Security Alert Burndown #21632

Activity

1. github-actions

   added

   enhancementNew feature or requestNew feature or request

   on Apr 8, 2026
2. github-actions commented on Apr 8, 2026

   

   github-actionsbot

   on Apr 8, 2026 – with GitHub Actions

   Contributor

   More actions

   🏷️ Issue Triaged

   Hi @mnkiefer! I've categorized this issue as enhancement based on the following analysis:

   Reasoning: This is a campaign tracking Epic for systematically remediating code security alerts — it represents an ongoing improvement effort to strengthen the codebase's security posture, making enhancement the most fitting label.

   View Triage Details

   Analysis

   • Keywords detected: "security alerts", "burn down", "backlog", "vulnerabilities", "campaign"
   • Issue type indicators: Epic/campaign tracking issue for security improvements; not a bug report, feature request, or question — it's an active improvement initiative
   • Confidence: High

   Recommended Next Steps

   • Link related fix PRs as sub-issues or references for traceability
   • Update the campaign status section as alerts are resolved
   • Consider closing once the campaign objectives are fully met

   References: Triage run §24142323339

   Note

   🔒 Integrity filter blocked 37 items

   The following items were blocked because they don't meet the GitHub integrity level.

   • Copilot CLI should retry on transient CAPIError 400 Bad Request during agentic workflow execution #25313 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
   • codex exec command line argument misplaced #25304 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
   • Gemini engine fails with AWF proxy: GEMINI_API_BASE_URL points to proxy but proxy has no Gemini handler #25294 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
   • MCP Gateway container missing ACTIONS_ID_TOKEN_REQUEST_URL / ACTIONS_ID_TOKEN_REQUEST_TOKEN env vars #25224 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
   • AWF API proxy doubles https:// scheme in --anthropic-api-target URL #25137 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
   • Temporary ID references in patch content are not resolved before git am #25130 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
   • agent-stdio.log must be mode 0600 and MCP gateway tokens must be masked in log pipelines #25103 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
   • Claude engine safeoutputs MCP shared bearer token enables direct write-sink bypass in local-analysis environment #25102 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
   • Claude engine should pin claude-code to a verified version and restrict sandbox env/network for npm operations #25101 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
   • MCP container images pulled without SHA-256 digest pinning; node:lts-alpine uses floating LTS tag #25071 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
   • Using agentic workflow from an organization .github repo #24961 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
   • Cross-org workflow_call: resolve_host_repo, checkout, and hash check all fail #24949 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
   • SARIF upload gives "Resource not accessible by integration" error #24930 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
   • Ability for checkout_pr_branch.cjs to preserve .github/skills/ and .github/instructions/ from base branch #23769 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
   • Safe-outputs write-sink MCP must use a distinct, scoped bearer token not shared with the read GitHub MCP #23740 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
   • assign_to_agent: allow multiple assignments to same issue when pull_request_repo differs #23726 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
   • ... and 21 more items

   To allow these resources, lower min-integrity in your GitHub frontmatter:

   tools:
     github:
       min-integrity: approved  # merged | approved | unapproved | none

   Generated by Issue Triage Agent · ● 417.5K · ◷
3. dsyme

   closed this as completedon Apr 15, 2026