Copilot AI linked an issue

that may be closed by this pull request

Closed

…parators (VULN-001)
- Add ValidateGitRef and ValidateGitPath helpers to pkg/gitutil that reject
  refs/paths starting with '-' (argument injection CWE-88) and refs containing
  '..' (git traversal expressions)
- Validate ref at parse time in parseWorkflowSpecParts and parseRemoteOrigin
  so malicious workflowspec imports are rejected before any git subprocess runs
- Add '--' end-of-options separator to all git subprocess calls that take
  user-derived positional arguments:
  - git archive --remote=<url> <ref> -- <path>  (remote_download_file.go)
  - git checkout -- <ref>                        (remote_download_file.go)
  - git ls-remote <url> -- <ref>                 (remote_resolve_sha.go)
- Add early ref/path validation guards in downloadFileViaGit and
  downloadFileViaGitClone fallback paths
- Add unit tests for ValidateGitRef and ValidateGitPath covering valid cases,
  empty inputs, leading-dash injection, and dotdot traversal
Fixes #47940
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI changed the title [WIP] Fix Git argument injection issue in remote import fallbacks fix: git argument injection via unvalidated ref/path in remote import fallbacks (VULN-001)

Copilot AI review requested due to automatic review settings

…strategy

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>