Pin threat-detect artifacts to independent SHA-256 digests#58310
Conversation
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
This reverts commit 15d3823. Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Fixed in |
|
@copilot The last maintainer request points at a failing unit-test job, and your follow-up says the root cause was fixed on a newer head. Please refresh the branch state if needed, re-run the
Failed check to reconcile:
|
Current head is Validated on HEAD: |
|
@copilot merge main and recompile |
Completed in merge commit |
|
Triage test comment from the agent triage workflow.
|
|
Triage: bug | risk: high | score: 74/100 (impact 40, urgency 20, quality 14).
|
|
Category: bug | Risk: high | Score: 78/100 (impact 42/50, urgency 24/30, quality 12/20) | Action: fast_track | Note: security-sensitive installer change affecting artifact verification; high impact and stale enough to merit prompt review. Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "github.com"See Network Configuration for more information.
|
|
Category: bug • Risk: high • Score: 80 (impact 46 + urgency 24 + quality 10) • Recommended action: fast_track • Batch: workflow-reliability
|
@copilot Please take the next forward-progress pass on PR #58310.
Failed checks: none currently reported on the compact queue.
Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "github.com"See Network Configuration for more information.
|
Refreshed the branch with the latest |
|
Category: bug | Risk: high | Score: 82/100 (impact 44, urgency 24, quality 14). Recommended action: fast_track. Batch: workflow-reliability. Reason: security-adjacent workflow hardening with concentrated scope and clear downstream value.
|
@copilot Please take the next forward-progress pass on PR #58310.
Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "github.com"See Network Configuration for more information.
|
Rechecked the current HEAD: the branch is clean and current with |
@copilot Please take the next forward-progress pass on PR #58310.
|
…endently-pinned-threat-detect-artifac Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>
Refreshed the branch with the latest |
|
Category: bug | Risk: high | Score: 82/100 (impact 45/50, urgency 24/30, quality 13/20). Recommended action: fast_track. Batch: workflow-reliability. Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "github.com"See Network Configuration for more information.
|
1 similar comment
|
Category: bug | Risk: high | Score: 82/100 (impact 45/50, urgency 24/30, quality 13/20). Recommended action: fast_track. Batch: workflow-reliability. Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "github.com"See Network Configuration for more information.
|
|
@copilot Please review this PR for forward progress. If there are unresolved review comments or failing checks, address them and then run the pr-finisher skill. If the branch is stale, refresh it from the base branch. Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "github.com"See Network Configuration for more information.
|
…endently-pinned-threat-detect-artifac Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>
Refreshed the branch with the latest |
The installer previously verified
threat-detectagainst a checksum downloaded from the same release, coupling the artifact and trust source.Independent verification
checksums.txt.Fail-closed behavior
Custom artifact verification
pr-sous-chef https://github.com/github/gh-aw/actions/runs/33831313247
pr-sous-chef https://github.com/github/gh-aw/actions/runs/33834943677
Warning
Firewall blocked 1 domain
The following domain was blocked by the firewall during workflow execution:
github.comTo allow these domains, add them to the
network.allowedlist in your workflow frontmatter:See Network Configuration for more information.
pr-sous-chef https://github.com/github/gh-aw/actions/runs/33865510093
Warning
Firewall blocked 2 domains
The following domains were blocked by the firewall during workflow execution:
github.comregistry.npmjs.orgTo allow these domains, add them to the
network.allowedlist in your workflow frontmatter:See Network Configuration for more information.
Run: https://github.com/github/gh-aw/actions/runs/33875422710
Warning
Firewall blocked 2 domains
The following domains were blocked by the firewall during workflow execution:
github.comregistry.npmjs.orgTo allow these domains, add them to the
network.allowedlist in your workflow frontmatter:See Network Configuration for more information.
Warning
Firewall blocked 1 domain
The following domain was blocked by the firewall during workflow execution:
github.comTo allow these domains, add them to the
network.allowedlist in your workflow frontmatter:See Network Configuration for more information.
Run: https://github.com/github/gh-aw/actions/runs/34005295919
Warning
Firewall blocked 2 domains
The following domains were blocked by the firewall during workflow execution:
github.comregistry.npmjs.orgTo allow these domains, add them to the
network.allowedlist in your workflow frontmatter:See Network Configuration for more information.
Warning
Firewall blocked 1 domain
The following domain was blocked by the firewall during workflow execution:
github.comTo allow these domains, add them to the
network.allowedlist in your workflow frontmatter:See Network Configuration for more information.
Run: https://github.com/github/gh-aw/actions/runs/34015173514
Warning
Firewall blocked 1 domain
The following domain was blocked by the firewall during workflow execution:
github.comTo allow these domains, add them to the
network.allowedlist in your workflow frontmatter:See Network Configuration for more information.
Warning
Firewall blocked 1 domain
The following domain was blocked by the firewall during workflow execution:
github.comTo allow these domains, add them to the
network.allowedlist in your workflow frontmatter:See Network Configuration for more information.
$
Warning
Firewall blocked 2 domains
The following domains were blocked by the firewall during workflow execution:
github.comregistry.npmjs.orgTo allow these domains, add them to the
network.allowedlist in your workflow frontmatter:See Network Configuration for more information.
Warning
Firewall blocked 1 domain
The following domain was blocked by the firewall during workflow execution:
api.github.com[!TIP]
api.github.comis blocked because GitHub API access uses the built-in GitHub tools by default. Instead of addingapi.github.comtonetwork.allowed, usetools.github.mode: gh-proxyfor direct pre-authenticated GitHub CLI access without requiring network access toapi.github.com:See GitHub Tools for more information on
gh-proxymode.To allow these domains, add them to the
network.allowedlist in your workflow frontmatter:See Network Configuration for more information.
Warning
Firewall blocked 1 domain
The following domain was blocked by the firewall during workflow execution:
github.comTo allow these domains, add them to the
network.allowedlist in your workflow frontmatter:See Network Configuration for more information.
Warning
Firewall blocked 1 domain
The following domain was blocked by the firewall during workflow execution:
github.comTo allow these domains, add them to the
network.allowedlist in your workflow frontmatter:See Network Configuration for more information.
Warning
Firewall blocked 1 domain
The following domain was blocked by the firewall during workflow execution:
github.comTo allow these domains, add them to the
network.allowedlist in your workflow frontmatter:See Network Configuration for more information.
Warning
Firewall blocked 1 domain
The following domain was blocked by the firewall during workflow execution:
github.comTo allow these domains, add them to the
network.allowedlist in your workflow frontmatter:See Network Configuration for more information.
Automated branch refresh attempt from PR Sous Chef. Run: https://github.com/github/gh-aw/actions/runs/34341665126
Warning
Firewall blocked 1 domain
The following domain was blocked by the firewall during workflow execution:
github.comTo allow these domains, add them to the
network.allowedlist in your workflow frontmatter:See Network Configuration for more information.