Enforce secure process execution in CI (#390)

* Enforce secure process execution

- add a dependency-free, fail-closed child_process analyzer\n- cover safe and unsafe syntax with deterministic fixtures\n- run the audit for every pull request with telemetry disabled\n- migrate removable process probes to fixed executable argv calls\n\nCo-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* Remove obsolete process audit exception

- remove the Playwright shell:true exception after the hardened launcher landed\n- require repository and CLI audits to report zero exceptions\n- retain exact exception schema and stale-drift coverage\n\nCo-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>\nCopilot-Session: f349adcb-b52e-4060-95aa-b0f4e13841ac

Author: priyanshu92

.github/workflows/validate-repository-metadata.yml

@@ -2,14 +2,14 @@ name: validate-repository-metadata
 
 on:
     pull_request:
-        branches:
-            - main
     workflow_dispatch:
 
 jobs:
     validate-repository-metadata:
         name: validate-repository-metadata
         runs-on: ubuntu-latest
+        env:
+            POWER_PLATFORM_SKILLS_TELEMETRY_POWER_PAGES_OPTOUT: "1"
         steps:
             - name: checkout
               uses: actions/checkout@v4
@@ -30,3 +30,9 @@ jobs:
 
             - name: validate-telemetry-ikeys
               run: node scripts/validate-telemetry-ikeys.js
+
+            - name: test-secure-process-execution-validator
+              run: node --test scripts/tests/validate-secure-process-execution.test.js
+
+            - name: validate-secure-process-execution
+              run: node scripts/validate-secure-process-execution.js

plugins/power-pages/AGENTS.md

@@ -4,7 +4,7 @@
 // Returns a Playwright channel name ('msedge', 'chrome', 'chromium').
 // Used by the Playwright MCP launcher and the axe-core audit script.
 
-const { execSync } = require('child_process');
+const { execFileSync } = require('child_process');
 const fs = require('fs');
 const path = require('path');
 const os = require('os');
@@ -15,7 +15,9 @@ function exists(filePath) {
 
 function whichExists(cmd) {
   try {
-    execSync(`which ${cmd}`, { stdio: 'ignore' });
+    // This helper only runs in the Linux branch below. Pass the fixed utility and
+    // candidate name separately so a future candidate cannot become shell syntax.
+    execFileSync('which', [cmd], { stdio: 'ignore', shell: false });
     return true;
   } catch {
     return false;

plugins/power-pages/scripts/lib/detect-browser.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 
-const { execSync } = require('child_process');
+const { execFileSync } = require('child_process');
 
 if (process.argv.includes('--help')) {
   process.stdout.write(`check-tools.js — Detects whether opengrep and trivy are installed.
@@ -23,19 +23,34 @@ Output (stdout, JSON):
   process.exit(0);
 }
 
-function probe(cmd, parseVersion) {
+function probe(runVersion, parseVersion) {
   try {
-    // 60s timeout — first invocation can be slow (cold start, antivirus scan, etc.)
-    const out = execSync(cmd, { encoding: 'utf8', timeout: 60000, stdio: ['ignore', 'pipe', 'pipe'] });
+    const out = runVersion();
     return { available: true, version: parseVersion(out), error: null };
   } catch (err) {
     return { available: false, version: null, error: (err.stderr || err.message || '').toString().trim() };
   }
 }
 
+// Keep executable names at the child_process call sites. Passing an executable
+// into probe() would make future CLI/env-derived values indistinguishable from
+// this fixed two-tool allowlist to the repository security validator.
+const runOpenGrepVersion = () => execFileSync('opengrep', ['--version'], {
+  encoding: 'utf8',
+  timeout: 60000,
+  stdio: ['ignore', 'pipe', 'pipe'],
+  shell: false,
+});
+const runTrivyVersion = () => execFileSync('trivy', ['--version'], {
+  encoding: 'utf8',
+  timeout: 60000,
+  stdio: ['ignore', 'pipe', 'pipe'],
+  shell: false,
+});
+
 const result = {
-  opengrep: probe('opengrep --version', (out) => (out.match(/[\d.]+/) || [null])[0]),
-  trivy: probe('trivy --version', (out) => {
+  opengrep: probe(runOpenGrepVersion, (out) => (out.match(/[\d.]+/) || [null])[0]),
+  trivy: probe(runTrivyVersion, (out) => {
     const m = out.match(/Version:\s*([\d.]+)/i) || out.match(/[\d.]+/);
     return m ? m[1] || m[0] : null;
   }),

plugins/power-pages/skills/scan-code/scripts/check-tools.js

@@ -0,0 +1,9 @@
+'use strict';
+
+const { spawn } = require('child_process');
+
+function launch(options) {
+  spawn('tool', [process.env.INPUT], options);
+}
+
+module.exports = { launch };

scripts/tests/fixtures/secure-process-execution/fail/ambiguous-options.js

@@ -0,0 +1,3 @@
+'use strict';
+
+require('child_process')['exec'](process.env.COMMAND);

scripts/tests/fixtures/secure-process-execution/fail/computed-direct-require.js

@@ -0,0 +1,6 @@
+'use strict';
+
+const childProcess = require('child_process');
+const method = process.env.METHOD;
+
+childProcess[method]('tool', []);

scripts/tests/fixtures/secure-process-execution/fail/computed-member.js

@@ -0,0 +1,3 @@
+import { exec as run } from 'child_process';
+
+run('pac pages upload --path ' + process.argv[2]);

scripts/tests/fixtures/secure-process-execution/fail/concatenated-command.js

@@ -0,0 +1,3 @@
+import childProcess from 'node:child_process';
+
+childProcess.exec(process.env.COMMAND);

scripts/tests/fixtures/secure-process-execution/fail/default-esm-import.mjs

@@ -0,0 +1,3 @@
+'use strict';
+
+require('node:child_process').exec('tool ' + process.argv[2]);