Avoid allocation-size overflow in AWF model policy union by Copilot · Pull Request #66646 · github/gh-aw

Copilot · 2026-10-07T18:15:20Z

Two high-severity CodeQL alerts flagged unchecked len(local)+len(override) capacity calculations in awf_config_policy.go. Local policy sizes derive from workflow frontmatter, meeting the issue’s human-review trigger.

Allocation safety: Remove slice and map capacity hints; grow incrementally while preserving ordered deduplication and non-nil empty results.
Regression coverage: Cover empty inputs, duplicates, ordering, independent output storage, and duplicate-heavy inputs without combined-length preallocation.
Review requirement: Human review is required; alert closure remains unverified because alert access was denied and CodeQL analysis was skipped.

Fixes [uk-ai-resilience] Allocation-size overflow in awf_config_policy.go (Tier B) #66614

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

github-actions · 2026-10-07T18:30:53Z

✅ Test Quality Sentinel completed test quality analysis.

Test Quality Sentinel skipped because pre-fetch PR data was unavailable: unable to fetch test file diff

🧪 Test quality analysis by Test Quality Sentinel

github-actions · 2026-10-07T18:30:53Z

✅ PR Code Quality Reviewer completed the code quality review.

🔎 Code quality review by PR Code Quality Reviewer

github-actions · 2026-10-07T18:30:55Z

🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer

github-actions · 2026-10-07T18:30:56Z

✅ Ponytail Reviewer completed successfully!

Lean already. Ship.

Generated by Ponytail Reviewer for #66646

github-actions · 2026-10-07T18:31:22Z

✅ Design Decision Gate 🏗️ completed the design decision gate check. See the comment below for the result and any generated ADR draft.

No ADR enforcement needed for PR #66646: no 'implementation' label (has_implementation_label=false) and only 50 added lines in business logic directories across 2 files, below the 100-line default threshold (requires_adr_by_default_volume=false, no custom .design-gate.yml).

🏗️ ADR gate enforced by Design Decision Gate 🏗️

Copilot

🔵 Needs a closer look

The security fix appears sound, but the stated human-review requirement and unverified CodeQL alert closure require final human validation.

0 open findings

What changed in this PR

Removes overflow-prone capacity arithmetic from AWF model-policy union logic while preserving ordered deduplication and non-nil results.

Changes:

Removes combined-length slice and map preallocation.
Adds regression coverage for ordering, duplicates, input independence, and duplicate-heavy inputs.

File	Description
`pkg/workflow/awf_config_policy.go`	Uses incremental allocation for policy unions.
`pkg/workflow/awf_config_test.go`	Adds allocation-safety and behavior tests.

🧠 Review effort: Balanced

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

github-actions · 2026-10-07T18:35:41Z

Comment Memory

Peek at saved memory (pr-code-quality-reviewer)

reviewed_at: 2026-10-07T18:32:36Z
review_event: COMMENT
top_themes:
  - surgical overflow fix
  - no blocking correctness regressions found
files_reviewed:
  - pkg/workflow/awf_config_policy.go
  - pkg/workflow/awf_config_test.go
comment_count: 0

Note

This comment is managed by comment memory.

Expand the saved memory block to view or edit the persistent context for this thread.
Edit only the text inside the backtick fences; workflow metadata and the footer are regenerated automatically.

Learn more about comment memory

🔎 Code quality review by PR Code Quality Reviewer · copilot · gpt54 · 18.6 AIC · ⌖ 5.25 AIC · ⊞ 19.6K · ◷
_{Comment /review to run again}

github-actions

Verdict

No blocking issue found in this patch.

Review notes

The fix is appropriately surgical: it removes the overflow-prone combined preallocation while preserving ordered de-duplication semantics, and the added tests cover empty inputs, duplicates, ordering, and input immutability. I also checked the new duplicate-heavy regression case; it does touch an implementation detail via `cap(got)`, but the assertion is loose enough that I do not consider it a merge blocker.

🔎 Code quality review by PR Code Quality Reviewer · copilot · gpt54 · 18.6 AIC · ⌖ 5.25 AIC · ⊞ 19.6K
_{Comment /review to run again}

github-actions

Impeccable Review — `harden` / `audit`

Change type: bug_fix (CodeQL allocation-overflow fix, #66614)

Summary: unionModelPolicyRules no longer preallocates capacity from len(local)+len(override), eliminating the integer-overflow/huge-allocation risk CodeQL flagged. Behavior is preserved (dedup + first-occurrence ordering), and the new tests cover empty inputs, duplicates, ordering, independent output storage (no aliasing of input slices), and a duplicate-heavy 10k-element case asserting cap(got) < len(local).

Findings: No blocking issues. The fix is minimal, correct, and verified by go test ./pkg/workflow/... -run TestUnionModelPolicyRules -v (all passing).

Notes (non-blocking)

intersectModelPolicyRules still preallocates make([]string, 0, len(override)), which is safe (bounded by a single slice length, not a sum), so no change needed there.
A few other call sites in the package (e.g. imports.go:219-220, compiler_builtin_job_augmentation.go:335-336) use the same len(a)+len(b) capacity-hint pattern. They're out of scope for this PR but could be worth a follow-up sweep if the same CodeQL rule flags them later.

🧵 Reviewed using Impeccable skills by Impeccable Skills Reviewer · copilot · sonnet50 · 21.8 AIC · ⌖ 13.2 AIC · ⊞ 8.1K

github-actions

Skills-Based Review 🧠

Applied /diagnosing-bugs and /tdd — this is a narrowly scoped fix with solid regression coverage, approving.

📋 Analysis

Root cause addressed correctly

The CodeQL alert flagged make([]string, 0, len(local)+len(override)) and make(map[string]struct{}, len(local)+len(override)) in unionModelPolicyRules — these capacity hints are derived from two independently-sized, attacker-influenceable slices (workflow frontmatter + env policy) and could overflow/panic on pathological inputs. The fix drops both capacity hints entirely, letting Go's slice/map growth handle sizing incrementally. This addresses the root cause (unchecked summed capacity) rather than just suppressing the symptom.

Test coverage (`/tdd`)

The new tests are a good set of specifications:

TestUnionModelPolicyRules covers empty/empty, empty-override, empty-local, and dedup-with-order-preservation — plus an aliasing check that mutating the result doesn't mutate the inputs (confirms independent storage, a good regression guard given the previous code's shared-capacity pattern).
TestUnionModelPolicyRules_DuplicateHeavyInputs directly encodes the fix's intent: cap(got) < len(local) proves capacity now grows with unique output size rather than combined input length — this is exactly the kind of test that would have caught the original bug and will catch any regression that reintroduces combined-length preallocation.

Minor observation (non-blocking)

intersectModelPolicyRules (unchanged in this PR) still does make([]string, 0, len(override)) — a single-slice capacity hint, so it doesn't have the same two-input-sum overflow shape. Worth a quick confirmatory look in a follow-up if override can also grow unbounded, but it's out of scope for this fix and not required here.

Positive highlights

✅ Correctly scoped: touches only the two lines CodeQL flagged, no unrelated refactoring
✅ Tests assert both behavior (want) and capacity growth characteristics, not just functional output
✅ Input-immutability check (mutating got[0] and asserting originals unchanged) is a nice touch confirming no accidental aliasing

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer · copilot · sonnet50 · 23.9 AIC · ⌖ 14.4 AIC · ⊞ 10.1K
_{Comment /matt to run again}

github-actions · 2026-10-07T18:38:22Z

🧪 Test Quality Sentinel Report

✅ Test Quality Score: 92/100 — Excellent

Analyzed 5 test(s): 5 design, 0 implementation, 0 violations.

📊 Metrics (5 tests)

Metric	Value
Analyzed	5 (Go: 5, JS: 0)
✅ Design	5 (100%)
⚠️ Implementation	0 (0%)
Edge/error coverage	5 (100%)
Duplicate clusters	0
Inflation	No (test:prod = 24:1, high coverage justified)
🚨 Violations	0

Test	File	Classification	Issues
`TestIntersectModelPolicyRules_EmptyOverrideKeepsLocal`	awf_config_test.go:2743	`behavioral_contract`	None — edge case
`TestIntersectModelPolicyRules_EmptyLocalUsesOverride`	awf_config_test.go:2748	`behavioral_contract`	None — edge case
`TestIntersectModelPolicyRules_OverlapOnly`	awf_config_test.go:2753	`behavioral_contract`	None — intersection logic
`TestUnionModelPolicyRules`	awf_config_test.go:2758	`behavioral_contract`	None — 4 scenarios, mutation testing
`TestUnionModelPolicyRules_DuplicateHeavyInputs`	awf_config_test.go:2791	`behavioral_contract`	None — regression test for CodeQL fix

Quality Highlights

✨ Exceptional test design:

Regression coverage: TestUnionModelPolicyRules_DuplicateHeavyInputs directly validates the CodeQL allocation-size overflow fix by asserting cap(got) < len(local) with 10,000-element inputs
Mutation testing: Main union test modifies output, re-checks inputs unchanged — proves independent output storage
Edge-case comprehensive: Empty inputs, duplicates, ordering preservation, overlap scenarios all covered
Build tags correct: (go/redacted):build !integration present

Verdict

✅ passed. 0% implementation tests (threshold: 30%). All 5 tests are high-value behavioral contracts with strong regression and edge-case coverage. Excellent test suite for an allocation-safety fix.

🧪 Test quality analysis by Test Quality Sentinel · copilot · haiku45 · 25.1 AIC · ⌖ 6.73 AIC · ⊞ 8.2K · ◷
_{Comment /review to run again}

github-actions

✅ Test Quality Sentinel: 92/100. 0% implementation tests (threshold: 30%). All 5 tests are high-value behavioral contracts with exceptional regression coverage for the CodeQL allocation-size fix.

🧪 Test quality analysis by Test Quality Sentinel · copilot · haiku45 · 25.1 AIC · ⌖ 6.73 AIC · ⊞ 8.2K
_{Comment /review to run again}

github-actions · 2026-10-07T20:31:23Z

🎉 This pull request is included in a new release.

Release: v0.91.5

Initial plan

ad018b1

Copilot AI assigned Copilot and pelikhan Oct 7, 2026

Copilot started work on behalf of pelikhan October 7, 2026 18:18 View session

Copilot AI linked an issue Oct 7, 2026 that may be closed by this pull request

[uk-ai-resilience] Allocation-size overflow in awf_config_policy.go (Tier B) #66614

Closed

Fix model policy union allocation-size overflow

506505c

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Fix allocation size overflow in awf_config_policy.go~~ Avoid allocation-size overflow in AWF model policy union Oct 7, 2026

Copilot finished work on behalf of pelikhan October 7, 2026 18:28

Copilot AI requested a review from pelikhan October 7, 2026 18:28

pelikhan marked this pull request as ready for review October 7, 2026 18:29

Copilot AI balanced review requested due to automatic review settings October 7, 2026 18:29

Copilot started reviewing on behalf of pelikhan October 7, 2026 18:30 View session

Copilot AI reviewed Oct 7, 2026

View reviewed changes

github-actions Bot reviewed Oct 7, 2026

View reviewed changes

pelikhan merged commit 4989360 into main Oct 7, 2026
84 of 98 checks passed

pelikhan deleted the copilot/uk-ai-operational-r-fix-allocation-size-overflow branch October 7, 2026 18:36

github-actions Bot approved these changes Oct 7, 2026

View reviewed changes

github-actions Bot mentioned this pull request Oct 7, 2026

[aw] No-Op Runs #65943

Open

Conversation

Copilot AI commented Oct 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

github-actions Bot commented Oct 7, 2026

Comment Memory

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Verdict

Uh oh!

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Impeccable Review — harden / audit

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Skills-Based Review 🧠

Root cause addressed correctly

Test coverage (/tdd)

Minor observation (non-blocking)

Positive highlights

Uh oh!

github-actions Bot commented Oct 7, 2026

🧪 Test Quality Sentinel Report

Quality Highlights

Verdict

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Oct 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Oct 7, 2026 •

edited

Loading

github-actions Bot commented Oct 7, 2026 •

edited

Loading

github-actions Bot commented Oct 7, 2026 •

edited

Loading

github-actions Bot commented Oct 7, 2026 •

edited

Loading

github-actions Bot commented Oct 7, 2026 •

edited

Loading

github-actions Bot commented Oct 7, 2026 •

edited

Loading

Impeccable Review — `harden` / `audit`

Test coverage (`/tdd`)