Use public permissions for extracted ZIP logs by Copilot · Pull Request #65463 · github/gh-aw

Copilot · 2026-10-04T02:26:02Z

GitHub Actions ZIP entries can carry restrictive file modes, leaving downloaded logs unreadable to later tooling. Extraction should not preserve those source permissions.

Extraction permissions: Create regular files with constants.FilePermPublic rather than the ZIP entry’s stored mode.
```
os.OpenFile(filePath, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, constants.FilePermPublic)
```
Regression coverage: Verify that an entry stored as owner-only (0600) extracts with world-read permission.

Fixes [deep-report] Fix: zip log extraction preserves source file mode, can produce unreadable (Permission denied) run artifacts #65456

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot

Copilot review overview

🟢 Approval recommended

The focused change matches the requested behavior, includes regression coverage, and has no identified blocking issues.

Review effort: Balanced
Findings: None

What changed in this PR

Updates gh-aw ZIP log extraction to avoid preserving restrictive archive permissions, addressing #65456.

Changes:

Creates extracted files using constants.FilePermPublic.
Updates regression coverage to check world-read permission for an entry stored with mode 0600.

File	Description
`pkg/cli/logs_extract_zip_test.go`	Checks public readability after extraction.
`pkg/cli/logs_download_zip.go`	Uses public file-creation permissions.

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

github-actions · 2026-10-04T03:19:37Z

✅ Design Decision Gate 🏗️ completed the design decision gate check. See the comment below for the result and any generated ADR draft.

Warning

Threat Detection Engine Failure — The analysis engine could not complete. This is a tooling failure, not a security finding.

What happened

The threat detection engine failed to produce results.

Review the workflow run logs for details.

🏗️ ADR gate enforced by Design Decision Gate 🏗️

github-actions · 2026-10-04T03:19:38Z

✅ Test Quality Sentinel completed test quality analysis.

Test Quality Sentinel skipped because pre-fetch PR data was unavailable: unable to fetch test file diff

🧪 Test quality analysis by Test Quality Sentinel

github-actions · 2026-10-04T03:19:40Z

🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer

github-actions · 2026-10-04T03:19:42Z

✅ Ponytail Reviewer completed successfully!

Lean already. Ship.

Generated by Ponytail Reviewer for #65463

github-actions · 2026-10-04T03:19:42Z

✅ PR Code Quality Reviewer completed the code quality review.

testing cli availability only

🔎 Code quality review by PR Code Quality Reviewer

github-actions

Skills-Based Review 🧠

Applied /tdd and /diagnosing-bugs — small, well-targeted fix with good regression coverage. No blocking issues found.

📋 Analysis

Root cause & fix

The bug (restrictive ZIP entry modes, e.g. 0600, making extracted logs unreadable by later tooling) is fixed at its source: os.OpenFile now always uses constants.FilePermPublic (0o644) instead of propagating f.Mode() from the ZIP entry. This is consistent with the existing constants.DirPermPublic usage a few lines above for directories, so the module stays internally consistent.

Test quality (`/tdd`)

The test was correctly renamed from TestExtractZipFilePreservesMode → TestExtractZipFileUsesPublicPermissions to reflect the new contract instead of leaving a stale, misleading name.
The fixture now encodes an owner-only 0600 mode (previously 0755/executable), which is the actual regression scenario described in the PR body, and the assertion (info.Mode().Perm()&0o004 != 0) directly verifies world-readability — a precise regression test for the reported bug.

Checked for side effects

Confirmed no downstream code in pkg/cli executes extracted log/artifact files (only parses/reads them), so dropping the execute bit for all entries is safe and doesn't regress any workflow that might have relied on executable extracted files.

Minor, non-blocking observation

f.Mode() is now unused for regular files in extractZipFile; worth double-checking there isn't a separate unused-import/lint warning once this merges (a quick make fmt/lint pass should catch it if so).

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer · copilot · sonnet50 · 27.3 AIC · ⌖ 14.3 AIC · ⊞ 10K
_{Comment /matt to run again}

github-actions

Reviewed with Impeccable skill lens (change_type: bug_fix — but this is backend Go file-permission logic, not UI, so harden/audit modes do not surface relevant findings).

The fix correctly replaces the ZIP entry's stored mode with constants.FilePermPublic (0o644), consistent with the existing DirPermPublic usage in the same file. The regression test was properly updated to assert world-read permission on an extracted 0600-mode entry rather than mode preservation.

No blocking or high-signal issues found in the changed lines.

🧵 Reviewed using Impeccable skills by Impeccable Skills Reviewer · copilot · sonnet50 · 15 AIC · ⌖ 13.9 AIC · ⊞ 8.1K

github-actions · 2026-10-04T03:24:48Z

Comment Memory

reviewed_at: 2026-10-04T03:21:13Z
review_event: REQUEST_CHANGES
top_themes:
- workflow log confidentiality regression
- umask-dependent permission test
files_reviewed:
- pkg/cli/logs_download_zip.go
- pkg/cli/logs_extract_zip_test.go
comment_count: 2

Note

This comment is managed by comment memory.

It stores persistent context for this thread in the code block at the top of this comment.
Edit only the text inside the backtick fences; workflow metadata and the footer are regenerated automatically.

Learn more about comment memory

🔎 Code quality review by PR Code Quality Reviewer · copilot · gpt54 · 34.4 AIC · ⌖ 7.34 AIC · ⊞ 19.4K · ◷
_{Comment /review to run again}

github-actions

Request changes

This patch fixes the ZIP-mode bug by opening every extracted workflow log as public, but that creates a new confidentiality regression and the regression test locks that weaker behavior in.

Blocking themes

pkg/cli/logs_download_zip.go: workflow-run logs are downloaded remote content and log output, so opening them with FilePermPublic violates the repo permission policy and can expose sensitive run data on shared machines.
pkg/cli/logs_extract_zip_test.go: the new assertion requires world-readable output, which both cements the security regression and makes the test environment-dependent because 0644 is still filtered by umask.

The safer fix is to ignore the archive entry mode while still writing extracted logs with constants.FilePermSensitive, then update the test to assert that sensitive, non-executable behavior instead of public readability.

🔎 Code quality review by PR Code Quality Reviewer · copilot · gpt54 · 34.4 AIC · ⌖ 7.34 AIC · ⊞ 19.4K
_{Comment /review to run again}

github-actions · 2026-10-04T03:24:50Z


 	// Create the destination file
-	destFile, err := os.OpenFile(filePath, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, f.Mode())
+	destFile, err := os.OpenFile(filePath, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, constants.FilePermPublic)


This widens downloaded workflow logs from owner-only to world-readable, which contradicts the repository permission policy for remote content and log output and can leak sensitive run data on shared machines.

💡 Why this should be fixed

extractZipFile is only used for workflow-run log archives, and constants.FilePermSensitive is explicitly documented for downloaded remote content and audit/log output. Switching to FilePermPublic makes every extracted log file readable to other local users/groups even though the caller created the workflow-log area as sensitive.

Use a fixed sensitive mode instead of the ZIP entry mode:

destFile, err := os.OpenFile(filePath, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, constants.FilePermSensitive)

That still fixes the original bug (ignore restrictive ZIP metadata) without downgrading log confidentiality.

Addressed in 1d5db5f: extracted log files now use constants.FilePermSensitive, and the regression verifies owner-only permissions.

github-actions · 2026-10-04T03:24:50Z


 	// Create the destination file
-	destFile, err := os.OpenFile(filePath, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, f.Mode())
+	destFile, err := os.OpenFile(filePath, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, constants.FilePermPublic)


This widens downloaded workflow logs from owner-only to world-readable, which contradicts the repository permission policy for remote content and log output and can leak sensitive run data on shared machines.

💡 Why this should be fixed

This extractor is only used for workflow-run log archives, and the constants package documents FilePermSensitive for downloaded remote content and audit/log output. Switching to FilePermPublic makes each extracted log file readable to other local users/groups even though the workflow-log area is created as sensitive.

Use a fixed sensitive mode here instead of the ZIP entry mode so the original bug is still fixed without downgrading log confidentiality.

Addressed in 1d5db5f: extracted log files now use constants.FilePermSensitive, and the regression verifies owner-only permissions.

Done

gh-aw-bot · 2026-10-04T08:42:50Z

@copilot address the following outstanding work in one pass:

Update this branch with the latest main using make merge-main, resolving any conflicts and preserving the intended changes.
Review (pkg/cli/logs_download_zip.go:94): This widens downloaded workflow logs from owner-only to world-readable, which contradicts the repository permission policy for remote content and log output and can leak sensitive run data on shared machines. - Use public permissions for extracted ZIP logs #65463 (comment)
Review (pkg/cli/logs_download_zip.go:94): This widens downloaded workflow logs from owner-only to world-readable, which contradicts the repository permission policy for remote content and log output and can leak sensitive run data on shared machines. - Use public permissions for extracted ZIP logs #65463 (comment)
Fix failing check lint-go-custom (FAILURE): https://github.com/github/gh-aw/actions/runs/37171511371/job/111351885997.
Fix failing check lint-go-custom (FAILURE): https://github.com/github/gh-aw/actions/runs/37171332434/job/111345283015.

Push the necessary fixes, reply to each listed review thread and resolve it when addressed. Ignore feedback already answered or resolved. Use the pr-finisher skill and stop when only human review or CI remains; do not trigger CI.

Sous-chef head: a522e8c
Sous-chef work: 41c633c50467b0f2dc87116833139ebf287e1ad59f1a015d8d1dfedd9d1b23f1 96733d1ebedc52fc285c4e83aa4dc70528a5dd98fa6a42c5a6465aaea61dddec fe7ee0cb526351dc127ff2f61cab7f27892e7cc7b5f612130b2de87a52cdf10f
Sous-chef state: 7a6e7f2e0650be509ce02205ddb179fe543383aebc882df3541677e32bd85a90

Generated by 👨‍🍳 PR Sous Chef · pi · haiku45 · 11.9 AIC · ⌖ 9.57 AIC · ⊞ 3K · ◷
_{Comment /souschef to run again}

…ix-zip-log-extraction Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot · 2026-10-04T09:04:45Z

@copilot address the following outstanding work in one pass:

Update this branch with the latest main using make merge-main, resolving any conflicts and preserving the intended changes....

Merged the latest main in 1c18f9a and addressed the permission feedback in 1d5db5f. The merge includes the fixes for the prior lint-go-custom blockers, and the exact native CI lint command passes locally. CI is stale after this push and needs a maintainer-triggered rerun.

github-actions · 2026-10-05T23:09:21Z

🎉 This pull request is included in a new release.

Release: v0.91.0

Initial plan

ddfc199

Copilot AI assigned Copilot and pelikhan Oct 4, 2026

Copilot started work on behalf of pelikhan October 4, 2026 02:26 View session

Copilot AI linked an issue Oct 4, 2026 that may be closed by this pull request

[deep-report] Fix: zip log extraction preserves source file mode, can produce unreadable (Permission denied) run artifacts #65456

Closed

Fix ZIP log extraction permissions

a522e8c

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Fix zip log extraction to preserve readable file permissions~~ Use public permissions for extracted ZIP logs Oct 4, 2026

Copilot finished work on behalf of pelikhan October 4, 2026 02:32

Copilot AI requested a review from pelikhan October 4, 2026 02:32

pelikhan marked this pull request as ready for review October 4, 2026 02:35

Copilot AI balanced review requested due to automatic review settings October 4, 2026 02:35

Copilot started reviewing on behalf of pelikhan October 4, 2026 02:35 View session

Copilot AI reviewed Oct 4, 2026

View reviewed changes

github-actions Bot mentioned this pull request Oct 4, 2026

[aw] Design Decision Gate 🏗️ produced no safe outputs #65363

Closed

github-actions Bot added the needs-review label Oct 4, 2026

github-actions Bot approved these changes Oct 4, 2026

View reviewed changes

github-actions Bot previously requested changes Oct 4, 2026

View reviewed changes

Copilot AI mentioned this pull request Oct 4, 2026

Prevent PR Sous Chef from no-oping on eligible PRs #65502

Merged

github-actions Bot mentioned this pull request Oct 4, 2026

[pr-review] Daily PR Code Quality Review — 37186050481 #65525

Closed

github-actions Bot mentioned this pull request Oct 4, 2026

[pr-sous-chef] PR Sous Chef Run Summary #65535

Closed

Copilot started work on behalf of gh-aw-bot October 4, 2026 08:43 View session

Copilot AI and others added 2 commits October 4, 2026 08:48

Merge remote-tracking branch 'origin/main' into copilot/deep-report-f…

1c18f9a

…ix-zip-log-extraction Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Use sensitive permissions for extracted ZIP logs

1d5db5f

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot finished work on behalf of gh-aw-bot October 4, 2026 09:07

Copilot AI requested a review from gh-aw-bot October 4, 2026 09:07

pelikhan merged commit 3712416 into main Oct 4, 2026
30 checks passed

pelikhan deleted the copilot/deep-report-fix-zip-log-extraction branch October 4, 2026 13:00

Conversation

Copilot AI commented Oct 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟢 Approval recommended

Uh oh!

github-actions Bot commented Oct 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Skills-Based Review 🧠

Root cause & fix

Test quality (/tdd)

Checked for side effects

Minor, non-blocking observation

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Oct 4, 2026

Comment Memory

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Request changes

Uh oh!

github-actions Bot Oct 4, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 4, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Oct 4, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 4, 2026

Choose a reason for hiding this comment

Uh oh!

gh-aw-bot commented Oct 4, 2026

Uh oh!

Copilot AI commented Oct 4, 2026

Uh oh!

Uh oh!

github-actions Bot commented Oct 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Copilot AI commented Oct 4, 2026 •

edited

Loading

github-actions Bot commented Oct 4, 2026 •

edited

Loading

github-actions Bot commented Oct 4, 2026 •

edited

Loading

github-actions Bot commented Oct 4, 2026 •

edited

Loading

github-actions Bot commented Oct 4, 2026 •

edited

Loading

github-actions Bot commented Oct 4, 2026 •

edited

Loading

Test quality (`/tdd`)