0be354a920
Single-commit clean baseline after security scrub of niche-tells, project codenames, internal jargon, and contributor-email leaks. Contents: - 100 Rust crates (_primitives/_rust/) - 37 agent manifests (_manifests/) + generated specs (_generated/) - 67 user-invocable skills (skills/) - 33 hooks (hooks/) - Composition blocks (_blocks/) - Documentation (docs/, README.md) - TS adapter packages (_ts_packages/) - Assembler (_assembler/) - Roles (_roles/) - Templates (_templates/) - Forgejo CI (.forgejo/) Author: Denis Parfionovich <info@greendragon.info> License: see LICENSE.
110 lines
4.4 KiB
Bash
Executable file
110 lines
4.4 KiB
Bash
Executable file
#!/bin/sh
|
|
# validate-workflow-shas.sh — verify every `uses: <repo>@<sha40>` pin in the
|
|
# repo's workflow files resolves upstream. Closes v0.20.1 incident class.
|
|
# Hard-fails (exit 1) only on 404 / 422 from GitHub commits API.
|
|
# Trailing comment `# validate-workflow-shas: skip=<reason>` skips a line.
|
|
# Tag refs (@v4, @stable) are policy decisions and not checked.
|
|
# GITHUB_TOKEN (optional) raises the 60/hr anonymous rate limit.
|
|
|
|
set -eu
|
|
|
|
ROOT=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)
|
|
|
|
SCAN_FILES=""
|
|
for f in "${ROOT}/.github/workflows"/*.yml \
|
|
"${ROOT}/.github/workflows"/*.yaml \
|
|
"${ROOT}/.github/dependabot.yml" ; do
|
|
[ -f "${f}" ] && SCAN_FILES="${SCAN_FILES} ${f}"
|
|
done
|
|
|
|
[ -z "${SCAN_FILES}" ] && { printf 'no workflow files under %s/.github\n' "${ROOT}"; exit 0; }
|
|
command -v curl >/dev/null 2>&1 || { printf 'curl not found\n' >&2; exit 2; }
|
|
|
|
# shellcheck disable=SC2086
|
|
PINS=$(grep -hE '^[[:space:]]*(-[[:space:]]*)?uses:[[:space:]]*[a-zA-Z0-9_.-]+/[a-zA-Z0-9_.-]+@[a-f0-9]{40}' ${SCAN_FILES} 2>/dev/null || true)
|
|
[ -z "${PINS}" ] && { printf 'no SHA-pinned `uses:` lines\n'; exit 0; }
|
|
|
|
TMP=$(mktemp)
|
|
trap 'rm -f "${TMP}"' EXIT INT TERM
|
|
|
|
# Token sanity-probe: invalid token => unauthenticated fallback.
|
|
AUTH=""
|
|
if [ -n "${GITHUB_TOKEN:-}" ]; then
|
|
P=$(curl -sS -o /dev/null -w '%{http_code}' \
|
|
-H "Authorization: Bearer ${GITHUB_TOKEN}" \
|
|
-H "Accept: application/vnd.github+json" \
|
|
https://api.github.com/rate_limit 2>/dev/null || printf 000)
|
|
if [ "${P}" = "200" ]; then AUTH="Authorization: Bearer ${GITHUB_TOKEN}"
|
|
else printf '[info] GITHUB_TOKEN probe=%s — anonymous (60/hr)\n' "${P}" >&2; fi
|
|
fi
|
|
|
|
check_sha() {
|
|
REPO=$1; SHA=$2; SHORT=$(printf '%s' "${SHA}" | cut -c1-7)
|
|
URL="https://api.github.com/repos/${REPO}/commits/${SHA}"
|
|
set +e
|
|
if [ -n "${AUTH}" ]; then
|
|
C=$(curl -sS -o /dev/null -w '%{http_code}' -H "${AUTH}" -H "Accept: application/vnd.github+json" "${URL}")
|
|
else
|
|
C=$(curl -sS -o /dev/null -w '%{http_code}' -H "Accept: application/vnd.github+json" "${URL}")
|
|
fi
|
|
RC=$?
|
|
set -e
|
|
if [ "${RC}" -ne 0 ]; then
|
|
printf '[UNVERIFIED: %s@%s — curl rc=%d]\n' "${REPO}" "${SHORT}" "${RC}"; echo U >> "${TMP}"; return 0
|
|
fi
|
|
case "${C}" in
|
|
200) printf 'SHA OK: %s@%s\n' "${REPO}" "${SHORT}"; echo K >> "${TMP}" ;;
|
|
404) printf 'SHA MISSING: %s@%s — repo not found (404)\n' "${REPO}" "${SHA}" >&2; echo M >> "${TMP}" ;;
|
|
422) printf 'SHA MISSING: %s@%s — no matching commit (422)\n' "${REPO}" "${SHA}" >&2; echo M >> "${TMP}" ;;
|
|
403) printf '[UNVERIFIED: %s@%s — 403 (rate-limited)]\n' "${REPO}" "${SHORT}"; echo U >> "${TMP}" ;;
|
|
*) printf '[UNVERIFIED: %s@%s — HTTP %s]\n' "${REPO}" "${SHORT}" "${C}"; echo U >> "${TMP}" ;;
|
|
esac
|
|
}
|
|
|
|
parse_line() {
|
|
L=$1
|
|
case "${L}" in
|
|
*"validate-workflow-shas: skip="*)
|
|
printf 'SKIP %s\n' "$(printf '%s' "${L}" | sed 's/^[[:space:]]*//')"
|
|
echo S >> "${TMP}"; return 0 ;;
|
|
esac
|
|
T=$(printf '%s' "${L}" | sed 's/^[[:space:]]*-\{0,1\}[[:space:]]*uses:[[:space:]]*//')
|
|
REF=$(printf '%s' "${T}" | sed 's/[[:space:]]*#.*$//' | sed 's/[[:space:]]*$//')
|
|
REPO=$(printf '%s' "${REF}" | sed 's/@.*$//')
|
|
SHA=$(printf '%s' "${REF}" | sed 's/^[^@]*@//')
|
|
if [ ${#SHA} -ne 40 ]; then
|
|
printf 'SKIP-BADSHAPE %s (len=%d)\n' "${REF}" "${#SHA}"; echo U >> "${TMP}"; return 0
|
|
fi
|
|
check_sha "${REPO}" "${SHA}"
|
|
}
|
|
|
|
printf '%s\n' "${PINS}" | while IFS= read -r LINE; do
|
|
[ -n "${LINE}" ] && parse_line "${LINE}"
|
|
done
|
|
|
|
count_tok() {
|
|
C=$(grep -c "^$1\$" "${TMP}" 2>/dev/null || printf 0)
|
|
C=$(printf '%s' "${C}" | tr -cd '0-9'); [ -z "${C}" ] && C=0
|
|
printf '%s' "${C}"
|
|
}
|
|
|
|
OK_C=$(count_tok K); M_C=$(count_tok M); U_C=$(count_tok U); S_C=$(count_tok S)
|
|
T_C=$((OK_C + M_C + U_C + S_C))
|
|
|
|
printf '\nSummary: %d checked | %d OK | %d MISSING | %d UNVERIFIED | %d SKIPPED\n' \
|
|
"${T_C}" "${OK_C}" "${M_C}" "${U_C}" "${S_C}"
|
|
|
|
[ "${M_C}" -gt 0 ] && exit 1
|
|
|
|
# v0.21.1 D3 — distinguish "all verified" from "rate-limited, we couldn't
|
|
# check". If there are UNVERIFIED pins AND we ran without GITHUB_TOKEN,
|
|
# treat this as a hard failure so CI surfaces the gap instead of silently
|
|
# returning green. If we DID have a token (even if rate-limited anyway),
|
|
# exit 0 — we tried, that's the best we can do.
|
|
if [ "${U_C}" -gt 0 ] && [ -z "${AUTH}" ]; then
|
|
printf 'ERROR: %d pins UNVERIFIED without GITHUB_TOKEN. Re-run with\n' "${U_C}" >&2
|
|
printf ' GITHUB_TOKEN=<pat> in env to complete verification.\n' >&2
|
|
exit 2
|
|
fi
|
|
|
|
exit 0
|