fix(security): inject zizmor unverified-creator annotations for all 9 SHA-pinned third-party actions by Copilot · Pull Request #50015 · github/gh-aw

Copilot · 2026-08-03T15:38:32Z

Resolves 9 github_action_from_unverified_creator_used zizmor findings from the 2026-08-03 static analysis report. All flagged actions are already SHA-pinned by the compiler; this adds # zizmor: ignore[github_action_from_unverified_creator_used] annotations to acknowledge the residual publisher-identity risk.

The core problem: The compiler parses YAML frontmatter and re-marshals it, stripping all comments. Annotations added to source .md files don't survive the round-trip into generated .lock.yml files — they must be re-injected at code generation time.

Compiler changes (`pkg/workflow/`)

compiler_yaml_step_conversion.go — New injectZizmorUnverifiedCreatorAnnotations(yamlStr) post-processor with a unverifiedCreatorActionPrefixes list (safedep/, super-linter/, actions-ecosystem/, erlef/, astral-sh/). Inserts a comment line before any matching uses: line, preserving the existing indentation. Called in ConvertStepToYAML() after the YAML marshal/unquote pass — handles custom job steps (super-linter/super-linter).
compiler_yaml_step_lifecycle.go — Calls injectZizmorUnverifiedCreatorAnnotations() at the top of writeStepsSection() before indentation normalization — handles pre-steps (safedep/pmg).
safe_outputs_actions.go — Injects the annotation comment slice element before the uses: line in buildActionSteps() — handles safe-output actions (actions-ecosystem/action-add-labels).
runtime_definitions.go / runtime_step_generator.go — UnverifiedCreator bool field on Runtime; generateSetupStep() injects the comment for erlef/ and astral-sh/ runtimes inline in the GitHubActionStep slice.

Plain (non-compiled) workflow files

copilot-setup-steps.yml — Annotation added before astral-sh/setup-uv.
link-check.yml — Annotations added before both gaurav-nelson/github-action-markdown-link-check steps.

Example output (generated lock file)

 - name: Install PMG (Package Manager Guard)# zizmor: ignore[github_action_from_unverified_creator_used]uses: safedep/pmg@5ac0f275b83d9d5a9342c6aae977ec32fa330daa # v1

All 9 occurrences verified across 8 affected workflow files; 269/269 workflows recompiled cleanly.

Fixes[static-analysis] Report - 2026-08-03 #49909

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 8.36 AIC · ⌖ 8.38 AIC · ⊞ 8.3K · ◷
_{Comment /souschef to run again}

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 20.5 AIC · ⌖ 9.4 AIC · ⊞ 5.9K · ◷
_{Comment /souschef to run again}

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 7.59 AIC · ⌖ 5.99 AIC · ⊞ 8.3K · ◷
_{Comment /souschef to run again}

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 15.3 AIC · ⌖ 9 AIC · ⊞ 8.3K · ◷
_{Comment /souschef to run again}

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 11.5 AIC · ⌖ 11.2 AIC · ⊞ 8.3K · ◷
_{Comment /souschef to run again}

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot

Pull request overview

Addresses issue #49909 by preserving zizmor suppressions for nine SHA-pinned actions from unverified creators.

Changes:

Adds compiler-time annotation injection across custom, lifecycle, safe-output, and runtime steps.
Marks affected source workflows.
Regenerates affected lock files.

Show a summary per file

File	Description
`pkg/workflow/safe_outputs_actions.go`	Annotates safe-output actions.
`pkg/workflow/runtime_step_generator.go`	Annotates runtime setup actions.
`pkg/workflow/runtime_definitions.go`	Marks unverified runtime creators.
`pkg/workflow/compiler_yaml_step_lifecycle.go`	Processes lifecycle steps.
`pkg/workflow/compiler_yaml_step_conversion.go`	Adds the YAML annotation injector.
`.github/workflows/super-linter.md`	Marks the super-linter action.
`.github/workflows/super-linter.lock.yml`	Regenerates the compiled suppression.
`.github/workflows/smoke-codex.md`	Marks the label action.
`.github/workflows/smoke-codex.lock.yml`	Regenerates the compiled suppression.
`.github/workflows/shared/pmg.md`	Marks the shared PMG action.
`.github/workflows/mcp-inspector.lock.yml`	Annotates setup-uv.
`.github/workflows/link-check.yml`	Annotates both link-check actions.
`.github/workflows/hippo-embed.lock.yml`	Annotates imported PMG.
`.github/workflows/dataflow-pr-discussion-dataset.lock.yml`	Annotates PMG and updates metadata.
`.github/workflows/daily-elixir-credo-snippet-audit.lock.yml`	Annotates setup-beam.
`.github/workflows/copilot-setup-steps.yml`	Annotates setup-uv.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 16/16 changed files
Comments generated: 2
Review effort level: Balanced

+func injectZizmorUnverifiedCreatorAnnotations(yamlStr string) string {
+	lines := strings.Split(yamlStr, "\n")
+	result := make([]string, 0, len(lines)+4)
+	for _, line := range lines {
+ trimmed := strings.TrimLeft(line, " \t")
+ if actionRef, ok := strings.CutPrefix(trimmed, "uses: "); ok {
+ for _, prefix := range unverifiedCreatorActionPrefixes {
+ if strings.HasPrefix(actionRef, prefix) {
+ indent := line[:len(line)-len(trimmed)]
+ result = append(result, indent+"# zizmor: ignore[github_action_from_unverified_creator_used]")
+ break
+ }
+ }
+ }
+ result = append(result, line)
+	}
+	return strings.Join(result, "\n")
+}


-# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"905bd34278b42598e78925c37617ee3eeaf01bb54a55cbf77711c0b0d84f818d","body_hash":"53eab465d720bf4387a7432ded7958daddbb5da3332d9c36f65737fcfff87673","strict":true,"agent_id":"copilot","engine_versions":{"copilot":"1.0.77"}}
-# gh-aw-manifest: {"version":1,"secrets":["COPILOT_GITHUB_TOKEN","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GH_AW_OTEL_GRAFANA_AUTHORIZATION","GH_AW_OTEL_GRAFANA_ENDPOINT","GH_AW_OTEL_SENTRY_AUTHORIZATION","GH_AW_OTEL_SENTRY_ENDPOINT","GITHUB_TOKEN"],"actions":[{"repo":"actions/cache/restore","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/cache/save","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/checkout","sha":"3d3c42e5aac5ba805825da76410c181273ba90b1","version":"v7.0.1"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"820762786026740c76f36085b0efc47a31fe5020","version":"v7.0.0"},{"repo":"actions/setup-python","sha":"5fda3b95a4ea91299a34e894583c3862153e4b97","version":"v7.0.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"},{"repo":"safedep/pmg","sha":"5ac0f275b83d9d5a9342c6aae977ec32fa330daa","version":"v1"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.27.43","digest":"sha256:04e2d1987a565000a8f114b89d806ae7a3864dd4f944be65275b28c93d8690e6","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.27.43@sha256:04e2d1987a565000a8f114b89d806ae7a3864dd4f944be65275b28c93d8690e6"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.43","digest":"sha256:d85f57975af5ea23af4996e41ed73fbc8f5b4a47402472bfe82e508f352cb0c1","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.43@sha256:d85f57975af5ea23af4996e41ed73fbc8f5b4a47402472bfe82e508f352cb0c1"},{"image":"ghcr.io/github/gh-aw-firewall/cli-proxy:0.27.43","digest":"sha256:65c45ea2967984d0024f3df61bc71335658a77ede96c8d9665da7a5f33a795ab","pinned_image":"ghcr.io/github/gh-aw-firewall/cli-proxy:0.27.43@sha256:65c45ea2967984d0024f3df61bc71335658a77ede96c8d9665da7a5f33a795ab"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.27.43","digest":"sha256:26be5e0b8c8f4c41c8a59126b29bb5d80b07253597472ded2a16bdd75abcbf9d","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.27.43@sha256:26be5e0b8c8f4c41c8a59126b29bb5d80b07253597472ded2a16bdd75abcbf9d"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.4.7","digest":"sha256:7545220a9aca134b71e51193ee0eaf4c50756ebf8fbd25a63ae7556e62815c00","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.4.7@sha256:7545220a9aca134b71e51193ee0eaf4c50756ebf8fbd25a63ae7556e62815c00"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:0d9f1fb5fd6610c0ac1f5194a38e45a8a1e81f8a390d5142d8e4e6f26a4b3196","pinned_image":"ghcr.io/github/gh-aw-node@sha256:0d9f1fb5fd6610c0ac1f5194a38e45a8a1e81f8a390d5142d8e4e6f26a4b3196"},{"image":"ghcr.io/github/github-mcp-server:v1.8.0","digest":"sha256:d5a18c04b92714c309eb46a2305087e91a4dbd80420f6e462656699f95093520","pinned_image":"ghcr.io/github/github-mcp-server:v1.8.0@sha256:d5a18c04b92714c309eb46a2305087e91a4dbd80420f6e462656699f95093520"}]}
+# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"a5dd5712ab4dfb3e852d78e0b1e44054bf76460e63c78c46efe35a034260e65e","body_hash":"421b26ff01056f750ef268a35325e6b4a64a8992f21253b54d9f1e8eea4bcba2","strict":true,"agent_id":"copilot","engine_versions":{"copilot":"1.0.77"}}
+# gh-aw-manifest: {"version":1,"secrets":["COPILOT_GITHUB_TOKEN","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GH_AW_OTEL_GRAFANA_AUTHORIZATION","GH_AW_OTEL_GRAFANA_ENDPOINT","GH_AW_OTEL_SENTRY_AUTHORIZATION","GH_AW_OTEL_SENTRY_ENDPOINT","GITHUB_TOKEN"],"actions":[{"repo":"actions/cache/restore","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/cache/save","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/checkout","sha":"3d3c42e5aac5ba805825da76410c181273ba90b1","version":"v7.0.1"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"820762786026740c76f36085b0efc47a31fe5020","version":"v7.0.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"},{"repo":"safedep/pmg","sha":"5ac0f275b83d9d5a9342c6aae977ec32fa330daa","version":"v1"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.27.43","digest":"sha256:04e2d1987a565000a8f114b89d806ae7a3864dd4f944be65275b28c93d8690e6","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.27.43@sha256:04e2d1987a565000a8f114b89d806ae7a3864dd4f944be65275b28c93d8690e6"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.43","digest":"sha256:d85f57975af5ea23af4996e41ed73fbc8f5b4a47402472bfe82e508f352cb0c1","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.43@sha256:d85f57975af5ea23af4996e41ed73fbc8f5b4a47402472bfe82e508f352cb0c1"},{"image":"ghcr.io/github/gh-aw-firewall/cli-proxy:0.27.43","digest":"sha256:65c45ea2967984d0024f3df61bc71335658a77ede96c8d9665da7a5f33a795ab","pinned_image":"ghcr.io/github/gh-aw-firewall/cli-proxy:0.27.43@sha256:65c45ea2967984d0024f3df61bc71335658a77ede96c8d9665da7a5f33a795ab"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.27.43","digest":"sha256:26be5e0b8c8f4c41c8a59126b29bb5d80b07253597472ded2a16bdd75abcbf9d","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.27.43@sha256:26be5e0b8c8f4c41c8a59126b29bb5d80b07253597472ded2a16bdd75abcbf9d"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.4.7","digest":"sha256:7545220a9aca134b71e51193ee0eaf4c50756ebf8fbd25a63ae7556e62815c00","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.4.7@sha256:7545220a9aca134b71e51193ee0eaf4c50756ebf8fbd25a63ae7556e62815c00"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:0d9f1fb5fd6610c0ac1f5194a38e45a8a1e81f8a390d5142d8e4e6f26a4b3196","pinned_image":"ghcr.io/github/gh-aw-node@sha256:0d9f1fb5fd6610c0ac1f5194a38e45a8a1e81f8a390d5142d8e4e6f26a4b3196"},{"image":"ghcr.io/github/github-mcp-server:v1.8.0","digest":"sha256:d5a18c04b92714c309eb46a2305087e91a4dbd80420f6e462656699f95093520","pinned_image":"ghcr.io/github/github-mcp-server:v1.8.0@sha256:d5a18c04b92714c309eb46a2305087e91a4dbd80420f6e462656699f95093520"}]}


pelikhan · 2026-08-03T16:59:37Z

@copilot fix https://github.com/github/gh-aw/actions/runs/30834160543/job/91755554193?pr=50015

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

gh-aw-bot · 2026-08-03T17:13:59Z

@copilot sous-chef triage:

Two review threads are still open and CI is not in a clean merge-ready state.

Please address unresolved review feedback first:
- fix(security): inject zizmor unverified-creator annotations for all 9 SHA-pinned third-party actions #50015 (comment)
- fix(security): inject zizmor unverified-creator annotations for all 9 SHA-pinned third-party actions #50015 (comment)
After pushing fixes, run the pr-finisher skill and summarize merge readiness.
If any checks need to be rerun after your changes, include that status in your handoff.

Generated by 👨🍳 PR Sous Chef · run: https://github.com/github/gh-aw/actions/runs/30835268189

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 8.36 AIC · ⌖ 8.38 AIC · ⊞ 8.3K · ◷
_{Comment /souschef to run again}

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-08-03T17:32:03Z

@copilot fix https://github.com/github/gh-aw/actions/runs/30834160543/job/91755554193?pr=50015

Addressed in 2be0bcf. I fixed annotation injection to skip YAML block-scalar payload content and added regression tests for block-scalar and post-block-scalar behavior; targeted tests and make agent-report-progress now pass locally.

Copilot · 2026-08-03T17:44:46Z

@copilot sous-chef triage:
Two review threads are still open and CI is not in a clean merge-ready state....

pr-finisher triage complete.

✅ Reviews — both referenced threads are outdated and their underlying issues are already addressed on HEAD 2be0bcf (yamlBlockScalarState guard is in place; dataflow-pr-discussion-dataset.lock.yml manifest includes actions/setup-python).
✅ Checks (local) — make fmt && make lint && make test-unit && make test all passed locally in this run.
❓ Checks (CI) — current PR check run is still in progress (copilot: https://github.com/github/gh-aw/actions/runs/30837216611/job/91765235176). CI on this HEAD remains unverified until maintainers re-trigger/complete checks.
✅ Mergeable — PR is OPEN, not draft; mergeable state reports unstable pending checks/review-thread resolution.

Actions taken in this pass: validated review-thread concerns against current HEAD and ran full local validation suite; no additional code changes were required.

Hand-off: please re-trigger/complete CI as needed and resolve the two outdated review threads to reach merge-ready state.

gh-aw-bot · 2026-08-03T17:57:44Z

@copilot sous-chef triage:

There are still two unresolved review threads, but your follow-up indicates the fixes are already on the current head.

Please resolve or otherwise close out these threads after confirming they are fully addressed:
- fix(security): inject zizmor unverified-creator annotations for all 9 SHA-pinned third-party actions #50015 (comment)
- fix(security): inject zizmor unverified-creator annotations for all 9 SHA-pinned third-party actions #50015 (comment)
After thread cleanup, re-run the pr-finisher skill and post a concise merge-readiness summary for the current head.
CI/review state still appears non-merge-ready, so include any remaining blocker in that handoff.

Generated by PR Sous Chef · run: https://github.com/github/gh-aw/actions/runs/30838483274

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 20.5 AIC · ⌖ 9.4 AIC · ⊞ 5.9K · ◷
_{Comment /souschef to run again}

Copilot · 2026-08-03T18:19:20Z

@copilot sous-chef triage:
There are still two unresolved review threads, but your follow-up indicates the fixes are already on the current head....

❌ Reviews — 2 outdated review threads remain unresolved in GitHub UI (r3706062697, r3706062796). I confirmed both concerns are already addressed on current HEAD 2be0bcf (block-scalar guard + manifest includes actions/setup-python).
✅ Checks (local) — make fmt, make lint, TEST_UNIT_RUN_FULL=1 make test-unit, make test, and make recompile passed.
❓ Checks (CI) — stale after agent run; current PR check shows one copilot run still in progress and prior failed CI log (job 91755554193) points to TestHashConsistencyAcrossLockFiles, which is now passing locally on current HEAD.
✅ Mergeable — PR is OPEN, not draft; mergeable state remains unstable due to pending CI/thread state.

Actions taken: re-triaged PR/checks, reviewed failing CI logs, reran full local validation suite, and verified no additional code changes were required.
Hand-off: resolve the two outdated review threads in GitHub and re-trigger CI from a maintainer context before merge.

gh-aw-bot · 2026-08-03T18:35:16Z

@copilot sous-chef triage:

This PR is not yet in a clean merge-ready state.

Please refresh the branch if needed, address remaining review/CI blockers, then run the pr-finisher skill and post a concise merge-readiness summary for the current head.

Generated by PR Sous Chef · run: https://github.com/github/gh-aw/actions/runs/30841444939

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 7.59 AIC · ⌖ 5.99 AIC · ⊞ 8.3K · ◷
_{Comment /souschef to run again}

Copilot · 2026-08-03T18:53:49Z

@copilot sous-chef triage:
This PR is not yet in a clean merge-ready state....

❌ Reviews — 2 outdated review threads are still unresolved in GitHub UI (r3706062697, r3706062796), though both concerns are already fixed on current HEAD 2be0bcf.
✅ Checks (local) — make fmt, make lint, TEST_UNIT_RUN_FULL=1 make test-unit, make test, make recompile, and make agent-report-progress all passed.
❓ Checks (CI) — latest copilot check is still in progress (91780889723); prior failing CI run (30834160543, job 91755554193) failed TestHashConsistencyAcrossLockFiles, which is now passing locally on current HEAD.
✅ Mergeable — PR is OPEN and not draft; state remains unstable pending thread cleanup / CI completion.

Actions taken: refreshed triage for current head, inspected CI logs, and reran full local validation. No new code changes were required.
Hand-off: resolve the two outdated review threads and re-trigger/complete CI from a maintainer context before merge.

github-actions · 2026-08-03T18:55:29Z

PR Triage: #50015

Category: chore
Risk: low
Score: 46/100 (Impact 20 + Urgency 10 + Quality 16)
Recommended action:batch_review
Batch:pr-batch:security-fixes

Adds zizmor unverified-creator lint-suppression annotations for 9 already SHA-pinned actions. Lint-only change, not a behavior/security fix itself.

Generated by 🔧 PR Triage Agent · auto · 51.1 AIC · ⌖ 4.08 AIC · ⊞ 8K · ◷

gh-aw-bot · 2026-08-03T19:16:32Z

@copilot This PR is still not merge-ready. Please address the remaining review feedback, fix the failing check, refresh the branch if needed, then run the pr-finisher skill and summarize merge readiness.

Unresolved reviews:

fix(security): inject zizmor unverified-creator annotations for all 9 SHA-pinned third-party actions #50015 (comment) — avoid injecting zizmor annotations into YAML block-scalar payloads such as run: | scripts; reuse the block-scalar state and skip payload content.
fix(security): inject zizmor unverified-creator annotations for all 9 SHA-pinned third-party actions #50015 (comment) — regenerate/correct the manifest so actions/setup-python is still tracked everywhere it is emitted.

Failed checks:

JS Tests (shard 4/4): https://github.com/github/gh-aw/actions/runs/30835526776/job/91775226624

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 15.3 AIC · ⌖ 9 AIC · ⊞ 8.3K · ◷
_{Comment /souschef to run again}

Copilot · 2026-08-03T19:34:33Z

@copilot This PR is still not merge-ready. Please address the remaining review feedback, fix the failing check, refresh the branch if needed, then run the pr-finisher skill and summarize merge readi...

Validated current head fed2e73:

The block-scalar injection concern is fixed in 2be0bcf (yamlBlockScalarState guard in injectZizmorUnverifiedCreatorAnnotations).
actions/setup-python is present in /home/runner/work/gh-aw/gh-aw/.github/workflows/dataflow-pr-discussion-dataset.lock.yml manifest and resolved manifest section.
The referenced failing JS check (30835526776 / 91775226624) is from PR Fix dynamic dispatch_workflow ref forwarding and prevent ref leakage into inputs #50042, not this PR branch.

I also re-ran local validation on this branch: make fmt && make lint && make test-unit && make test && make recompile — all pass.

No additional code changes were required in this pass.

gh-aw-bot · 2026-08-03T20:06:47Z

@copilot sous-chef triage:

Unresolved review threads remain:

copilot-pull-request-reviewer: fix(security): inject zizmor unverified-creator annotations for all 9 SHA-pinned third-party actions #50015 (comment)
copilot-pull-request-reviewer: fix(security): inject zizmor unverified-creator annotations for all 9 SHA-pinned third-party actions #50015 (comment)

Please address the unresolved review feedback, refresh the branch if needed, then run the pr-finisher skill and post a concise merge-readiness summary for the current head.

Generated by PR Sous Chef · run: https://github.com/github/gh-aw/actions/runs/30848087243

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 11.5 AIC · ⌖ 11.2 AIC · ⊞ 8.3K · ◷
_{Comment /souschef to run again}

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

github-actions · 2026-08-04T18:04:27Z

🎉 This pull request is included in a new release.

Release: v0.84.4

Initial plan
37a7f43

CopilotAI assigned Copilot and pelikhan Aug 3, 2026

Copilotstarted work on behalf of pelikhan August 3, 2026 15:39 View session

CopilotAI linked an issue Aug 3, 2026 that may be closed by this pull request
[static-analysis] Report - 2026-08-03 #49909
Closed
6 tasks

CopilotAIand others added 2 commits August 3, 2026 15:52

Initial progress report - planning zizmor unverified creator fixes
1a9d76c
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

fix: inject zizmor unverified-creator annotations for all 9 findings
5e83e1b
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

CopilotAI changed the title ~~[WIP] Update static analysis report for 2026-08-03~~fix(security): inject zizmor unverified-creator annotations for all 9 SHA-pinned third-party actionsAug 3, 2026

Copilotfinished work on behalf of pelikhan August 3, 2026 16:17

CopilotAI requested a review from pelikhan August 3, 2026 16:17

pelikhan marked this pull request as ready for review August 3, 2026 16:52

CopilotAI review requested due to automatic review settings August 3, 2026 16:52

Merge branch 'main' into copilot/static-analysis-report-2026-08-03
5572735

Copilotstarted reviewing on behalf of pelikhan August 3, 2026 16:52 View session

CopilotAI reviewed Aug 3, 2026
View reviewed changes

Merge branch 'main' into copilot/static-analysis-report-2026-08-03
3ed729a

Copilotstarted work on behalf of pelikhan August 3, 2026 17:00 View session

CopilotAIand others added 2 commits August 3, 2026 17:05

chore: start investigating CI failure feedback
ddf747f
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Merge branch 'main' into copilot/static-analysis-report-2026-08-03
5dbb342

github-actionsBot mentioned this pull request Aug 3, 2026
[pr-sous-chef] PR Sous Chef run report - 2026-08-03T00:15:52Z #49872
Closed

fix: skip block scalar payload when injecting zizmor uses annotations
2be0bcf
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilotfinished work on behalf of pelikhan August 3, 2026 17:32

Copilotstarted work on behalf of gh-aw-bot August 3, 2026 17:33 View session

Copilotfinished work on behalf of gh-aw-bot August 3, 2026 17:45

CopilotAI requested a review from gh-aw-bot August 3, 2026 17:45

Copilotstarted work on behalf of gh-aw-bot August 3, 2026 17:58 View session

Copilotfinished work on behalf of gh-aw-bot August 3, 2026 18:19

Copilotstarted work on behalf of gh-aw-bot August 3, 2026 18:36 View session

Copilotfinished work on behalf of gh-aw-bot August 3, 2026 18:54

github-actionsBot added pr-action:batch_review pr-agent:github-copilot pr-batch:security-fixes pr-priority:medium pr-risk:low pr-type:chore labels Aug 3, 2026

github-actionsBot mentioned this pull request Aug 3, 2026
[PR Triage Report] PR Triage Report — 2026-08-03 (14 PRs) #50066
Closed

Merge branch 'main' into copilot/static-analysis-report-2026-08-03
fed2e73

Copilotstarted work on behalf of gh-aw-bot August 3, 2026 19:17 View session

Copilotfinished work on behalf of gh-aw-bot August 3, 2026 19:35

Merge branch 'main' into copilot/static-analysis-report-2026-08-03
0b5ce0e

Copilotstarted work on behalf of gh-aw-bot August 3, 2026 20:07 View session

Apply remaining changes
205354b
Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilotfinished work on behalf of gh-aw-bot August 3, 2026 20:15

pelikhan merged commit 13e4b55 into mainAug 3, 2026
31 checks passed

pelikhan deleted the copilot/static-analysis-report-2026-08-03 branch August 3, 2026 20:48

Uh oh!

Conversation

CopilotAI commented Aug 3, 2026• edited by github-actions BotLoading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Compiler changes (pkg/workflow/)

Plain (non-compiled) workflow files

Example output (generated lock file)

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

pelikhan commented Aug 3, 2026

Uh oh!

gh-aw-bot commented Aug 3, 2026

Uh oh!

CopilotAI commented Aug 3, 2026

Uh oh!

CopilotAI commented Aug 3, 2026

Uh oh!

gh-aw-bot commented Aug 3, 2026

Uh oh!

CopilotAI commented Aug 3, 2026

Uh oh!

gh-aw-bot commented Aug 3, 2026

Uh oh!

CopilotAI commented Aug 3, 2026

Uh oh!

github-actionsBot commented Aug 3, 2026

PR Triage: #50015

Uh oh!

gh-aw-bot commented Aug 3, 2026

Uh oh!

CopilotAI commented Aug 3, 2026

Uh oh!

gh-aw-bot commented Aug 3, 2026

Uh oh!

Uh oh!

github-actionsBot commented Aug 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

CopilotAI commented Aug 3, 2026•
edited by github-actions Bot
Loading

Compiler changes (`pkg/workflow/`)