From 0dd8aaed0dd8c0fec7f5fc3635a66d35eeb0f1d5 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Fri, 28 Aug 2026 20:47:46 +0000 Subject: [PATCH 01/11] Initial plan From fb1fc908ca2c90b934dc36361684684029e11e8d Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Fri, 28 Aug 2026 20:57:16 +0000 Subject: [PATCH 02/11] Fix stale domain integration test expectations Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> --- .../allowed_domains_sanitization_test.go | 62 ++++--------------- .../domains_protocol_integration_test.go | 1 - 2 files changed, 11 insertions(+), 52 deletions(-) diff --git a/pkg/workflow/allowed_domains_sanitization_test.go b/pkg/workflow/allowed_domains_sanitization_test.go index 63272ff3ee3..4cf1db954bb 100644 --- a/pkg/workflow/allowed_domains_sanitization_test.go +++ b/pkg/workflow/allowed_domains_sanitization_test.go @@ -64,10 +64,6 @@ Test workflow with network permissions. expectedDomains: []string{ "example.com", "test.org", - // Copilot defaults should also be included - "api.github.com", - "github.com", - "raw.githubusercontent.com", }, unexpectedDomain: "registry.npmjs.org", }, @@ -96,12 +92,7 @@ Test workflow with network permissions. expectedDomains: []string{ "example.com", "test.org", - // Claude now has its own default domains with AWF support - "api.github.com", - "anthropic.com", - "api.anthropic.com", }, - // No unexpected domains - Claude has its own defaults unexpectedDomain: "", }, { @@ -122,14 +113,7 @@ safe-outputs: Test workflow with defaults network. `, - expectedDomains: []string{ - // Should have Copilot defaults - "api.github.com", - "github.com", - "raw.githubusercontent.com", - // Note: network: defaults for Copilot doesn't expand ecosystem domains - // in GetCopilotAllowedDomains - it only merges when network.allowed has values - }, + expectedDomains: []string{}, unexpectedDomain: "", }, { @@ -149,13 +133,7 @@ safe-outputs: Test workflow without network config. `, - expectedDomains: []string{ - // Should have Copilot defaults - "api.github.com", - "github.com", - "raw.githubusercontent.com", - // Note: nil network for Copilot only returns Copilot defaults - }, + expectedDomains: []string{}, unexpectedDomain: "", }, { @@ -319,7 +297,6 @@ Test that empty allowed-domains falls back to network config. `, expectedDomains: []string{ "example.com", - "api.github.com", // Copilot default }, unexpectedDomain: "", }, @@ -406,8 +383,6 @@ func TestComputeAllowedDomainsForSanitization(t *testing.T) { expectedDomains: []string{ "example.com", "test.org", - "api.github.com", // Copilot default - "github.com", // Copilot default }, }, { @@ -422,25 +397,16 @@ func TestComputeAllowedDomainsForSanitization(t *testing.T) { }, }, { - name: "Copilot with nil network", - engineID: "copilot", - networkPerms: nil, - expectedDomains: []string{ - "api.github.com", // Copilot default - "github.com", // Copilot default - "raw.githubusercontent.com", // Copilot default - // Note: When network is nil, GetCopilotAllowedDomains only returns Copilot defaults - // It does NOT include ecosystem defaults - }, + name: "Copilot with nil network", + engineID: "copilot", + networkPerms: nil, + expectedDomains: []string{}, }, { - name: "Claude with nil network", - engineID: "claude", - networkPerms: nil, - expectedDomains: []string{ - "json-schema.org", // ecosystem default - "archive.ubuntu.com", // ecosystem default - }, + name: "Claude with nil network", + engineID: "claude", + networkPerms: nil, + expectedDomains: []string{}, }, { name: "Codex with custom domains", @@ -460,8 +426,6 @@ func TestComputeAllowedDomainsForSanitization(t *testing.T) { expectedDomains: []string{ "api.acme.ghe.com", // GHES API domain "acme.ghe.com", // GHES base domain (derived from api-target) - "api.github.com", // Copilot default - "github.com", // Copilot default }, }, { @@ -548,8 +512,6 @@ Test workflow with GHES api-target. expectedDomains: []string{ "api.acme.ghe.com", // GHES API domain "acme.ghe.com", // GHES base domain derived from api-target - "api.github.com", // Copilot default - "github.com", // Copilot default }, }, { @@ -963,7 +925,7 @@ func TestAllowedDomainsUnionWithNetworkConfig(t *testing.T) { expectedDomains []string }{ { - name: "allowed-domains unioned with Copilot defaults and network config", + name: "allowed-domains unioned with network config", workflow: `--- on: push permissions: @@ -987,7 +949,6 @@ Test allowed-domains union with network config. expectedDomains: []string{ "extra-domain.com", // from allowed-domains "example.com", // from network.allowed - "api.github.com", // Copilot default "localhost", // always included "github.com", // always included }, @@ -1045,7 +1006,6 @@ Test that allowed-domains does not override network config. expectedDomains: []string{ "url-domain.com", // from allowed-domains "network-domain.com", // from network.allowed - still present (union) - "api.github.com", // Copilot default "localhost", // always included }, }, diff --git a/pkg/workflow/domains_protocol_integration_test.go b/pkg/workflow/domains_protocol_integration_test.go index 178854d9ce0..15a9d16162b 100644 --- a/pkg/workflow/domains_protocol_integration_test.go +++ b/pkg/workflow/domains_protocol_integration_test.go @@ -42,7 +42,6 @@ Test protocol-specific domain filtering. "https://secure.example.com", "http://legacy.example.com", "example.org", - "api.github.com", // Copilot default }, checkAWFArgs: true, }, From b9345b02574625f81a97198a83986bb6729704bc Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Fri, 28 Aug 2026 21:00:50 +0000 Subject: [PATCH 03/11] Fix remaining network defaults integration assertion Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> --- pkg/workflow/security_regression_test.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkg/workflow/security_regression_test.go b/pkg/workflow/security_regression_test.go index caac5a80c51..b8f70dfaa04 100644 --- a/pkg/workflow/security_regression_test.go +++ b/pkg/workflow/security_regression_test.go @@ -584,8 +584,8 @@ network: defaults # Defaults Test Test network defaults.`, - expectedDomains: []string{"api.github.com", "github.com"}, - description: "Default domains should be applied for copilot", + expectedDomains: []string{"json-schema.org", "archive.ubuntu.com"}, + description: "Default network domains should be applied", }, } From a51a0a87a32898a705ecfd876a5201cb62c39349 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Fri, 28 Aug 2026 22:47:20 +0000 Subject: [PATCH 04/11] Strengthen allowed domain test coverage Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com> --- pkg/workflow/allowed_domains_sanitization_test.go | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/pkg/workflow/allowed_domains_sanitization_test.go b/pkg/workflow/allowed_domains_sanitization_test.go index 4cf1db954bb..439237b6b3d 100644 --- a/pkg/workflow/allowed_domains_sanitization_test.go +++ b/pkg/workflow/allowed_domains_sanitization_test.go @@ -113,8 +113,8 @@ safe-outputs: Test workflow with defaults network. `, - expectedDomains: []string{}, - unexpectedDomain: "", + expectedDomains: []string{"json-schema.org", "archive.ubuntu.com"}, + unexpectedDomain: "api.githubcopilot.com", }, { name: "Copilot without network config", @@ -134,7 +134,7 @@ safe-outputs: Test workflow without network config. `, expectedDomains: []string{}, - unexpectedDomain: "", + unexpectedDomain: "api.githubcopilot.com", }, { name: "Claude with ecosystem identifier", @@ -373,6 +373,7 @@ func TestComputeAllowedDomainsForSanitization(t *testing.T) { networkPerms *NetworkPermissions expectedDomains []string unexpectedDomains []string + expectedEmpty bool }{ { name: "Copilot with custom domains", @@ -401,12 +402,14 @@ func TestComputeAllowedDomainsForSanitization(t *testing.T) { engineID: "copilot", networkPerms: nil, expectedDomains: []string{}, + expectedEmpty: true, }, { name: "Claude with nil network", engineID: "claude", networkPerms: nil, expectedDomains: []string{}, + expectedEmpty: true, }, { name: "Codex with custom domains", @@ -457,6 +460,9 @@ func TestComputeAllowedDomainsForSanitization(t *testing.T) { // Call the function domainsStr, err := compiler.computeAllowedDomainsForSanitization(data) require.NoError(t, err, "computeAllowedDomainsForSanitization should not return an error for valid test data") + if tt.expectedEmpty { + require.Empty(t, domainsStr, "expected no domains without network configuration") + } // Verify expected domains are present (substring match is fine here since domain names // in a CSV string that are exact entries won't appear as substrings of other entries From 1d4bec08bf4847f925386621e92b86a61b1bb463 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Fri, 28 Aug 2026 22:56:52 +0000 Subject: [PATCH 05/11] Complete allowed domain assertions Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com> --- pkg/workflow/allowed_domains_sanitization_test.go | 1 + 1 file changed, 1 insertion(+) diff --git a/pkg/workflow/allowed_domains_sanitization_test.go b/pkg/workflow/allowed_domains_sanitization_test.go index 439237b6b3d..e5087e1db9b 100644 --- a/pkg/workflow/allowed_domains_sanitization_test.go +++ b/pkg/workflow/allowed_domains_sanitization_test.go @@ -462,6 +462,7 @@ func TestComputeAllowedDomainsForSanitization(t *testing.T) { require.NoError(t, err, "computeAllowedDomainsForSanitization should not return an error for valid test data") if tt.expectedEmpty { require.Empty(t, domainsStr, "expected no domains without network configuration") + return } // Verify expected domains are present (substring match is fine here since domain names From 004fbd8d42c920d6241bd88fa3f828714c6b4170 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Fri, 28 Aug 2026 22:59:21 +0000 Subject: [PATCH 06/11] Simplify allowed domain empty assertions Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com> --- pkg/workflow/allowed_domains_sanitization_test.go | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/pkg/workflow/allowed_domains_sanitization_test.go b/pkg/workflow/allowed_domains_sanitization_test.go index e5087e1db9b..a1773969aaf 100644 --- a/pkg/workflow/allowed_domains_sanitization_test.go +++ b/pkg/workflow/allowed_domains_sanitization_test.go @@ -373,7 +373,6 @@ func TestComputeAllowedDomainsForSanitization(t *testing.T) { networkPerms *NetworkPermissions expectedDomains []string unexpectedDomains []string - expectedEmpty bool }{ { name: "Copilot with custom domains", @@ -402,14 +401,12 @@ func TestComputeAllowedDomainsForSanitization(t *testing.T) { engineID: "copilot", networkPerms: nil, expectedDomains: []string{}, - expectedEmpty: true, }, { name: "Claude with nil network", engineID: "claude", networkPerms: nil, expectedDomains: []string{}, - expectedEmpty: true, }, { name: "Codex with custom domains", @@ -460,7 +457,7 @@ func TestComputeAllowedDomainsForSanitization(t *testing.T) { // Call the function domainsStr, err := compiler.computeAllowedDomainsForSanitization(data) require.NoError(t, err, "computeAllowedDomainsForSanitization should not return an error for valid test data") - if tt.expectedEmpty { + if len(tt.expectedDomains) == 0 { require.Empty(t, domainsStr, "expected no domains without network configuration") return } From da309d27894a341d639dcb027972fc4edcca6072 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Fri, 28 Aug 2026 23:01:34 +0000 Subject: [PATCH 07/11] Retain allowed domain negative assertion Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com> --- pkg/workflow/allowed_domains_sanitization_test.go | 1 - 1 file changed, 1 deletion(-) diff --git a/pkg/workflow/allowed_domains_sanitization_test.go b/pkg/workflow/allowed_domains_sanitization_test.go index a1773969aaf..dd260c3770c 100644 --- a/pkg/workflow/allowed_domains_sanitization_test.go +++ b/pkg/workflow/allowed_domains_sanitization_test.go @@ -459,7 +459,6 @@ func TestComputeAllowedDomainsForSanitization(t *testing.T) { require.NoError(t, err, "computeAllowedDomainsForSanitization should not return an error for valid test data") if len(tt.expectedDomains) == 0 { require.Empty(t, domainsStr, "expected no domains without network configuration") - return } // Verify expected domains are present (substring match is fine here since domain names From 45d0e5c5d80d16f4d0c8fa18dd6448aa9cdcb31d Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Sat, 29 Aug 2026 06:47:58 +0000 Subject: [PATCH 08/11] Clarify manifest path validation Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com> --- docs/src/assets/diagrams/architecture-2026-08-29.svg | 1 - pkg/cli/add_package_manifest_includes.go | 2 +- 2 files changed, 1 insertion(+), 2 deletions(-) diff --git a/docs/src/assets/diagrams/architecture-2026-08-29.svg b/docs/src/assets/diagrams/architecture-2026-08-29.svg index 420523a2380..28bea1e9e14 100644 --- a/docs/src/assets/diagrams/architecture-2026-08-29.svg +++ b/docs/src/assets/diagrams/architecture-2026-08-29.svg @@ -54,7 +54,6 @@ create_pull_request - diff --git a/pkg/cli/add_package_manifest_includes.go b/pkg/cli/add_package_manifest_includes.go index 79e11bc69fa..b44599ce962 100644 --- a/pkg/cli/add_package_manifest_includes.go +++ b/pkg/cli/add_package_manifest_includes.go @@ -143,7 +143,7 @@ func parseManifestIncludeMapping(mapping map[string]any, manifestPath string) (r // paths that escape their root. func cleanManifestRelativePath(p string) (string, error) { slashed := filepath.ToSlash(p) - if slashed != "" && (slashed[0] == '/' || slashed[0] == '\\') || filepath.IsAbs(p) || isWindowsDriveRelativePath(slashed) { + if slashed != "" && ((slashed[0] == '/' || slashed[0] == '\\') || filepath.IsAbs(p) || isWindowsDriveRelativePath(slashed)) { return "", errors.New("absolute paths are not allowed") } cleaned := path.Clean(slashed) From d30d7842f9931e1f6be1e482066135fcda4d72c0 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Sat, 29 Aug 2026 06:49:31 +0000 Subject: [PATCH 09/11] Fix safe output diagram arrows Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com> --- docs/src/assets/diagrams/architecture-2026-08-29.svg | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/src/assets/diagrams/architecture-2026-08-29.svg b/docs/src/assets/diagrams/architecture-2026-08-29.svg index 28bea1e9e14..435ce2e123a 100644 --- a/docs/src/assets/diagrams/architecture-2026-08-29.svg +++ b/docs/src/assets/diagrams/architecture-2026-08-29.svg @@ -56,10 +56,10 @@ create_pull_request - - - - + + + + From 582f92983c1cf079a005c019297a99bbb7c4af4d Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Sat, 29 Aug 2026 06:50:56 +0000 Subject: [PATCH 10/11] Adjust safe output API connector Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com> --- docs/src/assets/diagrams/architecture-2026-08-29.svg | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/src/assets/diagrams/architecture-2026-08-29.svg b/docs/src/assets/diagrams/architecture-2026-08-29.svg index 435ce2e123a..1b9294f0891 100644 --- a/docs/src/assets/diagrams/architecture-2026-08-29.svg +++ b/docs/src/assets/diagrams/architecture-2026-08-29.svg @@ -66,6 +66,6 @@ GitHub API - + From 925b9a3525356ddacc2ef608316ba1b2488682b0 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Sat, 29 Aug 2026 06:52:35 +0000 Subject: [PATCH 11/11] Restore eval guidance checklist Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com> --- .github/aw/evals.md | 2 ++ docs/src/assets/diagrams/architecture-2026-08-29.svg | 2 +- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/aw/evals.md b/.github/aw/evals.md index 59d1a06ae9e..3d1e0b63a93 100644 --- a/.github/aw/evals.md +++ b/.github/aw/evals.md @@ -126,6 +126,8 @@ Do not combine mutually exclusive scenarios into one question list. If a questio ### Good question checklist +- ✅ Answerable from the agent output alone — no external calls needed. +- ✅ Exactly one binary claim per question. - ✅ Uses YES = success convention consistently. - ✅ Avoids subjective terms ("good", "well-written") unless the question explicitly bounds them ("according to the coding style guide"). diff --git a/docs/src/assets/diagrams/architecture-2026-08-29.svg b/docs/src/assets/diagrams/architecture-2026-08-29.svg index 1b9294f0891..2e36fc8141a 100644 --- a/docs/src/assets/diagrams/architecture-2026-08-29.svg +++ b/docs/src/assets/diagrams/architecture-2026-08-29.svg @@ -66,6 +66,6 @@ GitHub API - +