14 commits

Author	SHA1	Message	Date
Loup-Garou911XD	bc5c5aafc8	Split ci.yml to close a pull_request_target pwn-request hole ... pull_request_target checked out fork PR branches with the repo's write-scoped GITHUB_TOKEN and ran autopep8/metadata scripts/tests against that fork content, letting a malicious PR rewrite test/*.py for arbitrary code execution with push access and secrets. It's also been failing outright for weeks since actions/checkout now blocks unsafe fork checkouts here without explicit opt-in. Split into ci-check.yml (plain pull_request, GitHub's read-only no-secrets token, safe to run fork code) which uploads a diff artifact, and ci-apply.yml (workflow_run, privileged) which only applies that diff via `git apply`, never executing fork content. ci.yml keeps just the push-to-main job as the strict integrity check. Because GitHub runs the PR's own copy of ci-check.yml for pull_request events, that artifact is attacker-authored: ci-apply.yml therefore resolves PR identity from the workflow_run payload plus the API rather than the artifact, passes every dynamic value through env: instead of ${{ }} in run: blocks (which the runner substitutes before the shell parses, so quotes don't contain it), and validates branch, repo, sha and PR-number shapes before use. The patch itself stays untrusted input: allowlist-validated and applied only to the fork's own branch. test_checks.py adds an env-gated lenient mode so ci-check.yml's preview run doesn't fail on a brand-new plugin's not-yet-existing commit sha, while history and push-to-main stay strict.	2026-08-09 22:56:49 +05:30
Loup-Garou911XD	c096985e94	autometa commit	2026-01-10 18:49:07 +05:30
Rikko	b93d1ff270	Improve error messages on common test failures	2023-10-06 20:48:34 +05:30
rikkolovescats	3464799b96	[ci] auto-format	2023-10-06 13:35:18 +00:00
Rikko	ce526371cb	Add a test for plugin manager changelog entries	2023-10-06 19:04:16 +05:30
Rikko	8770d7d82c	Move away from deprecated distutils	2023-06-30 00:10:27 +05:30
Rikko	51a026611b	Execute tests for maps	2023-06-16 00:12:14 +05:30
Rikko	6b7307a8c5	Yay, i taught it to sort!	2022-12-05 21:09:01 +05:30
! Freaku	c1feee14ec	Switching to HTTPS (6/6)	2022-11-30 18:35:17 +05:30
Rikko	6998dedead	Release v0.1.5	2022-09-08 01:27:21 +05:30
Rikko	29f531e515	autopep8	2022-08-31 19:26:52 +05:30
Rikko	21c62f72f9	Add plugin meta tests	2022-08-31 06:18:24 +05:30
Rikko	74ca172fe6	Have a separate GH action for tests	2022-08-29 22:39:09 +05:30
Rikko	3f177bd27e	Add tests	2022-08-29 22:31:28 +05:30