[AW Top 10] 10 Harden install scripts and security ownership paths #65936

Priority 10/10 | 5 source issues | Impact 3/5 | Confidence 3/5 | Effort 3/5

One assignment, one coherent fix

Security audits report unpinned remote installs, non-deterministic installs in compiled workflows, insecure temporary file handling, a missing CODEOWNERS file and an undocumented token-minting change. These source issues share one supply-chain hardening scope.

Implementation scope

Pin and verify the root install script, use deterministic installs in generated workflows, switch automation scripts to safe temporary file creation, and add CODEOWNERS for the compiler and CLI paths. Confirm each finding against current code first.

Done when

• Install steps verify checksums or pinned versions instead of piping to a shell.
• A CODEOWNERS file covers security-sensitive compiler and CLI paths.

Why now

The findings are concrete and reduce supply-chain risk, but some may be stale, so each must be re-verified.

Unchanged AW sources close only after this summary is completed. Newer source activity and not-planned retirement do not trigger source closure. Assigned summaries are frozen; unassign to allow reclustering.

Generated by AW Essential Issue Clustering · copilot · auto · 32 AIC · ⌖ 11.2 AIC · ⊞ 8.9K · ◷