harden validation and safety boundaries - #2
Merged
Conversation
There was a problem hiding this comment.
Pull request overview
This PR tightens repository validation and documentation safety boundaries by making the privacy scan portable (no rg dependency), expanding detection of macOS user-home paths, adding regression checks in CI, and clarifying the guide’s staged-validation/authorization constraints.
Changes:
- Reworked
scripts/validate-repo.shprivacy scanning to usegit ls-files+ Ruby instead ofrg, and added required-command checks plus a regression test invocation. - Added a new regression script (
scripts/test-validate-repo.sh) and ran it in GitHub Actions before the main validator. - Updated docs to clarify validation/runtime boundaries, tighten “don’t close the only SSH entry” language, and date/source-anchor references.
Reviewed changes
Copilot reviewed 7 out of 7 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
SOURCES.md |
Dates the GitHub snapshot reference and adjusts fixed-version source anchors. |
SECURITY.md |
Clarifies destructive/credential actions must be staged and explicitly confirmed. |
scripts/validate-repo.sh |
Removes rg dependency; adds portable scanning and regression invocation. |
scripts/test-validate-repo.sh |
Adds integration regressions for missing-rg and generic macOS user-path detection. |
README.md |
Clarifies that only the original macOS split-routing case has runtime evidence; one-stop path still requires staged validation. |
docs/agent-runbook.md |
Tightens authorization boundaries for SSH closure, firewall enablement, and credential revocation. |
.github/workflows/validate.yml |
Runs regression checks prior to the main repository validator on macOS runner. |
Comments suppressed due to low confidence (1)
scripts/test-validate-repo.sh:54
- This file cleanup uses
unlink; usingrm -fkeeps deletion consistent with common shell portability expectations and avoids depending on the presence ofunlink.
unlink "$fixture"
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+123
to
124
| if git ls-files | grep -nE \ | ||
| '(^|/)(wireguard-private\.yaml|wg-private\.yaml|wg0\.conf|[^/]+\.key|[^/]+\.pem)$'; then |
Comment on lines
+136
to
+137
| content = File.binread(path) | ||
| next if content.include?("\0") |
Comment on lines
+145
to
+147
| rescue Errno::EACCES, Errno::ENOENT | ||
| next | ||
| end |
Comment on lines
+13
to
+15
| if [[ -e "$fixture" ]]; then | ||
| unlink "$fixture" | ||
| fi |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
rgdependency from privacy checks and scan tracked plus non-ignored files through Git and RubyYOUR_NAMEplaceholderWhy
Post-merge closeout found two validation gaps and two wording ambiguities. The GitHub macOS runner does not provide
rg; the previous script swallowed that command failure and could report a passing privacy scan without running it. The old path pattern also recognized only one local username. Separately, the guide could be read as allowing the only SSH entry to be closed or as treating the new one-stop path as already tested on a fresh machine.User impact
Readers and agents get portable privacy checks, clearer authorization boundaries, and a more accurate distinction between repository validation and real VPS/macOS runtime validation.
TDD evidence
RED on commit
3cf3105:bash scripts/test-validate-repo.shrgremoved fromPATHGREEN on commits
b3ee5aaande0eae9c:rgabsent, the portable validator still runs its normal checksrgabsent and a generic macOS path present, the same validator rejects the fixturebash scripts/validate-repo.shpassedgit diff --check main...HEADpassedThe intermediate CI failures were retained as evidence that the new regression actually exercised the GitHub runner; they led to removing the undeclared dependency rather than installing it implicitly.
Coverage note: this repository has no line-coverage runner. Both identified validation journeys are covered by executable integration regressions, and the existing static suite covers shell syntax, YAML, plist, SSH examples, Markdown links, server invariants, private-looking artifacts, and whitespace.