Fix upload-asset allowed-exts parsing and JS extension normalization by Copilot · Pull Request #27591 · github/gh-aw

Copilot · 2026-04-21T14:07:18Z

Summary

normalize literal safe-outputs.upload-asset.allowed-exts values during Go parsing
trim whitespace, lowercase values, add a leading . when missing, and deduplicate entries while preserving order
preserve GitHub Actions expressions in Go allowed-exts values as-is (no normalization)
refactor JavaScript allowed-extension parsing/normalization into a shared helper module
normalize GH_AW_ASSETS_ALLOWED_EXTS in JavaScript for literal extensions (trim/lowercase/add leading dot)
enforce that GH_AW_ASSETS_ALLOWED_EXTS is already expanded at runtime: unresolved GitHub Actions expressions (${{ ... }}) are rejected with a configuration error
add/update Go and JavaScript unit tests for normalization, expression pass-through, unresolved-expression rejection, and shared helper behavior

Validation

go test -v -run "TestUploadAssetsConfig(CustomExtensions|Defaults|NormalizesExtensions)|TestParseUploadAssetConfig" ./pkg/workflow/
cd actions/setup/js && npm run test:js -- allowed_extensions_helpers.test.cjs safe_outputs_handlers.test.cjs
make agent-finish (fails due to pre-existing lint issues in unrelated files: pkg/actionpins/spec_test.go, pkg/cli/spec_test.go)
parallel_validation (Code Review + CodeQL)

✨ PR Review Safe Output Test - Run 24733695961

💥 [THE END] — Illustrated by Smoke Claude · ● 147K · ◷

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/d805e60c-20aa-4a2f-86e0-c69c378498d0 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot

Pull request overview

Normalizes safe-outputs.upload-asset.allowed-exts values during parsing so configurations that omit leading dots (or include whitespace / mixed casing / duplicates) behave consistently.

Changes:

Add normalizeAllowedExtension() to trim whitespace, lowercase, and add a leading . when missing.
Deduplicate allowed-exts entries while preserving first-seen order during config parsing.
Add unit tests covering normalization behavior in both config and parsing tests.

Show a summary per file

File	Description
pkg/workflow/publish_assets.go	Normalizes and deduplicates `allowed-exts` during `upload-asset` config parsing.
pkg/workflow/publish_assets_test.go	Adds a parsing test case asserting normalization/dedup behavior.
pkg/workflow/upload_assets_config_test.go	Adds a config-level test for extension normalization behavior.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 3/3 changed files
Comments generated: 2

Copilot · 2026-04-21T15:05:39Z

+	}
+	if !strings.HasPrefix(normalized, ".") {
+		normalized = "." + normalized
+	}


normalizeAllowedExtension treats a single dot (".") as a valid extension and will return ".". This is unlikely to be a meaningful file extension and can lead to confusing or overly-broad allowlists if downstream validation uses suffix checks. Consider treating "." (and possibly other non-extension values like "..") as invalid by returning "" so it gets skipped during parsing.

Suggested change

}

}

if strings.Trim(normalized, ".") == "" {

return ""

}

👋 Smoke test agent was here — this is a great catch! The bare-dot edge case is easy to overlook. Agreed that rejecting . and .. would be a safer default.

📰 BREAKING: Report filed by Smoke Copilot · ● 1.1M

Copilot · 2026-04-21T15:05:40Z

+				BaseSafeOutputConfig: BaseSafeOutputConfig{},
+			},
+		},
 		{


The new normalization behavior is covered for missing dots, whitespace, casing, and duplicates, but there isn't a test case for edge inputs like "." or whitespace-only strings. Adding such a case would clarify the intended behavior (e.g., whether these entries should be ignored) and prevent regressions as normalization rules evolve.

Suggested change

{

{

name: "upload-asset config ignores empty allowed-exts entries",

input: map[string]any{

"upload-asset": map[string]any{

"allowed-exts": []any{".", " ", "\t", " GIF ", "."},

},

},

expected: &UploadAssetsConfig{

BranchName: "assets/${{ github.workflow }}",

MaxSizeKB: 10240,

AllowedExts: []string{".gif"},

BaseSafeOutputConfig: BaseSafeOutputConfig{},

},

},

{

pelikhan

@copilot normalize in JavaScript to account for scripts using github actions expressions (${{...

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/3ef72008-9f47-40a0-9fda-79ba057a572b Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-04-21T15:19:06Z

@copilot normalize in JavaScript to account for scripts using github actions expressions (${{...

Implemented in 1cba0d6: JavaScript now normalizes GH_AW_ASSETS_ALLOWED_EXTS entries (trim/lowercase/add leading dot for literals), preserves ${{ ... }} entries, and fails safely with a clear error if an unresolved GitHub Actions expression remains at validation time. Added/updated tests in safe_outputs_handlers.test.cjs for normalization and unresolved-expression handling.

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/3ef72008-9f47-40a0-9fda-79ba057a572b Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/77050c4d-1c90-4348-8809-a8d29c6c1090 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

pelikhan · 2026-04-21T15:44:58Z

 var publishAssetsLog = logger.New("workflow:publish_assets")

+func normalizeAllowedExtension(extension string) string {
+	normalized := strings.ToLower(strings.TrimSpace(extension))


@copilot do not normalize if it is a github actions expression, pass as is the JavaScript will normalize

Updated in cfc57d4: Go now preserves GitHub Actions expressions in allowed-exts as-is, and JavaScript handles normalization/validation at runtime. Screenshot: N/A (no UI changes).

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/62a39b21-d83d-41b7-8ee0-77c94be0e2e3 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

pelikhan · 2026-04-21T16:09:18Z

@copilot make sure the file are copied with setup.sh

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/80136222-62f9-48b4-9c3a-2409a9dc67d2 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-04-21T16:16:38Z

@copilot make sure the file are copied with setup.sh

Fixed in fb416b5: added allowed_extensions_helpers.cjs to SAFE_OUTPUTS_FILES in actions/setup/setup.sh so setup copies it into the safe-outputs runtime directory. Screenshot: N/A (no UI changes).

github-actions · 2026-04-21T16:21:34Z

🚀 Smoke OpenCode MISSION COMPLETE! OpenCode delivered. 🔥

github-actions · 2026-04-21T16:21:35Z

🎬 THE END — Smoke Claude MISSION: ACCOMPLISHED! The hero saves the day! ✨

github-actions · 2026-04-21T16:21:35Z

⚠️ Smoke Gemini failed. Gemini encountered unexpected challenges...

github-actions · 2026-04-21T16:21:37Z

⚠️ Smoke Crush failed. Crush encountered unexpected challenges...

github-actions · 2026-04-21T16:21:37Z

📰 BREAKING: Smoke Copilot is now investigating this pull request. Sources say the story is developing...

github-actions · 2026-04-21T16:21:40Z

🌑 The shadows whisper... Smoke Codex failed. The oracle requires further meditation...

github-actions · 2026-04-21T16:25:10Z

Agent Container Tool Check

Tool	Status	Version
bash	✅	5.2.21
sh	✅	available
git	✅	2.53.0
jq	✅	1.7
yq	✅	v4.52.5
curl	✅	8.5.0
gh	✅	2.89.0
node	✅	v20.20.2
python3	✅	3.12.3
go	✅	1.24.13
java	✅	21.0.10
dotnet	✅	10.0.201

Result: 12/12 tools available ✅

Overall Status: PASS

🔧 Tool validation by Agent Container Smoke Test · ● 160.9K · ◷

github-actions · 2026-04-21T16:29:30Z

Smoke Test Results — Run §24733695961

Core Tests	Status
1. GitHub MCP	✅
2. MCP Scripts GH CLI	✅
3. Serena MCP	✅
4. Make Build	✅
5. Playwright	✅
6. Tavily Web Search	✅
7. File Writing	✅
8. Bash Tool	✅
9. Discussion Comment	✅
10. AW MCP Status	❌
11. Slack Safe Output	✅
12. Code Scanning Alert	✅

PR Review Tests	Status
13. Update PR Body	✅
14. Review Comments	✅
15. Submit Review	✅
16. Resolve Thread	⚠️
17. Add Reviewer	✅
18. Push to Branch	✅
19. Close PR	⚠️

Overall: PARTIAL (1 failure: AW MCP Status tool error; 2 skipped)

💥 [THE END] — Illustrated by Smoke Claude · ● 147K · ◷

github-actions

💥 Automated smoke test review — all systems nominal! This review was auto-generated by the Claude smoke test agent for run §24733695961.

💥 [THE END] — Illustrated by Smoke Claude · ● 147K

github-actions · 2026-04-21T16:29:32Z

+function isGitHubExpression(value) {
+  const trimmed = value.trim();
+  return /^\$\{\{[\s\S]*\}\}$/.test(trimmed);
+}


🤖 Smoke test review comment — The regex [\s\S]* is correct for matching multiline expressions. Consider naming the exported isGitHubExpression helper with a _ prefix or JSDoc @internal if it's only used internally, to clarify the public API surface. ✅ Logic looks solid!

github-actions · 2026-04-21T16:29:32Z

+
+func isGitHubExpression(value string) bool {
+	trimmed := strings.TrimSpace(value)
+	return githubExpressionPattern.MatchString(trimmed)


🤖 Smoke test review comment — isGitHubExpression in Go mirrors the JS helper nicely. The (?s) flag in the regex makes . match newlines, which is correct for multiline expressions like $\{\{ steps.x.outputs\ny }}. 💡 Consider exporting this as IsGitHubExpression if other packages need it in the future.

github-actions · 2026-04-21T16:34:24Z

🧪 Smoke Test Results — Run §24733696225

GitHub MCP ✅ | MCP Scripts GH CLI ✅ | Serena CLI ✅
Playwright ✅ | Web Fetch ✅ | File Write ✅
Build gh-aw ✅ | Upload Artifact ✅ | Discussion ✅
Workflow Dispatch ✅ | PR Review ✅

Overall: ✅ PASS (13/13)

PR Author: @Copilot | Assignees: @pelikhan @Copilot

📰 BREAKING: Report filed by Smoke Copilot · ● 1.1M · ◷

github-actions

Overall the PR cleanly refactors extension normalization into shared helpers for both Go and JS sides, with good test coverage. Two minor points: (1) normalizeAllowedExtension should reject a bare . input; (2) confirm the .test.cjs file uses require() rather than ES import to match the CJS helper module.

📰 BREAKING: Report filed by Smoke Copilot · ● 1.1M

github-actions · 2026-04-21T16:34:27Z

+	normalized := strings.ToLower(trimmed)
+	if !strings.HasPrefix(normalized, ".") {
+		normalized = "." + normalized
+	}


The normalizeAllowedExtension function returns "." for a single-dot input, which could create misleading allowlists. Consider rejecting bare dots: if strings.Trim(normalized, ".") == "" { return "" }

github-actions · 2026-04-21T16:34:27Z

+  return normalized.startsWith(".") ? normalized : `.${normalized}`;
+}
+
+/**


The test file uses ES module import syntax but the helper uses CommonJS (module.exports). Make sure the test runner is configured for CJS or switch the test to require() to avoid module format mismatches.

github-actions · 2026-04-21T16:34:44Z

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

fix: normalize upload-asset allowed-exts values

f9f2d71

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/d805e60c-20aa-4a2f-86e0-c69c378498d0 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI assigned Copilot and pelikhan Apr 21, 2026

Copilot created this pull request from a session on behalf of pelikhan April 21, 2026 14:08 View session

Copilot finished work on behalf of pelikhan April 21, 2026 14:08

Copilot AI requested a review from pelikhan April 21, 2026 14:08

pelikhan marked this pull request as ready for review April 21, 2026 15:01

Copilot AI review requested due to automatic review settings April 21, 2026 15:01

Copilot started reviewing on behalf of pelikhan April 21, 2026 15:02 View session

github-actions Bot mentioned this pull request Apr 21, 2026

[aw] No-Op Runs #27396

Closed

Copilot AI reviewed Apr 21, 2026

View reviewed changes

pelikhan reviewed Apr 21, 2026

View reviewed changes

Copilot started work on behalf of pelikhan April 21, 2026 15:06 View session

Copilot AI and others added 2 commits April 21, 2026 15:15

fix: normalize asset extension parsing in JS handlers

8531139

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/3ef72008-9f47-40a0-9fda-79ba057a572b Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

fix: harden JS extension expression handling

1cba0d6

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/3ef72008-9f47-40a0-9fda-79ba057a572b Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

fix: fail safely on unresolved extension expressions

4c5b845

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/3ef72008-9f47-40a0-9fda-79ba057a572b Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI changed the title ~~Fix upload-asset allowed-exts parsing for missing leading dots~~ Fix upload-asset allowed-exts parsing and JS extension normalization Apr 21, 2026

pelikhan reviewed Apr 21, 2026

View reviewed changes

Comment thread actions/setup/js/safe_outputs_handlers.cjs Outdated

Copilot finished work on behalf of pelikhan April 21, 2026 15:24

Copilot AI requested a review from pelikhan April 21, 2026 15:24

Copilot started work on behalf of pelikhan April 21, 2026 15:24 View session

Copilot AI and others added 3 commits April 21, 2026 15:34

fix: reject unexpanded expressions in asset ext config

ae57838

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/77050c4d-1c90-4348-8809-a8d29c6c1090 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

refactor: avoid duplicate env parsing for extension checks

4a004f3

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/77050c4d-1c90-4348-8809-a8d29c6c1090 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

fix: tighten expression detection in allowed ext parsing

13dc34f

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/77050c4d-1c90-4348-8809-a8d29c6c1090 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan April 21, 2026 15:42

pelikhan reviewed Apr 21, 2026

View reviewed changes

Copilot started work on behalf of pelikhan April 21, 2026 15:45 View session

Copilot AI and others added 2 commits April 21, 2026 15:55

refactor: share extension parsing helpers and preserve expressions

cfc57d4

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/62a39b21-d83d-41b7-8ee0-77c94be0e2e3 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

fix: preserve expressions in js extension normalization

062f1ed

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/62a39b21-d83d-41b7-8ee0-77c94be0e2e3 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan April 21, 2026 16:02

Copilot AI requested a review from pelikhan April 21, 2026 16:02

Copilot started work on behalf of pelikhan April 21, 2026 16:09 View session

fix: copy allowed extension helper in setup script

fb416b5

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/80136222-62f9-48b4-9c3a-2409a9dc67d2 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan April 21, 2026 16:18

pelikhan added the smoke label Apr 21, 2026

github-actions Bot removed the smoke label Apr 21, 2026

github-actions Bot mentioned this pull request Apr 21, 2026

Smoke Test: Claude - 24733695961 #27618

Closed

github-actions Bot reviewed Apr 21, 2026

View reviewed changes

github-actions Bot mentioned this pull request Apr 21, 2026

Smoke Test: Copilot - 24733696225 #27620

Closed

github-actions Bot added the smoke-copilot label Apr 21, 2026

github-actions Bot reviewed Apr 21, 2026

View reviewed changes

pelikhan merged commit 758a1a9 into main Apr 21, 2026
166 of 170 checks passed

pelikhan deleted the copilot/update-allowed-exts-parsing branch April 21, 2026 16:38

-	}
+	}
+	if strings.Trim(normalized, ".") == "" {
+		return ""
+	}

-		{
+		{
+			name: "upload-asset config ignores empty allowed-exts entries",
+			input: map[string]any{
+				"upload-asset": map[string]any{
+					"allowed-exts": []any{".", "   ", "\t", " GIF ", "."},
+				},
+			},
+			expected: &UploadAssetsConfig{
+				BranchName:           "assets/${{ github.workflow }}",
+				MaxSizeKB:            10240,
+				AllowedExts:          []string{".gif"},
+				BaseSafeOutputConfig: BaseSafeOutputConfig{},
+			},
+		},
+		{

Conversation

Copilot AI commented Apr 21, 2026 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Validation

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Copilot's findings

Uh oh!

Copilot AI Apr 21, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Apr 21, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 21, 2026

Choose a reason for hiding this comment

Uh oh!

pelikhan left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI commented Apr 21, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

pelikhan Apr 21, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 21, 2026

Choose a reason for hiding this comment

Uh oh!

pelikhan commented Apr 21, 2026

Uh oh!

Copilot AI commented Apr 21, 2026

Uh oh!

github-actions Bot commented Apr 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Apr 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Apr 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Apr 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Apr 21, 2026

Uh oh!

github-actions Bot commented Apr 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Apr 21, 2026

Agent Container Tool Check

Uh oh!

github-actions Bot commented Apr 21, 2026

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Apr 21, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Apr 21, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Apr 21, 2026

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Apr 21, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Apr 21, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI commented Apr 21, 2026 •

edited by github-actions Bot

Loading

github-actions Bot commented Apr 21, 2026 •

edited

Loading

github-actions Bot commented Apr 21, 2026 •

edited

Loading

github-actions Bot commented Apr 21, 2026 •

edited

Loading

github-actions Bot commented Apr 21, 2026 •

edited

Loading

github-actions Bot commented Apr 21, 2026 •

edited

Loading