mirror of
https://github.com/abhigyanpatwari/GitNexus.git
synced 2026-10-09 03:17:54 +00:00
b5627f27d8
* ci: add fork-safe PR autofix pipeline
Two-workflow split posts prettier + eslint --fix output as inline
review-comment suggestions on PRs (including fork PRs) without running
fork-controlled ESLint plugins under a privileged token.
- pr-autofix.yml: untrusted, runs lint:fix/format with permissions: {},
uploads diff artifact. paths-ignore on lockfiles/snapshots/dist to
avoid reviewdog 406 on >3k-line diffs.
- pr-autofix-publish.yml: trusted workflow_run consumer. Validates every
metadata.json field with regex allowlists before exporting to
GITHUB_OUTPUT (closes head_ref newline-injection vector). Concurrency
keyed on PR number with fork fallback to head-repo+branch. Reviewdog
pinned to v0.21.0. Sticky comment posts only when patch is non-empty
(no noise on clean PRs); body carries a fenced gitnexus-autofix JSON
block under a stable HTML marker for agent parsing. gh API calls go
through a small retry helper for transient 5xx.
Branch protection should enable merge queue + 'require branches up to
date' to handle PR freshness; chinthakagodawita/autoupdate is dropped
(unmaintained since 2023).
* ci(autofix): close zizmor template-injection findings
Move fork-controlled values (head.ref, head.repo.full_name, head.sha,
pr.number, github.repository) into the step's env: block instead of
interpolating them with `${{ }}` directly into the bash run body. The
job has permissions:{} today so this is defence-in-depth, but a future
scope grant on the untrusted half would otherwise turn a malicious
branch name into shell injection.
Add pr-autofix-publish.yml to the documented dangerous-triggers ignore
list — workflow_run is required to post sticky comments on fork PRs
and the file's structural defences (no fork checkout, allowlist on
metadata.json, base_repo equality check) match the existing
ci-report.yml exemption.
* ci(autofix): close remaining review findings
- Add an actionlint job to workflow-lint.yml. Catches YAML syntax,
expression typing, shellcheck-inside-run, and deprecated runner
labels on every .github/** PR — closes the gap that let pr-autofix's
YAML literal-block bug reach review on this branch.
- pr-autofix-publish.yml emits a `gitnexus/autofix` Check Run on the
PR head SHA: conclusion `success` for clean, `neutral` (with
distinct output titles) for suggestions-posted vs.
skipped-too-large. Stable name lets agents read the outcome via
`gh pr checks` without parsing the sticky comment.
- Document the autofix signal contract in CONTRIBUTING.md — sticky
marker, fenced gitnexus-autofix JSON schema, Check Run name. One
source of truth so the marker / schema fields don't drift across
the workflow files and consumers.
* ci: fix actionlint/shellcheck findings on PR #1446
Closes the actionlint warnings the new lint job (workflow-lint.yml's
actionlint runner) surfaced once it was wired into CI. Mostly
shellcheck-style cleanups across three workflows.
pr-autofix-publish.yml
- SC2170: `[ "${{ steps.meta.outputs.changed_lines }}" -gt 3000 ]`
interpolates a literal string into bash, breaking shellcheck's
arithmetic-comparison parse. Move `changed_lines` through env: as
`CHANGED_LINES` and reference as `$CHANGED_LINES` inside bash.
ci-report.yml (Read PR metadata step)
- SC2002 ×2: `cat file | tr` -> `tr < file`.
- SC2129: three consecutive `>> "$GITHUB_OUTPUT"` redirects collapsed
into one `{ ...; } >> "$GITHUB_OUTPUT"` group.
ci-report.yml (Build report step)
- SC2162 ×2: `read VAR1 VAR2` -> `read -r VAR1 VAR2` so backslashes
in test-results.json output aren't mangled.
- SC2034: drop unused `SUITES` aggregate. The per-framework suite
counts (CLI_SU, WEB_SU) are now read into `_` placeholders since
the report doesn't surface them anywhere.
release-candidate.yml
- SC2129 ×2: collapse consecutive `>> "$GITHUB_OUTPUT"` redirects in
the rc-version computation step and the tag-push step into one
grouped block each.
82 lines
2.7 KiB
YAML
82 lines
2.7 KiB
YAML
name: Workflow Lint
|
|
|
|
# Lints .github/workflows/** for both:
|
|
# - actionlint: YAML syntax, expression typing, shellcheck inside `run:`
|
|
# blocks, unknown contexts, deprecated runner labels.
|
|
# - zizmor: security misconfigurations — unpinned actions, dangerous
|
|
# `${{ }}` interpolation, missing per-job permissions, etc.
|
|
#
|
|
# Scoped to PRs that touch .github/** only — keeps off the typical PR
|
|
# critical path.
|
|
|
|
on:
|
|
pull_request:
|
|
branches: [main]
|
|
paths:
|
|
- '.github/**'
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
actionlint:
|
|
name: actionlint
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 5
|
|
permissions:
|
|
contents: read
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
with:
|
|
persist-credentials: false
|
|
|
|
# Pinned to v2.1.2. Verify SHA via:
|
|
# gh api repos/raven-actions/actionlint/git/refs/tags/v2.1.2
|
|
# The action wraps the upstream `rhysd/actionlint` binary and emits
|
|
# GitHub-annotation-formatted findings on PRs.
|
|
- name: Run actionlint
|
|
uses: raven-actions/actionlint@205b530c5d9fa8f44ae9ed59f341a0db994aa6f8 # v2.1.2
|
|
with:
|
|
fail-on-error: true
|
|
|
|
zizmor:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 10
|
|
permissions:
|
|
contents: read
|
|
security-events: write
|
|
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Setup Python
|
|
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
|
|
with:
|
|
python-version: '3.12'
|
|
|
|
- name: Install zizmor
|
|
# Pinned — resolves to whatever's latest on PyPI otherwise.
|
|
# Bump via Dependabot pip ecosystem (see .github/dependabot.yml).
|
|
run: pipx install zizmor==1.24.1
|
|
|
|
# Initial threshold: medium. High+ findings fail the job; medium findings
|
|
# appear in the Security tab without blocking. Tune after first run.
|
|
# Per-rule exemptions for pre-existing intentional patterns live in
|
|
# .github/zizmor.yml (each carries a documented mitigation).
|
|
- name: Run zizmor
|
|
run: zizmor --config .github/zizmor.yml --format sarif --min-severity medium . > zizmor.sarif
|
|
continue-on-error: true
|
|
|
|
- name: Upload SARIF
|
|
uses: github/codeql-action/upload-sarif@e46ed2cbd01164d986452f91f178727624ae40d7 # v4.35.3
|
|
with:
|
|
sarif_file: zizmor.sarif
|
|
category: zizmor
|
|
|
|
- name: Fail on high+ findings
|
|
run: zizmor --config .github/zizmor.yml --min-severity high .
|