mirror of
https://github.com/Twigpine/openlaunch.git
synced 2026-11-09 13:31:29 -10:00
Kevin Codex
094d19229b
Fixes from the CodeRabbit and CodeQL review of #88, and from a second read of the result. - An owner's own pull request turns review findings into notices only when an owner pushed the head commit. The event's sender is that pusher only for a push event whose commit is still the head; for opened and reopened the branch's activity log is asked, and when GitHub cannot say, nobody pushed it. Before, reopening a pull request after someone else had pushed to it counted as the owner's push. - Dependency specs: the rule now lists what a registry spec may hold instead of every way to leave the registry. Local paths (../../x, ./x, ~/x, /x, .), tarball names, scp-style git remotes and unknown protocols were only "review" before. - A manifest or lockfile the guard cannot check (too large to read, nested too deep, past the file limit) is blocked. It used to be "unscanned", which one approval lets through. Both are read whole whatever their size. - Reports: finding details are code spans in the job summary, so a dependency or script name cannot write a link or HTML into it. A line of the job log no longer starts with a file name, which the runner could read as a workflow command. - The exit code is set, not forced: a JSON report sent into a pipe was cut at 8 KB on a Mac. - check-deployed-sources.sh: a library with edited or added files, with a state git cannot read, or with files but no repository is drift. The lock's last line counts without its newline, and --update works on an empty lock. - Workflows: every checkout drops its credentials, the guard job says what its two read permissions are for, and the tests pin the guard workflow line for line. - Not changed: a review does not start the guard. pull_request_review runs the pull request's copy of the workflow, so it cannot be trusted to judge, and re-running the trusted job takes a write permission that no workflow here has. The workflow header and CONTRIBUTING.md say so, and say when to re-run by hand. 136 tests (113 before), on Node 20, 22 and 24 and in a Linux container.