fix(workflows): isolate free-text workflow inputs - #3020
Merged
Conversation
stranske
added
agent:codex
|
Bugbot is not enabled for your account, so this pull request was not reviewed. Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs. |
stranske
temporarily deployed
to
agent-standard
August 10, 2026 00:08 — with 
GitHub Actions
Inactive
GitHub Actions
Inactive
Owner
Author
|
Runner dispatch state for autofix on PR #3020. Do not edit. |
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughWorkflow inputs now pass through environment variables instead of direct shell interpolation. The development-version workflow validates repository names. Regression tests scan workflow scripts for unsafe input expressions. The worker attempt record updates its timestamp and pull request number. ChangesWorkflow input safety
Execution record
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
Suggested labels: 🚥 Pre-merge checks | ✅ 2 | ❌ 3❌ Failed checks (3 warnings)
✅ Passed checks (2 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
stranske
temporarily deployed
to
agent-standard
August 10, 2026 00:08 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
Contributor
|
Runner dispatch state for codex on PR #3020. Do not edit. |
Contributor
🤖 Keepalive Loop StatusPR #3020 | Agent: Codex | Iteration 0/12 Current State
Last Codex Run
To retry immediately:
Or wait for the next successful Gate run to automatically retry. 🔍 Failure Classification| Error type | infrastructure |
|
Contributor
Keepalive Work Log (click to expand)
|
stranske
temporarily deployed
to
agent-high-privilege
August 10, 2026 00:09 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
Contributor
|
Autofix updated these files:
|
agents-workflows-bot
Bot
temporarily deployed
to
agent-high-privilege
August 10, 2026 00:10
Inactive
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e43b018f90
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Contributor
There was a problem hiding this comment.
Pull request overview
This PR hardens GitHub Actions workflows by preventing free-form workflow_dispatch inputs from being interpolated directly into run:/with.script: bodies, instead passing them via step-level env: to avoid script text injection / breakage on quotes.
Changes:
- Add a new regression test (
test_no_untrusted_expressions_in_script_bodies) intended to detect unsafe interpolation in workflow script bodies. - Update
maint-70-fix-integration-formatting.ymlto passinputs.commit_messageviaenv(COMMIT_MESSAGE) rather than embedding it in thegit commitcommand. - Update multiple workflows (notably
reusable-codex-run.yml,maint-69-sync-labels.yml,maint-52-sync-dev-versions.yml) to moveinputs.*values into stepenv:variables and reference shell variables in the script.
Reviewed changes
Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| tests/workflows/test_no_untrusted_interpolation.py | Adds a regression guard test for untrusted interpolation inside run: / with.script: bodies. |
| .github/workflows/reusable-codex-run.yml | Moves several inputs.* usages (including codex_args) into step env: variables for safer consumption. |
| .github/workflows/maint-70-fix-integration-formatting.yml | Passes commit_message through env and uses $COMMIT_MESSAGE in the commit step. |
| .github/workflows/maint-69-sync-labels.yml | Passes repos input via env (INPUT_REPOS) instead of interpolating into the shell. |
| .github/workflows/maint-52-sync-dev-versions.yml | Passes repos input via env (INPUT_REPOS) instead of interpolating into the shell. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+21
to
+26
| # Keep this deliberately small. Other expressions require a file-by-file | ||
| # constrained-value review; expanding this set is not a substitute for that | ||
| # review. | ||
| UNTRUSTED_EXPRESSIONS = frozenset( | ||
| {"inputs.commit_message", "inputs.codex_args", "inputs.repos"} | ||
| ) |
Comment on lines
+55
to
+60
| for expression in UNTRUSTED_EXPRESSIONS: | ||
| token = "${{ " + expression + " }}" | ||
| if token in script: | ||
| violations.append( | ||
| f"{workflow.relative_to(ROOT)}:{location}: {token}" | ||
| ) |
agents-workflows-bot
Bot
temporarily deployed
to
agent-high-privilege
August 10, 2026 00:12
Inactive
agents-workflows-bot
Bot
temporarily deployed
to
agent-high-privilege
August 10, 2026 00:15
Inactive
stranske-keepalive
Bot
added
agent:needs-attention
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@tests/workflows/test_no_untrusted_interpolation.py`:
- Around line 113-116: Update
test_untrusted_expression_guard_has_a_concrete_target to call
_untrusted_references for each parameterized expression and assert the expected
result, while retaining the inputs. prefix validation. Use the existing
UNTRUSTED_EXPRESSIONS data so every tracked field, including
inputs.commit_message, is exercised.
- Around line 77-85: Add regression tests in the workflow interpolation test
suite covering github.event.inputs aliases in both property and bracket
reference forms, and exercise every field defined in UNTRUSTED_EXPRESSIONS.
Reuse the existing matcher/test helpers and verify each alias is recognized as
an untrusted reference.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 839f2543-0395-411f-8eb5-2079f7b9ab45
📒 Files selected for processing (2)
langsmith-fleet-worker-attempt.jsontests/workflows/test_no_untrusted_interpolation.py
Add direct _references_untrusted_input coverage and parametrize _untrusted_references checks for every listed free-text input field. Co-authored-by: Cursor <cursoragent@cursor.com>
stranske
removed
needs-human
Owner
Author
Closer evidence — review-thread test coverage (cursor)Head: Changes:
Validation: Post-push: do not merge before this exact head ages 7 minutes; then re-read head, required checks, and active non-outdated review threads. |
stranske
temporarily deployed
to
agent-high-privilege
August 10, 2026 01:39 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
agents-workflows-bot
Bot
temporarily deployed
to
agent-high-privilege
August 10, 2026 01:43
Inactive
agents-workflows-bot
Bot
temporarily deployed
to
agent-high-privilege
August 10, 2026 01:47
Inactive
stranske-keepalive
Bot
added
agent:needs-attention
Owner
Author
|
Closer recovery: removed the unrelated |
Restore langsmith-fleet-worker-attempt.json to main so keepalive timestamp bumps do not reintroduce unrelated scope noise on #3020. Co-authored-by: Cursor <cursoragent@cursor.com>
Owner
Author
|
Closer evidence (cursor lane, 2026-08-10T02:38Z) Keepalive commit
Next: observe 7-minute exact-head window on |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@langsmith-fleet-worker-attempt.json`:
- Line 4: Update the artifact represented by the langsmith-fleet/v1 record to
match the registry contract: replace schema with schema_version, add every
required field, and use the registry-ingested artifact name. Do not limit the
change to renaming emitted_at; alternatively, explicitly define a separate
schema and consumer if this artifact is not intended to conform to
langsmith-fleet/v1.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: d86b1fab-cd64-4b1b-9304-03977ffad7b6
📒 Files selected for processing (1)
langsmith-fleet-worker-attempt.json
| "agent": "codex", | ||
| "cli_version": "0.144.1", | ||
| "emitted_at": "2026-08-09T20:34:22.350896Z", | ||
| "emitted_at": "2026-08-10T02:40:15.408109Z", |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
rg -n -C 4 '\b(emitted_at|recorded_at)\b|langsmith-fleet-worker-attempt|github_pr|pr_number' .Repository: stranske/Workflows
Length of output: 50377
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '%s\n' '== candidate files =='
git ls-files | grep -E '(^|/)(langsmith-fleet-worker-attempt\.json|.*langsmith.*fleet.*|.*fleet.*worker.*|.*observability.*contract.*)$' || true
printf '%s\n' '== exact timestamp references =='
rg -n -C 3 --glob '!*.lock' --glob '!*.min.*' \
'emitted_at|recorded_at|langsmith-fleet/v1|langsmith-fleet-worker-attempt' \
docs .github scripts langsmith-fleet-worker-attempt.json 2>/dev/null || trueRepository: stranske/Workflows
Length of output: 44840
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '%s\n' '== contract schema and validator requirements =='
sed -n '1,125p' docs/contracts/schemas/langsmith-fleet-v1.schema.json
sed -n '35,70p' scripts/langsmith_fleet.py
sed -n '330,355p' scripts/langsmith_fleet.py
sed -n '405,470p' scripts/langsmith_fleet.py
printf '%s\n' '== worker artifact producer and registry =='
sed -n '1135,1190p' .github/workflows/reusable-codex-run.yml
rg -n -C 5 'worker-attempt|langsmith-fleet-v1-worker|artifact_name|reusable-codex-run|agent-automation' config/langsmith_fleet_registry.json .github/workflows/maint-81-langsmith-fleet-conformance.yml tests/scripts tests/workflows
printf '%s\n' '== standalone shape check =='
python3 - <<'PY'
import json
from pathlib import Path
record = json.loads(Path("langsmith-fleet-worker-attempt.json").read_text())
schema = json.loads(Path("docs/contracts/schemas/langsmith-fleet-v1.schema.json").read_text())
required = schema["required"]
properties = schema["properties"]
print("record keys:", sorted(record))
print("schema required:", required)
print("missing required:", [key for key in required if key not in record])
print("unknown keys:", sorted(set(record) - set(properties)))
print("has recorded_at:", "recorded_at" in record)
print("has emitted_at:", "emitted_at" in record)
PYRepository: stranske/Workflows
Length of output: 50374
🏁 Script executed:
#!/bin/bash
set -euo pipefail
python3 - <<'PY'
import json
from pathlib import Path
record = json.loads(Path("langsmith-fleet-worker-attempt.json").read_text())
schema = json.loads(Path("docs/contracts/schemas/langsmith-fleet-v1.schema.json").read_text())
registry = json.loads(Path("config/langsmith_fleet_registry.json").read_text())
required = schema["required"]
missing = [key for key in required if key not in record]
print("declared_schema:", record.get("schema"))
print("declared_schema_version:", record.get("schema_version"))
print("missing_required_fields:", missing)
print("timestamp_fields:", {
key: record.get(key)
for key in ("emitted_at", "recorded_at")
if key in record
})
print("registry_artifact_names_for_workflows:", [
entry["artifact_name"]
for entry in registry["repos"]
if entry["repo"] == "stranske/Workflows"
])
print("uploaded_artifact_name_prefix:", "langsmith-fleet-v1-worker-attempt-")
print("canonical_artifact_name_uploaded_by_worker:", "langsmith-fleet.ndjson" in Path(".github/workflows/reusable-codex-run.yml").read_text())
PYRepository: stranske/Workflows
Length of output: 590
Emit a valid langsmith-fleet/v1 record.
This artifact uses schema instead of schema_version, omits required fields, and is uploaded under a name that the registry does not ingest. Renaming emitted_at alone will not fix the contract mismatch. Align the artifact with the contract, or define a separate schema and consumer.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@langsmith-fleet-worker-attempt.json` at line 4, Update the artifact
represented by the langsmith-fleet/v1 record to match the registry contract:
replace schema with schema_version, add every required field, and use the
registry-ingested artifact name. Do not limit the change to renaming emitted_at;
alternatively, explicitly define a separate schema and consumer if this artifact
is not intended to conform to langsmith-fleet/v1.
4 tasks
Contributor
Provider Comparison ReportProvider Summary
📋 Full Provider Details (click to expand)openai
anthropic
Agreement
Disagreement
Unique Insights
🔍 LangSmith Traces |
7 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #3016
Automated Status Summary
Scope
Scope section missing from source issue.
Context for Agent
Related Issues/PRs
Tasks
maint-70-fix-integration-formatting.yml:124(inputs.commit_message) andreusable-codex-run.yml(inputs.codex_args) — move each to a step-levelenv:entry and reference"$VAR"in the script.maint-69-sync-labels.yml's 3×${{ inputs.repos }}in the "Determine target repos" step the same way..github/workflows/*.ymlinventory: convertrun:/script:interpolations toenv:indirection where free-form; document deliberate exceptions inline where provably constrained (e.g. boolean or number)..github/workflows/and fails on${{ inputs.* }}/${{ github.event.* }}inside arun:/script:block scalar, with an explicit allowlist for reviewed exceptions.Acceptance criteria
tests/workflows/test_no_untrusted_interpolation.py::test_no_untrusted_expressions_in_script_bodies— parses each workflow, walksrun:/script:block scalars, and asserts noinputs./github.event.expression appears except those in an explicit, commented allowlist.git commit -m "${{ inputs.commit_message }}"inmaint-70-fix-integration-formatting.yml→ confirm the named test FAILS → revert.maint-70withcommit_messageset toa"band confirm the step succeeds (today it produces a brokengit commitcommand). Note this dispatch is currently blocked by [P1][ops] All agent issue-automation workflows halt at action_required with zero jobs — agents:auto-pilot is a no-op #3009.Summary by CodeRabbit
Bug Fixes
Tests