Add step shell script validator: gh CLI without GH_TOKEN heuristic by Copilot · Pull Request #44661 · github/gh-aw

Copilot · 2026-07-10T05:50:42Z

Steps using the gh CLI without GH_TOKEN in env: fail at runtime with opaque auth errors. This adds a compile-time heuristic to catch it early.

New validator: `step_shell_validator.go`

Checks pre-steps, steps, pre-agent-steps, post-steps for run: scripts invoking gh
Detection pattern: gh as a command token at line-start or after &&/||/;/|
Strict mode → error; non-strict → warning
Known limitation: $(gh ...) substitutions are not detected

Example violation caught:

steps:
- name: List issuesrun: gh issue list # ← no GH_TOKEN → compile error in strict mode

Fix suggested in the error message:

env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Wiring

validateStepShellScripts added to the validation chain in compiler_orchestrator_engine.go, alongside validateEnvSecrets and validateStepsSecrets.

Incidental fix

craft.md "Install gh-aw extension" step was genuinely missing GH_TOKEN — caught and fixed by the new validator.

Generated by 👨‍🍳 PR Sous Chef · 12.5 AIC · ⌖ 6.14 AIC · ⊞ 7.1K · ◷
_{Comment /souschef to run again}

Generated by 👨‍🍳 PR Sous Chef · 4.34 AIC · ⌖ 5.93 AIC · ⊞ 7.1K · ◷
_{Comment /souschef to run again}

Generated by 👨‍🍳 PR Sous Chef · 11.3 AIC · ⌖ 6.23 AIC · ⊞ 7.1K · ◷
_{Comment /souschef to run again}

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

pelikhan · 2026-07-10T06:39:34Z

@copilot run pr-finisher skill

Copilot

Pull request overview

Adds a new compile-time heuristic validator to detect run: scripts invoking the gh CLI without GH_TOKEN set in env: (error in strict mode, warning otherwise), wires it into the compiler’s validation chain, and updates the craft workflow to satisfy the new rule.

Changes:

Introduce validateStepShellScripts / step_shell_validator.go to detect gh usage in step run: scripts and require GH_TOKEN.
Add unit tests covering strict vs non-strict behavior and step section coverage.
Update .github/workflows/craft.md (and regenerated lock) to include GH_TOKEN for the gh extension install step.

Show a summary per file

File	Description
pkg/workflow/step_shell_validator.go	New heuristic validator for `gh` usage without `GH_TOKEN` in step `env:`.
pkg/workflow/step_shell_validator_test.go	Unit tests for strict/non-strict behavior and section scanning.
pkg/workflow/compiler_orchestrator_engine.go	Hooks the new validator into the existing validation chain.
.github/workflows/craft.md	Adds `GH_TOKEN` to a step that runs `gh`.
.github/workflows/craft.lock.yml	Regenerated compiled workflow reflecting the `craft.md` change.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 5/5 changed files
Comments generated: 3
Review effort level: Low

+	var violations []string
+	for _, step := range steps {
+ if v := checkStepGHToken(step); v != "" {
+ violations = append(violations, v)
+ }
+	}


Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-07-10T07:09:00Z

@copilot run pr-finisher skill

Addressed the finisher pass in bedc162: fixed the validator review feedback, added the missing regression coverage, and reran local validation (make fmt, make lint, make test-unit, make test, make recompile, make agent-report-progress). CI on this head is still unverified until a maintainer re-triggers it.

gh-aw-bot · 2026-07-10T07:11:09Z

@copilot please run the pr-finisher skill, address unresolved review comments, and rerun checks once the branch is up to date.

Unresolved review threads:

copilot-pull-request-reviewer: Add step shell script validator: gh CLI without GH_TOKEN heuristic #44661 (comment)

Generated by 👨‍🍳 PR Sous Chef · 12.5 AIC · ⌖ 6.14 AIC · ⊞ 7.1K · ◷
_{Comment /souschef to run again}

…piler-validator # Conflicts: # .github/workflows/craft.lock.yml Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

github-actions · 2026-07-10T07:31:37Z

🤖 PR Triage

Field	Value
Category	feature
Risk	🔴 High
Score	72 / 100
Action	⚡ fast_track

Score breakdown: impact 38 + urgency 22 + quality 12

Rationale: Adds compile-time validator catching gh CLI usage without GH_TOKEN, preventing runtime auth failures. Touches core compiler orchestrator and new validator. High value — catches a real class of silent failures. Recommend expedited human review.

Generated by 🔧 PR Triage Agent · 44.7 AIC · ⌖ 5.13 AIC · ⊞ 5.4K · ◷

pelikhan · 2026-07-10T07:39:56Z

@copilot validate container shas

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-07-10T08:01:41Z

@copilot validate container shas

Addressed in 04b8256: I validated the 0.27.29 firewall/build-tools image digests against docker buildx imagetools inspect, refreshed the incorrect pins in actions-lock.json, regenerated the affected lockfiles/synced pin data, updated the compile regression expectations, and reran make recompile, the firewall pin tests, the container-pin validation script, and make agent-report-progress.

gh-aw-bot · 2026-07-10T08:22:27Z

pr-sous-chef
@copilot please run the pr-finisher skill, ensure the branch is up to date, address any remaining review feedback, and rerun checks.

Run: https://github.com/github/gh-aw/actions/runs/29079112957

Generated by 👨‍🍳 PR Sous Chef · 8.44 AIC · ⌖ 5.58 AIC · ⊞ 7.1K · ◷
_{Comment /souschef to run again}

…update-go-compiler-validator Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot · 2026-07-10T08:39:32Z

pr-sous-chef
@copilot please run the pr-finisher skill, ensure the branch is up to date, address any remaining review feedback, and rerun checks.
...

Addressed on 4ab51f9: I unshallowed the repo, merged origin/main into the branch, reran local validation (make fmt, make lint, make test-unit, make test, make recompile, make agent-report-progress), and confirmed the remaining review thread is already outdated/satisfied on the current head. The linked PR Sous Chef run succeeded; CI on this updated head is still unverified until a maintainer re-triggers it.

github-actions · 2026-07-10T10:09:49Z

Hey @app/copilot-swe-agent 👋 — great addition! The new compile-time heuristic for catching gh CLI usage without GH_TOKEN is exactly the kind of early-error-detection that saves contributors from confusing runtime auth failures.

The PR is well-structured: the validator is cleanly wired into the orchestrator alongside validateEnvSecrets and validateStepsSecrets, the test file covers the new logic, golden files are updated consistently, and the incidental craft.md fix is a nice real-world validation that the heuristic works. This looks ready for review! 🚀

Generated by ✅ Contribution Check · 115.9 AIC · ⌖ 13.8 AIC · ⊞ 6.2K · ◷

gh-aw-bot · 2026-07-10T13:26:34Z

@copilot please run the pr-finisher skill, address any remaining review feedback, refresh the branch if needed, and rerun checks.

Generated by 👨‍🍳 PR Sous Chef · 4.34 AIC · ⌖ 5.93 AIC · ⊞ 7.1K · ◷
_{Comment /souschef to run again}

Copilot · 2026-07-10T13:38:34Z

@copilot please run the pr-finisher skill, address any remaining review feedback, refresh the branch if needed, and rerun checks.
...

Checked the branch on fbd3e9f: there’s no remaining actionable review feedback, the outstanding Copilot review thread is outdated/satisfied by the current validator implementation, and the branch already contains the current PR base commit. I reran local validation (make fmt, make lint, make test-unit, make test, make recompile), all of which passed. The latest PR workflows on this head are still action_required/stale after the agent push, so CI still needs a maintainer re-trigger before merge.

gh-aw-bot · 2026-07-10T14:17:41Z

@copilot please run the pr-finisher skill, address unresolved review comments, refresh the branch if needed, and rerun checks once ready.
Unresolved review threads:

Copilot: Add step shell script validator: gh CLI without GH_TOKEN heuristic #44661 (comment)
Copilot: Add step shell script validator: gh CLI without GH_TOKEN heuristic #44661 (comment)
Copilot: Add step shell script validator: gh CLI without GH_TOKEN heuristic #44661 (comment)

Generated by 👨‍🍳 PR Sous Chef · 11.3 AIC · ⌖ 6.23 AIC · ⊞ 7.1K · ◷
_{Comment /souschef to run again}

github-actions · 2026-07-11T09:03:13Z

🎉 This pull request is included in a new release.

Release: v0.82.8

CopilotAIand others added 2 commits July 10, 2026 05:45

Add step shell script validator (gh CLI missing GH_TOKEN rule)
bb9f61e
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Improve validator doc comments with known limitations
6184b80
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

CopilotAI assigned Copilot and pelikhan Jul 10, 2026

CopilotAI changed the title ~~Add step shell script validator: gh CLI missing GH_TOKEN heuristic~~Add step shell script validator: gh CLI without GH_TOKEN heuristicJul 10, 2026

CopilotAI requested a review from pelikhan July 10, 2026 05:51

Copilotcreated this pull request from a session on behalf of pelikhan July 10, 2026 05:51 View session

Copilotfinished work on behalf of pelikhan July 10, 2026 05:51

github-actionsBot mentioned this pull request Jul 10, 2026
[Contribution Check Report] Contribution Check — 2026-07-10 #44641
Closed

pelikhan marked this pull request as ready for review July 10, 2026 06:39

CopilotAI review requested due to automatic review settings July 10, 2026 06:39

Copilotstarted reviewing on behalf of pelikhan July 10, 2026 06:39 View session

CopilotAI reviewed Jul 10, 2026
View reviewed changes

Copilotstarted work on behalf of pelikhan July 10, 2026 06:44 View session

CopilotAIand others added 2 commits July 10, 2026 07:03

Fix step shell validator review feedback
e9f8480
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Add missing workflow env validator test case
bedc162
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilotfinished work on behalf of pelikhan July 10, 2026 07:09

github-actionsBot mentioned this pull request Jul 10, 2026
[pr-sous-chef] Run report — 5 nudged, 0 skipped #44677
Closed

Copilotstarted work on behalf of gh-aw-bot July 10, 2026 07:12 View session

Merge remote-tracking branch 'origin/main' into copilot/update-go-com…
fef0d8c
…piler-validator # Conflicts: # .github/workflows/craft.lock.yml Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

github-actionsBot added pr-action:fast_track pr-agent:copilot-swe-agent pr-priority:high pr-risk:high pr-type:feature labels Jul 10, 2026

github-actionsBot mentioned this pull request Jul 10, 2026
[PR Triage Report] PR Triage Report — 2026-07-10 [Run 29076495188] #44682
Closed

CopilotAI requested a review from gh-aw-bot July 10, 2026 07:36

Copilotstarted work on behalf of pelikhan July 10, 2026 07:40 View session

CopilotAIand others added 3 commits July 10, 2026 07:51

Start container SHA refresh
1d009b6
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Refresh firewall container SHA pins
9c4a819
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Update firewall pin compile expectation
04b8256
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilotfinished work on behalf of pelikhan July 10, 2026 08:02

github-actionsBot mentioned this pull request Jul 10, 2026
[pr-sous-chef] Run report — 5 nudged, 0 skipped #44688
Closed

Copilotstarted work on behalf of gh-aw-bot July 10, 2026 08:23 View session

Merge remote-tracking branch 'refs/remotes/origin/main' into copilot/…
4ab51f9
…update-go-compiler-validator Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilotfinished work on behalf of gh-aw-bot July 10, 2026 08:40

This was referenced Jul 10, 2026
[pr-sous-chef] Run report — 0 nudged, 6 skipped #44708
Closed
[pr-sous-chef] Run report — 0 nudged, 9 skipped #44713
Closed

Merge branch 'main' into copilot/update-go-compiler-validator
fbd3e9f

github-actionsBot mentioned this pull request Jul 10, 2026
[pr-sous-chef] Run report — 7 nudged, 2 skipped #44729
Closed

Copilotstarted work on behalf of gh-aw-bot July 10, 2026 13:27 View session

Copilotfinished work on behalf of gh-aw-bot July 10, 2026 13:39

github-actionsBot mentioned this pull request Jul 10, 2026
[pr-sous-chef] Run report — 9 nudged, 0 skipped #44742
Closed

Copilotstarted work on behalf of gh-aw-bot July 10, 2026 14:18 View session

pelikhan merged commit a1efc55 into mainJul 10, 2026
1 of 2 checks passed

pelikhan deleted the copilot/update-go-compiler-validator branch July 10, 2026 14:30

Copilot stopped work on behalf of gh-aw-bot due to an error July 10, 2026 14:30
The session was cancelled by the user.

Uh oh!

Conversation

CopilotAI commented Jul 10, 2026• edited by github-actions BotLoading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

New validator: step_shell_validator.go

Wiring

Incidental fix

Uh oh!

pelikhan commented Jul 10, 2026

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

Uh oh!

Uh oh!

CopilotAI commented Jul 10, 2026

Uh oh!

gh-aw-bot commented Jul 10, 2026

Uh oh!

github-actionsBot commented Jul 10, 2026

🤖 PR Triage

Uh oh!

pelikhan commented Jul 10, 2026

Uh oh!

CopilotAI commented Jul 10, 2026

Uh oh!

gh-aw-bot commented Jul 10, 2026

Uh oh!

CopilotAI commented Jul 10, 2026

Uh oh!

github-actionsBot commented Jul 10, 2026

Uh oh!

gh-aw-bot commented Jul 10, 2026

Uh oh!

CopilotAI commented Jul 10, 2026

Uh oh!

gh-aw-bot commented Jul 10, 2026

Uh oh!

Uh oh!

github-actionsBot commented Jul 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

CopilotAI commented Jul 10, 2026•
edited by github-actions Bot
Loading

New validator: `step_shell_validator.go`