From 2b5f9d1187c685adff0760e7c4a430e8edc4c17f Mon Sep 17 00:00:00 2001 From: Brady Gaster Date: Tue, 29 Sep 2026 16:36:32 -0700 Subject: [PATCH 1/2] fix(gh-aw): correct exact enlistment warning gate Closes #2117 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .changeset/gh-aw-native-review-warning.md | 6 ++ .../skills/gh-aw-enlistment/SKILL.md | 32 ++++++-- docs/src/content/docs/guide/gh-aw.md | 31 +++++++- .../skills/gh-aw-enlistment/SKILL.md | 32 ++++++-- .../skills/gh-aw-enlistment/SKILL.md | 32 ++++++-- templates/skills/gh-aw-enlistment/SKILL.md | 32 ++++++-- test/gh-aw-enlistment-skill.test.ts | 76 ++++++++++++++----- workflows/skills/gh-aw-enlistment/SKILL.md | 32 ++++++-- workflows/squad-workflows.manifest.json | 2 +- 9 files changed, 228 insertions(+), 47 deletions(-) create mode 100644 .changeset/gh-aw-native-review-warning.md diff --git a/.changeset/gh-aw-native-review-warning.md b/.changeset/gh-aw-native-review-warning.md new file mode 100644 index 000000000..9a4507abd --- /dev/null +++ b/.changeset/gh-aw-native-review-warning.md @@ -0,0 +1,6 @@ +--- +"@bradygaster/squad-cli": patch +"@bradygaster/squad-sdk": patch +--- + +Correct the enlistment skill's strict compile gate for gh-aw v0.89.21 to accept only the exact native review advisory and bot-trigger warning. Preserve all reviewer controls, human approval, and hard stops for errors or any unexpected warning. diff --git a/.squad-templates/skills/gh-aw-enlistment/SKILL.md b/.squad-templates/skills/gh-aw-enlistment/SKILL.md index 016f77f15..15a62147e 100644 --- a/.squad-templates/skills/gh-aw-enlistment/SKILL.md +++ b/.squad-templates/skills/gh-aw-enlistment/SKILL.md @@ -222,11 +222,33 @@ This must run after any first-install approval and before committing. Success criteria: - All eight workflows compile successfully. -- The **only** permitted warning is the known `squad.md` bot-trigger warning: it - configures both slash-command and `github-actions[bot]` triggers, and the bot - trigger is required for controlled worker-continuation dispatches. -- **STOP** on any error, or on **any additional warning** beyond that single - documented one. +- With gh-aw v0.89.21, require exactly two warnings, one occurrence of each + exact diagnostic header below (including its workflow path): + + +```text +.github/workflows/squad-review.md: warning: pull_request_target is a very dangerous trigger. +.github/workflows/squad.md: warning: Both slash_command and bots triggers are configured. If a bot listed in bots: posts a comment that starts with the slash command text (e.g., /command-name), it will trigger the workflow and occupy the concurrency slot, potentially blocking simultaneous manual invocations. To ensure the workflow only runs on explicit user commands, remove the 'bots:' field. +``` + + +The native review advisory includes the compiler's standard explanation and +Security Lab link. The following guard-policy dry-run lines are informational, +not another warning. The bot-trigger warning is expected because +`github-actions[bot]` enables controlled worker-continuation dispatches. + +Accept the native review advisory **only while all existing controls remain**: +same-repository head restriction, base-controlled workflow source, +`checkout: false` agent path, API-only inspection, exact run/head/attempt guard, +least-privilege jobs, advisory verdict, and independent human approval. +`pull_request_target` is not generally safe; this narrow exception neither +weakens those controls nor authorizes PR-head execution. + +**STOP** on any error, or on **any additional warning** beyond these two exact +documented diagnostics. Also STOP if either warning is missing, duplicated, +changed, or attributed to another path, if the summary is not +`Compiled 8 workflows: 8 succeeded, 2 warnings`, or if any required control is +absent. Do not suppress warnings or use `--approve` to bypass this gate. ### 6. Require the verifier to prove the complete consumer contract diff --git a/docs/src/content/docs/guide/gh-aw.md b/docs/src/content/docs/guide/gh-aw.md index 41f6f8359..1300c1a4b 100644 --- a/docs/src/content/docs/guide/gh-aw.md +++ b/docs/src/content/docs/guide/gh-aw.md @@ -341,10 +341,33 @@ gh aw compile --strict ``` Run this exact command after any required first-install approval and before -committing. It must report all eight workflows succeeded. `squad.md` currently -emits one known warning because both slash-command and `github-actions[bot]` -triggers are configured; the bot trigger is required for controlled worker -continuation dispatches. Any error or any additional warning is a stop condition. +committing. With gh-aw v0.89.21, require exactly two warnings, one occurrence +of each exact diagnostic header below (including its workflow path): + + +```text +.github/workflows/squad-review.md: warning: pull_request_target is a very dangerous trigger. +.github/workflows/squad.md: warning: Both slash_command and bots triggers are configured. If a bot listed in bots: posts a comment that starts with the slash command text (e.g., /command-name), it will trigger the workflow and occupy the concurrency slot, potentially blocking simultaneous manual invocations. To ensure the workflow only runs on explicit user commands, remove the 'bots:' field. +``` + + +The native review advisory includes the compiler's standard explanation and +Security Lab link. The following guard-policy dry-run lines are informational, +not another warning. The bot-trigger warning is expected because +`github-actions[bot]` enables controlled worker-continuation dispatches. + +Accept the native review advisory **only while all existing controls remain**: +same-repository head restriction, base-controlled workflow source, +`checkout: false` agent path, API-only inspection, exact run/head/attempt guard, +least-privilege jobs, advisory verdict, and independent human approval. +`pull_request_target` is not generally safe; this narrow exception neither +weakens those controls nor authorizes PR-head execution. + +**STOP** on any error, or on **any additional warning** beyond these two exact +documented diagnostics. Also STOP if either warning is missing, duplicated, +changed, or attributed to another path, if the summary is not +`Compiled 8 workflows: 8 succeeded, 2 warnings`, or if any required control is +absent. Do not suppress warnings or use `--approve` to bypass this gate. Verify the complete source/lock surface: diff --git a/packages/squad-cli/templates/skills/gh-aw-enlistment/SKILL.md b/packages/squad-cli/templates/skills/gh-aw-enlistment/SKILL.md index 016f77f15..15a62147e 100644 --- a/packages/squad-cli/templates/skills/gh-aw-enlistment/SKILL.md +++ b/packages/squad-cli/templates/skills/gh-aw-enlistment/SKILL.md @@ -222,11 +222,33 @@ This must run after any first-install approval and before committing. Success criteria: - All eight workflows compile successfully. -- The **only** permitted warning is the known `squad.md` bot-trigger warning: it - configures both slash-command and `github-actions[bot]` triggers, and the bot - trigger is required for controlled worker-continuation dispatches. -- **STOP** on any error, or on **any additional warning** beyond that single - documented one. +- With gh-aw v0.89.21, require exactly two warnings, one occurrence of each + exact diagnostic header below (including its workflow path): + + +```text +.github/workflows/squad-review.md: warning: pull_request_target is a very dangerous trigger. +.github/workflows/squad.md: warning: Both slash_command and bots triggers are configured. If a bot listed in bots: posts a comment that starts with the slash command text (e.g., /command-name), it will trigger the workflow and occupy the concurrency slot, potentially blocking simultaneous manual invocations. To ensure the workflow only runs on explicit user commands, remove the 'bots:' field. +``` + + +The native review advisory includes the compiler's standard explanation and +Security Lab link. The following guard-policy dry-run lines are informational, +not another warning. The bot-trigger warning is expected because +`github-actions[bot]` enables controlled worker-continuation dispatches. + +Accept the native review advisory **only while all existing controls remain**: +same-repository head restriction, base-controlled workflow source, +`checkout: false` agent path, API-only inspection, exact run/head/attempt guard, +least-privilege jobs, advisory verdict, and independent human approval. +`pull_request_target` is not generally safe; this narrow exception neither +weakens those controls nor authorizes PR-head execution. + +**STOP** on any error, or on **any additional warning** beyond these two exact +documented diagnostics. Also STOP if either warning is missing, duplicated, +changed, or attributed to another path, if the summary is not +`Compiled 8 workflows: 8 succeeded, 2 warnings`, or if any required control is +absent. Do not suppress warnings or use `--approve` to bypass this gate. ### 6. Require the verifier to prove the complete consumer contract diff --git a/packages/squad-sdk/templates/skills/gh-aw-enlistment/SKILL.md b/packages/squad-sdk/templates/skills/gh-aw-enlistment/SKILL.md index 016f77f15..15a62147e 100644 --- a/packages/squad-sdk/templates/skills/gh-aw-enlistment/SKILL.md +++ b/packages/squad-sdk/templates/skills/gh-aw-enlistment/SKILL.md @@ -222,11 +222,33 @@ This must run after any first-install approval and before committing. Success criteria: - All eight workflows compile successfully. -- The **only** permitted warning is the known `squad.md` bot-trigger warning: it - configures both slash-command and `github-actions[bot]` triggers, and the bot - trigger is required for controlled worker-continuation dispatches. -- **STOP** on any error, or on **any additional warning** beyond that single - documented one. +- With gh-aw v0.89.21, require exactly two warnings, one occurrence of each + exact diagnostic header below (including its workflow path): + + +```text +.github/workflows/squad-review.md: warning: pull_request_target is a very dangerous trigger. +.github/workflows/squad.md: warning: Both slash_command and bots triggers are configured. If a bot listed in bots: posts a comment that starts with the slash command text (e.g., /command-name), it will trigger the workflow and occupy the concurrency slot, potentially blocking simultaneous manual invocations. To ensure the workflow only runs on explicit user commands, remove the 'bots:' field. +``` + + +The native review advisory includes the compiler's standard explanation and +Security Lab link. The following guard-policy dry-run lines are informational, +not another warning. The bot-trigger warning is expected because +`github-actions[bot]` enables controlled worker-continuation dispatches. + +Accept the native review advisory **only while all existing controls remain**: +same-repository head restriction, base-controlled workflow source, +`checkout: false` agent path, API-only inspection, exact run/head/attempt guard, +least-privilege jobs, advisory verdict, and independent human approval. +`pull_request_target` is not generally safe; this narrow exception neither +weakens those controls nor authorizes PR-head execution. + +**STOP** on any error, or on **any additional warning** beyond these two exact +documented diagnostics. Also STOP if either warning is missing, duplicated, +changed, or attributed to another path, if the summary is not +`Compiled 8 workflows: 8 succeeded, 2 warnings`, or if any required control is +absent. Do not suppress warnings or use `--approve` to bypass this gate. ### 6. Require the verifier to prove the complete consumer contract diff --git a/templates/skills/gh-aw-enlistment/SKILL.md b/templates/skills/gh-aw-enlistment/SKILL.md index 016f77f15..15a62147e 100644 --- a/templates/skills/gh-aw-enlistment/SKILL.md +++ b/templates/skills/gh-aw-enlistment/SKILL.md @@ -222,11 +222,33 @@ This must run after any first-install approval and before committing. Success criteria: - All eight workflows compile successfully. -- The **only** permitted warning is the known `squad.md` bot-trigger warning: it - configures both slash-command and `github-actions[bot]` triggers, and the bot - trigger is required for controlled worker-continuation dispatches. -- **STOP** on any error, or on **any additional warning** beyond that single - documented one. +- With gh-aw v0.89.21, require exactly two warnings, one occurrence of each + exact diagnostic header below (including its workflow path): + + +```text +.github/workflows/squad-review.md: warning: pull_request_target is a very dangerous trigger. +.github/workflows/squad.md: warning: Both slash_command and bots triggers are configured. If a bot listed in bots: posts a comment that starts with the slash command text (e.g., /command-name), it will trigger the workflow and occupy the concurrency slot, potentially blocking simultaneous manual invocations. To ensure the workflow only runs on explicit user commands, remove the 'bots:' field. +``` + + +The native review advisory includes the compiler's standard explanation and +Security Lab link. The following guard-policy dry-run lines are informational, +not another warning. The bot-trigger warning is expected because +`github-actions[bot]` enables controlled worker-continuation dispatches. + +Accept the native review advisory **only while all existing controls remain**: +same-repository head restriction, base-controlled workflow source, +`checkout: false` agent path, API-only inspection, exact run/head/attempt guard, +least-privilege jobs, advisory verdict, and independent human approval. +`pull_request_target` is not generally safe; this narrow exception neither +weakens those controls nor authorizes PR-head execution. + +**STOP** on any error, or on **any additional warning** beyond these two exact +documented diagnostics. Also STOP if either warning is missing, duplicated, +changed, or attributed to another path, if the summary is not +`Compiled 8 workflows: 8 succeeded, 2 warnings`, or if any required control is +absent. Do not suppress warnings or use `--approve` to bypass this gate. ### 6. Require the verifier to prove the complete consumer contract diff --git a/test/gh-aw-enlistment-skill.test.ts b/test/gh-aw-enlistment-skill.test.ts index f7667511c..db6e81571 100644 --- a/test/gh-aw-enlistment-skill.test.ts +++ b/test/gh-aw-enlistment-skill.test.ts @@ -9,7 +9,7 @@ * 2. Its frontmatter advertises the documented trigger phrases (discoverability). * 3. Its body still encodes every critical safety gate (allowlist, strict * compile, never-auto-merge, read-only token, explicit staging). - * 4. The canonical source and both template mirrors are byte-for-byte identical + * 4. The canonical source and all four mirrors are byte-for-byte identical * (the sync invariant every canonical skill upholds). */ @@ -42,6 +42,64 @@ function readLF(rel: string): string { return readRaw(rel).replace(/\r\n/g, '\n'); } +const COMPILE_WARNINGS = [ + '.github/workflows/squad-review.md: warning: pull_request_target is a very dangerous trigger.', + ".github/workflows/squad.md: warning: Both slash_command and bots triggers are configured. If a bot listed in bots: posts a comment that starts with the slash command text (e.g., /command-name), it will trigger the workflow and occupy the concurrency slot, potentially blocking simultaneous manual invocations. To ensure the workflow only runs on explicit user commands, remove the 'bots:' field.", +]; + +function assertCompileWarningContract(content: string): void { + const regions = [...content.matchAll( + /^\n```text\n([\s\S]*?)\n```\n$/gm, + )]; + expect(regions).toHaveLength(1); + expect(regions[0][1].split('\n')).toEqual(COMPILE_WARNINGS); + const flat = content.replace(/\s+/g, ' '); + expect(flat).toContain('require exactly two warnings, one occurrence of each exact diagnostic header'); + expect(flat).toContain('**STOP** on any error, or on **any additional warning** beyond these two exact documented diagnostics.'); + expect(flat).toContain('Also STOP if either warning is missing, duplicated, changed, or attributed to another path'); + expect(flat).toContain('Compiled 8 workflows: 8 succeeded, 2 warnings'); + expect(flat).toContain('or if any required control is absent.'); + expect(flat).toContain('Do not suppress warnings or use `--approve` to bypass this gate.'); +} + +describe.each([CANONICAL, ...MIRRORS, GUIDE])('%s strict compile warning contract', path => { + const content = readLF(path); + + it('allows exactly the native review advisory and bot-trigger diagnostic with hard-stop semantics', () => { + assertCompileWarningContract(content); + }); + + it('conditions the native review exception on every existing control', () => { + const flat = content.replace(/\s+/g, ' '); + expect(flat).toContain('**only while all existing controls remain**'); + for (const control of [ + 'same-repository head restriction', 'base-controlled workflow source', + '`checkout: false` agent path', 'API-only inspection', 'exact run/head/attempt guard', + 'least-privilege jobs', 'advisory verdict', 'independent human approval', + ]) expect(flat).toContain(control); + expect(flat).toContain('`pull_request_target` is not generally safe'); + }); + + it.each([ + ['unknown third warning', `${COMPILE_WARNINGS.join('\n')}\n.github/workflows/squad.md: warning: unknown diagnostic`], + ['missing review warning', COMPILE_WARNINGS[1]], + ['missing bot warning', COMPILE_WARNINGS[0]], + ['duplicate warning', `${COMPILE_WARNINGS.join('\n')}\n${COMPILE_WARNINGS[0]}`], + ['different workflow path', COMPILE_WARNINGS.join('\n').replace('squad-review.md', 'untrusted.md')], + ['changed diagnostic', COMPILE_WARNINGS.join('\n').replace('very dangerous', 'safe')], + ])('rejects a contract mutation allowing %s', (_label, replacement) => { + const mutated = content.replace(COMPILE_WARNINGS.join('\n'), replacement); + expect(mutated).not.toBe(content); + expect(() => assertCompileWarningContract(mutated)).toThrow(); + }); + + it('rejects removal of the error/additional-warning hard stop', () => { + const mutated = content.replace('**STOP** on any error', 'Continue on any error'); + expect(mutated).not.toBe(content); + expect(() => assertCompileWarningContract(mutated)).toThrow(); + }); +}); + describe('gh-aw-enlistment skill', () => { it('canonical SKILL.md exists', () => { expect(existsSync(resolve(ROOT, CANONICAL)), `${CANONICAL} should exist`).toBe(true); @@ -169,22 +227,6 @@ describe('gh-aw-enlistment skill', () => { expect(content).toMatch(/^gh aw compile --strict(\s+#[^\n]*)?$/m); }); - it('permits only the documented bot-trigger warning', () => { - expect(content).toMatch(/bot-trigger warning|bot trigger/i); - }); - - // The permission above is only safe because it is paired with a hard halt - // on anything else. Asserting the allowance alone would keep passing if - // the STOP were deleted -- i.e. if the narrow exception silently became a - // blanket "warnings are fine". Assert the gate itself, not just the - // carve-out. Newlines are collapsed first because the sentence wraps. - it('halts on any error or any warning beyond the documented one', () => { - const flat = content.replace(/\s+/g, ' '); - expect(flat).toMatch( - /\*\*STOP\*\* on any error, or on \*\*any additional warning\*\* beyond that single documented one\./, - ); - }); - it('keeps the default workflow token read-only', () => { expect(content).toContain('default_workflow_permissions=read'); }); diff --git a/workflows/skills/gh-aw-enlistment/SKILL.md b/workflows/skills/gh-aw-enlistment/SKILL.md index 016f77f15..15a62147e 100644 --- a/workflows/skills/gh-aw-enlistment/SKILL.md +++ b/workflows/skills/gh-aw-enlistment/SKILL.md @@ -222,11 +222,33 @@ This must run after any first-install approval and before committing. Success criteria: - All eight workflows compile successfully. -- The **only** permitted warning is the known `squad.md` bot-trigger warning: it - configures both slash-command and `github-actions[bot]` triggers, and the bot - trigger is required for controlled worker-continuation dispatches. -- **STOP** on any error, or on **any additional warning** beyond that single - documented one. +- With gh-aw v0.89.21, require exactly two warnings, one occurrence of each + exact diagnostic header below (including its workflow path): + + +```text +.github/workflows/squad-review.md: warning: pull_request_target is a very dangerous trigger. +.github/workflows/squad.md: warning: Both slash_command and bots triggers are configured. If a bot listed in bots: posts a comment that starts with the slash command text (e.g., /command-name), it will trigger the workflow and occupy the concurrency slot, potentially blocking simultaneous manual invocations. To ensure the workflow only runs on explicit user commands, remove the 'bots:' field. +``` + + +The native review advisory includes the compiler's standard explanation and +Security Lab link. The following guard-policy dry-run lines are informational, +not another warning. The bot-trigger warning is expected because +`github-actions[bot]` enables controlled worker-continuation dispatches. + +Accept the native review advisory **only while all existing controls remain**: +same-repository head restriction, base-controlled workflow source, +`checkout: false` agent path, API-only inspection, exact run/head/attempt guard, +least-privilege jobs, advisory verdict, and independent human approval. +`pull_request_target` is not generally safe; this narrow exception neither +weakens those controls nor authorizes PR-head execution. + +**STOP** on any error, or on **any additional warning** beyond these two exact +documented diagnostics. Also STOP if either warning is missing, duplicated, +changed, or attributed to another path, if the summary is not +`Compiled 8 workflows: 8 succeeded, 2 warnings`, or if any required control is +absent. Do not suppress warnings or use `--approve` to bypass this gate. ### 6. Require the verifier to prove the complete consumer contract diff --git a/workflows/squad-workflows.manifest.json b/workflows/squad-workflows.manifest.json index 1a8161d93..d8af562d4 100644 --- a/workflows/squad-workflows.manifest.json +++ b/workflows/squad-workflows.manifest.json @@ -225,7 +225,7 @@ "name": "gh-aw-enlistment", "source": "workflows/skills/gh-aw-enlistment/SKILL.md", "destination": ".github/skills/gh-aw-enlistment/SKILL.md", - "sha256": "16f32f86b0a468891819e2b669bf834db60293cc1b5e0b492c75db146c937bc9" + "sha256": "bf3fc780e906b6f0e3c1fc157aac7eaf38f9c0b637f5d62f31c8d3e6d6f9c994" } ], "bootstrap": { From f64857870f7bbc39bd9e26caa4d9bdd5de14ee1e Mon Sep 17 00:00:00 2001 From: Brady Gaster Date: Tue, 29 Sep 2026 16:44:08 -0700 Subject: [PATCH 2/2] docs(gh-aw): retain bot-trigger explanation Closes #2117 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- docs/src/content/docs/guide/gh-aw.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/docs/src/content/docs/guide/gh-aw.md b/docs/src/content/docs/guide/gh-aw.md index 1300c1a4b..da32234dd 100644 --- a/docs/src/content/docs/guide/gh-aw.md +++ b/docs/src/content/docs/guide/gh-aw.md @@ -353,8 +353,9 @@ of each exact diagnostic header below (including its workflow path): The native review advisory includes the compiler's standard explanation and Security Lab link. The following guard-policy dry-run lines are informational, -not another warning. The bot-trigger warning is expected because -`github-actions[bot]` enables controlled worker-continuation dispatches. +not another warning. The bot-trigger warning is expected because `squad.md` +configures both slash-command and `github-actions[bot]` triggers for controlled +worker-continuation dispatches. Accept the native review advisory **only while all existing controls remain**: same-repository head restriction, base-controlled workflow source,