Skip to content

fix: gate 文件清单三防线——edited/rename 溯源/3000 fail-closed（ADR-0016） #53

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
randypanding merged 1 commit into from
Aug 19, 2026
Merged

fix: gate 文件清单三防线——edited/rename 溯源/3000 fail-closed（ADR-0016） #53

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 21 additions & 2 deletions .github/workflows/gate.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,10 @@
name: gate
on:
pull_request:
# edited（qodo review #1，CI-Workflows #8 同款加固）：adr-required 消费
# 可变的 PR title/body——不订阅 edited 则作者可在 check 通过后编辑掉
# ADR 引用而不触发重验；补引用救活 fail 的 check 同样依赖 edited 重触发
types: [opened, synchronize, reopened, edited]
push:
branches: [main]

Expand Down Expand Up @@ -65,8 +69,23 @@ jobs:
PR_TITLE: ${{ github.event.pull_request.title }}
PR_BODY: ${{ github.event.pull_request.body }}
run: |
# --paginate（评审项）：>100 文件的 PR 首页截断会把 C1 变更漏检成非 C1
FILES=$(gh api --paginate "repos/${{ github.repository }}/pulls/${{ github.event.pull_request.number }}/files?per_page=100" --jq '.[].filename')
# 文件清单三防线（qodo review #2 #3，CI-Workflows #8 同款加固）：
# --paginate：>100 文件的 PR 首页截断会把 C1 变更漏检成非 C1；
# rename 的 previous_filename 一并纳入——governance/standards/CODEOWNERS
# 等 C1 资产改名移出受管路径同样是 C1 变更（files API 只在
# previous_filename 暴露原路径）；
# files API 3000 文件硬上限：返回数 < changed_files = 清单不完整，
# fail-closed（清单不全时 C1 判定不可信，宁误杀不放过）。
PR_API="repos/${{ github.repository }}/pulls/${{ github.event.pull_request.number }}"
FILES_API="$PR_API/files?per_page=100"
CHANGED=$(gh api "$PR_API" --jq '.changed_files')
FILES_CUR=$(gh api --paginate "$FILES_API" --jq '.[].filename')
Comment on lines +81 to +82

@qodo-code-review qodo-code-review Bot Aug 19, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Remediation recommended

1. gh api uses workflow token 📘 Rule violation ⛨ Security

The added GitHub API requests authenticate through the existing ${{ github.token }} rather than a
single-repository cloudbrid-agent token issued by scripts/gh-app-token.sh. This violates the
required authentication and identity policy for automated GitHub operations.
Agent Prompt 
## Issue description
The new `gh api` requests use the workflow-provided GitHub token instead of a cloudbrid-agent GitHub App token.

## Issue Context
Obtain the token through `scripts/gh-app-token.sh`, setting its mandatory `REPO` input to the current repository name so the resulting installation token is restricted to one repository. Populate `GH_TOKEN` from that command's output rather than `${{ github.token }}`.

## Fix Focus Areas
- .github/workflows/gate.yml[67-82]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

GOT=$(grep -c . <<<"$FILES_CUR" || true)
Comment on lines +82 to +83

@qodo-code-review qodo-code-review Bot Aug 19, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Action required

2. Newline filename bypasses cap 🐞 Bug ≡ Correctness

GOT counts nonempty output lines rather than files, so a filename containing a newline can inflate
the count and conceal truncation above GitHub's 3000-file limit. An attacker can place such a
filename among the returned entries and a C1 file beyond the limit, causing the incomplete list to
pass and skip ADR enforcement.
Agent Prompt 
## Issue description
The fail-closed check counts lines emitted from filenames, but Git filenames may contain line feeds. This lets one returned file produce multiple counted lines and mask files omitted by the API's 3000-file cap.

## Issue Context
Keep the paginated response as structured JSON. Count response objects and evaluate `filename` and `previous_filename` directly with `jq`, rather than serializing filenames into newline-delimited shell text before counting or matching.

## Fix Focus Areas
- .github/workflows/gate.yml[79-89]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

if [ "$GOT" -lt "$CHANGED" ]; then
echo "::error::PR 声明变更 $CHANGED 个文件但 files API 只返回 $GOT 个（3000 上限截断）——C1 判定完整性无法保证，fail-closed"
exit 1
fi
FILES=$( { echo "$FILES_CUR"; gh api --paginate "$FILES_API" --jq '[.[].previous_filename // empty][]'; } )
if ! echo "$FILES" | grep -qE '^(governance/|standards/|scripts/|\.github/|CODEOWNERS|profile/)'; then
echo "非 C1 路径变更，跳过 adr-required"
exit 0
Expand Down