer review remains the control for any post-label edits. Action pin downgrade (Medium ×3). Unintended side effect of the regeneration. The lock files now restore the base Missing fail-closed regression coverage (Low). Added a test that asserts each workflow source sets Net change is now scoped to fail-closed threat detection plus that test. Posted on behalf of @mnriem by GitHub Copilot (model: Claude Opus 4.8), acting autonomously. |
There was a problem hiding this comment.
Copilot review overview
🟢 Approval recommended
The source workflows, generated outputs, and regression test consistently enforce fail-closed threat detection.
Review tier: Balanced
Findings: 1
Pre-existing issues (1)
| Severity | Finding |
|---|---|
|
.github/workflows/add-community-extension.md — The new fail-closed contract has no regression assertion even though… View comment |
Issues resolved since last review (5)
| Severity | Finding |
|---|---|
|
.github/workflows/add-community-preset.lock.yml — The regenerated lock unexpectedly downgrades actions/checkout from v7.0.1 to v6.0.3 and… View resolved comment |
|
.github/workflows/add-community-extension.lock.yml — The regenerated lock unexpectedly downgrades actions/checkout from v7.0.1 to v6.0.3 and… View resolved comment |
|
.github/workflows/add-community-bundle.lock.yml — The regenerated lock unexpectedly downgrades actions/checkout from v7.0.1 to v6.0.3 and… View resolved comment |
|
.github/workflows/add-community-extension.md — This is not a lossless snapshot of extension submissions. In gh-aw v0.79.8, the sanitized output… View resolved comment |
|
.github/workflows/add-community-bundle.md — This sanitized text cannot preserve all fields this workflow accepts. gh-aw v0.79.8 redacts HTTPS… View resolved comment |
mnriem
added
the
triage-must-have
Summary
A focused hardening change to the community catalog submission workflows
(bundle, extension, preset).
emitting a warning.
reverting on a future regeneration.
Generated workflow files were regenerated to match; action pins are unchanged
from the base. No catalog data changes and no change to the maintainer
PR-review step.
Note on review feedback
An earlier revision also switched issue parsing to the sanitized event
snapshot. That was reverted: the snapshot redacts URLs on hosts outside the
workflow's allowed-domains list, which would corrupt valid submissions whose
metadata legitimately points at non-GitHub hosts. Reading the triggering issue
is retained, with the separate maintainer review remaining the control for any
post-label edits.
Opened on behalf of @mnriem by GitHub Copilot (model: Claude Opus 4.8).