Harden Copilot cloud setup workflow

[johnml1135]

Summary

• make copilot setup workflow use repository wrappers (�uild.ps1/ est.ps1) with documented inputs
• pin runner and uv version for deterministic behavior
• cache NuGet at repo-local packages/ to match
  uget.config
• add guardrail to block installer builds in cloud agent workflow and document rationale
• add shallow helper repo clone step for full build compatibility
• add timeouts for build/test steps
• add least-privilege workflow permission (contents: read)
• ignore local .env files to reduce accidental secret commits

Notes

• This workflow is intentionally scoped to managed/native validation, not installer/signing/release jobs.
• JIRA integration is intentionally out of scope for this change.

---

This change is 

[Copilot]

Pull request overview

This PR hardens the Copilot cloud agent setup workflow by switching to pinned runner/tool versions, caching NuGet at the repo-local packages/ directory, adding guardrails against installer builds, cloning helper repositories with shallow checkouts, adding step-level timeouts, applying least-privilege permissions (contents: read), and ignoring .env files in .gitignore.

Changes:

• Refactored copilot-setup-steps.yml to use build.ps1/test.ps1 wrapper scripts (replacing bare msbuild), pin the runner to windows-2022 and uv to 0.6.x, add an installer-build guardrail, shallow-clone three helper repos, add 60-minute build/test timeouts, and set permissions: contents: read.
• Updated NuGet cache key and path to match the repo-local packages/ directory and include nuget.config in the hash.
• Added .env, .env.*, and .github/skills/**/.env ignore rules to .gitignore to reduce accidental secret commits.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 4 comments.

File	Description
.github/workflows/copilot-setup-steps.yml	Major refactor: pinned runner/tooling, wrapper-script-focused inputs, guardrail step, shallow helper-repo clones, per-step timeouts, least-privilege permissions
.gitignore	Added .env, .env.*, and .github/skills/**/.env rules to block accidental secret commits

[Copilot]

Direct interpolation of ${{ inputs.build_args }} into the run: script body (lines 198–199) is a script-injection risk. Although this workflow is workflow_call-only and its callers are in this repo, any caller workflow that itself accepts user input and forwards it to build_args would expose this path. The recommended GitHub Actions hardening pattern is to pass the input through an environment variable and then reference it in the script via $env:BUILD_ARGS:

env:
  BUILD_ARGS: ${{ inputs.build_args }}
run: |
  ./build.ps1 $env:BUILD_ARGS

This prevents template injection because $env:BUILD_ARGS is never evaluated as workflow expression syntax—it is only resolved as a shell variable at runtime.

[github-actions]

NUnit Tests

    1 files  ±0      1 suites  ±0   5m 58s ⏱️ +18s
4 407 tests ±0  4 320 ✅ ±0  87 💤 ±0  0 ❌ ±0 
4 416 runs  ±0  4 329 ✅ ±0  87 💤 ±0  0 ❌ ±0 

Results for commit 1501d41. ± Comparison against base commit 0d6dace.

♻️ This comment has been updated with latest results.

[github-actions]

⚠️ Commit Message Format Issues ⚠️
commit 0d16804cbb:
1: T3 Title has trailing punctuation (.): "Convert to official copilot setup steps."

[jasonleenaylor]

.github/workflows/copilot-setup-steps.yml line 207 at r2 (raw file):

          Invoke-ShallowClone -RepoUrl 'https://github.com/sillsdev/FwHelps.git' -Destination 'DistFiles/Helps'
          Invoke-ShallowClone -RepoUrl 'https://github.com/sillsdev/FwLocalizations.git' -Destination 'Localizations'
          Invoke-ShallowClone -RepoUrl 'https://github.com/sillsdev/liblcm.git' -Destination 'Localizations/LCM'

I'm not sure that liblcm should be copied here, we only need localizations for the installer build or for debugging localizations.

[jasonleenaylor]

@jasonleenaylor reviewed 5 files and all commit messages, and made 1 comment.
Reviewable status: all files reviewed, 1 unresolved discussion (waiting on johnml1135).