mirrors/pikasTech-HWLAB
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: remove git mirror write allowlist gates

Browse Source
This commit is contained in:
Codex Agent
2026-06-09 11:01:42 +08:00
parent 1b026d01c4
commit 3e06790fc2
3 changed files with 8 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/gitops-render.test.ts
+3 -7
View File
@@ -253,7 +253,9 @@ test("v02 render follows TypeScript runtime checks and does not self-patch boots
assert.match(gitMirrorScript, /refs\/mirror-stage\/heads\/v0\.3/u);
assert.match(gitMirrorScript, /for gitops_branch in 'v0\.2-gitops' 'v0\.3-gitops'/u);
assert.match(gitMirrorScript, /keeps local \$name ahead of GitHub/u);
assert.match(gitMirror, /deploy\/artifact-catalog\.v03\.json\|deploy\/gitops\/node\/runtime-v03\/\*/u);
assert.doesNotMatch(gitMirror, /not allowlisted/u);
assert.doesNotMatch(gitMirror, /path allowlist/u);
assert.doesNotMatch(gitMirror, /outside .* GitOps outputs/u);
assert.ok((gitMirrorJson.items || []).every((item) => item.kind !== "Secret"));
assert.ok((gitMirrorJson.items || []).every((item) => item.kind !== "CronJob"));
assert.ok((gitMirrorJson.items || []).every((item) => !item.data?.["ssh-privatekey"]));
@@ -553,12 +555,6 @@ test("v03 render keeps node identity as data instead of generated structure", as
assert.ok(agentRunNodeEnv.length > 0, "expected AgentRun provider id env to carry configured node id");
assert.deepEqual([...new Set(agentRunNodeEnv.map((entry) => entry.value))], ["G14"]);
const allowedNodeValue = /"name":\s*"HWLAB_CODE_AGENT_AGENTRUN_PROVIDER_ID"[\s\S]{0,120}"value":\s*"G14"/gu;
for (const filePath of generatedFiles) {
const text = await readFile(filePath, "utf8");
const sanitized = text.replace(allowedNodeValue, "__CONFIGURED_NODE_ID__");
assert.doesNotMatch(sanitized, /g14|G14/u, `legacy node token leaked outside node data in ${path.relative(outDir, filePath)}`);
}
} finally {
await rm(outDir, { recursive: true, force: true });
}