Skip to content

Create shared/security-analysis-base.md for daily security scan workflows#25459

Merged
pelikhan merged 2 commits intomainfrom
copilot/refactor-security-analysis-shared-component
Apr 9, 2026
Merged

Create shared/security-analysis-base.md for daily security scan workflows#25459
pelikhan merged 2 commits intomainfrom
copilot/refactor-security-analysis-shared-component

Conversation

Copy link
Copy Markdown
Contributor

Copilot AI commented Apr 9, 2026

Five security workflows duplicated the same bash: true, toolsets: [repos, code_security], and features: copilot-requests: true config. This extracts those into a single shared base to centralize security-scan tooling and reduce drift.

New shared component

.github/workflows/shared/security-analysis-base.md — provides:

  • permissions: security-events: read
  • tools: github: toolsets: [repos, code_security] + bash: true
  • features: copilot-requests: true
  • Security scanning guidelines (scope, reporting, false-positive avoidance, caching)

Workflow updates

Workflow Redundancies removed
daily-malicious-code-scan.md toolsets: [repos, code_security], bash: true, features: copilot-requests: true
daily-security-red-team.md bash: true; toolsets simplified [repos, issues][issues]
security-review.md import only (tools/features already broader)
code-scanning-fixer.md bash: true, features: copilot-requests: true; toolsets simplified [context, repos, code_security, pull_requests][context, pull_requests]
daily-semgrep-scan.md import only

Note on permissions

The compiler enforces that any permission declared in an imported workflow must also appear explicitly in the importing workflow (prevents silent privilege escalation via imports). So security-events: read stays in each workflow's own frontmatter — the shared base still meaningfully deduplicates the tools and features configuration.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

  • https://api.github.com/graphql
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw (http block)
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw AoyqIUo/CWml661U-1 (http block)
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw -regex .*[0-9]\.[0-9] bash --no�� ithub/workflows (http block)
  • https://api.github.com/orgs/test-owner/actions/secrets
    • Triggering command: /usr/bin/gh gh api /orgs/test-owner/actions/secrets --jq .secrets[].name -c=4 -nolocalimports -importcfg /tmp/go-build1256317996/b411/importcfg -pack /home/REDACTED/work/gh-aw/gh-aw/pkg/fileutil/fileutil.go /home/REDACTED/work/gh-aw/gh-aw/pkg/fileutil/tar.go env -json 1.5.0/internal/x-ifaceassert x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh api /orgs/test-owner/actions/secrets --jq .secrets[].name --write ../../../**/*.jsGOMOD 64/bin/go --ignore-path ../../../.pretti-c /opt/hostedtoolc"prettier" --check '**/*.cjs' '**/*.ts' '**/*.json' --ignore-path ../../../.prettierignore go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/actions/ai-inference/git/ref/tags/v1
    • Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq .object.sha --show-toplevel 64/pkg/tool/linux_amd64/vet /usr/bin/git 88060/b212/_pkg_git t2Bi/LbyKJAzlPTfrev-parse 64/pkg/tool/linu--show-toplevel git rev-�� --show-toplevel 64/pkg/tool/linux_amd64/link /usr/bin/git ger.test 6317996/b244/vetrev-parse ortcfg.link git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq .object.sha npx prettier --wGOINSECURE 64/pkg/tool/linuGOMOD 64/bin/go -json GO111MODULE ache/go/1.25.8/x-json go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v3
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq .object.sha --show-toplevel x_amd64/compile /usr/bin/git -json GO111MODULE x_amd64/vet git remo�� GOMODCACHE x_amd64/vet /opt/hostedtoolcache/node/24.14.1/x64/bin/node -json @v1.1.3/internalrev-parse x_amd64/vet node (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v5
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha se 6317996/b078/vet.cfg .cfg -p internal/runtimeremote -lang=go1.25 ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha --show-toplevel ache/go/1.25.8/x--json /usr/bin/git se 6317996/b107/vetrev-parse 64/pkg/tool/linu--show-toplevel git rev-�� --show-toplevel 64/pkg/tool/linux_amd64/compile /usr/bin/git 3024422399 -trimpath ache/go/1.25.8/x--show-toplevel git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha --show-toplevel ps /usr/bin/git t l /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git p/TestGetNpmBinPgit x_amd64/vet /usr/bin/git git (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v6
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha --show-toplevel 64/pkg/tool/linux_amd64/vet /usr/bin/infocmp RUoqI5yik .cfg 64/pkg/tool/linu--show-toplevel infocmp -1 xterm-color 64/pkg/tool/linuorigin /usr/bin/git y_with_repos=pubgit .cfg 64/pkg/tool/linu--show-toplevel git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha inputs.version 57/XJ3yBE12j21iuxq3TT-m/y51iLq3-X8Jwey5RNH0o /usr/bin/git itcustom_branch1git itcustom_branch1rev-parse 64/pkg/tool/linu--show-toplevel git rev-�� --show-toplevel 64/pkg/tool/linuother /usr/bin/git ithout_min-integgit .cfg 64/pkg/tool/linu--show-toplevel git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha uest|push_to_pull_request_branch)" git /usr/bin/git ons-test39803255git -goversion /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git /tmp/gh-aw-test-git config /opt/hostedtoolc--show-toplevel git (http block)
  • https://api.github.com/repos/actions/github-script/git/ref/tags/v8
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha -json GO111MODULE x_amd64/asm GOINSECURE GOMOD GOMODCACHE x_amd64/asm env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile abi/�� -json GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha 01 t/format.go x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet (http block)
  • https://api.github.com/repos/actions/setup-go/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq .object.sha --show-toplevel 64/pkg/tool/linux_amd64/vet /usr/bin/git cHhvdBx7A .cfg 64/pkg/tool/linu--show-toplevel /usr/bin/git conf�� --get-regexp ^remote\..*\.gh-resolved$ /usr/bin/git y_with_repos_arrgit .cfg 64/pkg/tool/linu--show-toplevel git (http block)
  • https://api.github.com/repos/actions/setup-node/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq .object.sha --show-toplevel 64/pkg/tool/linux_amd64/vet /usr/bin/git Wwm4jUvL6 g/constants/consrev-parse 64/pkg/tool/linu--show-toplevel /usr/bin/git conf�� --get-regexp ^remote\..*\.gh-resolved$ /usr/bin/git 88060/b048/_pkg_git .cfg 64/pkg/tool/linu--show-toplevel git (http block)
  • https://api.github.com/repos/actions/upload-artifact/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq .object.sha -bool -buildtags /usr/bin/git -errorsas -ifaceassert -nilfunc git rev-�� --show-toplevel -tests /usr/bin/git -json n/codec.go x_amd64/compile git (http block)
  • https://api.github.com/repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b
    • Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq .object.sha (http block)
    • Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq .object.sha k/gh-aw/gh-aw/.github/workflows security $name) { hasDiscussionsEnabled } } l (http block)
    • Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq .object.sha --noprofile (http block)
  • https://api.github.com/repos/github/gh-aw
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw --jq .visibility (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw --jq .visibility kflows/refiner.l-f config /usr/bin/gh remote.origin.urgit (http block)
  • https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v0.1.2
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0.1.2 --jq .object.sha --show-toplevel x_amd64/compile /usr/bin/git OsbJQPiBY .cfg 64/pkg/tool/linu--show-toplevel /usr/bin/git remo�� -v 64/pkg/tool/linux_amd64/vet /usr/bin/git 88060/b158/_pkg_git .cfg 64/pkg/tool/linu--show-toplevel git (http block)
  • https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq .object.sha --all-progress-implied (http block)
  • https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.2.3
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq .object.sha git-receive-pack '/tmp/TestParseDefaultBranchFromLsRemoteWithRealGitcustom_branch1730006492/001'git git-receive-pack '/tmp/TestParseDefaultBranchFromLsRemoteWithRealGitcustom_branch1730006492/001'rev-parse /usr/bin/git -json GO111MODULE x_amd64/asm git -C /tmp/TestGuardPolicyBlockedUsersApprovalLabelsCompiledOutput3909621890/001 rev-parse /usr/bin/git -json GO111MODULE x_amd64/compile git (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/1/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/1/artifacts --jq .artifacts[].name om/yosida95/urit-nolocalimports 64/pkg/tool/linu-importcfg GOINSECURE l/buffer GOMODCACHE 64/pkg/tool/linu/home/REDACTED/work/gh-aw/gh-aw/pkg/typeutil/convert_test.go env 1408926080 pRaw/gwkwek_UF5vdtNyzpRaw x_amd64/link GOINSECURE GOMOD GOMODCACHE x_amd64/link (http block)
    • Triggering command: /usr/bin/gh gh run download 1 --dir test-logs/run-1 .cfg 64/pkg/tool/linux_amd64/vet GOINSECURE fips140/edwards2rev-parse GOMODCACHE 64/pkg/tool/linux_amd64/vet env 88060/b238/_pkg_.a .cfg ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet GOINSECURE t/feature/pluralrev-parse GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/1/artifacts --jq .artifacts[].name GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env edOutput1067549650/001 GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/12345/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12345/artifacts --jq .artifacts[].name .cfg 64/pkg/tool/linux_amd64/vet GOINSECURE fips140/sha256 GOMODCACHE 64/pkg/tool/linux_amd64/vet env 88060/b212/_pkg_.a t2Bi/LbyKJAzlPTfrrG8ct2Bi 64/pkg/tool/linux_amd64/link GOINSECURE nal/fips140tls GOMODCACHE 64/pkg/tool/linux_amd64/link (http block)
    • Triggering command: /usr/bin/gh gh run download 12345 --dir test-logs/run-12345 GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE fips140/hmac GOMODCACHE 64/pkg/tool/linutest@example.com env 88060/b224/_pkg_.a ahb4/lZep-2MiwczJtV1iahb4 x_amd64/link GOINSECURE able GOMODCACHE x_amd64/link (http block)
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12345/artifacts --jq .artifacts[].name GO111MODULE tions/setup/node_modules/.bin/sh GOINSECURE GOMOD GOMODCACHE go env ithout_min-integrity3195665076/001 GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/12346/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12346/artifacts --jq .artifacts[].name .cfg 64/pkg/tool/linux_amd64/vet GOINSECURE fips140/sha3 GOMODCACHE 64/pkg/tool/linux_amd64/vet env 88060/b217/_pkg_.a Ldjv/q8rDzC5dO2KyVIFwLdjv util.test GOINSECURE g/x/text/transforemote GOMODCACHE util.test (http block)
    • Triggering command: /usr/bin/gh gh run download 12346 --dir test-logs/run-12346 GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE 88060/b092/ GOMODCACHE 64/pkg/tool/linux_amd64/vet env 2789529864 GO111MODULE .cfg GOINSECURE l 88060/b092/symab--show-toplevel ache/go/1.25.8/x64/pkg/tool/linutest@example.com (http block)
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12346/artifacts --jq .artifacts[].name GO111MODULE tions/node_modules/.bin/sh GOINSECURE GOMOD GOMODCACHE go env ithout_min-integrity3195665076/001 GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/2/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/2/artifacts --jq .artifacts[].name .cfg 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet env 1408926080 3zY_/HcUWNrRjpCKdAR9m3zY_ ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet GOINSECURE g/x/net/idna GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linuremote.origin.url (http block)
    • Triggering command: /usr/bin/gh gh run download 2 --dir test-logs/run-2 .cfg 64/pkg/tool/linux_amd64/vet GOINSECURE ntio/encoding/isinit GOMODCACHE 64/pkg/tool/linux_amd64/vet env 1122265503/.github/workflows GO111MODULE ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet GOINSECURE osh-tekuri/jsonsrev-parse GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linuremote (http block)
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/2/artifacts --jq .artifacts[].name GO111MODULE 1/x64/lib/node_modules/npm/node_modules/@npmcli/run-script/lib/node-gyp-bin/sh GOINSECURE GOMOD GOMODCACHE go env */*.ts' '**/*.json' --ignore-path ../../../.pret.prettierignore GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/3/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/3/artifacts --jq .artifacts[].name .cfg 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linuTest User env 1408926080 V7o_/18xeupG6XnJInX8DV7o_ 64/pkg/tool/linux_amd64/compile GOINSECURE t/internal/tag GOMODCACHE 64/pkg/tool/linux_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh run download 3 --dir test-logs/run-3 .cfg 64/pkg/tool/linux_amd64/vet GOINSECURE 88060/b012/compa/tmp/js-hash-test-2907726474/test-hash.js ache/go/1.25.8/x/home/REDACTED/work/gh-aw/gh-aw/.github/workflows/architecture-guardian.md 64/pkg/tool/linux_amd64/vet env 88060/b247/_pkg_.a cYAj/2RoSUfAH8dMcuiX4cYAj k GOINSECURE t/internal GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linu-trimpath (http block)
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/3/artifacts --jq .artifacts[].name GO111MODULE 86_64/sh GOINSECURE GOMOD GOMODCACHE go env mpiledOutput1485851901/001 GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linuorigin (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/4/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/4/artifacts --jq .artifacts[].name .cfg 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet env 88060/b232/_pkg_.a taK6/ikh7gQ1RReQdq87ptaK6 64/pkg/tool/linux_amd64/vet GOINSECURE contextprotocol/rev-parse GOMODCACHE 64/pkg/tool/linux_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh run download 4 --dir test-logs/run-4 .cfg 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet env 2713018826/.github/workflows verutil_test.go ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet GOINSECURE v3 GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/4/artifacts --jq .artifacts[].name GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env edOutput1067549650/001 GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/5/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/5/artifacts --jq .artifacts[].name .cfg 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet env 1408926080 oYmy/n_pwg_VDfKQLamLkoYmy k GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh run download 5 --dir test-logs/run-5 .cfg 64/pkg/tool/linux_amd64/vet GOINSECURE fips140/nistec/f-d ache/go/1.25.8/x-c 64/pkg/tool/linux_amd64/vet env 88060/b248/_pkg_.a mW0N/BDDpIqgj5QBgNtEbmW0N ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet GOINSECURE t/internal/formainit GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linu-importcfg (http block)
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/5/artifacts --jq .artifacts[].name GO111MODULE n-dir/sh GOINSECURE GOMOD GOMODCACHE go env */*.ts' '**/*.json' --ignore-path ../../../.pret.prettierignore GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet (http block)
  • https://api.github.com/repos/github/gh-aw/actions/workflows
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 100 GOMOD GOMODCACHE x_amd64/vet env -json irent.go x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 6 GOMOD GOMODCACHE x_amd64/compile env 88060/b196/_pkg_.a -QbQ/h0mDcb4RKnBUHEwN-QbQ 64/pkg/tool/linux_amd64/link GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/link (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v0.47.4
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v0.47.4 --jq .object.sha --show-toplevel ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet /usr/bin/git /tmp/go-build138git -trimpath 1/x64/bin/node git rev-�� --show-toplevel /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linuremote.origin.url /usr/bin/git vaScript15693173git -buildtags 1/x64/bin/node git (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq .object.sha l.go l_test.go ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linuremote.origin.url (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.2.3
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq .object.sha -json GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env .a GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env Gitmaster_branchremote.origin.url Gitmaster_branch750700535/001' 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v2.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq .object.sha -json GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env .a GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq .object.sha -json GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env .a /cpu/byteorder.go x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env Gitcustom_branchremote.origin.url Gitcustom_branch429724935/001' 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v3.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq .object.sha -json GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env 366803125/001 366803125/002/work x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/githubnext/agentics/git/ref/tags/-
    • Triggering command: /usr/bin/gh gh api /repos/githubnext/agentics/git/ref/tags/- --jq .object.sha (http block)
    • Triggering command: /usr/bin/gh gh api /repos/githubnext/agentics/git/ref/tags/- --jq .object.sha ithub/workflows (http block)
  • https://api.github.com/repos/nonexistent/action/git/ref/tags/v999.999.999
    • Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq .object.sha /workflows llzq/kleu3xr21GcpMTTxllzq ache/go/1.25.8/x64/pkg/tool/linu-nilfunc GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/xTest User (http block)
  • https://api.github.com/repos/nonexistent/repo/actions/runs/12345
    • Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion GOINSECURE /go-yaml/ast ache/go/1.25.8/x--show-toplevel 64/pkg/tool/linux_amd64/vet env fq9m/dOvw0liy9-ZbDdQ2fq9m GO111MODULE ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linu--jq (http block)
    • Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion GOINSECURE GOMOD GOMODCACHE go tion�� -json GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD (http block)
  • https://api.github.com/repos/owner/repo/actions/workflows
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo -nolocalimports -importcfg /tmp/go-build1256317996/b415/importcfg -pack /tmp/go-build1256317996/b415/_testmain.go env -json ag.go x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/owner/repo/contents/file.md
    • Triggering command: /tmp/go-build1256317996/b397/cli.test /tmp/go-build1256317996/b397/cli.test -test.testlogfile=/tmp/go-build1256317996/b397/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
    • Triggering command: /tmp/go-build3348231637/b397/cli.test /tmp/go-build3348231637/b397/cli.test -test.testlogfile=/tmp/go-build3348231637/b397/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true --show-toplevel git /usr/bin/gh go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/test-owner/test-repo/actions/secrets
    • Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name --write ../../../**/*.jsGOMOD 64/bin/go --ignore-path ../../../.pretti-c /opt/hostedtoolc"prettier" --check '**/*.cjs' '**/*.ts' '**/*.json' --ignore-path ../../../.prettierignore go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)

If you need me to access, download, or install something from one of these locations, you can either:

Copilot AI changed the title [WIP] Refactor to create shared security analysis base for workflows Create shared/security-analysis-base.md for daily security scan workflows Apr 9, 2026
Copilot AI requested a review from pelikhan April 9, 2026 12:55
@pelikhan pelikhan marked this pull request as ready for review April 9, 2026 12:58
Copilot AI review requested due to automatic review settings April 9, 2026 12:58
@pelikhan pelikhan merged commit efde1b5 into main Apr 9, 2026
53 of 54 checks passed
@pelikhan pelikhan deleted the copilot/refactor-security-analysis-shared-component branch April 9, 2026 12:58
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Extracts duplicated security-scan workflow configuration (GitHub toolsets, bash enablement, and Copilot requests feature flag) into a shared import to reduce drift across multiple daily security workflows.

Changes:

  • Added a new shared workflow component: shared/security-analysis-base.md (tools/features/permissions + guidelines).
  • Updated five security workflows to import the shared base and remove duplicated config.
  • Regenerated corresponding .lock.yml compiled workflows to reflect the new import/merged config.
Show a summary per file
File Description
.github/workflows/shared/security-analysis-base.md New shared base for security analysis workflows (permissions/tools/features + guidance).
.github/workflows/security-review.md Imports the new shared base.
.github/workflows/security-review.lock.yml Regenerated compiled workflow with the new import + merged tool/feature effects.
.github/workflows/daily-semgrep-scan.md Imports the new shared base.
.github/workflows/daily-semgrep-scan.lock.yml Regenerated compiled workflow with the new import + merged tool/feature effects.
.github/workflows/daily-security-red-team.md Adds security-events: read, simplifies toolsets, and imports the shared base.
.github/workflows/daily-security-red-team.lock.yml Regenerated compiled workflow with the new import + merged tool/feature effects.
.github/workflows/daily-malicious-code-scan.md Removes duplicated tools/features and imports the shared base.
.github/workflows/daily-malicious-code-scan.lock.yml Regenerated compiled workflow with the new import + merged tool/feature effects.
.github/workflows/code-scanning-fixer.md Imports shared base and removes duplicated tool/features config.
.github/workflows/code-scanning-fixer.lock.yml Regenerated compiled workflow with the new import + merged tool/feature effects.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comments suppressed due to low confidence (1)

.github/workflows/shared/security-analysis-base.md:32

  • The guideline suggests storing scan state in cache-memory, but this shared base doesn’t enable the cache-memory tool in its tools: section. Either add tools.cache-memory: here or adjust the guidance to only recommend caching when the workflow has cache-memory enabled, otherwise agents may attempt to use an unavailable tool.
### Security Scanning Guidelines

1. **Scope carefully** — analyze only the declared time window (e.g., last 24h commits)
2. **Report findings** — use `create-code-scanning-alert` or `create-issue` as appropriate
3. **Avoid false positives** — cross-reference findings with git blame and PR context before alerting
4. **Cache results** — store scan state in `cache-memory` to enable incremental analysis
  • Files reviewed: 11/11 changed files
  • Comments generated: 3

Comment on lines +12 to +14

features:
copilot-requests: true
Copy link

Copilot AI Apr 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

features.copilot-requests: true is being enabled for every workflow that imports this base. At least one importer (daily-security-red-team.md) uses engine: claude, so this import will still inject copilot-requests: write into the compiled workflow and enable Copilot-specific runtime behavior even though Copilot isn't used. Consider moving copilot-requests into a Copilot-only shared base (or leaving it opt-in per workflow) to avoid unnecessary permission scope and side effects for non-Copilot engines.

Suggested change
features:
copilot-requests: true

Copilot uses AI. Check for mistakes.
@@ -0,0 +1,32 @@
---
# Base configuration for AI-powered security analysis workflows.
# Provides: code security tools, bash access, and security-events permissions.
Copy link

Copilot AI Apr 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The header comment says this base "Provides ... security-events permissions", but imported permissions still require explicit declaration in each importing workflow (per compiler rule noted in the PR description). Consider rewording this comment to avoid implying that importing the base alone is sufficient to grant/declare permissions.

This issue also appears on line 27 of the same file.

Suggested change
# Provides: code security tools, bash access, and security-events permissions.
# Includes code security tools, bash access, and the baseline security-events setting
# used by these workflows. Importing workflows must still explicitly declare any
# required permissions (including security-events) per workflow compiler rules.

Copilot uses AI. Check for mistakes.
Comment on lines 21 to 25
max: 5
timeout-minutes: 60
imports:
- shared/security-analysis-base.md
- shared/reporting.md
Copy link

Copilot AI Apr 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This workflow imports shared/security-analysis-base.md, which currently enables features.copilot-requests: true. Since this workflow uses engine: claude, that feature will still inject copilot-requests: write into the compiled permissions and turn on Copilot-specific runtime toggles unnecessarily. If Copilot requests mode isn’t required here, consider excluding that feature from the shared base or overriding it locally.

Copilot uses AI. Check for mistakes.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[refactoring] Create shared/security-analysis-base.md for daily security scan workflows

3 participants