Suppress systemic runner-guard gVisor false positives and remove docker-sbx shellcheck noise at source

[Copilot]

Static analysis noise increased due to shared template emissions: runner-guard RGS-012 repeatedly flagged the gVisor installer path, and docker-sbx bootstrap scripts introduced repeated SC2034/SC2155 warnings across generated workflows. This PR addresses both in compiler sources so fixes propagate via regeneration instead of per-file edits.

• gVisor template: annotate intentional download pattern

  • Added a step-level runner-guard suppression comment on the generated Install gVisor (runsc) step in the shared generator.
  • Scope is limited to the pinned, checksum-verified artifact download path to reduce recurring RGS-012 false positives in generated lock files.

• docker-sbx template: fix shellcheck-triggering script patterns

  • Replaced combined declaration/export:
    • export DOCKER_CONFIG="$(mktemp -d)"
    • with separate assignment + export to satisfy SC2155.
  • Replaced unused loop variable i with _ in daemon polling loops to satisfy SC2034.

• Propagated via compilation output

  • Regenerated affected .lock.yml workflows so template-level fixes are reflected consistently across all consumers.

Example (docker-sbx script change):

DOCKER_CONFIG="$(mktemp -d)"
export DOCKER_CONFIG

for _ in $(seq 1 10); do
  if sbx daemon status 2>/dev/null | grep -q -i running; then
    break
  fi
  sleep 1
done

• Fixes [static-analysis] Report - 2026-08-08 #51310

[github-actions]

PR Triage

• Category: chore
• Risk: medium
• Score: 55/100 (impact 25, urgency 15, quality 15)
• Recommended action: batch_review
• Batch: B2 (large generated-lock-file regeneration PRs, with Bump pinned Claude Code CLI to 2.1.226 and Pi CLI to 0.84.1 #51340)

Touches 60 generated .lock.yml files via compiler template changes (gVisor + shellcheck noise suppression). Source-of-truth change is small but regenerated-file diff is large; review compiler templates directly rather than diffing all lock files. CI status unknown.

Generated by 🔧 PR Triage Agent · auto · 47.1 AIC · ⌖ 2.55 AIC · ⊞ 8K · ◷

[Copilot]

Pull request overview

Updates shared workflow generators to reduce Runner Guard and ShellCheck noise, then regenerates affected workflows.

Changes:

• Adds an RGS-012 suppression for gVisor downloads.
• Separates Docker config assignment/export and replaces unused loop variables.
• Updates tests and 56 generated lock workflows.

Show a summary per file

File	Description
pkg/workflow/gvisor_test.go	Tests gVisor suppression output.
pkg/workflow/docker_sbx_test.go	Tests ShellCheck-safe bootstrap output.
pkg/workflow/docker_sbx_install.go	Fixes SC2034 and SC2155 patterns.
pkg/workflow/copilot_engine_installation.go	Adds the gVisor RGS-012 directive.
.github/workflows/daily-file-diet.lock.yml	Regenerates docker-sbx bootstrap.
.github/workflows/daily-fact.lock.yml	Regenerates docker-sbx bootstrap.
.github/workflows/daily-experiment-report.lock.yml	Regenerates docker-sbx bootstrap.
.github/workflows/daily-evals-report.lock.yml	Regenerates docker-sbx bootstrap.
.github/workflows/daily-elixir-credo-snippet-audit.lock.yml	Regenerates docker-sbx bootstrap.
.github/workflows/daily-doc-updater.lock.yml	Regenerates docker-sbx bootstrap.
.github/workflows/daily-doc-healer.lock.yml	Regenerates docker-sbx bootstrap.
.github/workflows/daily-credit-limit-test.lock.yml	Regenerates docker-sbx bootstrap.
.github/workflows/daily-compiler-threat-spec-optimizer.lock.yml	Regenerates docker-sbx bootstrap.
.github/workflows/daily-compiler-quality.lock.yml	Regenerates docker-sbx bootstrap.
.github/workflows/daily-community-attribution.lock.yml	Regenerates docker-sbx bootstrap.
.github/workflows/daily-code-metrics.lock.yml	Regenerates docker-sbx bootstrap.
.github/workflows/daily-code-debt-aider.lock.yml	Regenerates docker-sbx bootstrap.
.github/workflows/daily-cli-performance.lock.yml	Regenerates docker-sbx bootstrap.
.github/workflows/daily-choice-test.lock.yml	Regenerates docker-sbx bootstrap.
.github/workflows/daily-caveman-optimizer.lock.yml	Regenerates docker-sbx bootstrap.
.github/workflows/daily-cache-strategy-analyzer.lock.yml	Regenerates docker-sbx bootstrap.
.github/workflows/daily-byok-ollama-test.lock.yml	Regenerates docker-sbx bootstrap.
.github/workflows/daily-awf-spec-compiler-surfacing.lock.yml	Regenerates docker-sbx bootstrap.
.github/workflows/daily-aw-cross-repo-compile-check.lock.yml	Regenerates docker-sbx bootstrap.
.github/workflows/daily-astrostylelite-markdown-spellcheck.lock.yml	Regenerates docker-sbx bootstrap.
.github/workflows/daily-assign-issue-to-user.lock.yml	Regenerates docker-sbx bootstrap.
.github/workflows/daily-arxiv-researcher.lock.yml	Regenerates docker-sbx bootstrap.
.github/workflows/daily-architecture-diagram.lock.yml	Regenerates docker-sbx bootstrap.
.github/workflows/daily-ambient-context-optimizer.lock.yml	Regenerates docker-sbx bootstrap.
.github/workflows/daily-agentrx-trace-optimizer.lock.yml	Regenerates docker-sbx bootstrap.
.github/workflows/daily-agent-of-the-day-blog-writer.lock.yml	Regenerates docker-sbx bootstrap.
.github/workflows/daily-action-setup-security-audit.lock.yml	Regenerates docker-sbx bootstrap.
.github/workflows/code-simplifier.lock.yml	Adds generated gVisor directive.
.github/workflows/code-scanning-fixer.lock.yml	Adds generated gVisor directive.
.github/workflows/cloclo.lock.yml	Adds generated gVisor directive.
.github/workflows/cli-version-checker.lock.yml	Adds generated gVisor directive.
.github/workflows/cli-consistency-checker.lock.yml	Adds generated gVisor directive.
.github/workflows/claude-code-user-docs-review.lock.yml	Adds generated gVisor directive.
.github/workflows/ci-coach.lock.yml	Adds generated gVisor directive.
.github/workflows/chaos-pr-bundle-fuzzer.lock.yml	Adds generated gVisor directive.
.github/workflows/changeset.lock.yml	Adds generated gVisor directive.
.github/workflows/breaking-change-checker.lock.yml	Adds generated gVisor directive.
.github/workflows/bot-detection.lock.yml	Adds generated gVisor directive.
.github/workflows/blog-auditor.lock.yml	Adds generated gVisor directive.
.github/workflows/aw-failure-investigator.lock.yml	Adds generated gVisor directive.
.github/workflows/avenger.lock.yml	Adds generated gVisor directive.
.github/workflows/auto-triage-issues.lock.yml	Adds generated gVisor directive.
.github/workflows/audit-workflows.lock.yml	Adds generated gVisor directive.
.github/workflows/artifacts-summary.lock.yml	Adds generated gVisor directive.
.github/workflows/archivx-agentic-workflows-analyzer.lock.yml	Adds generated gVisor directive.
.github/workflows/architecture-guardian.lock.yml	Adds generated gVisor directive.
.github/workflows/archie.lock.yml	Adds generated gVisor directive.
.github/workflows/approach-validator.lock.yml	Adds generated gVisor directive.
.github/workflows/api-consumption-report.lock.yml	Adds generated gVisor directive.
.github/workflows/ai-moderator.lock.yml	Adds generated gVisor directive.
.github/workflows/agentic-token-trend-audit.lock.yml	Adds generated gVisor directive.
.github/workflows/agent-persona-explorer.lock.yml	Adds generated gVisor directive.
.github/workflows/agent-performance-analyzer.lock.yml	Adds generated gVisor directive.
.github/workflows/ace-editor.lock.yml	Adds generated gVisor directive.
.github/workflows/ab-testing-advisor.lock.yml	Adds generated gVisor directive.

Review details

Tip

Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 60/60 changed files
• Comments generated: 3
• Review effort level: Balanced

[github-actions]

✅ Test Quality Sentinel completed test quality analysis.

No test files were added or modified in this PR. PR #51341 modifies production shell-generation code (docker_sbx_install.go, copilot_engine_installation.go) and adds assertions to existing test functions (docker_sbx_test.go, gvisor_test.go) to validate the new behavior. The pre-fetch analysis identified zero new/modified test functions — only inline assertion additions to existing tests. Test Quality Sentinel skipped.

🧪 Test quality analysis by Test Quality Sentinel

[github-actions]

✅ Design Decision Gate 🏗️ completed the design decision gate check.

No ADR enforcement needed: PR #51341 does not have the 'implementation' label and has only 11 new lines of code in business logic directories (threshold: 100).

🏗️ ADR gate enforced by Design Decision Gate 🏗️

[github-actions]

🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer

[github-actions]

✅ PR Code Quality Reviewer completed the code quality review.

Warning

Threat Detection Engine Failure — The analysis engine could not complete. This is a tooling failure, not a security finding.

What happened

The threat detection engine failed to produce results.

Review the workflow run logs for details.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• api.individual.githubcopilot.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.individual.githubcopilot.com"

See Network Configuration for more information.

🔎 Code quality review by PR Code Quality Reviewer

[github-actions]

The changes are correct and well-reasoned:

• SC2155 fix: Splitting export DOCKER_CONFIG="$(mktemp -d)" into separate assignment + export lines correctly preserves the exit code of $(mktemp -d) which would otherwise be masked.
• SC2034 fix: Using _ as the loop variable for unused iteration counters is idiomatic shell.
• RGS-012 suppression: The justification (pinned release, SHA-512 verified, download-only) is accurate and appropriate. Placing the annotation in the template source ensures it propagates to all generated lock files via recompilation.
• Tests: Both docker_sbx_test.go and gvisor_test.go correctly assert the new patterns.

No actionable issues found.

🧵 Reviewed using Impeccable skills by Impeccable Skills Reviewer · sonnet46 · 18.8 AIC · ⌖ 7.14 AIC · ⊞ 5.5K

[github-actions]

Skills-Based Review 🧠

Applied /diagnosing-bugs and /tdd — changes are clean and well-tested; approving.

📋 Key Themes & Highlights

Positive Highlights

• ✅ Root cause fixed in the generator source (docker_sbx_install.go, copilot_engine_installation.go) so all consumers benefit via recompilation — not a per-file workaround.
• ✅ Both shellcheck fixes (SC2155 split declaration/export, SC2034 unused-variable _) follow the canonical patterns for these warnings.
• ✅ Tests in docker_sbx_test.go and gvisor_test.go are updated to assert the new patterns and explicitly assert the old patterns are absent (NotContains) — good regression coverage.
• ✅ The runner-guard suppression comment is narrow and well-justified (pinned release, SHA-512 verified, download-only).
• ✅ Generated lock files are consistently propagated.

Minor Observations (non-blocking)

• The runner-guard:ignore comment is a single long line. Some linters flag long lines; not a blocker here.
• No CONTEXT.md or ADR update needed — these are suppressions of pre-existing static-analysis patterns, not new abstractions.

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer · sonnet46 · 19.5 AIC · ⌖ 7.43 AIC · ⊞ 7.1K
_{Comment /matt to run again}

[github-actions]

🎉 This pull request is included in a new release.

Release: v0.86.2