Add regression coverage for pip argv validation before exec

[Copilot]

Sighthound flagged low-confidence command-injection findings around exec.Command(..., args...) in workflow/package validation paths. This change narrows triage risk by adding explicit regression coverage for the pip validation exec boundary: invalid option-like package input must be rejected pre-exec, while valid packages must preserve expected argv shape.

• Validation boundary coverage (pip path)

  • Added a test that passes --index-url as a package and asserts no pip process invocation occurs.
  • This guards the exact concern in validatePythonPackagesWithPip where package names are transformed into CLI args.

• Expected argv contract for valid input

  • Added a test that passes requests and asserts the forwarded argv is exactly:
    • index
    • versions
    • requests
    • --pre
  • This makes argument construction behavior explicit and reviewable for future changes.

• Scope

  • Test-only update in pkg/workflow/argument_injection_test.go; no production logic change.

compiler.validatePythonPackagesWithPip([]string{"--index-url"}, "pip", fakePip)
// assert args file does not exist (invalid package rejected before exec)

compiler.validatePythonPackagesWithPip([]string{"requests"}, "pip", fakePip)
// assert argv == []string{"index", "versions", "requests", "--pre"}

• Fixes [sighthound] Security findings in github/gh-aw #54160

[Copilot]

Pull request overview

Adds regression tests for pip argument validation at the process-execution boundary.

Changes:

• Verifies invalid option-like package names never reach pip.
• Verifies valid packages preserve the expected pip argv.

Show a summary per file

File	Description
pkg/workflow/argument_injection_test.go	Adds fake-pip execution boundary tests.

Review details

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 1/1 changed files
• Comments generated: 0
• Review effort level: Balanced

[github-actions]

🎉 This pull request is included in a new release.

Release: v0.87.2