Pin poutine Docker image to the digest-pinned constant by Copilot · Pull Request #50279 · github/gh-aw

Copilot · 2026-08-04T14:31:03Z

Sighthound flagged five exec.Command sites in pkg/cli as command injection. All five pass argument slices (no shell) and four already validate their dynamic arguments. Auditing them surfaced one genuine issue: poutine.go invoked Docker with a mutable :latest tag rather than the digest-pinned constant used by every other scanner.

Change

pkg/cli/poutine.go — replace the hardcoded ghcr.io/boostsecurityio/poutine:latest literal with the PoutineImage constant in both scan paths (directory and single-file) and their verbose echo strings.

 cmd := exec.Command(
     dockerPath, "run", "--rm",
     "-v", volumeMount, "-w", "/workdir",
-    "ghcr.io/boostsecurityio/poutine:latest",
+    PoutineImage,
     "analyze_local", ".", "--format", "json", "--quiet",
 )

pkg/cli/poutine_test.go — regression test asserting PoutineImage is digest-pinned and passes validateDockerImageRef.

This also aligns poutine with the image pre-pull logic in docker_images.go, which already referenced the pinned constant — previously the pulled image and the executed image could diverge.

Findings assessed as already mitigated

Finding	Existing control
`runner_guard.go:114`	`ValidateAbsolutePath` on git root; `buildDockerVolumeMount`; `buildRunnerGuardContainerScanPath` (Clean + within-root + `./` prefix against option injection); `ResolveExecutablePath`
`grant.go:176`	`validateDockerImageRef` (name/tag/digest allowlist, no leading `-`, no whitespace/control chars); `buildDockerReadonlyFileMount` with regular-file stat
`poutine.go:109/229`	`buildDockerVolumeMount`
`upgrade_command.go:507`	Flag allowlist; `ValidateExecutablePath`; argv control-character screen

No changes made to those sites.

Fixes [sighthound] Security findings in github/gh-aw #50193

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

github-actions · 2026-08-04T14:55:16Z

✅ PR Code Quality Reviewer completed the code quality review.

github-actions · 2026-08-04T14:55:19Z

✅ Design Decision Gate 🏗️ completed the design decision gate check.

No ADR enforcement needed: PR #50279 does not have the 'implementation' label and has only 15 new lines of code in business logic directories (threshold: 100).

github-actions · 2026-08-04T14:55:21Z

🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅

github-actions · 2026-08-04T14:55:27Z

✅ Test Quality Sentinel completed test quality analysis.

Copilot

Pull request overview

Pins Poutine execution to the existing digest-pinned image constant, aligning execution with image pre-pulling.

Changes:

Uses PoutineImage for directory and single-file scans.
Adds a digest-validation test, though it does not cover command construction.

Show a summary per file

File	Description
`pkg/cli/poutine.go`	Replaces mutable Poutine image references.
`pkg/cli/poutine_test.go`	Validates the image constant is digest-pinned.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 2/2 changed files
Comments generated: 1
Review effort level: Balanced

+func TestPoutineImageIsPinnedByDigest(t *testing.T) {
+	if _, err := validateDockerImageRef(PoutineImage); err != nil {
+		t.Fatalf("PoutineImage %q failed docker image reference validation: %v", PoutineImage, err)
+	}
+	if !strings.Contains(PoutineImage, "@sha256:") {


github-actions

The changes look correct and improve supply-chain security by ensuring the executed poutine image matches the digest-pinned constant used by the pre-pull logic. All four call sites are updated consistently and the regression test validates the pinning invariant.

🧵 Reviewed using Impeccable skills by Impeccable Skills Reviewer · sonnet46 · 13.2 AIC · ⌖ 10.3 AIC · ⊞ 5.4K

github-actions

Skills-Based Review 🧠

Applied /diagnosing-bugs — the fix correctly addresses the root cause (:latest tag instead of pinned digest) and adds a regression test. No blocking issues.

📋 Key Themes & Highlights

Positive Highlights

✅ Root cause properly fixed: all four exec.Command sites in both scan paths now use PoutineImage
✅ Regression test TestPoutineImageIsPinnedByDigest guards against future drift (validates both validateDockerImageRef and @sha256: presence)
✅ Aligns the executed image with the pre-pull constant in docker_images.go — eliminates the execute/pull divergence
✅ Comment strings updated to use <PoutineImage> placeholder, keeping docs consistent

Minor Follow-up (non-blocking)

pkg/cli/README.md line 461 still documents PoutineImage as "ghcr.io/boostsecurityio/poutine:latest" — this is now stale and could mislead readers. Worth a one-line update.

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer · sonnet46 · 23.3 AIC · ⌖ 10.6 AIC · ⊞ 7.1K
_{Comment /matt to run again}

github-actions

Verdict: Approve — no blocking issues

Small, correct, well-scoped fix: replaces the hardcoded ghcr.io/boostsecurityio/poutine:latest tag with the existing digest-pinned PoutineImage constant in both the directory and single-file scan paths (command args + verbose echo comments), and adds TestPoutineImageIsPinnedByDigest to guard against regression.

Review notes

All four exec.Command call sites and both verbose-echo comment strings were updated consistently — no missed occurrence of the old :latest literal remains in poutine.go.
PoutineImage (defined in docker_images.go) is validated via validateDockerImageRef and is digest-pinned (@sha256:...), matching the pre-pull logic in docker_images.go so the pulled and executed images now match.
New test TestPoutineImageIsPinnedByDigest correctly asserts both the reference validation and the digest requirement.
No correctness, security, or performance concerns found in the diff. Comment-only changes are accurate (comments were updated to reflect the constant instead of leaving a stale literal).

🔎 Code quality review by PR Code Quality Reviewer · auto · 14.8 AIC · ⌖ 6.25 AIC · ⊞ 7.9K
_{Comment /review to run again}

github-actions · 2026-08-04T15:02:09Z

🧪 Test Quality Sentinel Report

✅ Test Quality Score: 100/100 — Excellent

Analyzed 1 test: 1 design, 0 implementation.

📊 Metrics (1 test)

Metric	Value
Analyzed	1 (Go: 1, JS: 0)
✅ Design	1 (100%)
⚠️ Implementation	0 (0%)
Edge/error coverage	1 (100%)
Duplicate clusters	0
Inflation	No (1.5:1 ratio)
🚨 Violations	0

Test	File	Classification	Notes
`TestPoutineImageIsPinnedByDigest`	`pkg/cli/poutine_test.go:364`	Design test, high value	Validates security invariant: docker image pinned by SHA256 digest

Verdict

✅ Passed. 0% implementation tests (threshold: 30%). Security invariant properly tested with valid error handling and digest pinning validation.

🧪 Test quality analysis by Test Quality Sentinel · haiku45 · 19.4 AIC · ⌖ 5.67 AIC · ⊞ 8.5K · ◷
_{Comment /review to run again}

github-actions

✅ Test Quality Sentinel: 100/100. 0% implementation tests (threshold: 30%).

github-actions · 2026-08-04T18:02:21Z

🎉 This pull request is included in a new release.

Release: v0.84.4

Initial plan

ffbaa4b

Copilot AI assigned Copilot and pelikhan Aug 4, 2026

Copilot started work on behalf of pelikhan August 4, 2026 14:31 View session

Copilot AI linked an issue Aug 4, 2026 that may be closed by this pull request

[sighthound] Security findings in github/gh-aw #50193

Closed

Pin poutine docker image to digest-pinned constant

719f418

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Fix security findings in github/gh-aw~~ Pin poutine Docker image to the digest-pinned constant Aug 4, 2026

Copilot finished work on behalf of pelikhan August 4, 2026 14:43

Copilot AI requested a review from pelikhan August 4, 2026 14:43

pelikhan marked this pull request as ready for review August 4, 2026 14:53

Copilot AI balanced review requested due to automatic review settings August 4, 2026 14:54

Copilot started reviewing on behalf of pelikhan August 4, 2026 14:54 View session

pelikhan merged commit 6860c3b into main Aug 4, 2026
20 of 22 checks passed

pelikhan deleted the copilot/sighthound-fix-security-findings branch August 4, 2026 14:54

Copilot AI reviewed Aug 4, 2026

View reviewed changes

github-actions Bot approved these changes Aug 4, 2026

View reviewed changes

github-actions Bot reviewed Aug 4, 2026

View reviewed changes

github-actions Bot mentioned this pull request Aug 4, 2026

[aw] No-Op Runs #48838

Open

github-actions Bot approved these changes Aug 4, 2026

View reviewed changes

github-actions Bot mentioned this pull request Aug 4, 2026

[breaking-change] Daily Breaking Change Analysis - 2026-08-04 #50310

Closed

6 tasks

Copilot AI mentioned this pull request Aug 4, 2026

Document breaking removal of the OpenCode engine #50311

Merged

Navigation Menu

Uh oh!

Pin poutine Docker image to the digest-pinned constant - #50279

Pin poutine Docker image to the digest-pinned constant#50279
pelikhan merged 2 commits into
mainfrom
copilot/sighthound-fix-security-findings

Copilot AI commented Aug 4, 2026 •

edited

Loading

Uh oh!

Uh oh!

github-actions Bot commented Aug 4, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Aug 4, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Aug 4, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Aug 4, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

github-actions Bot left a comment

Uh oh!

github-actions Bot left a comment

Uh oh!

github-actions Bot left a comment

Uh oh!

github-actions Bot commented Aug 4, 2026

Uh oh!

github-actions Bot left a comment

Uh oh!

github-actions Bot commented Aug 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

Copilot AI commented Aug 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Change

Findings assessed as already mitigated

Uh oh!

Uh oh!

github-actions Bot commented Aug 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Skills-Based Review 🧠

Positive Highlights

Minor Follow-up (non-blocking)

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Verdict: Approve — no blocking issues

Uh oh!

github-actions Bot commented Aug 4, 2026

🧪 Test Quality Sentinel Report

Verdict

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Aug 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Aug 4, 2026 •

edited

Loading

github-actions Bot commented Aug 4, 2026 •

edited

Loading

github-actions Bot commented Aug 4, 2026 •

edited

Loading

github-actions Bot commented Aug 4, 2026 •

edited

Loading

github-actions Bot commented Aug 4, 2026 •

edited

Loading