fix(security): replace curl|sh installer pipes with download+verify (RGS-018)#43716

Merged

pelikhan merged 33 commits into

mainfrom

copilot/static-analysis-report-2026-07-06

Jul 8, 2026

Commits on Jul 6, 2026

Initial plan
Copilot
authored
Initial plan checkpoint

Copilot
and
pelikhan
authored
fix(security): replace curl|sh installer patterns with download+verify (RGS-018)

Copilot
and
pelikhan
authored
Merge branch 'main' into copilot/static-analysis-report-2026-07-06
pelikhan
authored
fix: use /tmp/gh-aw/ folder for installer temp files

Copilot
and
pelikhan
authored
Merge branch 'main' into copilot/static-analysis-report-2026-07-06
pelikhan
authored
fix(security): pin installer refs to resolved SHA in dev-mode templates (RGS-018)

Copilot
and
gh-aw-bot
authored
Merge remote-tracking branch 'origin/main' into copilot/static-analysis-report-2026-07-06
Copilot
authored
fix: sh→bash for Ollama, add SHA update docs, trufflehog arch note + --no-same-owner

Copilot
and
gh-aw-bot
authored
Merge branch 'main' into copilot/static-analysis-report-2026-07-06
github-actions[bot]
authored
fix(security): pin copilotSetupStepsYAML constant to immutable SHA; add arch guard to trufflehog.md

Copilot
and
gh-aw-bot
authored
Merge remote-tracking branch 'origin/main' into copilot/static-analysis-report-2026-07-06
Copilot
authored
fix(security): add SHA256 integrity check to dev-mode install-gh-aw.sh download

Copilot
and
gh-aw-bot
authored
fix(security): add input validation guards for SHA values in install script helpers

Copilot
and
gh-aw-bot
authored
refactor: extract installScriptTempPath constant, simplify sha256 guards

Copilot
and
gh-aw-bot
authored
refactor: use installScriptTempPath constant in fmt.Sprintf and add const comment

Copilot
and
gh-aw-bot
authored

Commits on Jul 7, 2026