feat: adapt pullfrog for gitea + ollama
This commit is contained in:
+31
-147
@@ -5,7 +5,7 @@ import { join } from "node:path";
|
||||
import type { ShellPermission } from "../external.ts";
|
||||
import type { ToolState } from "../toolState.ts";
|
||||
import { log } from "./cli.ts";
|
||||
import type { OctokitWithPlugins } from "./github.ts";
|
||||
import type { Gitea } from "./gitea.ts";
|
||||
import { isInsideDocker } from "./globals.ts";
|
||||
import { $ } from "./shell.ts";
|
||||
|
||||
@@ -13,41 +13,15 @@ export interface SetupOptions {
|
||||
tempDir: string;
|
||||
}
|
||||
|
||||
/**
|
||||
* Create a shared temp directory for the action
|
||||
*/
|
||||
export function createTempDirectory(): string {
|
||||
const sharedTempDir = mkdtempSync(join(tmpdir(), "pullfrog-"));
|
||||
const sharedTempDir = mkdtempSync(join(tmpdir(), "shockbot-"));
|
||||
process.env.SHOCKBOT_TEMP_DIR = sharedTempDir;
|
||||
// also set PULLFROG_TEMP_DIR for compatibility with files that haven't been updated
|
||||
process.env.PULLFROG_TEMP_DIR = sharedTempDir;
|
||||
log.info(`» created temp dir at ${sharedTempDir}`);
|
||||
return sharedTempDir;
|
||||
}
|
||||
|
||||
/**
|
||||
* snapshot-and-delete the GHA runner's known credential leak surfaces inside
|
||||
* `$RUNNER_TEMP` before the agent spawns. without this, a shell-capable agent
|
||||
* can grep:
|
||||
* - `_runner_file_commands/set_output_*` for `core.setOutput('token', ghs_…)`
|
||||
* calls made by earlier composite-action steps (e.g.
|
||||
* pullfrog/pullfrog/get-installation-token);
|
||||
* - `<uuid>.sh` rendered step scripts whose `run: |` body embeds
|
||||
* `${{ steps.token.outputs.token }}` literally (GHA expands BEFORE writing);
|
||||
* - `git-credentials-*.config` written by `actions/checkout@v6` for the
|
||||
* workflow GITHUB_TOKEN.
|
||||
*
|
||||
* the running bash process already has its own `.sh` open via fd, so the
|
||||
* unlink is safe — `unlink` removes the dirent, the kernel keeps reading.
|
||||
*
|
||||
* preserves every `_runner_file_commands/` file path the runner pre-allocated
|
||||
* for OUR step — `$GITHUB_OUTPUT`, `$GITHUB_ENV`, `$GITHUB_PATH`,
|
||||
* `$GITHUB_STATE`, `$GITHUB_STEP_SUMMARY`. those are read by the runner
|
||||
* AFTER we exit (or by our own `post:` hook), and wiping them would break
|
||||
* pullfrog's `result` output, `post:` state handoff, and job summary.
|
||||
*
|
||||
* silent no-op when `$RUNNER_TEMP` is unset (local dev, `pnpm play`).
|
||||
* per-file errors are tolerated — the runner may delete files between
|
||||
* our readdir and our unlink.
|
||||
*/
|
||||
export function wipeRunnerLeakSurface(): void {
|
||||
const runnerTemp = process.env.RUNNER_TEMP;
|
||||
if (!runnerTemp) return;
|
||||
@@ -65,7 +39,6 @@ export function wipeRunnerLeakSurface(): void {
|
||||
try {
|
||||
preserve.add(realpathSync(path));
|
||||
} catch {
|
||||
// path may not exist yet — preserve the literal in case it gets created later
|
||||
preserve.add(path);
|
||||
}
|
||||
}
|
||||
@@ -76,16 +49,12 @@ export function wipeRunnerLeakSurface(): void {
|
||||
let resolved = path;
|
||||
try {
|
||||
resolved = realpathSync(path);
|
||||
} catch {
|
||||
// file may already be gone — fall through to unlink for the race-tolerant path
|
||||
}
|
||||
} catch {}
|
||||
if (preserve.has(resolved) || preserve.has(path)) return;
|
||||
try {
|
||||
unlinkSync(path);
|
||||
wiped.push(path);
|
||||
} catch {
|
||||
// race-tolerant: file may have been deleted between readdir and unlink
|
||||
}
|
||||
} catch {}
|
||||
};
|
||||
|
||||
const listDir = (dir: string): string[] => {
|
||||
@@ -113,35 +82,6 @@ export function wipeRunnerLeakSurface(): void {
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Setup the test repository for running actions
|
||||
*/
|
||||
export function setupTestRepo(options: SetupOptions): void {
|
||||
const tempDir = options.tempDir;
|
||||
const repo = process.env.GITHUB_REPOSITORY;
|
||||
if (!repo) throw new Error("GITHUB_REPOSITORY is required");
|
||||
log.info(`» cloning ${repo} into ${tempDir}...`);
|
||||
|
||||
// use https with token in ci or when running inside docker
|
||||
if (process.env.CI || isInsideDocker) {
|
||||
const token = process.env.GITHUB_TOKEN ?? process.env.GH_TOKEN;
|
||||
if (!token) {
|
||||
throw new Error("GITHUB_TOKEN or GH_TOKEN is required for https clone in ci or docker");
|
||||
}
|
||||
$("git", ["clone", `https://x-access-token:${token}@github.com/${repo}.git`, tempDir]);
|
||||
} else {
|
||||
$("git", ["clone", `git@github.com:${repo}.git`, tempDir]);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* build an env suitable for targeting a specific git repo via `cwd`.
|
||||
*
|
||||
* inherited GIT_DIR / GIT_WORK_TREE / GIT_INDEX_FILE override cwd resolution,
|
||||
* which matters when this code runs as a child of `git push` (pre-push hook)
|
||||
* or inside another git subcommand. if we don't strip them, a call that
|
||||
* names `repoDir` in cwd silently operates on the outer repo instead.
|
||||
*/
|
||||
function envScopedToRepo(): NodeJS.ProcessEnv {
|
||||
const scoped = { ...process.env };
|
||||
for (const key of Object.keys(scoped)) {
|
||||
@@ -150,18 +90,6 @@ function envScopedToRepo(): NodeJS.ProcessEnv {
|
||||
return scoped;
|
||||
}
|
||||
|
||||
/**
|
||||
* remove any `[includeIf ...]` entries from the local git config so that
|
||||
* actions/checkout-persisted credentials don't ride alongside ASKPASS-provided
|
||||
* auth for subsequent git operations.
|
||||
*
|
||||
* SECURITY: git config subsection values can contain arbitrary characters
|
||||
* including `$(...)` command substitutions, and `${IFS}` spacing tricks defeat
|
||||
* naive split-on-space filtering. we read keys via the `-z` (null-terminated)
|
||||
* output format and feed them to a spawn-array `git config --unset-all` so
|
||||
* the shell never interpolates key contents — closing the RCE path that a
|
||||
* string-interpolated `execSync(...)` would expose.
|
||||
*/
|
||||
export function removeIncludeIfEntries(repoDir: string): void {
|
||||
const env = envScopedToRepo();
|
||||
let configOutput: string;
|
||||
@@ -179,16 +107,11 @@ export function removeIncludeIfEntries(repoDir: string): void {
|
||||
const seen = new Set<string>();
|
||||
for (const entry of configOutput.split("\0")) {
|
||||
if (!entry) continue;
|
||||
// -z format: each entry is "<key>\n<value>". the key is up to the first newline.
|
||||
const nl = entry.indexOf("\n");
|
||||
const key = nl === -1 ? entry : entry.slice(0, nl);
|
||||
if (!key || seen.has(key)) continue;
|
||||
seen.add(key);
|
||||
try {
|
||||
// execFileSync (not execSync) so the key — which can contain arbitrary
|
||||
// characters including shell metacharacters and $() command substitutions
|
||||
// — is passed as an argv element and never interpolated by a shell.
|
||||
// this is the load-bearing side of a9aa3b2b's injection fix.
|
||||
execFileSync("git", ["config", "--local", "--unset-all", key], {
|
||||
cwd: repoDir,
|
||||
stdio: "pipe",
|
||||
@@ -210,33 +133,19 @@ export interface GitContext {
|
||||
gitToken: string;
|
||||
owner: string;
|
||||
name: string;
|
||||
octokit: OctokitWithPlugins;
|
||||
gitea: Gitea;
|
||||
toolState: ToolState;
|
||||
// shell permission level — controls hook and security behavior:
|
||||
// enabled: full shell, hooks run, no restrictions
|
||||
// restricted: MCP shell in stripped env, hooks run, token protection on auth ops
|
||||
// disabled: no shell, hooks disabled globally, all code execution paths blocked
|
||||
shell: ShellPermission;
|
||||
postCheckoutScript: string | null;
|
||||
}
|
||||
|
||||
export type SetupGitParams = GitContext;
|
||||
|
||||
/**
|
||||
* setup git configuration and authentication for the repository.
|
||||
* - configures git identity (user.email, user.name)
|
||||
* - sets up authentication via gitToken (minimal contents:write)
|
||||
*
|
||||
* gitToken is a minimal-permission token (contents + workflows) used for git operations.
|
||||
* it is assumed to be potentially exfiltratable, so it has limited scope.
|
||||
*/
|
||||
export async function setupGit(params: SetupGitParams): Promise<void> {
|
||||
const repoDir = process.cwd();
|
||||
|
||||
// 1. configure git identity
|
||||
log.info("» setting up git configuration...");
|
||||
try {
|
||||
// check current config - only set defaults if not configured or using generic bot
|
||||
let currentEmail = "";
|
||||
try {
|
||||
currentEmail = execSync("git config user.email", {
|
||||
@@ -244,31 +153,27 @@ export async function setupGit(params: SetupGitParams): Promise<void> {
|
||||
stdio: "pipe",
|
||||
encoding: "utf-8",
|
||||
}).trim();
|
||||
} catch {
|
||||
// not configured
|
||||
}
|
||||
} catch {}
|
||||
|
||||
const shouldSetDefaults =
|
||||
!currentEmail || currentEmail === "github-actions[bot]@users.noreply.github.com";
|
||||
!currentEmail ||
|
||||
currentEmail.includes("github-actions") ||
|
||||
currentEmail.includes("pullfrog");
|
||||
|
||||
if (shouldSetDefaults) {
|
||||
execSync('git config --local user.email "226033991+pullfrog[bot]@users.noreply.github.com"', {
|
||||
execSync('git config --local user.email "shockbot@git.shockvpn.com"', {
|
||||
cwd: repoDir,
|
||||
stdio: "pipe",
|
||||
});
|
||||
execSync('git config --local user.name "pullfrog[bot]"', {
|
||||
execSync('git config --local user.name "shockbot"', {
|
||||
cwd: repoDir,
|
||||
stdio: "pipe",
|
||||
});
|
||||
log.debug("» git user configured (using defaults)");
|
||||
log.debug("» git user configured (shockbot defaults)");
|
||||
} else {
|
||||
log.debug(`» git user already configured (${currentEmail}), skipping`);
|
||||
}
|
||||
|
||||
// SECURITY: disable git hooks when shell is disabled to prevent code execution.
|
||||
// in restricted mode, hooks run in the stripped sandbox — that's fine.
|
||||
// in enabled mode, the agent has full shell anyway.
|
||||
// in disabled mode, hooks are the primary code-execution escape vector.
|
||||
if (params.shell === "disabled") {
|
||||
execSync("git config --local core.hooksPath /dev/null", {
|
||||
cwd: repoDir,
|
||||
@@ -277,59 +182,40 @@ export async function setupGit(params: SetupGitParams): Promise<void> {
|
||||
log.debug("» git hooks disabled (shell=disabled)");
|
||||
}
|
||||
} catch (error) {
|
||||
// If git config fails, log warning but don't fail the action
|
||||
// This can happen if we're not in a git repo or git isn't available
|
||||
log.info(`Failed to set git config: ${error instanceof Error ? error.message : String(error)}`);
|
||||
}
|
||||
|
||||
// 2. setup authentication
|
||||
// remove existing git auth headers that actions/checkout might have set
|
||||
try {
|
||||
execSync("git config --local --unset-all http.https://github.com/.extraheader", {
|
||||
cwd: repoDir,
|
||||
stdio: "pipe",
|
||||
});
|
||||
log.info("» removed existing authentication headers");
|
||||
} catch {
|
||||
log.debug("» no existing authentication headers to remove");
|
||||
// Remove credential helpers set by actions/checkout
|
||||
for (const header of [
|
||||
"http.https://github.com/.extraheader",
|
||||
"http.https://git.shockvpn.com/.extraheader",
|
||||
]) {
|
||||
try {
|
||||
execSync(`git config --local --unset-all ${header}`, {
|
||||
cwd: repoDir,
|
||||
stdio: "pipe",
|
||||
});
|
||||
log.info(`» removed existing authentication headers (${header})`);
|
||||
} catch {
|
||||
log.debug(`» no existing authentication headers to remove (${header})`);
|
||||
}
|
||||
}
|
||||
|
||||
// remove includeIf entries that actions/checkout@v6 uses for credential persistence.
|
||||
// v6 stores credentials in an external file loaded via includeIf.gitdir, which our
|
||||
// --unset-all above doesn't catch. without this, stale credentials from actions/checkout
|
||||
// would be sent alongside ASKPASS-provided credentials.
|
||||
removeIncludeIfEntries(repoDir);
|
||||
|
||||
// SECURITY: set origin URL without token - auth is injected via GIT_ASKPASS
|
||||
// in $git() calls. this prevents token leakage to git hooks and subprocesses.
|
||||
const originUrl = `https://github.com/${params.owner}/${params.name}.git`;
|
||||
const giteaUrl = (process.env.GITEA_URL ?? "https://git.shockvpn.com").replace(/\/$/, "");
|
||||
const originUrl = `${giteaUrl}/${params.owner}/${params.name}.git`;
|
||||
$("git", ["remote", "set-url", "origin", originUrl], { cwd: repoDir });
|
||||
|
||||
// initialize pushUrl to base repo - may be updated by checkout_pr for fork PRs
|
||||
params.toolState.pushUrl = originUrl;
|
||||
|
||||
// disable credential helpers to prevent prompts and ensure clean auth state
|
||||
$("git", ["config", "--local", "credential.helper", ""], { cwd: repoDir });
|
||||
|
||||
// pin the run-entry HEAD for the checkout_pr initial-branch invariant; see
|
||||
// captureInitialHead for the named-branch vs detached split and why it
|
||||
// matters (zed-industries/cloud 2026-05-18 cross-PR clobber shape).
|
||||
params.toolState.initialHead = captureInitialHead(repoDir);
|
||||
|
||||
log.info("» git authentication configured");
|
||||
}
|
||||
|
||||
/**
|
||||
* snapshot the current HEAD as either a branch name (when on a named branch)
|
||||
* or a literal SHA (when detached). used by setupGit to pin the run-entry
|
||||
* position and by checkout_pr to compare the live HEAD against it.
|
||||
*
|
||||
* splitting the two cases is load-bearing: `git rev-parse --abbrev-ref HEAD`
|
||||
* returns the sentinel string `"HEAD"` on detached entry — which is the
|
||||
* default `actions/checkout` state for `pull_request` events. storing that
|
||||
* raw string would make any future detached state (including a subagent's
|
||||
* `git checkout --detach <sha>`) compare equal.
|
||||
*/
|
||||
export function captureInitialHead(
|
||||
repoDir: string
|
||||
): { kind: "branch"; name: string } | { kind: "detached"; sha: string } {
|
||||
@@ -339,9 +225,7 @@ export function captureInitialHead(
|
||||
log: false,
|
||||
}).trim();
|
||||
if (name) return { kind: "branch", name };
|
||||
} catch {
|
||||
// detached HEAD — fall through
|
||||
}
|
||||
} catch {}
|
||||
const sha = $("git", ["rev-parse", "HEAD"], { cwd: repoDir, log: false }).trim();
|
||||
return { kind: "detached", sha };
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user