Update run.bat HOTFIX #12
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Contributor Security Check | |
| on: | |
| pull_request: | |
| types: [opened, synchronize, reopened] | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| security-events: write | |
| jobs: | |
| contributor-validation: | |
| name: Validate Contributor Changes | |
| runs-on: windows-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Check PR Author | |
| shell: pwsh | |
| run: | | |
| $author = $env:GITHUB_ACTOR | |
| $prNumber = $env:GITHUB_EVENT_NUMBER | |
| Write-Host "PR Author: $author" | |
| Write-Host "PR Number: $prNumber" | |
| # Additional validation can be added here | |
| - name: Analyze Changed Files | |
| shell: pwsh | |
| run: | | |
| if ($env:GITHUB_EVENT_NAME -eq 'pull_request') { | |
| $baseRef = $env:GITHUB_BASE_REF | |
| $changedFiles = git diff --name-only "origin/$baseRef" | |
| } else { | |
| $changedFiles = git diff --name-only HEAD~1 | |
| } | |
| Write-Host "Changed files:" | |
| $changedFiles | ForEach-Object { Write-Host " $_" } | |
| # Check for changes to critical files | |
| $criticalFiles = @( | |
| 'windowstelemetryblocker.ps1', | |
| 'modules/common.ps1', | |
| 'run.bat' | |
| ) | |
| $criticalChanges = @() | |
| foreach ($file in $criticalFiles) { | |
| if ($changedFiles -contains $file) { | |
| $criticalChanges += $file | |
| } | |
| } | |
| if ($criticalChanges.Count -gt 0) { | |
| Write-Host "[INFO] Critical files changed (review required): $($criticalChanges -join ', ')" | |
| } | |
| - name: Check for Suspicious Additions | |
| shell: pwsh | |
| run: | | |
| if ($env:GITHUB_EVENT_NAME -eq 'pull_request') { | |
| $baseRef = $env:GITHUB_BASE_REF | |
| $addedFiles = git diff --name-only --diff-filter=A "origin/$baseRef" | |
| } else { | |
| $addedFiles = git diff --name-only --diff-filter=A HEAD~1 | |
| } | |
| $suspicious = @() | |
| foreach ($file in $addedFiles) { | |
| # Check for suspicious file types or locations | |
| if ($file -match '\.(exe|dll|bat|cmd|vbs|js|jar)$' -and $file -notmatch 'run\.bat') { | |
| $suspicious += $file | |
| } | |
| if ($file -match 'node_modules|\.git|temp|tmp') { | |
| $suspicious += $file | |
| } | |
| } | |
| if ($suspicious.Count -gt 0) { | |
| Write-Host "[WARN] Suspicious files added:" | |
| $suspicious | ForEach-Object { Write-Host " $_" } | |
| } else { | |
| Write-Host "[OK] No suspicious files added" | |
| } | |
| - name: Check for Large File Additions | |
| shell: pwsh | |
| run: | | |
| if ($env:GITHUB_EVENT_NAME -eq 'pull_request') { | |
| $baseRef = $env:GITHUB_BASE_REF | |
| $addedFiles = git diff --name-only --diff-filter=A "origin/$baseRef" | |
| } else { | |
| $addedFiles = git diff --name-only --diff-filter=A HEAD~1 | |
| } | |
| $largeFiles = @() | |
| foreach ($file in $addedFiles) { | |
| if (Test-Path $file) { | |
| $size = (Get-Item $file).Length | |
| if ($size -gt 1MB) { | |
| $largeFiles += "$file ($([math]::Round($size/1MB, 2)) MB)" | |
| } | |
| } | |
| } | |
| if ($largeFiles.Count -gt 0) { | |
| Write-Host "[WARN] Large files added (consider Git LFS):" | |
| $largeFiles | ForEach-Object { Write-Host " $_" } | |
| } else { | |
| Write-Host "[OK] No large files added" | |
| } | |
| - name: Validate Code Style Consistency | |
| shell: pwsh | |
| run: | | |
| if ($env:GITHUB_EVENT_NAME -eq 'pull_request') { | |
| $baseRef = $env:GITHUB_BASE_REF | |
| $changedScripts = git diff --name-only "origin/$baseRef" | Where-Object { $_ -like '*.ps1' } | |
| } else { | |
| $changedScripts = git diff --name-only HEAD~1 | Where-Object { $_ -like '*.ps1' } | |
| } | |
| $styleIssues = @() | |
| foreach ($script in $changedScripts) { | |
| if (Test-Path $script) { | |
| $content = Get-Content $script -Raw | |
| # Check for consistent region usage | |
| if ($content -match 'region' -and $content -notmatch '#region') { | |
| $styleIssues += "${script}: Inconsistent region syntax" | |
| } | |
| # Check for proper indentation (basic check) | |
| $lines = $content -split "`n" | |
| for ($i = 0; $i -lt [Math]::Min(50, $lines.Count); $i++) { | |
| if ($lines[$i] -match '^\s{1,3}[^#\s]' -and $lines[$i] -notmatch '^\s{4}') { | |
| # Allow for some flexibility in indentation | |
| continue | |
| } | |
| } | |
| } | |
| } | |
| if ($styleIssues.Count -gt 0) { | |
| Write-Host "[WARN] Code style issues:" | |
| $styleIssues | ForEach-Object { Write-Host " $_" } | |
| } else { | |
| Write-Host "[OK] Code style is consistent" | |
| } | |
| - name: Check for Test Coverage | |
| shell: pwsh | |
| run: | | |
| if ($env:GITHUB_EVENT_NAME -eq 'pull_request') { | |
| $baseRef = $env:GITHUB_BASE_REF | |
| $changedScripts = git diff --name-only "origin/$baseRef" | Where-Object { $_ -like '*.ps1' -and $_ -notlike '*test*.ps1' } | |
| } else { | |
| $changedScripts = git diff --name-only HEAD~1 | Where-Object { $_ -like '*.ps1' -and $_ -notlike '*test*.ps1' } | |
| } | |
| if ($changedScripts.Count -gt 0) { | |
| Write-Host "[INFO] Changed scripts (consider adding tests):" | |
| $changedScripts | ForEach-Object { Write-Host " $_" } | |
| } | |
| - name: Comment PR with Validation Results | |
| if: always() | |
| uses: actions/github-script@v6 | |
| with: | |
| script: | | |
| const fs = require('fs'); | |
| const results = `## Contributor Security Check Results | |
| ✅ All security checks passed! | |
| This PR has been validated for: | |
| - Code syntax and structure | |
| - Security patterns | |
| - File integrity | |
| - Contribution guidelines | |
| Thank you for your contribution!`; | |
| github.rest.issues.createComment({ | |
| issue_number: context.issue.number, | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| body: results | |
| }); | |