Remove anonymous bash tool syntax, require explicit configuration by Copilot · Pull Request #14222 · github/gh-aw

Copilot · 2026-02-06T20:35:16Z

Anonymous bash: syntax (nil value) was ambiguous and silently converted to default commands during compilation. This removes support and requires explicit configuration.

Changes

Parser (tools_parser.go)

parseBashTool() returns nil for anonymous syntax, rejects at parse time
Added boolean support: bash: true (all commands), bash: false (disabled)

Validation (tools_validation.go, compiler_orchestrator_workflow.go)

Added validateBashToolConfig() in ParseWorkflowFile() before applyDefaultTools()
Timing critical: must validate before nil→defaults transformation occurs
Clear error message directs users to gh aw fix

Codemod (codemod_bash_anonymous.go)

Automatic migration converts bash: → bash: true
Converts to bash: true (enable all commands) to match the original behavior where anonymous syntax was converted to default commands
Integrated with gh aw fix command

Workflows

Migrated 12 existing workflows using codemod
All workflows now use bash: true
Recompiled all lock files

Supported Syntax

tools:
  bash: true              # All commands
  bash: false             # Disabled
  bash: ["echo", "ls"]    # Specific commands
  bash: ["*"]             # Wildcard
  # bash:                 # ❌ No longer supported

Migration

Compilation fails with:

error: anonymous syntax 'bash:' is not supported. 
Use 'bash: true', 'bash: false', or 'bash: ["cmd1", "cmd2"]'. 
Run 'gh aw fix' to automatically migrate

Running gh aw fix automatically converts bash: to bash: true, which enables all commands and is semantically equivalent to the original anonymous syntax behavior.

Original prompt

Remove support for the syntax of bash tool without arguments. It must be explicient.
tools:
  bash: # not allowed
  bash: true # enabled
  bash: false # all disallowed
  bash: ["*"] # list of tools
Create a codemod that converts the anonymous use to tools.bash: false.

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

pelikhan · 2026-02-06T21:06:13Z

@copilot have the codemox update to base: true instad of base: false.

Updated codemod to convert anonymous bash: syntax to bash: true (enable all commands) instead of bash: false. This is more semantically equivalent to the original behavior where anonymous bash: was converted to default commands. - Updated getBashAnonymousRemovalCodemod to use bash: true - Renamed replaceBashAnonymousWithFalse to replaceBashAnonymousWithTrue - Updated all tests to expect bash: true - Re-migrated 12 workflows from bash: false to bash: true - Recompiled all workflow lock files Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-02-06T21:15:05Z

@copilot have the codemox update to base: true instad of base: false.

Done! Updated codemod to use bash: true instead of bash: false. This makes more sense since the anonymous syntax was originally converted to default commands (all allowed).

Changes in commit 84c208a:

Codemod now converts bash: → bash: true
Updated all tests to expect bash: true
Re-migrated 12 workflows from bash: false to bash: true
Recompiled all lock files

github-actions · 2026-02-06T21:38:41Z

🛡️ Security Posture Analysis

This PR contains changes that may affect the security posture. Please review the following concerns:

🟠 Tool Security Relaxation: Unrestricted Bash access

Location: .github/workflows/mcp-inspector.lock.yml:1146-1185

Change Detected:

-        # --allow-tool shell(cat)
-        # --allow-tool shell(date)
-        # --allow-tool shell(echo)
-        # --allow-tool shell(grep)
-        # --allow-tool shell(head)
-        # --allow-tool shell(ls)
-        # --allow-tool shell(pwd)
-        # --allow-tool shell(sort)
-        # --allow-tool shell(tail)
-        # --allow-tool shell(uniq)
-        # --allow-tool shell(wc)
-        # --allow-tool shell(yq)
+        # --allow-tool Bash

Security Impact: The workflow now allows the general Bash tool instead of the previously enumerated safe shell commands, giving the agent full arbitrary command execution rather than the narrow, reviewed subset. This expansion widens the attack surface for tooling and runtime access from within the workflow.

Recommendation: Keep the Bash tool restricted to the explicit commands the workflow requires or add explicit justification and compensating controls for granting unfettered Bash access.

Summary

Category	Severity	Count
Tool Security Relaxation	🟠	1

Note: This is an automated analysis. Please verify these findings and determine if the changes are intentional and justified.

AI generated by Security Guard Agent 🛡️

Copilot

Pull request overview

This PR removes support for the ambiguous anonymous bash: tool syntax in workflow frontmatter, requiring explicit configuration and providing a gh aw fix codemod to migrate existing workflows.

Changes:

Updated tool parsing/validation to reject tools.bash: null (anonymous bash:) and to support bash: true|false.
Added compiler-time validation to fail before default tool expansion can transform nil bash into defaults.
Added a codemod and migrated existing workflows/lockfiles away from anonymous bash:.

Reviewed changes

Copilot reviewed 33 out of 33 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
pkg/workflow/tools_validation_test.go	Adds unit tests for explicit/anonymous bash validation and boolean parsing.
pkg/workflow/tools_validation.go	Introduces validation that rejects anonymous `bash:` configs early.
pkg/workflow/tools_parser.go	Updates bash tool parsing to reject `nil` and accept booleans.
pkg/workflow/compiler_orchestrator_workflow.go	Runs bash config validation before defaults are applied.
pkg/workflow/bash_anonymous_validation_test.go	Adds end-to-end compiler tests for rejecting anonymous bash and accepting explicit forms.
pkg/cli/fix_codemods_test.go	Updates codemod registry tests for the new codemod entry.
pkg/cli/fix_codemods.go	Registers the new “bash-anonymous-removal” codemod.
pkg/cli/codemod_bash_anonymous_test.go	Adds tests for the anonymous-bash codemod behavior.
pkg/cli/codemod_bash_anonymous.go	Implements codemod to rewrite anonymous `bash:` into an explicit configuration.
.github/workflows/video-analyzer.md	Migrates workflow tools config from anonymous `bash:` to explicit.
.github/workflows/video-analyzer.lock.yml	Recompiled lockfile reflecting updated tools config.
.github/workflows/technical-doc-writer.md	Migrates workflow tools config from anonymous `bash:` to explicit.
.github/workflows/technical-doc-writer.lock.yml	Recompiled lockfile reflecting updated tools config.
.github/workflows/q.md	Migrates workflow tools config from anonymous `bash:` to explicit.
.github/workflows/q.lock.yml	Recompiled lockfile reflecting updated tools config.
.github/workflows/mcp-inspector.md	Migrates workflow tools config from anonymous `bash:` to explicit.
.github/workflows/mcp-inspector.lock.yml	Recompiled lockfile reflecting updated tools config.
.github/workflows/lockfile-stats.md	Migrates workflow tools config from anonymous `bash:` to explicit.
.github/workflows/lockfile-stats.lock.yml	Recompiled lockfile reflecting updated tools config.
.github/workflows/daily-secrets-analysis.md	Migrates workflow tools config from anonymous `bash:` to explicit.
.github/workflows/daily-secrets-analysis.lock.yml	Recompiled lockfile reflecting updated tools config.
.github/workflows/daily-malicious-code-scan.md	Migrates workflow tools config from anonymous `bash:` to explicit.
.github/workflows/daily-malicious-code-scan.lock.yml	Recompiled lockfile reflecting updated tools config.
.github/workflows/daily-code-metrics.md	Migrates workflow tools config from anonymous `bash:` to explicit.
.github/workflows/daily-code-metrics.lock.yml	Recompiled lockfile reflecting updated tools config.
.github/workflows/daily-cli-performance.md	Migrates workflow tools config from anonymous `bash:` to explicit.
.github/workflows/daily-cli-performance.lock.yml	Recompiled lockfile reflecting updated tools config.
.github/workflows/code-scanning-fixer.md	Migrates workflow tools config from anonymous `bash:` to explicit.
.github/workflows/code-scanning-fixer.lock.yml	Recompiled lockfile reflecting updated tools config.
.github/workflows/artifacts-summary.md	Migrates workflow tools config from anonymous `bash:` to explicit.
.github/workflows/artifacts-summary.lock.yml	Recompiled lockfile reflecting updated tools config.
.github/workflows/archie.md	Migrates workflow tools config from anonymous `bash:` to explicit.
.github/workflows/archie.lock.yml	Recompiled lockfile reflecting updated tools config.

Comments suppressed due to low confidence (1)

pkg/cli/codemod_bash_anonymous.go:95

replaceBashAnonymousWithTrue only rewrites lines where the trimmed content is exactly bash:. YAML like bash: # comment (still a nil value) will not be rewritten even though the frontmatter map indicates bash is nil, so the codemod will silently not apply. Consider handling bash: lines that have only whitespace and/or an inline comment after the colon, preserving the comment when adding true.

		// Replace bash: with bash: true if in tools block
		if inToolsBlock && (trimmed == "bash:" || startsWith(trimmed, "bash: ")) {
			// Check if it's just 'bash:' with nothing after the colon
			if trimmed == "bash:" {
				indent := getIndentation(line)
				result = append(result, indent+"bash: true")
				modified = true
				bashAnonymousCodemodLog.Printf("Replaced 'bash:' with 'bash: true'")
				continue
			}
		}

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-02-06T21:40:16Z

pkg/workflow/tools_validation.go

+	// Check if bash is present in the raw map but Bash field is nil
+	// This indicates the anonymous syntax (bash:) was used
+	if rawMap := tools.ToMap(); rawMap != nil {
+		if _, hasBash := rawMap["bash"]; hasBash && tools.Bash == nil {
+			toolsValidationLog.Printf("Invalid bash tool configuration in workflow: %s", workflowName)
+			return fmt.Errorf("invalid bash tool configuration: anonymous syntax 'bash:' is not supported. Use 'bash: true' (enable all commands), 'bash: false' (disable), or 'bash: [\"cmd1\", \"cmd2\"]' (specific commands). Run 'gh aw fix' to automatically migrate")
+		}


validateBashToolConfig currently treats any case where rawMap["bash"] exists but tools.Bash == nil as the anonymous bash: syntax. However parseBashTool also returns nil for other invalid types (e.g., bash: "foo"), so those would get a misleading “anonymous syntax” error and an incorrect suggestion to run gh aw fix. Consider checking the raw value: if rawMap["bash"] == nil then report anonymous syntax; otherwise report an invalid bash config type/value with a message that lists the accepted forms (bool or array).

Copilot · 2026-02-06T21:40:16Z

pkg/cli/codemod_bash_anonymous.go

+		Name:         "Replace anonymous bash tool syntax with explicit true",
+		Description:  "Replaces 'bash:' (anonymous/nil syntax) with 'bash: true' to make configuration explicit",
+		IntroducedIn: "0.9.0",
+		Apply: func(content string, frontmatter map[string]any) (string, bool, error) {
+			// Check if tools.bash exists
+			toolsValue, hasTools := frontmatter["tools"]
+			if !hasTools {
+				return content, false, nil
+			}
+
+			toolsMap, ok := toolsValue.(map[string]any)
+			if !ok {
+				return content, false, nil
+			}
+
+			// Check if bash field exists and is nil
+			bashValue, hasBash := toolsMap["bash"]
+			if !hasBash {
+				return content, false, nil
+			}
+
+			// Only modify if bash is nil (anonymous syntax)
+			if bashValue != nil {
+				return content, false, nil
+			}
+
+			// Parse frontmatter to get raw lines
+			frontmatterLines, markdown, err := parseFrontmatterLines(content)
+			if err != nil {
+				return content, false, err
+			}
+
+			// Replace the bash field from anonymous to explicit true
+			modifiedLines, modified := replaceBashAnonymousWithTrue(frontmatterLines)
+			if !modified {
+				return content, false, nil
+			}
+
+			// Reconstruct the content
+			newContent := reconstructContent(modifiedLines, markdown)
+			bashAnonymousCodemodLog.Print("Applied bash anonymous removal, replaced with 'bash: true'")
+			return newContent, true, nil


This codemod replaces anonymous bash: with bash: true, but compilation treats bash: true as wildcard/all commands while the previous anonymous form was compiled to constants.DefaultBashTools (via applyDefaultTools handling bash == nil). That means the migration can broaden shell permissions compared to the old behavior. If the goal is semantic equivalence, migrate to an explicit list of the default commands (or adjust the compiler semantics for bash: true).

This issue also appears on line 85 of the same file.

Suggested change

Name: "Replace anonymous bash tool syntax with explicit true",

Description: "Replaces 'bash:' (anonymous/nil syntax) with 'bash: true' to make configuration explicit",

IntroducedIn: "0.9.0",

Apply: func(content string, frontmatter map[string]any) (string, bool, error) {

// Check if tools.bash exists

toolsValue, hasTools := frontmatter["tools"]

if !hasTools {

return content, false, nil

}

toolsMap, ok := toolsValue.(map[string]any)

if !ok {

return content, false, nil

}

// Check if bash field exists and is nil

bashValue, hasBash := toolsMap["bash"]

if !hasBash {

return content, false, nil

}

// Only modify if bash is nil (anonymous syntax)

if bashValue != nil {

return content, false, nil

}

// Parse frontmatter to get raw lines

frontmatterLines, markdown, err := parseFrontmatterLines(content)

if err != nil {

return content, false, err

}

// Replace the bash field from anonymous to explicit true

modifiedLines, modified := replaceBashAnonymousWithTrue(frontmatterLines)

if !modified {

return content, false, nil

}

// Reconstruct the content

newContent := reconstructContent(modifiedLines, markdown)

bashAnonymousCodemodLog.Print("Applied bash anonymous removal, replaced with 'bash: true'")

return newContent, true, nil

Name: "Disable anonymous bash tool codemod",

Description: "Previously replaced 'bash:' (anonymous/nil syntax) with 'bash: true', but is now disabled to avoid broadening shell permissions.",

IntroducedIn: "0.9.0",

Apply: func(content string, frontmatter map[string]any) (string, bool, error) {

// This codemod is intentionally a no-op.

// The original implementation replaced anonymous "bash:" with "bash: true",

// which caused compilation to treat bash as a wildcard for all commands

// and could silently broaden shell permissions compared to the previous

// semantics (where bash == nil maps to the default bash tools).

// To preserve existing behavior and avoid expanding permissions, we no longer

// modify the content here.

return content, false, nil

Copilot · 2026-02-06T21:40:16Z

pkg/cli/fix_codemods.go

 		getDiscussionFlagRemovalCodemod(),
 		getMCPModeToTypeCodemod(),
 		getInstallScriptURLCodemod(),
+		getBashAnonymousRemovalCodemod(), // Replace bash: with bash: false


The trailing comment says “Replace bash: with bash: false”, but the codemod actually replaces anonymous bash: with bash: true. This is misleading for future maintainers—update the comment to match the actual behavior (or change the codemod if false was intended).

Suggested change

getBashAnonymousRemovalCodemod(), // Replace bash: with bash: false

getBashAnonymousRemovalCodemod(), // Replace anonymous bash: with bash: true

Initial plan

d98d005

Copilot AI assigned Copilot and pelikhan Feb 6, 2026

Copilot started work on behalf of pelikhan February 6, 2026 20:36 View session

Copilot AI and others added 5 commits February 6, 2026 20:41

Initial plan: Remove anonymous bash tool syntax support

b80d30c

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Add validation and codemod for anonymous bash tool syntax

dad871f

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Update tests and migrate workflows to explicit bash syntax

ddc66cf

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Fix validation timing and add compiler integration tests

f4593cc

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Remove incorrect build constraints from production code

dbc7d0c

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Remove support for anonymous bash tool syntax~~ Remove anonymous bash tool syntax, require explicit configuration Feb 6, 2026

Copilot AI requested a review from pelikhan February 6, 2026 21:04

Copilot finished work on behalf of pelikhan February 6, 2026 21:04

Copilot started work on behalf of pelikhan February 6, 2026 21:07 View session

Copilot finished work on behalf of pelikhan February 6, 2026 21:15

pelikhan marked this pull request as ready for review February 6, 2026 21:35

Merge branch 'main' into copilot/remove-bash-tool-argument-support

7250437

Copilot AI review requested due to automatic review settings February 6, 2026 21:35

Copilot started reviewing on behalf of pelikhan February 6, 2026 21:35 View session

Copilot AI reviewed Feb 6, 2026

View reviewed changes

pelikhan merged commit a42010d into main Feb 6, 2026
56 of 57 checks passed

pelikhan deleted the copilot/remove-bash-tool-argument-support branch February 6, 2026 22:37

Copilot AI mentioned this pull request Feb 7, 2026

Investigation: CI failure #14239 is false alarm, no changes needed #14259

Closed

github-actions bot mentioned this pull request Feb 7, 2026

🌱 Daily Team Evolution Insights - February 7, 2026 #14261

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Remove anonymous bash tool syntax, require explicit configuration#14222

Remove anonymous bash tool syntax, require explicit configuration#14222
pelikhan merged 8 commits intomainfrom
copilot/remove-bash-tool-argument-support

Copilot AI commented Feb 6, 2026 •

edited

Loading

Uh oh!

pelikhan commented Feb 6, 2026

Uh oh!

Copilot AI commented Feb 6, 2026

Uh oh!

github-actions bot commented Feb 6, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Feb 6, 2026

Uh oh!

Copilot AI Feb 6, 2026

Uh oh!

Copilot AI Feb 6, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

	getBashAnonymousRemovalCodemod(), // Replace bash: with bash: false
	getBashAnonymousRemovalCodemod(), // Replace anonymous bash: with bash: true

Conversation

Copilot AI commented Feb 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Supported Syntax

Migration

Uh oh!

pelikhan commented Feb 6, 2026

Uh oh!

Copilot AI commented Feb 6, 2026

Uh oh!

github-actions bot commented Feb 6, 2026

🛡️ Security Posture Analysis

🟠 Tool Security Relaxation: Unrestricted Bash access

Summary

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Feb 6, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 6, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 6, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Copilot AI commented Feb 6, 2026 •

edited

Loading