mirror of
https://github.com/alibaba/open-code-review.git
synced 2026-11-15 01:34:01 +08:00
f651412ed8
* fix(ci): pin workflow action references to full commit SHAs Extend the #836 pin discipline from action.yml to every workflow: all 21 external `uses:` references across the 8 workflow files now carry a full 40-hex commit SHA with a strict `# vX.Y.Z` comment, each SHA verified against the commit its version tag resolves to. Majors are unchanged (translation-sync stays on checkout v4), so behavior is identical — only the tags can no longer move. release.yml matters most: it holds the npm token and the attestation id-token, so a moved upstream tag there had credential blast radius (#841). verify-action-pins.sh now covers .github/workflows/*.yml as well. This also restores the review-requested hardening from #836 that raced the merge and never landed on main (pushed as 37fc06f eight minutes after the merge commit): full-line anchoring with a strict version comment, a directive pre-filter so commented examples are skipped, and the grep -n prefix strip. The extension surfaced why that matters immediately - without the pre-filter the check flags codeql.yml's commented setup-example line. Fixes #841 * fix(scripts): fail closed on flow-mapping uses entries and cover .yaml workflows Adversarial review of the extended check found two coverage gaps. A flow-mapping entry (`- {uses: actions/cache@v6}`) slipped past the anchored directive filter that block-style lines go through — the old unanchored grep would have flagged it, so the anchoring traded a comment false-positive for a narrow fail-open regression. The directive now matches the flow opener too, and since the pinned pattern never accepts flow syntax, such entries fail closed as unusual rather than vanishing. The file glob also only covered *.yml; GitHub executes *.yaml workflows just the same, so those join the set under nullglob (an absent glob would otherwise survive as a literal and trip the missing-file guard). * fix(scripts): scope the pin check back to action.yml The repo-level SHA-pinning setting covers this repository's own workflows at job start; the script keeps guarding the layer that setting cannot see — nested uses: inside the published composite action.yml, which only execute in consumers' workflows. Co-authored-by: wu21-web <149216116+wu21-web@users.noreply.github.com> * fix(ci): pin newly-added workflow action references to full SHAs Rebasing onto main surfaced floating tags in workflows added after this branch diverged: idea-ext.yml (checkout, gradle wrapper-validation, setup-java), ci.yml (windows job checkout, setup-go), and frontend-ext.yml (checkout, cache). Pin them to the same 40-hex SHAs used elsewhere so the whole workflow set is SHA-pinned, matching the goal of #841. * style(ci): use full version in checkout pin comments action-contract.yml and plugin-contract.yml already pin the full SHA but their trailing comments read # v7; normalize to # v7.0.1 to match the rest of the repo. Comment-only change, no behavior difference. * fix(scripts): catch quoted uses: keys in the pin-check directive A quoted mapping key ("uses": / 'uses' :) is valid YAML but did not match the directive filter, so such a line was silently skipped and a floating tag inside it escaped the check. Broaden the directive to match quoted keys and space-before-colon; the pinned pattern still rejects those forms, so they fail closed as unusual syntax rather than slipping through. Reported by wu21-web in review of #856. * fix(scripts): extend pin check to workflow files Scope verify-action-pins.sh back over .github/workflows/*.yml and *.yaml, not just action.yml. Workflows carry credentials (release.yml holds the npm token and attestation id-token), and a moved upstream tag there is not otherwise caught: floating tags reach main today, so runtime enforcement is not blocking them. The check now fails closed on any future floating reference in a workflow. All current references already pass. --------- Co-authored-by: Fanzzzd <fanzzzd@users.noreply.github.com> Co-authored-by: wu21-web <149216116+wu21-web@users.noreply.github.com> Co-authored-by: Kite <254839944+lizhengfeng101@users.noreply.github.com> Co-authored-by: kite <lizhengfeng.lzf@alibaba-inc.com>
87 lines
3.1 KiB
YAML
87 lines
3.1 KiB
YAML
name: plugin-contract
|
|
|
|
# Distribution-contract guardrails, kept out of ci.yml (which is build/test/lint)
|
|
# for the same reason translation-sync.yml is: a slow container pull here should
|
|
# never delay core CI feedback.
|
|
#
|
|
# - blocking: every in-repo path link in the docs/READMEs resolves to a real
|
|
# file (these URLs are served from the default branch, so a stale path is a
|
|
# 404 for every reader). blob/tree kind mismatches are warnings only.
|
|
# - blocking: every path a plugin or marketplace manifest declares resolves to
|
|
# a real, non-empty directory, and every SKILL.md / command prompt carries
|
|
# the frontmatter its loader requires.
|
|
#
|
|
# Scoped with paths: so it only runs when a manifest, a skill, a command prompt,
|
|
# a doc, or the checker itself changes.
|
|
#
|
|
# Both checks read the whole work tree, so they are also run on push to main:
|
|
# two PRs can each pass alone and break the invariant once merged (one renames a
|
|
# file, the other adds a reference to the old path). Without the push trigger
|
|
# nothing would ever re-evaluate the merged result. Same shape as
|
|
# action-contract.yml.
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
paths:
|
|
- ".claude-plugin/**"
|
|
- ".agents/**"
|
|
- ".kimi-plugin/**"
|
|
- "plugins/**"
|
|
- "skills/**"
|
|
- "pages/src/content/docs/**"
|
|
- "README*.md"
|
|
- "CONTRIBUTING*.md"
|
|
- "AGENTS.md"
|
|
- "scripts/github-actions/check-plugin-contract.*"
|
|
- ".github/workflows/plugin-contract.yml"
|
|
pull_request:
|
|
branches: [main]
|
|
paths:
|
|
- ".claude-plugin/**"
|
|
- ".agents/**"
|
|
- ".kimi-plugin/**"
|
|
- "plugins/**"
|
|
- "skills/**"
|
|
- "pages/src/content/docs/**"
|
|
- "README*.md"
|
|
- "CONTRIBUTING*.md"
|
|
- "AGENTS.md"
|
|
- "scripts/github-actions/check-plugin-contract.*"
|
|
- ".github/workflows/plugin-contract.yml"
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
plugin-contract:
|
|
runs-on: self-hosted
|
|
timeout-minutes: 10
|
|
container:
|
|
# Pinned to an exact 24.x for reproducible builds, matching the pin used
|
|
# by translation-sync.yml (avoids the mutable node:24 tag).
|
|
image: node:24.18.0
|
|
steps:
|
|
# The checks read the working tree only — no git history needed.
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
|
|
- name: Trust workspace
|
|
run: git config --global --replace-all safe.directory '*'
|
|
|
|
# Validate the guardrail script itself (plain Node, no deps).
|
|
- name: Test plugin-contract guardrail
|
|
run: node scripts/github-actions/check-plugin-contract.test.js
|
|
|
|
# BLOCKING: no doc or README may link to a path that no longer exists.
|
|
- name: Check in-repo path links
|
|
run: node scripts/github-actions/check-plugin-contract.js links
|
|
|
|
# BLOCKING: plugin/marketplace manifests must resolve to real targets and
|
|
# every skill/command must carry loadable frontmatter.
|
|
- name: Check plugin manifest contract
|
|
run: node scripts/github-actions/check-plugin-contract.js manifests
|