Repository navigation
Conversation
…nvironment The TAURI_SIGNING_PRIVATE_KEY / TAURI_SIGNING_PRIVATE_KEY_PASSWORD secrets were plain repo-level secrets on a public repo with no approval gate. The build-tauri job now requires the release-signing Environment, which enforces a manual reviewer approval and restricts which branches/tags can access the secrets (dev, main, v*-fork* tags). Secret values must still be migrated into the Environment by a human (gh secret set ... --env release-signing) before this job can run.
|
Hey! Your PR title Please update it to start with one of:
Where See CONTRIBUTING.md for details. |
|
This PR doesn't fully meet our contributing guidelines and PR template. What needs to be fixed:
Please edit this PR description to address the above within 2 hours, or it will be automatically closed. If you believe this was flagged incorrectly, please let a maintainer know. |
|
This pull request has been automatically closed because it was not updated to meet our contributing guidelines within the 2-hour window. Feel free to open a new pull request that follows our guidelines. |
3 of 6 tasks
Rwanbt
added a commit
that referenced
this pull request
Oct 5, 2026
…297) The 223 open alerts all carry the same most_recent_instance commit, 207ff45, which is origin/main and an ancestor of dev. The two analyses since then, both on dev, completed with an empty error and 22 results each. Of the 46 alerts carrying a security severity, 30 point at a path dev no longer has; the remaining 16 can still describe dev, and 8 of those were still true of the code at 26ba494. github/index.ts took a URL out of a model-produced prompt and attached the Action's GitHub token to the request, then wrote that URL to the log unflattened (#14 critical, #23). attachmentUrl() now asserts the parsed origin is https://github.com and the path is a user attachment before any header exists; a URL that fails is dropped, never fetched. logSafe() collapses control characters and bounds the line. The test asserts that new URL() resolves ".." before the pathname is read, which is why /user-attachments/../../settings/tokens is refused. Three console scripts escaped only the quote in the env value they hand to sst secret load (#2, #3, #4). The value is JSON read back from sst secret list, so it holds escaped-quote pairs: escaping the quote alone turned that into a double backslash followed by a quote, which closes the value early, and a trailing backslash escaped the line's own closing quote. quoteEnvValue() escapes the backslash first. Verified the test earns its place: with the old escaping restored it is 0 pass / 3 fail. checkMacosApp interpolated an IPC-supplied appName into a macOS .app path, so a parent segment or a second separator could aim the existsSync probe anywhere (#5). isBundleName() rejects anything that is not one plain segment. bundle-mobile.mjs joined its bun build arguments into a string and gave it to execSync, i.e. a shell, with outdir coming from the command line (#8, #35). execFileSync takes a list and spawns no shell. formatDateForTable ended in .replace(",", ","), replacing a comma with itself; removed, since Intl already emits the separator the locale wants (#21). Each fix has a regression test. No alert is dismissed and no query is weakened.
This was referenced Oct 5, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
environment: release-signingto thebuild-taurijob infork-release.yml.TAURI_SIGNING_PRIVATE_KEY,TAURI_SIGNING_PRIVATE_KEY_PASSWORD) were plain repo-level secrets on a public repo with zero Environment protection (found during G-001 GitHub audit).release-signingEnvironment already created and configured (G-004, Unifia multi-AI runbook): required reviewer (Rwanbt), branch/tag policy restricted todev,main, andv*-fork*tags.Context
Part of the Unifia multi-AI orchestration runbook, Programme G (GitHub hardening). Full audit trail in the Obsidian vault:
unifia-multi-ai-runbook/Logs/GITHUB-BASELINE-2026-07-20.md,unifia-multi-ai-runbook/Cards/G-004-*.Note:
publish.ymlalso references these secret names but is gated withif: github.repository == 'anomalyco/opencode'— it never runs on this fork, so it is out of scope for this change.Remaining steps (not in this PR)
release-signingEnvironment (gh secret set TAURI_SIGNING_PRIVATE_KEY --env release-signing, same for the password) — requires the secret owner, cannot be done by an agent.Test plan
bun turbo typecheckpasses (ran automatically via pre-push hook).fork-release.ymlviaworkflow_dispatchafter secrets are migrated, confirm the approval gate appears and the build succeeds once approved.