Activation job builds the agent prompt from PR-head content before base-branch restore runs, for pull_request-triggered workflows

[aharper-srsacquiom]

Summary

For a .md workflow triggered on pull_request (e.g. types: [opened, ready_for_review, labeled]), the compiled activation job's "Checkout .github and .agents folders" step has no ref: override, so it checks out whatever the triggering ref resolves to (the PR's merge ref for pull_request events) before building the agent prompt via {{#runtime-import <workflow>.md}} and installing the declared skills:. The "Restore agent config folders from base branch" step only runs later, inside the agent job.

This means a same-repository, non-fork PR (fork PRs are already excluded by the compiler's head.repo.id == github.repository_id gate) authored by anyone with write/maintainer/admin access — i.e. anyone who can get the workflow to activate at all — can edit the workflow's own source .md file (or an installed skill file it imports) in that same PR, and have the modified instructions used to build the prompt that reviews that very PR. For an advisory PR-review-style workflow, this could be used to suppress findings, alter severity grading, or otherwise steer the review, before the "restore from base branch" step ever runs.

Where we found it

Porting SRS-Acquiom/deal-setup's fleet-review.md/fleet-review-ci skill (a pull_request-triggered, gh-aw-compiled advisory review workflow) into another repository (compiled with gh-aw v0.89.15). Both repos' compiled fleet-review.lock.yml have the identical construction:

• Activation job checkout (no ref:) → builds prompt via {{#runtime-import .github/workflows/<file>.md}} and skill install, using whatever is present at that checkout.
• "Restore agent config folders from base branch" only executes in the agent job, after the prompt has already been assembled.

Impact

Bounded, but real for anyone who can open/label a PR with write access:

• Only reachable by same-repo, non-fork PRs from users who already clear the compiler's role gate (fork PRs are excluded outright).
• Doesn't grant new write capability by itself — a workflow can still constrain the agent's actual token/permissions and safe-output policy — but it does let that same actor control the instructions the agent runs under for reviewing their own PR, which defeats the purpose of an advisory-review-style workflow whose entire value is being trustworthy regardless of PR content.

Suggested fix

Either:

1. Pin the activation job's checkout (and any {{#runtime-import}}/skill-install steps that read the workflow's own .md source or installed skills) to github.event.pull_request.base.sha for pull_request-triggered workflows, or
2. Run the "restore agent config folders from base branch" step (or an equivalent restore) before prompt construction/skill installation in the activation job, not only later in the agent job.

Happy to provide the two compiled fleet-review.lock.yml files (from SRS-Acquiom/deal-setup and the port) as concrete repro artifacts if useful.