Serendipity
1a1254f045
CI - 构建、测试和质量检查 / Rust 代码检查 (push) Has been cancelled
CI - 构建、测试和质量检查 / 单元测试 (push) Has been cancelled
CI - 构建、测试和质量检查 / 代码格式检查 (push) Has been cancelled
CI - 构建、测试和质量检查 / Clippy 代码质量检查 (push) Has been cancelled
CI - 构建、测试和质量检查 / 构建可执行文件 (claude_code_rs, macos-latest, x86_64-apple-darwin) (push) Has been cancelled
CI - 构建、测试和质量检查 / 构建可执行文件 (claude_code_rs, ubuntu-latest, x86_64-unknown-linux-gnu) (push) Has been cancelled
CI - 构建、测试和质量检查 / 构建可执行文件 (claude_code_rs.exe, windows-latest, x86_64-pc-windows-msvc) (push) Has been cancelled
- 添加 Rust GUI 桌面应用程序入口点 - 添加 TypeScript/JavaScript 项目基础结构文件 - 包含组件、工具、命令、服务和工具定义 - 添加配置文件如 .gitignore、.gitattributes 和 LICENSE - 包含图片资源和演示文件 - 为各种功能模块添加占位符和类型定义
48 lines
1.6 KiB
YAML
48 lines
1.6 KiB
YAML
name: Non-write Users Check
|
|
on:
|
|
pull_request:
|
|
paths:
|
|
- ".github/**"
|
|
|
|
permissions:
|
|
contents: read
|
|
pull-requests: write
|
|
|
|
jobs:
|
|
allowed-non-write-check:
|
|
runs-on: ubuntu-latest
|
|
env:
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
steps:
|
|
- run: |
|
|
DIFF=$(gh pr diff "$PR_NUMBER" -R "$REPO" || true)
|
|
|
|
if ! echo "$DIFF" | grep -qE '^diff --git a/\.github/.*\.ya?ml'; then
|
|
exit 0
|
|
fi
|
|
|
|
MATCHES=$(echo "$DIFF" | grep "^+.*allowed_non_write_users" || true)
|
|
|
|
if [ -z "$MATCHES" ]; then
|
|
exit 0
|
|
fi
|
|
|
|
EXISTING=$(gh pr view "$PR_NUMBER" -R "$REPO" --json comments --jq '.comments[].body' \
|
|
| grep -c "<!-- non-write-users-check -->" || true)
|
|
|
|
if [ "$EXISTING" -gt 0 ]; then
|
|
exit 0
|
|
fi
|
|
|
|
gh pr comment "$PR_NUMBER" -R "$REPO" --body '<!-- non-write-users-check -->
|
|
**`allowed_non_write_users` detected**
|
|
|
|
This PR adds or modifies `allowed_non_write_users`, which allows users without write access to trigger Claude Code Action workflows. This can introduce security risks.
|
|
|
|
If this is a new flow, please make sure you actually need `allowed_non_write_users`. If you are editing an existing workflow, double check that you are not adding new Claude permissions which might lead to a vulnerability.
|
|
|
|
See existing workflows in this repo for safe usage examples, or contact the AppSec team.'
|
|
env:
|
|
PR_NUMBER: ${{ github.event.pull_request.number }}
|
|
REPO: ${{ github.repository }}
|