alteropen/streamyfin
1
0
Fork 0
mirror of https://github.com/streamyfin/streamyfin.git synced 2026-06-02 03:58:36 +01:00
Code Issues Actions 7 Packages Projects Releases Wiki Activity

chore(security): harden helpers + document conflict-labeler safety

Browse Source 
From the workflow security audit:
- symlink-native-dirs.js: drop the execSync shell strings for fs.symlink/mkdir
  (removes a latent shell-injection surface; also clears dead commented code).
- automerge.sh: add 'set -euo pipefail' and restore the starting branch on exit
  so a mid-merge failure can't leave the repo on the wrong branch.
- conflict.yml: document that this pull_request_target workflow must never check
  out or run PR-head code (it only labels via the API today).
This commit is contained in:
Gauvino
2026-06-01 20:35:05 +02:00
parent 54ee507209
commit 06510d2bd6
3 changed files with 70 additions and 89 deletions
Download Patch File Download Diff File Expand all files Collapse all files

53
.github/workflows/conflict.yml vendored
View File

@@ -1,24 +1,29 @@
name: 🏷️🔀Merge Conflict Labeler name: 🏷️🔀Merge Conflict Labeler
on: on:
push: push:
branches: [develop] branches: [develop]
pull_request_target: # SECURITY: pull_request_target runs with the base repo's write token and secrets.
branches: [develop] # This job only labels via the API and is safe ONLY because it never checks out or
types: [synchronize] # runs the PR head's code. NEVER add `actions/checkout` of the PR head (or any `run:`
# that interpolates PR-controlled data) to this workflow — that would turn it into a
jobs: # full repo-compromise vector.
label: pull_request_target:
name: 🏷️ Labeling Merge Conflicts branches: [develop]
runs-on: ubuntu-24.04 types: [synchronize]
if: ${{ github.repository == 'streamyfin/streamyfin' }}
permissions: jobs:
contents: read label:
pull-requests: write name: 🏷️ Labeling Merge Conflicts
steps: runs-on: ubuntu-24.04
- name: 🚩 Apply merge conflict label if: ${{ github.repository == 'streamyfin/streamyfin' }}
uses: eps1lon/actions-label-merge-conflict@1df065ebe6e3310545d4f4c4e862e43bdca146f0 # v3.0.3 permissions:
with: contents: read
dirtyLabel: '⚔️ merge-conflict' pull-requests: write
commentOnDirty: 'This pull request has merge conflicts. Please resolve the conflicts so the PR can be successfully reviewed and merged.' steps:
repoToken: '${{ secrets.GITHUB_TOKEN }}' - name: 🚩 Apply merge conflict label
uses: eps1lon/actions-label-merge-conflict@1df065ebe6e3310545d4f4c4e862e43bdca146f0 # v3.0.3
with:
dirtyLabel: '⚔️ merge-conflict'
commentOnDirty: 'This pull request has merge conflicts. Please resolve the conflicts so the PR can be successfully reviewed and merged.'
repoToken: '${{ secrets.GITHUB_TOKEN }}'

32
scripts/automerge.sh
View File

@@ -1,12 +1,22 @@
#!/bin/bash #!/bin/bash
[[ -z $(git status --porcelain) ]] && # Local helper: fast-forward master into develop and back. Aborts on any failure and
git checkout master && # restores the branch you started on. Not used in CI.
git pull --ff-only && set -euo pipefail
git checkout develop &&
git merge master && if [[ -n $(git status --porcelain) ]]; then
git push --follow-tags && echo "Error: working tree is not clean — commit or stash first." >&2
git checkout master && exit 1
git merge develop --ff-only && fi
git push &&
git checkout develop || start_branch=$(git rev-parse --abbrev-ref HEAD)
(echo "Error: Failed to merge" && exit 1) trap 'git checkout "$start_branch" >/dev/null 2>&1 || true' EXIT
git checkout master
git pull --ff-only
git checkout develop
git merge master
git push --follow-tags
git checkout master
git merge develop --ff-only
git push
git checkout develop

74
scripts/symlink-native-dirs.js
View File

@@ -1,62 +1,28 @@
#!/usr/bin/env node #!/usr/bin/env node
const _fs = require("node:fs"); // Symlinks the platform-specific native dirs to `ios` / `android` depending on EXPO_TV.
// Uses fs APIs (no shell) so there is no command-injection surface.
const fs = require("node:fs");
const path = require("node:path"); const path = require("node:path");
const process = require("node:process");
const { execSync } = require("node:child_process");
const root = process.cwd(); const root = process.cwd();
// const tvosPath = path.join(root, 'iostv'); const isTV = process.env.EXPO_TV && process.env.EXPO_TV !== "0";
// const iosPath = path.join(root, 'iosmobile');
// const androidPath = path.join(root, 'androidmobile');
// const androidTVPath = path.join(root, 'androidtv');
// const device = process.argv[2];
// const platform = process.argv[2];
const isTV = process.env.EXPO_TV || false;
const paths = new Map([ const links = isTV
["tvos", path.join(root, "iostv")], ? { ios: path.join(root, "iostv"), android: path.join(root, "androidtv") }
["ios", path.join(root, "iosmobile")], : {
["android", path.join(root, "androidmobile")], ios: path.join(root, "iosmobile"),
["androidtv", path.join(root, "androidtv")], android: path.join(root, "androidmobile"),
]); };
// const platformPath = paths.get(platform); for (const [link, target] of Object.entries(links)) {
fs.mkdirSync(target, { recursive: true });
if (isTV) { try {
stdout = execSync( fs.unlinkSync(link); // replace an existing symlink/file (ln -nsf)
`mkdir -p ${paths.get("tvos")}; ln -nsf ${paths.get("tvos")} ios`, } catch {
); // nothing to remove
console.log(stdout.toString()); }
stdout = execSync( fs.symlinkSync(target, link);
`mkdir -p ${paths.get("androidtv")}; ln -nsf ${paths.get( console.log(`${link} -> ${target}`);
"androidtv",
)} android`,
);
console.log(stdout.toString());
} else {
stdout = execSync(
`mkdir -p ${paths.get("ios")}; ln -nsf ${paths.get("ios")} ios`,
);
console.log(stdout.toString());
stdout = execSync(
`mkdir -p ${paths.get("android")}; ln -nsf ${paths.get("android")} android`,
);
console.log(stdout.toString());
} }
// target = "";
// switch (platform) {
// case "tvos":
// target = "ios";
// break;
// case "ios":
// target = "ios";
// break;
// case "android":
// target = "android";
// break;
// case "androidtv":
// target = "android";
// break;
// }