PR #1627's npm install -g npm@latest step crashed mid-install with MODULE_NOT_FOUND: promise-retry — a known fragility when npm self-upgrades. Node 22's bundled npm is 10.9.x (no OIDC). Fix: bump publish job's node-version to 24, which ships with npm 11.x natively. Package consumers unaffected (this Node version is only used during publish; engines.node is >=22.0.0; ci-tests.yml continues testing on Node 22).
First live-fire RC publish after #1610 failed at npm publish with E404. The if: failure() cleanup correctly auto-deleted the partial v-tag and rc-marker, but OIDC never engaged. Root cause: two coordinated upstream bugs.
1. actions/setup-node@v6 with registry-url: writes _authToken into the runner .npmrc AND exports NODE_AUTH_TOKEN from its token: input (defaulting to github.token). npm publish sends GITHUB_TOKEN as the bearer and the registry returns 404. OIDC never tried because npm thinks it already has a credential. See actions/setup-node#1440.
2. The Node 22 runner ships with npm 10.9.x. npm Trusted Publishing OIDC support requires npm >= 11.5.1.
Fix: omit registry-url: from the setup-node step (per the consensus workaround in community discussion #176761), and add npm install -g npm@latest before publish. --provenance flag is NOT added; npm auto-attaches provenance under Trusted Publishing.
Sources:
- https://github.com/actions/setup-node/issues/1440
- https://github.com/orgs/community/discussions/176761
- https://docs.npmjs.com/trusted-publishers/
Collapse release-candidate.yml into publish.yml so there is exactly one workflow that publishes gitnexus to npm, creates GitHub Releases, and triggers Docker builds — for both release candidates and stable releases. Closes#1609 architecturally.
A first-stage `route` job classifies push-to-main / push-tag / workflow_dispatch into `rc` / `stable` modes and fails closed on malformed shapes. RC path runs rc-guard → ci.yml → publish (mint GitHub App token → checkout with persist-credentials:false → resolve next rc version → atomic v-tag + rc/<SHA> marker push → vtag integrity gate → npm publish via OIDC → GitHub prerelease → if: failure() cleanup) → docker.yml. Stable path verifies package.json matches the tag and publishes to `latest` via OIDC (no docker).
Hardening:
• Self-trigger prevention via negative-glob `tags: ['v*', '!v*-rc.*']` — the bug class behind #1609 cannot recur.
• Two distinct actions/checkout steps per mode (no conditional `token:` expression footgun).
• Workflow-level `permissions: {}` deny-all + per-job grants; `id-token: write` only where OIDC is used.
• npm Trusted Publishing replaces NPM_TOKEN (delete the secret after the first successful publish).
• GitHub App installation token (actions/create-github-app-token@v3.2.0) replaces the long-lived RELEASE_PUSH_TOKEN PAT (delete after first successful RC).
• vtag integrity gate fails closed on empty / mode-mismatched output (prevents Release named `main` from a github.ref fallback).
• Annotation-injection sanitization on every logged ref.
• Explicit `secrets:` passthrough on docker.yml (DOCKERHUB_USERNAME, DOCKERHUB_TOKEN); ci.yml no longer inherits anything.
• `if: failure()` cleanup auto-deletes v-tag + rc-marker on partial failure (eliminates the external-consumer phantom-version ingestion window).
• ACTIONS_STEP_DEBUG window closed via `set +x` wrap on the inline auth-header compute.
• Curated retry-loud error handling on `gh api` bot-user-id lookup and `npx semver`.
Pre-merge validation:
• 10-reviewer multi-agent code-review pass; 14 findings fixed inline (commit 820cefae), 6 deferred to follow-ups.
• End-to-end dry-run rehearsal via workflow_dispatch (run 25919563064) validated route classification, rc-guard, App token mint, RC checkout, version resolver, vtag synthetic-regex check, and faithful tarball pack at the bumped version.
• All zizmor findings on the unification commits closed.
• Branch-protection required checks all green.
Post-merge actions:
• After the first successful RC, delete the `NPM_TOKEN` and `RELEASE_PUSH_TOKEN` secrets — they are no longer used.
• The first real RC after merge is the live-fire test for steps dry-run could not exercise (atomic tag push, real npm OIDC handshake, GitHub Release creation, docker.yml under explicit secrets passthrough). The if: failure() cleanup step handles the partial-failure recovery automatically; the Rollback Runbook in CONTRIBUTING.md covers the rare cases auto-cleanup can't reach.
Claude Code defaults to prompting for Bash approval. In GitHub Actions there
is no human to approve, so gh pr comment and similar commands fail and the
PR receives no review comment. Pass --dangerously-skip-permissions for the
code-review step only (headless CI; token and checkout are already scoped).
Co-authored-by: Cursor <cursoragent@cursor.com>
The Run Claude Code Review step passed an invalid PR ref
(owner/repo/pull/N) which gh interprets as a branch name, causing
early gh pr view failures. More importantly, the prompt omitted
--comment, so the code-review plugin only displayed findings in
terminal output and never invoked gh pr comment to post to the PR.
Switch to a full PR URL and add --comment so the plugin posts the
review during the session, which also routes around upstream bugs
anthropics/claude-code-action#1061 and #1087 where the action's
post-step capture can silently drop output on issue_comment triggers.
* ci(release): skip rc build on release PRs
Suppress the auto-fired Release Candidate workflow when:
1. The HEAD commit subject matches `chore: release vX.Y.Z` (the canonical
release-PR title), or
2. The squash-merged PR carries the `release` label.
Either match short-circuits the guard to should_run=false. This prevents the
rc cycle from racing publish.yml on the v-tag (as happened on v1.6.4 where
we had to manually cancel the auto-fired RC run after merging PR #1473).
Adds pull-requests: read to the guard job for the label lookup. A failed
gh API call falls through to the existing dedup logic rather than silently
suppressing rc builds.
* ci(release): address PR #1474 review — anchor regex + sanitise log echo
Two minor follow-ups from Claude's review:
1. End-anchor the release-subject regex. The previous shape
^chore: release vX.Y.Z would match noisy variants like
chore: release v1.0.0 (something unrelated). The new shape
requires either the bare title or the canonical squash-merge
(#NNNN) suffix exactly.
2. Sanitise HEAD_SUBJECT before echoing to logs. git %s strips
newlines so LF injection is impossible, but a hypothetical
subject containing ::error:: or ::set-output:: could otherwise
forge GitHub Actions annotation entries. Defence-in-depth.
Both findings flagged minor / does not block merge — applying
anyway since they are trivial.
* Initial plan
* chore(security): harden workflow permissions and pin Docker base image digests
Agent-Logs-Url: https://github.com/abhigyanpatwari/GitNexus/sessions/2ddc8f2b-7355-48cf-9a0b-c06df66c3f47
* fix(security): restore permissions: {} on publish + release-candidate workflows
These two release-publishing workflows had permissions: {} (the strictest valid form) before PR #1454, which replaced it with permissions: read-all. Every job in both files already declares its own permissions block, so the workflow-level default is only the safety net for future jobs added without one — read-all weakens that net for no benefit. Restore {} and the explanatory comment.
Scorecard's TokenPermissions check accepts both forms, so this preserves U9 compliance.
* fix(security): narrow permissions: read-all to contents: read on 13 workflows
PR #1454 added permissions: read-all to 13 workflows that previously had no top-level permissions block. read-all is Scorecard-compliant but unnecessarily broad — every job in scope only needs contents:read at the workflow level (job-level blocks already grant the writes that any job actually performs).
Snapshot of every job in the 13 workflows confirms contents:read is sufficient:
- ci.yml: quality/tests/scope-parity have explicit contents:read job blocks; save-pr-meta uses upload-artifact only (no token scopes needed); ci-status is pure shell.
- ci-e2e.yml, ci-quality.yml, ci-scope-parity.yml, ci-tests.yml: all jobs do checkout + npm + tsc/vitest/playwright/upload-artifact only; no API token scopes required.
- claude.yml, codeql.yml, dependency-review.yml, docker.yml, gitleaks.yml, pr-labeler.yml, trivy.yml, workflow-lint.yml: all jobs already declare their own job-level blocks (security-events:write, pull-requests:write, packages:write, etc.) so the workflow-level default does not gate them.
zizmor (--min-severity high) is clean on the resulting tree. Pre-existing medium findings (secrets-inherit, artipacked) are in unrelated workflows and untouched by this commit.
scorecard.yml also uses read-all but pre-existed PR #1454 and is deferred to a follow-up PR per the plan's scope boundary.
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Gergő Magyar <gergomagyar@icloud.com>
* fix: pin Docker node base images and remediate bundled npm CVEs
Agent-Logs-Url: https://github.com/abhigyanpatwari/GitNexus/sessions/e0605c79-296e-4b3a-b6c3-4ad375950935
Co-authored-by: magyargergo <11230420+magyargergo@users.noreply.github.com>
* fix: run trivy on docker PR changes and remove corepack
Agent-Logs-Url: https://github.com/abhigyanpatwari/GitNexus/sessions/4d714047-4fc1-4af1-9734-91400a15568f
Co-authored-by: magyargergo <11230420+magyargergo@users.noreply.github.com>
* chore: add docker digest updates and normalize dockerfile comments
Agent-Logs-Url: https://github.com/abhigyanpatwari/GitNexus/sessions/7d980908-a823-4c28-b074-9134ec672e84
Co-authored-by: magyargergo <11230420+magyargergo@users.noreply.github.com>
* fix: add dependabot cooldown policies
Agent-Logs-Url: https://github.com/abhigyanpatwari/GitNexus/sessions/a8531b8d-384b-4c54-84dd-a98b31993c44
Co-authored-by: magyargergo <11230420+magyargergo@users.noreply.github.com>
* fix: remove unsupported dependabot cooldown keys
Agent-Logs-Url: https://github.com/abhigyanpatwari/GitNexus/sessions/166df50e-c2fe-4d7f-ab41-e94c703338f6
Co-authored-by: magyargergo <11230420+magyargergo@users.noreply.github.com>
* chore(node): bump CI + engines to Node 22; centralize NPM_VERSION via build ARG
Closes the LOW findings from Claude Final Re-Review on PR #1455:
- Bump engines.node to >=22.0.0 and align all CI workflows (ci-quality,
pr-autofix, publish, release-candidate) and the composite setup
actions on Node 22. Node 20 reached EOL on 2026-04-30; the test
Docker image was already on 22.
- Centralize the bootstrapped npm version in a single ARG NPM_VERSION
per Dockerfile (cli, web, gitnexus/Dockerfile.test) so a security
bump only requires updating one default per file with a clear
cross-reference comment.
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: magyargergo <11230420+magyargergo@users.noreply.github.com>
Co-authored-by: Gergo Magyar <gergomagyar@icloud.com>
* fix(autofix): verify reviewdog actually posted before claiming "click Apply"
The sticky summary comment was stating "Posted formatting suggestions
inline. Click Apply suggestion on each" even when reviewdog landed zero
inline review comments — typical case: the formatter touched lines
outside the PR's added range, so `-filter-mode=added` (correctly)
filtered everything out. The script unconditionally set `posted=true`
after running reviewdog regardless of whether any comments were
actually created, leaving the user staring at a sticky that promised
buttons that didn't exist.
The publish job now snapshots the count of `github-actions[bot]` review
comments before and after reviewdog. If the delta is zero, surface a
new `diff-no-overlap` UI state that tells the user plainly:
"Formatter found fixable issues, but they're on lines outside this
PR's added range — there's nothing to click here. Run locally:
npm run lint:fix && npm run format."
Plus a matching `gitnexus/autofix` Check Run conclusion (still neutral,
distinct title) so agents reading `gh pr checks` see the same signal.
Three states are now machine-distinguishable in the sticky's
gitnexus-autofix JSON block: suggestions-posted (delta > 0),
diff-no-overlap (delta == 0), skipped-too-large (>3k lines).
* feat(autofix): replace inline reviewdog with /autofix ChatOps button
Pivot the PR autofix UX from per-line reviewdog suggestions to a single
slash-command button. Contributors comment `/autofix` on the PR; a new
trusted workflow downloads the existing autofix patch artifact, applies
it to the PR head, and pushes a commit back.
Why:
- 3K+ diffs hit GitHub's review-comment API 406 limit -> dead end.
- Diffs where the formatter touches lines outside the PR's added range
("no-overlap") get filtered by reviewdog's -filter-mode=added -> dead
end (PR #1457 patched the lying sticky but the underlying UX gap
remained).
- Per-line click-Apply-suggestion is high-friction for big diffs and
easy to apply unevenly.
- A single `git apply` + push works at any size and lands fixes
atomically.
Changes:
- pr-autofix-publish.yml: remove `Install reviewdog` and
`Post inline suggestions` steps. Collapse three sticky states
(suggestions-posted, diff-no-overlap, skipped-too-large) into one
(fixes-available). Bump JSON schema v1 -> v2 with `apply_command`
field; all v1 fields preserved.
- pr-autofix-apply.yml (new): triggers on issue_comment with body
`/autofix`, validates body via strict regex, validates commenter
has write/admin/maintain or is the PR author, locates latest
successful pr-autofix run for PR head SHA, downloads artifact,
applies patch, pushes commit. Reacts +1/-1/eyes on triggering
comment per outcome. Idempotent (`git apply --check --reverse`
detects already-applied state).
- CONTRIBUTING.md: document v2 schema and the /autofix flow,
including the maintainer-edit requirement for fork PR pushes.
Trust posture: apply workflow runs from default-branch code only,
under issue_comment trigger. Comment body and author login flow
through env vars and pattern-matched, never interpolated into shell.
Permission gate (write/admin/maintain OR PR author) before any
artifact fetch. Fork PRs require "Allow edits by maintainers"
(GitHub-native; we don't bypass).
Net YAML: -139 lines in publish.yml, +260 in apply.yml. Removes
reviewdog binary pin and the entire review-comment API surface.
* fix(autofix): address Codex adversarial findings on PR #1458
Two findings from the Codex adversarial review of the autofix ChatOps
pivot. Both are localized YAML changes that close trust gaps the pivot
inherited from the original PR #1446 design.
U1 — Cross-verify metadata against workflow_run authority
(.github/workflows/pr-autofix-publish.yml):
Previously the trusted publisher accepted pr_number, head_sha, and
head_repo from metadata.json after only an allowlist regex. A
fork-controlled `npm run lint:fix` could have written a syntactically
valid metadata.json referencing another PR/SHA, redirecting the
write-scoped sticky/check-run onto an attacker-chosen target.
New `Verify metadata against workflow_run authority` step compares
artifact-claimed identity against:
- github.event.workflow_run.head_sha
- github.event.workflow_run.head_repository.full_name
- workflow_run.pull_requests[].number (within-repo PRs)
- gh api commits/{sha}/pulls fallback (fork PRs, where
pull_requests[] is empty)
Fail closed on mismatch — no sticky, no check-run, no override.
U2 — Lease-protected push in apply workflow
(.github/workflows/pr-autofix-apply.yml):
Previously the apply step pushed `HEAD:${HEAD_REF}` plain. A force-
push between resolve (Step 5) and push (Step 9) would silently
fast-forward an older commit graph over the contributor's newer
state.
Push now uses `--force-with-lease=refs/heads/${HEAD_REF}:${HEAD_SHA}`
against the SHA resolved earlier. Distinct `lease-failed` result code
+ retry-message reply, separated from `push-failed` (fork without
maintainer-edit) so contributors can diagnose the actual cause.
Plan: docs/plans/2026-05-09-005-fix-autofix-codex-adversarial-findings-plan.md
(local-only per repo convention).
Trust posture preserved: no new permissions, no new workflows, no
contract change. JSON v2 schema unchanged. CodeQL js/server-side-
request-forgery and template-injection posture unchanged — all new
inputs flow via env vars and pattern-matched.
* fix(autofix): close zizmor credential-persistence finding on apply checkout
actions/checkout's default behavior writes the GITHUB_TOKEN into
.git/config as an extraheader. The token then sits on disk in the
checkout directory — an actions/upload-artifact step on that
directory would leak it. We don't upload, but zizmor's
credential-persistence lint correctly flags the latent risk.
Set persist-credentials: false on the Checkout PR head step. Provide
push auth inline via `git -c http.extraheader="Authorization: Basic
<base64-of-x-access-token:TOKEN>"` so the credential never lands on
disk and never appears in process listings (the URL form
https://x-access-token:TOKEN@… is rejected here because it leaks via
ps and git remote -v).
Push lease semantics from U2 unchanged — same --force-with-lease
against the resolved HEAD_SHA, same lease-failed/push-failed/stale
result codes.
* fix(review): apply autofix feedback
ce-code-review surfaced 15 findings on PR #1458; this commit applies
the 7 with concrete fixes (#1, #2, #3, #4, #5, #9, #13). Five P2
findings (#6, #7, #8, #10, #12) are recorded as residual actionable
work for follow-up; two advisory items (#11, #14) skipped.
#1 — applied_run_id schema drift (CONTRIBUTING.md):
v2 docs claimed `state: applied` enum value and an `applied_run_id`
field that no code path emits. Trimmed docs to match what the
workflow actually writes (state: fixes-available; v1 field set as
superset). Implementing the apply-side sticky upsert that would
populate `applied_run_id` is deferred — cleaner than carrying a
contract claim with no code.
#2 — result= unset between idempotency probe and lease push
(pr-autofix-apply.yml):
After `git apply --check` passed, an early non-zero exit from
`git config` / `git apply` / `git add` / `git commit` left
`result=` unset, sending the user to the `*` "unexpected state
(`unknown`)" arm. Wrapped the apply/commit phase in a single
if-test that sets `result=apply-failed` on any failure. New
React-and-reply branch surfaces an actionable message.
#3 — permission lookup conflated transient API failures with denial
(pr-autofix-apply.yml):
`gh api … 2>/dev/null || echo "none"` swallowed 5xx, 429 secondary
rate-limit, and network failures, surfacing them as a public 👎
refusal to legitimate maintainers. Now distinguishes 404
(genuine non-collaborator) from other API failures via stderr
match. New `allowed=api-failed` state triggers a 😕 reaction with
a "transient API failure, retry" reply instead of a misleading
refusal.
#4 — lease-failure grep missed git's "remote rejected" / branch-
deleted phrasings (pr-autofix-apply.yml):
Real lease failures got classified as `push-failed` →
user told to enable maintainer-edit, which won't help. Expanded
regex to match `remote rejected` and `! [rejected]`.
#5 — broken bullet continuation in CONTRIBUTING.md release-candidate
section: rejoined the split bullet so it renders correctly.
#9 — base64 GITHUB_TOKEN bypassed GitHub's secret-masker
(pr-autofix-apply.yml):
Added `::add-mask::${auth_header}` immediately after construction
so any subsequent log line (set -x, GIT_TRACE) gets *** redacted.
#13 — misleading schema-bump comment in pr-autofix-publish.yml:
Comment claimed all v1 fields preserved exactly, but the `state`
enum was redefined v1→v2. Updated to make the migration path
explicit (v1 readers see unfamiliar schema, fall back to prose).
Residual actionable work (deferred to follow-up):
#6 locate step gh api retry; #7 artifact-expired graceful fallback;
#8 re-entrancy comment-spam guard; #10 producer-still-running UX;
#12 gh_retry wrapper for apply.yml.
Validations: yaml.safe_load OK, check-workflow-concurrency.py OK.
* fix(autofix): apply remaining ce-code-review residual findings (#6, #7, #8, #10, #12)
Pulls the deferred items from the previous review pass into this PR so
the workflow ships with full reliability + UX coverage rather than
follow-up debt.
#6 + #12 — gh_retry wrapper on idempotent GETs in apply.yml:
Permission lookup, PR metadata fetch, and workflow-run lookup are now
wrapped in the same gh_retry helper publish.yml uses (3 attempts,
linear backoff). Reaction/comment POSTs remain unwrapped (retrying
POST would dupe the resource).
#10 — producer-still-running UX:
The locate step now distinguishes three cases via `found_status`
output: success (proceed), in-progress / queued / pending / waiting
(reply ⏳ "wait for autofix run to finish"), not-found (reply 🤔
"push a commit"), api-failed (reply ⚠️ "transient API failure"). The
"no successful autofix run" message no longer fires immediately after
a fresh push while the producer is still mid-run.
#7 — artifact-expired graceful fallback:
actions/download-artifact gains `continue-on-error: true`. The apply
step distinguishes patch-file-missing (artifact expired, 1-day
retention elapsed) from patch-file-zero-bytes (formatter found
nothing). New `result=artifact-expired` case + ⏳ "push a new commit
to regenerate" reply.
#8 — re-entrancy loop guard:
After checkout but before applying, check if HEAD itself is a
github-actions[bot] `chore(autofix)` commit. If so, refuse to
re-apply (`result=loop-prevented`) with a 🔁 reply telling the user
to push a human-authored commit or revert before retrying. Prevents
formatter-config-drift loops where an automated agent watching the
sticky could pump arbitrary apply commits.
Net effect: every code path in apply.yml now sets a meaningful `result=`
that maps to a specific user-facing reaction + reply. The `*` "unexpected
state (unknown)" arm becomes truly unreachable in normal operation.
Validations: yaml.safe_load OK, check-workflow-concurrency.py OK.
* fix(autofix): refresh stale reviewdog comments + reject patches touching .github/
Two follow-up findings on PR #1458:
#1 — Stale reviewdog references in workflow header comments:
pr-autofix-publish.yml's header still described the removed inline-
suggestion path ("posts inline review-comment suggestions to the PR
using `reviewdog`", "Reviewdog reporter: github-pr-review reads
$REVIEWDOG_GITHUB_API_TOKEN…"). The Check Run permissions comment
enumerated the old outcomes (clean / suggestions-posted /
skipped-too-large) instead of the current set (clean / fixes-
available). pr-autofix.yml's header described the trusted job as
posting "inline review-comment suggestions" and the changed_lines
comment referenced the dead 3000-line cap. Refreshed all three to
describe the actual sticky + Check Run + /autofix flow.
#2 — Reject patches touching .github/ (sensitive-paths guard):
Theoretical supply-chain vector: a malicious PR could ship a custom
prettier/ESLint config that reformats workflow YAML, dependabot.yml,
or CODEOWNERS. The producer would capture those edits in
autofix.patch; a maintainer running `/autofix` would push them under
`contents: write` without human review. The default GITHUB_TOKEN
lacks the `workflows` scope so workflow-file pushes would fail at
the platform layer anyway, but as a generic `push-failed` (which
misleads users into enabling maintainer-edit). Reject early with
a specific reason.
Match runs against the patch with grep on `^(diff --git|---|+++)
[ab]?/?\.github/`. New `result=sensitive-paths` case + 🛑 reply
telling the user to apply .github/ formatter changes manually.
Documented the constraint in CONTRIBUTING.md under the /autofix
section so contributors aren't surprised when the workflow refuses
a patch that includes formatter changes to workflow files.
Validations: yaml.safe_load OK, check-workflow-concurrency.py OK.
* ci: add fork-safe PR autofix pipeline
Two-workflow split posts prettier + eslint --fix output as inline
review-comment suggestions on PRs (including fork PRs) without running
fork-controlled ESLint plugins under a privileged token.
- pr-autofix.yml: untrusted, runs lint:fix/format with permissions: {},
uploads diff artifact. paths-ignore on lockfiles/snapshots/dist to
avoid reviewdog 406 on >3k-line diffs.
- pr-autofix-publish.yml: trusted workflow_run consumer. Validates every
metadata.json field with regex allowlists before exporting to
GITHUB_OUTPUT (closes head_ref newline-injection vector). Concurrency
keyed on PR number with fork fallback to head-repo+branch. Reviewdog
pinned to v0.21.0. Sticky comment posts only when patch is non-empty
(no noise on clean PRs); body carries a fenced gitnexus-autofix JSON
block under a stable HTML marker for agent parsing. gh API calls go
through a small retry helper for transient 5xx.
Branch protection should enable merge queue + 'require branches up to
date' to handle PR freshness; chinthakagodawita/autoupdate is dropped
(unmaintained since 2023).
* ci(autofix): close zizmor template-injection findings
Move fork-controlled values (head.ref, head.repo.full_name, head.sha,
pr.number, github.repository) into the step's env: block instead of
interpolating them with `${{ }}` directly into the bash run body. The
job has permissions:{} today so this is defence-in-depth, but a future
scope grant on the untrusted half would otherwise turn a malicious
branch name into shell injection.
Add pr-autofix-publish.yml to the documented dangerous-triggers ignore
list — workflow_run is required to post sticky comments on fork PRs
and the file's structural defences (no fork checkout, allowlist on
metadata.json, base_repo equality check) match the existing
ci-report.yml exemption.
* ci(autofix): close remaining review findings
- Add an actionlint job to workflow-lint.yml. Catches YAML syntax,
expression typing, shellcheck-inside-run, and deprecated runner
labels on every .github/** PR — closes the gap that let pr-autofix's
YAML literal-block bug reach review on this branch.
- pr-autofix-publish.yml emits a `gitnexus/autofix` Check Run on the
PR head SHA: conclusion `success` for clean, `neutral` (with
distinct output titles) for suggestions-posted vs.
skipped-too-large. Stable name lets agents read the outcome via
`gh pr checks` without parsing the sticky comment.
- Document the autofix signal contract in CONTRIBUTING.md — sticky
marker, fenced gitnexus-autofix JSON schema, Check Run name. One
source of truth so the marker / schema fields don't drift across
the workflow files and consumers.
* ci: fix actionlint/shellcheck findings on PR #1446
Closes the actionlint warnings the new lint job (workflow-lint.yml's
actionlint runner) surfaced once it was wired into CI. Mostly
shellcheck-style cleanups across three workflows.
pr-autofix-publish.yml
- SC2170: `[ "${{ steps.meta.outputs.changed_lines }}" -gt 3000 ]`
interpolates a literal string into bash, breaking shellcheck's
arithmetic-comparison parse. Move `changed_lines` through env: as
`CHANGED_LINES` and reference as `$CHANGED_LINES` inside bash.
ci-report.yml (Read PR metadata step)
- SC2002 ×2: `cat file | tr` -> `tr < file`.
- SC2129: three consecutive `>> "$GITHUB_OUTPUT"` redirects collapsed
into one `{ ...; } >> "$GITHUB_OUTPUT"` group.
ci-report.yml (Build report step)
- SC2162 ×2: `read VAR1 VAR2` -> `read -r VAR1 VAR2` so backslashes
in test-results.json output aren't mangled.
- SC2034: drop unused `SUITES` aggregate. The per-framework suite
counts (CLI_SU, WEB_SU) are now read into `_` placeholders since
the report doesn't surface them anywhere.
release-candidate.yml
- SC2129 ×2: collapse consecutive `>> "$GITHUB_OUTPUT"` redirects in
the rc-version computation step and the tag-push step into one
grouped block each.
The "Fetch base branch coverage" step in ci-report.yml now:
- Checks up to 5 recent successful main-branch CI runs
- Catches HTTP 410 (artifact expired) and tries the next run
- Gracefully sets found=false if all artifacts are expired/missing
This prevents the PR Report job from failing when the most recent
main-branch test-reports artifact has expired.
Agent-Logs-Url: https://github.com/abhigyanpatwari/GitNexus/sessions/a2a6b392-de09-4c76-b7ea-5de2c738cb9d
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: magyargergo <11230420+magyargergo@users.noreply.github.com>
The default GITHUB_TOKEN cannot be granted `workflows: write`, so
`git push --atomic` of the rc v-tag fails when its commit chain reaches
any commit that modified `.github/workflows/**`. Symptom on the most
recent run:
! [remote rejected] v1.6.4-rc.82 -> v1.6.4-rc.82
(refusing to allow a GitHub App to create or update workflow
`.github/workflows/trivy.yml` without `workflows` permission)
GitHub's rule: any ref-update that makes a workflow-modifying commit
reachable through the new ref requires `workflows: write` on the
identity performing the push, regardless of whether that commit is
already on another remote ref. The default GITHUB_TOKEN cannot hold
that permission.
Pass a fine-grained PAT (RELEASE_PUSH_TOKEN, scoped to this repo with
Contents: write + Workflows: write) into actions/checkout's `token`
input so origin is preauthed for the subsequent `git push`. The
job-level GITHUB_TOKEN keeps its scoped permissions for npm provenance
and other steps.
Required one-time setup:
1. Generate a fine-grained PAT
- Resource owner: account that owns this repo
- Repository access: Only select repositories → GitNexus
- Permissions: Contents: write, Workflows: write, Metadata: read
2. Add as repo secret named RELEASE_PUSH_TOKEN
3. Re-run the failed Release Candidate workflow with force=true
Considered and skipped: GitHub App approach (org-owned, bot identity,
short-lived tokens). Better long-term, but a fine-grained PAT is
acceptable at one-maintainer scale. Migration is mechanical if the
project later wants to switch.
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Test fixtures are intentionally synthetic inputs (broken/unused code,
malformed samples) used to exercise the analyzer. Quality-tool findings
on them are noise, not real bugs — they were drowning out actionable
signal in the GitHub Security tab.
- CodeQL: add `**/test/fixtures/**` to paths-ignore in codeql.yml
- ESLint: add `gitnexus-web/test/fixtures/**` to global ignores
(the gitnexus/ counterpart was already ignored)
- Prettier: add `gitnexus-web/test/fixtures/` to .prettierignore
(same gap as ESLint)
Real test files (*.test.ts) remain in scope so genuine issues like
js/file-system-race and js/insecure-temporary-file in test code still
surface.
* ci(security): add CodeQL SAST workflow for JS/TS and Python
CodeQL analyzes both languages on PR, main push, and weekly schedule.
Findings upload to the Security tab as SARIF. Advisory only on
introduction; promote to required check after baseline triage.
Plan: docs/plans/2026-05-03-001-feat-automated-security-scans-plan.md (U1)
* ci(security): add Dependency Review PR gate
Blocks PRs introducing high+ severity dependency vulnerabilities.
Posts inline summary comment on failure. Required-check candidate
after one week of clean runs.
Plan: docs/plans/2026-05-03-001-feat-automated-security-scans-plan.md (U2)
* ci(security): add Gitleaks secret scanning
PR runs scan the diff; main pushes scan full history.
Defense-in-depth on top of GitHub native push protection
(documented as a recommended Settings toggle in SECURITY.md).
Plan: docs/plans/2026-05-03-001-feat-automated-security-scans-plan.md (U3)
* ci(security): add OpenSSF Scorecard workflow
Weekly + on main push. SARIF uploads to Security tab; public
badge URL resolves after first scheduled run lands.
Plan: docs/plans/2026-05-03-001-feat-automated-security-scans-plan.md (U4)
* ci(security): add zizmor workflow lint
Lints .github/workflows/** for known Actions security misconfigurations
(unpinned actions, dangerous interpolation, missing permissions).
Triggered only on PRs touching .github/**.
Plan: docs/plans/2026-05-03-001-feat-automated-security-scans-plan.md (U5)
* ci(security): add Trivy container image scanning
Builds Dockerfile.cli and Dockerfile.web, then scans images for
HIGH/CRITICAL CVEs. Findings record-only on Security tab; not
PR-blocking. Weekly schedule + main push for freshness.
Plan: docs/plans/2026-05-03-001-feat-automated-security-scans-plan.md (U6)
* docs(security): add SECURITY.md policy and Scorecard badge
Vulnerability disclosure policy points to GitHub Private Vulnerability
Reporting. Documents in-CI scans landed in this branch and recommended
admin actions for forks.
Plan: docs/plans/2026-05-03-001-feat-automated-security-scans-plan.md (U7)
* fix(review): apply autofix feedback
- CodeQL paths-ignore: replace brace expansion (parser.{c,js}) with two
explicit entries — CodeQL uses .gitignore-style globs that do NOT support
brace expansion, so the original pattern matched no files.
- Trivy: pin aquasecurity/trivy-action from @master to @0.28.0 — mutable
refs are a supply-chain risk and are exactly what zizmor (added in this
same plan) is meant to flag.
ce-code-review run: /tmp/compound-engineering/ce-code-review/20260503-104259-279c3bc4/
* docs(review): record residual review findings
ce-code-review autofix run flagged three downstream-resolver items
that are not blockers but should land before promoting any of the new
security workflows to required PR checks.
Source: /tmp/compound-engineering/ce-code-review/20260503-104259-279c3bc4/
* fix(ci-security): address all zizmor + dependency-review violations
Resolves all GitHub Advanced Security findings on PR #1297:
- Add 'persist-credentials: false' to actions/checkout in 5 workflows
(codeql, dependency-review, gitleaks, trivy, workflow-lint). Prevents
the GITHUB_TOKEN from persisting in .git/config for downstream steps
to read. Scorecard already had it.
- Pin every net-new third-party Action to a commit SHA (was: major-tag
refs flagged by zizmor as 'unpinned action reference'):
github/codeql-action -> v3.35.3 (0daab03)
actions/dependency-review-action -> v4.9.0 (2031cfc)
gitleaks/gitleaks-action -> v2.3.9 (ff98106)
ossf/scorecard-action -> v2.4.3 (4eaacf0)
docker/build-push-action -> v6.19.2 (10e90e3)
- Bump aquasecurity/trivy-action 0.28.0 -> 0.36.0 (ed142fd). Versions
< 0.35.0 are flagged by GHSA-69fq-xp46-6x23 (briefly compromised
supply chain). Caught by Dependency Review on the introducing PR.
- Pin pipx-installed zizmor to 1.24.1 (was unpinned 'pipx install
zizmor' resolving to latest at run time).
Removes the now-stale residual-findings doc since every item it
recorded is resolved on this branch.
* fix(ci-security): clear remaining zizmor findings
After landing the new security workflows, zizmor reported 5 high+
findings against pre-existing workflows (none introduced by this PR's
new files, all introduced by zizmor's wider scope). Resolved per
research at docs.zizmor.sh and PyO3/maturin issue #2425:
Real fixes (cache-poisoning):
- publish.yml + release-candidate.yml: add 'package-manager-cache:
false' to actions/setup-node. setup-node v5+ enables caching by
default when a packageManager field is present in package.json;
explicit opt-out keeps release installs hermetic and clears the
audit. Cost: ~30s slower per release run.
Documented exemptions (dangerous-triggers, .github/zizmor.yml):
- ci-report.yml: workflow_run is REQUIRED to post sticky comments
on fork PRs (forks have read-only GITHUB_TOKEN on pull_request).
- claude.yml: pull_request_target is required by claude-code-action
to access secrets and post fork-PR review comments. PR checkouts
pin fork HEAD SHA to mitigate TOCTOU.
- pr-labeler.yml: pull_request_target on the autolabel job needs
pull-requests:write. release-drafter runs with dry-run:true and
reads config from the BASE ref only.
Each exemption carries the documented mitigation in zizmor.yml.
workflow-lint.yml now passes --config to both the SARIF and the
gate invocations.
Local 'zizmor --config .github/zizmor.yml --min-severity high .'
reports: No findings to report. Good job!
Avoid workflow planning failures by deriving the e2e GitNexus home from RUNNER_TEMP inside a shell step instead of using runner context in job-level env.
Made-with: Cursor
Let release-candidate.yml be the single main-push entry point that reuses CI before publishing, while keeping CI as the direct pull-request gate.
Made-with: Cursor
The early Validate step ran on both workflow_call and push events, but
push events never populate inputs.tag (the tag comes from github.ref).
This regressed every real tag-push release — v1.6.3's Docker Build &
Push failed at that gate. The downstream Verify step already falls back
to GITHUB_REF, so the upfront guard only needs to cover workflow_call.
Wraps docker/build-push-action with a local composite action that retries
once on failure (upstream keeps retry out of the action per
docker/build-push-action#1422). Adds ignore-error=true on cache-to so GHA
cache export flakes don't fail an otherwise successful push.
- Emit `::notice::` in the resolve step when attempt 2 recovers from a
first-attempt failure, so silent retries are grep-able in run logs and
trending registry/cache flakes stay visible.
- Bind `retry-wait-seconds` via `env:` in the backoff step to match the
env-binding convention used elsewhere in docker.yml (TAG_INPUT, DIGEST,
TAGS) — no direct expression interpolation inside shell bodies.
Preserves existing contract end-to-end: SHA pin, provenance=max, sbom=true,
dual-registry push, `steps.build.outputs.digest` wiring to Cosign and the
build-provenance attestations.
- Introduced a new job `validate` in the GitHub Actions workflow to validate the desktop package.
- Added steps for checking out the repository, setting up Node.js, installing dependencies, type checking, and running unit tests.
- Updated the `package` job to depend on the `validate` job.
chore: update package-lock.json and package.json for vitest integration
- Added `vitest` as a development dependency in `package.json`.
- Updated `typecheck` script to include a new TypeScript configuration for vitest.
- Updated `package-lock.json` to reflect the new dependencies.
refactor: modularize runtime path handling in main process
- Created a new module `runtime-paths.ts` to handle static path normalization and request handling.
- Refactored `main.ts` to utilize the new `normalizeStaticPath`, `getRequestedPath`, and `getPackagedRendererEntry` functions.
test: add unit tests for runtime path utilities
- Implemented tests for `normalizeStaticPath`, `getRequestedPath`, and `getPackagedRendererEntry` using Vitest.
- Ensured coverage for directory traversal attempts and null-byte paths.
chore: configure Vitest for testing
- Added `vitest.config.ts` for Vitest configuration.
- Created `tsconfig.vitest.json` to include types for Vitest in TypeScript compilation.
Co-authored-by: Copilot <copilot@github.com>
* ci(docker): mirror signed images to Docker Hub alongside GHCR
docker.yml now publishes to docker.io/abhigyanpatwari/gitnexus{,-web} in
the same build step as the existing GHCR push, so both registries receive
the same digest, the same Cosign keyless signature, and the same SBOM /
build-provenance attestations. The Docker Hub login uses new repo secrets
DOCKERHUB_USERNAME / DOCKERHUB_TOKEN (scoped PAT, not account password).
Supply-chain guarantees carry over unchanged: the signing loop iterates
metadata-action's full tag set, so Docker Hub tags get signed at the
identical digest under the same docker.yml@refs/tags/v* identity. The
ClusterImagePolicy is extended with docker.io / index.docker.io / bare-
namespace globs so admission cannot be sidestepped by registry-prefix
choice. README and .env.example document both registries; RC section in
CONTRIBUTING.md notes the Docker Hub mirror tag.
Closes#1027
* ci(docker): publish to akonlabs Docker Hub namespace; add PR dry-run CI
- Hardcode `akonlabs` as the Docker Hub namespace in metadata-action and
both attestation subject-names (Docker Hub org differs from GitHub org
`abhigyanpatwari`, so `github.repository_owner` would produce the wrong ref)
- Update docs (.env.example, README, CONTRIBUTING) and the Kubernetes
ClusterImagePolicy globs to reference `akonlabs/gitnexus{,-web}`
- Add `pull_request` trigger so the image build runs as CI on every PR
(build only — no push, sign, or attestation)
- Add `workflow_dispatch` with `dry_run: boolean` (default true) for
manual build-only runs; all publish steps gated on
`github.event_name != 'pull_request' && !inputs.dry_run`
