Suppress poutine untrusted_checkout_exec via .poutine.yml skip rule - #51533
Conversation
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
PR Triage
|
|
@copilot remove inert poutine:ignore |
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Removed in dcae8d4. Dropped the inert |
|
✅ PR Code Quality Reviewer completed the code quality review. Warning Threat Detection Engine Failure — The analysis engine could not complete. This is a tooling failure, not a security finding. What happenedThe threat detection engine failed to produce results. Review the workflow run logs for details. Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "api.individual.githubcopilot.com"See Network Configuration for more information.
|
|
✅ Test Quality Sentinel completed test quality analysis.
|
|
✅ Design Decision Gate 🏗️ completed the design decision gate check. No ADR enforcement needed: PR #51533 does not have the 'implementation' label and has only 17 new lines of code in business logic directories (threshold: 100).
|
|
🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅
|
|
✅ Ponytail Reviewer completed successfully! Pre-fetched diff only contains generated .lock.yml files (ab-testing-advisor.lock.yml, ace-editor.lock.yml), which are out of scope for this review per instructions. The substantive source changes described in the PR (.poutine.yml, pkg/cli/poutine.go, pkg/cli/poutine_test.go, pkg/workflow/compiler_yaml_prompt.go) are not present in pr-diff.patch, so there is nothing eligible to review for over-engineering. Lean already. Ship.
|
There was a problem hiding this comment.
Pull request overview
Moves Poutine suppression from ineffective inline comments to .poutine.yml, while updating compiler output and generated workflows.
Changes:
- Adds an
activationjob skip to repository and generated Poutine configuration. - Removes inert inline suppression comments from compiler templates.
- Regenerates workflow lock files and extends configuration tests.
Show a summary per file
| File | Description |
|---|---|
.poutine.yml |
Adds the repository-level Poutine skip. |
pkg/cli/poutine.go |
Adds the skip to generated configuration. |
pkg/cli/poutine_test.go |
Tests generated skip content. |
pkg/workflow/ambient_folders.go |
Removes inert inline ignores. |
pkg/workflow/compiler_yaml_prompt.go |
Removes ignores and corrects documentation. |
pkg/workflow/pr.go |
Removes an inline ignore from folder staging. |
pkg/workflow/unified_prompt_step.go |
Removes an inline prompt-step ignore. |
.github/workflows/workflow-skill-extractor.lock.yml |
Regenerated workflow output. |
.github/workflows/workflow-normalizer.lock.yml |
Regenerated workflow output. |
.github/workflows/workflow-health-manager.lock.yml |
Regenerated workflow output. |
.github/workflows/workflow-generator.lock.yml |
Regenerated workflow output. |
.github/workflows/weekly-editors-health-check.lock.yml |
Regenerated workflow output. |
.github/workflows/weekly-blog-post-writer.lock.yml |
Regenerated workflow output. |
.github/workflows/video-analyzer.lock.yml |
Regenerated workflow output. |
.github/workflows/update-astro.lock.yml |
Regenerated workflow output. |
.github/workflows/unbloat-docs.lock.yml |
Regenerated workflow output. |
.github/workflows/ubuntu-image-analyzer.lock.yml |
Regenerated workflow output. |
.github/workflows/typist.lock.yml |
Regenerated workflow output. |
.github/workflows/tidy.lock.yml |
Regenerated workflow output. |
.github/workflows/test-quality-sentinel.lock.yml |
Regenerated workflow output. |
.github/workflows/technical-doc-writer.lock.yml |
Regenerated workflow output. |
.github/workflows/super-linter.lock.yml |
Regenerated workflow output. |
.github/workflows/static-analysis-report.lock.yml |
Regenerated workflow output. |
.github/workflows/stale-repo-identifier.lock.yml |
Regenerated workflow output. |
.github/workflows/stale-pr-cleanup.lock.yml |
Regenerated workflow output. |
.github/workflows/spec-librarian.lock.yml |
Regenerated workflow output. |
.github/workflows/spec-extractor.lock.yml |
Regenerated workflow output. |
.github/workflows/spec-enforcer.lock.yml |
Regenerated workflow output. |
.github/workflows/smoke-project.lock.yml |
Regenerated workflow output. |
.github/workflows/smoke-ci.lock.yml |
Regenerated workflow output. |
.github/workflows/sergo.lock.yml |
Regenerated workflow output. |
.github/workflows/security-compliance.lock.yml |
Regenerated workflow output. |
.github/workflows/schema-feature-coverage.lock.yml |
Regenerated workflow output. |
.github/workflows/research.lock.yml |
Regenerated workflow output. |
.github/workflows/repo-tree-map.lock.yml |
Regenerated workflow output. |
.github/workflows/release.lock.yml |
Regenerated workflow output. |
.github/workflows/refiner.lock.yml |
Regenerated workflow output. |
.github/workflows/refactoring-cadence.lock.yml |
Regenerated workflow output. |
.github/workflows/q.lock.yml |
Regenerated workflow output. |
.github/workflows/python-data-charts.lock.yml |
Regenerated workflow output. |
.github/workflows/purelock.lock.yml |
Regenerated workflow output. |
.github/workflows/pr-triage-agent.lock.yml |
Regenerated workflow output. |
.github/workflows/pr-description-caveman.lock.yml |
Regenerated workflow output. |
.github/workflows/plan.lock.yml |
Regenerated workflow output. |
.github/workflows/pdf-summary.lock.yml |
Regenerated workflow output. |
.github/workflows/outcome-collector.lock.yml |
Regenerated workflow output. |
.github/workflows/org-health-report.lock.yml |
Regenerated workflow output. |
.github/workflows/objective-impact-report.lock.yml |
Regenerated workflow output. |
.github/workflows/notion-issue-summary.lock.yml |
Regenerated workflow output. |
.github/workflows/metrics-collector.lock.yml |
Regenerated workflow output. |
.github/workflows/mergefest.lock.yml |
Regenerated workflow output. |
.github/workflows/mcp-inspector.lock.yml |
Regenerated workflow output. |
.github/workflows/linter-miner.lock.yml |
Regenerated workflow output. |
.github/workflows/lint-monster.lock.yml |
Regenerated workflow output. |
.github/workflows/layout-spec-maintainer.lock.yml |
Regenerated workflow output. |
.github/workflows/jsweep.lock.yml |
Regenerated workflow output. |
.github/workflows/issue-arborist.lock.yml |
Regenerated workflow output. |
.github/workflows/gpclean.lock.yml |
Regenerated workflow output. |
.github/workflows/go-pattern-detector.lock.yml |
Regenerated workflow output. |
.github/workflows/go-logger.lock.yml |
Regenerated workflow output. |
.github/workflows/go-fan.lock.yml |
Regenerated workflow output. |
.github/workflows/glossary-maintainer.lock.yml |
Regenerated workflow output. |
.github/workflows/functional-pragmatist.lock.yml |
Regenerated workflow output. |
.github/workflows/firewall.lock.yml |
Regenerated workflow output. |
.github/workflows/firewall-escape.lock.yml |
Regenerated workflow output. |
.github/workflows/example-permissions-warning.lock.yml |
Regenerated workflow output. |
.github/workflows/example-failure-category-filter.lock.yml |
Regenerated workflow output. |
.github/workflows/evoskill-evolver.lock.yml |
Regenerated workflow output. |
.github/workflows/eslint-refiner.lock.yml |
Regenerated workflow output. |
.github/workflows/eslint-monster.lock.yml |
Regenerated workflow output. |
.github/workflows/eslint-miner.lock.yml |
Regenerated workflow output. |
.github/workflows/duplicate-code-detector.lock.yml |
Regenerated workflow output. |
.github/workflows/draft-pr-cleanup.lock.yml |
Regenerated workflow output. |
.github/workflows/dictation-prompt.lock.yml |
Regenerated workflow output. |
.github/workflows/dev.lock.yml |
Regenerated workflow output. |
.github/workflows/dev-hawk.lock.yml |
Regenerated workflow output. |
.github/workflows/deployment-incident-monitor.lock.yml |
Regenerated workflow output. |
.github/workflows/delight.lock.yml |
Regenerated workflow output. |
.github/workflows/deep-report.lock.yml |
Regenerated workflow output. |
.github/workflows/dead-code-remover.lock.yml |
Regenerated workflow output. |
.github/workflows/daily-team-status.lock.yml |
Regenerated workflow output. |
.github/workflows/daily-regulatory.lock.yml |
Regenerated workflow output. |
.github/workflows/daily-performance-summary.lock.yml |
Regenerated workflow output. |
.github/workflows/daily-news.lock.yml |
Regenerated workflow output. |
.github/workflows/daily-model-resolution.lock.yml |
Regenerated workflow output. |
.github/workflows/daily-model-inventory.lock.yml |
Regenerated workflow output. |
.github/workflows/daily-geo-optimizer.lock.yml |
Regenerated workflow output. |
.github/workflows/daily-file-diet.lock.yml |
Regenerated workflow output. |
.github/workflows/daily-fact.lock.yml |
Regenerated workflow output. |
.github/workflows/daily-experiment-report.lock.yml |
Regenerated workflow output. |
.github/workflows/daily-evals-report.lock.yml |
Regenerated workflow output. |
.github/workflows/daily-credit-limit-test.lock.yml |
Regenerated workflow output. |
.github/workflows/daily-community-attribution.lock.yml |
Regenerated workflow output. |
.github/workflows/daily-cli-tools-tester.lock.yml |
Regenerated workflow output. |
.github/workflows/daily-cli-performance.lock.yml |
Regenerated workflow output. |
.github/workflows/daily-architecture-diagram.lock.yml |
Regenerated workflow output. |
.github/workflows/craft.lock.yml |
Regenerated workflow output. |
.github/workflows/copilot-opt.lock.yml |
Regenerated workflow output. |
.github/workflows/copilot-centralization-optimizer.lock.yml |
Regenerated workflow output. |
.github/workflows/contribution-check.lock.yml |
Regenerated workflow output. |
.github/workflows/code-simplifier.lock.yml |
Regenerated workflow output. |
.github/workflows/code-scanning-fixer.lock.yml |
Regenerated workflow output. |
.github/workflows/ci-doctor.lock.yml |
Regenerated workflow output. |
.github/workflows/ci-coach.lock.yml |
Regenerated workflow output. |
.github/workflows/avenger.lock.yml |
Regenerated workflow output. |
.github/workflows/audit-workflows.lock.yml |
Regenerated workflow output. |
.github/workflows/artifacts-summary.lock.yml |
Regenerated workflow output. |
.github/workflows/architecture-guardian.lock.yml |
Regenerated workflow output. |
.github/workflows/archie.lock.yml |
Regenerated workflow output. |
.github/workflows/agentic-token-optimizer.lock.yml |
Regenerated workflow output. |
.github/workflows/agentic-token-audit.lock.yml |
Regenerated workflow output. |
.github/workflows/agent-performance-analyzer.lock.yml |
Regenerated workflow output. |
.github/workflows/ace-editor.lock.yml |
Regenerated workflow output. |
.github/workflows/ab-testing-advisor.lock.yml |
Regenerated workflow output. |
Review details
Tip
Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.
- Files reviewed: 291/291 changed files
- Comments generated: 4
- Review effort level: Balanced
| - rule: untrusted_checkout_exec | ||
| job: activation |
| - rule: untrusted_checkout_exec | ||
| job: activation |
| yaml.WriteString(" run: |\n") | ||
| yaml.WriteString(" # poutine:ignore untrusted_checkout_exec\n") | ||
| yaml.WriteString(" bash \"${RUNNER_TEMP}/gh-aw/actions/create_prompt_first.sh\"\n") |
| process_safe_outputs_items_applied: ${{ steps.process_safe_outputs.outputs.items_applied }} | ||
| process_safe_outputs_items_cancelled: ${{ steps.process_safe_outputs.outputs.items_cancelled }} | ||
| process_safe_outputs_items_deferred: ${{ steps.process_safe_outputs.outputs.items_deferred }} |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
The approach is correct and well-reasoned: the .poutine.yml skip rule is properly scoped to the activation job with a clear explanation of why the finding is a false positive. Removing the inert poutine:ignore comments from lock files is the right cleanup. No actionable issues found.
🧵 Reviewed using Impeccable skills by Impeccable Skills Reviewer · sonnet46 · 23.7 AIC · ⌖ 9.93 AIC · ⊞ 5.4K
There was a problem hiding this comment.
Skills-Based Review 🧠
Applied /codebase-design — this is a clean, correct fix for a recurring false-positive suppression.
📋 Key Themes & Highlights
Key Themes
- Root cause fixed:
.poutine.ymlskip:is poutine's actual suppression mechanism; the# poutine:ignoreinline comments were inert, and this PR replaces them with a working repo-level rule. - Template kept in sync:
ensurePoutineConfiginpoutine.gomirrors the newskip:entry so freshly bootstrapped repositories get the same suppressions. - Test coverage present:
TestEnsurePoutineConfigasserts both new YAML keys (- rule: untrusted_checkout_exec,job: activation). - Generated lock files cleaned up: All inert comments removed; no spurious diff noise remains.
Positive Highlights
- ✅ Excellent PR description: root cause, verification steps, scope, and follow-up items all documented.
- ✅ Skip rule is correctly scoped to
job: activation, leaving user-authoredagentjob steps fully covered. - ✅ Idempotent
ensurePoutineConfigpreserves existing custom configs.
🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer · sonnet46 · 42.6 AIC · ⌖ 7.83 AIC · ⊞ 7.1K
Comment /matt to run again
🧪 Test Quality Sentinel Report
📊 Metrics (1 test)
|
Poutine reports 10
untrusted_checkout_execfindings insmoke-workflow-call.lock.ymlandsmoke-workflow-call-with-inputs.lock.yml. This finding has been "fixed" and reopened five times (#22608, #22248, #26552, #48717, #51177) by adding# poutine:ignore untrusted_checkout_execcomments to generated lock files — poutine has no inline ignore-comment mechanism, so those comments are inert. Verified against poutine 1.1.6: adding the comment to the one remaining un-annotated step still left all 5 findings in place.Poutine's actual suppression mechanism is the
skip:section of.poutine.yml.Changes
.poutine.yml— added askipentry foruntrusted_checkout_execscoped to the generatedactivationjob. Those steps run helper scripts extracted from the pinned gh-aw action into$RUNNER_TEMP, not from the repository checkout; the rule fires only because the workflow declares an untrusted trigger (workflow_call). User-authored steps run in theagentjob and stay covered by the rule.pkg/cli/poutine.go— mirrored the entry in the template written byensurePoutineConfig, so repositories bootstrapped by gh-aw get it too.pkg/cli/poutine_test.go— extendedTestEnsurePoutineConfigto assert the new template content.pkg/workflow/compiler_yaml_prompt.go— corrected a doc comment that claimed the inline comment suppressed the finding.No lock files change; the inert
# poutine:ignorecomments in generated output were left as-is to avoid a 284-file diff.Repository-wide
poutine analyze_local .goes from 10 → 0untrusted_checkout_execfindings; the remaining previously-accepted findings (github_action_from_unverified_creator_used×9,unpinnable_action,pr_runs_on_self_hosted) are unaffected.The other items in the static-analysis report (serena-mcp-server re-pin, runner-guard inline suppression, actionlint SC2016, shellcheck SC2015) are separate concerns and not addressed here.