From e031ea55b51ef008055cef15d8cb81fd4b142859 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Fri, 21 Aug 2026 23:47:52 +0000 Subject: [PATCH 1/3] Initial plan From 1281773065937cb30804506d588fa52df15d8fff Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Fri, 21 Aug 2026 23:52:19 +0000 Subject: [PATCH 2/3] Audit strict-mode CLI default Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> --- .github/workflows/weekly-network-domains-audit.lock.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/weekly-network-domains-audit.lock.yml b/.github/workflows/weekly-network-domains-audit.lock.yml index a274b6de207..d27c362ba8a 100644 --- a/.github/workflows/weekly-network-domains-audit.lock.yml +++ b/.github/workflows/weekly-network-domains-audit.lock.yml @@ -1505,7 +1505,7 @@ jobs: mkdir -p /tmp/gh-aw/threat-detection touch /tmp/gh-aw/threat-detection/detection.log - name: Install AWF binary - run: bash "${RUNNER_TEMP}/gh-aw/actions/install_awf_binary.sh" v0.28.4 + run: bash "${RUNNER_TEMP}/gh-aw/actions/install_awf_binary.sh" v0.28.4 --rootless - name: Install GitHub Copilot CLI run: bash "${RUNNER_TEMP}/gh-aw/actions/install_copilot_cli.sh" env: @@ -1520,6 +1520,7 @@ jobs: id: detection_agentic_execution if: always() && steps.detection_guard.outputs.run_detection == 'true' continue-on-error: true + timeout-minutes: 20 env: AWF_REFLECT_ENABLED: 1 COPILOT_AGENT_RUNNER_TYPE: STANDALONE From af3c5f5fe7bebb947ad62ecfad7164818026975b Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Fri, 21 Aug 2026 23:56:03 +0000 Subject: [PATCH 3/3] Test CLI strict default Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> --- .../compile_permissions_integration_test.go | 23 +++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/pkg/cli/compile_permissions_integration_test.go b/pkg/cli/compile_permissions_integration_test.go index 21cf331f3bb..c197b58c5a0 100644 --- a/pkg/cli/compile_permissions_integration_test.go +++ b/pkg/cli/compile_permissions_integration_test.go @@ -90,3 +90,26 @@ func TestCompileVulnerabilityAlertsPermissionIncluded(t *testing.T) { assert.Greater(t, occurrences, 0, "vulnerability-alerts: read should appear at least once in the lock file") } + +func TestCompileDefaultsToStrictMode(t *testing.T) { + setup := setupIntegrationTest(t) + defer setup.cleanup() + + workflowPath := filepath.Join(setup.workflowsDir, "strict-default.md") + workflow := `--- +on: push +permissions: + contents: write +engine: copilot +--- + +# Strict default +` + require.NoError(t, os.WriteFile(workflowPath, []byte(workflow), 0644)) + + cmd := exec.Command(setup.binaryPath, "compile", workflowPath) + output, err := cmd.CombinedOutput() + require.Error(t, err, "compile without --strict should reject write permissions") + assert.Contains(t, string(output), "strict mode: write permission 'contents: write' is not allowed", + "compile without --strict should enable strict validation by default") +}