Skip to content

Detect secret references in all AWF environment sources - #67017

Merged
pelikhan merged 4 commits into
mainfrom
copilot/awf-exclude-env-secret-fix
Oct 9, 2026
Merged

Detect secret references in all AWF environment sources#67017
pelikhan merged 4 commits into
mainfrom
copilot/awf-exclude-env-secret-fix

Conversation

Copilot AI commented Oct 8, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

AWF’s --exclude-env detection could miss secret references when spacing, capitalization, or fallback order differed from the literal ${{ secrets. pattern, risking secret exposure through --env-all.

  • Extraction: Match the secrets context and secret names case-insensitively, preserving captured spelling and the full expression.
  • Classification: Use shared secret extraction for engine, sandbox-agent, and mcp-scripts environment values.

For example, API_TOKEN is excluded for this fallback expression:

env:
  API_TOKEN: "${{ vars.A || secrets.B }}"

Copilot AI linked an issue Oct 8, 2026 that may be closed by this pull request
AWF --exclude-env misses secret references that aren't written exactly as '${{ secrets.' #67016
Closed
@SivaKesava1
SivaKesava1 marked this pull request as ready for review October 8, 2026 23:10
Copilot AI balanced review requested due to automatic review settings October 8, 2026 23:10
Copilot AI reviewed Oct 8, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot wasn't able to review any files in this pull request. Check if the Files changed in this pull request are included in default exclusions.

@SivaKesava1
Fix AWF secret env exclusion detection
8f24566 
Co-authored-by: SivaKesava1 <11771739+SivaKesava1@users.noreply.github.com>
Copilot AI changed the title [WIP] Fix AWF --exclude-env to recognize all secret references Detect secret references in all AWF environment sources Oct 8, 2026
Copilot AI requested a review from SivaKesava1 October 8, 2026 23:18
@SivaKesava1 SivaKesava1 mentioned this pull request Oct 8, 2026
Closed
@SivaKesava1

SivaKesava1 commented Oct 8, 2026

Copy link
Copy Markdown
Collaborator

Verified at 8f245669 by compiling the same workflow with gh-aw main (5a8304e503) and with this PR. The workflow had strict: false and these values:

  • engine.env: A_NOSPACE: ${{secrets.TOKEN_A}}, B_MIXEDCASE: ${{ Secrets.Token_B }}, C_VARS_FIRST: ${{ vars.X || secrets.TOKEN_C }}, D_TOKEN_FIRST: ${{ github.token || secrets.TOKEN_D }}, E_STANDARD: ${{ secrets.TOKEN_E }}, F_STATIC: hello, H_VARS_ONLY: ${{ vars.SOME_SETTING }}
  • sandbox.agent.env: G_AGENT_LOWER: ${{secrets.token_g}}

--exclude-env in the lock file (besides the engine's fixed names):

Build Excluded
main E_STANDARD only. A, B, C, D and G reach the agent, although main's own compile warning says A, C and D "will be excluded".
this PR A_NOSPACE, B_MIXEDCASE, C_VARS_FIRST, D_TOKEN_FIRST, E_STANDARD, G_AGENT_LOWER. F_STATIC and H_VARS_ONLY stay visible, as intended.

With strict: true, this PR's error now also lists ${{ Secrets.Token_B }}, which main's strict check missed.

@copilot /pr-finisher

@SivaKesava1
SivaKesava1 requested a review from pelikhan October 8, 2026 23:56
@SivaKesava1
SivaKesava1 requested a review from lpcox October 9, 2026 01:18
@pelikhan
pelikhan merged commit c268866 into main Oct 9, 2026
35 checks passed
@pelikhan
pelikhan deleted the copilot/awf-exclude-env-secret-fix branch October 9, 2026 03:16
@github-actions github-actions Bot mentioned this pull request Oct 9, 2026
Open
@github-actions

github-actions Bot commented Oct 9, 2026

Copy link
Copy Markdown
Contributor

🎉 This pull request is included in a new release.

Release: v0.91.7

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@SivaKesava1 SivaKesava1 Awaiting requested review from SivaKesava1
@pelikhan pelikhan Awaiting requested review from pelikhan
@lpcox lpcox Awaiting requested review from lpcox

Assignees

@SivaKesava1 SivaKesava1

Copilot code review Copilot

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

AWF --exclude-env misses secret references that aren't written exactly as '${{ secrets.'

4 participants

@SivaKesava1 @pelikhan