fix(security): replace curl|sh installer pipes with download+verify (RGS-018)

.github/workflows/copilot-setup-steps.yml

@@ -13,12 +13,12 @@ jobs:
     permissions:
       contents: read
     steps:
-    - name: Install gh-aw extension
-      run: curl -fsSL https://raw.githubusercontent.com/github/gh-aw/refs/heads/main/install-gh-aw.sh | bash
     - name: Checkout code
       uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       with:
         persist-credentials: false
+    - name: Install gh-aw extension
+      run: bash install-gh-aw.sh
     - name: Set up Node.js
       uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f
       with:

.github/workflows/daily-byok-ollama-test.md

@@ -20,8 +20,17 @@ strict: true
 timeout-minutes: 20
 steps:
   - name: Install Ollama
+    env:
+      OLLAMA_VERSION: "0.31.1"
+      # SHA256 of install.sh from https://github.com/ollama/ollama/releases/download/v${OLLAMA_VERSION}/install.sh
+      # To update: curl -fsSL https://github.com/ollama/ollama/releases/download/vNEW_VERSION/install.sh | sha256sum
+      OLLAMA_INSTALL_SHA256: "25f64b810b947145095956533e1bdf56eacea2673c55a7e586be4515fc882c9f"
     run: |
-      curl -fsSL https://ollama.com/install.sh | sh
+      echo "Downloading Ollama v${OLLAMA_VERSION} install script..."
+      mkdir -p /tmp/gh-aw
+      curl -fsSL "https://github.com/ollama/ollama/releases/download/v${OLLAMA_VERSION}/install.sh" -o /tmp/gh-aw/ollama-install.sh
+      echo "${OLLAMA_INSTALL_SHA256}  /tmp/gh-aw/ollama-install.sh" | sha256sum -c -
+      bash /tmp/gh-aw/ollama-install.sh
   - name: Generate Ollama API key
     run: |
       OLLAMA_API_KEY="$(openssl rand -hex 16)"

.github/workflows/shared/trufflehog.md

@@ -38,9 +38,22 @@ jobs:
         id: install-trufflehog
         env:
           TRUFFLEHOG_VERSION: "3.88.27"
+          # SHA256 of the linux_amd64 .tar.gz from the pinned release. Only GitHub-hosted ubuntu-latest runners
+          # (always amd64) are supported; self-hosted ARM runners will need a separate per-arch hash.
+          # To update: curl -fsSL https://github.com/trufflesecurity/trufflehog/releases/download/vNEW/trufflehog_NEW_linux_amd64.tar.gz | sha256sum
+          TRUFFLEHOG_SHA256: "e3b2647b7a7bc1591f316da91fd33fc7397f8e3c21e2feed791c171f0c406bc7"
         run: |
-          echo "Installing TruffleHog v${TRUFFLEHOG_VERSION}..."
-          curl -sSfL https://raw.githubusercontent.com/trufflesecurity/trufflehog/main/scripts/install.sh | sh -s -- -b /usr/local/bin "v${TRUFFLEHOG_VERSION}"
+          ARCH=$(uname -m)
+          if [ "$ARCH" != "x86_64" ]; then
+            echo "::error::TruffleHog installation only supports x86_64 (linux_amd64); detected $ARCH. Self-hosted ARM runners must install TruffleHog separately."
+            exit 1
+          fi
+          echo "Downloading TruffleHog v${TRUFFLEHOG_VERSION}..."
+          mkdir -p /tmp/gh-aw
+          curl -fsSL "https://github.com/trufflesecurity/trufflehog/releases/download/v${TRUFFLEHOG_VERSION}/trufflehog_${TRUFFLEHOG_VERSION}_linux_amd64.tar.gz" -o /tmp/gh-aw/trufflehog.tar.gz
+          # SHA256 covers the .tar.gz archive; the binary is extracted from the verified archive
+          echo "${TRUFFLEHOG_SHA256}  /tmp/gh-aw/trufflehog.tar.gz" | sha256sum -c -
+          sudo tar -xzf /tmp/gh-aw/trufflehog.tar.gz --no-same-owner -C /usr/local/bin trufflehog
           trufflehog --version
 
       - name: Scan agent output for secrets

Makefile

@@ -1013,6 +1013,13 @@ sync-action-scripts:
 	@chmod +x actions/setup-cli/install.sh
 	@echo "✓ Action scripts synced successfully"
 
+# Sync install-gh-aw.sh SHA/hash constants in pkg/cli/copilot_setup.go
+.PHONY: sync-install-script-hashes
+sync-install-script-hashes:
+	@echo "Updating install-gh-aw.sh SHA and SHA256 constants..."
+	@bash scripts/update-install-script-hashes.sh
+	@echo "✓ Install script hashes synced successfully"
+
 # Recompile all workflow files
 .PHONY: recompile
 recompile: build
@@ -1052,6 +1059,7 @@ dependabot: build
 update: build
 	./$(BINARY_NAME) update
 	$(MAKE) sync-action-pins
+	$(MAKE) sync-install-script-hashes
 	$(MAKE) build
 
 # Run development server
@@ -1190,6 +1198,7 @@ help:
 	@echo "  install          - Install binary locally"
 	@echo "  sync-action-pins - Sync actions-lock.json from .github/aw to pkg/actionpins/data and pkg/workflow/data (runs automatically during build)"
 	@echo "  sync-action-scripts - Sync install-gh-aw.sh to actions/setup-cli/install.sh (runs automatically during build)"
+	@echo "  sync-install-script-hashes - Update install-gh-aw.sh SHA and SHA256 constants in pkg/cli/copilot_setup.go (runs automatically during update)"
 	@echo "  update           - Update GitHub Actions and workflows, sync action pins, and rebuild binary"
 	@echo "  fix              - Apply automatic codemod-style fixes to workflow files (depends on build)"
 	@echo "  recompile        - Recompile all workflow files (runs init, depends on build)"