feat: safe update mode warning prompt for secrets and actions (#safe-update)#24968

Open

Copilot wants to merge 18 commits intomainfrom

copilot/update-compiler-safe-update-mode

Commits on Apr 6, 2026

feat: add safe update mode enforcement for secrets

Copilot
and
pelikhan
authored
refactor: use body secrets from generateYAML in safe update enforcement

Copilot
and
pelikhan
authored
fix: improve log/error messages for safe update manifest failures

Copilot
and
pelikhan
authored

Commits on Apr 7, 2026

fix: rename to gh-aw-manifest and restrict safe-update to CLI only

Copilot
and
pelikhan
authored
chore: plan – extend safe-update to enforce action changes

Copilot
and
pelikhan
authored
feat: extend safe-update enforcement to also check action changes

Copilot
and
pelikhan
authored
feat: enforce safe-update on first compile when no prior lock file exists

Copilot
and
pelikhan
authored
feat: add safe-update feature flag support and exempt actions/* org from enforcement

Copilot
and
pelikhan
authored
feat: read lock file manifest from git HEAD to prevent local tampering

Copilot
and
pelikhan
authored
fix: use filepath.Join for path construction and fix %q double-quoting in log message

Copilot
and
pelikhan
authored
feat: gate ReadFileFromHEAD tamper prevention to dev mode only

Copilot
and
pelikhan
authored
fix: add missing log message when lock file not found in filesystem (non-dev mode)

Copilot
and
pelikhan
authored
fix: address review comments — doc accuracy, path-traversal guard, log/help text

Copilot
and
pelikhan
authored
test(integration): add safe-update integration tests for secret and action enforcement

Copilot
and
pelikhan
authored
style: use 0o644 octal prefix for file permissions in integration tests

Copilot
and
pelikhan
authored
test(integration): add transitive import tests verifying manifest captures full secrets/actions closure

Copilot
and
pelikhan
authored
fix(tests): address code review - safe array bounds check in log statements

Copilot
and
pelikhan
authored
feat: change safe-update from hard error to warning prompt, apply to all modes

Copilot
and
pelikhan
authored

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: safe update mode warning prompt for secrets and actions (#safe-update)#24968

feat: safe update mode warning prompt for secrets and actions (#safe-update)#24968
Copilot wants to merge 18 commits intomainfrom
copilot/update-compiler-safe-update-mode

Commits on Apr 6, 2026

feat: add safe update mode enforcement for secrets

refactor: use body secrets from generateYAML in safe update enforcement

fix: improve log/error messages for safe update manifest failures

Commits on Apr 7, 2026

fix: rename to gh-aw-manifest and restrict safe-update to CLI only

chore: plan – extend safe-update to enforce action changes

feat: extend safe-update enforcement to also check action changes

feat: enforce safe-update on first compile when no prior lock file exists

feat: add safe-update feature flag support and exempt actions/* org from enforcement

feat: read lock file manifest from git HEAD to prevent local tampering

fix: use filepath.Join for path construction and fix %q double-quoting in log message

feat: gate ReadFileFromHEAD tamper prevention to dev mode only

fix: add missing log message when lock file not found in filesystem (non-dev mode)

fix: address review comments — doc accuracy, path-traversal guard, log/help text

test(integration): add safe-update integration tests for secret and action enforcement

style: use 0o644 octal prefix for file permissions in integration tests

test(integration): add transitive import tests verifying manifest captures full secrets/actions closure

fix(tests): address code review - safe array bounds check in log statements

feat: change safe-update from hard error to warning prompt, apply to all modes