Skip to content

[plan] Fix untrusted_checkout_exec in smoke-workflow-call workflows (Day 8 unresolved) #22248

Description

@github-actions

Objective

Resolve the critical untrusted_checkout_exec poutine security finding in smoke-workflow-call.md and smoke-workflow-call-with-inputs.md. This has been unresolved for 8 consecutive days and was briefly fixed then regressed.

Context

Source: Static Analysis Report - 2026-03-22

Vulnerability: Arbitrary code execution from untrusted code changes — bash scripts are executed in a context where PR/fork code could influence execution.

Affected files:

  • .github/workflows/smoke-workflow-call.md
  • .github/workflows/smoke-workflow-call-with-inputs.md

Flagged lines (in compiled .lock.yml):

  • run: bash ${RUNNER_TEMP}/gh-aw/actions/create_prompt_first.sh
  • run: bash ${RUNNER_TEMP}/gh-aw/actions/validate_prompt_placeholders.sh
  • run: bash ${RUNNER_TEMP}/gh-aw/actions/print_prompt_summary.sh

The scripts run from ${RUNNER_TEMP}/gh-aw/actions/ which are downloaded from the repository during checkout. If these workflows are called from a fork with malicious script changes, those scripts could be executed.

Approach

Choose the most appropriate option based on how these smoke tests are triggered:

Option A — Add a poutine suppression comment (preferred if these workflows only run on trusted callers):
In the compiled output or via workflow-level configuration, add:

# poutine:ignore untrusted_checkout_exec
run: bash ${RUNNER_TEMP}/gh-aw/actions/create_prompt_first.sh

Option B — Restrict to trusted refs only: Add a job condition to ensure the workflow only runs when triggered by trusted non-fork refs. Investigate adding a guard in the jobs.activation section in the .md frontmatter.

Option C — Reference pinned scripts: Reference scripts from a pinned SHA rather than the current checkout so fork code cannot affect the scripts being executed.

Investigation Steps

  1. Review smoke-workflow-call.md and smoke-workflow-call-with-inputs.md to understand when/how they're triggered
  2. Check if these workflows can be triggered by fork PRs
  3. Check git history to understand what the previous fix was (it worked on 2026-03-18 but regressed the next day)
  4. Apply the appropriate fix
  5. Run make recompile and validate poutine no longer reports the issue

Files to Modify

  • .github/workflows/smoke-workflow-call.md
  • .github/workflows/smoke-workflow-call-with-inputs.md
  • Recompile: make recompile

Acceptance Criteria

  • Poutine no longer reports untrusted_checkout_exec for these two workflows
  • The fix is durable (won't regress on next recompile)
  • The smoke tests still function correctly

Generated by Plan Command for issue #discussion #22240 ·

  • expires on Mar 24, 2026, 8:48 AM UTC

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Labels

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions