fix: trust gh-aw infrastructure actions in safe update enforcement#25891
Merged
fix: trust gh-aw infrastructure actions in safe update enforcement#25891
Conversation
Safe update enforcement only trusted actions under the actions/ GitHub org. When `gh aw upgrade` changed the setup action from github/gh-aw/actions/setup to github/gh-aw-actions/setup, the new repo path was flagged as 'unapproved' because it wasn't in the manifest and wasn't in the trusted set. Add github/gh-aw/actions/ and github/gh-aw-actions/ as trusted action prefixes alongside actions/, since these are gh-aw's own infrastructure actions that get upgraded automatically by `gh aw upgrade`.
Contributor
There was a problem hiding this comment.
Pull request overview
Updates safe-update enforcement to avoid falsely flagging gh-aw’s own infrastructure actions as “unapproved” when gh aw upgrade rewrites action paths.
Changes:
- Replace
isActionsOrgRepo()withisTrustedActionRepo()to allow bothactions/org actions and gh-aw infrastructure action prefixes. - Add regression tests covering the
gh aw upgradepath rewrite scenario and first-compile behavior.
Show a summary per file
| File | Description |
|---|---|
| pkg/workflow/safe_update_enforcement.go | Expands the trusted action allowlist logic to include gh-aw infrastructure action prefixes. |
| pkg/workflow/safe_update_enforcement_test.go | Adds test cases ensuring gh-aw infrastructure actions are exempted from “unapproved action” violations. |
Copilot's findings
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 2/2 changed files
- Comments generated: 0
…ub.com/github/gh-aw into fix/trust-gh-aw-actions-in-safe-update
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
gh aw upgradecan update the setup action repo path fromgithub/gh-aw/actions/setuptogithub/gh-aw-actions/setup. Safe update enforcement then flags the new path as an "unapproved action" because only theactions/GitHub org was in the trusted set.This produces a spurious warning:
Fix
Add
github/gh-aw/actions/andgithub/gh-aw-actions/as trusted action prefixes inisTrustedActionRepo(), alongside the existingactions/org trust. These are gh-aw's own infrastructure actions that get upgraded automatically bygh aw upgrade, so they should never be flagged as unapproved third-party additions.Changes
pkg/workflow/safe_update_enforcement.go: Replace narrowisActionsOrgRepo()withisTrustedActionRepo()that also trusts gh-aw infrastructure action prefixespkg/workflow/safe_update_enforcement_test.go: Add tests for gh-aw action trust, including the exact upgrade scenario (old path in manifest, new path in compilation)