Repository navigation
fix(gh-aw): document native review compiler advisory in enlistment gate #2117
Description
Problem
Final consumer preflight at immutable merged source f67bee5a6cf3e93598ec6396b02c5121cd2b6c5a succeeds for schema v2, both provenance forms, exact digests, immutable action pins, and strict install verification, but the enlistment contract halts because it currently permits only the known squad.md slash-command/bot warning.
gh aw compile --strict with gh-aw v0.89.21 deterministically emits a second warning for the intentional native reviewer architecture:
.github/workflows/squad-review.md: warning: pull_request_target is a very dangerous trigger.
This event runs with full write permissions and access to all repository secrets.
Unlike pull_request, it runs in the context of the target (base) branch, giving
the workflow elevated access even for PRs from untrusted fork contributors.
Even with checkout: false, consider whether pull_request_target is truly necessary.
If you only need to react to PR events without write access, use pull_request instead.
See: https://securitylab.github.com/resources/github-actions-preventing-pwn-requests/
Canonical-workflow and package-root provenance compiles produce byte-identical stderr, exit 0, and exactly two warnings total. The second remains the documented squad.md slash-command/bot concurrency warning.
Required correction
- Update the canonical enlistment skill, all generated/template copies, and the gh-aw guide to permit exactly these two documented warnings.
- Explain why
pull_request_targetis intentional and safe only with the existing same-repository restriction, base-controlled workflow source,checkout: falseagent path, API-only inspection, deterministic guard, least-privilege job permissions, and human approval requirement. - Preserve a hard stop for any other warning or any error; do not add a blanket warning waiver.
- Add contract tests that require both exact narrow warning descriptions and the hard stop.
- Keep native GitHub Actions/gh-aw only: no PAT, App, private key, custom token, new secret/environment, or external service.
- Validate both provenance forms and the 8-workflow/17-runtime/1-skill topology.
Acceptance evidence
- gh-aw v0.89.21 strict compile exits 0 for both provenance forms.
- Compiler stderr is byte-identical across variants and contains exactly the two documented warnings.
- Enlistment contract rejects a third/unknown warning.
- Skill copies remain synchronized and docs/tests/build/lint/integrity pass.
- Independent security/reliability review approves the exact immutable head.
Hosted fixture mutation remains paused until this correction merges.
Activity
docs(gh-aw): retain bot-trigger explanation
fix(gh-aw): correct exact enlistment compiler warning gate (#2118)
bradygaster commentedon Sep 30, 2026
Final immutable preflight and install-PR evidence (not hosted acceptance)
Source:
93aec83accb44e08c39e4a799f13b55208215a13, including merged #2118. This supersedes the earlierf67bee5apreflight.Proven: trusted source preflight; schema-v2 8 workflows / 17 runtime resources / 1 skill; both workflow-level and package-root provenance strict compile and digest verification; immutable gh-aw v0.89.21 setup/setup-cli pin
924af5fdc64061cfbf66fb584c8b07e2ac230c60; exactly the two documented diagnostic headers and the 8-success/2-warning summary. Both provenance compiles emitted byte-identical diagnostics. All three real consumer installs passed strict install and staged-index verification with exactly 46 required paths and no optional editor/maintenance extras. Backend ownership JSON was included despite its broadpackages/ignore rule. Enlistment tests: 85 passed; native review workflow/control tests: 17 passed.8bb53644ba0729e084a6f3030cb4f5413f350cbd8fcaef5532bbb0a7baa770c04fd6cd1065967aa7b5f611a9db1dbd425544d21bf55c8c240e26b2041213623adc5eaa8669d78bc994a8624f37d5d9521be606cf5095062faff701f0a77a5c417b928deaa96d37615a17a7265d16f9561fe0dc6e09efc538cd21b9fd9f0b597b497de00ac440aa492551caa8; 46-file inventory SHA-25643c2151f781f90a068b4173060952e207bbdc712a86f93f7783144f2195e1a9a.8654bc9f6ccef2249b023a8230f259f8e707f267; 46-file inventory SHA-2562c2c0fb5a8b221519d88735a278ccb79825534aafe318957efaee8b4a91c6424.c2d4a431edc8fe632ec937959c1f9e1ed2f97335; 46-file inventory SHA-25608c1e379f1634cfc53407ddde4f0c99aca17a55d218a16dab7c0f7363f966fec.Checks and runs at capture
Run links below identify exact run ID/attempt. All seven bootstrap jobs (
pre_activation,activation,agent,safe_outputs,detection,Materialize validated Squad bootstrap,conclusion) were skipped, not passed. The separatecopilot-pull-request-reviewerandgithub-advanced-securitychecks were still running; no completed review is claimed.Human boundary and preservation
No fixture PR was merged, no default branch was pushed, and no alternate bootstrap trigger was used. The original default SHA/tree/settings, all pre-existing branches (including Dependabot), preserved evidence PRs, and existing issues were verified unchanged. Preserved PRs: octodemo/zava-social-backend-template-20260928092124#3 and octodemo/zava-social-backend-template-20260928092124#8; octodemo/zava-social-frontend-template-20260928092124#3 and octodemo/zava-social-frontend-template-20260928092124#7; octodemo/zava-social-queue-worker-template-20260928092124#9 and octodemo/zava-social-queue-worker-template-20260928092124#13. Only one fresh installation branch and PR per fixture was added. No PAT, dedicated App, private key, custom token, new secret, reviewer environment, or external service was introduced.
Still unproven until an explicitly authorized human installation merge: hosted bootstrap ownership validation and deterministic materialization, Cast/research safe outputs, automatic native Squad Review
reviewjob and logical verdict, exact run/attempt relay and downstream cleanup, and queue negative/recovery/idempotency scenarios. Copilot PR review is not a substitute for that native Squad Review evidence. These install PRs do not establish end-to-end acceptance, and no acceptance issue is being closed or recommended for closure. Docs PR #2100 remains unchanged.chore(release): promote dev to main (v1.1.0) (#2241)