fix: harden temporary artifact handling by pelikhan · Pull Request #8663 · github/gh-aw-firewall

pelikhan · 2026-09-16T23:04:52Z

Summary

Remediates every finding tracked by github/vuln-mgmt#251067 for github/gh-aw-firewall.

github/vuln-mgmt#251055: removes the predictable timestamp-based default work directory and creates defaults atomically with mkdtempSync; validates reused directories as real directories with trusted root/SUDO_UID-aware ownership and rejects group/world-writable modes.
github/vuln-mgmt#251064: writes enclave-audit-incomplete.txt through the shared descriptor-based no-follow writer with fstat, fchmod, fsync, and guaranteed close; adds a real-filesystem symlink regression proving the external target remains unchanged.
github/vuln-mgmt#251043, github/vuln-mgmt#251057, github/vuln-mgmt#251053, github/vuln-mgmt#251047, github/vuln-mgmt#251040, github/vuln-mgmt#251065, github/vuln-mgmt#251061, github/vuln-mgmt#251063: replaces test-only URL/domain substring assertions with exact ACL-line equality and removes the redundant diagnostics substring lookup, without changing production domain matching.
Cleans fixed /tmp fixtures in the implicated main-action, Docker cleanup/coverage, and SSL key-storage tests; real filesystem cases now use unique mkdtempSync parents with reliable cleanup while fully mocked cases use explicit synthetic paths.
github/vuln-mgmt#251051: adds top-level pull-requests: read permissions to the pinned PR-title workflow.

Validation

Focused affected suite: 215 passed across 11 suites.
npm run lint -- --quiet
npm run type-check
npm run build
actionlint .github/workflows/pr-title.yml
Full unit suite: 5,868 passed, 2 skipped; 21 infrastructure-only failures remain in untouched tests because this macOS host has not accepted the Xcode license (Python-backed enclave harnesses), plus one environment-sensitive compose fixture.
Integration suite attempted: 72 passed, 2 skipped; remaining tests require passwordless sudo/Docker and failed because this host prompts for a sudo password.

A subsequent GitHub CodeQL scan is required to formally close the eight test-only alerts; no false-positive dismissal should be necessary because the flagged assertion patterns were removed.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot

Copilot review overview

🟡 Changes recommended

Reused directory permissions can expose sensitive endpoints, and early failures leak auto-created directories.

Get a fresh assessment by requesting another Copilot review.

Review effort: Balanced
Findings: 1 · 1

Open (2)

Keep reused work directories owner-only · New
Clean up defaults created before the cleanup boundary · New

What changed in this PR

Hardens temporary work directories and audit artifact writes against predictable paths and symlink attacks.

Changes:

Creates default work directories atomically and validates reused directories.
Adds descriptor-based, no-follow artifact writing and regression coverage.
Tightens ACL assertions, fixtures, and workflow permissions.

File	Description
`src/test-helpers/config-writer-test-harness.test-utils.ts`	Adapts ownership simulation.
`src/ssl-key-storage.test.ts`	Uses synthetic mocked paths.
`src/squid/acl-generator.test.ts`	Uses exact ACL assertions.
`src/fs-utils.ts`	Adds secure file writer.
`src/docker-manager-coverage.test.ts`	Isolates temporary fixtures.
`src/docker-manager-cleanup.test.ts`	Isolates cleanup fixtures.
`src/container-startup-diagnostics-coverage.test.ts`	Removes redundant substring assertions.
`src/config-writer.ts`	Validates ownership and reuses secure writer.
`src/config-writer.test.ts`	Updates ownership mocking.
`src/config-writer-new-branches.test.ts`	Covers ownership and permissions.
`src/commands/main-action.ts`	Creates unique defaults and securely writes markers.
`src/commands/main-action.test.ts`	Tests default-directory and marker behavior.
`src/commands/main-action.test-utils.ts`	Updates synthetic work directory.
`src/commands/main-action-security.test.ts`	Adds symlink regression coverage.
`src/commands/main-action-fs-mock.test-utils.ts`	Mocks atomic directory creation.
`src/cli-options.ts`	Removes predictable timestamp default.
`.github/workflows/pr-title.yml`	Grants pull-request read permission.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

github-actions · 2026-09-16T23:19:33Z

✅ Copilot review passed with no inline comments.

@pelikhan Add the ready-for-aw label to this PR to trigger agentic CI smoke tests.

github-actions · 2026-09-16T23:22:58Z

✅ Coverage Check Passed

Overall Coverage

Metric	Base	PR	Delta
Lines	94.18%	94.20%	📈 +0.02%
Statements	92.85%	92.87%	📈 +0.02%
Functions	93.46%	93.47%	📈 +0.01%
Branches	86.63%	86.67%	📈 +0.04%

📁 Per-file Coverage Changes (6 files)

File	Lines (Before → After)	Statements (Before → After)
`src/fs-utils.ts`	98.5% → 97.5% (-1.02%)	98.5% → 97.5% (-1.02%)
`src/config-writer.ts`	89.5% → 89.7% (+0.20%)	89.5% → 89.7% (+0.20%)
`src/commands/main-action-fs-mock.test-utils.ts`	94.1% → 94.4% (+0.33%)	95.0% → 95.2% (+0.23%)
`src/test-helpers/config-writer-test-harness.test-utils.ts`	96.7% → 97.0% (+0.39%)	96.8% → 97.1% (+0.37%)
`src/commands/main-action.ts`	97.0% → 97.5% (+0.46%)	97.1% → 97.5% (+0.45%)
`src/log-directory-setup.ts`	96.2% → 100.0% (+3.78%)	96.3% → 100.0% (+3.71%)

Coverage comparison generated by scripts/ci/compare-coverage.ts

github-actions · 2026-09-17T00:07:15Z

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

Warning

Firewall blocked 8 domains

The following domains were blocked by the firewall during workflow execution:

accounts.google.com
android.clients.google.com
clients2.google.com
contentautofill.googleapis.com
msfeed25.pkgs.visualstudio.com
update.googleapis.com
www.google.com
www.gstatic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "accounts.google.com"
    - "android.clients.google.com"
    - "clients2.google.com"
    - "contentautofill.googleapis.com"
    - "msfeed25.pkgs.visualstudio.com"
    - "update.googleapis.com"
    - "www.google.com"
    - "www.gstatic.com"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex

github-actions · 2026-09-17T00:07:15Z

✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓

🔑 BYOK report filed by Smoke Copilot BYOK

github-actions · 2026-09-17T00:07:17Z

🚀 Security Guard has started processing this pull request

github-actions · 2026-09-17T00:07:17Z

❌ Smoke Gemini reports failed. Facets need polishing...

💎 Faceted by Smoke Gemini

github-actions · 2026-09-17T00:07:18Z

❌ Smoke Copilot BYOK AOAI (api-key) reports failed. AOAI BYOK (api-key) mode investigation needed...

🔑 BYOK (AOAI api-key) report filed by Smoke Copilot BYOK AOAI (api-key)

github-actions · 2026-09-17T00:07:19Z

🔌 Smoke Services — All services reachable! ✅

🔌 Service connectivity validated by Smoke Services

github-actions · 2026-09-17T00:07:20Z

🛡️ Smoke Copilot Network Isolation confirmed the egress allowlist is enforced. ✅

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

example.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "example.com"

See Network Configuration for more information.

🛡️ Egress verdict from Smoke Copilot Network Isolation

github-actions · 2026-09-17T00:07:24Z

❌ Smoke Copilot BYOK AOAI (Entra) reports failed. AOAI BYOK (Entra) mode investigation needed...

🪪 BYOK (AOAI Entra) report filed by Smoke Copilot BYOK AOAI (Entra)

github-actions · 2026-09-17T00:07:24Z

✅ Build Test Suite completed successfully!

Generated by Build Test Suite for #8663

github-actions · 2026-09-17T00:07:34Z

📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅

📡 OTel tracing validated by Smoke OTel Tracing

github-actions · 2026-09-17T00:07:35Z

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

📰 BREAKING: Report filed by Smoke Copilot

github-actions · 2026-09-17T00:07:40Z

📰 DEVELOPING STORY: Smoke Docker Sbx reports failed. Our correspondents are investigating the incident...

📰 BREAKING: Report filed by Smoke Docker Sbx

github-actions · 2026-09-17T00:08:09Z

Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded.

Tested by Smoke Chroot

github-actions · 2026-09-17T00:08:11Z

✅ Smoke Claude passed

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

api.anthropic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.anthropic.com"

See Network Configuration for more information.

Generated by Smoke Claude for #8663

github-actions · 2026-09-17T00:10:19Z

Smoke Test: Copilot BYOK (Direct) Mode ✅

Test Results:

✅ GitHub MCP connectivity (PR data retrieved: Fix Refactoring Scanner safe-output fallback #8627, Fix Duplicate Code Detector Copilot model #8626)
✅ GitHub.com connectivity (HTTP 200)
✅ File write/read (smoke test file confirmed)
✅ BYOK inference path (this response proves it)

Mode: Direct BYOK (COPILOT_PROVIDER_API_KEY) → api-proxy → api.githubcopilot.com

Status: PASS

Assignees: @lpcox

🔑 BYOK report filed by Smoke Copilot BYOK
_{Add label ready-for-aw to run again}

github-actions · 2026-09-17T00:10:19Z

@lpcox

EGRESS_RESULT allow=pass deny=pass

✅ Allowed domain (github.com) reachable: allowed=200
✅ Non-allowed domain (example.com) blocked: 403 CONNECT tunnel failure

Overall: PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

example.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "example.com"

See Network Configuration for more information.

🛡️ Egress verdict from Smoke Copilot Network Isolation
_{Add label ready-for-aw to run again}

github-actions · 2026-09-17T00:10:33Z

Smoke Test: Copilot Engine — @lpcox

✅ GitHub MCP: PR Fix Refactoring Scanner safe-output fallback #8627, Fix Duplicate Code Detector Copilot model #8626 fetched
✅ GitHub.com connectivity (HTTP 200)
✅ File write/read test

Overall: PASS

📰 BREAKING: Report filed by Smoke Copilot
_{Add label ready-for-aw to run again}

github-actions · 2026-09-17T00:11:11Z

Smoke Test: Claude Engine Validation

Check	Status
API	✅ PASS
gh CLI	✅ PASS
File	✅ PASS

Overall result: PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

api.anthropic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.anthropic.com"

See Network Configuration for more information.

Generated by Smoke Claude for #8663 · claude · haiku45 · 55.2 AIC · ⊞ 4.5K · ◷
_{Add label ready-for-aw to run again}

github-actions · 2026-09-17T00:11:30Z

Smoke Test: API Proxy OpenTelemetry Tracing — Results

Scenario	Result
1. Module Loading	✅ `otel.js` loads successfully; exports `startRequestSpan`, `setTokenAttributes`, `setBudgetAttributes`, `endSpan`, `endSpanError`, `shutdown`, `isEnabled`, plus internal exporter/provider helpers
2. Test Suite	✅ 3 suites (`otel.test.js`, `otel-fanout.test.js`, `otel-workload-identity.test.js`), 68/68 tests passed
3. Env Var Forwarding	✅ `env-passthrough.ts` forwards `COPILOT_OTEL_FILE_EXPORTER_PATH`, `GITHUB_AW_OTEL_TRACE_ID`, `GITHUB_AW_OTEL_PARENT_SPAN_ID` to the agent container; `api-proxy-env-config.ts` (`buildOtelEnv`) forwards `OTEL_EXPORTER_OTLP_ENDPOINT`, `OTEL_EXPORTER_OTLP_HEADERS`, `OTEL_SERVICE_NAME`, and the same trace-context vars into the api-proxy container
4. Token Tracker Integration	✅ `onUsage` callback present in `token-tracker-http.js` (invoked with normalized usage + model as the OTEL hook point)
5. OTEL Diagnostics	⚪ Not applicable in this smoke test — no live proxy run was executed, so no spans were expected to be exported

Summary: All applicable scenarios passed. OTEL tracing integration is working as expected.

📡 OTel tracing validated by Smoke OTel Tracing
_{Add label ready-for-aw to run again}

github-actions · 2026-09-17T00:12:08Z

Smoke Test: Services Connectivity — PASS ✅

Redis PING: ✅ PONG
Postgres pg_isready: ✅ accepting connections
Postgres SELECT 1: ✅ 1

Overall: PASS

🔌 Service connectivity validated by Smoke Services
_{Add label ready-for-aw to run again}

github-actions · 2026-09-17T00:12:15Z

Merged PRs: "Fix Refactoring Scanner safe-output fallback"; "Fix Duplicate Code Detector Copilot model"
PR detail fetch: ✅
Playwright title check: ✅
File write/readback: ✅
Latest discussion comment: ✅
AWF build (npm ci && npm run build): ✅
Overall: PASS

Warning

Firewall blocked 8 domains

The following domains were blocked by the firewall during workflow execution:

accounts.google.com
android.clients.google.com
clients2.google.com
contentautofill.googleapis.com
msfeed25.pkgs.visualstudio.com
update.googleapis.com
www.google.com
www.gstatic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "accounts.google.com"
    - "android.clients.google.com"
    - "clients2.google.com"
    - "contentautofill.googleapis.com"
    - "msfeed25.pkgs.visualstudio.com"
    - "update.googleapis.com"
    - "www.google.com"
    - "www.gstatic.com"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

github-actions · 2026-09-17T00:12:26Z

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	✅	1/1 passed	✅ PASS
Bun	hono	✅	1/1 passed	✅ PASS
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	N/A	1/1 passed	✅ PASS
Deno	std	N/A	1/1 passed	✅ PASS
.NET	hello-world	✅	N/A (ran successfully)	✅ PASS
.NET	json-parse	✅	N/A (ran successfully)	✅ PASS
Go	color	✅	passed	✅ PASS
Go	env	✅	passed	✅ PASS
Go	uuid	✅	passed	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS
Java	caffeine	✅	1/1 passed	✅ PASS
Node.js	clsx	✅	passed	✅ PASS
Node.js	execa	✅	passed	✅ PASS
Node.js	p-limit	✅	passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 8/8 ecosystems passed — PASS

Notes:

Java: Maven's default ~/.m2 directory was root-owned and inaccessible to the runner user; builds/tests were run with -Dmaven.repo.local=/tmp/gh-aw/agent/m2-repo as a workaround, using the squid-proxy:3128 proxy settings from ~/.m2/settings.xml as configured. Both projects compiled and passed all tests.
All other ecosystems built/installed and passed tests without issue via the firewall proxy.

Generated by Build Test Suite for #8663 · copilot · auto · 44.7 AIC · ⊞ 10.6K · ◷
_{Add label ready-for-aw to run again}

github-actions · 2026-09-17T00:13:49Z

Chroot Version Comparison

Runtime	Host Version	Chroot Version	Match?
Python	Python 3.12.14	Python 3.12.14	✅ YES
Node.js	v24.20.0	v22.23.2	❌ NO
Go	go1.22.12	go1.22.12	✅ YES

Overall result: ❌ Not all tests passed (Node.js version mismatch between host and chroot environment). Skipping the smoke-chroot label since ALL_TESTS_PASSED=false.

Tested by Smoke Chroot
_{Add label ready-for-aw to run again}

fix: remediate temporary file vulnerabilities

f98a4dd

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot AI balanced review requested due to automatic review settings September 16, 2026 23:04

Copilot started reviewing on behalf of pelikhan September 16, 2026 23:05

View session

Copilot AI reviewed Sep 16, 2026

View reviewed changes

Comment thread src/config-writer.ts Outdated

Comment thread src/commands/main-action.ts Outdated

fix: preserve work directory confidentiality

4f09507

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

lpcox added the ready-for-aw label Sep 17, 2026

lpcox had a problem deploying to aoai-model September 17, 2026 00:07 — with GitHub Actions Failure

github-actions Bot added the smoke-copilot-network-isolation Copilot network-isolation egress smoke test label Sep 17, 2026

github-actions Bot added the smoke-copilot-byok label Sep 17, 2026

github-actions Bot added the smoke-copilot label Sep 17, 2026

lpcox deployed to aoai-model September 17, 2026 00:10 — with GitHub Actions Active

lpcox deployed to aoai-model September 17, 2026 00:11 — with GitHub Actions Active

github-actions Bot added the smoke-claude label Sep 17, 2026

This was referenced Sep 17, 2026

[aw] Smoke Gemini failed #8664

Closed

[aw] Smoke Copilot BYOK AOAI (Entra) failed #8665

Closed

[aw] Smoke Copilot BYOK AOAI (api-key) failed #8666

Closed

github-actions Bot added the smoke-services label Sep 17, 2026

github-actions Bot added the smoke-codex label Sep 17, 2026

github-actions Bot mentioned this pull request Sep 17, 2026

[aw] Smoke Docker Sbx failed #8667

Closed

github-actions Bot added the build-test label Sep 17, 2026

lpcox merged commit 1c89d28 into main Sep 17, 2026
176 of 181 checks passed

lpcox deleted the pelikhan-security-remediations branch September 17, 2026 02:16

github-actions Bot mentioned this pull request Sep 18, 2026

🩺 Runner Doctor UpdateRunner Doctor knowledge-base update: D14 follow-up fixes (2026-09-16 scan) #8751

Closed

Copilot AI mentioned this pull request Sep 18, 2026

Update Runner Doctor D14 Cloud Hypervisor diagnostics #8756

Merged

github-actions Bot mentioned this pull request Sep 21, 2026

🩺 Runner Doctor UpdateRunner Doctor knowledge-base update: D14 retry-fix follow-up (2026-09-19 scan) #8844

Closed

Copilot AI mentioned this pull request Sep 21, 2026

Sync D14 runner-doctor catalog with #8801 Cloud Hypervisor retry-fix follow-up #8854

Merged

github-actions Bot mentioned this pull request Sep 22, 2026

fix: propagate config fields to all layers #8876

Merged

5 tasks done

Conversation

pelikhan commented Sep 16, 2026

Summary

Validation

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Sep 16, 2026

Uh oh!

github-actions Bot commented Sep 16, 2026

✅ Coverage Check Passed

Overall Coverage

Uh oh!

github-actions Bot commented Sep 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 17, 2026

Uh oh!

github-actions Bot commented Sep 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 17, 2026

Smoke Test: Copilot BYOK (Direct) Mode ✅

Uh oh!

github-actions Bot commented Sep 17, 2026

Uh oh!

github-actions Bot commented Sep 17, 2026

Uh oh!

github-actions Bot commented Sep 17, 2026

Smoke Test: Claude Engine Validation

Uh oh!

github-actions Bot commented Sep 17, 2026

Smoke Test: API Proxy OpenTelemetry Tracing — Results

Uh oh!

github-actions Bot commented Sep 17, 2026

Smoke Test: Services Connectivity — PASS ✅

Uh oh!

github-actions Bot commented Sep 17, 2026

Uh oh!

github-actions Bot commented Sep 17, 2026

🏗️ Build Test Suite Results

Uh oh!

github-actions Bot commented Sep 17, 2026 •

edited

Loading

github-actions Bot commented Sep 17, 2026 •

edited

Loading

github-actions Bot commented Sep 17, 2026 •

edited

Loading

github-actions Bot commented Sep 17, 2026 •

edited

Loading

github-actions Bot commented Sep 17, 2026 •

edited

Loading

github-actions Bot commented Sep 17, 2026 •

edited

Loading

github-actions Bot commented Sep 17, 2026 •

edited

Loading

github-actions Bot commented Sep 17, 2026 •

edited

Loading

github-actions Bot commented Sep 17, 2026 •

edited

Loading

github-actions Bot commented Sep 17, 2026 •

edited

Loading

github-actions Bot commented Sep 17, 2026 •

edited

Loading

github-actions Bot commented Sep 17, 2026 •

edited

Loading

github-actions Bot commented Sep 17, 2026 •

edited

Loading