fix(security): replace curl|sh installer pipes with download+verify (RGS-018)#43716

Open

pelikhan with Copilot wants to merge 20 commits into

mainfrom

copilot/static-analysis-report-2026-07-06

Commits on Jul 6, 2026

Initial plan
Copilot
authored
Initial plan checkpoint

Copilot
and
pelikhan
authored
fix(security): replace curl|sh installer patterns with download+verify (RGS-018)

Copilot
and
pelikhan
authored
Merge branch 'main' into copilot/static-analysis-report-2026-07-06
pelikhan
authored
fix: use /tmp/gh-aw/ folder for installer temp files

Copilot
and
pelikhan
authored
Merge branch 'main' into copilot/static-analysis-report-2026-07-06
pelikhan
authored
fix(security): pin installer refs to resolved SHA in dev-mode templates (RGS-018)

Copilot
and
gh-aw-bot
authored
Merge remote-tracking branch 'origin/main' into copilot/static-analysis-report-2026-07-06
Copilot
authored
fix: sh→bash for Ollama, add SHA update docs, trufflehog arch note + --no-same-owner

Copilot
and
gh-aw-bot
authored
Merge branch 'main' into copilot/static-analysis-report-2026-07-06
github-actions[bot]
authored
fix(security): pin copilotSetupStepsYAML constant to immutable SHA; add arch guard to trufflehog.md

Copilot
and
gh-aw-bot
authored
Merge remote-tracking branch 'origin/main' into copilot/static-analysis-report-2026-07-06
Copilot
authored
fix(security): add SHA256 integrity check to dev-mode install-gh-aw.sh download

Copilot
and
gh-aw-bot
authored
fix(security): add input validation guards for SHA values in install script helpers

Copilot
and
gh-aw-bot
authored
refactor: extract installScriptTempPath constant, simplify sha256 guards

Copilot
and
gh-aw-bot
authored
refactor: use installScriptTempPath constant in fmt.Sprintf and add const comment

Copilot
and
gh-aw-bot
authored

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(security): replace curl|sh installer pipes with download+verify (RGS-018)#43716

fix(security): replace curl|sh installer pipes with download+verify (RGS-018)#43716
pelikhan with Copilot wants to merge 20 commits into
mainfrom
copilot/static-analysis-report-2026-07-06

Commits on Jul 6, 2026

Initial plan

Initial plan checkpoint

fix(security): replace curl|sh installer patterns with download+verify (RGS-018)

Merge branch 'main' into copilot/static-analysis-report-2026-07-06

fix: use /tmp/gh-aw/ folder for installer temp files

Merge branch 'main' into copilot/static-analysis-report-2026-07-06

fix(security): pin installer refs to resolved SHA in dev-mode templates (RGS-018)

Merge remote-tracking branch 'origin/main' into copilot/static-analysis-report-2026-07-06

fix: sh→bash for Ollama, add SHA update docs, trufflehog arch note + --no-same-owner

Merge branch 'main' into copilot/static-analysis-report-2026-07-06

fix(security): pin copilotSetupStepsYAML constant to immutable SHA; add arch guard to trufflehog.md

Merge remote-tracking branch 'origin/main' into copilot/static-analysis-report-2026-07-06

fix(security): add SHA256 integrity check to dev-mode install-gh-aw.sh download

fix(security): add input validation guards for SHA values in install script helpers

refactor: extract installScriptTempPath constant, simplify sha256 guards

refactor: use installScriptTempPath constant in fmt.Sprintf and add const comment

Commits on Jul 7, 2026

refactor: extract sha256CheckLine helper to deduplicate sha256sum command construction

docs: document sha256CheckLine trailing newline and parameter safety requirements

fix(security): add runtime input validation to sha256CheckLine

fix: add wildcards to path validation in sha256CheckLine; remove redundant hex check