[Copilot]

Workflow allowlist denials could surface as generic CLI failures, triggering futile retries and aborting scans. Several affected workflows also needed clearer tool-boundary guidance or explicit permissions for required operations.

• Denial handling

  • Classify explicit workflow-tool denials as permission_denied, stop retries, and report missing-tool guidance without suggesting credential escalation.
  • Match the SDK’s driver log marker to avoid misclassifying arbitrary output.

  [sdk-driver] permission denied by workflow tool permissions: shell(git status)
  → permission_denied; no retry; report missing tool
  

• Workflow alignment

  • Clarify standalone, allowlisted command use in four workflow prompts.
  • Add issue-reading access and the exact scan-log commands needed by the container image scan.
  • Allow the formal verifier’s referenced TLA+ installer test script.
  • Regenerate the five affected compiled workflow locks.

• Fixes [AW Top 10] 08 Fix tool allowlist denials that abort agent runs #75853

[github-actions]

❌ PR Specification Reviewer failed to deliver outputs. Please review the logs for details.

Caution

agentic threat detected
Threat detection flagged this output in warn mode. Manual review is REQUIRED before any follow-up automation.

Details

Potential security threats were detected in the agent output. Detected threat types: malicious patch.

Review the workflow run logs for details.

Generated by PR Specification Reviewer for #75986

[github-actions]

🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer

[github-actions]

✅ Ponytail Reviewer completed successfully!

Ponytail Reviewer

Outcome: reported_no_action

The agent completed and reported no action. A no-op output alone does not verify that all required work was completed or that publication was possible.

Agent messages are omitted from this comment. The category uses structured run status, not interpretation of agent prose.

Generated from Ponytail Reviewer · routed: gpt61 medium · ~4 AIC · ⌖ ~1 AIC · ◇ ~1 AIC · ⊞ 181 · ◷

Generated by Ponytail Reviewer for #75986

[github-actions]

✅ Test Quality Sentinel completed test quality analysis.

Test Quality Sentinel

Outcome: reported_no_action

The agent completed and reported no action. A no-op output alone does not verify that all required work was completed or that publication was possible.

Agent messages are omitted from this comment. The category uses structured run status, not interpretation of agent prose.

Generated from Test Quality Sentinel · routed: haiku55 xhigh · ~1 AIC · ⌖ ~2 AIC · ◇ ~1 AIC · ⊞ 7.2K · ◷

🧪 Test quality analysis by Test Quality Sentinel

[github-actions]

✅ PR Code Quality Reviewer completed the code quality review.

🔎 Code quality review by PR Code Quality Reviewer

[github-actions]

✅ Design Decision Gate 🏗️ completed the design decision gate check. See the comment below for the result and any generated ADR draft.

Design Decision Gate 🏗️

Outcome: reported_no_action

The agent completed and reported no action. A no-op output alone does not verify that all required work was completed or that publication was possible.

Agent messages are omitted from this comment. The category uses structured run status, not interpretation of agent prose.

Generated from Design Decision Gate 🏗️ · routed: haiku55 xhigh · ~2 AIC · ⌖ ~2 AIC · ◇ ~1 AIC · ⊞ 8.6K · ◷

🏗️ ADR gate enforced by Design Decision Gate 🏗️

[github-actions]

Comment Memory

Peek at saved memory (pr-code-quality-reviewer)

reviewed_at: 2026-11-08T22:51:50Z
review_event: COMMENT
top_themes:
  - wildcarded workflow grep allowlists may permit arbitrary options and paths
files_reviewed:
  - .github/workflows/daily-community-attribution.md
  - .github/workflows/daily-formal-spec-verifier.md
  - .github/workflows/daily-spdd-spec-planner.md
  - .github/workflows/daily-squid-image-scan.md
  - .github/workflows/pr-specification-reviewer.md
  - actions/setup/js/copilot_harness.cjs
  - actions/setup/js/permission_denied_helpers.cjs
  - actions/setup/js/harness_failure_handling.cjs
comment_count: 1

Note

This comment is managed by comment memory.

Expand the saved memory block to view or edit the persistent context for this thread.
Edit only the text inside the backtick fences; workflow metadata and the footer are regenerated automatically.

Learn more about comment memory

🔎 Code quality review by PR Code Quality Reviewer · copilot · gpt50 · ~3 AIC · ⌖ ~2 AIC · ⊞ 1.6K · ◷
_{Comment /review to run again}

[github-actions]

I found one actionable issue: the new wildcarded grep allowlist can permit model-supplied options or extra file operands, potentially reading outside the intended scan directory. Please constrain those command shapes before merge. I also reviewed the denial-classification changes and workflow guidance; no additional blocking issues were identified from the capped diff. Static review only; tests were not run per review instructions.

🔎 Code quality review by PR Code Quality Reviewer · copilot · gpt50 · ~3 AIC · ⌖ ~2 AIC · ⊞ 1.6K
_{Comment /review to run again}

[github-actions]

Caution

agentic threat detected
Threat detection flagged this output in warn mode. Manual review is REQUIRED before any follow-up automation.

Details

Potential security threats were detected in the agent output. Detected threat types: malicious patch.

Review the workflow run logs for details.

Reviewed PR head 142f43a9a36845c4999926fe22617839a39d0fc5 against Copilot SDK Driver Specification v1.0.2 and security architecture requirements.

Blocking finding

• Prompt-injectable denial classification (actions/setup/js/permission_denied_helpers.cjs:78, also recorded by the existing inline review comment): hasWorkflowToolPermissionDenial() trusts a forgeable line-shaped [sdk-driver] permission denied by workflow tool permissions: marker in untrusted combined model/driver output. An agent can emit that text and force permission_denied, suppress retries, and trigger missing-tool guidance despite no actual SDK denial. The added negative test only rejects non-line-leading text; it does not establish provenance. Fix by classifying only a trusted structured SDK event/channel or by authenticating/separating driver stderr from model output; do not broaden the regex to accept textual markers. This is required to preserve fail-secure/auditable security behavior.

Specification synchronization

Queued commit f08ac02 via safe output updates docs/src/content/docs/specs/copilot-sdk-driver-specification.md from v1.0.2 to v1.0.3. It documents the anchored marker contract, retry termination, non-escalation guidance, and adds T-CSD-112/113. This documentation update does not resolve the provenance flaw above.

Coverage limit: static review only; no PR code, tests, or conformance scripts were executed, per review policy.

Generated by PR Specification Reviewer for #75986 · copilot · gpt50 · ~5 AIC · ⌖ ~3 AIC · ⊞ 1.7K
_{Comment /review-specs to run again}

[Copilot]

🟢 Approval recommended

No active review issues are reported for the workflow tool-denial handling changes.

No open issues 🎉

What changed in this PR

This PR updates gh-aw’s Copilot failure handling to distinguish workflow tool denials from generic CLI failures, addressing #75853 and avoiding futile retries.

Changes:

• Recognize SDK-marked tool denials, stop retries, and provide workflow-permission guidance without suggesting credential escalation.
• Clarify command boundaries in four workflow prompts, update scan and verifier allowlists, and regenerate five workflow locks.
• Add denial-classification regression coverage and an index-search reference to the workflow skill.

File	Description
actions/​setup/​js/​safeoutputs_cli.cjs	Updates the permission-denial suppression comment.
actions/​setup/​js/​permission_denied_helpers.test.cjs	Tests marker matching and denial-specific reporting.
actions/​setup/​js/​permission_denied_helpers.cjs	Requires the SDK marker and tailors missing-tool guidance.
actions/​setup/​js/​harness_failure_handling.test.cjs	Updates expected permission-failure log messages.
actions/​setup/​js/​harness_failure_handling.cjs	Generalizes log wording beyond repeated denials.
actions/​setup/​js/​copilot_harness.test.cjs	Tests explicit denial classification and retry suppression.
actions/​setup/​js/​copilot_harness.cjs	Integrates explicit denials into classification and stop handling.
.github/​workflows/​pr-specification-reviewer.md	Adds standalone-command and blocked-operation guidance.
.github/​workflows/​pr-specification-reviewer.lock.yml	Refreshes hashes for the revised prompt.
.github/​workflows/​daily-squid-image-scan.md	Sets issue-only GitHub tools and adds scan-log commands.
.github/​workflows/​daily-squid-image-scan.lock.yml	Regenerates tool configuration and workflow hashes.
.github/​workflows/​daily-spdd-spec-planner.md	Adds standalone-command and blocked-operation guidance.
.github/​workflows/​daily-spdd-spec-planner.lock.yml	Refreshes hashes for the revised prompt.
.github/​workflows/​daily-formal-spec-verifier.md	Allows the TLA+ installer test and clarifies shell boundaries.
.github/​workflows/​daily-formal-spec-verifier.lock.yml	Regenerates verifier permissions and workflow hashes.
.github/​workflows/​daily-community-attribution.md	Adds standalone-command and blocked-operation guidance.
.github/​workflows/​daily-community-attribution.lock.yml	Refreshes prompt, admission, and harness hashes.
.github/​skills/​agentic-workflows/​SKILL.md	Adds the index-search documentation reference.

_{Review effort: Balanced (auto)}

[github-actions]

Skills-Based Review 🧠

Applied /diagnosing-bugs and /tdd. Requesting changes: the workflow-denial detector can be spoofed from agent output, and the prompt guidance is not in the compiled locks.

📋 Key Themes & Highlights

Key Themes

• Spoofable signal: hasWorkflowToolPermissionDenial matches a line-start [sdk-driver] line, and the harness classifies assistant-influenced output. An echoed line forces permission_denied and suppresses retries (verified).
• Test gap: the negative test covers only a mid-line phrase, so the spoof path is untested.
• Allowlist breadth: unquoted grep -nE * / grep -oE * and a full pipeline entry in the squid job widen the command surface.
• Lock drift: the new prompt guidance is absent from the four affected .lock.yml files at HEAD. Run make recompile.

Positive Highlights

• ✅ The permission denied classification is now separated from generic CLI failures, with a clear reason and retry behaviour.
• ✅ The rename from "numerous permission-denied" to a precise workflow-denial reason makes logs easier to act on.
• ✅ Explicit test assertions updated alongside the behaviour change.

@copilot please address the review comments above.

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer · copilot · routed: haiku55 xhigh · ~11 AIC · ⌖ ~2 AIC · ⊞ 6.3K
_{Comment /matt to run again}

[gh-aw-bot]

@copilot

Copilot assignment requested for the following outstanding work:

1. Update this branch with the latest main using make merge-main, resolving any conflicts and preserving the intended changes.
2. Review (.github/workflows/daily-squid-image-scan.md:28): The broad * argument here appears to let the agent choose arbitrary grep options and additional file operands, not just the intended scan logs. For example, a supplied pattern beginning with - can become an option, and extra paths can make grep read outside /tmp/gh-aw/agent/image-scan; the analogous grep -oE * entry has the same issue. Please pin the regex/path shape or route this through a dedicated fixed-argument script so the allowlist cannot be expanded by model-supplied arguments. - Classify Copilot tool denials and align workflow allowlists #75986 (comment)
3. Review (actions/setup/js/permission_denied_helpers.cjs:78): [/diagnosing-bugs] The workflow-denial check still trusts text the agent can produce. hasWorkflowToolPermissionDenial now matches a line-start [sdk-driver] permission denied by workflow tool permissions:, but copilot_harness.cjs classifies result.output, which includes assistant text (copilot_sdk_session.cjs line 542). I verified that an assistant-echoed line-start marker returns true, so an agent can force permission_denied, suppress retries, and emit report_missing_tool. Prefer a structured signal from the SDK driver, such as an exit code or a separate event channel, over... - Classify Copilot tool denials and align workflow allowlists #75986 (comment)
4. Review (actions/setup/js/permission_denied_helpers.test.cjs:42): [/tdd] This negative test only covers a phrase in the middle of a line. Add a case pinning the intended behaviour when a line-start [sdk-driver] permission denied by workflow tool permissions: shell(ls) appears in assistant output. Right now that case returns true, so the spoofing path has no test and a regression would pass silently. - Classify Copilot tool denials and align workflow allowlists #75986 (comment)
5. Review (.github/workflows/daily-squid-image-scan.md:29): [/diagnosing-bugs] grep -nE * leaves the pattern as an unquoted glob, so the allowlist entry matches any pattern and any file in the directory. That is wider than the exact-command intent. Narrow the entry to the specific pattern and file names the job needs, and quote the pattern. - Classify Copilot tool denials and align workflow allowlists #75986 (comment)
6. Review (.github/workflows/daily-squid-image-scan.md:30): [/tdd] The grep -oE * ... | sort | uniq -c entry allowlists a full pipeline with an unquoted glob, which widens the command surface. Confirm the job needs this exact pipeline, and drop the pipeline or narrow the pattern. Add a test or check that the entry cannot be extended with other commands. - Classify Copilot tool denials and align workflow allowlists #75986 (comment)
7. Review (.github/workflows/daily-formal-spec-verifier.md:70): [/diagnosing-bugs] This allowlists a repository script the agent can run. Confirm the agent cannot write to .github/scripts/install_tla_runtime_test.sh or to anything it sources, and that the script only runs fixture-based checks with no network or credential access. Otherwise a modified script becomes an arbitrary-code path through an allowed command. - Classify Copilot tool denials and align workflow allowlists #75986 (comment)
8. Review (.github/workflows/daily-formal-spec-verifier.md:105): [/diagnosing-bugs] The new prompt guidance is not present in daily-formal-spec-verifier.lock.yml at HEAD, nor in the other three locks this PR touches. The lock is out of sync with its source. Run make recompile and commit the regenerated locks so the guidance reaches the runtime. - Classify Copilot tool denials and align workflow allowlists #75986 (comment)
9. Fix failing check JS Tests (shard 7/8) (FAILURE): https://github.com/github/gh-aw/actions/runs/42532071939/job/128888332285.
10. Fix failing check JS Tests (shard 7/8) (FAILURE): https://github.com/github/gh-aw/actions/runs/42529663215/job/128880946945.
11. Fix failing check safe_outputs (FAILURE): https://github.com/github/gh-aw/actions/runs/42532071928/job/128890023457.

Once you start work, post this work summary as a PR comment without the leading Copilot mention, including the Sous-chef head, work, and state lines below, to record that the assignment is running. Apply the necessary fixes on this PR's existing branch, reply to each listed review thread and resolve it when addressed. Ignore feedback already answered or resolved; stop when only human review or CI remains. Do not merge or trigger CI.

Sous-chef requested-head: 142f43a
Sous-chef requested-work: 023e8cf2941c759c44ee737f4225e85ed4bc83bea2f87c8752bc51093177c072 072b1db30f56d7828275eba68db0ea7cd21fcce8771ebf57d792353a7488bf3d 244a9d08b745405e60339a52e04ce8f3cd7b3bbb56262e5f3ee94f3ebf5fd0d7 2c18092484158e6c1fa23f93a75612d5546a53209acd4d81dcffd4050473ca03 47f188a12b316525c2202f4f75b82185d76be0a140c0f99eae185cf2b7d8acb1 5117f7b932e4a3c25d6a5082dad5bf133efe80a56554c56656db97d445035eb0 a355fdd92eb3fb91b570c5f46e56763e664a4670c426874c39ce30c2895bf07e c0e04ee1a4393459d720efbb0415e6a022b927f1508d688131e7deca649d04bd c7cf93e497befdd5e698d00101b0703e4101fe4133d86d433f7c170d07402b7e
Sous-chef requested-state: 7be0aec20a3cff8d6a7f8bc34c1abacc98d2214a6227aa1714906fc430354a57

Generated by 👨🍳 PR Sous Chef · pi · haiku45 · ~7 AIC · ⌖ ~12 AIC · ⊞ 1.2K · ◷
_{Comment /souschef to run again}

[Copilot]

@copilot

Copilot assignment requested for the following outstanding work:...

Sous-chef requested-head: 142f43a
Sous-chef requested-work: 023e8cf2941c759c44ee737f4225e85ed4bc83bea2f87c8752bc51093177c072 072b1db30f56d7828275eba68db0ea7cd21fcce8771ebf57d792353a7488bf3 244a9d08b745405e60339a52e04ce8f3cd7b3bbb56262e5f3ee94f3ebf5fd0d7 2c18092484158e6c1fa23f93a75612d5546a53209acd4d81dcffd4050473ca03 47f188a12b316525c2202f4f75b82185d76be0a140c0f99eae185cf2b7d8acb1 5117f7b932e4a3c25d6a5082dad5bf133efe80a56554c56656db97d445035eb0 a355fdd92eb3fb91b570c5f46e56763e664a4670c426874c39ce30c2895bf07e c0e04ee1a4393459d720efbb0415e6a022b927f1508d688131e7deca649d04bd c7cf93e497befdd5e698d00101b0703e4101fe4133d86d433f7c170d07402b7e
Sous-chef requested-state: 7be0aec20a3cff8d6a7f8bc34c1abacc98d2214a6227aa1714906fc430354a57

Work is underway: I’m merging the latest main, narrowing the scan-log command allowlist, replacing denial detection based on agent-visible text with a trusted structured signal, verifying the TLA+ installer script boundary, recompiling workflow locks, and investigating the cited failing checks. I’ll validate changes and respond to the actionable review threads.

ok