Skip to content

Suppress benign workflow exfiltration findings - #52083

Merged
pelikhan merged 3 commits into
mainfrom
copilot/static-analysis-report-2026-08-11
Aug 11, 2026
Merged

Suppress benign workflow exfiltration findings#52083
pelikhan merged 3 commits into
mainfrom
copilot/static-analysis-report-2026-08-11

Conversation

CopilotAI commented Aug 11, 2026

Copy link
Copy Markdown
Contributor

Static analysis flagged intended provider API requests and loopback health checks as potential secret exfiltration. It also identified an ambiguous ShellCheck conditional in the VulnHunter workflow.

  • Runner Guard

    • Add scoped RGS-012 suppressions for official model-provider endpoints.
    • Document the unauthenticated models.dev request.
    • Suppress loopback-only Ollama and documentation-server requests.
  • ShellCheck

    • Rewrite the VulnHunter best-effort grep pipeline to avoid SC2015 ambiguity.
  • Generated workflows

    • Recompile the four affected lockfiles from their Markdown sources.

CopilotAI linked an issue Aug 11, 2026 that may be closed by this pull request
CopilotAIand others added 2 commits August 11, 2026 15:14
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
CopilotAI changed the title [WIP] Update static analysis report for 2026-08-11Suppress benign workflow exfiltration findingsAug 11, 2026
CopilotAI requested a review from pelikhanAugust 11, 2026 15:20
@pelikhan
pelikhan marked this pull request as ready for review August 11, 2026 15:25
CopilotAI balanced review requested due to automatic review settings August 11, 2026 15:25
@pelikhan
pelikhan merged commit 1dd49c6 into mainAug 11, 2026
@pelikhan
pelikhan deleted the copilot/static-analysis-report-2026-08-11 branch August 11, 2026 15:25
Copilot stopped reviewing on behalf of pelikhan due to an error August 11, 2026 15:25

CopilotAI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Note

Copilot could not run the full agentic suite for this review because it was automatically requested on a bot-authored pull request. Request a review from Copilot under Reviewers to retry with the full agentic suite. Improved support for bot-authored pull requests is coming soon.

Updates GitHub Actions workflows to satisfy runner-guard checks and make the vulnhunter scan’s repo traversal more robust.

Changes:

  • Add runner-guard:ignore RGS-012 annotations for local/read-only HTTP probes and known-safe API calls.
  • Adjust daily-vulnhunter-scan to avoid continuing when cd "$REPO_ROOT" fails.
  • Regenerate corresponding *.lock.yml workflows to reflect source workflow updates / version bumps.
Show a summary per file
FileDescription
.github/workflows/docs-noob-tester.mdAdds runner-guard ignore annotations for localhost readiness checks.
.github/workflows/docs-noob-tester.lock.ymlRegenerates locked workflow to include the same annotations.
.github/workflows/daily-vulnhunter-scan.mdChanges add_hits() to handle cd $REPO_ROOT failure differently.
.github/workflows/daily-vulnhunter-scan.lock.ymlRegenerates locked workflow with the updated add_hits() implementation.
.github/workflows/daily-pr-review-cursor.lock.ymlBumps locked workflow metadata/version values.
.github/workflows/daily-model-inventory.mdAdds runner-guard ignore annotations for external model inventory fetches.
.github/workflows/daily-model-inventory.lock.ymlRegenerates locked workflow to include the same annotations.
.github/workflows/daily-byok-ollama-test.mdAdds runner-guard ignore annotations for localhost Ollama probes/requests.
.github/workflows/daily-byok-ollama-test.lock.ymlRegenerates locked workflow to include the same annotations.

Review details

Tip

Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

  • Files reviewed: 9/9 changed files
  • Comments generated: 1
  • Review effort level: Lite

: > "$HITS"
add_hits() {
(cd "$REPO_ROOT" && grep -rlE "$2" . 2>/dev/null || true) \
(cd "$REPO_ROOT" || return; grep -rlE "$2" . 2>/dev/null || true) \
CopilotAI added a commit that referenced this pull request Aug 11, 2026
PR #52083 landed the RGS-012 suppressions on main using the repo's
established convention: the directive is placed inside the run script
directly above the offending curl, where the compiler emits it verbatim.
That makes the step-level comment preservation added here unnecessary,
so the compiler post-processing, its tests, the ADR and the duplicate
step-level suppressions are removed in favour of main's version.
Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>
@github-actions

Copy link
Copy Markdown
Contributor

🎉 This pull request is included in a new release.

Release: v0.86.2

Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[static-analysis] Report - 2026-08-11

3 participants

@pelikhan