Reject direct issue creation and safe-output access in post-steps by Copilot · Pull Request #66064 · github/gh-aw

Copilot · 2026-10-06T07:37:44Z

User post-steps can attempt to publish agent-generated issues outside safe outputs or read the agent’s output file directly. The compiler now reports these patterns as errors and points authors to safe outputs.

Validation: Check main and imported post-steps for direct issue creation through common gh, REST, curl, and GitHub Script patterns, and for access to agent_output.json. Read-only issue queries remain allowed.
Guidance: Identify the offending step and suggest safe-outputs.create-issue for issue publishing. Document the restriction in the post-steps reference.
Coverage: Add cases for rejected patterns and permitted read-only operations.

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

pelikhan · 2026-10-06T11:49:16Z

@copilot they also try to access the safeoutputs mcp storage file outputs.jsonl

Copilot

Copilot review overview

🟡 Changes recommended

Validation still permits prohibited operations and rejects valid read-only requests.

Review effort: Balanced
Findings: 7

Open (7)

Recognize gh issue commands after -R or --repo · New
Correctly infer curl methods from body, GET, and overrides · New
Detect issue creation via octokit.request and github.request · New
Block access to raw safe-output files and runtime paths · New
Validate file inputs for artifact upload actions · New
Scan complete logical shell commands across continued lines · New
Recognize gh api --input before the endpoint · New

What changed in this PR

Adds compiler checks intended to keep post-step issue publishing and agent-output access within the safe-output system.

Changes:

Validates main and imported post-steps.
Adds rejection, read-only, and compilation tests.
Documents the restriction and safe-output alternative.

File	Description
`pkg/workflow/workflow_builder_steps.go`	Validates merged post-steps.
`pkg/workflow/post_steps_validation.go`	Detects prohibited commands and output-file references.
`pkg/workflow/post_steps_validation_test.go`	Tests validation and compiler integration.
`docs/src/content/docs/reference/steps-jobs.md`	Documents post-step restrictions.

Copilot · 2026-10-06T12:37:55Z

+)
+
+var (
+	postStepIssueCreateRE = regexp.MustCompile(`(?i)(?:^|[\s|;&])gh\s+issue\s+create\b`)


Added detection for gh -R/--repo before issue create and regression coverage confirming gh -R ... issue list remains allowed. Fix is in e24f63b.

Copilot · 2026-10-06T12:37:55Z

+	postStepIssueAPIRE    = regexp.MustCompile(`(?i)(?:^|[/\s"'=])(?:https://api\.github\.com/)?repos/(?:[^/\s"'?]+/[^/\s"'?]+|\$\{\{\s*github\.repository\s*\}\}|\$\{?GITHUB_REPOSITORY\}?)/issues(?:[?"'\s]|$)`)
+	postStepAPIPostRE     = regexp.MustCompile(`(?i)(?:^|\s)(?:-X\s+POST|--method(?:=|\s+)POST|-f(?:\s|=)|-F(?:\s|=)|--(?:raw-)?field(?:\s|=))`)
+	postStepAPIGetRE      = regexp.MustCompile(`(?i)(?:^|\s)(?:-X\s+GET\b|--method(?:=|\s+)GET\b)`)
+	postStepCurlPostRE    = regexp.MustCompile(`(?i)\bcurl\b[^\n]*\s(?:-X\s+POST\b|--request(?:=|\s+)POST\b|(?:-d|--data(?:-raw|-binary|-urlencode)?)(?:\s|=))`)


Curl validation now derives the effective method from JSON/data options, -G/--get, and explicit -X/--request overrides, with POST and GET regression cases. Fix is in e24f63b.

Copilot · 2026-10-06T12:37:54Z

+	postStepAPIPostRE     = regexp.MustCompile(`(?i)(?:^|\s)(?:-X\s+POST|--method(?:=|\s+)POST|-f(?:\s|=)|-F(?:\s|=)|--(?:raw-)?field(?:\s|=))`)
+	postStepAPIGetRE      = regexp.MustCompile(`(?i)(?:^|\s)(?:-X\s+GET\b|--method(?:=|\s+)GET\b)`)
+	postStepCurlPostRE    = regexp.MustCompile(`(?i)\bcurl\b[^\n]*\s(?:-X\s+POST\b|--request(?:=|\s+)POST\b|(?:-d|--data(?:-raw|-binary|-urlencode)?)(?:\s|=))`)
+	postStepOctokitRE     = regexp.MustCompile(`\b(?:github|octokit)(?:\.rest)?\.issues\.create\s*\(`)


Added checks for literal POST issue routes in both github.request and octokit.request; GET and issue-comment routes remain allowed. Fix is in e24f63b.

Copilot · 2026-10-06T12:37:54Z

+	postStepAPIGetRE      = regexp.MustCompile(`(?i)(?:^|\s)(?:-X\s+GET\b|--method(?:=|\s+)GET\b)`)
+	postStepCurlPostRE    = regexp.MustCompile(`(?i)\bcurl\b[^\n]*\s(?:-X\s+POST\b|--request(?:=|\s+)POST\b|(?:-d|--data(?:-raw|-binary|-urlencode)?)(?:\s|=))`)
+	postStepOctokitRE     = regexp.MustCompile(`\b(?:github|octokit)(?:\.rest)?\.issues\.create\s*\(`)
+	postStepOutputRE      = regexp.MustCompile(`(?i)(?:\bagent_output\.json\b|(?:safeoutputs|safe-outputs)/output\.json\b|\bGH_AW_AGENT_OUTPUT\b)`)


The validator now rejects outputs.jsonl, the collected safe-output path, GH_AW_SAFE_OUTPUTS, and the runtime-path expression. Fix is in e24f63b.

Copilot · 2026-10-06T12:37:54Z

+		if with, ok := step["with"].(map[string]any); ok {
+			if script, ok := with["script"].(string); ok {
+				scripts = append(scripts, script)
+			}
+		}


Added safe-output checks for path inputs to upload-artifact, cache, and upload-pages-artifact actions, including broad /tmp/gh-aw/ paths. The docs example now uploads only /tmp/gh-aw/agent/. Fix is in e24f63b.

Copilot · 2026-10-06T12:37:55Z

+
+		for _, script := range scripts {
+			createsIssue := postStepIssueCreateRE.MatchString(script) || postStepOctokitRE.MatchString(script)
+			for _, command := range ghAPICmdRE.FindAllStringSubmatch(script, -1) {


Shell validation now joins backslash-continued lines and splits commands at unquoted shell separators, preserving command boundaries. Added continued gh api and curl regressions. Fix is in e24f63b.

Copilot · 2026-10-06T12:37:54Z

+			createsIssue := postStepIssueCreateRE.MatchString(script) || postStepOctokitRE.MatchString(script)
+			for _, command := range ghAPICmdRE.FindAllStringSubmatch(script, -1) {
+				for _, args := range command {
+					if postStepIssueAPIRE.MatchString(parseGHAPIEndpoint(args)) &&


Handled gh api --input before the endpoint in post-step endpoint parsing and added a regression case for that argument order. Fix is in e24f63b.

pelikhan · 2026-10-06T12:04:41Z

@copilot run pr-finisher skill
also scan for secrets in post-step env section (should not be allowed)

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-10-06T12:09:35Z

@copilot they also try to access the safeoutputs mcp storage file outputs.jsonl

Post-step validation now rejects both safeoutputs/outputs.jsonl and the collected safeoutputs.jsonl path. Added regression coverage in commit 11c44de.

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-10-06T12:37:54Z

@copilot run pr-finisher skill
also scan for secrets in post-step env section (should not be allowed)

Post-step validation now rejects GitHub secret references in step-level env values without echoing the referenced secret. Added coverage and documented the restriction in e24f63b.

pelikhan · 2026-10-06T12:45:00Z

@copilot merge main, recompile , fix golden wasm

…support-for-post-steps Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-10-06T13:00:34Z

@copilot merge main, recompile , fix golden wasm

Merged main, recompiled all workflows, and refreshed the stale WASM golden fixtures. The CI golden failures are fixed in 39511b8.

pelikhan · 2026-10-06T13:29:47Z

@copilot fix https://github.com/github/gh-aw/actions/runs/37467420656/job/112292656739?pr=66064

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-10-06T13:45:18Z

@copilot fix https://github.com/github/gh-aw/actions/runs/37467420656/job/112292656739?pr=66064

Fixed the failing workflow tests in 527bcf6. The impacted Go tests and final change-scoped validation pass; automated Code Review reported no comments, though its backend was unavailable, and CodeQL was skipped because these are test-only changes.

pelikhan · 2026-10-06T13:55:56Z

@copilot resolve the merge conflicts on this branch.

…support-for-post-steps # Conflicts: # pkg/workflow/action_pins_test.go # pkg/workflow/compiler_jobs_test.go Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-10-06T14:08:48Z

@copilot resolve the merge conflicts on this branch.

Merged the latest main and resolved both test conflicts in merge commit 68c4aa6b. Targeted workflow tests and the final impacted checks pass.

github-actions · 2026-10-06T19:25:32Z

🎉 This pull request is included in a new release.

Release: v0.91.2

…ts changes Document engine.dynamic-workflows (schema default false, added in #66195), correct model-routing allowed-models to reflect that declared sub-agent models are now admitted separately from routing candidates (#66234), and note the compile-time rejection of issue creation and safe-output storage access in user post-steps (#66064). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Copilot AI and others added 2 commits October 6, 2026 07:30

Reject issue creation and safe-output access in user post-steps

f459caf

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Handle dynamic issue endpoints and explicit GET in post-step validation

5136aad

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI assigned Copilot and pelikhan Oct 6, 2026

Copilot AI changed the title ~~Reject unsafe issue creation and safe-output reads in post-steps~~ Reject direct issue creation and safe-output access in post-steps Oct 6, 2026

Copilot created this pull request from a session on behalf of pelikhan October 6, 2026 07:38 View session

Copilot finished work on behalf of pelikhan October 6, 2026 07:38

Copilot AI requested a review from pelikhan October 6, 2026 07:38

github-actions Bot mentioned this pull request Oct 6, 2026

[Contribution Check Report] Contribution Check — 2026-10-06 #65977

Closed

pelikhan marked this pull request as ready for review October 6, 2026 11:48

Copilot AI balanced review requested due to automatic review settings October 6, 2026 11:48

Copilot started reviewing on behalf of pelikhan October 6, 2026 11:48 View session

Copilot AI reviewed Oct 6, 2026

View reviewed changes

Copilot started work on behalf of pelikhan October 6, 2026 11:59 View session

Reject access to safe-output JSONL storage

11c44de

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan October 6, 2026 12:09

Copilot started work on behalf of pelikhan October 6, 2026 12:10 View session

Harden post-step issue and secret validation

e24f63b

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan October 6, 2026 12:38

Copilot started work on behalf of pelikhan October 6, 2026 12:45 View session

Copilot AI and others added 2 commits October 6, 2026 12:53

Merge remote-tracking branch 'origin/main' into copilot/add-compiler-…

ec1bf07

…support-for-post-steps Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Update WASM goldens after merging main

39511b8

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan October 6, 2026 13:04

Copilot started work on behalf of pelikhan October 6, 2026 13:30 View session

Fix workflow CI test expectations

527bcf6

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan October 6, 2026 13:45

Copilot started work on behalf of pelikhan October 6, 2026 13:56 View session

Merge remote-tracking branch 'origin/main' into copilot/add-compiler-…

68c4aa6

…support-for-post-steps # Conflicts: # pkg/workflow/action_pins_test.go # pkg/workflow/compiler_jobs_test.go Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan October 6, 2026 14:09

pelikhan added 2 commits October 6, 2026 07:31

Merge branch 'main' into copilot/add-compiler-support-for-post-steps

6bbcabc

Merge branch 'main' into copilot/add-compiler-support-for-post-steps

d4b124d

pelikhan merged commit 62aa9ec into main Oct 6, 2026
1 of 2 checks passed

pelikhan deleted the copilot/add-compiler-support-for-post-steps branch October 6, 2026 14:34

This was referenced Oct 7, 2026

[instructions] Sync instruction files with release v0.89.21 (dynamic-workflows, model-routing, post-steps) #66518

Merged

Suggested test: copilot/post-steps-reject-direct-issue-creation githubnext/gh-aw-test#20624

Open

Conversation

Copilot AI commented Oct 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pelikhan commented Oct 6, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Copilot AI Oct 6, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 6, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 6, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 6, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 6, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 6, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 6, 2026

Choose a reason for hiding this comment

Uh oh!

pelikhan commented Oct 6, 2026

Uh oh!

Copilot AI commented Oct 6, 2026

Uh oh!

Copilot AI commented Oct 6, 2026

Uh oh!

pelikhan commented Oct 6, 2026

Uh oh!

Copilot AI commented Oct 6, 2026

Uh oh!

pelikhan commented Oct 6, 2026

Uh oh!

Copilot AI commented Oct 6, 2026

Uh oh!

pelikhan commented Oct 6, 2026

Uh oh!

Copilot AI commented Oct 6, 2026

Uh oh!

Uh oh!

github-actions Bot commented Oct 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Oct 6, 2026 •

edited

Loading