Skip to content

Replace curl | bash with gh extension install in install.md - #16

Merged
mrjf merged 2 commits into
mainfrom
copilot/fix-install-md-curl-bash
Apr 4, 2026
Merged

Replace curl | bash with gh extension install in install.md#16
mrjf merged 2 commits into
mainfrom
copilot/fix-install-md-curl-bash

Conversation

CopilotAI commented Apr 4, 2026

Copy link
Copy Markdown
Contributor

install.md pipes remote code directly to shell via curl -sL ... | bash, with the -s flag suppressing errors. This is a well-known anti-pattern for installing software.

Changes:

  • Use gh extension install github/gh-aw as the primary install method
  • Move curl-based install to a collapsible fallback using download-then-execute:
    curl -fL https://raw.githubusercontent.com/github/gh-aw/main/install-gh-aw.sh -o /tmp/install-gh-aw.sh
    bash /tmp/install-gh-aw.sh
    rm -f /tmp/install-gh-aw.sh
  • Add -f (fail on HTTP errors), drop -s (silent) so errors surface

CopilotAI linked an issue Apr 4, 2026 that may be closed by this pull request
- Make `gh extension install github/gh-aw` the primary install method
- Move curl-based install to collapsible fallback with download-then-execute
- Use `-f` flag (fail on HTTP errors), remove `-s` (silent) flag
- Update troubleshooting section reference
Fixes#12
Agent-Logs-Url: https://github.com/githubnext/autoloop/sessions/a6c8d12b-6d27-417a-951f-582d4adcfce3
Co-authored-by: mrjf <180956+mrjf@users.noreply.github.com>
CopilotAI changed the title [WIP] Fix curl bash command in install.md for better securityReplace curl | bash with gh extension install in install.mdApr 4, 2026
CopilotAI requested a review from mrjfApril 4, 2026 04:37
@mrjf
mrjf marked this pull request as ready for review April 4, 2026 04:52
@mrjf
mrjf merged commit bb92631 into mainApr 4, 2026
15 checks passed
@mrjf
mrjf deleted the copilot/fix-install-md-curl-bash branch April 4, 2026 04:55
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

curl | bash in install.md

2 participants

@mrjf