verify-action-build: diff and scan the shell payload actions ship - #1205
Open
potiuk wants to merge 1 commit into
Open
verify-action-build: diff and scan the shell payload actions ship#1205potiuk wants to merge 1 commit into
potiuk wants to merge 1 commit into
Conversation
The source diff only copied JS/TS/JSON/YAML, and script analysis ran only for composite/docker actions and only for scripts named in action.yml or a Dockerfile. A node action that shells out to a committed script therefore had that script reviewed by nobody: uraimo/run-on-arch-action declares main: src/run-on-arch.js, which exec()s src/run-on-arch.sh, so PR apache#1196's +12/-1 change to its docker run invocation never reached the reviewer. Add shell/interpreter extensions and Dockerfile* to the source diff, discover committed scripts from the repo tree, and run script analysis for JS actions too (informational there - the verdict is unchanged). Generated-by: Claude Code (Opus 5)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Code change
Summary
A node action can shell out to a script committed beside it, and nothing was reviewing that script.
.js/.ts/.mjs/.cjs/.mts/.cts/.json/.yml/.yaml, so.shfiles andDockerfile*never appeared in it.analyze_scriptsran only for composite/docker actions, and only for scripts named inaction.ymlor aDockerfile.Surfaced by #1196 (
uraimo/run-on-arch-actionv3.2.0). Itsaction.ymldeclaresmain: src/run-on-arch.js, whichexec()ssrc/run-on-arch.sh- so the reviewer was shown "only anaction.ymldescription changed" while the upstream diff also carriedsrc/run-on-arch.sh+12/-1 (five new bind-mounts of runner-writable paths into the container) and three newDockerfiles/Dockerfile.*.Dockerfile*to the source diff (diff_source.py).security.py).verification.py). Informational there: findings show in the summary but are not added tonon_js_warnings, so a JS action's pass/fail verdict is unchanged.Type of change
Testing
uv run pytest utils/tests/- 334 passed.test_diff_source.pycovering the selection predicate, including suffixed-Dockerfile and not-a-Dockerfile precision cases.analyze_scriptsregression tests: the run-on-arch shape (script reachable only from the JS entrypoint), vendored/test dir exclusion, sub_path scoping.Drafted-by: Claude Code (Opus 5); reviewed by @potiuk before posting