fix: graphql exposure auth gaps - #34
Merged
Merged
Conversation
…concepts VocabularyGuards.TraxVocabularyIsUsed scans a repo for uses of a third-party attribute where Trax has a vocabulary of its own, and names the replacement in the offender line. The banned list is an argument rather than a constant, because only the repo knows which concepts are its own: a library primitive Trax has no notion of is not listed, and listing everything would end at reimplementing the library. Matching requires the file to mention the library, since short attribute names collide: ASP.NET Core's [Authorize] governs endpoints, a surface Trax does not own, and must not trip a guard aimed at HotChocolate's. Comments and string literals are stripped first, because the messages that tell a consumer to stop using these attributes have to name them. The translation layer is allowlisted by path with a reason. Code constructing the library's type to speak to the library is the allowed direction. Enforces Trax.Docs/adr/0013.
This repo has no cross-repo Trax pins to flatten, but it gets the same ignore rule as the others: a Trax major is a deliberate migration rather than a bot PR, and it keeps Dependabot away from the unlisted 2.0.0 packages still sitting on nuget.org for trax.core and trax.scheduler. Unlisted versions stay resolvable, so they would otherwise look like a legitimate upgrade target.
Dependabot edits Directory.Packages.props but does not reliably regenerate the packages.lock.json files beside it. The pull-request build restores with --locked-mode, so a lockfile that disagrees with the manifest fails the PR with NU1004 and the bump stalls until somebody regenerates by hand. Reproduced deliberately: bumping one pin without touching the lockfiles gives exactly that error, and restore --use-lock-file --force-evaluate clears it. This matters more now that the Trax pins are readable, because those bumps will start arriving. Two jobs, per GITHUB_ACTIONS_SECURITY.md triage item 2. `dotnet restore` resolves and downloads third-party packages, and that must not share a job with a write token, so the resolve job holds contents: read and hands the result to the commit job as a patch. The commit job holds the only elevated token in the workflow and runs nothing but git. The patch comes from a job that ran dependency code, so it is treated as untrusted on arrival: git apply is restricted with --include to lockfile paths, and the working tree is re-checked afterwards in case that restriction ever slips. Both were verified to hold, including that --include refuses a patch touching Directory.Packages.props. The guard is the pull request author rather than github.actor, which is what GitHub documents: a human re-running the workflow changes the actor but not the author. persist-credentials is true in the commit job alone, against the convention everywhere else here, because that is the job that pushes.
Codecov Report❌ Patch coverage is
📢 Thoughts on this report? Let us know! |
|
This PR is included in version 1.7.1 |
This was referenced Sep 16, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.