Skip to content

[aw] Daily action/setup/* Security Audit failed #65470

Closed as not planned
Closed as not planned
[aw] Daily action/setup/* Security Audit failed#65470
Labels
agentic-workflows

Description

@github-actions
github-actions
bot
opened on Oct 4, 2026

Workflow Failure

Workflow: Daily action/setup/* Security Audit
Branch: main
Run: https://github.com/github/gh-aw/actions/runs/37173694465

Warning

Engine Failure: The copilot engine terminated unexpectedly.

Last agent output:

{"type":"tool.execution_complete","timestamp":"2026-10-04T03:21:51.574Z","data":{"toolName":"bash","mcpServerName":"","toolCallId":"toolu_013L3pAquyG4vsvLEewHSF2r","success":true,"result":{"content":"=== files changed in last 7 days under actions/setup ===\nactions/setup/README.md\nactions/setup/action.yml\nactions/setup/clean.sh\nactions/setup/index.js\nactions/setup/js/.prettierrc.json\nactions/setup/js/Dockerfile.safe-outputs-mcp\nactions/setup/js/TESTING_LIVE_API.md\nactions/setup/js/action_conclusion_otlp.cjs\nactions/setup/js/action_input_utils.cjs\nactions/setup/js/action_setup_otlp.cjs\nactions/setup/js/actions_secret_masking.cjs\nactions/setup/js/add_comment.cjs\nactions/setup/js/add_labels.cjs\nactions/setup/js/add_mask_redaction.cjs\nactions/setup/js/add_reaction.cjs\nactions/setup/js/add_reaction_and_edit_comment.cjs\nactions/setup/js/add_reviewer.cjs\nactions/setup/js/add_workflow_run_comment.cjs\nactions/setup/js/agent_session.cjs\nactions/setup/js/agent_session_render.cjs\nactions/setup/js/ai_credits_context.cjs\nactions/setup/js/allowed_extensions_helpers.cjs\nactions/setup/js/allowed_issue_fields.cjs\nactions/setup/js/apply_safe_outputs_replay.cjs\nactions/setup/js/apply_samples.cjs\nactions/setup/js/approve_workflow_run.cjs\nactions/setup/js/artifact_client.cjs\nactions/setup/js/assign_agent_helpers.cjs\nactions/setup/js/assign_copilot_to_created_issues.cjs\nactions/setup/js/assign_milestone.cjs\nactions/setup/js/assign_to_agent.cjs\nactions/setup/js/assign_to_user.cjs\nactions/setup/js/assign_work_item.cjs\nactions/setup/js/autofix_code_scanning_alert.cjs\nactions/setup/js/aw_context.cjs\nactions/setup/js/awf_reflect.cjs\nactions/setup/js/awf_reflect_paths.cjs\nactions/setup/js/awf_reflect_summary.cjs\nactions/setup/js/azure_devops_work_items.cjs\nactions/setup/js/bash_command_parser.cjs\n<shellId: 15 completed with exit code 0>","detailedContent":"=== files changed in last 7 days under actions/setup ===\nactions/setup/README.md\nactions/setup/action.yml\nactions/setup/clean.sh\nactions/setup/index.js\nactions/setup/js/.prettierrc.json\nactions/setup/js/Dockerfile.safe-outputs-mcp\nactions/setup/js/TESTING_LIVE_API.md\nactions/setup/js/action_conclusion_otlp.cjs\nactions/setup/js/action_input_utils.cjs\nactions/setup/js/action_setup_otlp.cjs\nactions/setup/js/actions_secret_masking.cjs\nactions/setup/js/add_comment.cjs\nactions/setup/js/add_labels.cjs\nactions/setup/js/add_mask_redaction.cjs\nactions/setup/js/add_reaction.cjs\nactions/setup/js/add_reaction_and_edit_comment.cjs\nactions/setup/js/add_reviewer.cjs\nactions/setup/js/add_workflow_run_comment.cjs\nactions/setup/js/agent_session.cjs\nactions/setup/js/agent_session_render.cjs\nactions/setup/js/ai_credits_context.cjs\nactions/setup/js/allowed_extensions_helpers.cjs\nactions/setup/js/allowed_issue_fields.cjs\nactions/setup/js/apply_safe_outputs_replay.cjs\nactions/setup/js/apply_samples.cjs\nactions/setup/js/approve_workflow_run.cjs\nactions/setup/js/artifact_client.cjs\nactions/setup/js/assign_agent_helpers.cjs\nactions/setup/js/assign_copilot_to_created_issues.cjs\nactions/setup/js/assign_milestone.cjs\nactions/setup/js/assign_to_agent.cjs\nactions/setup/js/assign_to_user.cjs\nactions/setup/js/assign_work_item.cjs\nactions/setup/js/autofix_code_scanning_alert.cjs\nactions/setup/js/aw_context.cjs\nactions/setup/js/awf_reflect.cjs\nactions/setup/js/awf_reflect_paths.cjs\nactions/setup/js/awf_reflect_summary.cjs\nactions/setup/js/azure_devops_work_items.cjs\nactions/setup/js/bash_command_parser.cjs\n<shellId: 15 completed with exit code 0>","contents":[{"type":"shell_exit","shellId":"15","exitCode":0,"cwd":"/home/runner/work/gh-aw/gh-aw","outputPreview":"=== files changed in last 7 days under actions/setup ===\nactions/setup/README.md\nactions/setup/action.yml\nactions/setup/clean.sh\nactions/setup/index.js\nactions/setup/js/.prettierrc.json\nactions/setup/js/Dockerfile.safe-outputs-mcp\nactions/setup/js/TESTING_LIVE_API.md\nactions/setup/js/action_conclusion_otlp.cjs\nactions/setup/js/action_input_utils.cjs\nactions/setup/js/action_setup_otlp.cjs\nactions/setup/js/actions_secret_masking.cjs\nactions/setup/js/add_comment.cjs\nactions/setup/js/add_labels.cjs\nactions/setup/js/add_mask_redaction.cjs\nactions/setup/js/add_reaction.cjs\nactions/setup/js/add_reaction_and_edit_comment.cjs\nactions/setup/js/add_reviewer.cjs\nactions/setup/js/add_workflow_run_comment.cjs\nactions/setup/js/agent_session.cjs\nactions/setup/js/agent_session_render.cjs\nactions/setup/js/ai_credits_context.cjs\nactions/setup/js/allowed_extensions_helpers.cjs\nactions/setup/js/allowed_issue_fields.cjs\nactions/setup/js/apply_safe_outputs_replay.cjs\nactions/setup/js/apply_samples.cjs\nactions/setup/js/approve_workflow_run.cjs\nactions/setup/js/artifact_client.cjs\nactions/setup/js/assign_agent_helpers.cjs\nactions/setup/js/assign_copilot_to_created_issues.cjs\nactions/setup/js/assign_milestone.cjs\nactions/setup/js/assign_to_agent.cjs\nactions/setup/js/assign_to_user.cjs\nactions/setup/js/assign_work_item.cjs\nactions/setup/js/autofix_code_scanning_alert.cjs\nactions/setup/js/aw_context.cjs\nactions/setup/js/awf_reflect.cjs\nactions/setup/js/awf_reflect_paths.cjs\nactions/setup/js/awf_reflect_summary.cjs\nactions/setup/js/azure_devops_work_items.cjs\nactions/setup/js/bash_command_parser.cjs\n"}]}}}
{"type":"assistant.message","timestamp":"2026-10-04T03:21:57.374Z","data":{"content":"Large regeneration. Let me check the directly secret-relevant new files for the reuse aspect."}}
{"type":"tool.execution_start","timestamp":"2026-10-04T03:21:57.377Z","data":{"toolName":"bash","mcpServerName":"","toolCallId":"toolu_01XQw6xM2eq6rTEewrAFqu25","input":{"command":"cd /home/runner/work/gh-aw/gh-aw\nfor f in actions_secret_masking add_mask_redaction; do\necho \"===== $f.cjs (key logic) =====\"\ngrep -nE \"setSecret|mask|replace|redact|length|\\*\\*\\*|<<|GITHUB_ENV|GITHUB_OUTPUT\" actions/setup/js/$f.cjs | head -20\ndone","description":"Check secret masking helpers"},"command":"cd /home/runner/work/gh-aw/gh-aw\nfor f in actions_secret_masking add_mask_redaction; do\necho \"===== $f.cjs (key logic) =====\"\ngrep -nE \"setSecret|mask|replace|redact|length|\\*\\*\\*|<<|GITHUB_ENV|GITHUB_OUTPUT\" actions/setup/js/$f.cjs | head -20\ndone"}}
{"type":"tool.execution_complete","timestamp":"2026-10-04T03:22:31.504Z","data":{"toolName":"bash","mcpServerName":"","toolCallId":"toolu_01L4UpzYMKM6TfD18FzowWuM","success":true,"result":{"content":"STATE OK (valid JSON), ts=2026-10-04-03-22-31\n<shellId: 17 completed with exit code 0>","detailedContent":"STATE OK (valid JSON), ts=2026-10-04-03-22-31\n<shellId: 17 completed with exit code 0>","contents":[{"type":"shell_exit","shellId":"17","exitCode":0,"cwd":"/home/runner/work/gh-aw/gh-aw","outputPreview":"STATE OK (valid JSON), ts=2026-10-04-03-22-31\n"}]}}}
{"type":"assistant.message","timestamp":"2026-10-04T03:22:42.092Z","data":{"content":"State updated. All four aspects audited clean — no net-new high/critical findings. Emitting the required `noop` safe output."}}
{"type":"tool.execution_complete","timestamp":"2026-10-04T03:22:42.322Z","data":{"toolName":"safeoutputs-noop","mcpServerName":"safeoutputs","toolCallId":"toolu_015Zs2zxwC48ctihTMphTDZ5","success":true,"result":{"content":"{\"result\":\"success\"}","detailedContent":"{\"result\":\"success\"}","contents":[{"type":"text","text":"{\"result\":\"success\"}"}]}}}
[safeoutputs-cli] hasTerminalSafeOutput: terminal entry found in /home/runner/work/_temp/gh-aw/safeoutputs/outputs.jsonl: type=noop
{"type":"assistant.message","timestamp":"2026-10-04T03:22:49.040Z","data":{"content":"Audit complete.\n\n**Summary — Daily `actions/setup/*` Security Audit (cycle 10, run 3)**\n\nSelected 4 aspects via the 60/40 rotation:\n- **Reuse (60%)**: `secret-handling`, `command-injection` (prior-finding aspects)\n- **New (40%)**: `network-requests`, `file-permissions`\n\nScanned **578 files**. Key verifications:\n- **secret-handling** — `configure_git_credentials.sh:96` remains the known persistent MEDIUM (token in `.git/config` remote URL; already in agent env). Masking helpers correctly escape `%/CR/LF` and redact longest-first.\n- **command-injection** — git calls use array-form; `ledger_replay.cjs` SQL identifier interpolation is guarded by a strict `IDENTIFIER` regex + `sqlite_`/reserved rejection with prepared-statement values.\n- **network-requests** — TLS enforced, credentials/query/hash rejected, fail-closed proxy behavior, bounded responses, abort timeouts.\n- **file-permissions** — sensitive writes use `0o600`, status-only reports, `mkdtempSync` temps.\n\n**Result**: No net-new high/critical findings. Only the pre-existing persistent MEDIUM remains (not issue-worthy). Emitted `noop` and updated cache-memory state."}}
[copilot-sdk-driver] [sdk-driver] session completed: hasOutput=true assistantTurns=15 durationMs=155072
{"type":"result","num_turns":20,"usage":{"input_tokens":930381,"output_tokens":10442,"cache_read_input_tokens":861042,"cache_creation_input_tokens":61612}}

Action Required

Assign this issue to an agent to debug and fix the issue.

Debug with any coding agent

Use this prompt with any coding agent (GitHub Copilot, Claude, Gemini, etc.):

Debug the agentic workflow failure using https://raw.githubusercontent.com/github/gh-aw/main/debug.md

The failed workflow run is at https://github.com/github/gh-aw/actions/runs/37173694465
Manually invoke the agent

Debug this workflow failure using your favorite Agent CLI and the agentic-workflows prompt.

Tip

Stop reporting this workflow as a failure

To stop a workflow from creating failure issues, set report-failure-as-issue: false in its frontmatter:

safe-outputs:
  report-failure-as-issue: false

Generated from Daily action/setup/* Security Audit · copilot · 111.5 AIC · ◷

  • expires on Oct 4, 2026, 3:24 PM UTC

Activity

  1. github-actions
    added
    agentic-workflows
    on Oct 4, 2026

  2. github-actions commented on Oct 4, 2026

    @github-actions
    github-actionsbot
    on Oct 4, 2026 – with GitHub Actions
    ContributorAuthor

    This issue was automatically closed because it expired on 2026-10-04T15:24:58.326Z.

    Closed by Workflow

  3. github-actions
    closed this as not plannedon Oct 4, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    agentic-workflows

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions