mirror of
https://github.com/abhigyanpatwari/GitNexus.git
synced 2026-10-03 02:21:44 +00:00
1e8bdd890a
* fix(ci): look up fork prebuild PRs by head owner and branch
commits/{sha}/pulls is empty for fork SHAs, so deliver-fork-prebuilds failed closed on every real fork PR. Resolve the open PR from workflow_run head owner+branch instead.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(ci): use the same fork-PR lookup in autofix publish
pr-autofix-publish had the same commits/{sha}/pulls fallback, which is empty for fork SHAs. Share the pulls?head=owner:branch verifier and always run it before sticky comments or check runs.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(ci): fail closed on ambiguous fork-head PRs
Untrusted artifact pr_number must not pick among sibling open PRs from the same fork branch. Parse paginated gh --slurp pages and require verify success before prebuild checkout/push.
Co-authored-by: Cursor <cursoragent@cursor.com>
* style(ci): prettier the fork-PR identity verifier
Root prettier --check fails on .cjs; lint-staged only formats .js.
Co-authored-by: Cursor <cursoragent@cursor.com>
---------
Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
59 lines
3.2 KiB
YAML
59 lines
3.2 KiB
YAML
# zizmor config — pre-existing intentional patterns flagged on initial introduction.
|
|
# Each ignore below has a documented mitigation. Re-evaluate when the source workflow changes.
|
|
#
|
|
# To run zizmor locally with this config:
|
|
# zizmor --config .github/zizmor.yml .
|
|
|
|
rules:
|
|
dangerous-triggers:
|
|
ignore:
|
|
# workflow_run is REQUIRED to post sticky comments on fork PRs — the
|
|
# default-branch privileged token isn't accessible from `pull_request`
|
|
# on a fork. Mitigated by: read-only `actions:read` + `contents:read`
|
|
# for artifact download; `pull-requests:write` is the only write scope;
|
|
# no checkout of fork code occurs. Header comment in the file documents.
|
|
- ci-report.yml
|
|
|
|
# workflow_run is the trusted half of the autofix pipeline. The
|
|
# untrusted half (pr-autofix.yml) runs fork code with permissions:{}
|
|
# and produces only a diff artifact (data, not executable code). The
|
|
# publish job consumes the artifact, allowlist-validates every field
|
|
# of metadata.json, then cross-checks identity against
|
|
# workflow_run.head_sha / head_repository / head_branch via
|
|
# pulls?head=owner:branch (commits/{sha}/pulls is empty for fork SHAs).
|
|
# It never checks out fork code and never executes anything
|
|
# fork-controlled. Header comment in the file documents the split.
|
|
- pr-autofix-publish.yml
|
|
|
|
# workflow_run is the trusted half of the vendored-grammar prebuild
|
|
# pipeline (commit-fork-prebuilds.yml). The untrusted producer
|
|
# (build-tree-sitter-prebuilds.yml on a fork pull_request) builds +
|
|
# validates the .node prebuilds and uploads them as artifacts. This
|
|
# consumer downloads ONLY those artifacts + metadata.json,
|
|
# allowlist-validates every metadata field, cross-checks identity against
|
|
# workflow_run.head_sha / head_repository / head_branch via
|
|
# pulls?head=owner:branch (commits/{sha}/pulls is empty for fork SHAs), and
|
|
# checks out the fork head pinned to that HEAD SHA solely to ADD prebuild
|
|
# files (never executes fork code) before pushing. Header comment in the
|
|
# file documents the split.
|
|
- commit-fork-prebuilds.yml
|
|
|
|
# pull_request_target needed by claude-code-action to access secrets
|
|
# and post review comments on fork PRs. Mitigated by: PR checkouts pin
|
|
# the fork's HEAD SHA (not the branch ref) to prevent TOCTOU races,
|
|
# and claude-code-action sandboxes execution. Header comment documents.
|
|
- claude.yml
|
|
|
|
# pull_request_target on the autolabel job needs `pull-requests:write`
|
|
# to apply labels. Mitigated by: release-drafter runs with `dry-run:
|
|
# true`, reads only `.github/release-drafter.yml` from the BASE ref,
|
|
# and the validate-title job (which runs untrusted `pull_request`
|
|
# context) holds no write permissions. Header comment documents.
|
|
- pr-labeler.yml
|
|
|
|
# Note: cache-poisoning is NOT exempted. The two prior findings in
|
|
# publish.yml and the former release-candidate.yml were fixed structurally
|
|
# by dropping `cache: npm` from those workflows (matches the pattern used
|
|
# by PyO3/maturin for the same audit). After the publish-workflow
|
|
# unification (issue #1609), only publish.yml remains; the same
|
|
# cache-poisoning hardening applies there.
|