Enforce gh-aw v0.85.3 security compatibility floor

[Copilot]

Updates the compatibility policy for GHSA-8h78-hpm7-29gg and adds reusable guidance for translating security advisories into targeted compatibility changes.

Changes

• Compatibility enforcement

  • Raises minimumVersion from v0.65.3 to v0.85.3.
  • Preserves blocked, recommended, and agent compatibility policies.

• Advisory workflow

  • Adds security-advisory-compat-enforcer.
  • Requires evidence-backed policy selection, monotonic version floors, schema validation, and preservation of unrelated fields.

"minimumVersion": "v0.85.3"

[pelikhan]

@copilot can you ban the range of releases flagged by the advisory?

[Copilot]

@copilot can you ban the range of releases flagged by the advisory?

Addressed in 313ee1e: blockedVersions now enumerates every affected release from v0.82.8 through v0.85.2, while the general minimum remains v0.65.3.

[pelikhan]

@copilot v0.85.4 it's the first valid version that doesn't contain such a misreading of the advisory—or is the advisory…

[Copilot]

@copilot v0.85.4 it's the first valid version that doesn't contain such a misreading of the advisory—or is the advisory…

Corrected in b435280: v0.85.3 is now blocked, so v0.85.4 is the first allowed release.

[pelikhan]

@copilot update the skill to make sure to run a schema validator on compat.json (there should be a task in main), also maintain a compat.md that lists why these versions are blocked linking to the advisories

[Copilot]

@copilot update the skill to make sure to run a schema validator on compat.json (there should be a task in main), also maintain a compat.md that lists why these versions are blocked linking to the adv...

Addressed in b3644de: the skill now requires the compatibility CI task plus Draft 7 schema validation, and .github/aw/compat.md documents the blocked v0.82.8–v0.85.3 range with the GHSA link.

[pelikhan]

@copilot ensure that there is a unit test that validate that compat.json is valid w.r.t to the compat schema.

[pelikhan]

@copilot the skill should tell the agent to provide remediation instructions, similarly to the advisory (see updated content in https://github.com/github/gh-aw/security/advisories/GHSA-8h78-hpm7-29gg)

Review the skill wording and habits and apply best practices from the security comunity, known CVE way of wording, specifying things.

[Copilot]

@copilot ensure that there is a unit test that validate that compat.json is valid w.r.t to the compat schema.

Addressed in e5e0922: added TestCompatJSONConformsToSchema, which compiles .github/aw/compat.schema.json and validates .github/aw/compat.json against it.

[Copilot]

@copilot the skill should tell the agent to provide remediation instructions, similarly to the advisory (see updated content in https://github.com/github/gh-aw/security/advisories/GHSA-8h78-hpm7-29gg)...

Addressed in 1033341: the skill now requires evidence-backed affected/fixed version wording, permanent remediation commands, separate mitigation/workaround language, artifact regeneration, verification, and authoritative references. compat.md now documents the v0.85.4 upgrade and workflow regeneration steps.

[github-actions]

Category: chore | Risk: medium | Score: 44/100 (impact 20/50, urgency 10/30, quality 14/20) | Action: defer | Batch: workflow-runtime

Generated by 🔧 PR Triage Agent · copilot · mai10 · 12.3 AIC · ⌖ 2.45 AIC · ⊞ 15.6K · ◷