Use official Copilot CLI installer script with security improvements by Copilot · Pull Request #6691 · github/gh-aw

Copilot · 2025-12-17T01:32:12Z

Plan: Add SHA256 Checksum Verification for Copilot CLI Installer Script

Research official checksum source for Copilot CLI releases
Implement secure installation using official install.sh script
Add tests for installer implementation
Update dev.md workflow as proof of concept
Recompile all workflows to generate updated lock files
Run tests and validate changes
Document the secure installation pattern
Create list of affected workflows for future rollout

Status: ✅ Implementation Complete - Using Official Install Script

Summary

Updated implementation to use the official install.sh script from the Copilot CLI repository as requested by @pelikhan. This maintains security improvements while leveraging the official installer.

Implementation Details

Security Improvements Over Original

✅ Downloads script from official GitHub repository: https://raw.githubusercontent.com/github/copilot-cli/main/install.sh
✅ Saves script to temporary file before execution (not piped directly to bash)
✅ Uses official installer which includes platform detection and error handling
✅ Cleans up temporary file after installation

Installation Pattern

# Download official Copilot CLI installer script
curl -fsSL https://raw.githubusercontent.com/github/copilot-cli/main/install.sh -o /tmp/copilot-install.sh

# Execute the installer with the specified version
export VERSION=0.0.369 && sudo bash /tmp/copilot-install.sh

# Cleanup
rm -f /tmp/copilot-install.sh

# Verify installation
copilot --version

Code Changes

Modified: pkg/workflow/copilot_engine.go - GenerateCopilotInstallerSteps() function
Modified: pkg/workflow/copilot_installer_test.go - Updated tests for new pattern
Modified: pkg/workflow/engine_includes_test.go - Updated test expectations
Modified: pkg/workflow/codex_test.go - Updated test expectations

Test Results

✅ All unit tests passing
✅ Workflow compilation successful
✅ 115 out of 116 workflows recompiled successfully

Benefits

Official Support: Uses the official installer from the Copilot CLI repository
Platform Support: Supports Linux, macOS, and Windows via official script
Architecture Support: Handles x64 and arm64 via official script
Improved Security: No longer pipes script directly to bash
Maintainability: Leverages official installer maintained by Copilot CLI team
Cleaner Output: Single-line command for version export and execution

Original prompt

This section details on the original issue you should resolve

<issue_title>[plan] Add SHA256 checksum verification for Copilot CLI installer script</issue_title>
<issue_description>## Objective

Implement integrity verification for the Copilot CLI installation script to prevent supply chain attacks. Currently, 20+ workflows download and execute an installer script without checksum verification.

Context

Poutine identified unverified_script_exec in multiple workflows. The current pattern executes a downloaded script with sudo privileges without any integrity checks:
- name: Install GitHub Copilot CLI
  run: |
    export VERSION=0.0.369 && curl -fsSL gh.io/copilot-install | sudo bash
Security Risk: If the installation URL is compromised, malicious code could be injected and executed with elevated privileges across all affected workflows.

Approach

Option A: SHA256 Checksum Verification (Recommended)

Obtain official SHA256 checksum for each Copilot CLI version

Download script to temporary location

Verify checksum before execution

Execute verified script
- name: Install GitHub Copilot CLI
  run: |
    curl -fsSL gh.io/copilot-install -o /tmp/copilot-install.sh
    echo "ACTUAL_CHECKSUM  /tmp/copilot-install.sh" | sha256sum -c -
    export VERSION=0.0.369
    sudo bash /tmp/copilot-install.sh
    rm /tmp/copilot-install.sh
Option B: Use Official GitHub Action (If Available)

Research if an official github/copilot-cli-action exists and use it with SHA pinning.

Implementation Steps

Research: Determine official checksum source for Copilot CLI releases

Develop: Create verified installation snippet

Test: Validate in a single workflow (e.g., dev.md)

Document: Update installation docs with secure pattern

Prepare: Document list of all affected workflows for Phase 2 rollout

Note: This issue focuses on developing and testing the solution. A separate issue will handle rollout to all affected workflows.

Files to Create/Modify

Research: Document checksum source location

Test: Update dev.md as proof of concept

Document: Update relevant documentation with secure installation pattern

Acceptance Criteria

Official checksum source identified and documented

Secure installation method implemented and tested

At least one workflow successfully using verified installation

Poutine scan shows zero warnings for tested workflow

Documentation includes secure installation pattern

Rollout plan prepared (list of affected workflows)
Related to [plan] Security remediation: Fix static analysis findings from December 16, 2024 #6672

AI generated by Plan Command for discussion #6670

Comments on the Issue (you are @copilot in this section)

Fixes [plan] Add SHA256 checksum verification for Copilot CLI installer script #6674

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

Changeset

Type: patch
Description: Replace insecure 'curl | sudo bash' Copilot installer usage with official install.sh downloaded to a temporary file, executed, and removed. Tests updated to assert secure installer usage. Fixes [plan] Add SHA256 checksum verification for Copilot CLI installer script #6674

Ahoy! This treasure was crafted by 🏴‍☠️ Changeset Generator

Changeset

Type: patch
Description: Replace insecure 'curl | sudo bash' Copilot installer usage with the official install.sh downloaded to a temporary file, executed, and removed. Tests updated to assert secure installer usage. Fixes [plan] Add SHA256 checksum verification for Copilot CLI installer script #6674

Ahoy! This treasure was crafted by 🏴‍☠️ Changeset Generator

Co-authored-by: mnkiefer <8320933+mnkiefer@users.noreply.github.com>

- Replace installer script with direct binary download - Add SHA256 checksum verification before installation - Implement graceful fallback for older releases without checksums - Update tests to validate new implementation - Test with dev.md workflow as proof of concept Co-authored-by: mnkiefer <8320933+mnkiefer@users.noreply.github.com>

- Fix test expectations for new checksum verification pattern - Add comprehensive documentation about the implementation - Document 74 affected workflows Co-authored-by: mnkiefer <8320933+mnkiefer@users.noreply.github.com>

pelikhan · 2025-12-17T04:22:37Z

@copilot use the script at https://github.com/github/copilot-cli/blob/main/install.sh

@pelikhan

Per @pelikhan feedback, switch to using the official installer script from https://github.com/github/copilot-cli/blob/main/install.sh instead of custom checksum verification implementation. Security improvements: - Download script from official repository (not gh.io redirect) - Save to temporary file before execution (not piped to bash) - Clean up temporary file after installation Updated tests to verify new implementation. Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2025-12-17T04:32:24Z

@copilot use the script at https://github.com/github/copilot-cli/blob/main/install.sh

Updated implementation to use the official install.sh script from the Copilot CLI repository. The script is now downloaded from https://raw.githubusercontent.com/github/copilot-cli/main/install.sh, saved to a temporary file, and executed with the VERSION environment variable.

Security improvements maintained:

Downloads from official repository (not gh.io redirect)
Saves to file before execution (not piped directly to bash)
Includes cleanup of temporary file

Commit: 5b120c4

github-actions · 2025-12-17T04:37:51Z

🔮 The ancient spirits stir... Smoke Codex awakens to divine this pull request...

github-actions · 2025-12-17T04:37:52Z

💥 WHOOSH! Smoke Claude springs into action on this pull request! [Panel 1 begins...]

github-actions · 2025-12-17T04:37:53Z

🎉 Yo ho ho! Changeset Generator found the treasure and completed successfully! ⚓💰

9429ec6

github-actions · 2025-12-17T04:37:56Z

📰 BREAKING: Smoke Copilot is now investigating this pull request. Sources say the story is developing...

pelikhan · 2025-12-17T04:38:06Z

@copilot can do make this a single command?

export VERSION=0.0.369
sudo bash /tmp/copilot-install.sh

@pelikhan

Per @pelikhan feedback, combine the export VERSION and sudo bash commands into a single line using && operator for cleaner output. Changed from: export VERSION=0.0.369 sudo bash /tmp/copilot-install.sh To: export VERSION=0.0.369 && sudo bash /tmp/copilot-install.sh Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2025-12-17T04:44:36Z

@copilot can do make this a single command?

export VERSION=0.0.369...

Combined into a single command using the && operator:

export VERSION=0.0.369 && sudo bash /tmp/copilot-install.sh

Commit: 3664556

github-actions · 2025-12-17T04:46:12Z

💥 WHOOSH! Smoke Claude springs into action on this pull request! [Panel 1 begins...]

github-actions · 2025-12-17T04:46:13Z

🎉 Yo ho ho! Changeset Generator found the treasure and completed successfully! ⚓💰

2e38404

github-actions · 2025-12-17T04:46:13Z

🔮 The ancient spirits stir... Smoke Codex awakens to divine this pull request...

github-actions · 2025-12-17T04:46:14Z

📰 BREAKING: Smoke Copilot is now investigating this pull request. Sources say the story is developing...

github-actions · 2025-12-17T04:48:09Z

Smoke Test Results (Run 20291926982)

Last 2 Merged PRs:

Add HTTP client retry logic with exponential backoff for MCP connections #6694: Add HTTP client retry logic with exponential backoff for MCP connections (@Copilot, assigned @mnkiefer)
Add fuzzy scheduling support for weekly schedules #6693: Add fuzzy scheduling support for weekly schedules (@Copilot, assigned @pelikhan)

Test Results:

✅ GitHub MCP: Retrieved recent PRs successfully
✅ File Writing: Created /tmp/gh-aw/agent/smoke-test-copilot-20291926982.txt
✅ Bash Tool: Verified file creation
✅ Default Toolset: Confirmed get_me tool NOT available (403 error as expected)
✅ Cache Memory: Created /tmp/gh-aw/cache-memory/smoke-test-20291926982.txt
✅ Tools Available: bash, view, edit, create, grep, glob, github-* tools

Status: PASS ✅

📰 BREAKING: Report filed by Smoke Copilot fer issue #6691 🗺️

github-actions · 2025-12-17T04:48:51Z

Smoke Test Results - Claude Engine

Last 2 merged PRs:

Add SessionTimeout to MCP HTTP server to prevent resource leaks #6690: Add SessionTimeout to MCP HTTP server
Add HTTP client retry logic with exponential backoff for MCP connections #6694: Add HTTP client retry logic with exponential backoff

Test Results:
✅ GitHub MCP (fetch PRs)
✅ File Writing (/tmp/gh-aw/agent/)
✅ Bash Tool (file verification)
✅ Playwright MCP (GitHub.com page title verified)
✅ Cache Memory (/tmp/gh-aw/cache-memory/)
❌ safeinputs-gh tool (not available)

Status: PARTIAL PASS (5/6 tests passed)

💥 [THE END] — Illustrated by Smoke Claude fer issue #6691 🗺️

github-actions · 2025-12-17T04:49:12Z

Merged PRs: Add SessionTimeout to MCP HTTP server to prevent resource leaks | Extract MCP timeout constants for maintainability
GitHub MCP: ✅
Agent file write: ✅
Bash cat verify: ✅
Playwright title check: ✅
Cache memory write: ✅
safeinputs-gh issues list: ❌ (tool unavailable here)
Overall: FAIL

🔮 The oracle has spoken through Smoke Codex fer issue #6691 🗺️

Initial plan

91604a5

Copilot AI assigned Copilot and mnkiefer Dec 17, 2025

Copilot started work on behalf of mnkiefer December 17, 2025 01:32 View session

Copilot AI and others added 3 commits December 17, 2025 01:37

Initial plan for Copilot CLI installer checksum verification

7a3e948

Co-authored-by: mnkiefer <8320933+mnkiefer@users.noreply.github.com>

Update tests and documentation for checksum verification

ec36952

- Fix test expectations for new checksum verification pattern - Add comprehensive documentation about the implementation - Document 74 affected workflows Co-authored-by: mnkiefer <8320933+mnkiefer@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Add SHA256 checksum verification for CLI installer script~~ Add SHA256 checksum verification for Copilot CLI installation Dec 17, 2025

Copilot AI requested a review from mnkiefer December 17, 2025 01:59

Copilot finished work on behalf of mnkiefer December 17, 2025 01:59

Copilot started work on behalf of pelikhan December 17, 2025 04:23 View session

Copilot AI changed the title ~~Add SHA256 checksum verification for Copilot CLI installation~~ Use official Copilot CLI installer script with security improvements Dec 17, 2025

Copilot AI requested a review from pelikhan December 17, 2025 04:33

Copilot finished work on behalf of pelikhan December 17, 2025 04:33

pelikhan added the smoke label Dec 17, 2025

Copilot started work on behalf of pelikhan December 17, 2025 04:38 View session

github-actions Bot added the smoke-copilot label Dec 17, 2025

This comment has been minimized.

Sign in to view

Add changeset for Copilot installer security fix [skip-ci]

9429ec6

github-actions Bot added the smoke-claude label Dec 17, 2025

This comment has been minimized.

Sign in to view

Copilot finished work on behalf of pelikhan December 17, 2025 04:45

pelikhan added smoke and removed smoke labels Dec 17, 2025

Add changeset [skip-ci]

2e38404

pelikhan marked this pull request as ready for review December 17, 2025 04:49

pelikhan merged commit 01a5715 into main Dec 17, 2025
6 checks passed

pelikhan deleted the copilot/add-sha256-checksum-verification branch December 17, 2025 04:49

Copilot AI mentioned this pull request Dec 17, 2025

Verify secure Copilot CLI installation rollout is complete #6698

Closed

Conversation

Copilot AI commented Dec 17, 2025 • edited by agentic-workflows-dev Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Plan: Add SHA256 Checksum Verification for Copilot CLI Installer Script

Summary

Implementation Details

Security Improvements Over Original

Installation Pattern

Code Changes

Test Results

Benefits

Context

Approach

Option A: SHA256 Checksum Verification (Recommended)

Option B: Use Official GitHub Action (If Available)

Implementation Steps

Files to Create/Modify

Acceptance Criteria

Comments on the Issue (you are @copilot in this section)

Changeset

Changeset

Uh oh!

pelikhan commented Dec 17, 2025

Uh oh!

Copilot AI commented Dec 17, 2025

Uh oh!

github-actions Bot commented Dec 17, 2025

Uh oh!

github-actions Bot commented Dec 17, 2025

Uh oh!

github-actions Bot commented Dec 17, 2025 • edited by agentic-workflows-dev Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Dec 17, 2025

Uh oh!

pelikhan commented Dec 17, 2025

Uh oh!

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

Copilot AI commented Dec 17, 2025

Uh oh!

github-actions Bot commented Dec 17, 2025

Uh oh!

github-actions Bot commented Dec 17, 2025 • edited by agentic-workflows-dev Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Dec 17, 2025

Uh oh!

github-actions Bot commented Dec 17, 2025

Uh oh!

github-actions Bot commented Dec 17, 2025

Smoke Test Results (Run 20291926982)

Uh oh!

github-actions Bot commented Dec 17, 2025

Smoke Test Results - Claude Engine

Uh oh!

github-actions Bot commented Dec 17, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Copilot AI commented Dec 17, 2025 •

edited by agentic-workflows-dev Bot

Loading

github-actions Bot commented Dec 17, 2025 •

edited by agentic-workflows-dev Bot

Loading

github-actions Bot commented Dec 17, 2025 •

edited by agentic-workflows-dev Bot

Loading