From d37f68db73a49d2a2db777f3124f1aafc8ad74a8 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Sun, 23 Aug 2026 01:43:31 +0000 Subject: [PATCH 1/4] Initial plan From f2761750490d01001895b5df8de72a01b5e939ee Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Sun, 23 Aug 2026 01:50:10 +0000 Subject: [PATCH 2/4] Add inline YAML fix example to persist-credentials compile error Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> --- pkg/workflow/imported_steps_validation.go | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/pkg/workflow/imported_steps_validation.go b/pkg/workflow/imported_steps_validation.go index 1677a94c46d..1028e2c7fb7 100644 --- a/pkg/workflow/imported_steps_validation.go +++ b/pkg/workflow/imported_steps_validation.go @@ -92,10 +92,16 @@ func (c *Compiler) validateCheckoutPersistCredentials(frontmatter map[string]any return nil } + const persistCredentialsExample = ` # example (keep your existing "uses:" ref): + - uses: actions/checkout@v4 + with: + persist-credentials: false` + msg := fmt.Sprintf( "actions/checkout step(s) without 'persist-credentials: false' detected in the agent job: %s. "+ "Without this setting the git token is stored in .git/config and leaked to the agent. "+ - "Add 'persist-credentials: false' to the 'with:' block of each checkout step. "+ + "Add 'persist-credentials: false' to the 'with:' block of each checkout step, for example:\n"+ + persistCredentialsExample+"\n"+ "See: https://github.github.com/gh-aw/reference/steps/", strings.Join(offendingStepNames, ", "), ) From 73298fe071e7c99b015a4600e86ded4546551aea Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Sun, 23 Aug 2026 01:59:51 +0000 Subject: [PATCH 3/4] Use current pinned actions/checkout release (v7.0.1) in fix example Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> --- pkg/workflow/imported_steps_validation.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkg/workflow/imported_steps_validation.go b/pkg/workflow/imported_steps_validation.go index 1028e2c7fb7..6470fad9201 100644 --- a/pkg/workflow/imported_steps_validation.go +++ b/pkg/workflow/imported_steps_validation.go @@ -93,7 +93,7 @@ func (c *Compiler) validateCheckoutPersistCredentials(frontmatter map[string]any } const persistCredentialsExample = ` # example (keep your existing "uses:" ref): - - uses: actions/checkout@v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false` From e6e792ec743ea7b7dcb1d8886df4ae8b373c0517 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Sun, 23 Aug 2026 02:12:53 +0000 Subject: [PATCH 4/4] Resolve checkout version via actionpins manager, use version-only ref in example Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> --- pkg/workflow/imported_steps_validation.go | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/pkg/workflow/imported_steps_validation.go b/pkg/workflow/imported_steps_validation.go index 6470fad9201..9de43430003 100644 --- a/pkg/workflow/imported_steps_validation.go +++ b/pkg/workflow/imported_steps_validation.go @@ -30,6 +30,7 @@ import ( "github.com/goccy/go-yaml" + "github.com/github/gh-aw/pkg/actionpins" "github.com/github/gh-aw/pkg/console" "github.com/github/gh-aw/pkg/logger" ) @@ -92,10 +93,15 @@ func (c *Compiler) validateCheckoutPersistCredentials(frontmatter map[string]any return nil } - const persistCredentialsExample = ` # example (keep your existing "uses:" ref): - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + checkoutVersion := "v4" + if pin, ok := actionpins.GetLatestActionPinByRepo("actions/checkout"); ok && pin.Version != "" { + checkoutVersion = pin.Version + } + + persistCredentialsExample := fmt.Sprintf(` # example (keep your existing "uses:" ref): + - uses: actions/checkout@%s with: - persist-credentials: false` + persist-credentials: false`, checkoutVersion) msg := fmt.Sprintf( "actions/checkout step(s) without 'persist-credentials: false' detected in the agent job: %s. "+