Conversation
Permit curl and the GitHub archive/release redirect hosts in all three community submission workflows. Require direct download evidence, preserve existing pinning checks, and cover the source and compiled configuration with regression checks. Closes github#4589 Assisted-by: GitHub Copilot (model: GPT-6 Astra, autonomous) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Contributor
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
The bundle workflow unnecessarily allows codeload access despite accepting only release assets.
Get a fresh assessment by requesting another Copilot review.
Review effort: Balanced
Findings: 2
Open (2)
What changed in this PR
Enables direct archive validation in community submission workflows while constraining downloads to HTTPS GitHub hosts.
Changes:
- Allows
curland GitHub archive redirect hosts. - Adds timeout, status verification, and non-execution safeguards.
- Regenerates workflow locks and adds regression tests.
| File | Description |
|---|---|
.github/workflows/add-community-extension.md |
Enables guarded archive downloads. |
.github/workflows/add-community-extension.lock.yml |
Regenerates the extension workflow. |
.github/workflows/add-community-preset.md |
Enables guarded archive downloads. |
.github/workflows/add-community-preset.lock.yml |
Regenerates the preset workflow. |
.github/workflows/add-community-bundle.md |
Enables release-asset downloads. |
.github/workflows/add-community-bundle.lock.yml |
Regenerates the bundle workflow. |
tests/test_github_workflows.py |
Verifies permissions, hosts, and download safeguards. |
💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| allowed: | ||
| - defaults | ||
| - github.com | ||
| - codeload.github.com |
Comment on lines
+316
to
+320
| download_hosts = { | ||
| "github.com", | ||
| "codeload.github.com", | ||
| "release-assets.githubusercontent.com", | ||
| } |
mnriem
added
the
triage-must-have
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Closes #4589.
Run 34898212927 denied the archive
curlcommand because it was absent from the shell tool allowlist. The resolved firewall configuration also omittedcodeload.github.comandrelease-assets.githubusercontent.com, so permitting the command alone would leave the accepted download URLs blocked at their redirect destinations.curland only the required GitHub download hosts alongside the existing default network policy in the extension, preset, and bundle submission workflows, which share the same validation requirements and configuration gap.Testing
uv run specify --helpuv sync && uv run pytestWorkflow-only change; CLI/sample-project checks and the full suite were not run. Targeted validation used this worktree's own virtualenv:
.venv/bin/python -m pytest tests/test_github_workflows.py -q: 14 passed. All three new regression checks failed before the fix.gh aw compile add-community-extension add-community-preset add-community-bundle --strict --no-check-update: all three compiled with zero errors or warnings using v0.79.8, matching their existing compiler metadata. Unrelated compiler drift was removed to retain existing action pins and repository configuration.curltool permission changed; existing action/container pins and policies remain unchanged.codeload.github.com.git diff --checkpassed.The hosted workflow has not been rerun; end-to-end confirmation is needed after merge and a new submission-label trigger.
AI Disclosure
GitHub Copilot (model: GPT-6 Astra), acting on behalf of @mnriem, investigated the run, authored the fix and regression coverage, and performed the local validation autonomously. @mnriem requested the work and authorized the commit and upstream PR; the changes have not been represented as human-authored or line-by-line human-reviewed.