Repository navigation
Fall back to pinned Copilot CLI when live compatibility targets lack trusted checksums - #71339
Merged
Merged
Conversation
…ewed Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Bind the compiler default CLI version to its reviewed manifest SHA256, resolve both constants from reviewed release pins, and reject missing default pins during compilation. Preserve cache-first installation with --prefer-toolcache while keeping explicit workflow pins download-only. Add actionable missing-pin remediation and cover compiler, resolver, cache, and musl behavior. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Regenerate workflow lock files to inline the default Copilot CLI version, manifest SHA256, and cache-first installer flag. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Contributor
There was a problem hiding this comment.
🔵 Needs a closer look
Default installs bypass the promised compatibility safeguards, and the broader supply-chain behavior change needs human design and security review.
1 open issue
What changed in this PR
Addresses #71332’s Copilot CLI installation failure by adding reviewed-pin fallback handling and embedding the compiler’s default version/checksum pair in generated workflows.
Changes:
- Add compatibility-bounded fallback and checksum-aware cache options.
- Propagate the compiler’s reviewed default pin across installation jobs.
- Add offline pin-update tooling, regression coverage, snapshots, and documentation.
| File | Description |
|---|---|
scripts/update-copilot-version.sh |
Updates default version and checksum together. |
scripts/update-copilot-version_test.sh |
Tests offline updates and failure handling. |
scripts/test-wasm-golden.mjs |
Normalizes default installation pins. |
pkg/workflow/wasm_golden_test.go |
Tests pin normalization in snapshots. |
pkg/workflow/testdata/TestWasmGolden_CompileFixtures/with-imports.golden |
Updates imported-workflow installation snapshot. |
pkg/workflow/testdata/TestWasmGolden_CompileFixtures/smoke-copilot.golden |
Updates main and detection installation snapshots. |
pkg/workflow/testdata/TestWasmGolden_CompileFixtures/playwright-cli-mode.golden |
Updates Playwright fixture installation snapshot. |
pkg/workflow/testdata/TestWasmGolden_CompileFixtures/basic-copilot.golden |
Updates basic Copilot installation snapshot. |
pkg/workflow/testdata/TestWasmGolden_AllEngines/copilot.golden |
Updates Copilot engine installation snapshot. |
pkg/workflow/release_integrity_validation.go |
Validates the compiler’s default release pin. |
pkg/workflow/release_integrity_validation_test.go |
Tests validation and cross-job pin propagation. |
pkg/workflow/firewall_version_pinning_test.go |
Checks default checksum against bootstrap pins. |
pkg/workflow/copilot_installer.go |
Emits default version, checksum, and cache flags. |
pkg/workflow/copilot_installer_test.go |
Updates generated-installation expectations. |
pkg/workflow/copilot_engine_installation.go |
Routes omitted versions through shared default pinning. |
pkg/constants/version_constants.go |
Adds the default Copilot manifest digest. |
Makefile |
Registers the pin-updater regression tests. |
docs/src/content/docs/reference/engines/copilot.md |
Documents default pinning and maintenance. |
actions/setup/sh/release_integrity.sh |
Expands missing-pin recovery guidance. |
actions/setup/sh/release_integrity_test.sh |
Covers fallback bounds, checksums, and cache behavior. |
actions/setup/sh/install_copilot_cli.sh |
Adds guarded fallback and pinned cache reuse. |
Review effort: Max
Comment on lines
+15
to
+16
| if version == "" { | ||
| version = string(constants.DefaultCopilotVersion) |
Contributor
|
🎉 This pull request is included in a new release. Release: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
AW 0.93.0 can fail to install Copilot CLI on runners without a compatible cached binary: the live compatibility matrix may select a release whose checksum pin is absent from the setup action.