Pin threat-detect artifacts to independent SHA-256 digests

[Copilot]

The installer previously verified threat-detect against a checksum downloaded from the same release, coupling the artifact and trust source.

• Independent verification

  • Embed SHA-256 digests for v0.5.1 Linux amd64 and arm64 artifacts in the immutable setup action.
  • Select the expected digest using the detected architecture.
  • Stop downloading release-hosted checksums.txt.

• Fail-closed behavior

  • Reject unsupported versions without explicit valid digests before downloading.
  • Reject digest mismatches before installation.
  • Preserve existing compiled workflow invocations for the pinned version.

• Custom artifact verification

  • Allow callers to supply independently managed digests:

install_threat_detect_binary.sh v1.0.0 \
  --sha256-amd64 "$AMD64_SHA256" \
  --sha256-arm64 "$ARM64_SHA256"

• Documentation
  • Document the independent, architecture-specific verification model.

• Fixes Support independently pinned threat-detect artifacts #57792

---

pr-sous-chef https://github.com/github/gh-aw/actions/runs/33831313247

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 40.5 AIC · ⌖ 8.81 AIC · ⊞ 8.9K · ◷
_{Comment /souschef to run again}

---

pr-sous-chef https://github.com/github/gh-aw/actions/runs/33834943677

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• github.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "github.com"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 41.7 AIC · ⌖ 8.84 AIC · ⊞ 8.9K · ◷
_{Comment /souschef to run again}

---

pr-sous-chef https://github.com/github/gh-aw/actions/runs/33865510093

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

• github.com
• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "github.com"
    - "registry.npmjs.org"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 18.6 AIC · ⌖ 8.56 AIC · ⊞ 8.7K · ◷
_{Comment /souschef to run again}

---

Run: https://github.com/github/gh-aw/actions/runs/33875422710

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

• github.com
• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "github.com"
    - "registry.npmjs.org"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 18.9 AIC · ⌖ 8.77 AIC · ⊞ 8.7K · ◷
_{Comment /souschef to run again}

[Copilot]

Copilot wasn't able to review any files in this pull request.

[pelikhan]

@copilot fix https://github.com/github/gh-aw/actions/runs/33809941495/job/100840175260?pr=58310

[Copilot]

@copilot fix https://github.com/github/gh-aw/actions/runs/33809941495/job/100840175260?pr=58310

Fixed in b38c832. The Dependabot manifest tests now use a deterministic local failing npm stub instead of contacting the registry; the focused tests passed 10 consecutive runs and the final impacted Go tests passed.

[gh-aw-bot]

@copilot The last maintainer request points at a failing unit-test job, and your follow-up says the root cause was fixed on a newer head.

Please refresh the branch state if needed, re-run the pr-finisher skill on the current head, and summarize in maintainer-facing terms:

• the exact root cause you fixed,
• the concrete validation you ran on HEAD, and
• whether any blocker remains beyond CI re-running on the updated commit.

Failed check to reconcile:

• Unit tests (D-G): https://github.com/github/gh-aw/actions/runs/33809941495/job/100840175260

Generated by 👨🍳 PR Sous Chef

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 32.7 AIC · ⌖ 9.85 AIC · ⊞ 9.2K · ◷
_{Comment /souschef to run again}

[Copilot]

@copilot The last maintainer request points at a failing unit-test job, and your follow-up says the root cause was fixed on a newer head.

Please refresh the branch state if needed, re-run the `pr-fin...

Current head is b3edf93; no refresh was needed. Root cause: TestGenerateDependabotManifests_WithDependencies invoked the real npm registry, leaving npm install blocked until the package-wide 3-minute timeout. The fix uses a deterministic local failing npm stub for both non-strict and strict paths.

Validated on HEAD: make lint, make test-unit, full make test, 12 installer tests, and the two Dependabot tests for 10 consecutive runs; all passed. The working tree is clean, there are no review threads or merge conflicts, and no code blocker remains. Current-head CI is action_required, so checks still need maintainer approval/re-run on b3edf93.

[pelikhan]

@copilot merge main and recompile

[Copilot]

@copilot merge main and recompile

Completed in merge commit 30352e2. Its second parent is current origin/main (0d11aae). Recompiled all 298 workflows successfully; no lock-file changes were needed. Final make agent-report-progress passed, workflow locks are in sync, and the working tree is clean.

[gh-aw-bot]

pr-sous-chef

@copilot Please take the next forward-progress pass on this PR.

• Your latest update says current head b3edf93 has the deterministic local npm-stub fix, all targeted validation passed, and no code blocker remains.
• Please run the pr-finisher skill on the current head and restate the maintainer-facing status clearly.
• If the only remaining work is maintainer approval or routine CI state rather than additional code changes, say that explicitly.

Generated by PR Sous Chef: https://github.com/github/gh-aw/actions/runs/33831313247

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 40.5 AIC · ⌖ 8.81 AIC · ⊞ 8.9K · ◷
_{Comment /souschef to run again}

[Copilot]

pr-sous-chef
```...

Ran the PR finisher pass on the current head. The branch is refreshed through main and workflow locks were recompiled in commit f6f8c3a; all 299 locks are synchronized and final pre-PR validation passed. The prior Unit tests (D-G) failure was caused by Dependabot tests invoking the real npm registry and timing out; the deterministic local failing npm stub fix is present on the branch. No code blocker remains; only maintainer CI re-trigger/approval is needed.

[gh-aw-bot]

pr-sous-chef

@copilot Please take the next forward-progress pass on this PR.

• Your latest update says the deterministic npm-stub fix is present, the branch is refreshed, and no code blocker remains.
• Please run the pr-finisher skill on the current head and restate the maintainer-facing status clearly.
• If the only remaining work is maintainer approval or routine CI state rather than additional code changes, say that explicitly.

Generated by PR Sous Chef: https://github.com/github/gh-aw/actions/runs/33834943677

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• github.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "github.com"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 41.7 AIC · ⌖ 8.84 AIC · ⊞ 8.9K · ◷
_{Comment /souschef to run again}

[Copilot]

pr-sous-chef
```...

Ran the PR finisher pass on current HEAD dcc170b. The branch is clean and contains the refreshed main merge plus regenerated workflow locks; local pre-PR validation passed, including synchronization of all 299 workflow locks. The prior unit-test timeout was fixed by replacing the real npm registry call in Dependabot manifest tests with a deterministic local failing npm stub. No code blocker remains; only maintainer CI re-trigger and any required approval are needed.

[gh-aw-bot]

@copilot PR #58310 (Pin threat-detect artifacts to independent SHA-256 digests) is ready for another pass. Please review outstanding feedback/checks, refresh the branch if needed, and run the pr-finisher skill to move it toward maintainer-ready state.

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 6.97 AIC · ⌖ 8.68 AIC · ⊞ 9.2K · ◷
_{Comment /souschef to run again}

[Copilot]

@copilot PR #58310 (Pin threat-detect artifacts to independent SHA-256 digests) is ready for another pass. Please review outstanding feedback/checks, refresh the branch if needed, and run the `pr-fini...

Ran the PR finisher pass on current HEAD dcc170b. The branch is clean and already contains the current main merge plus synchronized generated workflow locks (all 299 compile successfully). The prior Unit tests (D-G) failure was caused by Dependabot tests reaching the real npm registry; the deterministic local failing npm stub is present and local validation passes. No code blocker remains; only maintainer CI re-trigger and any required approval remain.

[gh-aw-bot]

pr-sous-chef

@copilot Please take the next forward-progress pass on this PR.

• Your recent updates say the deterministic local npm-stub fix is already on the branch and no code-side blocker remains.
• Please run the pr-finisher skill on the current head and restate the exact maintainer-facing status succinctly.
• If the only remaining work is maintainer approval or routine CI state rather than additional code changes, say that explicitly.

Generated by PR Sous Chef: https://github.com/github/gh-aw/actions/runs/33868135047

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 27.1 AIC · ⌖ 8.74 AIC · ⊞ 9.2K · ◷
_{Comment /souschef to run again}

[Copilot]

pr-sous-chef
```...

Ran the PR finisher pass on current HEAD 25edcb8. The branch is clean and up to date with main; the existing deterministic local npm-stub fix remains in place, and the workflow lock refresh is present. No code-side blocker remains. Current CI runs are action_required/awaiting maintainer handling, so only CI re-trigger/approval and GitHub mergeability re-evaluation remain.

[gh-aw-bot]

pr-sous-chef

@copilot Current HEAD 25edcb8 still has no code-side blocker, but GitHub mergeability remains stalled while CI is action_required/awaiting maintainer handling.

• No new code changes are needed for the deterministic local npm-stub fix or the workflow-lock refresh already on the branch.
• Please re-check the current workflow state, reconcile any waiting/action-required runs on this HEAD, and then run the pr-finisher skill again.
• If the only remaining blocker after that is maintainer approval / GitHub mergeability refresh, say that explicitly in maintainer-facing terms.

Generated by PR Sous Chef: https://github.com/github/gh-aw/actions/runs/33870214889

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 28.4 AIC · ⌖ 8.65 AIC · ⊞ 9K · ◷
_{Comment /souschef to run again}

[Copilot]

pr-sous-chef
```...

Rechecked the current workflow state and ran the PR finisher pass. HEAD 25edcb8 is clean and up to date with main; the latest addressing-comment run is in progress, while prior PR workflows are action_required rather than code failures. The deterministic npm-stub fix and workflow-lock refresh are already present. No code-side blocker remains; maintainer action is required to handle/re-trigger CI and refresh GitHub mergeability.

[gh-aw-bot]

@copilot Please take the next forward-progress pass on this PR.

• Current HEAD appears code-complete, but the PR still needs a maintainer-facing status pass on the latest branch state.
• Please review any outstanding checks or feedback, refresh the branch if needed, and run the pr-finisher skill on current HEAD.
• If the only remaining blocker is routine CI completion or maintainer review, say that explicitly in your summary.

Generated by PR Sous Chef: https://github.com/github/gh-aw/actions/runs/33875422710

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

• github.com
• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "github.com"
    - "registry.npmjs.org"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 18.9 AIC · ⌖ 8.77 AIC · ⊞ 8.7K · ◷
_{Comment /souschef to run again}

[Copilot]

@copilot Please take the next forward-progress pass on this PR.

• Current HEAD appears code-complete, but the PR still needs a maintainer-facing status pass on the latest branch state....

Completed the latest PR finisher pass on HEAD 25edcb8. The branch is clean and already includes the current main merge and workflow-lock refresh; no source changes are needed. The latest addressing-comment run is in progress, while the prior CGO and Docs runs are action_required rather than code failures. No code-side blocker remains; maintainer CI handling/re-trigger and GitHub mergeability refresh are the only remaining items.