Pin threat-detect artifacts to independent SHA-256 digests

[Copilot]

The installer previously verified threat-detect against a checksum downloaded from the same release, coupling the artifact and trust source.

• Independent verification

  • Embed SHA-256 digests for v0.5.1 Linux amd64 and arm64 artifacts in the immutable setup action.
  • Select the expected digest using the detected architecture.
  • Stop downloading release-hosted checksums.txt.

• Fail-closed behavior

  • Reject unsupported versions without explicit valid digests before downloading.
  • Reject digest mismatches before installation.
  • Preserve existing compiled workflow invocations for the pinned version.

• Custom artifact verification

  • Allow callers to supply independently managed digests:

install_threat_detect_binary.sh v1.0.0 \
  --sha256-amd64 "$AMD64_SHA256" \
  --sha256-arm64 "$ARM64_SHA256"

• Documentation
  • Document the independent, architecture-specific verification model.

• Fixes Support independently pinned threat-detect artifacts #57792

---

pr-sous-chef https://github.com/github/gh-aw/actions/runs/33831313247

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 40.5 AIC · ⌖ 8.81 AIC · ⊞ 8.9K · ◷
_{Comment /souschef to run again}

---

pr-sous-chef https://github.com/github/gh-aw/actions/runs/33834943677

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• github.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "github.com"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 41.7 AIC · ⌖ 8.84 AIC · ⊞ 8.9K · ◷
_{Comment /souschef to run again}

---

pr-sous-chef https://github.com/github/gh-aw/actions/runs/33865510093

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

• github.com
• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "github.com"
    - "registry.npmjs.org"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 18.6 AIC · ⌖ 8.56 AIC · ⊞ 8.7K · ◷
_{Comment /souschef to run again}

---

Run: https://github.com/github/gh-aw/actions/runs/33875422710

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

• github.com
• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "github.com"
    - "registry.npmjs.org"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 18.9 AIC · ⌖ 8.77 AIC · ⊞ 8.7K · ◷
_{Comment /souschef to run again}

---

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 54.6 AIC · ⌖ 9.63 AIC · ⊞ 9.2K · ◷
_{Comment /souschef to run again}

---

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• github.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "github.com"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 69.5 AIC · ⌖ 8.75 AIC · ⊞ 8.9K · ◷
_{Comment /souschef to run again}

[Copilot]

Copilot wasn't able to review any files in this pull request.

[pelikhan]

@copilot fix https://github.com/github/gh-aw/actions/runs/33809941495/job/100840175260?pr=58310

[Copilot]

@copilot fix https://github.com/github/gh-aw/actions/runs/33809941495/job/100840175260?pr=58310

Fixed in b38c832. The Dependabot manifest tests now use a deterministic local failing npm stub instead of contacting the registry; the focused tests passed 10 consecutive runs and the final impacted Go tests passed.

[gh-aw-bot]

@copilot The last maintainer request points at a failing unit-test job, and your follow-up says the root cause was fixed on a newer head.

Please refresh the branch state if needed, re-run the pr-finisher skill on the current head, and summarize in maintainer-facing terms:

• the exact root cause you fixed,
• the concrete validation you ran on HEAD, and
• whether any blocker remains beyond CI re-running on the updated commit.

Failed check to reconcile:

• Unit tests (D-G): https://github.com/github/gh-aw/actions/runs/33809941495/job/100840175260

Generated by 👨🍳 PR Sous Chef

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 32.7 AIC · ⌖ 9.85 AIC · ⊞ 9.2K · ◷
_{Comment /souschef to run again}

[Copilot]

@copilot The last maintainer request points at a failing unit-test job, and your follow-up says the root cause was fixed on a newer head.

Please refresh the branch state if needed, re-run the `pr-fin...

Current head is b3edf93; no refresh was needed. Root cause: TestGenerateDependabotManifests_WithDependencies invoked the real npm registry, leaving npm install blocked until the package-wide 3-minute timeout. The fix uses a deterministic local failing npm stub for both non-strict and strict paths.

Validated on HEAD: make lint, make test-unit, full make test, 12 installer tests, and the two Dependabot tests for 10 consecutive runs; all passed. The working tree is clean, there are no review threads or merge conflicts, and no code blocker remains. Current-head CI is action_required, so checks still need maintainer approval/re-run on b3edf93.

[pelikhan]

@copilot merge main and recompile

[Copilot]

@copilot merge main and recompile

Completed in merge commit 30352e2. Its second parent is current origin/main (0d11aae). Recompiled all 298 workflows successfully; no lock-file changes were needed. Final make agent-report-progress passed, workflow locks are in sync, and the working tree is clean.

[github-actions]

Category: bug | Risk: high | Score: 73 (impact 38 urgency 20 quality 15) | Action: fast_track | Batch: workflow-reliability

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• api.github.com

[!TIP]
api.github.com is blocked because GitHub API access uses the built-in GitHub tools by default. Instead of adding api.github.com to network.allowed, use tools.github.mode: gh-proxy for direct pre-authenticated GitHub CLI access without requiring network access to api.github.com:

tools:
  github:
    mode: gh-proxy

See GitHub Tools for more information on gh-proxy mode.

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.github.com"

See Network Configuration for more information.

Generated by 🔧 PR Triage Agent · copilot · mai10 · 25.2 AIC · ⌖ 2.93 AIC · ⊞ 15.1K · ◷

[gh-aw-bot]

pr-sous-chef

@copilot The branch state on this PR appears code-complete, but it is still stuck behind waiting/action-required workflow handling.

• Please reconcile the current waiting/action-required runs on HEAD with the current branch state.
• If no code changes are needed and the remaining blocker is only maintainer workflow approval / CI re-trigger plus mergeability refresh, say that explicitly.
• After that, run the pr-finisher skill and provide a concise maintainer-facing status handoff.

Generated by PR Sous Chef: https://github.com/github/gh-aw/actions/runs/33908460692

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 33.4 AIC · ⌖ 8.81 AIC · ⊞ 9.2K · ◷
_{Comment /souschef to run again}

[Copilot]

pr-sous-chef
```...

Reconciled the current state on HEAD 25edcb8. The branch is clean and current with main; the latest addressing-comment run is in progress, while the prior CGO/Docs and smoke runs are action_required (maintainer approval/handling), not code failures. The deterministic npm-stub fix and workflow-lock refresh are already present. No code changes are needed; remaining work is maintainer CI approval/re-trigger and GitHub mergeability refresh.

[gh-aw-bot]

pr-sous-chef

@copilot Please take the next forward-progress pass on this PR.

• Review the latest branch state, outstanding feedback, and any failing checks on current HEAD.
• Refresh the branch if needed, then run the pr-finisher skill and provide a concise maintainer-facing status handoff.
• If no code changes are needed and the remaining blocker is only maintainer approval, stale review state, or routine CI handling, say that explicitly.

Generated by PR Sous Chef: https://github.com/github/gh-aw/actions/runs/33920455377

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 24.6 AIC · ⌖ 8.73 AIC · ⊞ 9.2K · ◷
_{Comment /souschef to run again}

[Copilot]

pr-sous-chef
```...

Completed the finisher pass on current HEAD 25edcb8. The branch is clean, current with main, and no source changes are needed. The latest addressing-comment workflow is still in progress; prior addressing-comment runs succeeded, while CI workflows remain subject to maintainer handling. No code-side blocker remains. Remaining handoff: maintainer approval/re-trigger of CI and GitHub mergeability refresh.

[github-actions]

Category: bug | Risk: high | Score: 78 | Breakdown: impact 40/urgency 24/quality 14 | Action: fast_track | Batch: workflow-reliability

Generated by 🔧 PR Triage Agent · copilot · mai10 · 24 AIC · ⌖ 2.63 AIC · ⊞ 15.1K · ◷

[gh-aw-bot]

pr-sous-chef

@copilot Please take the next forward-progress pass on this PR.

• Current head appears code-complete, but this PR is still waiting on a maintainer-facing closeout of the latest branch/check state.
• Please reconcile the current workflow/check status on HEAD, run the pr-finisher skill again, and restate clearly whether the only remaining blocker is maintainer approval / routine CI handling.
• If no code changes are needed, say that explicitly in maintainer-facing terms.

Generated by PR Sous Chef: https://github.com/github/gh-aw/actions/runs/33940432105

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• github.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "github.com"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 69.5 AIC · ⌖ 8.75 AIC · ⊞ 8.9K · ◷
_{Comment /souschef to run again}

[Copilot]

pr-sous-chef
```...

Completed the finisher pass on current HEAD ea3140d. The branch is clean and includes the latest main merge; the PR’s three source files remain unchanged and no code changes are needed. Current Docs/CGO workflows are action_required, while the latest addressing-comment workflow is still in progress. No code-side blocker remains; the remaining handoff is maintainer CI approval/re-trigger and mergeability refresh.

[gh-aw-bot]

pr-sous-chef

@copilot Current HEAD ea3140d still appears code-complete, but this PR remains stuck behind waiting/action-required workflow handling.

• Please reconcile the current waiting/action-required Docs/CGO runs on this HEAD with the branch state.
• If no code changes are needed and the remaining blocker is only maintainer workflow approval / CI re-trigger plus mergeability refresh, say that explicitly.
• After that, run the pr-finisher skill and provide a concise maintainer-facing status handoff.

Generated by PR Sous Chef: https://github.com/github/gh-aw/actions/runs/33944404705

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 25.4 AIC · ⌖ 9.6 AIC · ⊞ 9K · ◷
_{Comment /souschef to run again}

[Copilot]

pr-sous-chef
```...

Reconciled HEAD ea3140d: the branch is clean and current with main; Docs and CGO runs on this HEAD are action_required, and the latest addressing-comment run is in progress. The prior addressing run succeeded, with no code failure indicated. No code changes are needed. Remaining handoff is maintainer workflow approval/re-trigger and GitHub mergeability refresh.