CI fix round 1: realliance annotations, member text as data, publish hardening #2
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "fix-round-1"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Fix round 1 for the forge CI (Task 4 review), before
2.4.0gets tagged.crane appendkept nginx's manifest annotations: its source, revision, version, created time and base image. Renovate reads those before the config labels.crane mutate -anow setssourceandrevision(the labels' values),url, andcreatedfromSOURCE_DATE_EPOCH(the commit time), and blanks every other key the base sets.check-image.shrequires the two annotations to equal the labels, and no annotation may name nginx. The publishedsha-d0eb467keeps nginx's annotations: tags never move, and nothing deploys it.build.tspastedabout.tomlstrings into pugmixincalls, so a quote turned a bio into code that ran in the publishing job. Theconnorjcbio did exactly that: it injected a script (the "(Ethical) Hacking" marquee) and linked to an OWASP page on injection flaws. Members now reach pug as locals, which pug escapes, and links must behttps://. Theconnorjccard keeps its text and links, and only the marquee script goes.scripts/test-members.shbuilds a copy with a hostile member and runs in CI.scripts/deno-build.sh) reads this directory and writesbuild/only. Its network and imports reachdeno.landandesm.shonly, and it can read only the environment variables the libraries probe. It can start no processes and read no system information.RUNNER_TEMP, which the runner deletes at job end (probed).MANIFEST_UNKNOWNorNAME_UNKNOWN.persist-credentials: false.EXPECT_REVISIONdefaults toHEAD, and the build log prints tar's version next to the digest.Testing:
18376d6gave the same digest,sha256:9696208d…a177, andcheck-image: PASS.check-image.shagainst the publishedsha-d0eb467fails, flagging nginx's annotations.connorjcscript and the.filterutility it implied.Never approve workflow runs from fork pull requests.
build.ts pasted about.toml strings into pug mixin calls, so a value with a quote became pug and JavaScript that ran at build time, in the job that later publishes. Members now reach src/index.pug as locals (each m in members), pug escapes them on output, values must be strings, links must be https://, and an icon must sit next to its about.toml. scripts/test-members.sh builds a copy with a hostile member (quotes, #{}, </h3><script>, a closing mixin call) and expects it all escaped and no <script>; a javascript: link must fail. scripts/deno-build.sh is the one build command (CI, just build, the test): read this directory, write build/ only, net and imports to deno.land/esm.sh, and only the environment variables the libraries probe, with the ones that change the output unset. No --allow-run or --allow-sys. autoprefixer gets browserslist's default query explicitly and BROWSERSLIST_ROOT_PATH bounds its config search, so no read leaves the directory. The intermediate/ folder goes. For the current members the page is the same except ConnorJC's script (previous commit), and tailwind.css drops the `.filter` utility it implied. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FWhaDeswMqYvQaVdpL8oit