Repository navigation
fix(devcontainer): use pinned Go image to avoid remote version lookup - #62
Merged
Merged
Conversation
… registry Change the References in the two ActionsLockAware query help files from gh.io/actions-lockfile, which redirects to a private early-access repo and 404s for the public, to the public GitHub Docs lockfile pages. Regenerate the corpus SARIF fixtures to pick up the new help. Set the e2e harness .npmrc to registry.npmjs.org, and regenerate package-lock.json against it so npm ci stops fetching from an internal feed. Add .gitattributes to mark the corpus fixture SARIFs linguist-generated.
data-douser
added
bug
Copilot stopped reviewing on behalf of
data-douser due to an error
October 16, 2026 18:33
Copilot stopped reviewing on behalf of
data-douser due to an error
October 16, 2026 18:33
There was a problem hiding this comment.
Note
Copilot was unable to run its full agentic suite in this review.
Copilot review overview
1 open finding
What changed in this PR
Adds a “remote-source eligibility” policy gate to prevent ABOM from downloading remote content (source, SARIF, databases, etc.) unless the repository is public or within declared ownership and (where applicable) has sufficient Code Scanning/Code Security evidence, plus refresh hooks for retries and setup events.
Changes:
- Introduces
internal/sourcepolicywith caching, warnings vs refusals, and invalidation/refresh behavior. - Wires the policy into Git fetch, GitHub API reads for downloadable content, server retry endpoints, and setup event processing; adds/updates tests to cover refusals, retries, and concurrency.
- Regenerates corpus SARIF fixtures/help links, pins devcontainer Go provisioning, and standardizes npm registry for e2e lockfile stability.
| File | Description |
|---|---|
| ui/tests/e2e/.npmrc | Forces npmjs registry to avoid user/corporate registry leaking into package-lock.json. |
| testdata/corpus/fixtures/globex-industries__legacy-pipeline/findings.sarif | Regenerated fixture content/help text and tool/package versions. |
| testdata/corpus/fixtures/globex-industries__feature-flags/findings.sarif | Regenerated fixture content/help text and tool/package versions. |
| testdata/corpus/fixtures/globex-industries__docs-site/findings.sarif | Regenerated fixture content/help text and tool/package versions. |
| testdata/corpus/fixtures/globex-industries__deploy-scripts/findings.sarif | Regenerated fixture ordering/help text and tool/package versions. |
| testdata/corpus/fixtures/globex-industries__config-service/findings.sarif | Regenerated fixture content/help text and tool/package versions. |
| testdata/corpus/fixtures/globex-industries__codeql-config/findings.sarif | Regenerated fixture content/help text and tool/package versions. |
| testdata/corpus/fixtures/globex-industries__cli-wrapper/findings.sarif | Regenerated fixture content/help text and tool/package versions. |
| testdata/corpus/fixtures/globex-industries__artifact-store/findings.sarif | Regenerated fixture content/help text and tool/package versions. |
| testdata/corpus/fixtures/globex-industries__access-gateway/findings.sarif | Regenerated fixture content/help text and tool/package versions. |
| testdata/corpus/fixtures/acme-corp__storefront/findings.sarif | Regenerated fixture content/help text and tool/package versions. |
| testdata/corpus/fixtures/acme-corp__payments/findings.sarif | Regenerated fixture content/help text and tool/package versions. |
| testdata/corpus/authoring.json | Bumps recorded CLI version used for corpus authoring metadata. |
| scripts/test_devcontainer.py | Adds a test ensuring Go is sourced from a pinned image stage without remote tag discovery. |
| ql/actions/findings/src/ActionsLockAware/UncoveredActionRef.md | Updates reference links to current GitHub Docs pages. |
| ql/actions/findings/src/ActionsLockAware/ActionsLockMissingForWorkflow.md | Updates reference links to current GitHub Docs pages. |
| internal/store/sourcepolicy_test.go | Adds store-level test for requeueing only source-policy-skipped frontier rows. |
| internal/store/requeue.go | Adds store APIs to detect and requeue source-policy-unavailable work. |
| internal/store/backend.go | Extends SetupStore interface with source-policy skip/retry methods. |
| internal/sourcepolicy/policy_test.go | Adds unit tests for policy decisions, invalidation, concurrency, and cancellation behavior. |
| internal/sourcepolicy/policy.go | Implements best-effort remote-source eligibility checks with caching and warnings/refusals. |
| internal/serve/serve.go | Adds server hook to invalidate cached source policy state on operator retry. |
| internal/serve/requestexamples_test.go | Ensures source policy refusals map to HTTP 403 (not 502). |
| internal/serve/requestexamples.go | Returns 403 for source-policy-denied example reads. |
| internal/serve/discovery_test.go | Verifies invalidation runs only after control authorization on retry-unavailable. |
| internal/serve/discovery.go | Invokes invalidation hook before retrying unavailable queue items. |
| internal/harness/session.go | Adds fixture guidance to prefer synthetic/anonymized examples over private production source. |
| internal/harness/fixtureguidance_test.go | Tests that authoring/drafting guidance includes anonymization language. |
| internal/harness/draft.go | Updates drafting guidance to require synthetic/anonymized examples. |
| internal/ghapp/manifest.go | Documents additional API uses for source-access and scanning-access probes. |
| internal/expand/sourcepolicy_test.go | Adds expander tests for local reuse bypass and refusal visibility at any depth. |
| internal/expand/requeue.go | Invalidates policy cache on explicit repository requeue. |
| internal/expand/expand.go | Adds SourcePolicy to expander and wires it into expansion flow. |
| internal/expand/checkout.go | Treats policy refusals as “unavailable” and checks eligibility before git fetch. |
| internal/catalog/sourceaccess_test.go | Tests new SourceAccess/CheckScanningAccess behaviors and malformed responses. |
| internal/catalog/sourceaccess.go | Adds SourceAccess + lightweight scanning-access probe; introduces allowSource hook. |
| internal/catalog/setup.go | Applies source policy to remote file content downloads. |
| internal/catalog/files.go | Applies source policy to commit file reads (remote content). |
| internal/catalog/codescanning.go | Applies source policy to code scanning data fetches and downloads. |
| internal/catalog/client.go | Applies source policy to database downloads and exposes policy hook in client. |
| docs/deployment/source.md | Replaces prior disclaimer with links to CodeQL terms and new eligibility docs. |
| docs/deployment/operations.md | Documents warnings/refusals and retry behavior for source-policy decisions. |
| docs/deployment/index.md | Updates deployment docs to reference best-effort remote-source checks. |
| docs/deployment/configuration.md | Adds “Remote-source eligibility” section describing policy behavior and scope. |
| cmd/codeql-abom/verifylock.go | Wires source policy into lock verification (git fetch path) with API URL binding. |
| cmd/codeql-abom/sourcepolicy_test.go | Adds integration-style tests for preventing bypass and host coherence. |
| cmd/codeql-abom/sourcepolicy_corpus_test.go | Adds optional corpus regression test for policy decisions without mutating evidence. |
| cmd/codeql-abom/sourcepolicy.go | Implements policy wiring, store evidence use, and GitHub host binding for checkout. |
| cmd/codeql-abom/serve.go | Wires source policy into server processor/setup flow and lock verification. |
| cmd/codeql-abom/expand.go | Ensures CLI expansion path wires the policy by default. |
| cmd/codeql-abom/discover.go | Ensures discovery client enforces policy on remote content operations. |
| cmd/codeql-abom/codescanning.go | Applies policy to code scanning reuse client if enabled. |
| cmd/codeql-abom/check.go | Applies policy to the check reader to block remote content reads when refused. |
| .gitattributes | Marks SARIF fixtures as generated to reduce diff noise in GitHub. |
| .devcontainer/devcontainer.json | Disables Go feature version lookup in favor of pinned image provisioning. |
| .devcontainer/Dockerfile | Copies Go toolchain from a digest-pinned golang image stage. |
Files not reviewed (1)
- ui/tests/e2e/package-lock.json: Generated file
🧠 Review effort: Lite
💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.
Copilot stopped reviewing on behalf of
data-douser due to an error
October 16, 2026 18:39
Copilot stopped reviewing on behalf of
data-douser due to an error
October 16, 2026 18:39
Copilot stopped reviewing on behalf of
data-douser due to an error
October 16, 2026 18:42
Copilot stopped reviewing on behalf of
data-douser due to an error
October 16, 2026 18:42
There was a problem hiding this comment.
Note
Copilot was unable to run its full agentic suite in this review.
Copilot review overview
5 open findings
RequeueRepositoryunconditionally callse.SourcePolicy.Invalidate(name)and does so before… · Newe.SourcePolicycan be nil (e.g., in tests or alternative constructions ofExpander), which…RequeueRepositoryunconditionally dereferencese.SourcePolicy. SinceSourcePolicyis a…Checkout.Timeoutis applied after theSourcePolicycheck, so the policy/eligibility requests… · New
Files not reviewed (1)
- ui/tests/e2e/package-lock.json: Generated file
🧠 Review effort: Lite
… trimmed requeue name Apply Checkout.Timeout before the source policy runs so a stalled eligibility check cannot hold a fetching worker without a deadline, and trim the requeued repository name before invalidating its eligibility memo so a padded name refreshes the same key that is requeued. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot stopped reviewing on behalf of
data-douser due to an error
October 16, 2026 19:09
Copilot stopped reviewing on behalf of
data-douser due to an error
October 16, 2026 19:09
There was a problem hiding this comment.
Note
Copilot was unable to run its full agentic suite in this review.
Copilot review overview
1 open finding
5 resolved since last review
RequeueRepositoryunconditionally callse.SourcePolicy.Invalidate(name)and does so before…e.SourcePolicycan be nil (e.g., in tests or alternative constructions ofExpander), which…RequeueRepositoryunconditionally dereferencese.SourcePolicy. SinceSourcePolicyis a…Checkout.Timeoutis applied after theSourcePolicycheck, so the policy/eligibility requests…
Files not reviewed (1)
- ui/tests/e2e/package-lock.json: Generated file
🧠 Review effort: Lite
Copilot stopped reviewing on behalf of
data-douser due to an error
October 16, 2026 19:11
Copilot stopped reviewing on behalf of
data-douser due to an error
October 16, 2026 19:12
The SourcePolicy comment said it covered only source and result downloads, but the policy deliberately gates every read of repository content or code-scanning results, including alert reads and commit comparisons, whose answer carries file patches. TestRemoteContentCannotBypassPrivateSourceOwnership already pins all six gated reads. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot stopped reviewing on behalf of
data-douser due to an error
October 16, 2026 20:52
Copilot stopped reviewing on behalf of
data-douser due to an error
October 16, 2026 20:52
There was a problem hiding this comment.
Note
Copilot was unable to run its full agentic suite in this review.
Copilot review overview
4 open findings
e.SourcePolicycan be nil (e.g., in builds/configurations that don’t wire remote-source…e.SourcePolicycan benil(it’s a pointer field and can be omitted by other… · NewallowSource(...)is now enforced for…catalog.Client.sourceAccess(unexported helper) while other entries… · New
1 resolved since last review
Files not reviewed (1)
- ui/tests/e2e/package-lock.json: Generated file
🧠 Review effort: Lite
Resolve conflicts with #61, which squashed this branch's first two commits: - requeue.go: keep main's nil guard around Invalidate, after the trim. - sourcepolicy_test.go: keep this branch's copy, a strict superset of main's. - client.go: keep this branch's corrected SourcePolicy comment. - checkout.go: keep only the policy check under the checkout timeout; the textual merge kept both blocks and ran the check twice. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot stopped reviewing on behalf of
data-douser due to an error
October 16, 2026 20:56
Copilot stopped reviewing on behalf of
data-douser due to an error
October 16, 2026 20:56
There was a problem hiding this comment.
Note
Copilot was unable to run its full agentic suite in this review.
Copilot review overview
4 open findings
gois discoverable on PATH. Since… · NewallowSource(...)is now enforced for…catalog.Client.sourceAccess(unexported helper) while other entries…
2 resolved since last review
🧠 Review effort: Lite
… loopback The firewall confines the Demo in every dev container, so keep that the subject, and give the Codespace's shared VM network as the reason name lookups are refused even over loopback. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot stopped reviewing on behalf of
data-douser due to an error
October 16, 2026 21:04
Copilot stopped reviewing on behalf of
data-douser due to an error
October 16, 2026 21:04
There was a problem hiding this comment.
Note
Copilot was unable to run its full agentic suite in this review.
Copilot review overview
1 open issue
4 resolved since last review
gois discoverable on PATH. Since…allowSource(...)is now enforced for…catalog.Client.sourceAccess(unexported helper) while other entries…
Review effort: Lite
…space The paragraph named the Codespace only as the reason for refusing lookups over loopback, which left a local reader unsure whether the rule applied to them. It does: confine has no Codespaces check. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot stopped reviewing on behalf of
data-douser due to an error
October 16, 2026 21:27
Copilot stopped reviewing on behalf of
data-douser due to an error
October 16, 2026 21:27
… version Dropping the option is the likeliest regression, since the feature then defaults to latest and queries go.googlesource.com, and indexing it raised a bare KeyError that hid the test's message. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot stopped reviewing on behalf of
data-douser due to an error
October 16, 2026 21:48
Copilot stopped reviewing on behalf of
data-douser due to an error
October 16, 2026 21:48
…the checkout timeout The bound accepted any deadline at most an hour away, including one that had already passed, so applying a zero or negative timeout before the source policy would still have satisfied it. Require the remaining time to be positive as well. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot stopped reviewing on behalf of
data-douser due to an error
October 16, 2026 22:08
Copilot stopped reviewing on behalf of
data-douser due to an error
October 16, 2026 22:08
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fix Codespaces prebuilds. Copy Go 1.26.0 from a digest-pinned official image instead of relying on the Go feature’s remote version lookup. Keep the feature for environment and permissions setup.