Skip to content

fix: adr-required 换行文件名绕过截断检测——jq 结构化计数（ADR-0016） #54

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
randypanding merged 1 commit into from
Aug 19, 2026
Merged

fix: adr-required 换行文件名绕过截断检测——jq 结构化计数（ADR-0016） #54

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
37 changes: 25 additions & 12 deletions .github/workflows/gate.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,24 +69,37 @@ jobs:
PR_TITLE: ${{ github.event.pull_request.title }}
PR_BODY: ${{ github.event.pull_request.body }}
run: |
# 文件清单三防线（qodo review #2 #3，CI-Workflows #8 同款加固）：
# --paginate：>100 文件的 PR 首页截断会把 C1 变更漏检成非 C1；
# rename 的 previous_filename 一并纳入——governance/standards/CODEOWNERS
# 等 C1 资产改名移出受管路径同样是 C1 变更（files API 只在
# previous_filename 暴露原路径）；
# files API 3000 文件硬上限：返回数 < changed_files = 清单不完整，
# fail-closed（清单不全时 C1 判定不可信，宁误杀不放过）。
# 文件清单三防线（qodo review #2 #3 + 追加：换行文件名绕过）：
# 分页拉全量；rename 的 previous_filename 一并纳入 C1 判定（C1 资产改名
# 移出受管路径同样是 C1 变更）；files API 3000 文件硬上限 fail-closed。
# 计数与 C1 匹配全部在 jq 内按 JSON 对象处理——Git 允许文件名含换行，
# 行流（grep -c / echo|grep）会被单文件多行虚增计数绕过截断检测
# （qodo review：Newline filenames bypass truncation，AR#22 同款）。
PR_API="repos/${{ github.repository }}/pulls/${{ github.event.pull_request.number }}"
FILES_API="$PR_API/files?per_page=100"
CHANGED=$(gh api "$PR_API" --jq '.changed_files')
FILES_CUR=$(gh api --paginate "$FILES_API" --jq '.[].filename')
GOT=$(grep -c . <<<"$FILES_CUR" || true)
GOT=0
C1_HIT=0
PAGE=1
while :; do
PAGEJSON=$(gh api "$PR_API/files?per_page=100&page=$PAGE")

@qodo-code-review qodo-code-review Bot Aug 19, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Remediation recommended

1. gh api uses workflow token 📘 Rule violation ⛨ Security

The added paginated GitHub API call inherits GH_TOKEN from ${{ github.token }} rather than
obtaining a single-repository cloudbrid-agent token through scripts/gh-app-token.sh. This violates
the mandated identity and token-scoping mechanism for CI GitHub operations.
Agent Prompt 
## Issue description
The added `gh api` pagination call authenticates with the workflow-provided GitHub token instead of the required cloudbrid-agent GitHub App identity.

## Issue Context
Obtain the token by invoking `scripts/gh-app-token.sh`, set `REPO` to the specific repository, and expose its output to `gh` as `GH_TOKEN`. Preserve fail-closed behavior if token acquisition fails.

## Fix Focus Areas
- .github/workflows/gate.yml[67-84]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

if ! jq -e 'type == "array"' <<<"$PAGEJSON" >/dev/null 2>&1; then
echo "::error::files API 第 $PAGE 页拉取失败——C1 判定完整性无法保证，fail-closed"
exit 1
fi
N=$(jq 'length' <<<"$PAGEJSON")
GOT=$((GOT+N))
if jq -e '[.[] | .filename, (.previous_filename // empty)]
| any(test("^(governance/|standards/|scripts/|\\.github/|CODEOWNERS|profile/)"))' <<<"$PAGEJSON" >/dev/null 2>&1; then
C1_HIT=1
fi
[[ $N -lt 100 ]] && break
PAGE=$((PAGE+1))
done
if [ "$GOT" -lt "$CHANGED" ]; then
echo "::error::PR 声明变更 $CHANGED 个文件但 files API 只返回 $GOT 个（3000 上限截断）——C1 判定完整性无法保证，fail-closed"
exit 1
fi
FILES=$( { echo "$FILES_CUR"; gh api --paginate "$FILES_API" --jq '[.[].previous_filename // empty][]'; } )
if ! echo "$FILES" | grep -qE '^(governance/|standards/|scripts/|\.github/|CODEOWNERS|profile/)'; then
if [ "$C1_HIT" -ne 1 ]; then
echo "非 C1 路径变更，跳过 adr-required"
exit 0
fi
Expand Down