mirror of
https://github.com/abhigyanpatwari/GitNexus.git
synced 2026-09-23 00:41:36 +00:00
b5627f27d8
* ci: add fork-safe PR autofix pipeline
Two-workflow split posts prettier + eslint --fix output as inline
review-comment suggestions on PRs (including fork PRs) without running
fork-controlled ESLint plugins under a privileged token.
- pr-autofix.yml: untrusted, runs lint:fix/format with permissions: {},
uploads diff artifact. paths-ignore on lockfiles/snapshots/dist to
avoid reviewdog 406 on >3k-line diffs.
- pr-autofix-publish.yml: trusted workflow_run consumer. Validates every
metadata.json field with regex allowlists before exporting to
GITHUB_OUTPUT (closes head_ref newline-injection vector). Concurrency
keyed on PR number with fork fallback to head-repo+branch. Reviewdog
pinned to v0.21.0. Sticky comment posts only when patch is non-empty
(no noise on clean PRs); body carries a fenced gitnexus-autofix JSON
block under a stable HTML marker for agent parsing. gh API calls go
through a small retry helper for transient 5xx.
Branch protection should enable merge queue + 'require branches up to
date' to handle PR freshness; chinthakagodawita/autoupdate is dropped
(unmaintained since 2023).
* ci(autofix): close zizmor template-injection findings
Move fork-controlled values (head.ref, head.repo.full_name, head.sha,
pr.number, github.repository) into the step's env: block instead of
interpolating them with `${{ }}` directly into the bash run body. The
job has permissions:{} today so this is defence-in-depth, but a future
scope grant on the untrusted half would otherwise turn a malicious
branch name into shell injection.
Add pr-autofix-publish.yml to the documented dangerous-triggers ignore
list — workflow_run is required to post sticky comments on fork PRs
and the file's structural defences (no fork checkout, allowlist on
metadata.json, base_repo equality check) match the existing
ci-report.yml exemption.
* ci(autofix): close remaining review findings
- Add an actionlint job to workflow-lint.yml. Catches YAML syntax,
expression typing, shellcheck-inside-run, and deprecated runner
labels on every .github/** PR — closes the gap that let pr-autofix's
YAML literal-block bug reach review on this branch.
- pr-autofix-publish.yml emits a `gitnexus/autofix` Check Run on the
PR head SHA: conclusion `success` for clean, `neutral` (with
distinct output titles) for suggestions-posted vs.
skipped-too-large. Stable name lets agents read the outcome via
`gh pr checks` without parsing the sticky comment.
- Document the autofix signal contract in CONTRIBUTING.md — sticky
marker, fenced gitnexus-autofix JSON schema, Check Run name. One
source of truth so the marker / schema fields don't drift across
the workflow files and consumers.
* ci: fix actionlint/shellcheck findings on PR #1446
Closes the actionlint warnings the new lint job (workflow-lint.yml's
actionlint runner) surfaced once it was wired into CI. Mostly
shellcheck-style cleanups across three workflows.
pr-autofix-publish.yml
- SC2170: `[ "${{ steps.meta.outputs.changed_lines }}" -gt 3000 ]`
interpolates a literal string into bash, breaking shellcheck's
arithmetic-comparison parse. Move `changed_lines` through env: as
`CHANGED_LINES` and reference as `$CHANGED_LINES` inside bash.
ci-report.yml (Read PR metadata step)
- SC2002 ×2: `cat file | tr` -> `tr < file`.
- SC2129: three consecutive `>> "$GITHUB_OUTPUT"` redirects collapsed
into one `{ ...; } >> "$GITHUB_OUTPUT"` group.
ci-report.yml (Build report step)
- SC2162 ×2: `read VAR1 VAR2` -> `read -r VAR1 VAR2` so backslashes
in test-results.json output aren't mangled.
- SC2034: drop unused `SUITES` aggregate. The per-framework suite
counts (CLI_SU, WEB_SU) are now read into `_` placeholders since
the report doesn't surface them anywhere.
release-candidate.yml
- SC2129 ×2: collapse consecutive `>> "$GITHUB_OUTPUT"` redirects in
the rc-version computation step and the tag-push step into one
grouped block each.
43 lines
2.2 KiB
YAML
43 lines
2.2 KiB
YAML
# zizmor config — pre-existing intentional patterns flagged on initial introduction.
|
|
# Each ignore below has a documented mitigation. Re-evaluate when the source workflow changes.
|
|
#
|
|
# To run zizmor locally with this config:
|
|
# zizmor --config .github/zizmor.yml .
|
|
|
|
rules:
|
|
dangerous-triggers:
|
|
ignore:
|
|
# workflow_run is REQUIRED to post sticky comments on fork PRs — the
|
|
# default-branch privileged token isn't accessible from `pull_request`
|
|
# on a fork. Mitigated by: read-only `actions:read` + `contents:read`
|
|
# for artifact download; `pull-requests:write` is the only write scope;
|
|
# no checkout of fork code occurs. Header comment in the file documents.
|
|
- ci-report.yml
|
|
|
|
# workflow_run is the trusted half of the autofix pipeline. The
|
|
# untrusted half (pr-autofix.yml) runs fork code with permissions:{}
|
|
# and produces only a diff artifact (data, not executable code). The
|
|
# publish job consumes the artifact, allowlist-validates every field
|
|
# of metadata.json before exporting to $GITHUB_OUTPUT, never checks
|
|
# out fork code, and never executes anything fork-controlled. Header
|
|
# comment in the file documents the split.
|
|
- pr-autofix-publish.yml
|
|
|
|
# pull_request_target needed by claude-code-action to access secrets
|
|
# and post review comments on fork PRs. Mitigated by: PR checkouts pin
|
|
# the fork's HEAD SHA (not the branch ref) to prevent TOCTOU races,
|
|
# and claude-code-action sandboxes execution. Header comment documents.
|
|
- claude.yml
|
|
|
|
# pull_request_target on the autolabel job needs `pull-requests:write`
|
|
# to apply labels. Mitigated by: release-drafter runs with `dry-run:
|
|
# true`, reads only `.github/release-drafter.yml` from the BASE ref,
|
|
# and the validate-title job (which runs untrusted `pull_request`
|
|
# context) holds no write permissions. Header comment documents.
|
|
- pr-labeler.yml
|
|
|
|
# Note: cache-poisoning is NOT exempted. The two prior findings in
|
|
# publish.yml and release-candidate.yml were fixed structurally by
|
|
# dropping `cache: npm` from those workflows (matches the pattern used
|
|
# by PyO3/maturin for the same audit). See the commit that added this
|
|
# file for the rationale.
|