luckberg/familysync
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Phase 16: CI dependency audit & security checks #15

Merged
luckberg merged 40 commits from gsd/phase-16-ci-dependency-audit-and-security-checks into main 2026-06-13 10:01:01 -04:00
Conversation 0 Commits 40 Files Changed 42
+21 -5
1 changed files with 21 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit 26a6b2e53f - Show all commits
.gitea/workflows/ci.yml
+21 -5
View File
@@ -358,17 +358,33 @@ jobs:
# github.event.pull_request.base.sha may be empty on some Gitea versions. # github.event.pull_request.base.sha may be empty on some Gitea versions.
# If so, fall back to git merge-base to compute the real branch-point SHA. # If so, fall back to git merge-base to compute the real branch-point SHA.
- name: Probe PR base/head SHA - name: Probe PR base/head SHA
# WR-01: bind context values through env: so they are never substituted
# into the rendered shell body (script-injection vector — github.base_ref
# is an attacker-influenceable branch name). Reference them as already-
# quoted shell variables only.
env:
PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
PR_BASE_REF: ${{ github.base_ref }}
run: | run: |
set -euo pipefail set -euo pipefail
echo "Event base.sha: ${{ github.event.pull_request.base.sha }}" echo "Event base.sha: $PR_BASE_SHA"
echo "Event head.sha: ${{ github.event.pull_request.head.sha }}" echo "Event head.sha: $PR_HEAD_SHA"
BASE_SHA="${{ github.event.pull_request.base.sha }}" BASE_SHA="$PR_BASE_SHA"
HEAD_SHA="${{ github.event.pull_request.head.sha }}" HEAD_SHA="$PR_HEAD_SHA"
if [ -z "$BASE_SHA" ]; then if [ -z "$BASE_SHA" ]; then
echo "base.sha empty — computing merge-base fallback" echo "base.sha empty — computing merge-base fallback"
BASE_SHA=$(git merge-base "$(git rev-parse origin/${{ github.base_ref }})" HEAD) BASE_SHA=$(git merge-base "$(git rev-parse "origin/$PR_BASE_REF")" HEAD)
echo "Computed BASE_SHA via merge-base: $BASE_SHA" echo "Computed BASE_SHA via merge-base: $BASE_SHA"
fi fi
# WR-03: mirror the base fallback for head so the scan range is never
# silently left half-empty (A.. only happens to default to A..HEAD).
if [ -z "$HEAD_SHA" ]; then
echo "head.sha empty — falling back to git rev-parse HEAD"
HEAD_SHA=$(git rev-parse HEAD)
echo "Computed HEAD_SHA via rev-parse: $HEAD_SHA"
fi
echo "Secret-scan range: ${BASE_SHA}..${HEAD_SHA}"
echo "BASE_SHA=$BASE_SHA" >> "$GITHUB_ENV" echo "BASE_SHA=$BASE_SHA" >> "$GITHUB_ENV"
echo "HEAD_SHA=$HEAD_SHA" >> "$GITHUB_ENV" echo "HEAD_SHA=$HEAD_SHA" >> "$GITHUB_ENV"