mirror of
https://github.com/abhigyanpatwari/GitNexus.git
synced 2026-10-27 06:12:20 +00:00
5d1bc3dcea
* feat(eval): measure PR cost before merge Reuse authenticated historical MCP measurements for one pinned PR preview. Keep the protected main evaluator and publish separate evidence that cannot authorize a release. * fix(eval): gate PR cost runs on a label Require a repository writer label event and retain the opt-in label and exact PR head before dispatch and paid sessions. Keep the request handler on trusted base code and execute evaluation on main. * ci: document trusted cost label trigger * fix(eval): restrict previews to maintainer labels Remove manual PR preview inputs and authorize Maintain/Admin roles before calling the protected reusable evaluator. Compare workflow measurement settings with historical evidence instead of exempting the entire workflow. --------- Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com>
69 lines
3.9 KiB
YAML
69 lines
3.9 KiB
YAML
# zizmor config — pre-existing intentional patterns flagged on initial introduction.
|
|
# Each ignore below has a documented mitigation. Re-evaluate when the source workflow changes.
|
|
#
|
|
# To run zizmor locally with this config:
|
|
# zizmor --config .github/zizmor.yml .
|
|
|
|
rules:
|
|
dangerous-triggers:
|
|
ignore:
|
|
# workflow_run is REQUIRED to post sticky comments on fork PRs — the
|
|
# default-branch privileged token isn't accessible from `pull_request`
|
|
# on a fork. Mitigated by: read-only `actions:read` + `contents:read`
|
|
# for artifact download; `pull-requests:write` is the only write scope;
|
|
# no checkout of fork code occurs. Header comment in the file documents.
|
|
- ci-report.yml
|
|
|
|
# workflow_run is the trusted half of the autofix pipeline. The
|
|
# untrusted half (pr-autofix.yml) runs fork code with permissions:{}
|
|
# and produces only a diff artifact (data, not executable code). The
|
|
# publish job consumes the artifact, allowlist-validates every field
|
|
# of metadata.json, then cross-checks identity against
|
|
# workflow_run.head_sha / head_repository / head_branch via
|
|
# pulls?head=owner:branch (commits/{sha}/pulls is empty for fork SHAs).
|
|
# It never checks out fork code and never executes anything
|
|
# fork-controlled. Header comment in the file documents the split.
|
|
- pr-autofix-publish.yml
|
|
|
|
# workflow_run is the trusted half of the vendored-grammar prebuild
|
|
# pipeline (commit-fork-prebuilds.yml). The untrusted producer
|
|
# (build-tree-sitter-prebuilds.yml on a fork pull_request) builds +
|
|
# validates the .node prebuilds and uploads them as artifacts. This
|
|
# consumer downloads ONLY those artifacts + metadata.json,
|
|
# allowlist-validates every metadata field, cross-checks identity against
|
|
# workflow_run.head_sha / head_repository / head_branch via
|
|
# pulls?head=owner:branch (commits/{sha}/pulls is empty for fork SHAs), and
|
|
# checks out the fork head pinned to that HEAD SHA solely to ADD prebuild
|
|
# files (never executes fork code) before pushing. Header comment in the
|
|
# file documents the split.
|
|
- commit-fork-prebuilds.yml
|
|
|
|
# pull_request_target needed by claude-code-action to access secrets
|
|
# and post review comments on fork PRs. Mitigated by: PR checkouts pin
|
|
# the fork's HEAD SHA (not the branch ref) to prevent TOCTOU races,
|
|
# and claude-code-action sandboxes execution. Header comment documents.
|
|
- claude.yml
|
|
|
|
# pull_request_target on the autolabel job needs `pull-requests:write`
|
|
# to apply labels. Mitigated by: release-drafter runs with `dry-run:
|
|
# true`, reads only `.github/release-drafter.yml` from the BASE ref,
|
|
# and the validate-title job (which runs untrusted `pull_request`
|
|
# context) holds no write permissions. Header comment documents.
|
|
- pr-labeler.yml
|
|
|
|
# pull_request_target is required for a label request on fork PRs to
|
|
# call the protected evaluator on main. This hosted handler checks
|
|
# out only github.sha (the trusted base commit), never PR code, and
|
|
# verifies the labeling actor's Maintain/Admin role plus the live
|
|
# label/head. Its token is read-only. The evaluator job calls trusted
|
|
# reusable workflow code under the existing main-only protected
|
|
# environment; no PR source is executed by this request handler.
|
|
# Tests lock down base checkout, maintainer gate and changed-head denial.
|
|
- pr-cost-evaluation.yml
|
|
|
|
# Note: cache-poisoning is NOT exempted. The two prior findings in
|
|
# publish.yml and the former release-candidate.yml were fixed structurally
|
|
# by dropping `cache: npm` from those workflows (matches the pattern used
|
|
# by PyO3/maturin for the same audit). After the publish-workflow
|
|
# unification (issue #1609), only publish.yml remains; the same
|
|
# cache-poisoning hardening applies there.
|