auto_apply_plugin_metadata.py asked "what version is already released?" by
reading the category manifest out of the PR's own working tree. Once
ci-apply.yml has pushed its "[ci] apply-plugin-metadata-and-formatting"
commit back to the PR branch, that tree already lists the version being
added - so the check compared the new version against itself and raised
"Version cant be lower or equal than the previous version."
That fires on every re-run of PR Check: the one ci-apply.yml's own push
triggers, and any run caused by a contributor pushing a follow-up commit.
Published state now comes from the base branch instead, read with
`git show $PLUGMAN_BASE_REF:<manifest>` (ci-check.yml supplies the PR base
sha; local runs fall back to origin/main, then to the working tree). The
writer is idempotent to match: a version entry that is already stamped and
still matches the plugin's md5sum is left alone rather than reset to null.
An entry whose md5sum has drifted is still reset, which implements the TODO
this replaces - a contributor can keep iterating on an unpublished version
during review without bumping it every round. Bump enforcement against
published versions is unchanged.
Version comparison and ordering switch to the existing
get_comparable_version_tuple_from_string; versioning_tools.semantic_to_str
ordered 1.0.10 below 1.0.9 and silently truncated 3-digit components.
pull_request_target checked out fork PR branches with the repo's
write-scoped GITHUB_TOKEN and ran autopep8/metadata scripts/tests
against that fork content, letting a malicious PR rewrite test/*.py
for arbitrary code execution with push access and secrets. It's also
been failing outright for weeks since actions/checkout now blocks
unsafe fork checkouts here without explicit opt-in.
Split into ci-check.yml (plain pull_request, GitHub's read-only
no-secrets token, safe to run fork code) which uploads a diff
artifact, and ci-apply.yml (workflow_run, privileged) which only
applies that diff via `git apply`, never executing fork content.
ci.yml keeps just the push-to-main job as the strict integrity check.
Because GitHub runs the PR's own copy of ci-check.yml for
pull_request events, that artifact is attacker-authored: ci-apply.yml
therefore resolves PR identity from the workflow_run payload plus the
API rather than the artifact, passes every dynamic value through env:
instead of ${{ }} in run: blocks (which the runner substitutes before
the shell parses, so quotes don't contain it), and validates branch,
repo, sha and PR-number shapes before use. The patch itself stays
untrusted input: allowlist-validated and applied only to the fork's
own branch.
test_checks.py adds an env-gated lenient mode so ci-check.yml's
preview run doesn't fail on a brand-new plugin's not-yet-existing
commit sha, while history and push-to-main stay strict.
