Harden GH_AW_MCP_CLI_SERVERS shell export to resolve code scanning alert #580

[Copilot]

Bug Fix

Alert #580 flagged unsafe shell quoting when emitting GH_AW_MCP_CLI_SERVERS in generated workflow script content. This change applies proper shell argument escaping at the sink so JSON payloads containing quotes cannot break command structure.

• What was the bug?

  Direct interpolation wrote JSON into shell commands with ad hoc quoting, allowing embedded ' to terminate quotes and corrupt the export/$GITHUB_ENV write path.

• How did you fix it?

  Applied shellEscapeArg(...) to the marshaled JSON before writing both command lines in writeMCPGatewayExports (pkg/workflow/mcp_setup_generator.go), and used the escaped value consistently for:

  • export GH_AW_MCP_CLI_SERVERS=...
  • echo GH_AW_MCP_CLI_SERVERS=... >> "$GITHUB_ENV"

• Example (before/after)

escapedCLIServersJSON := shellEscapeArg(string(cliServersJSON))
yaml.WriteString("          export GH_AW_MCP_CLI_SERVERS=" + escapedCLIServersJSON + "\n")
yaml.WriteString("          echo GH_AW_MCP_CLI_SERVERS=" + escapedCLIServersJSON + " >> \"$GITHUB_ENV\"\n")

[Copilot]

Pull request overview

Hardens the generated workflow script output to prevent shell-quoting injection when exporting GH_AW_MCP_CLI_SERVERS (fixing code scanning alert #580).

Changes:

• Shell-escapes the marshaled JSON for GH_AW_MCP_CLI_SERVERS using shellEscapeArg(...).
• Uses the escaped JSON consistently for both export GH_AW_MCP_CLI_SERVERS=... and writing to $GITHUB_ENV.

Show a summary per file

File	Description
pkg/workflow/mcp_setup_generator.go	Applies shellEscapeArg to the JSON payload before emitting it into shell export and $GITHUB_ENV append lines.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 1/1 changed files
• Comments generated: 0