[oblt-aw][security] Fix SEC-022 secret scoping in reusable workflows

[github-actions]

Closes #819

Summary

This remediates SEC-022 least-privilege findings by removing broad secret inheritance from reusable workflow calls and forwarding only COPILOT_GITHUB_TOKEN where needed.

Resolution Plan Checklist

• Identify SEC-022-style secrets: inherit usages in affected workflows
• Replace inherited secrets with explicit least-privilege secret forwarding
• Add/align workflow_call secret contracts for wrappers that forward secrets
• Update related workflow documentation
• Run validation and confirm remediation

Changes Implemented

• Replaced secrets: inherit with explicit COPILOT_GITHUB_TOKEN forwarding in:
  • .github/workflows/oblt-aw-ingress.yml (autodoc, issue-fixer, resource-not-accessible-by-integration-fixer, security-fixer jobs)
  • .github/workflows/gh-aw-agent-suggestions.yml
  • .github/workflows/gh-aw-resource-not-accessible-by-integration-detector.yml
  • .github/workflows/gh-aw-security-fixer.yml
  • .github/workflows/gh-aw-autodoc.yml (audit, fix jobs)
  • .github/workflows/gh-aw-issue-fixer.yml
  • .github/workflows/gh-aw-resource-not-accessible-by-integration-fixer.yml
• Added explicit workflow_call secret declarations:
  • .github/workflows/gh-aw-issue-fixer.yml
  • .github/workflows/gh-aw-resource-not-accessible-by-integration-fixer.yml
• Updated docs:
  • docs/workflows/gh-aw-issue-fixer.md
  • docs/workflows/gh-aw-resource-not-accessible-by-integration-fixer.md

Validation Evidence

npm test --silent
6 passed, 0 failed

/tmp/gh-aw/agent/venv/bin/pytest tests/ -q
89 passed, 0 failed

grep -R --line-number -E "secrets:[[:space:]]*inherit" .github/workflows
(no matches)

bash scripts/security-scan.sh .
scripts/install_security_detector_tools.sh|21|SEC-032|high|Download via curl/wget without obvious checksum/signature verification in this script.
(no SEC-022 findings)

Security Control Confirmation

• Least-privilege: applied by replacing inherited secret propagation with explicit forwarding of only COPILOT_GITHUB_TOKEN.
• Env-indirection: preserved; this change introduces no secret interpolation in run: command strings.

Note

🔒 Integrity filter blocked 31 items

The following items were blocked because they don't meet the GitHub integrity level.

• [oblt-aw][security] SEC-022 — findings (2026-05-08) #819 issue_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #819 issue_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• [oblt-aw][security] SEC-032 — findings (2026-05-08) #822 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• [oblt-aw][security] SEC-031 — findings (2026-05-08) #821 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• [oblt-aw][security] SEC-030 — findings (2026-05-08) #820 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• [oblt-aw][security] SEC-022 — findings (2026-05-08) #819 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• [oblt-aw][security] SEC-010 — findings (2026-05-08) #818 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• [oblt-aw][security] SEC-032 — findings (2026-05-07) #814 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• [oblt-aw][security] SEC-031 — findings (2026-05-07) #813 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• [oblt-aw][security] SEC-030 — findings (2026-05-07) #812 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• [oblt-aw][security] SEC-022 — findings (2026-05-07) #811 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• [oblt-aw][security] SEC-010 — findings (2026-05-07) #810 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• [oblt-aw][security] SEC-032 — findings (2026-05-06) #803 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• [oblt-aw][security] SEC-031 — findings (2026-05-06) #802 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• [oblt-aw][security] SEC-030 — findings (2026-05-06) #801 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• [oblt-aw][security] SEC-022 — findings (2026-05-06) #800 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• ... and 15 more items

To allow these resources, lower min-integrity in your GitHub frontmatter:

tools:
  github:
    min-integrity: approved  # merged | approved | unapproved | none

---

What is this? | From workflow: Observability Agentic Workflow Entrypoint

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

---

Note

This was originally intended as a pull request, but the git push operation failed.

Workflow Run: View run details and download bundle artifact

The bundle file is available in the agent artifact in the workflow run linked above.

To create a pull request with the changes:

# Download the artifact from the workflow run
gh run download 25541826962 -n agent -D /tmp/agent-25541826962

# Fetch the bundle into a local branch
git fetch /tmp/agent-25541826962/aw-fix-sec-022-secret-scoping-issue-819.bundle refs/heads/fix/sec-022-secret-scoping-issue-819:refs/heads/fix/sec-022-secret-scoping-issue-819-73895681a8f28bc0
git checkout fix/sec-022-secret-scoping-issue-819-73895681a8f28bc0

# Push the branch to origin
git push origin fix/sec-022-secret-scoping-issue-819-73895681a8f28bc0

# Create the pull request
gh pr create --title '[oblt-aw][security] Fix SEC-022 secret scoping in reusable workflows' --base main --head fix/sec-022-secret-scoping-issue-819-73895681a8f28bc0 --repo elastic/oblt-aw