[integrity-audit] Integrity Filtering Audit — github/gh-aw — 2026-07-21

[github-actions]

Integrity Filtering Audit — github/gh-aw

Audit period: Last 24 hours (2026-07-20T06:45Z – 2026-07-21T06:45Z)
Audit run: 29807798967
Runs analyzed: 60 completed runs in github/gh-aw
Runs with agent artifacts: 10 (artifact download blocked by secrecy policy)

---

Findings Summary

Severity	Count	Description
🔴 Critical	0	None
🟡 Warning	2	Agent CLI failures (VulnHunter timeout, Model Resolution Audit); DIFC artifact data unavailable for deep inspection
🟢 Info	4	DIFC secrecy filtering confirmed; guard policies correctly configured; no bypass attempts; action_required early-exits expected

Critical Findings

None identified.

Warnings

W-1: Daily VulnHunter Scan — Agent Failure (Timeout)

Run: 29807147048
Workflow: daily-vulnhunter-scan.lock.yml (claude-opus-4.6)
Step failed: Execute Claude Code CLI — ran for 609 seconds before failure
DIFC posture: Uses github-mcp-server:v1.6.0 with allow-only guard policy (min-integrity: $GITHUB_MCP_GUARD_MIN_INTEGRITY, repos: $GITHUB_MCP_GUARD_REPOS). Read-only (GITHUB_READ_ONLY=1). Toolsets: context,repos,issues,pull_requests.

The agent infrastructure (MCP Gateway, firewall, detection) completed successfully. The failure is in the Claude Code CLI execution itself after ~10 minutes. This is likely a task timeout or a logic error in the vulnerability scanning workflow, not a DIFC misconfiguration.

Note: Since artifact downloads are blocked by the secrecy policy, the rpc-messages.jsonl and mcp-gateway.log files cannot be directly inspected. However, the job steps Stop MCP Gateway, Redact secrets in logs, Parse MCP Gateway logs for step summary, and Print firewall logs all succeeded post-failure, indicating the gateway shut down cleanly.

W-2: Daily Sub-Agent Model Resolution Audit — Agent Failure

Run: 29806493363
Workflow: daily-model-resolution.lock.yml (gpt-5.4-mini)
Step failed: Execute GitHub Copilot CLI
DIFC posture: Uses a locally-built agenticworkflows container (no external GitHub MCP server). The workflow builds the gh-aw CLI from source (Docker image localhost/gh-aw:dev) and uses write-sink guard policies. Does not use tools.github / github-mcp-server.

The activation, MCP Gateway startup, and post-processing steps all succeeded. This appears to be an agent logic or configuration failure (sub-agent model resolution test), not a DIFC issue.

Informational

I-1: DIFC Secrecy Filtering Confirmed Operational

During this audit, the DIFC secrecy policy correctly blocked two categories of privileged access:

• Artifact downloads (download_workflow_run_artifact): [Filtered] resource:actions_get exists but is not accessible — filtered by secrecy policy
• Job log access (get_job_logs): [Filtered] resource:get_job_logs exists but is not accessible — filtered by secrecy policy

This confirms that the MCP Gateway secrecy-label enforcement is functioning correctly for this audit integration. The audit agent was correctly denied access to private-scoped workflow artifacts and logs.

I-2: Guard Policies Properly Configured

Inspected workflow configurations for runs with GitHub MCP server access:

Workflow	MCP Server	Guard Policy	Read-Only	Toolsets
Daily VulnHunter Scan	github-mcp-server:v1.6.0	allow-only (repos + min-integrity)	Yes	context, repos, issues, pull_requests
Sighthound Security Scan	github-mcp-server:v1.6.0	allow-only (repos + min-integrity)	Yes	context, repos, issues, pull_requests
Daily Safe Outputs Conformance	None (safeoutputs only)	write-sink	N/A	N/A
Daily Sub-Agent Model Resolution	Local agenticworkflows	write-sink	N/A	N/A
PR Sous Chef, Schema Checker, etc.	Varies	write-sink	N/A	N/A

Firewall container gh-aw-firewall v0.27.37 is consistently used across all agentic runs, with a properly scoped allowDomains list that includes api.github.com, github.com, and Copilot API endpoints. Network isolation is enabled ("isolation":true).

I-3: No External API Bypass Attempts Detected

No evidence of agents attempting to contact api.github.com, chatgpt.com, api.openai.com, or other external services directly. All workflows route through the MCP Gateway (awmg-mcpg:8080) as expected. Network topology attachment (topologyAttach: ["awmg-mcpg", "awmg-cli-proxy"]) is correctly configured.

I-4: Action-Required Early-Exits (Expected)

Multiple PR-triggered workflows ended with action_required (pre-activation guardrail):

• Test Quality Sentinel (29807173201)
• Design Decision Gate (29807173195)
• PR Code Quality Reviewer (29807173152)
• Matt Pocock Skills Reviewer (29807173141)
• Impeccable Skills Reviewer (29807173136)
• CWI / CGO (multiple)
• Label Closed PRs / PR Description Updater (multiple)

These are expected: the agent was never invoked, so no MCP traffic or DIFC filtering occurred.

I-5: MCP Artifact Deep Inspection Unavailable

As noted in previous audits, artifact downloads are blocked by the DIFC secrecy policy. Cannot directly verify:

• DIFC event counts from rpc-messages.jsonl
• Guard error counts from mcp-gateway.log
• Filtering ratios or integrity tag scoping

The rpc-messages.jsonl and mcp-gateway.log deep-audit requires either: (a) elevated secrecy permissions for the audit agent, or (b) a summary step that writes aggregate DIFC stats to the GitHub Step Summary (publicly readable).

---

Runs Analyzed

Run	Workflow	Branch	Agent Invoked	Artifacts	Status
29807555251	Running Copilot Code Review	copilot/add-sprintfbool-linter	✅	0	✅ success
29807289647	Agentic Commands	copilot/add-sprintfbool-linter	✅ route	0	✅ success
29807270445	Agentic Commands	copilot/add-sprintfbool-linter	✅ route	0	✅ success
29807179619	Running Copilot Code Review	copilot/review-and-improve-pr-46973	✅	0	✅ success
29807147048	Daily VulnHunter Scan	main	✅	7	❌ failure
29807067973	Daily Safe Outputs Conformance Checker	main	✅	7	✅ success
29806936696	Agentic Commands	copilot/review-and-improve-pr-46973	✅ route	0	✅ success
29806922615	AI Moderator	copilot/review-and-improve-pr-46973	✅	0	✅ success
29806922582	Agentic Commands	copilot/review-and-improve-pr-46973	✅ route	0	✅ success
29806922559	Content Moderation	copilot/review-and-improve-pr-46973	✅	0	✅ success
29806509918	Daily AgentRx Trace Optimizer	main	✅	8	✅ success
29806496418	Multi-Device Docs Tester	main	✅	6	✅ success
29806493363	Daily Sub-Agent Model Resolution Audit	main	✅	6	❌ failure
29806478521	PR Sous Chef	main	✅	6	✅ success
29806458607	GitHub Remote MCP Authentication Test	main	✅	8	✅ success
29806407418	CLI Version Checker	main	✅	—	✅ success
29806384829	Schema Consistency Checker	main	✅	7	✅ success
29806182389	Running Copilot cloud agent	copilot/add-sprintfbool-linter	✅	0	✅ success
29806173098	Running Copilot cloud agent	copilot/aw-failures-fix-auto-pricing	✅	0	✅ success
29806000813	ESLint Refiner	main	✅	7	✅ success
29805908218	Daily Cli Tools Tester	main	✅	8	✅ success
29805895900	Sighthound Security Scan	main	✅	7	✅ success
29805881339	Issue Monster	main	✅	7	✅ success

Multiple CI/infra runs (CI, CGO, CWI, CJS, Deployment Incident Monitor, Label Closed PRs, etc.) omitted — no agent invocation.

---

Recommendations

1. Investigate VulnHunter timeout: The Execute Claude Code CLI step consistently fails around the 10-minute mark. Review the claude-opus-4.6 agent prompt and task scope in daily-vulnhunter-scan.md — the scanning task may be too broad for a single session, or the Claude Code CLI is hitting a rate limit or context window limit.

2. Investigate Sub-Agent Model Resolution Audit failure: The Execute GitHub Copilot CLI step fails. Review daily-model-resolution.md and the gpt-5.4-mini model behavior. Since this workflow builds the gh-aw CLI from source, check whether the build artifacts are compatible with the CLI proxy.

3. Enable DIFC audit telemetry: As noted in prior audits, the audit cannot verify DIFC event counts (labelled/filtered) without artifact access. Consider having the MCP Gateway parse step summary output aggregate DIFC stats to the GitHub Step Summary. This would allow the audit workflow to read aggregate DIFC event counts without needing direct artifact access.

4. Confirm allow-only scope includes current repository: The VulnHunter and Sighthound workflows use repos: $GITHUB_MCP_GUARD_REPOS — verify this resolves to a scoped value (e.g., github/gh-aw) and is not left empty or set to public unexpectedly.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by Integrity Filtering Audit · 234.2 AIC · ⊞ 8.1K · ◷

• expires on Jul 28, 2026, 6:54 AM UTC

[github-actions]

This issue is being closed as outdated. A newer issue has been created: #9818

View newer issue

---

This action was performed automatically by the Integrity Filtering Audit workflow.