Wiz reported a real GitHub Actions injection in Snowflake’s .NET connector repository. An issue title was expanded directly inside a shell script that had access to Jira credentials. Wiz also called the bug “created by Copilot Autofix.” The public history establishes Copilot co-authorship on the merged commit, but it does not establish that Copilot wrote the vulnerable jira_issue.yml hunk.

The merged commit has a Copilot co-author trailer, but that trailer summarizes contributors to the whole pull request. In the PR history, the commit actually named copilot suggestion changes only jira_close.yml. It moves interpolated values into environment variables, which is the safer direction. The vulnerable jira_issue.yml shape first appears in a different commit whose public metadata credits one human author and no Copilot co-author.

The security finding still matters. At merge, the workflow regressed from passing issue data through env: and constructing JSON with jq --arg to placing ${{ github.event.issue.title }} and body directly in a run: block. Shell escaping happened after Actions had already generated the script, so a crafted title could break out before sed got a chance to help. The repair restored the environment-variable and jq boundary.

I would test that boundary, not an AI label. For a workflow triggered by public issues, reject any change that puts user-controlled event fields directly inside run:. Feed quotes, newlines, and shell metacharacters through the accepted path and require them to remain data. Then inspect history when a patch removes an odd-looking layer such as env: plus jq; it may be the security control. Commit-level co-author trailers are not hunk provenance, and shaky attribution makes a sound review lesson easier to dismiss.