fix: move sink-visibility to env var to prevent zizmor template-injection - #48589

Merged

pelikhan merged 8 commits into

mainfrom

copilot/compiler-fix-sink-visibility

Jul 28, 2026

Commits on Jul 28, 2026

Initial plan
Copilot
authored
fix: move sink-visibility to env var to prevent zizmor template-injection

Copilot
and
pelikhan
authored
fix: set GH_AW_SINK_VISIBILITY for gh-proxy mode workflows

Copilot
and
pelikhan
authored
fix: remove toJSON() from GH_AW_SINK_VISIBILITY to fix double-encoding

Copilot
and
pelikhan
authored
Add changeset for sink visibility fix
github-actions[bot]
authored
fix: rebase PR 48632 fixes - add sinkVisibilityEnvVar constant, sorted policy iteration, and case string handler

Copilot
and
pelikhan
authored
Merge branch 'main' into copilot/compiler-fix-sink-visibility
pelikhan
authored
Merge branch 'main' into copilot/compiler-fix-sink-visibility
pelikhan
authored