Promote the Write Guard's Remaining gh Target Reads and the Bootstrap Dash-Name Refusal to Main by ptr727 · Pull Request #3164 · ptr727/ProjectTemplate

ptr727 · 2026-10-16T20:04:55Z

Read the gh Write Targets the Write Guard Still Missed #3162 makes gh-write-guard read the gh write targets it still missed: an inherited GH_REPO from the session environment, a run-time word before gh's command, a gh write behind a run-time command word, a positional repository and the missing write subcommands, gh api write targets outside repos/, and the GH_REPO gaps Read a gh Write's Subcommand and Target the Way gh Parses Them #3135 introduced. It adds no new allow.
Reject a Dash-Prefixed Agents Name in Both Bootstrap Loaders #3156 makes both bootstrap loaders reject a dash-prefixed -Agents/--agents name before the handoff, so -All can no longer bind install-agents' switch. Verified natively under pwsh 7 and Windows PowerShell 5.1 in Run the Native Windows Check for the Bootstrap Dash-Name Refusal #3161.
Let a Manual Dispatch Bypass the Smoke Build's Paths Filter #3153 lets a manual dispatch bypass the smoke build's paths filter, in the catalog snippet and the reusable-workflows example together.
Test the Docker Task Workflow's Credential Check, Login, and Hook Inputs #3154 tests the Docker task workflow's credential check, login, and hook inputs.
Bump the actions-deps group across 4 directories with 2 updates #3150 bumps the actions-deps group.

After this merges, the host-safety installer payload changes, so the maintainer runs the installer after promotion.

Closes #3129
Closes #3131
Closes #3132
Closes #3133
Closes #3136
Closes #3147
Closes #3148
Closes #3149

🤖 Generated with Claude Code

Fixes #3129 `bootstrap.ps1 -Agents` and `bootstrap.sh --agents` now refuse any tool name that starts with a dash before the handoff to `install-agents`, with an error and a nonzero exit. Without it, `pwsh -File` binds `-All` or `-a` as a parameter of `install-agents.ps1` (and `--all` is read as an option by `install-agents.sh`), installing every tool. - bash: refused during argument parsing, per comma-separated name, before anything runs. - PowerShell: refused in `Invoke-AgentsInstall` over every split name, for ASCII hyphen and also U+2013, U+2014, U+2015, which PowerShell binds as a parameter prefix (autocorrected paste). The check runs after the tree fetch, as the empty-list check does. - Tests: one per loader in `tests/test_bootstrap.py`. Revert proof: with both loaders restored to develop, all subtests of both new tests fail; with the fix they pass. - Local review: two passes. Pass 1 found the typographic-dash bypass (fixed). Pass 2 found no code defect and one test gap (U+2015 case), added after the pass as a one-line test-only commit, so the recorded receipt covers that line unreviewed. Windows native verification (5.1 and 7) is left to the maintainer. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>

…uts (#3154) Fixes #3148 ## Change Adds `tests/test_docker_task_workflow.py`, a stdlib-only structural test of `.github/workflows/build-docker-task.yml`. The job and step sets are read from the workflow by indentation, with no hard-coded indexes. Every job with a push-capable step (a step passing `push`, or a caller build hook) must: - run a credential check step (both secrets through env, both tested empty, `exit 1`, no `if` or `continue-on-error`) before its first push-capable step; - run the `docker/login-action` step fed both secrets, ungated, before its first push-capable step, and after the check; - forward `push`, `ref`, `branch`, and `platforms` to the caller hook, with `push`, `ref`, and `branch` wired to the same-named input. It also requires at least two pushing jobs, so a parse that silently loses a job fails. ## Mutation proof The test file holds these mutations in-memory against the real workflow text, and each asserts the specific violation. Also run once against a scratch copy: | Mutation | Result | | --- | --- | | drop login | `no login before the first push step` in docker-build-base and build-docker | | drop credential check | `no credential check before the first push step` in both | | login moved after the hook | `docker-build-base: no login before the first push step` | | login moved after build-push | `build-docker: no login before the first push step` | | check moved after login | `docker-build-base: login before the credential check` | | drop hook `push`, `ref`, `branch`, `platforms` (each) | `hook ... lacks <key>` | | `ref` wired to `inputs.branch` | `does not forward inputs.ref` | | half the credential test, `continue-on-error`, `if` gate, commented-out password | caught | ## Local review Three passes. Rounds 1 and 2 findings were fixed (move-helper newline glue, substring false passes on comments and gating, a mutation test that gated the wrong job's identical step, missing check-after-login and half-check mutations, hook input values). The third pass raised five findings, left unfixed per the two-round budget and handed here as known limits of an indentation-based reader: - `||` joining the two empty tests is not checked (`&&` would pass). - The login step is not checked for `username`/`password` wiring or a non-Hub `registry:`. - Compact YAML (`- name:` at the same indent as `steps:`) and flow-style `with: {push: true}` are not parsed, so a new job written that way is unjudged beyond the two-job floor. - Earlier, accepted: a `run:` step that pushes is not push-capable, and a step whose first key is not `name:` is unsupported. Verified: ruff format and check, pyright, `prose_lint`, `repo_gate --check eol`, `eol-coverage`, `spec/validate.py`, 12 tests pass. Co-authored in a Claude Code session. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>

Fixes #3149 The release-with-smoke caller stub gated `smoke-build` only on the paths-filter output, so a `workflow_dispatch` run (no changed paths) always skipped the build. Per the maintainer decision on the issue, `smoke-build` now runs when `github.event_name == 'workflow_dispatch' || needs.changes.outputs.release == 'true'`. The `workflow_dispatch:` trigger stays. The change is in `catalog/snippets/workflows/test-pull-request-smoke.yml` and the matching example in `docs/reusable-workflows.md`, which stay byte-identical. Verification - `tests/test_release_guards.py::ReleaseGuardCase::test_smoke_caller_stub_is_its_snippet_byte_for_byte` passes. Revert proof: reverting only the docs copy makes it fail. - eol, eol-coverage, spec/validate.py, prose_lint, markdownlint and editorconfig-checker are clean. actionlint is not installed locally. - Local strict review: 0 findings. The aggregator still treats skipped as pass, and the dispatch `branch` input resolves via `ref_name`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>

## Summary The write guard's cross-owner check (rule 3) read a write's target only from a repo flag, a `repos/` API path, and a `GH_REPO` set in the command text. gh reads its target from more places than that. This change reads each of them, building on the command and subcommand reader #3135 added. Every new reading only adds a target, so nothing develop denies is allowed. - **An inherited `GH_REPO` (#3147).** The value in the environment the session was launched with now reaches every gh word, wrapper bodies and substitutions included. A command-text prefix or a repo flag still overrides it, as gh reads it. The hook reads the same environment `GH_WRITE_GUARD_ALLOW` is read from. A value a Bash call gets another way, such as from a shell profile, is not seen, and the README says so. - **A run-time word before gh's command, and a bare export (#3136).** `gh "$R" pr comment 5` is read as a comment whose run-time word may be a repo flag, so it fails closed, as `gh pr "$R" comment` does. `GH_REPO=x; export GH_REPO` reaches gh. So does a plain assignment once GH_REPO is exported, and an `export` argument past a bare name. - **A gh write behind a run-time command word (#3131).** `$G`, `"$G"`, `${G}`, and `"$(command -v gh)"` before a literal gh write are read as gh, for rules 1, 2, 3, and 5. - **Positional repositories and missing write subcommands (#3133).** A pull request or issue URL argument names its repository. A `gh repo` write's repository argument, `gh issue transfer`'s destination, and `gh issue develop --branch-repo` are read too, in gh's `[HOST/]OWNER/REPO`, https, ssh, and scp forms. The table gains `pr revert`/`update-branch`, `issue develop`, `release delete-asset`, `repo unarchive`/`sync`, `label clone`, `workflow run`/`enable`/`disable`, `run rerun`/`cancel`/`delete`, `cache delete`, `repo deploy-key add`/`delete`, and `repo autolink create`/`delete`. - **`gh api` write targets outside `repos/` (#3132).** `orgs/<owner>`, `users/<owner>`, `user/starred/<owner>/<repo>`, `user/following|blocks/<user>`, and `user/memberships/orgs/<org>` name an owner. An api write whose endpoint opens with a run-time word, or whose owner segment is one, fails closed. - **Wrapper-scoped `GH_REPO` (#3144, under-deny side).** Each wrapper's own reaching value is now read for its own bodies, nested ones inheriting. So is a quoted `"$(...)"` substitution's. Develop allowed `GH_REPO=stranger/example bash -c 'gh issue comment 5 -b hi'; GH_REPO=example/repo bash -c 'gh pr view 5'`. The old latest-value reading is kept beside it, so the issue's own over-deny example stays denied. - **#3145.** The merge deny message now names a quoted run-time word where gh itself goes. `gh api`'s older `:owner`/`:repo` placeholders take `GH_REPO` (confirmed live: gh 2.102 still fills them). A three-part value is read by its middle owner as well, which closes `--repo example/stranger/x`. The first-part reading is kept, so `GH_REPO=github.com/example/repo` stays denied. The maintainer's rule on #3079 holds throughout: a run-time repository value fails closed only when its owner is run-time, so `gh repo create "example/$NAME"` and `orgs/example/$T` are compared by their literal owner. ## Scope Choices - An environment `GH_REPO` is replaced only by a prefix, on the gh word or on its wrapper. A command-text export can sit where it never runs, in a subshell, an untaken branch, a function, or a backgrounded or piped command, so the environment value is read beside every export. That denies `export GH_REPO=example/repo; gh pr comment 5` in a session whose environment holds a foreign `GH_REPO`, a deliberate over-deny. A prefix, `GH_REPO=example/repo gh pr comment 5`, or `-R` is the allowed spelling, and the Claude README now says so. - A wholly run-time pull request or issue selector, as in `gh pr comment "$PR"`, is left allowed. Whether it should fail closed is #3157. ## Develop-Versus-Branch Differential The corpus is every command in develop's self-test tables (1255 commands) plus 165 constructed commands, each tagged with the issue it exercises or as a control. Each was run under both guards with origin `example/repo` and again with a second owner, 2840 runs. - **Flips:** 189, every one allow to deny, and **new allows: 0**. - **Every flip has an issue:** #3147 (38), #3136 (27), #3131 (23), #3133 (64), #3132 (27), #3145 (7), #3144 (3). Those counts include the 11 flips tagged control. All 11 are under the second owner, where `example/...` is itself a foreign owner, so each is the same shape as its issue's case: one #3136, one #3131, six #3133, and three #3132. - **Unexplained flips:** none. No case from develop's own tables flipped. - **Fuzzing:** 42,000 random constructed commands across the branch's heads, 6,000 of them on the final one, plus about 100,000 to 160,000 per pass from the local reviewer. No new allow, and no exception from `classify`. An exception there would let the hook fail open. ## Tests and Revert Proof - `_GH_TARGET_CASES` adds 82 self-tests, run with the environment each names, origin `example/repo`. They cover every closed gap and a control for each. - **Revert proof:** the 82 cases were run against develop's guard, that is, with the fix reverted. All 56 deny cases fail there and all 26 allow controls pass, so each test fails without its fix. - `--selftest` passes with 1413 cases. `python3 -m unittest discover -s tests` passes 2873 tests, and `test_install.py` passes 162. - ruff check and format, mypy, `prose_lint.py --diff origin/develop`, `repo_gate.py --check eol` and `eol-coverage`, `spec/validate.py`, markdownlint, editorconfig-checker, and cspell are all clean. ## Local Review Five full passes at `frontier`, plus a receipt pass over the last README sentence. Round one raised 8 findings. These were fixed: - the shell state now reaches a gh word behind a launcher or `find -exec` - a substitution takes the state at the word opening it - ssh and scp repository forms are read - rule 2 now covers `$G api graphql` Rounds two through four were all about one question, when a command-text export may replace an environment `GH_REPO`. Each test that let one replace it was missing a case: a subshell, a backgrounded or piped export, a `case`, an if or loop body, or a quoted separator. The last test was also quadratic on long commands. That logic is deleted rather than patched again, so only a prefix replaces the value, per the scope choice above. A 26k-character command classifies in 0.46s, as on develop. Round two also found a gh word that is only an `echo` argument taking `GH_REPO`, and that is fixed. Round five found no code defect and a README gap, which is filled. These were filed: - the run-time selector, as #3157 - `--org`/`--owner` flags, issue-reference flag values, `repositories/<id>` paths, `eval` payloads, dot-segments, and `declare -x`, as #3158 These were declined: - merging `_export_words` into the git-side export reader, which would change git-rule verdicts outside these issues - the ungated `sentence-length` check, which has about 175 existing hits in these files - a Windows env-name case item, which is unlikely Closes #3147 Closes #3136 Closes #3131 Closes #3133 Closes #3132 Refs #3144, whose over-deny example waits for the over-denial lane Refs #3145, whose item 3 over-deny (`GH_REPO=github.com/example/repo` denied) waits for the same lane 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

coderabbitai · 2026-10-16T20:05:04Z

Important

🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Repository: ptr727/ProjectTemplate/.coderabbit.yaml
Review profile: CHILL
Plan: Advanced
Run ID: 30e7fe67-33d0-4217-aad9-e1ee940f299a

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

codecov · 2026-10-16T20:09:43Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 63.97%. Comparing base (4ce0bf5) to head (a152f47).
⚠️ Report is 390 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #3164   +/-   ##
=======================================
  Coverage   63.97%   63.97%           
=======================================
  Files          17       17           
  Lines        9151     9151           
=======================================
  Hits         5854     5854           
  Misses       3297     3297

Flag	Coverage Δ
python-3.13	`63.97% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Copilot

🟡 Changes recommended

Unresolved moderate findings remain in gh-write-guard and Docker workflow regression coverage.

1 open finding

Recognize runtime gh subcommands in write detection · New

What changed in this PR

This PR promotes host-safety protections, bootstrap validation, smoke-build behavior, Docker workflow tests, and action dependency updates.

Changes:

Expands gh-write-guard target and write parsing.
Rejects dash-prefixed bootstrap agent names.
Updates smoke dispatch behavior and Docker workflow coverage.
Bumps pinned action dependencies.

File	Summary
`tests/test_release_guards.py`	Tests smoke-build dispatch gating.
`tests/test_docker_task_workflow.py`	Tests Docker credentials, login, and hook inputs; wiring assertions need strengthening.
`tests/test_bootstrap.py`	Tests dash-prefixed agent rejection.
`host-setup/bootstrap.sh`	Rejects dash-prefixed agent names.
`host-setup/bootstrap.ps1`	Rejects ASCII and typographic dash-prefixed names.
`host-setup/agent-safety/README.md`	Documents expanded target detection.
`host-setup/agent-safety/claude/README.md`	Documents inherited `GH_REPO` handling.
`host-setup/agent-safety/claude/gh-write-guard.py`	Expands write and target parsing; unresolved findings remain around `GH_REPO`, `repo fork`, runtime commands, and API targets.
`docs/reusable-workflows.md`	Updates manual smoke-build behavior.
`catalog/snippets/workflows/test-pull-request-smoke.yml`	Mirrors smoke dispatch behavior.
`.github/actions/validate/action.yml`	Updates the `setup-uv` pin.
`.github/actions/pypi-build-default/action.yml`	Updates `setup-uv` and artifact pins.
`.github/actions/nuget-build-default/action.yml`	Updates artifact pins.
`.github/actions/dotnet-publish-default/action.yml`	Updates the artifact pin.

🧠 Review effort: Lite

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

ptr727 · 2026-10-16T20:13:41Z

Answering the overview of the Copilot round at #3164 (review) (head a152f479). Its open-findings list counts 1 finding, answered on its thread with #3165. The headline and two file-table notes name concerns with no file:line anchor and no thread, so each is answered here.

tests/test_docker_task_workflow.py, table note "wiring assertions need strengthening", and the headline's "Docker workflow regression coverage". No change needed. This is the depth limit Copilot raised on Test the Docker Task Workflow's Credential Check, Login, and Hook Inputs #3154 and that pull request declined with evidence at Test the Docker Task Workflow's Credential Check, Login, and Hook Inputs #3154 (comment): the login check pins both secrets and that the step is ungated, the hook-input values are pinned, and a swapped username/password or a non-Hub registry input is a known limit of the indentation-based reader, recorded in that pull request's body.
host-setup/agent-safety/claude/gh-write-guard.py, table note "unresolved findings remain around GH_REPO, repo fork, runtime commands, and API targets". Deferred to the open issues that already track each: GH_REPO to Read a GH_REPO Only in the Wrapper Body It Reaches in the Write Guard #3144, Close Three Small GH_REPO and Merge-Message Gaps in the Write Guard #3145, and Let a Top-Level Command-Text GH_REPO Export Override an Inherited One in the Write Guard #3163, repo fork --org and other owner flags to Read the Owner Flags, Issue References, and Repository Ids the Write Guard Still Skips #3158, run-time words to Decide Whether a Run-Time Pull Request Selector Fails Closed in the Write Guard #3157 and Read a Run-Time Path Word Behind a Run-Time Command Word as a Possible Write in the Write Guard #3165, and API targets by repository id to Read the Owner Flags, Issue References, and Repository Ids the Write Guard Still Skips #3158. The note names no command shape beyond those, so there is nothing further to triage.

dependabot Bot and others added 5 commits October 16, 2026 17:35

Copilot AI lite review requested due to automatic review settings October 16, 2026 20:04

Copilot started reviewing on behalf of ptr727 October 16, 2026 20:05

View session

Copilot AI reviewed Oct 16, 2026

View reviewed changes

Comment thread host-setup/agent-safety/claude/gh-write-guard.py

ptr727 mentioned this pull request Oct 16, 2026

Read a Run-Time Path Word Behind a Run-Time Command Word as a Possible Write in the Write Guard #3165

Open

ptr727 merged commit 0f1ac32 into main Oct 16, 2026
14 checks passed

ptr727 mentioned this pull request Oct 16, 2026

Session Handoff [engineering]: Guard Target Reads and Bootstrap Dash-Name Refusal Released as 2.0.1074, Guard Allow Gaps Next #3166

Open

Navigation Menu

Repository navigation

Promote the Write Guard's Remaining gh Target Reads and the Bootstrap Dash-Name Refusal to Main - #3164

Promote the Write Guard's Remaining gh Target Reads and the Bootstrap Dash-Name Refusal to Main#3164
ptr727 merged 5 commits into
mainfrom
develop

ptr727 commented Oct 16, 2026

Uh oh!

coderabbitai Bot commented Oct 16, 2026

Uh oh!

codecov Bot commented Oct 16, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

ptr727 commented Oct 16, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

ptr727 commented Oct 16, 2026

Uh oh!

coderabbitai Bot commented Oct 16, 2026

Uh oh!

codecov Bot commented Oct 16, 2026

Codecov Report

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

ptr727 commented Oct 16, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants