Add cross-repository allowlist validation (SEC-005) by Copilot · Pull Request #15808 · github/gh-aw

Copilot · 2026-02-14T23:15:01Z

Implement Cross-Repository Allowlist Validation (SEC-005) ✅

Issue Resolution

Successfully resolved SEC-005 conformance check failure by implementing cross-repository allowlist validation in all affected handlers.

Changes Complete

✅ Handlers with Validation Added:

assign_to_agent.cjs
- Validates GH_AW_TARGET_REPO against GH_AW_AGENT_ALLOWED_REPOS
- Returns E004 error code on validation failure
- Test coverage: 3 test cases
create_agent_session.cjs
- Validates GITHUB_AW_TARGET_REPO against GH_AW_AGENT_SESSION_ALLOWED_REPOS
- Returns E004 error code on validation failure
- Test coverage: 3 test cases
push_repo_memory.cjs
- Validates TARGET_REPO against REPO_MEMORY_ALLOWED_REPOS
- Returns E004 error code on validation failure
- Test coverage: 3 test cases ✅ NEW

✅ Documentation Added (No Validation Needed):

get_repository_url.cjs - URL helper only, no API operations
checkout_pr_branch.cjs - Works within PR context only
pr_review_buffer.cjs - Receives pre-validated data from callers
temporary_id.cjs - Utility library, callers handle validation

Implementation Details

All validation uses the centralized validateRepo() function from repo_helpers.cjs which:

Checks if target repo equals default repo (always allowed)
Checks if target repo is in the allowlist
Returns standardized error messages with E004 code
Provides consistent behavior across all handlers

Test Coverage ✅

✅ Total new tests: 9 test cases (3 per handler)
✅ All tests verify E004 error codes for non-allowlisted repos
✅ All tests verify allowlist enforcement works correctly
✅ All tests verify default repo is always allowed

Verification ✅

✅ SEC-005 conformance check: PASSING
✅ All tests: PASSING (9 new tests added)
✅ Linting: PASSING
✅ Formatting: PASSING
✅ Code review: COMPLETED

Security Impact

This fix eliminates the HIGH severity security vulnerability where agents could potentially perform operations on unauthorized repositories. All cross-repository operations now properly validate target repositories against configured allowlists, preventing:

Unauthorized data access across repositories
Privilege escalation via cross-repo operations
Potential supply chain attacks

Original prompt

This section details on the original issue you should resolve

<issue_title>[Safe Outputs Conformance] SEC-005: Cross-repository handlers lack allowlist validation</issue_title>
<issue_description>### Conformance Check Failure

Check ID: SEC-005
Severity: HIGH
Category: Security
Date: 2026-02-14
Run ID: §22025666977

Problem Description

The conformance checker identified 7 handlers that support cross-repository operations (target-repo or targetRepo parameters) but do not implement allowlist validation. This violates the Safe Outputs specification requirement that cross-repository operations must validate target repositories against an allowlist to prevent unauthorized access.

Security Impact: Without allowlist validation, agents could potentially perform operations on unauthorized repositories, leading to:

Unauthorized data access

Privilege escalation across repositories

Potential for supply chain attacks

Affected Handlers

assign_to_agent.cjs

checkout_pr_branch.cjs

create_agent_session.cjs

get_repository_url.cjs

pr_review_buffer.cjs

push_repo_memory.cjs

temporary_id.cjs

Current Behavior

These handlers accept target-repo or targetRepo parameters but do not validate the target repository against an allowlist before performing operations. This allows cross-repository operations without proper authorization checks.

Expected Behavior

Per the Safe Outputs specification, all handlers that support cross-repository operations MUST:

Validate target repositories against a configured allowlist

Reject operations on non-allowlisted repositories with clear error messages

Log allowlist validation attempts for security auditing

Remediation Steps

For each affected handler:

Add allowlist validation function call before any cross-repository operation

Use a centralized validateTargetRepo() or checkAllowedRepo() function

Ensure the allowlist is configurable via workflow configuration

Add appropriate error handling with E004 (validation error) code

Include security logging for validation failures

Example pattern:
if (targetRepo && !validateTargetRepo(targetRepo, allowedRepos)) {
  throw new Error(`E004: Target repository ${targetRepo} not in allowlist`);
}
Verification

After remediation, verify the fix by running:
bash scripts/check-safe-outputs-conformance.sh
The check SEC-005 should pass without errors.

References

Safe Outputs Specification: docs/src/content/docs/reference/safe-outputs-specification.md

Conformance Checker: scripts/check-safe-outputs-conformance.sh

Generated by Daily Safe Outputs Conformance Checker

expires on Feb 15, 2026, 11:01 PM UTC

Comments on the Issue (you are @copilot in this section)

Fixes [Safe Outputs Conformance] SEC-005: Cross-repository handlers lack allowlist validation #15803

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

Changeset

Type: patch
Description: Enforce cross-repository allowlists in the assign, session, and memory handlers so unauthorized target repositories now trigger the E004 validation error.

Generated by Changeset Generator

✨ PR Review Safe Output Test - Run 22030010500

💥 [THE END] — Illustrated by Smoke Claude

✨ PR Review Safe Output Test - Run 22037471598

💥 [THE END] — Illustrated by Smoke Claude

- Add validateRepo checks to assign_to_agent.cjs - Add validateRepo checks to create_agent_session.cjs - Add validateRepo checks to get_repository_url.cjs - Add validateRepo checks to push_repo_memory.cjs - Add documentation comments for checkout_pr_branch.cjs (false positive) - Add documentation comments for pr_review_buffer.cjs (validation handled by callers) - Add documentation comments for temporary_id.cjs (utility library) All handlers now implement E004 error code for validation failures. SEC-005 conformance check now passes. Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

- Add test cases for assign_to_agent.cjs allowlist validation - Add test cases for create_agent_session.cjs allowlist validation - Tests cover: rejection of non-allowlisted repos, acceptance of allowlisted repos, and default repo handling Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

- Add mockContext to create_agent_session tests - Add getExecOutput mock to mockExec - Fix assign_to_agent test to include allowlist for cross-repo test - Clean up test environment variables in afterEach All tests now passing for both handlers. Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

get_repository_url.cjs is a URL helper that doesn't perform actual cross-repository operations. It only generates URLs for display purposes. Handlers that use it and perform actual operations are responsible for their own validation. Added documentation comment explaining this. Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot

Pull request overview

This PR implements cross-repository allowlist validation (SEC-005) for seven handlers as required by the Safe Outputs specification. The changes address a conformance check failure by adding validation to handlers that perform cross-repository API operations and documenting helpers that don't require validation.

Changes:

Added allowlist validation to three handlers performing cross-repo API operations: assign_to_agent.cjs, create_agent_session.cjs, and push_repo_memory.cjs
Added documentation to four non-API helpers explaining why they don't need validation: temporary_id.cjs, get_repository_url.cjs, checkout_pr_branch.cjs, and pr_review_buffer.cjs
Added comprehensive test coverage for validation in assign_to_agent.test.cjs and create_agent_session.test.cjs

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
`actions/setup/js/assign_to_agent.cjs`	Added validation of `GH_AW_TARGET_REPO` against `GH_AW_AGENT_ALLOWED_REPOS` using centralized `validateRepo()` function
`actions/setup/js/assign_to_agent.test.cjs`	Added test suite for cross-repository allowlist validation covering rejection, acceptance, and default repository cases; fixed existing test to include target repo in allowlist
`actions/setup/js/create_agent_session.cjs`	Added validation of `GITHUB_AW_TARGET_REPO` against `GH_AW_AGENT_SESSION_ALLOWED_REPOS` before processing agent sessions
`actions/setup/js/create_agent_session.test.cjs`	Added test suite for cross-repository allowlist validation with proper setup/teardown of environment variables
`actions/setup/js/push_repo_memory.cjs`	Added validation of `TARGET_REPO` against `REPO_MEMORY_ALLOWED_REPOS` before git operations
`actions/setup/js/checkout_pr_branch.cjs`	Added documentation explaining it operates within PR context and doesn't support cross-repo operations
`actions/setup/js/get_repository_url.cjs`	Added documentation explaining it's a URL helper that doesn't perform cross-repo operations
`actions/setup/js/pr_review_buffer.cjs`	Added documentation explaining it receives pre-validated data from other handlers
`actions/setup/js/temporary_id.cjs`	Added documentation explaining it's a utility library and handlers using it are responsible for validation

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

actions/setup/js/push_repo_memory.cjs

pelikhan · 2026-02-14T23:53:10Z

@copilot add tests

pelikhan · 2026-02-15T04:44:13Z

@copilot keep working

- Add 3 test cases similar to assign_to_agent and create_agent_session tests - Test rejection of non-allowlisted repositories with E004 error - Test acceptance of allowlisted repositories - Test default repository being allowed without explicit allowlist - All tests passing Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-02-15T04:49:41Z

@copilot keep working

Added 3 test cases for push_repo_memory.cjs cross-repository allowlist validation in commit f9f041c:

Rejection of non-allowlisted repositories (E004 error)
Acceptance of allowlisted repositories
Default repository allowed without explicit allowlist

All tests passing.

github-actions · 2026-02-15T04:58:39Z

🎬 THE END — Smoke Claude MISSION: ACCOMPLISHED! The hero saves the day! ✨

github-actions · 2026-02-15T04:58:39Z

🧪 Smoke Project is now testing project operations...

github-actions · 2026-02-15T04:58:39Z

✅ Changeset Generator completed successfully!

github-actions · 2026-02-15T04:58:39Z

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

github-actions · 2026-02-15T04:58:39Z

❌ Smoke Copilot SDK failed. Please review the logs for details.

github-actions · 2026-02-15T04:58:40Z

🧪 Smoke Temporary ID is now testing temporary ID functionality...

github-actions · 2026-02-15T04:58:40Z

📰 BREAKING: Smoke Copilot is now investigating this pull request. Sources say the story is developing...

github-actions · 2026-02-15T05:01:12Z

✅ Smoke Temporary ID completed successfully. Temporary ID validation passed.

github-actions · 2026-02-15T05:01:21Z

Agent Container Tool Check

Tool	Status	Version
bash	✅	5.2.21
sh	✅	available
git	✅	2.52.0
jq	✅	1.7
yq	✅	v4.52.2
curl	✅	8.11.1
gh	✅	2.86.0
node	✅	20.20.0
python3	✅	3.12.3
go	✅	1.24.13
java	✅	11
dotnet	✅	10.0.102

Result: 12/12 tools available ✅

All required development tools are present and functioning in the agent container environment.

AI generated by Agent Container Smoke Test

github-actions · 2026-02-15T05:01:58Z

✅ Smoke Project completed successfully. All project operations validated.

github-actions · 2026-02-15T05:02:48Z

🤖 Beep boop! The smoke test agent just dropped by to say hello! 👋✨

Running some automated testing magic in the background. Don't mind me, just making sure everything's working smoothly! 🚀

This message brought to you by the friendly neighborhood Copilot smoke test suite 🎭

AI generated by Smoke Copilot

github-actions · 2026-02-15T05:02:57Z

Smoke Test Results for Run 22030010496

✅ GitHub MCP (#15807, #15806)
✅ Safe Inputs GH CLI (#15859, #15856)
⚠️ Serena MCP (tool unavailable)
✅ Playwright, File ops, Bash, Discussion, Build, Workflow dispatch, PR review

Overall Status: PASS (10/11 tests)

@app/copilot-swe-agent @pelikhan @Copilot

AI generated by Smoke Copilot

github-actions · 2026-02-15T05:03:21Z

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

github-actions · 2026-02-15T05:03:31Z

Smoke test results:
PRs: "SEC-004: Add content sanitization to safe-output handlers"; "[docs] Update sandbox documentation to reflect SRT removal"
GitHub MCP: ✅
Serena MCP: ✅
Playwright: ✅
File write+cat: ✅
Build: ✅
Overall: PASS

AI generated by Smoke Codex

github-actions

💥 Automated smoke test review - all systems nominal!

The cross-repository allowlist validation implementation looks solid. Consistent error codes and centralized validation logic are excellent security practices.

💥 [THE END] — Illustrated by Smoke Claude for issue #15808

Initial plan

ab5e139

Copilot AI assigned Copilot and pelikhan Feb 14, 2026

Copilot started work on behalf of pelikhan February 14, 2026 23:15 View session

Copilot AI and others added 4 commits February 14, 2026 23:23

Copilot AI changed the title ~~[WIP] Fix allowlist validation for cross-repository handlers~~ Add cross-repository allowlist validation (SEC-005) Feb 14, 2026

Copilot AI requested a review from pelikhan February 14, 2026 23:36

Copilot finished work on behalf of pelikhan February 14, 2026 23:36

pelikhan marked this pull request as ready for review February 14, 2026 23:42

Copilot AI review requested due to automatic review settings February 14, 2026 23:42

Copilot started reviewing on behalf of pelikhan February 14, 2026 23:42 View session

Copilot AI reviewed Feb 14, 2026

View reviewed changes

actions/setup/js/push_repo_memory.cjs Show resolved Hide resolved

Copilot started work on behalf of pelikhan February 14, 2026 23:53 View session

github-actions bot added enhancement New feature or request safe-outputs security labels Feb 15, 2026

This was referenced Feb 15, 2026

[Safe Outputs] Add max limit enforcement to 7 core handlers (SEC-003) #15806

Merged

Smoke Test: Copilot - 22028525097 #15854

Closed

Copilot started work on behalf of pelikhan February 15, 2026 04:44 View session

Copilot finished work on behalf of pelikhan February 15, 2026 04:50

pelikhan added the smoke label Feb 15, 2026

This was referenced Feb 15, 2026

[smoke-temporary-id] Sub-Issue 1: Test Temporary ID References #15876

Open

[smoke-temporary-id] Test Parent: Temporary ID Validation #15877

Open

[smoke-temporary-id] Sub-Issue 2: Test Different ID Length #15878

Closed

Add changeset [skip-ci]

519ac35

github-actions bot mentioned this pull request Feb 15, 2026

Smoke Test: Copilot - 22030010496 #15881

Closed

github-actions bot added smoke-copilot and removed smoke labels Feb 15, 2026

github-actions bot added the smoke-codex label Feb 15, 2026

github-actions bot mentioned this pull request Feb 15, 2026

Smoke Test: Claude - 22030010500 #15882

Closed

github-actions bot added the smoke-claude label Feb 15, 2026

github-actions bot reviewed Feb 15, 2026

View reviewed changes

pelikhan merged commit 56007c1 into main Feb 15, 2026
1 check passed

pelikhan deleted the copilot/fix-allowlist-validation branch February 15, 2026 14:45

This was referenced Feb 15, 2026

Smoke Test: Claude - 22037471598 #15922

Closed

Smoke Test: Claude - 22037921199 #15940

Open

Conversation

Copilot AI commented Feb 14, 2026 • edited by github-actions bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Implement Cross-Repository Allowlist Validation (SEC-005) ✅

Issue Resolution

Changes Complete

Implementation Details

Test Coverage ✅

Verification ✅

Security Impact

Problem Description

Affected Handlers

Current Behavior

Expected Behavior

Remediation Steps

Verification

References

Comments on the Issue (you are @copilot in this section)

Changeset

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

pelikhan commented Feb 14, 2026

Uh oh!

pelikhan commented Feb 15, 2026

Uh oh!

Copilot AI commented Feb 15, 2026

Uh oh!

github-actions bot commented Feb 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Feb 15, 2026

Uh oh!

github-actions bot commented Feb 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Feb 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Feb 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Feb 15, 2026

Uh oh!

github-actions bot commented Feb 15, 2026

Uh oh!

github-actions bot commented Feb 15, 2026

Uh oh!

github-actions bot commented Feb 15, 2026

Agent Container Tool Check

Uh oh!

github-actions bot commented Feb 15, 2026

Uh oh!

github-actions bot commented Feb 15, 2026

Uh oh!

github-actions bot commented Feb 15, 2026

Uh oh!

github-actions bot commented Feb 15, 2026

Uh oh!

github-actions bot commented Feb 15, 2026

Uh oh!

github-actions bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Copilot AI commented Feb 14, 2026 •

edited by github-actions bot

Loading

github-actions bot commented Feb 15, 2026 •

edited

Loading

github-actions bot commented Feb 15, 2026 •

edited

Loading

github-actions bot commented Feb 15, 2026 •

edited

Loading

github-actions bot commented Feb 15, 2026 •

edited

Loading