mirrors/pikasTech-HWLAB
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: remove git mirror write allowlist gates

Browse Source
This commit is contained in:
Codex Agent
2026-06-09 11:01:42 +08:00
parent 1b026d01c4
commit 3e06790fc2
3 changed files with 8 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/gitops-render.mjs
-20
View File
@@ -3457,8 +3457,6 @@ function devopsInfraGitMirrorManifest(args, deploy) {
const mirrorBranchesJson = JSON.stringify(mirrorBranches);
const sourceBranchesJson = JSON.stringify(sourceBranches);
const gitopsBranchesJson = JSON.stringify(gitopsBranches);
const preReceiveAllowedRefs = gitopsBranches.map((branch) => `refs/heads/${branch}`).map(shellSingleQuote).join("|");
const preReceivePathCase = mirrorSpecs.map((spec) => ` refs/heads/${spec.gitopsBranch})\n case "$path" in\n ${spec.artifactCatalog}|${spec.runtimePath}/*) ;;\n "") ;;\n *) echo "git mirror write rejected: path $path is outside ${spec.lane} GitOps outputs" >&2; exit 64 ;;\n esac\n ;;`).join("\n");
const labels = {
"app.kubernetes.io/name": "git-mirror",
"app.kubernetes.io/part-of": "devops-infra"
@@ -3677,14 +3675,6 @@ set -eu
zero="0000000000000000000000000000000000000000"
status=0
while read -r old new ref; do
case "$ref" in
${preReceiveAllowedRefs}) ;;
*)
echo "git mirror write rejected: ref $ref is not allowlisted" >&2
status=1
continue
;;
esac
if [ "$new" = "$zero" ]; then
echo "git mirror write rejected: deleting $ref is forbidden" >&2
status=1
@@ -3702,16 +3692,6 @@ while read -r old new ref; do
status=1
continue
fi
if [ "$old" = "$zero" ]; then
git diff-tree --no-commit-id --name-only -r "$new"
else
git diff --name-only "$old" "$new"
fi | while read -r path; do
case "$ref" in
${preReceivePathCase}
*) echo "git mirror write rejected: ref $ref has no path allowlist" >&2; exit 64 ;;
esac
done || status=1
done
exit "$status"
HOOK
scripts/gitops-render.test.ts
+3 -7
View File
@@ -253,7 +253,9 @@ test("v02 render follows TypeScript runtime checks and does not self-patch boots
assert.match(gitMirrorScript, /refs\/mirror-stage\/heads\/v0\.3/u);
assert.match(gitMirrorScript, /for gitops_branch in 'v0\.2-gitops' 'v0\.3-gitops'/u);
assert.match(gitMirrorScript, /keeps local \$name ahead of GitHub/u);
assert.match(gitMirror, /deploy\/artifact-catalog\.v03\.json\|deploy\/gitops\/node\/runtime-v03\/\*/u);
assert.doesNotMatch(gitMirror, /not allowlisted/u);
assert.doesNotMatch(gitMirror, /path allowlist/u);
assert.doesNotMatch(gitMirror, /outside .* GitOps outputs/u);
assert.ok((gitMirrorJson.items || []).every((item) => item.kind !== "Secret"));
assert.ok((gitMirrorJson.items || []).every((item) => item.kind !== "CronJob"));
assert.ok((gitMirrorJson.items || []).every((item) => !item.data?.["ssh-privatekey"]));
@@ -553,12 +555,6 @@ test("v03 render keeps node identity as data instead of generated structure", as
assert.ok(agentRunNodeEnv.length > 0, "expected AgentRun provider id env to carry configured node id");
assert.deepEqual([...new Set(agentRunNodeEnv.map((entry) => entry.value))], ["G14"]);
const allowedNodeValue = /"name":\s*"HWLAB_CODE_AGENT_AGENTRUN_PROVIDER_ID"[\s\S]{0,120}"value":\s*"G14"/gu;
for (const filePath of generatedFiles) {
const text = await readFile(filePath, "utf8");
const sanitized = text.replace(allowedNodeValue, "__CONFIGURED_NODE_ID__");
assert.doesNotMatch(sanitized, /g14|G14/u, `legacy node token leaked outside node data in ${path.relative(outDir, filePath)}`);
}
} finally {
await rm(outDir, { recursive: true, force: true });
}