From fb5baacbf9ddeb05c6d32c6833bec2cbd93849b5 Mon Sep 17 00:00:00 2001 From: stranske Date: Sun, 16 Aug 2026 14:07:50 -0500 Subject: [PATCH 1/3] fix(security): pass belt-dispatcher inputs via env, not script interpolation --- .github/workflows/agents-71-codex-belt-dispatcher.yml | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/.github/workflows/agents-71-codex-belt-dispatcher.yml b/.github/workflows/agents-71-codex-belt-dispatcher.yml index c94f979e6..025a512a9 100644 --- a/.github/workflows/agents-71-codex-belt-dispatcher.yml +++ b/.github/workflows/agents-71-codex-belt-dispatcher.yml @@ -225,6 +225,9 @@ jobs: - name: Resolve candidate issue id: pick uses: actions/github-script@v9 + env: + FORCE_ISSUE: ${{ inputs.force_issue }} + AGENT_KEY: ${{ inputs.agent_key }} with: github-token: ${{ env.GH_DISPATCH_TOKEN }} script: | @@ -234,8 +237,8 @@ jobs: core, task: 'belt-dispatcher-pick', }); - const forced = '${{ inputs.force_issue }}'; - const agentKey = String('${{ inputs.agent_key }}' || 'codex').trim().toLowerCase() || 'codex'; + const forced = process.env.FORCE_ISSUE || ''; + const agentKey = String(process.env.AGENT_KEY || 'codex').trim().toLowerCase() || 'codex'; const { owner, repo } = context.repo; const summary = core.summary; From 68530e5b14563a097f432be590d1fd1692711a53 Mon Sep 17 00:00:00 2001 From: stranske Date: Sun, 16 Aug 2026 14:07:52 -0500 Subject: [PATCH 2/3] fix(security): same fix in the consumer template synced to all consumers --- .../.github/workflows/agents-71-codex-belt-dispatcher.yml | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/templates/consumer-repo/.github/workflows/agents-71-codex-belt-dispatcher.yml b/templates/consumer-repo/.github/workflows/agents-71-codex-belt-dispatcher.yml index 0c9255a0f..b9dfd0444 100644 --- a/templates/consumer-repo/.github/workflows/agents-71-codex-belt-dispatcher.yml +++ b/templates/consumer-repo/.github/workflows/agents-71-codex-belt-dispatcher.yml @@ -225,6 +225,9 @@ jobs: - name: Resolve candidate issue id: pick uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9 + env: + FORCE_ISSUE: ${{ inputs.force_issue }} + AGENT_KEY: ${{ inputs.agent_key }} with: github-token: ${{ env.GH_DISPATCH_TOKEN }} script: | @@ -234,8 +237,8 @@ jobs: core, task: 'codex-belt-dispatcher-pick', }); - const forced = '${{ inputs.force_issue }}'; - const agentKey = String('${{ inputs.agent_key }}' || 'codex').trim().toLowerCase() || 'codex'; + const forced = process.env.FORCE_ISSUE || ''; + const agentKey = String(process.env.AGENT_KEY || 'codex').trim().toLowerCase() || 'codex'; const { owner, repo } = context.repo; const summary = core.summary; From 2190bf1c9fd51582bfcea1eb5eccf78b9ece2738 Mon Sep 17 00:00:00 2001 From: stranske Date: Sun, 16 Aug 2026 14:10:52 -0500 Subject: [PATCH 3/3] chore: re-baseline belt-dispatcher drift fingerprints after the env: fix --- config/template-drift-allowlist.txt | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/config/template-drift-allowlist.txt b/config/template-drift-allowlist.txt index 75951fa65..23105cd30 100644 --- a/config/template-drift-allowlist.txt +++ b/config/template-drift-allowlist.txt @@ -50,9 +50,9 @@ reason = Intentional divergence re-reviewed 2026-08-09: root intake now records [pair.2] main = .github/workflows/agents-71-codex-belt-dispatcher.yml template = templates/consumer-repo/.github/workflows/agents-71-codex-belt-dispatcher.yml -main_sha256 = 4c00b0622181cd89c09f9297446c65045538245789809ca5fc899592d26af482 -template_sha256 = 53a57369e4d0f526edc88bdf4bbc079ee095ccd41a9a7fe37e0d9e0b828be8e3 -reason = Existing reviewed baseline drift re-baselined 2026-06-20: exported Orchestrator skill inputs were added to both root and consumer dispatcher surfaces while preserving consumer action pinning and Codex-specific wording. +main_sha256 = 0e9a4c7e7b120985fd9684a9e4f89049601b2bbc0b9da9bee5510d3ec1c3c175 +template_sha256 = 6a7b6e203f6ac2837bc09dc2dc6620faa37b72cb78068af1bb77779e246cb1dd +reason = Intentional divergence re-baselined 2026-08-16: workflow_dispatch inputs (force_issue, agent_key) are now passed to the github-script step via step-level env: and read through process.env instead of being interpolated into the script body, removing a script-injection surface that caused GitHub to block the workflow as possibly malicious in consumer repos. Applied identically to both surfaces; consumer action pinning and Codex-specific wording preserved. [pair.3] main = .github/workflows/agents-72-codex-belt-worker.yml