fix(security): close RCE via PR title, stop leaking secrets, harden r… #263
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: ['**'] | |
| pull_request: | |
| branches: [main] | |
| jobs: | |
| # The runner entrypoint executes untrusted PR content and was the only code | |
| # in the repo with no linter over it. A shell injection lived there | |
| # undetected; shellcheck is what stops the next one. | |
| lint-shell: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - run: shellcheck infra/docker/claude-runner/entrypoint.sh scripts/*.sh | |
| lint-backend: | |
| runs-on: ubuntu-latest | |
| defaults: | |
| run: | |
| working-directory: apps/api | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: astral-sh/setup-uv@v4 | |
| - run: uv sync --frozen | |
| - run: uv run ruff check src/ tests/ | |
| - run: uv run ruff format --check src/ tests/ | |
| - run: uv run mypy src/ | |
| test-backend: | |
| runs-on: ubuntu-latest | |
| defaults: | |
| run: | |
| working-directory: apps/api | |
| services: | |
| postgres: | |
| image: postgres:16-alpine | |
| env: | |
| POSTGRES_DB: helprs_test | |
| POSTGRES_USER: helprs | |
| POSTGRES_PASSWORD: helprs | |
| ports: | |
| - 5432:5432 | |
| options: >- | |
| --health-cmd "pg_isready -U helprs" | |
| --health-interval 5s | |
| --health-timeout 3s | |
| --health-retries 5 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: astral-sh/setup-uv@v4 | |
| - run: uv sync --frozen | |
| - run: uv run pytest --cov=helprs --cov-report=term-missing --cov-fail-under=70 | |
| env: | |
| # Test-only values. The ephemeral CI database is destroyed after each run | |
| # and nothing it encrypts ever leaves the job. Do not reuse anywhere else. | |
| DATABASE_URL: postgresql+asyncpg://helprs:helprs@localhost:5432/helprs_test | |
| SECRET_KEY: ci-test-secret-key | |
| FERNET_KEY: "-fB7lL74GHGbXnRClRQTaBP9_flqSUHFC9_c2n3Tvbo=" | |
| GITHUB_APP_ID: "000000" | |
| ENVIRONMENT: test | |
| lint-frontend: | |
| runs-on: ubuntu-latest | |
| defaults: | |
| run: | |
| working-directory: apps/web | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 22 | |
| cache: npm | |
| cache-dependency-path: apps/web/package-lock.json | |
| - run: npm ci | |
| - run: npx eslint src/ | |
| test-frontend: | |
| runs-on: ubuntu-latest | |
| defaults: | |
| run: | |
| working-directory: apps/web | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 22 | |
| cache: npm | |
| cache-dependency-path: apps/web/package-lock.json | |
| - run: npm ci | |
| - run: npx vitest run | |
| build: | |
| runs-on: ubuntu-latest | |
| needs: [lint-backend, test-backend, lint-frontend, test-frontend] | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - run: docker build -f infra/docker/Dockerfile.api --target production apps/api | |
| - run: docker build -f infra/docker/Dockerfile.web --target production apps/web | |
| - run: docker build -f infra/docker/claude-runner/Dockerfile infra/docker/claude-runner |