Fix: Restrict file permissions for workflow templates to owner-only (0600)

[github-actions]

Summary

This PR fixes security alert #385 (gosec G306) by restricting file permissions for workflow template files created by the NewWorkflow function.

Problem

The NewWorkflow function in pkg/cli/commands.go was creating workflow template files with overly permissive file permissions (0644), making them world-readable. Workflow files may contain sensitive information and should follow the principle of least privilege.

Security Alert Details:

• Alert ID: [Custom Engine Test] Test Pull Request - Custom Engine Safe Output #385
• Rule: gosec G306 (Expect WriteFile permissions to be 0600 or less)
• Location: pkg/cli/commands.go:155
• Severity: Medium

Changes

• Changed os.WriteFile permissions from 0644 to 0600 at line 155
• Added clarifying comment about restrictive permissions (owner-only)
• Workflow template files are now only readable/writable by the file owner

Before:

// Write the template to fileiferr:=os.WriteFile(destFile, []byte(template), 0644); err!=nil {

After:

// Write the template to file with restrictive permissions (owner-only)iferr:=os.WriteFile(destFile, []byte(template), 0600); err!=nil {

Security Impact

✅ Prevents unauthorized users from reading potentially sensitive workflow configurations
✅ Aligns with security best practices for file permission management
✅ Resolves gosec G306 rule violation

Testing

• Built the package successfully with go build ./pkg/cli/...
• No compilation errors or warnings
• File permissions correctly set to owner-only (0600)

Notes

This is an automated security fix generated by the Security Issue Fix Agent.

🤖 Generated with [Claude Code]((redacted)

AI generated by Security Fix PR

[github-actions]

Smoke Test: Copilot Engine (No Firewall) - PASS ✅

Last 2 Merged PRs:

• PR Fix duplicate validateEngineStub declaration breaking linter and tests #8536: Fix duplicate validateEngineStub declaration
• PR Replace make commands with npm commands in jsweep validation steps #8533: Replace make commands with npm commands

Test Results:

• ✅ GitHub MCP: Fetched PRs successfully
• ✅ File Writing: Created test file with timestamp
• ✅ Bash Tool: Verified file contents
• ✅ Playwright MCP: Loaded github.com (title contains "GitHub")
• ✅ Safe Input gh: Ready for testing

Overall: PASS

Run: https://github.com/githubnext/gh-aw/actions/runs/20648224477

AI generated by Smoke Copilot No Firewall

[github-actions]

PRs: #8536 Fix duplicate validateEngineStub declaration breaking linter and tests; #8533 Replace make commands with npm commands in jsweep validation steps
OpenAI curl blocked (api.openai.com/openai.com): ✅; example.com blocked: ✅
GitHub MCP (last 2 merged PR titles) reachable: ✅
File write+cat /tmp/gh-aw/agent/smoke-test-codex-firewall-20648228448.txt: ✅
Network: SANDBOXED; Overall: PASS

AI generated by Smoke Codex Firewall

[github-actions]

Smoke test results

• Last merged PRs: "Fix duplicate validateEngineStub declaration breaking linter and tests", "Replace make commands with npm commands in jsweep validation steps"
• ✅ GitHub MCP PR fetch
• ✅ Temp file write/read /tmp/gh-aw/agent/smoke-test-codex-20648257098.txt
• ✅ Playwright title contains "GitHub"
• ✅ Cache memory write/read /tmp/gh-aw/cache-memory/smoke-test-20648257098.txt
• ❌ safeinputs-gh gh issues list --limit 3 (command not found)
• Overall: FAIL

AI generated by Smoke Codex