Loup-Garou911XD
bc5c5aafc8
Split ci.yml to close a pull_request_target pwn-request hole
...
pull_request_target checked out fork PR branches with the repo's
write-scoped GITHUB_TOKEN and ran autopep8/metadata scripts/tests
against that fork content, letting a malicious PR rewrite test/*.py
for arbitrary code execution with push access and secrets. It's also
been failing outright for weeks since actions/checkout now blocks
unsafe fork checkouts here without explicit opt-in.
Split into ci-check.yml (plain pull_request, GitHub's read-only
no-secrets token, safe to run fork code) which uploads a diff
artifact, and ci-apply.yml (workflow_run, privileged) which only
applies that diff via `git apply`, never executing fork content.
ci.yml keeps just the push-to-main job as the strict integrity check.
Because GitHub runs the PR's own copy of ci-check.yml for
pull_request events, that artifact is attacker-authored: ci-apply.yml
therefore resolves PR identity from the workflow_run payload plus the
API rather than the artifact, passes every dynamic value through env:
instead of ${{ }} in run: blocks (which the runner substitutes before
the shell parses, so quotes don't contain it), and validates branch,
repo, sha and PR-number shapes before use. The patch itself stays
untrusted input: allowlist-validated and applied only to the fork's
own branch.
test_checks.py adds an env-gated lenient mode so ci-check.yml's
preview run doesn't fail on a brand-new plugin's not-yet-existing
commit sha, while history and push-to-main stay strict.
2026-08-09 22:56:49 +05:30
Loup
d442c44ea8
Merge pull request #469 from bombsquad-community/fix_119
...
CI / build (push) Has been cancelled
Create Release / Create Release (push) Has been cancelled
fix for 1.1.9 breaking on older versions
2026-06-12 11:12:04 +05:30
Loup-Garou911XD
7acd7a87ab
[ci] apply-version-metadata
2026-06-12 05:41:53 +00:00
Loup-Garou911XD
a1baa5fca2
fix for 1.1.9 breaking on older versions
2026-06-12 11:10:44 +05:30
Loup
c2c2a04891
Merge pull request #466 from GeoHnlol/patch-1
...
Updated export shortcuts
2026-06-12 01:49:59 +05:30
Loup
b6ccdb12ef
Merge pull request #468 from MrParadox1691/main
...
Minor bug fix for Vanishing tiles
2026-06-12 01:49:06 +05:30
MrParadox1691
f1c02ae85a
[ci] apply-version-metadata
2026-06-11 15:16:45 +00:00
MrParadox1691
5d7d22245b
[ci] apply-plugin-metadata-and-formatting
2026-06-11 15:16:42 +00:00
Mr.Paradox
b8dee8f224
Update vanishing_tiles.py
2026-06-11 20:43:39 +05:30
Mr.Paradox
710dbebee4
Merge branch 'bombsquad-community:main' into main
2026-06-11 20:25:43 +05:30
Mr.Paradox
643ac51a08
Update vanishing_tiles.py
2026-06-11 20:23:25 +05:30
GeoHnlol
d0df37d764
[ci] apply-version-metadata
2026-06-11 09:35:34 +00:00
GeoHnlol
3adfe38e55
Changed version number to 1.1.9
2026-06-11 12:35:04 +03:00
Loup
2660a8d973
Merge pull request #467 from MrParadox1691/main
...
Vanishing tiles minigame update
2026-06-10 22:05:13 +05:30
Loup
767fbe3a28
Delete version 1.0.2 from minigames.json
...
Removed version 1.0.2 details from minigames.json
2026-06-10 22:02:11 +05:30
MrParadox1691
18dbcbbe3f
[ci] apply-version-metadata
2026-06-10 16:12:15 +00:00
MrParadox1691
0749053077
[ci] apply-plugin-metadata-and-formatting
2026-06-10 16:12:12 +00:00
Mr.Paradox
4804a55ca0
Update vanishing_tiles.py
2026-06-10 21:41:40 +05:30
Mr.Paradox
2e2ff3656a
Update utilities.json
2026-06-10 21:21:21 +05:30
Loup
55c3fe5af4
Merge pull request #465 from FluffyPal0/main
...
Added fluffyplaylisteditor
2026-06-10 20:33:54 +05:30
MrParadox1691
7fcb9b4468
[ci] apply-version-metadata
2026-06-10 07:05:09 +00:00
MrParadox1691
edaed70235
[ci] apply-plugin-metadata-and-formatting
2026-06-10 07:05:08 +00:00
Mr.Paradox
e091fb6983
Update and rename vanishing_tiles.py to vanishing_tiles.py
2026-06-10 09:18:14 +05:30
GeoHnlol
d88d0e149d
Updated export shortcuts
...
Replaced all instances of EXPORT_CLASS_NAME_SHORTCUTS with _DEPRECATED_EXPORT_SHORTCUTS for bs version 1.7.63
2026-06-08 14:27:28 +03:00
FluffyPal0
7e249c1181
[ci] apply-version-metadata
2026-06-08 05:14:51 +00:00
FluffyPal0
99cf837498
[ci] apply-plugin-metadata-and-formatting
2026-06-08 05:14:50 +00:00
FluffyPal
1662980eea
Adding fluffyplaylisteditor
2026-06-08 13:12:31 +08:00
Vishyyy
929ce3f26f
Merge pull request #464 from Scriptz1/main
...
Volley Punch
2026-06-02 11:55:34 +05:30
Scriptz1
d35b78326b
[ci] apply-version-metadata
2026-06-02 00:27:00 +00:00
Scriptz1
a6d11fd8ce
[ci] apply-plugin-metadata-and-formatting
2026-06-02 00:26:59 +00:00
Scriptz1
d517d47f3e
Update volley_punch.py
2026-06-01 20:26:09 -04:00
Scriptz1
811e151c81
Update volley_punch.py
2026-06-01 20:25:17 -04:00
Loup
a1b809bc80
Merge pull request #463 from bombsquad-community/revert-462-main
...
Revert "volley_punch"
2026-06-01 20:42:35 +05:30
Loup
7c718cf4a3
Revert "Volley Punch"
...
This reverts commit f6c0fd5fbe
2026-06-01 08:21:09 +05:30
Scriptz1
8fba8c8ab5
Update volley_punch.py
2026-05-31 21:11:03 -04:00
Scriptz1
f6c0fd5fbe
Volley Punch
2026-06-01 06:32:13 +05:30
Scriptz1
e9e1a29fea
[ci] apply-version-metadata
2026-06-01 00:58:05 +00:00
Scriptz1
576a9c0304
[ci] apply-plugin-metadata-and-formatting
2026-06-01 00:58:03 +00:00
Scriptz1
9a74e81ec7
Update volley_punch.py
2026-05-31 20:57:41 -04:00
Scriptz1
d0e936c582
Rename volleypunch.py to volley_punch.py
2026-05-31 20:55:10 -04:00
Scriptz1
e6d9c5d71c
Add files via upload
2026-05-31 20:43:43 -04:00
Loup
3a622edb51
Merge pull request #461 from andrejkuroglo8/main
...
Add glowing_profiles.py, which was merged since simpleredefiner.py
2026-05-15 11:47:54 +05:30
andrejkuroglo8
23fbdf5e9d
[ci] apply-version-metadata
2026-05-10 11:24:45 +00:00
andrejkuroglo8
6a494a44fc
[ci] apply-plugin-metadata-and-formatting
2026-05-10 11:24:43 +00:00
andrejkuroglo8
7c5038263c
[ci] apply-plugin-metadata-and-formatting
2026-05-10 11:22:18 +00:00
andrejkuroglo8
bbf36dc4a9
Update glowing_profiles.py
2026-05-10 14:15:10 +03:00
andrejkuroglo8
6212108315
Add files via upload
2026-05-10 14:11:32 +03:00
Loup
05c3f1d023
Merge pull request #457 from anasdhaoidi/main
...
fix some plugins and add new plugin
2026-05-07 23:14:23 +05:30
anasdhaoidi
e131859fe6
[ci] apply-version-metadata
2026-05-01 14:28:17 +00:00
anasdhaoidi
023b733c3b
[ci] apply-plugin-metadata-and-formatting
2026-05-01 14:28:15 +00:00
