Tags: github/gh-aw
Tags
Fix `gh aw logs` discarding all processed runs due to variable shadow… …ing (#49332) * Initial plan * Fix gh aw logs discarding processed runs due to variable shadowing Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> * Add changeset for logs processed-runs fix Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
fix: address top-5 high-severity Sighthound security findings (#48824) * Initial plan * fix: address sighthound security findings (path traversal, SSRF, false positives) Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> * fix: tighten security validations per review feedback Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Peli de Halleux <pelikhan@users.noreply.github.com>
Mitigate secret argv exposure and harden remote include write boundar… …ies (#48318) * Initial plan * Fix secret argv exposure and include write boundary checks Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> * docs(adr): add draft ADR-48318 for secret stdin delivery and include write boundaries * Fix --body - flag in secret set calls and fix ValidatePathWithinBase symlink ancestor bypass Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> * Thread ctx through uploadSecretToRepo, replace fetchIncludeFromSource global with parameter, add .. guard and nested traversal test Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
[eslint-miner] fix(eslint): extend require-fetch-try-catch to detect … …member-chained fetch calls (#47967) * fix(eslint): extend require-fetch-try-catch to detect member-chained fetch calls Previously, isAwaitFetchCall only matched bare `await fetch(url)` expressions. Any method chain on the result (`await fetch(url).then(...)`, `.catch(...)`, `.json()`) had a MemberExpression callee and silently escaped detection. This change: - Adds getRootFetchCall() to walk call/member chains and identify fetch at the root - Adds chainHasRejectionHandler() to recognize .catch(handler) and two-arg .then() as satisfying the error-handling requirement (no flag emitted for those) - Updates the AwaitExpression visitor to use these new helpers - Adds test cases covering chained-fetch valid/invalid patterns Closes #47950, relates to #47932 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix(eslint): address review feedback on require-fetch-try-catch rule Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> * chore: merge main into fix branch Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> * style(eslint): apply prettier formatting to require-fetch-try-catch.ts Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> Co-authored-by: Peli de Halleux <pelikhan@users.noreply.github.com>
Pin docker/build-push-action to commit SHA (CodeQL alert #625) (#47334) * Initial plan * fix: pin docker/build-push-action to commit SHA to resolve alert #625 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> Co-authored-by: Peli de Halleux <pelikhan@users.noreply.github.com>
[aw] Reduce Daily VulnHunter Scan AI credit usage by switching to Son… …net model (#47002) * Initial plan * Optimize Daily VulnHunter scan model cost Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
fix: propagate tools.startup-timeout to gateway.startupTimeout (preve… …nts safeoutputs eviction on slow runners) (#46875) * Initial plan * fix: propagate tools.startup-timeout to gateway.startupTimeout to prevent safeoutputs timeout Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> * docs(adr): add draft ADR-46875 for always emitting gateway.startupTimeout Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
PreviousNext