Repository navigation
Validate plugin manifests in CI - #1
Merged
Merged
Conversation
Contributor
Author
|
Independent review passed for the CI change at head The review covered security, correctness and maintainability. The check parses tracked JSON files, rejects symlinks and non-file entries, uses read-only repository permissions, and pins checkout without retained credentials. All five manifests pass; a tracked symlink to JSON outside the checkout fails. GitHub's check job passed for this exact head. Confidential review receipt retained, SHA-256 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The plugin manifests have no CI validation. Add a read-only check that parses every tracked JSON manifest on pull requests and
main, and rejects symlink or non-file entries.Validation: all five manifests pass; a tracked symlink to a JSON file outside the checkout fails; actionlint and whitespace checks pass.
Audit receipt
Outcome: Reject invalid plugin manifests before merging changes.
Change: A read-only GitHub Actions job parses tracked JSON files and rejects symlinks and non-file entries.
Proof: Head
02e58355ccfa4c462372bfe039a63119d872f71e; base199d170472a3fe8e2d3cdecdba46591fd8e448ae; stable Myers patch IDa8396925c06e56836c3be866a1f0ba9347492336. Green CI job. Independent technical review. Confidential review receipt retained, SHA-256a48df6cce614f2bcfb8aeacfc7dba31f100d61c4f51f2f4adb9d257c18d20132.Risk: Changes CI configuration only. Tracked manifests must be regular files. No runtime or deployment change.
Owner: Tomás Senart. Full ownership and authorization evidence is retained in the confidential receipt.