From badeff733b88c97cdfd28ff0083842e141389e75 Mon Sep 17 00:00:00 2001
From: Don Petry <36422719+don-petry@users.noreply.github.com>
Date: Sun, 11 Oct 2026 20:58:40 -0500
Subject: [PATCH 1/2] Potential fix for code scanning alert no. 40: Checkout of
 untrusted code in a non-privileged context

Copilot Autofix

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
---
 .github/workflows/dev-lead-reusable.yml | 30 ++++++++++++++++++++++++-
 1 file changed, 29 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/dev-lead-reusable.yml b/.github/workflows/dev-lead-reusable.yml
index ad3aa22fb..13a446e14 100644
--- a/.github/workflows/dev-lead-reusable.yml
+++ b/.github/workflows/dev-lead-reusable.yml
@@ -247,13 +247,41 @@ jobs:
         with:
           token: ${{ secrets.GH_PAT_DON_PETRY || secrets.GH_PAT_WORKFLOWS || github.token }}
 
+      - name: Validate dev-lead ref input
+        shell: bash
+        run: |
+          ref="${{ inputs.agent_ref }}"
+          if [ -z "$ref" ]; then
+            ref="main"
+          fi
+
+          # Block untrusted PR refs and unsafe ref formats.
+          if [[ "$ref" =~ ^refs/pull/ ]]; then
+            echo "::error::inputs.agent_ref must not be a pull-request ref: $ref"
+            exit 1
+          fi
+          if [[ "$ref" =~ ^[0-9a-fA-F]{40}$ ]]; then
+            echo "::error::inputs.agent_ref must not be a raw commit SHA: $ref"
+            exit 1
+          fi
+          if [[ "$ref" == *".."* || "$ref" == *":"* || "$ref" =~ [[:space:]] ]]; then
+            echo "::error::inputs.agent_ref contains unsafe characters: $ref"
+            exit 1
+          fi
+          if [[ ! "$ref" =~ ^[A-Za-z0-9._/-]+$ ]]; then
+            echo "::error::inputs.agent_ref contains invalid characters: $ref"
+            exit 1
+          fi
+
+          echo "SAFE_AGENT_REF=$ref" >> "$GITHUB_ENV"
+
       - name: Checkout dev-lead scripts
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: petry-projects/.github-private
           # Pinned channel (e.g. dev-lead/stable) when a trigger stub passes it;
           # defaults to "main" → unchanged behaviour (#535/#506).
-          ref: ${{ inputs.agent_ref }}
+          ref: ${{ env.SAFE_AGENT_REF }}
           path: .dev-lead
           # Cross-repo callers: github.token cannot read a private org repo — ensure
           # GH_PAT_WORKFLOWS is set as an org or repo secret in the calling repo.

From 12a7ef35e685a1067636a1d674272d2b308e5f3c Mon Sep 17 00:00:00 2001
From: don-petry <36422719+don-petry@users.noreply.github.com>
Date: Mon, 12 Oct 2026 02:01:59 +0000
Subject: [PATCH 2/2] fix(reviews): pass inputs.agent_ref via env instead of
 interpolating into run script

---
 .github/workflows/dev-lead-reusable.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/dev-lead-reusable.yml b/.github/workflows/dev-lead-reusable.yml
index 13a446e14..4634b12df 100644
--- a/.github/workflows/dev-lead-reusable.yml
+++ b/.github/workflows/dev-lead-reusable.yml
@@ -249,8 +249,10 @@ jobs:
 
       - name: Validate dev-lead ref input
         shell: bash
+        env:
+          AGENT_REF: ${{ inputs.agent_ref }}
         run: |
-          ref="${{ inputs.agent_ref }}"
+          ref="$AGENT_REF"
           if [ -z "$ref" ]; then
             ref="main"
           fi