Validate pre-created PR branch before privileged checkout by Copilot · Pull Request #55481 · github/gh-aw

Copilot · 2026-08-24T18:58:48Z

CodeQL flagged q.lock.yml for checking out an attacker-influenced pre-created PR branch in a privileged workflow path. The risk was that issue_comment-reachable input could flow into actions/checkout before the branch was proven to be the workflow-created branch.

Branch validation
- Adds an activation-job validation step after PR pre-creation.
- Confirms the branch matches the expected gh-aw/pre-created/<run_id>-<attempt> pattern.
- Confirms the pre-created PR head and base repositories are the workflow repository.
Safer checkout ref
- Changes generated agent and safe-output checkouts to use the deterministic workflow-owned branch ref directly, instead of the raw activation output.

ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}

Generated workflow update
- Regenerates .github/workflows/q.lock.yml from the updated compiler output.
- Keeps the validated branch output for safe-output metadata that still needs the branch name.

Fixes [uk-ai-resilience] Untrusted checkout of pre-created PR branch in privileged q.lock.yml workflow (Tier C, critical) #55433

gh-aw-pr-sous-chef: attempted branch refresh in run https://github.com/github/gh-aw/actions/runs/32780228606

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 36 AIC · ⌖ 8.01 AIC · ⊞ 8.7K · ◷
_{Comment /souschef to run again}

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

pelikhan · 2026-08-24T20:08:59Z

@copilot update safe outputs specification using w3c spec writer

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-08-24T20:42:13Z

@copilot update safe outputs specification using w3c spec writer

Addressed in 7174596 by updating the Safe Outputs specification with W3C-style normative requirements for pre-created PR branch provenance, validation before downstream privileged use, and deterministic checkout refs. I also updated the pull-request reference docs to match.

pelikhan · 2026-08-24T20:48:59Z

@copilot the user should be able to configure the branch prefix as part of the safe-outputs.create-pull-request configuration.

github-actions · 2026-08-24T21:02:53Z

✅ Test Quality Sentinel completed test quality analysis.

Test Quality Sentinel skipped because pre-fetch PR data was unavailable: unable to fetch test file diff

🧪 Test quality analysis by Test Quality Sentinel

github-actions · 2026-08-24T21:02:56Z

🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer

github-actions · 2026-08-24T21:02:57Z

✅ Ponytail Reviewer completed successfully!

Lean already. Ship.

Generated by Ponytail Reviewer for #55481

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

github-actions · 2026-08-24T21:08:36Z

Comment Memory

reviewed_at: 2026-08-24T21:06:00Z
review_event: REQUEST_CHANGES
top_themes:
  - pre-created PR mode regressed existing branch-prefix configurability
  - security fix hard-codes behavior instead of deriving trusted ref from config
files_reviewed:
  - pkg/workflow/compiler_precreate_pull_request.go
  - pkg/workflow/create_pull_request.go
  - pkg/workflow/compiler_yaml_checkout.go
  - pkg/workflow/compiler_safe_outputs_steps.go
  - actions/setup/js/validate_pre_created_pull_request.cjs
  - actions/setup/js/validate_pre_created_pull_request.test.cjs
  - docs/src/content/docs/reference/safe-outputs-pull-requests.md
  - docs/src/content/docs/specs/safe-outputs-specification.md
comment_count: 1

Note

This comment is managed by comment memory.

It stores persistent context for this thread in the code block at the top of this comment.
Edit only the text inside the backtick fences; workflow metadata and the footer are regenerated automatically.

Learn more about comment memory

🔎 Code quality review by PR Code Quality Reviewer · pi · gpt54 · 41 AIC · ⌖ 9.08 AIC · ⊞ 7K · ◷
_{Comment /review to run again}

github-actions

Verdict

REQUEST_CHANGES — this closes the original checkout injection hole, but it hard-codes a branch name that the feature already allows users to customize.

The blocking issue is a config/behavior mismatch in pre-created PR mode.

The new compiler path always checks out gh-aw/pre-created/<run_id>-<run_attempt> directly in downstream privileged jobs and the validator only accepts that exact ref. That is fine for the default case, but create-pull-request already exposes branch-prefix, and this PR now documents/validates steer as incompatible with branch-prefix instead of preserving the existing branch-prefix contract.

Right now a workflow author who configured branch naming policy cannot opt into pre-created PRs without losing that configuration surface. Either pre-created branch generation/validation needs to derive the trusted ref from configured branch-prefix, or the feature needs a much more deliberate API change than silently making the option unusable for this mode.

🔎 Code quality review by PR Code Quality Reviewer · pi · gpt54 · 41 AIC · ⌖ 9.08 AIC · ⊞ 7K
_{Comment /review to run again}

github-actions · 2026-08-24T21:08:42Z


 const preCreatePullRequestAppTokenStepID = "pre-create-pull-request-app-token"

+func preCreatedPullRequestBranchRef() string {


This change hard-codes the trusted pre-created branch to gh-aw/pre-created/..., which breaks the existing create-pull-request.branch-prefix contract for anyone trying to use steer and branch naming policy together.

💡 Why this blocks

create-pull-request already supports branch-prefix, and the JS handler still understands it for normal PR creation. This patch makes pre-created PR mode special by forcing downstream privileged checkouts to a fixed ref and by rejecting steer + branch-prefix in validatePreCreatePullRequest().

That turns a security fix into a behavior regression: users who rely on branch naming policy cannot adopt steer at all. Either the trusted ref derivation needs to incorporate the configured prefix, or the product decision to drop branch-prefix in pre-created mode needs to be handled as an explicit API change with matching implementation/docs elsewhere.

A minimal fix would be to derive the expected trusted branch from configuration instead of returning a hard-coded literal here.

Implemented configured branch-prefix support for steer-mode pre-created branches. The compiler now derives deterministic pre-created refs from that configuration in e066cf2.

github-actions

Review: Validate pre-created PR branch before privileged checkout

This is a well-structured security fix for the CodeQL finding. The two-layer defence is correct:

Validation step — validate-pre-created-pull-request checks the branch name against the deterministic gh-aw/pre-created/<run_id>-<attempt> pattern before it can flow into any downstream step.
Hardcoded ref at checkout — all actions/checkout calls now use the literal expected name instead of the activation output, so even if an attacker somehow altered the output, the checkout ignores it.

The pattern is applied consistently across all lock files. No issues found.

🧵 Reviewed using Impeccable skills by Impeccable Skills Reviewer · copilot · sonnet46 · 24.1 AIC · ⌖ 9.05 AIC · ⊞ 6.2K

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

github-actions

Skills-Based Review 🧠

Applied /diagnosing-bugs and /tdd — two issues found; one requesting changes.

📋 Key Themes & Highlights

Key Themes

Empty-branch bypass (security, line 7): If GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH is empty, validation silently passes and an empty trusted-branch output is emitted. Add an explicit !expectedBranch guard.
Missing null-repo test (test coverage): The ?. optional chain on line 22 handles a null head.repo correctly, but no test pins this behaviour. Add a test for the fork-deleted scenario.

Correction — inline comment #3

The concern about GitHub expression expansion in the Go compiler is a false alarm: fmt.Sprintf("...: %s\n", preCreatedPullRequestBranchRef()) emits the expression unquoted in YAML (confirmed in q.lock.yml), so ${{ github.run_id }} is correctly expanded by Actions at runtime. Disregard that comment.

Positive Highlights

✅ Validation step correctly placed after pre-creation and before the branch output is trusted by downstream jobs — good defence-in-depth ordering.
✅ pre_created_pull_request_branch output is now sourced from the validated step, not the raw pre-create output — this is the right fix for the CodeQL finding.
✅ Deterministic preCreatedPullRequestBranchRef() used for checkout ref instead of trusting the activation output — clean and correct.
✅ Test suite is well-structured (Arrange/Act/Assert) and covers the main attack scenarios.

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer · copilot · sonnet46 · 56.6 AIC · ⌖ 10.3 AIC · ⊞ 7.6K
_{Comment /matt to run again}

github-actions · 2026-08-24T21:09:23Z

+async function main() {
+  const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+  const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || "";
+  if (branch !== expectedBranch) {


[/diagnosing-bugs] Empty expectedBranch silently bypasses validation — if GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH is unset or empty, both expectedBranch and branch default to "", the equality check passes, and core.setOutput("branch", "") is emitted without an error.

💡 Suggested guard

Add an explicit guard before the equality check:

if (!expectedBranch) { throw new Error("GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH is not set"); }

And a corresponding test:

it("rejects empty expectedBranch to prevent misconfiguration bypass", async () => { process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH = ""; process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH = ""; const { main } = await import("./validate_pre_created_pull_request.cjs"); await expect(main()).rejects.toThrow(/not set/); });

Without this guard, a misconfigured job would accept any branch that also produces empty output.

@copilot please address this.

Added a fail-closed guard for missing expected branch metadata, with coverage, in 1fbd7c3.

github-actions · 2026-08-24T21:09:23Z

+    pull_number: pullNumber,
+  });
+  const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
+  if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) {


[/tdd] No test covers the case where pullRequest.head.ref matches but head.repo is null — the ?. optional chain on line 22 silently swallows this and produces undefined !== expectedRepo, which throws the right error, but there's no test to pin that behaviour. If the logic is ever refactored, a null repo could be silently accepted.

💡 Suggested test

it("rejects when head repo is null (fork-deleted scenario)", async () => { global.github.rest.pulls.get.mockResolvedValue({ data: { head: { ref: "gh-aw/pre-created/123-2", repo: null }, base: { repo: { full_name: "owner/repo" } }, }, }); const { main } = await import("./validate_pre_created_pull_request.cjs"); await expect(main()).rejects.toThrow(/does not target the expected trusted repository branch/); });

@copilot please address this.

Added coverage for a null PR head repository; it is rejected before emitting the trusted branch in 1fbd7c3.

github-actions · 2026-08-24T21:09:23Z

+		"          GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }}\n",
+		fmt.Sprintf("          GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: %s\n", preCreatedPullRequestBranchRef()),
+		"        with:\n",
+		fmt.Sprintf("          github-token: %s\n", token),


[/diagnosing-bugs] GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH is set to a plain string "gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}" (unexpanded) in the env: block. This means the equality check on line 7 compares the raw template literal string against the actual branch name, which will never match at runtime — validation will always fail.

The fmt.Sprintf call inserts the literal GitHub expression ${{ github.run_id }}-${{ github.run_attempt }} into the YAML, which GitHub Actions will expand before the step runs. Verify in a generated lock file that the env: block reads:

GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}

and NOT a quoted Go string. If the value is double-quoted in YAML it will be treated as literal text by the shell and the ${{ expansion will not happen.

@copilot please address this.

The generated environment value is a GitHub Actions expression and is evaluated before the github-script step runs. Generated lockfiles contain the deterministic run-id/run-attempt ref.

Copilot

Pull request overview

Hardens pre-created pull request workflows by validating branch provenance and using deterministic checkout refs.

Changes:

Adds activation-time PR branch and repository validation.
Uses workflow-derived refs for agent and safe-output checkouts.
Updates tests, documentation, schema, and generated workflows.

Show a summary per file

File	Description
`pkg/workflow/create_pull_request.go`	Validates configured pre-created branch prefixes.
`pkg/workflow/compiler_yaml_checkout.go`	Uses deterministic agent checkout refs.
`pkg/workflow/compiler_safe_outputs_steps.go`	Uses deterministic safe-output checkout refs.
`pkg/workflow/compiler_precreate_pull_request.go`	Generates branch refs and validation steps.
`pkg/workflow/compiler_precreate_pull_request_test.go`	Tests generation and prefix validation.
`pkg/workflow/compiler_precreate_pull_request_integration_test.go`	Tests compiled checkout behavior.
`pkg/parser/schemas/main_workflow_schema.json`	Documents steer-mode prefix constraints.
`docs/src/content/docs/specs/safe-outputs-specification.md`	Specifies branch-provenance requirements.
`docs/src/content/docs/reference/safe-outputs-pull-requests.md`	Documents secure pre-creation behavior.
`docs/src/content/docs/reference/frontmatter-full.md`	Updates branch-prefix reference text.
`actions/setup/js/validate_pre_created_pull_request.test.cjs`	Tests PR provenance validation.
`actions/setup/js/validate_pre_created_pull_request.cjs`	Validates branch, PR number, and repositories.
`actions/setup/js/pre_create_pull_request.test.cjs`	Tests custom branch prefixes.
`actions/setup/js/pre_create_pull_request.cjs`	Creates deterministic prefixed branches.
`.github/workflows/weekly-safe-outputs-spec-review.lock.yml`	Regenerates validation and deterministic refs.
`.github/workflows/weekly-editors-health-check.lock.yml`	Regenerates validation and deterministic refs.
`.github/workflows/weekly-blog-post-writer.lock.yml`	Regenerates validation and deterministic refs.
`.github/workflows/update-astro.lock.yml`	Regenerates validation and deterministic refs.
`.github/workflows/unbloat-docs.lock.yml`	Regenerates validation and deterministic refs.
`.github/workflows/ubuntu-image-analyzer.lock.yml`	Regenerates validation and deterministic refs.
`.github/workflows/tidy.lock.yml`	Regenerates validation and deterministic refs.
`.github/workflows/technical-doc-writer.lock.yml`	Regenerates validation and deterministic refs.
`.github/workflows/spec-extractor.lock.yml`	Regenerates validation and deterministic refs.
`.github/workflows/spec-enforcer.lock.yml`	Regenerates validation and deterministic refs.
`.github/workflows/smoke-project.lock.yml`	Regenerates validation and deterministic refs.
`.github/workflows/slide-deck-maintainer.lock.yml`	Regenerates validation and deterministic refs.
`.github/workflows/ruflo-backed-task.lock.yml`	Regenerates validation and deterministic refs.
`.github/workflows/refiner.lock.yml`	Regenerates validation and deterministic refs.
`.github/workflows/q.lock.yml`	Removes attacker-influenced checkout refs.
`.github/workflows/purelock.lock.yml`	Regenerates validation and deterministic refs.
`.github/workflows/linter-miner.lock.yml`	Regenerates validation and deterministic refs.
`.github/workflows/layout-spec-maintainer.lock.yml`	Regenerates validation and deterministic refs.
`.github/workflows/instructions-janitor.lock.yml`	Regenerates validation and deterministic refs.
`.github/workflows/hourly-ci-cleaner.lock.yml`	Regenerates validation and deterministic refs.
`.github/workflows/go-logger.lock.yml`	Regenerates validation and deterministic refs.
`.github/workflows/glossary-maintainer.lock.yml`	Regenerates validation and deterministic refs.
`.github/workflows/github-mcp-tools-report.lock.yml`	Regenerates validation and deterministic refs.
`.github/workflows/functional-pragmatist.lock.yml`	Regenerates validation and deterministic refs.
`.github/workflows/evoskill-evolver.lock.yml`	Regenerates validation and deterministic refs.
`.github/workflows/eslint-miner.lock.yml`	Regenerates validation and deterministic refs.
`.github/workflows/dictation-prompt.lock.yml`	Regenerates validation and deterministic refs.
`.github/workflows/developer-docs-consolidator.lock.yml`	Regenerates validation and deterministic refs.
`.github/workflows/dependabot-burner.lock.yml`	Regenerates validation and deterministic refs.
`.github/workflows/dead-code-remover.lock.yml`	Regenerates validation and deterministic refs.
`.github/workflows/daily-yamllint-fixer.lock.yml`	Regenerates validation and deterministic refs.
`.github/workflows/daily-workflow-updater.lock.yml`	Regenerates validation and deterministic refs.
`.github/workflows/daily-trajectory-grader-implementer.lock.yml`	Regenerates validation and deterministic refs.
`.github/workflows/daily-safeoutputs-git-simulator.lock.yml`	Regenerates validation and deterministic refs.
`.github/workflows/daily-safe-output-integrator.lock.yml`	Regenerates validation and deterministic refs.
`.github/workflows/daily-rendering-scripts-verifier.lock.yml`	Regenerates validation and deterministic refs.
`.github/workflows/daily-go-test-stubs-aider.lock.yml`	Regenerates validation and deterministic refs.
`.github/workflows/daily-go-test-parallelizer.lock.yml`	Regenerates validation and deterministic refs.
`.github/workflows/daily-elixir-credo-snippet-audit.lock.yml`	Regenerates validation and deterministic refs.
`.github/workflows/daily-documentation-diagram.lock.yml`	Regenerates validation and deterministic refs.
`.github/workflows/daily-doc-updater.lock.yml`	Regenerates validation and deterministic refs.
`.github/workflows/daily-doc-healer.lock.yml`	Regenerates validation and deterministic refs.
`.github/workflows/daily-compiler-threat-spec-optimizer.lock.yml`	Regenerates validation and deterministic refs.
`.github/workflows/daily-community-attribution.lock.yml`	Regenerates validation and deterministic refs.
`.github/workflows/daily-code-debt-aider.lock.yml`	Regenerates validation and deterministic refs.
`.github/workflows/daily-caveman-optimizer.lock.yml`	Regenerates validation and deterministic refs.
`.github/workflows/daily-astrostylelite-markdown-spellcheck.lock.yml`	Regenerates validation and deterministic refs.
`.github/workflows/daily-architecture-diagram.lock.yml`	Regenerates validation and deterministic refs.
`.github/workflows/daily-agent-of-the-day-blog-writer.lock.yml`	Regenerates validation and deterministic refs.
`.github/workflows/code-simplifier.lock.yml`	Regenerates validation and deterministic refs.
`.github/workflows/code-scanning-fixer.lock.yml`	Regenerates validation and deterministic refs.
`.github/workflows/cloclo.lock.yml`	Regenerates validation and deterministic refs.
`.github/workflows/ci-coach.lock.yml`	Regenerates validation and deterministic refs.
`.github/workflows/avenger.lock.yml`	Regenerates validation and deterministic refs.

Review details

Files reviewed: 68/68 changed files
Comments generated: 2
Review effort level: Balanced

Copilot · 2026-08-24T22:07:15Z

+	normalized := normalizePreCreatedPullRequestBranchPrefix(prefix)
+	if normalized != prefix || normalized == "" {
+		return fmt.Errorf("safe-outputs.create-pull-request.steer branch-prefix must be a valid git branch prefix; normalized form would be %q", normalized)
+	}


Pre-created branch prefixes now validate the complete deterministic branch ref and reject reserved or structurally invalid forms in 1c25d85.

Copilot · 2026-08-24T22:07:15Z

+  const pullNumber = Number.parseInt(process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || "", 10);
+  if (!Number.isSafeInteger(pullNumber) || pullNumber <= 0) {
+    throw new Error("Pre-created pull request number is invalid");
+  }


PR numbers now require a canonical positive decimal string before safe-integer conversion, with malformed-value coverage, in 1c25d85.

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-08-24T21:17:17Z

@copilot the user should be able to configure the branch prefix as part of the safe-outputs.create-pull-request configuration.

Addressed in 281333e by allowing safe-outputs.create-pull-request.branch-prefix to configure the pre-created PR branch prefix in steer mode, while keeping the branch deterministic and validated before privileged checkout.

github-actions · 2026-08-24T21:18:09Z

Test Quality Sentinel Report

Score: 87/100 ✅ Excellent

Design tests: 78% (threshold: 70%) ✓
Implementation: 22% (threshold <30%) ✓
Violations: None ✓

23 tests added with strong security focus and comprehensive edge-case coverage.

🧪 Test quality analysis by Test Quality Sentinel · copilot · haiku45 · 113.4 AIC · ⌖ 6.54 AIC · ⊞ 8.3K · ◷
_{Comment /review to run again}

github-actions

✅ Test Quality Sentinel: 87/100 — Excellent

Results: 78% design tests (threshold: 70%), 0% implementation tests (threshold: <30%), strong edge-case coverage with security-focused validation, no violations.

Recommendation: Approve — comprehensive test coverage for pre-created PR branch validation feature.

gh-aw-bot · 2026-08-24T21:44:57Z

gh-aw-pr-sous-chef
@copilot PR Sous Chef triage: this PR still needs forward progress before maintainer investigation is likely to be productive.

Please do one focused follow-up pass:

address the outstanding review feedback and reply in the relevant review thread(s) with the concrete fix or rationale
refresh the branch if needed and use the pr-finisher skill before handing back for review
run make fmt if you touch code

I also attempted a branch refresh for this PR in this run.

Run: https://github.com/github/gh-aw/actions/runs/32780228606

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 36 AIC · ⌖ 8.01 AIC · ⊞ 8.7K · ◷
_{Comment /souschef to run again}

done

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Documents the already-implemented validate-pre-created-pull-request activation-job step (#55481) that re-validates the pre-created steer PR's branch and repository identity before privileged agent/safe-outputs checkout, and the branch-prefix static/valid-git-ref-prefix validation. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

github-actions · 2026-08-25T05:09:00Z

🎉 This pull request is included in a new release.

Release: v0.87.5

Initial plan

3f70f37

Copilot AI assigned Copilot and pelikhan Aug 24, 2026

Copilot started work on behalf of pelikhan August 24, 2026 18:59 View session

Copilot AI linked an issue Aug 24, 2026 that may be closed by this pull request

[uk-ai-resilience] Untrusted checkout of pre-created PR branch in privileged q.lock.yml workflow (Tier C, critical) #55433

Closed

Copilot AI and others added 2 commits August 24, 2026 19:10

Validate pre-created PR branch before checkout

1dff1e5

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Fix pre-created PR validation script generation

d54f266

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Fix untrusted checkout in q.lock.yml workflow~~ Validate pre-created PR branch before privileged checkout Aug 24, 2026

Copilot finished work on behalf of pelikhan August 24, 2026 19:19

Copilot AI requested a review from pelikhan August 24, 2026 19:19

pelikhan reviewed Aug 24, 2026

View reviewed changes

Comment thread pkg/workflow/compiler_precreate_pull_request.go Outdated

Copilot started work on behalf of pelikhan August 24, 2026 20:08 View session

Copilot AI and others added 3 commits August 24, 2026 20:12

Plan refactor precreate validation javascript

0958c14

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Refactor pre-created PR validation script

7cb0b3f

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Regenerate pre-create validation lockfiles

e821aa0

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan August 24, 2026 20:26

Copilot AI requested a review from pelikhan August 24, 2026 20:26

Copilot started work on behalf of pelikhan August 24, 2026 20:26 View session

Update safe outputs pre-created PR spec

7174596

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan August 24, 2026 20:42

Copilot started work on behalf of pelikhan August 24, 2026 20:49 View session

pelikhan marked this pull request as ready for review August 24, 2026 21:01

Copilot AI balanced review requested due to automatic review settings August 24, 2026 21:01

Copilot started reviewing on behalf of pelikhan August 24, 2026 21:02 View session

Harden precreated branch prefix validation

eea280c

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

github-actions Bot requested changes Aug 24, 2026

View reviewed changes

github-actions Bot approved these changes Aug 24, 2026

View reviewed changes

Clean precreated branch prefix normalizer

155e646

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

github-actions Bot previously requested changes Aug 24, 2026

View reviewed changes

Copilot AI reviewed Aug 24, 2026

View reviewed changes

Copilot AI and others added 2 commits August 24, 2026 21:11

Clarify precreated prefix validation

dd91e62

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Name precreated prefix length limit

281333e

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan August 24, 2026 21:18

github-actions Bot reviewed Aug 24, 2026

View reviewed changes

This was referenced Aug 24, 2026

[aw] Test Quality Sentinel reported incomplete result #55517

Closed

[pr-sous-chef] PR Sous Chef run report #55197

Closed

Merge branch 'main' into copilot/uk-ai-resilience-fix-untrusted-checkout

3fb5b1c

Copilot started work on behalf of gh-aw-bot August 24, 2026 21:45 View session

Copilot AI and others added 2 commits August 24, 2026 22:04

Harden pre-created PR validation

1c25d85

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Fail closed on missing PR branch

0e2fc40

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot finished work on behalf of gh-aw-bot August 24, 2026 22:07

Copilot AI requested a review from gh-aw-bot August 24, 2026 22:07

pelikhan merged commit 4108423 into main Aug 24, 2026
46 checks passed

pelikhan deleted the copilot/uk-ai-resilience-fix-untrusted-checkout branch August 24, 2026 22:46

This was referenced Aug 25, 2026

[compiler-threat-spec] Add CTR-027: pre-created PR branch confusion to threat detection spec #55579

Closed

Smoke Test: MAI-Code-1-Flash - 32804908647 #55598

Closed

Smoke Test: MAI-Code-1-Flash - 32807470495 #55618

Closed


		const preCreatePullRequestAppTokenStepID = "pre-create-pull-request-app-token"

		func preCreatedPullRequestBranchRef() string {

Uh oh!

Conversation

Copilot AI commented Aug 24, 2026 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

pelikhan commented Aug 24, 2026

Uh oh!

Copilot AI commented Aug 24, 2026

Uh oh!

pelikhan commented Aug 24, 2026

Uh oh!

github-actions Bot commented Aug 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 24, 2026

Comment Memory

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Verdict

Uh oh!

github-actions Bot Aug 24, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Aug 24, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Review: Validate pre-created PR branch before privileged checkout

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Skills-Based Review 🧠

Key Themes

Correction — inline comment #3

Positive Highlights

Uh oh!

github-actions Bot Aug 24, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Aug 24, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Aug 24, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Aug 24, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Aug 24, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Aug 24, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

Copilot AI Aug 24, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Aug 24, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI commented Aug 24, 2026

Uh oh!

github-actions Bot commented Aug 24, 2026

Test Quality Sentinel Report

Uh oh!

github-actions Bot left a comment

Copilot AI commented Aug 24, 2026 •

edited by github-actions Bot

Loading

github-actions Bot commented Aug 24, 2026 •

edited

Loading

github-actions Bot commented Aug 24, 2026 •

edited

Loading

github-actions Bot commented Aug 24, 2026 •

edited

Loading