Use inline threat detection for Code Scanning Fixer

[Copilot]

The Code Scanning Fixer detection job failed because the experimental external detector could not download threat-detect from GitHub Releases.

• Detection path

  • Remove gh-aw-detection from the workflow feature flags.
  • Retain threat detection through the compiler’s inline detection path.

• Generated workflow

  • Regenerate code-scanning-fixer.lock.yml without the external binary installation and execution steps.

# External detector feature removed:# features:# gh-aw-detection: true

• Fixes[aw] Failed jobs: Code Scanning Fixer #51272

[pelikhan]

@copilot fix the installer script instead

[Copilot]

@copilot fix the installer script instead

Implemented in cda634d. The installer now uses GitHub Releases latest/download redirects instead of the unauthenticated GitHub API, with focused coverage for that path.

[pelikhan]

@copilot do not use gh APIs, download the binary release directly .

[Copilot]

@copilot do not use gh APIs, download the binary release directly .

Implemented in a699b05. The installer now constructs direct GitHub Release asset URLs for both versioned and latest releases, and the test verifies direct binary and checksum downloads without API requests.

[Copilot]

Pull request overview

Aims to move Code Scanning Fixer to inline detection, but currently modifies the external detector installer instead.

Changes:

• Uses GitHub’s latest-release download endpoint.
• Updates installer documentation and tests.
• Does not update or regenerate the Code Scanning Fixer workflow.

Show a summary per file

File	Description
pkg/constants/version_constants.go	Updates latest-version documentation.
actions/setup/sh/install_threat_detect_binary.sh	Changes latest-release download behavior.
actions/setup/sh/install_threat_detect_binary_test.sh	Tests direct latest-release URLs.

Review details

Tip

Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 3/3 changed files
• Comments generated: 1
• Review effort level: Balanced

[github-actions]

✅ Design Decision Gate 🏗️ completed the design decision gate check.

No ADR enforcement needed: PR does not have the 'implementation' label and has ≤100 new lines of code in business logic directories (only 2 additions detected).

🏗️ ADR gate enforced by Design Decision Gate 🏗️

[github-actions]

✅ Test Quality Sentinel completed test quality analysis.

No Go or JavaScript test files were added or modified in this PR. Test Quality Sentinel skipped. (PR contains changes to shell script install_threat_detect_binary_test.sh and version constants, which are outside the scope of Go/JavaScript test analysis.)

🧪 Test quality analysis by Test Quality Sentinel

[github-actions]

🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer

[github-actions]

✅ PR Code Quality Reviewer completed the code quality review.

Warning

Threat Detection Engine Failure — The analysis engine could not complete. This is a tooling failure, not a security finding.

What happened

The threat detection engine failed to produce results.

Review the workflow run logs for details.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• api.individual.githubcopilot.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
allowed:
- defaults
- "api.individual.githubcopilot.com"

See Network Configuration for more information.

🔎 Code quality review by PR Code Quality Reviewer

[github-actions]

The change is correct and well-tested. Using releases/latest/download is the idiomatic GitHub way to fetch the latest release asset without an extra API call, and the new Test 8 validates the URL shape end-to-end. No blocking issues found.

🧵 Reviewed using Impeccable skills by Impeccable Skills Reviewer · sonnet46 · 16.1 AIC · ⌖ 7.11 AIC · ⊞ 5.5K

[github-actions]

Skills-Based Review 🧠

Applied /diagnosing-bugs and /tdd — the installer fix is correct and the new regression test is well-structured. One scope gap flagged inline.

📋 Key Themes & Highlights

Key Themes

• Scope mismatch: PR description mentions removing gh-aw-detection from code-scanning-fixer.md, but that file is absent from the diff. See the inline comment.

Positive Highlights

• ✅ Root cause properly addressed: direct /releases/latest/download avoids GitHub API rate-limit/auth failures
• ✅ Test 8 explicitly asserts no api.github.com calls and checks correct URL shapes — good specification-level coverage
• ✅ run_installer signature extended cleanly with the version parameter
• ✅ Versioned installs (v0.4.0 etc.) are unaffected by the change

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer · sonnet46 · 34.3 AIC · ⌖ 7.47 AIC · ⊞ 7.1K
_{Comment /matt to run again}

[github-actions]

[/diagnosing-bugs] The PR description says gh-aw-detection is removed from code-scanning-fixer.md, but that file is not in this diff — the feature flag and generated lock file remain unchanged. The installer fix here is correct, but without removing the feature flag the external binary path is still invoked, so the job may still fail in other scenarios.

💡 Suggested follow-up

Either:

1. Remove features: gh-aw-detection: true from .github/workflows/code-scanning-fixer.md and regenerate the lock, or
2. Update the PR description to clarify that fixing the installer alone is the intended scope and the feature flag intentionally stays.

@copilot please address this.

[github-actions]

🎉 This pull request is included in a new release.

Release: v0.86.2