Add allowed-github-references safe-output field to restrict markdown references #9033

Copilot · 2026-01-05T20:59:08Z

Implementation: allowed-github-references ✅

Successfully implemented support for restricting GitHub markdown references (like #123 or owner/repo#456) to a set of allowed repositories.

Completed Tasks:

Implementation Details:

Configuration Format:

safe-outputs:
  allowed-github-references: ["repo"]  # Current repo only
  # OR
  allowed-github-references: ["repo", "org/repo2", "org/repo3"]  # Multiple repos
  # OR
  allowed-github-references: []  # Escape all references

Behavior:

Not specified: All references allowed (no escaping) - default behavior
Empty array []: All references escaped with backticks
With "repo": Current repo references allowed, others escaped
With specific repos: Only listed repos allowed, others escaped
Pattern matching: #123, owner/repo#456, case-insensitive
"repo" keyword: Represents the current repository - both #123 and owner/repo#123 are allowed
Environment variable: GH_AW_ALLOWED_GITHUB_REFS (comma-separated list, or empty string for escape-all)

Examples when "repo" is specified:

✅ #123 → NOT escaped (refers to current repo)
✅ myorg/myrepo#456 → NOT escaped (current repo, explicit format)
❌ other/repo#789 → escaped as `other/repo#789` (different repo)

Examples when empty array [] is specified:

❌ #123 → escaped as `#123`
❌ myorg/myrepo#456 → escaped as `myorg/myrepo#456`
❌ other/repo#789 → escaped as `other/repo#789`

Schema Validation:

Pattern: ^(repo|[a-zA-Z0-9][-a-zA-Z0-9]{0,38}/[a-zA-Z0-9._-]+)$
Validates repository name format (allows hyphens in owner names)
Repository names can contain alphanumeric, hyphens, underscores, and dots
Examples provided in schema

Test Coverage:

✅ JavaScript sanitization tests (28 cases including empty array test) - ALL PASSING
✅ Go configuration parsing tests (8 cases) - ALL PASSING
✅ Integration tests for env var passing (6 cases) - ALL PASSING
✅ All tests passing (42 total tests)

Bug Fixes:

Fixed setup.sh to copy all required MCP handler files (go, javascript, python, shell) to both safe-inputs and safe-outputs directories
Fixed JavaScript test expectations for default behavior (allow all references when no env var set)

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

https://api.github.com/user
- Triggering command: /usr/bin/gh gh api user --jq .login -json GO111MODULE 0.1-go1.25.0.linGOMODCACHE GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 0.1-go1.25.0.lin-nilfunc GOINSECURE GOMOD GOMODCACHE go (http block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

Add a safe-output field to support restricting github markdown references (like issue #number) to a set of repos. The default is all are allowed.

safe-outputs:
allow-github-references: ["repo"] # restrict to current repo only
allow-github-references: ["repo", "org/repo2"] # restrict to current repo, org/repo2 only

The javascript that redacts markdown must parse github references and applyes the restrictions. If a restricted referernce is foudn, it should be escaped using backticks.

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

Changeset

Type: patch
Description: Add allowed-github-references safe-output field to restrict and escape unauthorized GitHub-style markdown references (e.g. #123, owner/repo#456). Includes backend parsing, JS sanitizer, schema validation, and tests.

Ahoy! This treasure was crafted by 🏴‍☠️ Changeset Generator

Changeset

Type: patch
Description: Add allowed-github-references safe-output field to restrict and escape unauthorized GitHub-style markdown references (e.g. #123, owner/repo#456). Includes backend parsing, JS sanitizer, schema validation, and tests.

Ahoy! This treasure was crafted by 🏴‍☠️ Changeset Generator

Co-authored-by: pelikhan <[email protected]>

pelikhan · 2026-01-05T22:24:11Z

@copilot rename allow-github-references to allowed-github-references

Co-authored-by: pelikhan <[email protected]>

Copilot · 2026-01-05T22:31:39Z

@copilot rename allow-github-references to allowed-github-references

Done. Renamed allow-github-references to allowed-github-references throughout the codebase (commit 4e3e0a0).

pelikhan · 2026-01-05T22:33:32Z

@copilot

same repo references (#123 → escaped as #123) are allowed if "repo" is specified

…ified Co-authored-by: pelikhan <[email protected]>

Copilot · 2026-01-05T22:40:37Z

@copilot

same repo references (#123 → escaped as #123) are allowed if "repo" is specified

Correct. Fixed the test expectations - same-repo references like #123 are now properly allowed (not escaped) when "repo" is specified. Updated PR description to reflect this behavior (commit 8204e5e).

pelikhan · 2026-01-05T22:41:24Z

Add more tests

pelikhan · 2026-01-05T22:41:36Z

@copilot add more tests

- Add 14 additional JavaScript tests covering edge cases: * Empty allowed-refs list * Current repo not in list * Hyphens, underscores, and dots in repo names * Multiple references in same sentence * References at start/end of string * Mixed case handling * Long issue numbers * Missing GITHUB_REPOSITORY env var * Spacing preservation - Add 4 additional Go config tests: * Repos with hyphens * Repos with underscores and dots * Single specific repo without 'repo' keyword * Mix of 'repo' keyword and specific repos - Add 3 additional Go integration tests: * Special characters in repo names * Mix of repo keyword and specific repos * Only specific repos without repo keyword - Update schema pattern to allow hyphens in owner names: ^(repo|[a-zA-Z0-9][-a-zA-Z0-9]{0,38}/[a-zA-Z0-9._-]+)$ Total test coverage: 27 JavaScript tests + 8 Go config tests + 6 Go integration tests = 41 tests Co-authored-by: pelikhan <[email protected]>

Copilot · 2026-01-05T22:50:34Z

@copilot add more tests

Added comprehensive test coverage (commit f900bd4):

JavaScript tests (27 total):

14 new tests covering edge cases: empty allowed-refs list, current repo not in list, special characters in repo names, multiple references, mixed case, long issue numbers, missing GITHUB_REPOSITORY, spacing preservation

Go tests (14 total):

4 new config parsing tests: repos with hyphens, underscores/dots, single specific repo, mix of 'repo' keyword and specific repos
3 new integration tests: special characters in repo names, mixed configurations, specific repos only

Also updated schema pattern to ^(repo|[a-zA-Z0-9][-a-zA-Z0-9]{0,38}/[a-zA-Z0-9._-]+)$ to properly support hyphens in owner names.

Total: 41 tests covering all major scenarios and edge cases.

pelikhan · 2026-01-05T22:58:51Z

@copilot update smoke-no-firewall agentic workflow with allowed-github-references: []

- Update Go compiler to set GH_AW_ALLOWED_GITHUB_REFS env var even when array is empty - Update JavaScript to distinguish between undefined (allow all) and empty string (escape all) - Initialize refStrings as empty slice instead of nil to preserve empty array semantics - Add test for escaping all references when allowed-github-references: [] - Update smoke-copilot-no-firewall workflow to use allowed-github-references: [] When allowed-github-references is: - Not specified: All references allowed (no escaping) - Empty array []: All references escaped - ["repo"]: Only current repo references allowed - ["repo", "org/other"]: Current repo and specific repos allowed Co-authored-by: pelikhan <[email protected]>

github-actions · 2026-01-05T23:48:43Z

✅ Firewall validation complete... Smoke Codex Firewall confirmed network sandboxing is operational. 🛡️

github-actions · 2026-01-05T23:48:45Z

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

github-actions · 2026-01-05T23:48:45Z

🤖 DIAGNOSTIC COMPLETE: Smoke Copilot No Firewall STATUS: ALL_UNITS_OPERATIONAL. MISSION_SUCCESS.

github-actions · 2026-01-05T23:48:46Z

🎬 THE END — Smoke Claude MISSION: ACCOMPLISHED! The hero saves the day! ✨

github-actions · 2026-01-05T23:48:46Z

🎉 Yo ho ho! Changeset Generator found the treasure and completed successfully! ⚓💰

github-actions · 2026-01-05T23:48:46Z

🎉 Yo ho ho! Smoke Copilot Safe Inputs found the treasure and completed successfully! ⚓💰

github-actions · 2026-01-05T23:48:49Z

📰 DEVELOPING STORY: Smoke Copilot reports failed. Our correspondents are investigating the incident...

github-actions · 2026-01-05T23:48:49Z

📰 VERDICT: Smoke Copilot Playwright has concluded. All systems operational. This is a developing story. 🎤

github-actions · 2026-01-05T23:50:39Z

PRs: #9036 Add debugging-workflows Agent Skill | #9035 Add fix tool to MCP server
OpenAI curl blocked: ✅
example.com blocked: ✅
GitHub MCP last 2 merged PRs fetched: ✅
File write/read /tmp/gh-aw/agent/smoke-test-codex-firewall-20732827216.txt: ✅
Network: SANDBOXED
Overall: PASS

AI generated by Smoke Codex Firewall

github-actions · 2026-01-05T23:51:20Z

Smoke Test Results

❌ Playwright MCP Testing: Missing playwright MCP server tool
❌ Safe Input gh Tool Testing: Missing safeinputs-gh tool
✅ Cache Memory Testing: Successfully wrote and verified file

Overall Status: ❌ FAIL (2/3 tests failed - required tools not available)

AI generated by Smoke Copilot Playwright

github-actions · 2026-01-05T23:51:21Z

✅ Smoke test complete - all tests passed!

Test Results:

✅ Reviewed last 2 merged PRs (#9036, #9035)
✅ Created test file at /tmp/gh-aw/agent/smoke-test-copilot-20732827247.txt
✅ Navigated to GitHub homepage with Playwright (title verified)
✅ Listed 3 open issues using safeinputs-gh tool

AI generated by Smoke Copilot No Firewall

github-actions · 2026-01-05T23:51:22Z

Smoke Test Results - Claude Engine

Recent PRs:

Add debugging-workflows Agent Skill #9036: Add debugging-workflows Agent Skill
Add fix tool to MCP server #9035: Add fix tool to MCP server

Test Results:
✅ GitHub MCP - Retrieved 2 merged PRs
✅ File Writing - Created /tmp/gh-aw/agent/smoke-test-claude-20732827225.txt
✅ Bash Tool - Verified file contents successfully
✅ Playwright MCP - Navigated to GitHub, title contains "GitHub"
✅ Cache Memory - Created /tmp/gh-aw/cache-memory/smoke-test-20732827225.txt
❌ Safe Input gh Tool - Tool not available (not configured)

Status: PASS (5/6 tests passed, gh tool unavailable by design)

AI generated by Smoke Claude

github-actions · 2026-01-05T23:51:29Z

Smoke Test Results

✅ File Writing: Created /tmp/gh-aw/agent/smoke-test-copilot-20732827207.txt
✅ Bash Tool: Verified file content successfully
✅ Safe Input gh Tool: Accessed GitHub data (2 merged PRs)

Overall Status: PASS 🎉

AI generated by Smoke Copilot Safe Inputs

github-actions · 2026-01-05T23:51:39Z

PRs: Add debugging-workflows Agent Skill; Add fix tool to MCP server
GitHub MCP: ✅
File write: ✅
File readback: ✅
Playwright title check: ✅
Cache memory write/read: ✅
safeinputs-gh issues list: ❌ (tool unavailable in toolset)
Overall: FAIL

AI generated by Smoke Codex

pelikhan · 2026-01-05T23:53:12Z

@copilot format, fix js tests

Fixed two failing tests in sanitize_content.test.cjs: 1. "should allow all references by default" - Fixed expectation to NOT escape #123 when no env var is set, since the default behavior is to allow all references. 2. "should handle no GITHUB_REPOSITORY env var with 'repo' keyword" - Fixed expectation to NOT escape #123 when GITHUB_REPOSITORY is not set, since the reference can't be determined and is left as-is. The tests were expecting references to be escaped by bot trigger neutralization, but "issue" is not a bot trigger word (only "fixes", "closes", "resolves", etc. are). All 122 JavaScript test files now pass (2462 tests). All Go tests for allowed-github-references pass (14 tests). Co-authored-by: pelikhan <[email protected]>

Copilot · 2026-01-06T00:03:12Z

@copilot format, fix js tests

Fixed in commit d61a21f.

Formatting: Already passing - all JavaScript files properly formatted with Prettier.

JavaScript tests: Fixed 2 failing tests in sanitize_content.test.cjs by correcting test expectations:

"should allow all references by default" - Now correctly expects #123 to NOT be escaped when no env var is set (default behavior allows all references)
"should handle no GITHUB_REPOSITORY env var with 'repo' keyword" - Now correctly expects #123 to NOT be escaped when GITHUB_REPOSITORY is missing

All 122 JavaScript test files now pass (2462 tests total).
All 14 Go tests for allowed-github-references also pass.

Initial plan

59df109

Copilot AI assigned Copilot and pelikhan Jan 5, 2026

Copilot started work on behalf of pelikhan January 5, 2026 20:59 View session

Copilot AI and others added 3 commits January 5, 2026 21:15

Add allow-github-references configuration and JavaScript implementation

837ad3c

Co-authored-by: pelikhan <[email protected]>

Add schema validation and integration tests for allow-github-references

b5fbac6

Co-authored-by: pelikhan <[email protected]>

Complete implementation of allow-github-references feature

015c7ef

Co-authored-by: pelikhan <[email protected]>

Copilot AI changed the title ~~[WIP] Add safe-output field for restricting GitHub markdown references~~ Add allow-github-references safe-output field to restrict markdown references Jan 5, 2026

Copilot AI requested a review from pelikhan January 5, 2026 21:30

Copilot finished work on behalf of pelikhan January 5, 2026 21:30

Copilot started work on behalf of pelikhan January 5, 2026 22:24 View session

Rename allow-github-references to allowed-github-references

4e3e0a0

Co-authored-by: pelikhan <[email protected]>

Copilot AI changed the title ~~Add allow-github-references safe-output field to restrict markdown references~~ Add allowed-github-references safe-output field to restrict markdown references Jan 5, 2026

Copilot finished work on behalf of pelikhan January 5, 2026 22:32

Copilot started work on behalf of pelikhan January 5, 2026 22:34 View session

Fix test expectations: allow same-repo references when "repo" is spec…

8204e5e

…ified Co-authored-by: pelikhan <[email protected]>

Copilot finished work on behalf of pelikhan January 5, 2026 22:41

Copilot started work on behalf of pelikhan January 5, 2026 22:42 View session

Copilot finished work on behalf of pelikhan January 5, 2026 22:51

Copilot started work on behalf of pelikhan January 5, 2026 22:59 View session

pelikhan added smoke and removed smoke labels Jan 5, 2026

github-actions bot added the smoke-codex-firewall label Jan 5, 2026

Add changeset [skip-ci]

85e8813

github-actions bot added smoke-copilot-no-firewall smoke-claude labels Jan 5, 2026

github-actions bot added the smoke-copilot label Jan 5, 2026

Copilot started work on behalf of pelikhan January 5, 2026 23:53 View session

Copilot finished work on behalf of pelikhan January 6, 2026 00:04

pelikhan marked this pull request as ready for review January 6, 2026 00:10

pelikhan merged commit c59dc61 into main Jan 6, 2026
4 checks passed

pelikhan deleted the copilot/add-safe-output-field branch January 6, 2026 00:10

github-actions bot mentioned this pull request Jan 6, 2026

Update AWF to v0.8.1 #9038

Merged

Add allowed-github-references safe-output field to restrict markdown references #9033

Add allowed-github-references safe-output field to restrict markdown references #9033

Uh oh!

Conversation

Copilot AI commented Jan 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Implementation: allowed-github-references ✅

Completed Tasks:

Implementation Details:

I tried to connect to the following addresses, but was blocked by firewall rules:

Changeset

Changeset

Uh oh!

pelikhan commented Jan 5, 2026

Uh oh!

Copilot AI commented Jan 5, 2026

Uh oh!

pelikhan commented Jan 5, 2026

Uh oh!

Copilot AI commented Jan 5, 2026

Uh oh!

pelikhan commented Jan 5, 2026

Uh oh!

pelikhan commented Jan 5, 2026

Uh oh!

Copilot AI commented Jan 5, 2026

Uh oh!

pelikhan commented Jan 5, 2026

Uh oh!

github-actions bot commented Jan 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Jan 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Jan 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Jan 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Jan 5, 2026 • edited by agentic-workflows-dev bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Jan 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Jan 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Jan 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Jan 5, 2026

Uh oh!

github-actions bot commented Jan 5, 2026

Smoke Test Results

Uh oh!

github-actions bot commented Jan 5, 2026

Uh oh!

github-actions bot commented Jan 5, 2026

Smoke Test Results - Claude Engine

Uh oh!

github-actions bot commented Jan 5, 2026

Smoke Test Results

Uh oh!

github-actions bot commented Jan 5, 2026

Uh oh!

pelikhan commented Jan 5, 2026

Uh oh!

Copilot AI commented Jan 6, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

Copilot AI commented Jan 5, 2026 •

edited

Loading

github-actions bot commented Jan 5, 2026 •

edited

Loading

github-actions bot commented Jan 5, 2026 •

edited

Loading

github-actions bot commented Jan 5, 2026 •

edited

Loading

github-actions bot commented Jan 5, 2026 •

edited

Loading

github-actions bot commented Jan 5, 2026 •

edited by agentic-workflows-dev bot

Loading

github-actions bot commented Jan 5, 2026 •

edited

Loading

github-actions bot commented Jan 5, 2026 •

edited

Loading

github-actions bot commented Jan 5, 2026 •

edited

Loading