fix: add missing secure_getenv interposer initialization

[Copilot]

Docker build fails compiling one-shot-token.c due to undeclared real_secure_getenv and init_real_secure_getenv().

The secure_getenv interposer implementation was incomplete - it called initialization functions that didn't exist and used an undeclared function pointer.

Changes

• Add secure_getenv infrastructure following the getenv pattern:

  • real_secure_getenv function pointer
  • secure_getenv_init_once pthread_once control
  • init_real_secure_getenv_once() for dlsym initialization
  • init_real_secure_getenv() wrapper for thread-safe init

• Add .gitignore for *.so build artifacts in one-shot-token directory

Implementation

/* Pointer to the real secure_getenv function */
static char *(*real_secure_getenv)(const char *name) = NULL;

/* pthread_once control for thread-safe initialization */
static pthread_once_t secure_getenv_init_once = PTHREAD_ONCE_INIT;

/* Initialize the real secure_getenv pointer (called exactly once via pthread_once) */
static void init_real_secure_getenv_once(void) {
    real_secure_getenv = dlsym(RTLD_NEXT, "secure_getenv");
    /* Note: secure_getenv may not be available on all systems, so we don't abort if NULL */
    if (real_secure_getenv == NULL) {
        fprintf(stderr, "[one-shot-token] WARNING: secure_getenv not available, falling back to getenv\n");
    }
}

/* Ensure real_secure_getenv is initialized (thread-safe) */
static void init_real_secure_getenv(void) {
    pthread_once(&secure_getenv_init_once, init_real_secure_getenv_once);
}

The secure_getenv interposer now mirrors the getenv implementation, using pthread_once for thread-safe lazy initialization.

Original prompt

Fix the failing GitHub Actions workflow agent
Analyze the workflow logs, identify the root cause of the failure, and implement a fix.
Job ID: 63068542292
Job URL: https://github.com/github/gh-aw-firewall/actions/runs/21854575561/job/63068542292

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[github-actions]

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

[github-actions]

Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded.

[github-actions]

🎬 THE END — Smoke Claude MISSION: ACCOMPLISHED! The hero saves the day! ✨

[github-actions]

Bun Build Test Results ✅

Project	Install	Tests	Status
elysia	✅	1/1	PASS
hono	✅	1/1	PASS

Overall: PASS

All Bun projects built and tested successfully.

AI generated by Build Test Bun

[github-actions]

Deno Build Test Results

Project	Tests	Status
oak	1/1	✅ PASS
std	1/1	✅ PASS

Overall: ✅ PASS

AI generated by Build Test Deno

[github-actions]

Smoke Test Results: Claude Engine

Last 2 Merged PRs:

• fix: preserve secure_getenv semantics in one-shot token interposer #610: fix: preserve secure_getenv semantics in one-shot token interposer
• fix: use pthread_once for thread-safe getenv initialization #609: fix: use pthread_once for thread-safe getenv initialization

Test Results:

• ✅ GitHub MCP: Retrieved PR data
• ✅ Playwright: Navigated to github.com (title: "GitHub · Change is constant. GitHub keeps you ahead. · GitHub")
• ✅ File Writing: Created /tmp/gh-aw/agent/smoke-test-claude-21854832573.txt
• ✅ Bash Tool: Verified file content

Status: PASS

AI generated by Smoke Claude

[github-actions]

Node.js Build Test Results

Project	Install	Tests	Status
clsx	✅	✅	PASS
execa	✅	✅	PASS
p-limit	✅	✅	PASS

Overall: PASS ✅

All Node.js projects installed and tested successfully.

AI generated by Build Test Node.js

[github-actions]

Smoke Test Results

Last 2 merged PRs:

• feat: add runtime configuration for one-shot token protection via AWF_ONE_SHOT_TOKENS #607: feat: add runtime configuration for one-shot token protection via AWF_ONE_SHOT_TOKENS
• chore(deps): bump the github-actions group with 11 updates #597: chore(deps): bump the github-actions group with 11 updates

✅ GitHub MCP: Retrieved PR data
✅ Playwright: Page title contains "GitHub"
✅ File Write: Created test file
✅ Bash Tool: File verified

Status: PASS

cc @Copilot @lpcox

AI generated by Smoke Copilot

[github-actions]

Build Test: Go Results

Project	Download	Tests	Status
color	✅	PASS	✅ PASS
env	✅	PASS	✅ PASS
uuid	✅	PASS	✅ PASS

Overall: ✅ PASS

All Go projects successfully downloaded dependencies and passed their tests.

AI generated by Build Test Go

[github-actions]

Rust Build Test Results

Project	Build	Tests	Status
fd	✅	1/1	PASS
zoxide	✅	1/1	PASS

Overall: PASS ✅

All Rust projects built and tested successfully.

AI generated by Build Test Rust

[github-actions]

C++ Build Test Results

Project	CMake	Build	Status
fmt	✅	✅	PASS
json	✅	✅	PASS

Overall: PASS

Both projects built successfully using CMake and make.

AI generated by Build Test C++

[github-actions]

Chroot Test Results

Runtime	Host Version	Chroot Version	Match?
Python	Python 3.12.12	Python 3.12.3	❌ NO
Node.js	v24.13.0	v20.20.0	❌ NO
Go	go1.22.12	go1.22.12	✅ YES

Overall Status: ❌ Not all versions matched (1/3 passed)

The chroot environment did not have matching versions for Python and Node.js, which indicates the host binaries are not fully transparent through the chroot.

AI generated by Smoke Chroot

[Copilot]

Pull request overview

Fixes the agent Docker image build failure by completing the secure_getenv interposer infrastructure in the one-shot-token LD_PRELOAD library, aligning it with the existing getenv initialization pattern.

Changes:

• Add missing secure_getenv function pointer and pthread_once-based initialization helpers.
• Add a local .gitignore entry to ignore built *.so artifacts in the one-shot-token directory.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
containers/agent/one-shot-token/one-shot-token.c	Adds secure_getenv interposer initialization plumbing to fix compilation and enable runtime symbol resolution.
containers/agent/one-shot-token/.gitignore	Ignores local .so build artifacts in this directory.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

secure_getenv() (below) relies on the token list to classify sensitive variables, but the token list is only initialized in getenv() via init_token_list() under token_mutex. As a result, if a process calls secure_getenv() before any getenv() call, num_tokens is still 0 and get_token_index() will always return -1, bypassing one-shot protection for sensitive tokens. Consider mirroring the getenv() initialization flow in secure_getenv(): lock token_mutex, call init_token_list() if needed, and compute token_idx while holding the mutex before deciding whether to pass through or apply one-shot behavior.

Suggested change

	static void init_real_secure_getenv(void) {
	pthread_once(&secure_getenv_init_once, init_real_secure_getenv_once);
	static void init_real_secure_getenv(void) {
	/* Initialize the real secure_getenv function pointer once */
	pthread_once(&secure_getenv_init_once, init_real_secure_getenv_once);
	/*
	* Ensure the sensitive token list is initialized before any secure_getenv()
	* logic relies on it. This covers the case where secure_getenv() is called
	* before getenv(), which would otherwise leave num_tokens == 0 and cause
	* get_token_index() to always return -1.
	*/
	pthread_mutex_lock(&token_mutex);
	if (!tokens_initialized) {
	init_token_list();
	}
	pthread_mutex_unlock(&token_mutex);