From c6c764a91567588eae0cd0d1e62b41893caa1558 Mon Sep 17 00:00:00 2001
From: Don Petry <36422719+don-petry@users.noreply.github.com>
Date: Sun, 11 Oct 2026 20:57:45 -0500
Subject: [PATCH 1/3] Potential fix for code scanning alert no. 41: Checkout of
 untrusted code in a non-privileged context

Copilot Autofix for this issue

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
---
 .github/workflows/dev-lead-reusable.yml | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/dev-lead-reusable.yml b/.github/workflows/dev-lead-reusable.yml
index ad3aa22fb..d013ca27c 100644
--- a/.github/workflows/dev-lead-reusable.yml
+++ b/.github/workflows/dev-lead-reusable.yml
@@ -788,11 +788,24 @@ jobs:
         with:
           token: ${{ secrets.GH_PAT_DON_PETRY || secrets.GH_PAT_WORKFLOWS || github.token }}
 
+      - name: Validate dev-lead scripts ref
+        run: |
+          ref="${{ inputs.agent_ref }}"
+          if [ -z "$ref" ]; then
+            echo "::error::inputs.agent_ref must be provided as a pinned commit SHA."
+            exit 1
+          fi
+          if ! [[ "$ref" =~ ^[0-9a-fA-F]{40}$ ]]; then
+            echo "::error::inputs.agent_ref must be a full 40-character commit SHA; branch and tag refs are not allowed."
+            exit 1
+          fi
+          echo "SAFE_AGENT_REF=$ref" >> "$GITHUB_ENV"
+
       - name: Checkout dev-lead scripts
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: petry-projects/.github-private
-          ref: ${{ inputs.agent_ref }}
+          ref: ${{ env.SAFE_AGENT_REF }}
           path: .dev-lead
           token: ${{ secrets.GH_PAT_DON_PETRY || secrets.GH_PAT_WORKFLOWS || github.token }}
           sparse-checkout: |

From 6d7e8e5f31d455ff0351241d201c2f9564d02fa7 Mon Sep 17 00:00:00 2001
From: don-petry <36422719+don-petry@users.noreply.github.com>
Date: Mon, 12 Oct 2026 05:56:28 +0000
Subject: [PATCH 2/3] fix(reviews): pass agent_ref via env instead of inline
 expression interpolation

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 .github/workflows/dev-lead-reusable.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/dev-lead-reusable.yml b/.github/workflows/dev-lead-reusable.yml
index d013ca27c..afb5a9d48 100644
--- a/.github/workflows/dev-lead-reusable.yml
+++ b/.github/workflows/dev-lead-reusable.yml
@@ -789,8 +789,10 @@ jobs:
           token: ${{ secrets.GH_PAT_DON_PETRY || secrets.GH_PAT_WORKFLOWS || github.token }}
 
       - name: Validate dev-lead scripts ref
+        env:
+          INPUT_AGENT_REF: ${{ inputs.agent_ref }}
         run: |
-          ref="${{ inputs.agent_ref }}"
+          ref="$INPUT_AGENT_REF"
           if [ -z "$ref" ]; then
             echo "::error::inputs.agent_ref must be provided as a pinned commit SHA."
             exit 1

From 44881beae4cbff71bd330dbe97c9888e759e201d Mon Sep 17 00:00:00 2001
From: don-petry <36422719+don-petry@users.noreply.github.com>
Date: Wed, 14 Oct 2026 15:15:58 +0000
Subject: [PATCH 3/3] fix(reviews): hand validated agent_ref to checkout via
 step output, not GITHUB_ENV

---
 .github/workflows/dev-lead-reusable.yml | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/dev-lead-reusable.yml b/.github/workflows/dev-lead-reusable.yml
index 1ddd74018..1f6d53270 100644
--- a/.github/workflows/dev-lead-reusable.yml
+++ b/.github/workflows/dev-lead-reusable.yml
@@ -789,6 +789,7 @@ jobs:
           token: ${{ secrets.GH_PAT_DON_PETRY || secrets.GH_PAT_WORKFLOWS || github.token }}
 
       - name: Validate dev-lead scripts ref
+        id: agent_ref
         env:
           INPUT_AGENT_REF: ${{ inputs.agent_ref }}
         run: |
@@ -801,13 +802,13 @@ jobs:
             echo "::error::inputs.agent_ref must be a full 40-character commit SHA; branch and tag refs are not allowed."
             exit 1
           fi
-          echo "SAFE_AGENT_REF=$ref" >> "$GITHUB_ENV"
+          echo "ref=$ref" >> "$GITHUB_OUTPUT"
 
       - name: Checkout dev-lead scripts
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: combsmith/.github-private
-          ref: ${{ env.SAFE_AGENT_REF }}
+          ref: ${{ steps.agent_ref.outputs.ref }}
           path: .dev-lead
           token: ${{ secrets.GH_PAT_DON_PETRY || secrets.GH_PAT_WORKFLOWS || github.token }}
           sparse-checkout: |