diff --git a/.github/scripts/pr-conflict-notifier.cjs b/.github/scripts/pr-conflict-notifier.cjs
index 3827d992..fa13bfb3 100644
--- a/.github/scripts/pr-conflict-notifier.cjs
+++ b/.github/scripts/pr-conflict-notifier.cjs
@@ -1,147 +1,147 @@
-// Labels open PRs that conflict with the default branch and tells the author,
-// once per push, how to rebase. Clears the label when the conflict is gone.
-//
-// Runs from the base repo on push/schedule only. It reads PR metadata through
-// the API and never checks out or executes PR code, so a malicious PR cannot
-// influence it.
-
-const MARKER = '';
-const LABEL = 'needs-rebase';
-const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
-
-module.exports = async ({ github, context, core, dryRun = false }) => {
- const { owner, repo } = context.repo;
- const { data: repoInfo } = await github.rest.repos.get({ owner, repo });
- const base = repoInfo.default_branch;
-
- if (!dryRun) await ensureLabel(github, owner, repo);
-
- const cause = await latestMergedPr(github, owner, repo, base);
- const prs = (await github.paginate(github.rest.pulls.list, {
- owner, repo, state: 'open', base, per_page: 100,
- })).filter((pr) => !pr.draft);
-
- // GitHub computes mergeability lazily: the first request starts the job,
- // later requests return the result. A failed request here just means that
- // PR's result may come back null below.
- await Promise.allSettled(prs.map((pr) => github.rest.pulls.get({ owner, repo, pull_number: pr.number })));
- await sleep(15000);
-
- const tally = { notified: [], labelledOnly: [], cleared: [], unknown: [], errored: [] };
- for (const pr of prs) {
- // One PR's API error (GitHub returns the odd 500/503 even after the
- // client's retries) must not stop the rest; it's picked up next run.
- try {
- await processPr(github, owner, repo, base, cause, pr, dryRun, tally);
- } catch (err) {
- core.warning(`#${pr.number}: ${err.status || ''} ${err.message}`.trim());
- tally.errored.push(pr.number);
- }
- }
-
- const fmt = (list) => (list.length ? list.map((n) => `#${n}`).join(', ') : 'none');
- const lines = [
- `${dryRun ? '[dry run] ' : ''}Checked ${prs.length} open PRs against \`${base}\`.`,
- `Notified (new conflict since last push): ${fmt(tally.notified)}`,
- `Still conflicting, author already notified: ${fmt(tally.labelledOnly)}`,
- `Conflict resolved, label removed: ${fmt(tally.cleared)}`,
- `Mergeability not computed yet, retried next run: ${fmt(tally.unknown)}`,
- `API error, retried next run: ${fmt(tally.errored)}`,
- ];
- lines.forEach((line) => core.info(line));
- if (core.summary) await core.summary.addRaw(lines.join('\n\n')).write();
- return tally;
-};
-
-async function processPr(github, owner, repo, base, cause, pr, dryRun, tally) {
- const mergeable = await readMergeable(github, owner, repo, pr.number);
- const hasLabel = pr.labels.some((l) => l.name === LABEL);
-
- if (mergeable === null) {
- tally.unknown.push(pr.number);
- return;
- }
-
- if (mergeable === false) {
- if (!hasLabel && !dryRun) {
- await github.rest.issues.addLabels({ owner, repo, issue_number: pr.number, labels: [LABEL] });
- }
- if (await notifiedSinceLastPush(github, owner, repo, pr)) {
- tally.labelledOnly.push(pr.number);
- return;
- }
- if (!dryRun) {
- await github.rest.issues.createComment({
- owner, repo, issue_number: pr.number, body: commentBody(pr, base, cause),
- });
- }
- tally.notified.push(pr.number);
- } else if (hasLabel) {
- if (!dryRun) {
- await github.rest.issues.removeLabel({ owner, repo, issue_number: pr.number, name: LABEL });
- }
- tally.cleared.push(pr.number);
- }
-}
-
-async function ensureLabel(github, owner, repo) {
- try {
- await github.rest.issues.getLabel({ owner, repo, name: LABEL });
- } catch (err) {
- if (err.status !== 404) throw err;
- await github.rest.issues.createLabel({
- owner, repo, name: LABEL, color: 'd93f0b', description: 'Has merge conflicts with main; the author needs to rebase',
- });
- }
-}
-
-async function readMergeable(github, owner, repo, number) {
- for (let attempt = 0; attempt < 4; attempt++) {
- const { data } = await github.rest.pulls.get({ owner, repo, pull_number: number });
- if (data.mergeable !== null) return data.mergeable;
- await sleep(5000);
- }
- return null;
-}
-
-// True when someone has already told the author about conflicts after their
-// latest push, so a conflict that persists across runs is announced only once,
-// and a fresh conflict after a rebase is announced again.
-async function notifiedSinceLastPush(github, owner, repo, pr) {
- const { data: head } = await github.rest.repos.getCommit({ owner, repo, ref: pr.head.sha });
- const pushedAt = new Date(head.commit.committer.date);
- const comments = await github.paginate(github.rest.issues.listComments, {
- owner, repo, issue_number: pr.number, since: pushedAt.toISOString(), per_page: 100,
- });
- return comments.some((c) => new Date(c.created_at) >= pushedAt
- && c.user.login !== pr.user.login
- && (c.body.includes(MARKER) || /merge conflicts?/i.test(c.body)));
-}
-
-async function latestMergedPr(github, owner, repo, base) {
- const { data: commit } = await github.rest.repos.getCommit({ owner, repo, ref: base });
- const { data: pulls } = await github.rest.repos.listPullRequestsAssociatedWithCommit({
- owner, repo, commit_sha: commit.sha,
- });
- const merged = pulls.find((p) => p.merged_at);
- return merged ? { number: merged.number, title: merged.title } : null;
-}
-
-function commentBody(pr, base, cause) {
- const because = cause && cause.number !== pr.number
- ? `, most likely because #${cause.number} (${cause.title}) was just merged`
- : '';
- return `${MARKER}
-@${pr.user.login} This PR now has merge conflicts with \`${base}\`${because}, so it can't be merged until it's rebased:
-
-\`\`\`bash
-git fetch upstream # upstream = https://github.com/${pr.base.repo.full_name}.git
-git rebase upstream/${base}
-# resolve the conflicts, re-run the tests, then:
-git push --force-with-lease
-\`\`\`
-
-The usual culprits are shared docs like \`ROADMAP.md\` and \`ARCHITECTURE*.md\`. If the conflict is in the \`ROADMAP.md\` changelog, move your entry into a new file under \`changelog.d/\` (see \`changelog.d/README.md\`) rather than resolving it in place, so it can't conflict again. CI re-runs when you push, and the \`${LABEL}\` label is removed automatically once the conflicts are resolved.
-
-Automated message. It won't repeat unless the PR conflicts again after your next push.`;
-}
+// Labels open PRs that conflict with the default branch and tells the author,
+// once per push, how to rebase. Clears the label when the conflict is gone.
+//
+// Runs from the base repo on push/schedule only. It reads PR metadata through
+// the API and never checks out or executes PR code, so a malicious PR cannot
+// influence it.
+
+const MARKER = '';
+const LABEL = 'needs-rebase';
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+
+module.exports = async ({ github, context, core, dryRun = false }) => {
+ const { owner, repo } = context.repo;
+ const { data: repoInfo } = await github.rest.repos.get({ owner, repo });
+ const base = repoInfo.default_branch;
+
+ if (!dryRun) await ensureLabel(github, owner, repo);
+
+ const cause = await latestMergedPr(github, owner, repo, base);
+ const prs = (await github.paginate(github.rest.pulls.list, {
+ owner, repo, state: 'open', base, per_page: 100,
+ })).filter((pr) => !pr.draft);
+
+ // GitHub computes mergeability lazily: the first request starts the job,
+ // later requests return the result. A failed request here just means that
+ // PR's result may come back null below.
+ await Promise.allSettled(prs.map((pr) => github.rest.pulls.get({ owner, repo, pull_number: pr.number })));
+ await sleep(15000);
+
+ const tally = { notified: [], labelledOnly: [], cleared: [], unknown: [], errored: [] };
+ for (const pr of prs) {
+ // One PR's API error (GitHub returns the odd 500/503 even after the
+ // client's retries) must not stop the rest; it's picked up next run.
+ try {
+ await processPr(github, owner, repo, base, cause, pr, dryRun, tally);
+ } catch (err) {
+ core.warning(`#${pr.number}: ${err.status || ''} ${err.message}`.trim());
+ tally.errored.push(pr.number);
+ }
+ }
+
+ const fmt = (list) => (list.length ? list.map((n) => `#${n}`).join(', ') : 'none');
+ const lines = [
+ `${dryRun ? '[dry run] ' : ''}Checked ${prs.length} open PRs against \`${base}\`.`,
+ `Notified (new conflict since last push): ${fmt(tally.notified)}`,
+ `Still conflicting, author already notified: ${fmt(tally.labelledOnly)}`,
+ `Conflict resolved, label removed: ${fmt(tally.cleared)}`,
+ `Mergeability not computed yet, retried next run: ${fmt(tally.unknown)}`,
+ `API error, retried next run: ${fmt(tally.errored)}`,
+ ];
+ lines.forEach((line) => core.info(line));
+ if (core.summary) await core.summary.addRaw(lines.join('\n\n')).write();
+ return tally;
+};
+
+async function processPr(github, owner, repo, base, cause, pr, dryRun, tally) {
+ const mergeable = await readMergeable(github, owner, repo, pr.number);
+ const hasLabel = pr.labels.some((l) => l.name === LABEL);
+
+ if (mergeable === null) {
+ tally.unknown.push(pr.number);
+ return;
+ }
+
+ if (mergeable === false) {
+ if (!hasLabel && !dryRun) {
+ await github.rest.issues.addLabels({ owner, repo, issue_number: pr.number, labels: [LABEL] });
+ }
+ if (await notifiedSinceLastPush(github, owner, repo, pr)) {
+ tally.labelledOnly.push(pr.number);
+ return;
+ }
+ if (!dryRun) {
+ await github.rest.issues.createComment({
+ owner, repo, issue_number: pr.number, body: commentBody(pr, base, cause),
+ });
+ }
+ tally.notified.push(pr.number);
+ } else if (hasLabel) {
+ if (!dryRun) {
+ await github.rest.issues.removeLabel({ owner, repo, issue_number: pr.number, name: LABEL });
+ }
+ tally.cleared.push(pr.number);
+ }
+}
+
+async function ensureLabel(github, owner, repo) {
+ try {
+ await github.rest.issues.getLabel({ owner, repo, name: LABEL });
+ } catch (err) {
+ if (err.status !== 404) throw err;
+ await github.rest.issues.createLabel({
+ owner, repo, name: LABEL, color: 'd93f0b', description: 'Has merge conflicts with main; the author needs to rebase',
+ });
+ }
+}
+
+async function readMergeable(github, owner, repo, number) {
+ for (let attempt = 0; attempt < 4; attempt++) {
+ const { data } = await github.rest.pulls.get({ owner, repo, pull_number: number });
+ if (data.mergeable !== null) return data.mergeable;
+ await sleep(5000);
+ }
+ return null;
+}
+
+// True when someone has already told the author about conflicts after their
+// latest push, so a conflict that persists across runs is announced only once,
+// and a fresh conflict after a rebase is announced again.
+async function notifiedSinceLastPush(github, owner, repo, pr) {
+ const { data: head } = await github.rest.repos.getCommit({ owner, repo, ref: pr.head.sha });
+ const pushedAt = new Date(head.commit.committer.date);
+ const comments = await github.paginate(github.rest.issues.listComments, {
+ owner, repo, issue_number: pr.number, since: pushedAt.toISOString(), per_page: 100,
+ });
+ return comments.some((c) => new Date(c.created_at) >= pushedAt
+ && c.user.login !== pr.user.login
+ && (c.body.includes(MARKER) || /merge conflicts?/i.test(c.body)));
+}
+
+async function latestMergedPr(github, owner, repo, base) {
+ const { data: commit } = await github.rest.repos.getCommit({ owner, repo, ref: base });
+ const { data: pulls } = await github.rest.repos.listPullRequestsAssociatedWithCommit({
+ owner, repo, commit_sha: commit.sha,
+ });
+ const merged = pulls.find((p) => p.merged_at);
+ return merged ? { number: merged.number, title: merged.title } : null;
+}
+
+function commentBody(pr, base, cause) {
+ const because = cause && cause.number !== pr.number
+ ? `, most likely because #${cause.number} (${cause.title}) was just merged`
+ : '';
+ return `${MARKER}
+@${pr.user.login} This PR now has merge conflicts with \`${base}\`${because}, so it can't be merged until it's rebased:
+
+\`\`\`bash
+git fetch upstream # upstream = https://github.com/${pr.base.repo.full_name}.git
+git rebase upstream/${base}
+# resolve the conflicts, re-run the tests, then:
+git push --force-with-lease
+\`\`\`
+
+The usual culprits are shared docs like \`ROADMAP.md\` and \`ARCHITECTURE*.md\`. If the conflict is in the \`ROADMAP.md\` changelog, move your entry into a new file under \`changelog.d/\` (see \`changelog.d/README.md\`) rather than resolving it in place, so it can't conflict again. CI re-runs when you push, and the \`${LABEL}\` label is removed automatically once the conflicts are resolved.
+
+Automated message. It won't repeat unless the PR conflicts again after your next push.`;
+}
diff --git a/.github/scripts/pr-malware-scan.cjs b/.github/scripts/pr-malware-scan.cjs
index f0deda7f..5c96016b 100644
--- a/.github/scripts/pr-malware-scan.cjs
+++ b/.github/scripts/pr-malware-scan.cjs
@@ -1,441 +1,441 @@
-// Scans a PR's changes for malware and supply-chain tricks: editor/devcontainer
-// autorun tasks, install hooks, untrusted GitHub Actions, payloads disguised
-// as fonts or images, base64/whitespace obfuscation, exfiltration endpoints,
-// reverse shells and miners.
-//
-// It treats the PR purely as data. Files are read through the API (patches,
-// or raw contents for large files) and matched against patterns; nothing from
-// the PR is checked out, installed or executed.
-//
-// HIGH findings fail the check, add the `security-review` label and
-// @mention the author. WARN findings are listed for the reviewing maintainer.
-// The comment is edited in place on every push, so a PR has one scan comment.
-
-const MARKER = '';
-const LABEL = 'security-review';
-const MAX_FETCH_BYTES = 2 * 1024 * 1024;
-
-// Owners whose Actions this org already uses. Anything else in `uses:` fails.
-const ALLOWED_ACTION_OWNERS = [
- 'actions', 'github', 'dtolnay', 'Swatinem', 'taiki-e', 'oven-sh', 'denoland', 'softprops',
-];
-
-// Popular packages that typosquats imitate, plus this org's own stack.
-const POPULAR_PACKAGES = [
- 'react', 'react-dom', 'react-router', 'react-router-dom', 'react-hook-form', 'react-intl', 'zod', 'zustand',
- 'axios', 'express', 'lodash', 'moment', 'dayjs', 'date-fns', 'date-fns-tz', 'vite', 'vitest', 'jest', 'typescript',
- 'eslint', 'prettier', 'webpack', 'babel', 'chalk', 'commander', 'dotenv', 'jsonwebtoken', 'bcrypt', 'bcryptjs',
- 'prisma', '@prisma/client', 'pg', 'mongoose', 'redis', 'ioredis', 'socket.io', 'cors', 'helmet', 'uuid', 'nanoid',
- 'yaml', 'qrcode', 'jspdf', 'html2canvas', 'buffer', 'crypto-js', 'ethers', 'web3', 'tweetnacl', 'bignumber.js',
- 'node-fetch', 'cross-env', 'nodemon', 'ts-node', 'tsx', 'playwright', '@playwright/test', 'puppeteer',
- '@stellar/stellar-sdk', '@stellar/freighter-api', 'stellar-sdk', 'soroban-client', '@sentry/react', '@sentry/browser',
- 'workbox-core', 'vite-plugin-pwa', 'msw', 'supertest', 'zxcvbn', 'otplib', 'speakeasy', 'nodemailer',
-];
-
-const TEXT_EXT = /\.(c|m)?(j|t)sx?$|\.(json|jsonc|md|mdx|rs|toml|ya?ml|css|scss|html|sql|prisma|lock|svg|txt|snap|sh|py|graphql|spec|example|env|xml|csv|ini|cfg|conf|dict|gitignore|gitattributes|editorconfig|nvmrc|npmrc|dockerignore|mts|cts|vue|svelte|astro|less|sass|go|mod|sum|tla)$/i;
-const MEDIA_EXT = /\.(woff2?|ttf|otf|eot|png|jpe?g|gif|ico|webp|bmp|pdf|mp3|mp4|wav|zip|gz|tgz|wasm)$/i;
-const DOC_EXT = /\.(md|mdx|txt)$/i;
-const GENERATED = /(^|\/)(package-lock\.json|Cargo\.lock|yarn\.lock|pnpm-lock\.yaml)$|(^|\/)test_snapshots\/|(^|\/)generated\/|\.snap$|\.min\.(js|css)$|\.svg$/;
-const JS_LIKE = /\brequire\s*\(|\bimport\s+[\w{*]|=>|\bfunction\s*\(|\beval\s*\(|\bprocess\.(env|argv)|module\.exports|child_process/;
-const SELF = '.github/scripts/pr-malware-scan.cjs';
-
-// Code patterns checked on every added line. Docs only get WARN for these,
-// since READMEs legitimately show install one-liners.
-const LINE_RULES = [
- // Marker of the obfuscated loader planted in escrow #163 and web #137.
- { id: 'known-payload', sev: 'high', re: /\bglobal(This)?\[\s*['"]!['"]\s*\]\s*=/, msg: 'Matches the obfuscated JavaScript loader seen in earlier malicious PRs.' },
- { id: 'pipe-to-shell', sev: 'high', re: /\b(curl|wget)\b[^|\n]*\|\s*(sudo\s+)?(ba|z|da)?sh\b/, msg: 'Downloads and pipes straight into a shell.' },
- { id: 'powershell-encoded', sev: 'high', re: /powershell[^\n]*(-enc(odedcommand)?\b|\biex\b|invoke-expression)/i, msg: 'Encoded or downloaded PowerShell execution.' },
- { id: 'reverse-shell', sev: 'high', re: /\/dev\/tcp\/|\bnc\b[^\n]*\s-e\s|\bbash\s+-i\s*>&|\bsocat\b[^\n]*exec:/, msg: 'Reverse-shell pattern.' },
- { id: 'exfil-endpoint', sev: 'high', re: /discord(app)?\.com\/api\/webhooks|api\.telegram\.org\/bot|pastebin\.com\/raw|webhook\.site|requestbin|pipedream\.net|\.ngrok(-free)?\.(io|app)|interact\.sh|burpcollaborator/i, msg: 'Sends data to a known exfiltration or paste endpoint.' },
- { id: 'miner', sev: 'high', re: /\bxmrig\b|stratum\+(tcp|ssl):\/\/|coinhive|cryptonight/i, msg: 'Cryptocurrency-miner indicator.' },
- { id: 'decode-and-run', sev: 'high', re: /(eval|Function|require|exec(Sync)?)\s*\([^\n]*(atob\s*\(|Buffer\.from\([^)]*['"](base64|hex)['"])/, msg: 'Decodes base64/hex and executes the result.' },
- { id: 'charcode-payload', sev: 'high', re: /fromCharCode\s*\(\s*(\d+\s*,\s*){8,}/, msg: 'Builds a string from a long run of char codes (common obfuscation).' },
- { id: 'hex-escapes', sev: 'high', re: /(\\x[0-9a-fA-F]{2}){20,}/, msg: 'Long run of \\x escapes (obfuscated string).' },
- { id: 'env-dump', sev: 'high', re: /JSON\.stringify\(\s*process\.env\s*\)|Object\.(entries|keys)\(\s*process\.env\s*\)[^\n]*(fetch|post|send|request)/, msg: 'Serialises the whole environment (secrets) for sending.' },
- { id: 'credential-files', sev: 'warn', re: /\.ssh\/(id_|authorized_keys)|\.aws\/credentials|\.npmrc['"]|Login Data|Local State|keychain|\.config\/solana\/id\.json|wallet\.dat|keystore\/UTC/i, msg: 'Touches local credential or wallet files.' },
- { id: 'dynamic-code', sev: 'warn', re: /\beval\s*\(|\bnew\s+Function\s*\(/, msg: 'Dynamic code execution (eval / new Function).' },
- { id: 'node-runs-odd-file', sev: 'high', re: /\bnode\s+(\.\/)?[\w./-]+\.(?!(c|m)?js\b|ts\b|mts\b)[a-z0-9]{2,5}\b/i, msg: 'Runs `node` on a file that is not a .js/.ts file (payload disguised by extension).' },
-];
-
-module.exports = async ({ github, context, core, pr: prOverride, dryRun = false }) => {
- const { owner, repo } = context.repo;
- const pr = prOverride || context.payload.pull_request;
- const files = await github.paginate(github.rest.pulls.listFiles, {
- owner, repo, pull_number: pr.number, per_page: 100,
- });
-
- const findings = [];
- const add = (sev, file, line, rule, msg) => findings.push({ sev, file, line, rule, msg });
-
- for (const f of files) {
- if (f.status === 'removed') continue;
- const path = f.filename;
-
- let lines;
- if (typeof f.patch === 'string') {
- lines = addedLines(f.patch);
- } else {
- // No patch: the file is binary or too large for the API diff.
- const raw = await fetchRaw(github, pr, path);
- if (raw === null) {
- if (!MEDIA_EXT.test(path) && f.changes > 0) add('warn', path, null, 'unscanned', 'Too large to scan automatically; review by hand.');
- continue;
- }
- if (raw.binary) {
- continue;
- }
- lines = raw.text.split('\n').map((text, i) => ({ n: i + 1, text }));
- }
- scanFile(path, f.status, lines, add);
- if (/(^|\/)package\.json$/.test(path)) await scanPackageJson(github, pr, path, f.status, add);
- }
-
- const high = findings.filter((x) => x.sev === 'high');
- const warn = findings.filter((x) => x.sev === 'warn');
- const body = renderComment(pr, high, warn);
-
- core.info(`Scanned ${files.length} files: ${high.length} high, ${warn.length} warn.`);
- for (const x of findings) core.info(`[${x.sev}] ${x.file}${x.line ? `:${x.line}` : ''} ${x.rule}: ${x.msg}`);
- if (core.summary) await core.summary.addRaw(body.replace(MARKER, '')).write();
-
- if (!dryRun) await publish(github, owner, repo, pr, body, findings.length > 0, high.length > 0);
- if (high.length && core.setFailed) core.setFailed(`Malware scan: ${high.length} high-severity finding(s). A maintainer must review this PR.`);
- return { high, warn };
-};
-
-// Manual backfill (workflow_dispatch): scans PRs that haven't been pushed since
-// the scanner went live, or re-scans after a rule change. Each result is
-// recorded as a `Malware scan` commit status on the PR head, which satisfies
-// the required check just like the check run a normal PR push produces.
-module.exports.backfill = async ({ github, context, core, prs = 'all', dryRun = false }) => {
- const { owner, repo } = context.repo;
- const wanted = String(prs).trim();
- const numbers = wanted === 'all' || wanted === ''
- ? (await github.paginate(github.rest.pulls.list, { owner, repo, state: 'open', per_page: 100 })).map((p) => p.number)
- : wanted.split(/[\s,]+/).map(Number).filter((n) => Number.isInteger(n) && n > 0);
- const runUrl = context.runId ? `${context.serverUrl}/${owner}/${repo}/actions/runs/${context.runId}` : undefined;
- const quiet = { info: () => {}, summary: null, setFailed: null };
- const rows = [];
-
- for (const number of numbers) {
- let pr;
- try {
- ({ data: pr } = await github.rest.pulls.get({ owner, repo, pull_number: number }));
- } catch (err) {
- rows.push(`| #${number} | skipped | not found (${err.status || err.message}) |`);
- continue;
- }
- if (pr.state !== 'open') {
- rows.push(`| #${number} | skipped | ${pr.merged_at ? 'merged' : 'closed'} |`);
- continue;
- }
- let result;
- try {
- result = await module.exports({ github, context, core: quiet, pr, dryRun });
- } catch (err) {
- core.warning(`#${number}: scan errored (${err.message}); left without a status so it is retried by the next push or backfill.`);
- rows.push(`| #${number} | β οΈ error | ${err.message.slice(0, 80)} |`);
- continue;
- }
- const failed = result.high.length > 0;
- if (!dryRun) {
- await github.rest.repos.createCommitStatus({
- owner, repo, sha: pr.head.sha, context: 'Malware scan', target_url: runUrl,
- state: failed ? 'failure' : 'success',
- description: failed ? `${result.high.length} high-severity finding(s); maintainer review needed` : `Clean (backfill${result.warn.length ? `, ${result.warn.length} note(s)` : ''})`,
- });
- }
- rows.push(`| #${number} | ${failed ? 'π¨ high' : result.warn.length ? 'notes' : 'β
clean'} | ${[...new Set([...result.high, ...result.warn].map((x) => x.rule))].join(', ')} |`);
- core.info(`#${number}: ${result.high.length} high, ${result.warn.length} warn`);
- }
-
- const summary = [`${dryRun ? '[dry run] ' : ''}Backfill processed ${rows.length} PR(s).`, '', '| PR | Result | Rules |', '|---|---|---|', ...rows].join('\n');
- if (core.summary) await core.summary.addRaw(summary).write();
- return rows;
-};
-
-function scanFile(path, status, lines, add) {
- const isDoc = DOC_EXT.test(path);
- const isGenerated = GENERATED.test(path);
- const all = lines.map((l) => l.text).join('\n');
- const first = lines[0] ? lines[0].n : null;
-
- // Editor and devcontainer configs that execute on open.
- if (/^\.vscode\/tasks\.json$/.test(path) && /"runOn"\s*:\s*"folderOpen"/.test(all)) {
- add('high', path, first, 'editor-autorun', 'VS Code task set to run automatically when the folder is opened.');
- } else if (/^\.(vscode|idea|fleet|zed)\//.test(path)) {
- add('warn', path, first, 'editor-config', 'Adds or changes editor config; check it runs nothing on open.');
- }
- if (/^\.devcontainer\//.test(path)) {
- const host = /"initializeCommand"/.test(all);
- add(host ? 'high' : 'warn', path, first, 'devcontainer-command',
- host ? 'devcontainer `initializeCommand` runs on the host machine.' : 'Changes devcontainer config; check its post-create/start commands.');
- }
-
- // Install-time and build-time hooks (package.json is handled in scanPackageJson).
- if (/(^|\/)package-lock\.json$/.test(path)) {
- for (const l of lines) {
- const m = /"resolved"\s*:\s*"([^"]+)"/.exec(l.text);
- // Relative paths are local workspace packages; only remote sources matter.
- if (m && /^[a-z+]+:/i.test(m[1]) && !m[1].startsWith('https://registry.npmjs.org/')) {
- add('high', path, l.n, 'lockfile-source', `Lockfile resolves a package from \`${m[1]}\`, not registry.npmjs.org.`);
- }
- }
- }
- if (/(^|\/)\.(npmrc|yarnrc(\.yml)?)$/.test(path)) {
- const reg = /registry\s*[=:]/.test(all) && !/registry\.npmjs\.org/.test(all);
- add(reg ? 'high' : 'warn', path, first, 'npm-config', reg ? 'Points npm at a non-default registry.' : 'Changes npm/yarn config.');
- }
- if (/(^|\/)build\.rs$/.test(path)) {
- const risky = /std::process|Command::new|TcpStream|reqwest|ureq|std::net/.test(all);
- add(risky ? 'high' : 'warn', path, first, 'build-script',
- risky ? 'Cargo build script spawns processes or opens network connections at compile time.' : 'Adds or changes a Cargo build script (runs at compile time).');
- }
- if (/(^|\/)Cargo\.toml$/.test(path)) {
- for (const l of lines) {
- if (/\bgit\s*=\s*"/.test(l.text)) add('warn', path, l.n, 'git-dependency', 'Crate pulled from a git repository instead of crates.io.');
- }
- }
- if (/^\.husky\/|(^|\/)\.git-hooks?\//.test(path)) add('warn', path, first, 'git-hook', 'Adds or changes git hooks.');
-
- // GitHub Actions.
- if (/^\.github\/workflows\//.test(path)) {
- add('warn', path, first, 'workflow-change', 'Changes a CI workflow; a maintainer must review before approving runs.');
- for (const l of lines) {
- const u = /^\s*-?\s*uses:\s*['"]?([^@\s'"]+)@/.exec(l.text);
- if (u && !u[1].startsWith('./')) {
- const owner = u[1].split('/')[0];
- if (!ALLOWED_ACTION_OWNERS.includes(owner)) {
- const near = typosquatOf(owner, ALLOWED_ACTION_OWNERS, true);
- add('high', path, l.n, 'untrusted-action', near
- ? `\`${u[1]}\` looks like a typosquat of \`${near}/β¦\`.`
- : `\`${u[1]}\` is not from an allowed Actions publisher (${ALLOWED_ACTION_OWNERS.join(', ')}).`);
- }
- }
- if (/\bpull_request_target\b/.test(l.text)) add('high', path, l.n, 'pull-request-target', '`pull_request_target` runs with a write token and secrets on fork PRs.');
- if (/\$\{\{\s*secrets\./.test(l.text)) add('warn', path, l.n, 'workflow-secret', 'Workflow uses a repository secret.');
- }
- }
-
- // Payload disguised as a font, image or other non-code file.
- if (MEDIA_EXT.test(path) || (!TEXT_EXT.test(path) && /\.[a-z0-9]{2,5}$/i.test(path) && !/(^|\/)[A-Z][A-Z_]*$|Dockerfile|Makefile|LICENSE/.test(path))) {
- if (JS_LIKE.test(all)) {
- add('high', path, first, 'disguised-code', 'Non-code file extension, but the content is JavaScript. Typical of a hidden payload.');
- }
- }
-
- if (path === SELF) return; // the scanner's own pattern list would match itself
-
- // The whole-line heuristics report once per file; the line rules still
- // check every line, including the one a heuristic matched.
- let heuristicHit = false;
- for (const l of lines) {
- const t = l.text;
- if (!isGenerated && !heuristicHit && t.length >= 200) {
- const compact = t.replace(/\s/g, '');
- const b64 = compact.replace(/[^A-Za-z0-9+/=]/g, '');
- const ws = (t.match(/\s/g) || []).length;
- if (b64.length >= 200 && b64.length / compact.length > 0.98 && looksLikeBase64Text(compact)) {
- add('high', path, l.n, 'base64-file', 'Content is committed as base64. It hides what the file really contains, and merging overwrites the real file.');
- heuristicHit = true;
- } else if (ws / t.length > 0.9 && /\S/.test(t)) {
- add('high', path, l.n, 'whitespace-hiding', 'Code is hidden among large runs of whitespace.');
- heuristicHit = true;
- } else if (/\S\s{150,}\S/.test(t) || /^\s{150,}\S/.test(t)) {
- add('high', path, l.n, 'offscreen-code', 'Code is pushed far off-screen by a long run of whitespace.');
- heuristicHit = true;
- }
- }
- if (isGenerated) continue;
- for (const r of LINE_RULES) {
- if (r.re.test(t)) add(isDoc && r.sev === 'high' ? 'warn' : r.sev, path, l.n, r.id, r.msg);
- }
- }
-}
-
-const LIFECYCLE = ['preinstall', 'install', 'postinstall', 'prepare', 'prepublish', 'preprepare', 'postprepare'];
-const DEP_FIELDS = ['dependencies', 'devDependencies', 'optionalDependencies', 'peerDependencies'];
-// A prepare script that only builds the package itself is normal; anything else runs arbitrary code on install.
-const BENIGN_PREPARE = /^(npm run [\w:-]+|tsc\b[^;&|]*|husky( install)?|vite build|node-gyp rebuild|patch-package)( && (npm run [\w:-]+|tsc\b[^;&|]*))*$/;
-
-async function scanPackageJson(github, pr, path, status, add) {
- const head = await fetchRaw(github, pr, path);
- const base = status === 'added' ? { text: '{}' } : await fetchRaw(github, { head: { repo: pr.base.repo, sha: pr.base.sha } }, path);
- if (!head || head.binary) {
- add('warn', path, null, 'package-json-unparsed', 'package.json could not be fetched; review its scripts and dependencies by hand.');
- return;
- }
- let h; let b;
- try {
- h = JSON.parse(head.text);
- b = JSON.parse(base ? base.text : '{}');
- } catch {
- add('warn', path, null, 'package-json-unparsed', 'package.json could not be parsed; review its scripts and dependencies by hand.');
- return;
- }
- const lineOf = (key) => {
- const i = head.text.split('\n').findIndex((l) => l.includes(`"${key}"`));
- return i >= 0 ? i + 1 : null;
- };
-
- for (const key of LIFECYCLE) {
- const now = h.scripts && h.scripts[key];
- if (!now || (b.scripts && b.scripts[key] === now)) continue;
- const benign = (key === 'prepare' || key === 'prepublish') && BENIGN_PREPARE.test(now.trim());
- add(benign ? 'warn' : 'high', path, lineOf(key), 'install-script',
- `Adds or changes the \`${key}\` script (\`${now.slice(0, 80)}\`), which runs automatically on \`npm install\`.`);
- }
-
- // An everyday script (dev, build, testβ¦) that now also runs some file first
- // or after: the original command still works, so the change is easy to miss.
- for (const [key, now] of Object.entries(h.scripts || {})) {
- const was = b.scripts && b.scripts[key];
- if (LIFECYCLE.includes(key) || typeof now !== 'string' || !was || now === was || !now.includes(was)) continue;
- const extra = now.replace(was, '');
- const runs = /\b(node|bun|deno|sh|bash|python3?)\s+(?!-)([^\s;&|]+)/.exec(extra);
- if (runs) {
- add('high', path, lineOf(key), 'script-hijack',
- `The \`${key}\` script now also runs \`${runs[1]} ${runs[2]}\` alongside its original command (\`${was.slice(0, 60)}\`).`);
- }
- }
-
- for (const field of DEP_FIELDS) {
- for (const [name, spec] of Object.entries(h[field] || {})) {
- if (b[field] && b[field][name] === spec) continue;
- const local = /^(file|link|workspace):(\.\/)?(?!\.\.|\/)/.test(spec) || /^workspace:/.test(spec);
- if (local) {
- add('warn', path, lineOf(name), 'dependency-source', `\`${name}\` is a local package (\`${spec}\`); check that path is part of this PR's reviewed code.`);
- } else if (/^(https?:|git(\+\w+)?:|github:|gitlab:|bitbucket:|file:|link:)/.test(spec) || /^[\w-]+\/[\w.-]+(#.*)?$/.test(spec)) {
- add('high', path, lineOf(name), 'dependency-source', `\`${name}\` is installed from \`${spec}\` instead of the npm registry.`);
- }
- const squat = typosquatOf(name, POPULAR_PACKAGES);
- if (squat) add('high', path, lineOf(name), 'typosquat', `\`${name}\` looks like a typosquat of \`${squat}\`.`);
- }
- }
-}
-
-function addedLines(patch) {
- const out = [];
- let n = 0;
- for (const line of patch.split('\n')) {
- const h = /^@@ -\d+(?:,\d+)? \+(\d+)/.exec(line);
- if (h) { n = Number(h[1]); continue; }
- if (line.startsWith('+')) out.push({ n: n++, text: line.slice(1) });
- else if (!line.startsWith('-') && !line.startsWith('\\')) n++;
- }
- return out;
-}
-
-async function fetchRaw(github, pr, path) {
- const head = pr.head.repo;
- if (!head) return null; // fork deleted
- try {
- const { data } = await github.rest.repos.getContent({ owner: head.owner.login, repo: head.name, path, ref: pr.head.sha });
- if (Array.isArray(data) || data.type !== 'file' || data.size > MAX_FETCH_BYTES) return null;
- let buf;
- if (data.content) {
- buf = Buffer.from(data.content, 'base64');
- } else {
- const { data: blob } = await github.rest.git.getBlob({ owner: head.owner.login, repo: head.name, file_sha: data.sha });
- buf = Buffer.from(blob.content, 'base64');
- }
- if (buf.includes(0)) return { binary: true };
- return { text: buf.toString('utf8') };
- } catch {
- return null;
- }
-}
-
-// Decodes the longest clean base64 run, so a stray character can't shift the
-// alignment and hide the content.
-function looksLikeBase64Text(s) {
- const run = (s.match(/[A-Za-z0-9+/]{200,}/g) || []).sort((a, b) => b.length - a.length)[0];
- if (!run) return false;
- const decoded = Buffer.from(run.slice(0, 4000 - (Math.min(run.length, 4000) % 4)), 'base64').toString('utf8');
- if (decoded.length < 100) return false;
- const printable = (decoded.match(/[\x20-\x7e\n\r\t]/g) || []).length;
- return printable / decoded.length > 0.9;
-}
-
-// `prefix` also flags lookalikes sharing the first 4 letters (dtolstech vs dtolnay).
-// Only used for Action owners: npm names legitimately share prefixes (react-dom, react-query).
-function typosquatOf(name, known, prefix = false) {
- const lower = name.toLowerCase();
- if (known.some((k) => k.toLowerCase() === lower)) return null;
- for (const k of known) {
- const kl = k.toLowerCase();
- if (Math.abs(kl.length - lower.length) > 2 || kl.length < 4) continue;
- const d = distance(lower, kl);
- if (d === 1 || (d === 2 && kl.length >= 7)) return k;
- }
- for (const k of prefix ? known : []) {
- const kl = k.toLowerCase();
- if (kl.length >= 5 && lower.length >= 5 && lower.slice(0, 4) === kl.slice(0, 4) && !lower.startsWith(kl) && !kl.startsWith(lower)) return k;
- }
- return null;
-}
-
-function distance(a, b) {
- const dp = Array.from({ length: a.length + 1 }, (_, i) => [i, ...Array(b.length).fill(0)]);
- for (let j = 1; j <= b.length; j++) dp[0][j] = j;
- for (let i = 1; i <= a.length; i++) {
- for (let j = 1; j <= b.length; j++) {
- dp[i][j] = Math.min(dp[i - 1][j] + 1, dp[i][j - 1] + 1, dp[i - 1][j - 1] + (a[i - 1] === b[j - 1] ? 0 : 1));
- }
- }
- return dp[a.length][b.length];
-}
-
-function renderComment(pr, high, warn) {
- const row = (x) => `| \`${x.file}${x.line ? `:${x.line}` : ''}\` | ${x.rule} | ${x.msg} |`;
- const table = (list) => ['| Where | Rule | Why |', '|---|---|---|', ...list.slice(0, 50).map(row),
- ...(list.length > 50 ? [`| β¦ | | ${list.length - 50} more in the workflow log |`] : [])].join('\n');
- const sha = pr.head.sha.slice(0, 7);
-
- if (high.length) {
- return `${MARKER}
-### π¨ Malware scan: needs security review
-
-@${pr.user.login} The automated scan of \`${sha}\` flagged code that can run on a maintainer's machine or in CI, or that hides what it contains. This PR won't be reviewed, and its CI won't be approved, until a maintainer has checked these:
-
-${table(high)}
-${warn.length ? `\n${warn.length} lower-severity note(s) for the reviewer
\n\n${table(warn)}\n${warn.length} lower-severity note(s) for the reviewer
\n\n${table(warn)}\n