[Safe Outputs Conformance] SEC-005: Conformance checker false-positives on unified_session_payload.cjs and unified_session_render.cjs (needs exemption anno #70449

Conformance Check Failure

Check ID: SEC-005
Severity: HIGH
Category: Security

Problem Description

scripts/check-safe-outputs-conformance.sh (Cross-Repository Validation) flags two files for referencing targetRepo without an allowlist check:

[HIGH] SEC-005: actions/setup/js/unified_session_payload.cjs supports target-repo but lacks allowlist check
[HIGH] SEC-005: actions/setup/js/unified_session_render.cjs supports target-repo but lacks allowlist check

Investigation result: this is a checker false positive, not a security gap. In both files, targetRepo is only used as a telemetry/display field name:

• actions/setup/js/unified_session_payload.cjs line 426 - targetRepo is listed in the workflow.info event field-name mapping (EVENT_FIELDS), used purely to normalize incoming session-event JSON keys for logging.
• actions/setup/js/unified_session_render.cjs line 273 - targetRepo is included in the field list passed to a human-readable log-line renderer for the session.init event.

Neither file performs an octokit call or any cross-repo write keyed off this field, so the SEC-005 allowlist requirement (which protects handlers that actually act on a target repo, e.g. create_issue.cjs, create_pull_request.cjs) does not apply here. All genuine cross-repo write handlers in actions/setup/js already pass this check.

Affected Components

• Files:

  • actions/setup/js/unified_session_payload.cjs (line 426)
  • actions/setup/js/unified_session_render.cjs (line 273)

• Checker: scripts/check-safe-outputs-conformance.sh (SEC-005, lines 171-198) already supports a documented exemption mechanism via an @safe-outputs-exempt SEC-005 annotation (lines 180-183), which these files should use.

Remediation Steps

This task can be assigned to a Copilot coding agent with the following steps:

1. Confirm (re-verify) that unified_session_payload.cjs and unified_session_render.cjs only read/normalize/log the targetRepo field and never pass it into an octokit write call.
2. Add a one-line documented exemption comment near the top of each file, e.g. // @safe-outputs-exempt SEC-005: targetRepo is used for telemetry field mapping/log rendering only; no cross-repo write originates here.
3. Re-run bash scripts/check-safe-outputs-conformance.sh and confirm SEC-005 reports PASS.
4. If either file is later changed to actually perform a cross-repo write keyed off targetRepo, remove the exemption and add real allowlist validation (allowedRepos/validateTargetRepo/checkAllowedRepo) instead.

Verification

After remediation, verify the fix by running: bash scripts/check-safe-outputs-conformance.sh

The check SEC-005 should pass without errors.

References

• Safe Outputs Specification: docs/src/content/docs/specs/safe-outputs-specification.md
• Conformance Checker: scripts/check-safe-outputs-conformance.sh
• Run ID: 39376524099
• Date: 2026-10-20

Generated by ✅ Daily Safe Outputs Conformance Checker · claude · agent · 98 AIC · ⌖ 0.625 AIC · ⊞ 5.4K · ◷

• expires on Oct 20, 2026, 9:53 PM UTC-08:00