[plan] Fix unverified_script_exec: Add checksum verification to install-gh-aw.sh curl-pipe-bash patterns

[github-actions]

Objective

Add SHA256 checksum verification to the two curl | bash patterns that execute install-gh-aw.sh without integrity checking.

Context

From static analysis discussion #17844: Poutine flags two unverified_script_exec findings (info severity):

• .github/workflows/copilot-setup-steps.yml:17
• .github/workflows/daily-copilot-token-report.lock.yml:302

Both execute curl -fsSL https://raw.githubusercontent.com/github/gh-aw/refs/heads/main/install-gh-aw.sh | bash without verifying the script's integrity. If the script is tampered with (compromised repo or CDN), the runner executes malicious code.

Approach

1. Open .github/workflows/copilot-setup-steps.yml and find the curl-pipe-bash pattern
2. Open the source .md file that compiles to daily-copilot-token-report.lock.yml (likely .github/workflows/daily-copilot-token-report.md) and find the same pattern
3. Replace direct curl | bash with a download-then-verify-then-execute pattern:

   curl -fsSL https://raw.githubusercontent.com/github/gh-aw/refs/heads/main/install-gh-aw.sh -o /tmp/gh-aw-install.sh
   echo "EXPECTED_SHA256  /tmp/gh-aw-install.sh" | sha256sum -c
   bash /tmp/gh-aw-install.sh

4. The expected SHA256 should be computed from the current install-gh-aw.sh and stored as a workflow variable or inline constant
5. Run make recompile after modifying any .md files
6. Run make agent-finish before committing

Files to Modify

• .github/workflows/copilot-setup-steps.yml (direct YAML — not compiled)
• Find and update the .md source file that generates daily-copilot-token-report.lock.yml

Acceptance Criteria

• Both curl | bash patterns are replaced with download + verify + execute
• The expected SHA256 checksum is documented and maintained
• make recompile runs without errors (for any modified .md files)
• make agent-finish passes
• Poutine unverified_script_exec findings drop to 0

Generated by Plan Command for issue #discussion #17844

• expires on Feb 25, 2026, 7:18 AM UTC