gh aw compile generates CodeQL code-injection alert for ${{ runner.tool_cache }} in shell run block

[kkruel8100]

Summary

gh aw compile generates lock workflows that interpolate ${{ runner.tool_cache }} directly inside an executable shell run: block.

CodeQL flags this as actions/code-injection/medium.

We have several workflows that use on.workflow-call and use a centralized repo ops pattern. The centralized workflow is extremely important to use to maintain workflows in one place.

The ${{ runner.tool_cache }} appears more broadly but the CodeQL alerts appear related to workflows that use the on.workflow-call.

Generated Code

- name: Set runtime paths
  id: set-runtime-paths
  run:  |
    if [ -z "${RUNNER_TOOL_CACHE:-}" ]; then
      echo "RUNNER_TOOL_CACHE=${{ runner.tool_cache }}" >> "$GITHUB_ENV"
    fi

CodeQL Alert

Potential code injection in ${{ runner.tool_cache }}, which may be controlled by external user.

Observed Context

This appears in generated .lock.yml files produced by gh aw compile.
The source .md workflow files do not contain this shell line. It is introduced by compilation, so manual editing is not durable.

Version

Observed in v 0.87.10

Proposed fix

Replace with

  env:
    GH_AW_RUNNER_TOOL_CACHE: ${{ runner.tool_cache }}
  run:  |
    if [ -z "${RUNNER_TOOL_CACHE:-}" ]; then
      echo "RUNNER_TOOL_CACHE=${{ GH_AW_RUNNER_TOOL_CACHE }}" >> "$GITHUB_ENV"
    fi

Request

Please update gh aw compile so ${{ runner.tool_cache }} is passed through env: and referenced as a shell variable, rather then being interpolated directly into executable run: script text.

Impact

We have a centralized workflow with a large number of reusable workflows, so the count of CodeQL alerts is significant.

Thank you for reviewing the matter.

[kkruel8100]

/help

[github-actions]

Agentic Workflow Commands

Centralized slash commands

• /* — Reviews pull requests by mapping any slash command to a matching repository skill under .github/skills
• /ace — Generates an ACE editor session link when invoked with /ace command on pull request comments
• /approach-validator — Validates proposed technical approaches before implementation begins using a sequential multi-agent panel of Devil's Advocate, Alternatives Scout, Implementation Estimator, and Dead End Detector
• /archie — Generates Mermaid diagrams to visualize issue and pull request relationships when invoked with the /archie command
• /cloclo
• /craft — Generates new agentic workflow markdown files based on user requests when invoked with /craft command
• /dependabot-burner — Runs one grouped Dependabot remediation wave from schedule, manual dispatch, or /dependabot-burner on pull requests
• /grumpy — ⚠️ DEPRECATED: Use PR Code Quality Reviewer (pr-code-quality-reviewer) instead. Performs critical code review with a focus on edge cases, potential bugs, and code quality issues
• /matt — Reviews pull requests using Matt Pocock's engineering skills to provide targeted, high-quality improvement suggestions based on the type of changes
• /mergefest — Automatically merges the main branch into pull request branches when invoked with /mergefest command
• /nit — ⚠️ DEPRECATED: Use PR Code Quality Reviewer (pr-code-quality-reviewer) instead. Provides detailed nitpicky code review focusing on style, best practices, and minor improvements
• /plan — Generates project plans and task breakdowns when invoked with /plan command in issues or PRs
• /poem-bot — Generates creative poems on specified themes when invoked with /poem-bot command
• /ponytail — Reviews pull requests for unnecessary complexity using Ponytail
• /review — Enforces Architecture Decision Records (ADRs) before implementation work can merge, detecting missing design decisions and generating draft ADRs using AI analysis
• /ruflo — Runs a repository task inside GitHub Agentic Workflows while delegating inner planning and coordination to Ruflo
• /scout — Performs deep research investigations using web search to gather and synthesize comprehensive information on any topic
• /security-review — Security-focused AI agent that reviews pull requests to identify changes that could weaken security posture or extend AWF boundaries
• /smoke-agent-all-merged — Guard policy smoke test: repos=all, min-integrity=merged (most restrictive)
• /smoke-agent-all-none — Guard policy smoke test: repos=all, min-integrity=none (most permissive)
• /smoke-agent-public-approved — Smoke test that validates assign-to-agent with the agentic-workflows custom agent
• /smoke-agent-public-none — Guard policy smoke test: repos=public, min-integrity=none
• /smoke-agent-scoped-approved — Guard policy smoke test: repos=[github/gh-aw, github/*], min-integrity=approved (scoped patterns)
• /smoke-aider — Smoke test workflow that validates Aider engine functionality
• /smoke-call-workflow — Smoke test for the call-workflow safe output - orchestrator that calls a worker via workflow_call at compile-time fan-out
• /smoke-checkout-pr-dispatch — Integration test validating that workflow_dispatch events with aw_context.item_type == 'pull_request' correctly check out the PR branch
• /smoke-claude — Smoke test workflow that validates Claude engine functionality by reviewing recent PRs twice daily
• /smoke-claude-on-copilot — Smoke test for Claude engine on GitHub Inference that posts a concise PR summary comment
• /smoke-codex — Smoke test workflow that validates Codex engine functionality by reviewing recent PRs twice daily
• /smoke-copilot — Smoke Copilot
• /smoke-copilot-aoai-apikey — Smoke Copilot - AOAI (apikey)
• /smoke-copilot-aoai-entra — Smoke Copilot - AOAI (Entra)
• /smoke-copilot-arm — Smoke Copilot ARM64
• /smoke-copilot-mai — Smoke test for MAI-Code-1-Flash (mai-code-1-flash-picker) — pricing: $0.75/M input, $0.075/M cached, $4.50/M output
• /smoke-copilot-sdk — Smoke Copilot SDK
• /smoke-copilot-small — Smoke Copilot Small
• /smoke-create-cross-repo-pr — Smoke test validating cross-repo pull request creation in github/gh-aw-side-repo
• /smoke-crush — Smoke test workflow that validates Crush engine functionality
• /smoke-cursor — Smoke test workflow that validates Cursor engine functionality
• /smoke-deepseek-harness — Smoke test workflow that validates DeepSeek Harness engine functionality
• /smoke-drive — Smoke test workflow that validates experimental GitHub Drives memory
• /smoke-gemini — Smoke test workflow that validates Gemini engine functionality twice daily
• /smoke-github-claude — Smoke test for Claude engine using GitHub provider that posts a concise PR summary comment
• /smoke-goose — Smoke test workflow that validates Goose engine functionality
• /smoke-kiro — Smoke test workflow that validates Kiro engine functionality
• /smoke-multi-pr — Test creating multiple pull requests in a single workflow run
• /smoke-opencode — Smoke test workflow that validates OpenCode engine functionality
• /smoke-otel-backends — Smoke test that validates OTEL span export and query access for Sentry, Grafana, and Datadog
• /smoke-pi — Smoke test workflow that validates Pi engine functionality
• /smoke-project — Smoke Project - Test project operations
• /smoke-pydantic — Smoke test workflow that validates Pydantic AI engine functionality
• /smoke-service-ports — Smoke test to validate --allow-host-service-ports with Redis service container
• /smoke-temporary-id — Test temporary ID functionality for issue chaining and cross-references
• /smoke-test-tools — Smoke test to validate common development tools are available in the agent container
• /smoke-update-cross-repo-pr — Smoke test validating cross-repo pull request updates in github/gh-aw-side-repo by adding lines from Homer's Odyssey to the README
• /souschef — Keeps open non-draft PRs moving toward maintainer investigation by posting targeted Copilot nudges
• /squad-plan — Uses Squad to plan an issue from the /squad-plan slash command and create Copilot-ready sub-issues
• /summarize — pdf summarizer
• /tidy — Automatically formats and tidies code files (Go, JS, TypeScript) on schedule or command
• /unbloat — Reviews and simplifies documentation by reducing verbosity while maintaining clarity and completeness
• /windows — Windows runner integration test that writes a haiku issue using the Docker agent runtime

Non-centralized slash commands

• /q — Intelligent assistant that answers questions, analyzes repositories, and can create PRs for workflow optimizations
• /squad — Cast, connect, or adopt a Squad AI team for your repository

Label commands

• approach-proposal — Validates proposed technical approaches before implementation begins using a sequential multi-agent panel of Devil's Advocate, Alternatives Scout, Implementation Estimator, and Dead End Detector
• ci-doctor — Investigates failed CI workflows to identify root causes and patterns, creating issues with diagnostic information; also reviews PR check failures when the ci-doctor label is applied
• cloclo
• dev — Daily status report for gh-aw project
• necromancer — Investigates merge-ready pull requests, traces root-cause issues, and adds regression tests before merge
• needs-design — Validates proposed technical approaches before implementation begins using a sequential multi-agent panel of Devil's Advocate, Alternatives Scout, Implementation Estimator, and Dead End Detector
• smoke — Smoke Copilot - AOAI (apikey)
• smoke-sdk — Smoke Copilot SDK

Learn more: Slash command documentation

[kkruel8100]

@pelikhan
Would you be available to either assign this issue to Copilot or run the appropriate gh-aw remediation slash command?

Thank you for your consideration.

[pelikhan]

@kkruel8100 cooking!