Repository navigation
Conversation
… only by a named allowlist infra-PR-cull's sign-off of 52b0c9d found five holes: -c accepted only as the first flag, pipes into a shell never walked, and variable-built or ANSI-C command words exempted before the OPAQUE check and gated on owns_step. Rule, applied to every run step in every workflow and composite action: RED [OPAQUE] for (a) a shell given -c among any flags (-o pipefail -c, -eo pipefail -c, -lc) with a non-literal string, (b) any pipe into a shell, eval, xargs sh or source /dev/stdin, (c) eval/source/. with a non-literal argument or a process substitution, (d) a command word that is not a literal after normalisation ($'..', $( ), backtick, $VAR). The owns_step gate and the variable-word exemption are removed. The only exemption is scripts/uid-agnostic-opaque-allow.txt (file:exact-line # reason); a stale or reasonless entry is RED [ALLOWLIST]. Quoted text no longer reads as statements. Real repo: 6 allowlist entries (4 x "$PV" codegen, 2 lines inside multi-line jq/awk programs), each with its reason. Self-test: every reviewer point has a mutant, in an ownership step and in a plain step, plus literal and ordinary-pipe controls. Refs: paiml/infra#2349 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Member
Author
|
quorum-review (AD-04): NOT agreed (auto_merge: checked=true was_armed=false disarmed=false) {
"ticket": "PMAT-2349",
"head": "9967bdddfa1ce1c4c4eb176cc2765c8d570c011a",
"width": 3,
"executor": "agy",
"agreed": false,
"auto_merge": {
"checked": true,
"was_armed": false,
"disarmed": false,
"note": "auto-merge not armed"
},
"lanes": [
{
"lane": 1,
"verdict": "FAIL",
"findings": 3
},
{
"lane": 2,
"verdict": "FAIL",
"findings": 4
},
{
"lane": 3,
"verdict": "PASS",
"findings": 0
}
]
} |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #95 (merged at 52b0c9d), carrying infra-PR-cull's open points from its 52b0c9d round (
bash -o pipefail -c "$X", a pipe intosh, a printf-built command word). Linear on main; one commit. Refs: paiml/infra#2349.run:step in every workflow and composite action, not only ownership steps:sh/bash -cat any flag position with non-literal input, a pipe into a shell oreval, a non-literaleval/source, a non-literal command word.scripts/uid-agnostic-opaque-allow.txt, entries<file>:<exact line> # <reason>. A stale entry, a missing file or a reason under 12 characters isFAIL[ALLOWLIST].owns_stepgate on OPAQUE and the variable-word exemption.🤖 Generated with Claude Code