From 0d19b23ca19aeb9e9178d7963a48544da9e3d6ca Mon Sep 17 00:00:00 2001 From: Alexey Samoylov Date: Fri, 10 Jul 2026 18:21:26 +0600 Subject: [PATCH 1/2] fix(action): bind installer to cli v1 Default to CLI major 1, disable npm lifecycle scripts, and verify the wrapper against a staged DiffPal binary.\n\nRefs: dp-zsy.3 --- .github/workflows/ci.yml | 20 +++++++++++++++++++ README.md | 4 ++-- action.yml | 2 +- scripts/contract-test.sh | 28 ++++++++++++++++++++++++++ scripts/install-diffpal.sh | 4 ++-- scripts/smoke-test.sh | 40 ++++++++++++++++++++++++++++++++++++++ 6 files changed, 93 insertions(+), 5 deletions(-) create mode 100755 scripts/contract-test.sh diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 0b5deb4..04e557f 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -12,3 +12,23 @@ jobs: - uses: actions/checkout@v6 - name: Smoke test action scripts run: bash scripts/smoke-test.sh + + - name: Check out DiffPal CLI contract + uses: actions/checkout@v6 + with: + repository: diffpal/diffpal + ref: develop + path: .tmp/diffpal + + - uses: actions/setup-go@v6 + with: + go-version-file: .tmp/diffpal/go.mod + + - name: Build staged DiffPal CLI + working-directory: .tmp/diffpal + run: go build -o "$RUNNER_TEMP/diffpal" ./cmd/diffpal + + - name: Verify CLI v1 contract + env: + DIFFPAL_BIN: ${{ runner.temp }}/diffpal + run: bash scripts/contract-test.sh diff --git a/README.md b/README.md index 0eab13c..6a0c8ab 100644 --- a/README.md +++ b/README.md @@ -18,7 +18,7 @@ the review flow stays the same. First generate and commit a DiffPal config: ```bash -npx -y @diffpal/diffpal@latest init --wizard --setup codex-api-key --platform github +npx -y @diffpal/diffpal@1.0.0 init --wizard --setup codex-api-key --platform github ``` This creates `.config/diffpal/config.yaml` with a visible `ci` profile. Existing @@ -87,7 +87,7 @@ they configure. | Input | Default | Use | | --- | --- | --- | | `install` | `true` | Install `@diffpal/diffpal` before review. | -| `diffpal-version` | `latest` | npm version or dist-tag. Pin for reproducible CI. | +| `diffpal-version` | `1` | npm version or dist-tag. Use an exact v1 release for reproducible CI. | | `diffpal-path` | `diffpal` | Existing binary path. Custom paths skip install. | ### Config Selection diff --git a/action.yml b/action.yml index a251970..f4cc05f 100644 --- a/action.yml +++ b/action.yml @@ -12,7 +12,7 @@ inputs: diffpal-version: description: npm version or dist-tag for @diffpal/diffpal. Use an exact version for reproducible CI. required: false - default: latest + default: "1" diffpal-path: description: Path to an existing diffpal binary. Custom paths skip automatic installation. required: false diff --git a/scripts/contract-test.sh b/scripts/contract-test.sh new file mode 100755 index 0000000..c2252aa --- /dev/null +++ b/scripts/contract-test.sh @@ -0,0 +1,28 @@ +#!/usr/bin/env bash +set -euo pipefail + +diffpal_bin="${DIFFPAL_BIN:?DIFFPAL_BIN is required}" +help="$($diffpal_bin review github --help)" + +for flag in \ + --base \ + --head \ + --profile \ + --block-on \ + --gate \ + --feedback \ + --summary-overview \ + --out \ + --repo \ + --review-id \ + --review-channel \ + --language \ + --instructions \ + --instructions-file; do + if ! grep -Fq -- "$flag" <<<"$help"; then + echo "DiffPal CLI contract is missing $flag" >&2 + exit 1 + fi +done + +echo "DiffPal CLI v1 contract passed" diff --git a/scripts/install-diffpal.sh b/scripts/install-diffpal.sh index 43e2a91..8bb204e 100755 --- a/scripts/install-diffpal.sh +++ b/scripts/install-diffpal.sh @@ -14,7 +14,7 @@ truthy() { install_requested="${INPUT_INSTALL:-true}" diffpal_path="${INPUT_DIFFPAL_PATH:-diffpal}" -version="${INPUT_DIFFPAL_VERSION:-latest}" +version="${INPUT_DIFFPAL_VERSION:-1}" if [[ "$diffpal_path" != "diffpal" ]]; then echo "Using custom diffpal-path: $diffpal_path" @@ -36,7 +36,7 @@ fi install_root="${RUNNER_TEMP:-/tmp}/diffpal-action" mkdir -p "$install_root" -npm install --global --prefix "$install_root" "@diffpal/diffpal@$version" --omit=dev --no-audit --no-fund +npm install --global --prefix "$install_root" "@diffpal/diffpal@$version" --omit=dev --ignore-scripts --no-audit --no-fund diffpal_bin="$install_root/bin/diffpal" if [[ ! -x "$diffpal_bin" ]]; then diff --git a/scripts/smoke-test.sh b/scripts/smoke-test.sh index 6e250cf..51f33e4 100755 --- a/scripts/smoke-test.sh +++ b/scripts/smoke-test.sh @@ -97,9 +97,48 @@ SCRIPT "$repo_root/scripts/install-diffpal.sh" assert_contains "$npm_args" "@diffpal/diffpal@0.1.2" + assert_contains "$npm_args" "--ignore-scripts" assert_contains "$github_env" "DIFFPAL_BIN=$runner_temp/diffpal-action/bin/diffpal" } +test_installer_defaults_to_cli_v1() { + local dir="$1" + local fake_bin="$dir/fake-bin" + local runner_temp="$dir/runner" + local github_env="$dir/github-env" + local npm_args="$dir/npm-args" + mkdir -p "$fake_bin" "$runner_temp" + + cat > "$fake_bin/npm" <<'SCRIPT' +#!/usr/bin/env bash +printf '%s\n' "$@" > "$NPM_ARGV_FILE" +prefix="" +while [[ "$#" -gt 0 ]]; do + if [[ "$1" == "--prefix" ]]; then + prefix="$2" + shift 2 + continue + fi + shift +done +mkdir -p "$prefix/bin" +printf '#!/usr/bin/env bash\nexit 0\n' > "$prefix/bin/diffpal" +chmod +x "$prefix/bin/diffpal" +SCRIPT + chmod +x "$fake_bin/npm" + + PATH="$fake_bin:$PATH" \ + RUNNER_TEMP="$runner_temp" \ + GITHUB_ENV="$github_env" \ + NPM_ARGV_FILE="$npm_args" \ + INPUT_INSTALL=true \ + INPUT_DIFFPAL_PATH=diffpal \ + "$repo_root/scripts/install-diffpal.sh" + + assert_contains "$npm_args" "@diffpal/diffpal@1" + assert_contains "$npm_args" "--ignore-scripts" +} + test_installer_selects_custom_path() { local dir="$1" local github_env="$dir/github-env-custom" @@ -250,6 +289,7 @@ tmpdir="$(mktemp -d)" trap 'rm -rf "$tmpdir"' EXIT test_installer_installs_requested_version "$tmpdir/install" +test_installer_defaults_to_cli_v1 "$tmpdir/default-v1" test_installer_selects_custom_path "$tmpdir/custom" test_installer_selects_path_when_install_disabled "$tmpdir/disabled" test_wrapper_uses_installed_binary_and_feedback "$tmpdir/wrapper-installed" From 770cb249b0d5b8c6f26f8f2f910db25c8c99f258 Mon Sep 17 00:00:00 2001 From: Alexey Samoylov Date: Fri, 10 Jul 2026 18:47:04 +0600 Subject: [PATCH 2/2] chore(security): harden action supply chain Refs: dp-zsy.2 --- .github/CODEOWNERS | 4 ++++ .github/ISSUE_TEMPLATE/bug.yml | 25 +++++++++++++++++++++++++ .github/ISSUE_TEMPLATE/config.yml | 5 +++++ .github/PULL_REQUEST_TEMPLATE.md | 9 +++++++++ .github/workflows/ci.yml | 6 +++--- SECURITY.md | 11 +++++++++++ 6 files changed, 57 insertions(+), 3 deletions(-) create mode 100644 .github/CODEOWNERS create mode 100644 .github/ISSUE_TEMPLATE/bug.yml create mode 100644 .github/ISSUE_TEMPLATE/config.yml create mode 100644 .github/PULL_REQUEST_TEMPLATE.md create mode 100644 SECURITY.md diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS new file mode 100644 index 0000000..114873b --- /dev/null +++ b/.github/CODEOWNERS @@ -0,0 +1,4 @@ +* @metalagman + +/.github/ @metalagman +/action.yml @metalagman diff --git a/.github/ISSUE_TEMPLATE/bug.yml b/.github/ISSUE_TEMPLATE/bug.yml new file mode 100644 index 0000000..25afbdb --- /dev/null +++ b/.github/ISSUE_TEMPLATE/bug.yml @@ -0,0 +1,25 @@ +name: Bug report +description: Report a reproducible action defect +title: "bug: " +labels: [bug] +body: + - type: textarea + id: behavior + attributes: + label: Observed behavior + validations: + required: true + - type: textarea + id: reproduce + attributes: + label: Minimal workflow and logs + description: Remove credentials and private source before posting. + validations: + required: true + - type: input + id: version + attributes: + label: Action reference + placeholder: diffpal/action@v1 or commit SHA + validations: + required: true diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml new file mode 100644 index 0000000..bcf39f8 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/config.yml @@ -0,0 +1,5 @@ +blank_issues_enabled: true +contact_links: + - name: Security report + url: https://github.com/diffpal/action/security/advisories/new + about: Report vulnerabilities privately. diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md new file mode 100644 index 0000000..c793f1b --- /dev/null +++ b/.github/PULL_REQUEST_TEMPLATE.md @@ -0,0 +1,9 @@ +## Summary + + + +## Validation + +- [ ] The action smoke and staged CLI contract tests pass. +- [ ] Input, output, and compatibility changes are documented. +- [ ] Security and secret-handling impact has been considered. diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 04e557f..1b923b5 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -9,18 +9,18 @@ jobs: smoke: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 - name: Smoke test action scripts run: bash scripts/smoke-test.sh - name: Check out DiffPal CLI contract - uses: actions/checkout@v6 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 with: repository: diffpal/diffpal ref: develop path: .tmp/diffpal - - uses: actions/setup-go@v6 + - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6 with: go-version-file: .tmp/diffpal/go.mod diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..3fe48e8 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,11 @@ +# Security Policy + +Security fixes are provided for the latest released major version. + +Do not open a public issue for a suspected vulnerability. Report it through +[GitHub private vulnerability reporting](https://github.com/diffpal/action/security/advisories/new) +with reproduction steps and impact. We aim to acknowledge reports within three +business days and coordinate remediation and disclosure with the reporter. + +Issues in the DiffPal CLI itself should be reported to the +[core repository](https://github.com/diffpal/diffpal/security/advisories/new).