feat: enable checksum validation by default in install-gh-aw.sh by Copilot · Pull Request #29223 · github/gh-aw

Copilot · 2026-04-30T00:55:02Z

Summary

Enable SHA256 checksum validation by default when installing the gh-aw binary.

Background

scripts/build-release.sh already generates a checksums.txt file during the build process, and the release workflow uploads all dist/* files (including checksums.txt) to every GitHub release. The validation logic in both install scripts was fully implemented but gated behind SKIP_CHECKSUM=true (the default), pending checksums being available in releases.

Since checksums are now consistently published, this PR flips the default to SKIP_CHECKSUM=false.

Changes

install-gh-aw.sh: Change default SKIP_CHECKSUM=true → SKIP_CHECKSUM=false; remove redundant SKIP_CHECKSUM=false override in the GitHub Actions context block; update header comment
actions/setup-cli/install.sh: Same changes (these two files are kept in sync)

No logic changes — the existing checksum download, verification, and graceful-fallback code paths are unchanged. Users can still pass --skip-checksum to bypass verification.

Testing

bash -n syntax check passes on both scripts
scripts/test-install-script.sh — all 10 test groups pass

- Change SKIP_CHECKSUM default from true to false in both install-gh-aw.sh and actions/setup-cli/install.sh - Remove redundant SKIP_CHECKSUM=false in GitHub Actions context block (no longer needed since it's now the default) - Update header comments to reflect checksums are validated by default Agent-Logs-Url: https://github.com/github/gh-aw/sessions/73f24b82-4807-40b8-a61b-c662ee683ab0 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

pelikhan

@copilot review checksum code

Replace `grep "$EXPECTED_FILENAME" | awk '{print $1}'` with `awk -v f="$EXPECTED_FILENAME" '$2 == f {print $1}'` to avoid false matches when the filename appears as a substring in another entry (e.g. matching 'gh-aw-linux-amd64-extra.tar.gz' when searching for 'linux-amd64'). Agent-Logs-Url: https://github.com/github/gh-aw/sessions/057dcad8-6129-46c2-8ce5-d318e1698526 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-04-30T01:02:47Z

@copilot review checksum code

Found one bug: the checksum lookup used grep "$EXPECTED_FILENAME" | awk '{print $1}' which matches any line where the filename appears as a substring — e.g. searching for linux-amd64 would also match an entry named gh-aw-linux-amd64-extra.tar.gz, returning multiple hashes and causing a spurious verification failure.

Fixed in d4d43bb by replacing it with awk -v f="$EXPECTED_FILENAME" '$2 == f {print $1}' which matches only when field 2 is an exact equal to the expected filename.

Everything else in the checksum path looks solid:

Tool detection (sha256sum / shasum -a 256) with graceful skip if neither is available
Retry loop with 3 attempts for both the binary and checksums file downloads
Corrupt binary is deleted before exiting on mismatch
Checksums file is cleaned up after use

Copilot

Pull request overview

Enables SHA256 checksum validation by default in the gh-aw installer scripts now that checksums.txt is consistently published with releases.

Changes:

Flip default SKIP_CHECKSUM from true → false in both install scripts.
Remove the GitHub Actions-only SKIP_CHECKSUM=false override (now redundant).
Tighten checksum lookup to an exact filename match using awk (instead of substring grep).

Show a summary per file

File	Description
install-gh-aw.sh	Enables checksum verification by default and improves checksum lookup precision.
actions/setup-cli/install.sh	Mirrors the same default checksum behavior and checksum lookup update for the GitHub Action installer.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comments suppressed due to low confidence (1)

install-gh-aw.sh:16

Header docs still reference ./install.sh for usage/examples, but this script is install-gh-aw.sh (and later messaging already uses that name). This can mislead users copy/pasting the examples; update the Usage/Examples lines here to match the actual filename.

# Usage: ./install.sh [version] [options]
#
# Examples:
#   ./install.sh                           # Install latest version
#   ./install.sh v1.0.0                    # Install specific version
#   ./install.sh --skip-checksum           # Skip checksum validation
#

Files reviewed: 2/2 changed files
Comments generated: 0

pelikhan · 2026-04-30T19:56:32Z

@copilot investigate failure at https://github.com/github/gh-aw/actions/runs/25141957823/job/73694097432

The binary download and checksums download curl calls had no timeout options, causing them to hang indefinitely if a connection stalled. This was most visible on Windows GitHub Actions runners where the CI job ran for 3 hours before being killed. Add --connect-timeout 15 --max-time 120 to the binary download and --connect-timeout 15 --max-time 60 to the checksums download so the retry loop can cycle and eventually fail with a clear error instead of hanging forever. Agent-Logs-Url: https://github.com/github/gh-aw/sessions/1b540671-88f4-4de1-a709-01352e1f5788 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-04-30T20:03:09Z

@copilot investigate failure at https://github.com/github/gh-aw/actions/runs/25141957823/job/73694097432

The Windows job ran for ~3 hours before being killed by the runner. Root cause: the two curl calls in the install script had no --connect-timeout or --max-time options. If the connection stalls (common on Windows GitHub Actions runners), curl blocks indefinitely and the retry loop never advances.

Fixed in e5b1ac6 by adding:

--connect-timeout 15 --max-time 120 to the binary download
--connect-timeout 15 --max-time 60 to the checksums download

This was a latent bug that became newly reachable for the checksums path once we flipped the SKIP_CHECKSUM default to false.

pelikhan · 2026-04-30T23:35:59Z

@copilot add a 5 minute timeout on the jobs for the installation scripts test.

Investigate why this one gets stuck: https://github.com/github/gh-aw/actions/runs/25191069497/job/73860917300?pr=29223

…30s timeout The Windows CI job was hanging in the install script at the binary verification step (lines 376/399): `"$BINARY_PATH" --help` and `"$BINARY_PATH" version` can stall indefinitely while Windows Defender scans the newly downloaded executable. - .github/workflows/install.yml: add `timeout-minutes: 5` to the test-install job so a hung Windows runner is killed in under 5 minutes instead of consuming the full runner quota (previously 3+ hours) - install-gh-aw.sh / actions/setup-cli/install.sh: set BINARY_EXEC_TIMEOUT to `timeout 30` on Windows, wrap both binary verification calls with it; on timeout emit a warning and continue rather than failing the install (the binary has already passed checksum verification so it is safe to use) Agent-Logs-Url: https://github.com/github/gh-aw/sessions/9be8cef1-6312-4362-a598-ab4c831a4838 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-04-30T23:41:46Z

@copilot add a 5 minute timeout on the jobs for the installation scripts test.

Investigate why this one gets stuck: https://github.com/github/gh-aw/actions/runs/25191069497/job/73860917300?pr=29223

Root cause found: the install script executes "$BINARY_PATH" --help and "$BINARY_PATH" version directly after download (lines 376 and 399). On Windows, Windows Defender scans the newly downloaded executable before allowing it to run, which can block indefinitely — this is the same issue already documented for gh extension install in the same script.

Fixed in 623d0ea:

.github/workflows/install.yml: added timeout-minutes: 5 to the test-install job so a hung Windows runner is killed quickly
install-gh-aw.sh / actions/setup-cli/install.sh: added BINARY_EXEC_TIMEOUT="timeout 30" on Windows (matching the existing pattern for gh extension install), wrapping both binary verification calls; on timeout a warning is emitted and the install completes — the binary is safe to use since it already passed checksum verification

github-actions · 2026-05-01T00:19:57Z

✅ smoke-ci: safeoutputs CLI comment + comment-memory run (25195877414)

Generated by Smoke CI for issue #29223 · ◷

Copilot AI assigned Copilot and pelikhan Apr 30, 2026

Copilot created this pull request from a session on behalf of pelikhan April 30, 2026 00:55 View session

Copilot finished work on behalf of pelikhan April 30, 2026 00:55

Copilot AI requested a review from pelikhan April 30, 2026 00:55

pelikhan reviewed Apr 30, 2026

View reviewed changes

Copilot started work on behalf of pelikhan April 30, 2026 00:57 View session

Copilot finished work on behalf of pelikhan April 30, 2026 01:03

Copilot AI requested a review from pelikhan April 30, 2026 01:03

pelikhan marked this pull request as ready for review April 30, 2026 01:09

Copilot AI review requested due to automatic review settings April 30, 2026 01:09

Copilot started reviewing on behalf of pelikhan April 30, 2026 01:09 View session

github-actions Bot mentioned this pull request Apr 30, 2026

[aw] No-Op Runs #29134

Open

Copilot AI reviewed Apr 30, 2026

View reviewed changes

github-actions Bot mentioned this pull request Apr 30, 2026

[Contribution Check Report] Contribution Check — 2026-04-30 #29234

Closed

Copilot started work on behalf of pelikhan April 30, 2026 19:56 View session

Copilot finished work on behalf of pelikhan April 30, 2026 20:05

Merge branch 'main' into copilot/add-checksum-validation-install-gh-aw

80b5995

This comment has been minimized.

Sign in to view

Copilot started work on behalf of pelikhan April 30, 2026 23:36 View session

Copilot finished work on behalf of pelikhan April 30, 2026 23:42

Merge branch 'main' into copilot/add-checksum-validation-install-gh-aw

58ba502

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: enable checksum validation by default in install-gh-aw.sh#29223

feat: enable checksum validation by default in install-gh-aw.sh#29223
Copilot wants to merge 6 commits intomainfrom
copilot/add-checksum-validation-install-gh-aw

Copilot AI commented Apr 30, 2026

Uh oh!

pelikhan left a comment

Uh oh!

Copilot AI commented Apr 30, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

pelikhan commented Apr 30, 2026

Uh oh!

Copilot AI commented Apr 30, 2026

Uh oh!

This comment has been minimized.

This comment has been minimized.

pelikhan commented Apr 30, 2026

Uh oh!

Copilot AI commented Apr 30, 2026

Uh oh!

github-actions Bot commented May 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

Copilot AI commented Apr 30, 2026

Summary

Background

Changes

Testing

Uh oh!

pelikhan left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI commented Apr 30, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Copilot's findings

Uh oh!

pelikhan commented Apr 30, 2026

Uh oh!

Copilot AI commented Apr 30, 2026

Uh oh!

This comment has been minimized.

This comment has been minimized.

pelikhan commented Apr 30, 2026

Uh oh!

Copilot AI commented Apr 30, 2026

Uh oh!

github-actions Bot commented May 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants