Add tested public-source release safety gate - #60
Conversation
Replace the inline worktree regex scan with a deterministic HEAD-and-index gate, fixture its source, history, workflow, encoding, LFS, redaction, and GitHub-control boundaries, and add the thin managed skill plus package documentation and MIT provenance.
|
@codex review |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 614d49404b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3b4e91e2af
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 698e5835ef
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a32a2ac88d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4a43c631cc
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 1f1595d4c8
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d4eb99aad5
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 85a85d422d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e630a33096
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 32aa3a5129
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Recursively inspect shell substitutions for tainted evaluators, recognize parameter-expansion taint and workflow-run display titles, treat interpreter preload modules as artifact execution sources, and reject tainted Git SSH command templates at remote operations. Add focused regression coverage while preserving safe controls.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c066120e0a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Handle nested legacy substitutions, Git SSH configuration sinks, runtime stdin and awk evaluation, static Node preload options, makefile artifact sources, tainted archive extraction, and aliases of GitHub environment files. Add focused regressions and a matching GITHUB_ENV alias guard.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3462dfd23b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Track ordered shell reassignment and positional taint, static evaluator aliases, env-prefixed Git and Node loaders, runtime option operands, heredoc programs, AWK and sed sources, cumulative make directories, tar aliases, current-run artifact reuploads, and BuildKit RUN mount images. Add focused unsafe fixtures and safe overwrite coverage.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 770e76dc41
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0134749784
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 848d5e2afb
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 244dc81135
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 015ac945ab
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: bfff6cd53c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
|
Closing unmerged at this checkpoint. The existing protections on main remain the accepted safety baseline. This branch is being retained as research material; any follow-up should be a deliberately narrower release-audit change focused on a thin checklist, high-confidence current-source scanning, and direct verification of native GitHub controls, with full-history investigation kept separate. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a22a84341e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| const redirections = [...stage.matchAll( | ||
| /(?:^|\s)(\d*)(>>?|>\|)\s*("[^"]*"|'[^']*'|[^\s;&|]+)/gu, | ||
| )]; |
There was a problem hiding this comment.
Fresh evidence beyond the resolved stdout-redirection case is an issue_comment step using printf '%s' "$CODE" | tee generated.sh >/dev/null; bash generated.sh, where CODE comes from the public comment: the exact workflow executes attacker-controlled script text but passes the audit with zero findings because this function only records shell redirections. The installed tee --help states that it copies standard input to each FILE, so tee destinations receiving tainted pipeline input must also update localTaintedScriptPaths.
Useful? React with 👍 / 👎.
| if (!["cp", "gcp", "install", "mv", "rsync"].includes(command)) { | ||
| return undefined; | ||
| } |
There was a problem hiding this comment.
Fresh evidence beyond the resolved copy-and-move case is a privileged workflow_run step using ln -s payload/run.sh trusted-name.sh; bash trusted-name.sh after downloading an untrusted artifact to payload; the exact workflow receives no blocking artifact-execution finding because ln is excluded from the transfer commands. The installed ln --help documents TARGET LINK_NAME and says symbolic links are resolved relative to their parent, so link destinations targeting known artifact paths must inherit their provenance.
Useful? React with 👍 / 👎.
| if (commandName === "bash" && commandEnvironmentValues.get("bash_env")) { | ||
| executionSources.push(commandEnvironmentValues.get("bash_env")); | ||
| } |
There was a problem hiding this comment.
Fresh evidence beyond the resolved BASH_ENV startup-file case is a privileged workflow_run step with PYTHONPATH: payload and run: python3 -c 'print("fixed")' after downloading an artifact containing payload/sitecustomize.py; Python executes that module before the fixed command, but the exact workflow produces no blocking finding. Installed python3 --help-env says PYTHONPATH is prefixed to the module search path, while python3 -h confirms that site is imported on initialization unless -S is supplied; inspect artifact-backed Python search paths whenever an affected interpreter is launched.
Useful? React with 👍 / 👎.
| ))); | ||
| taintedVariables.caseSensitive = variablesAreCaseSensitive; | ||
| const anyEnvironmentVariableTainted = taintedBindings.has("env.*"); | ||
| const evaluatorCommand = /^\s*(?:(?:builtin|command|exec)\s+)?(?:(?:\/usr\/bin\/)?env\s+(?:(?:-[^\s]+|[A-Za-z_][A-Za-z0-9_]*=[^\s]+)\s+)*)?(?:eval\b|(?:(?:\/[^/\s]+)*\/)?(?:bash|dash|fish|ksh|sh|zsh)\b[^;&|]*\s-c(?:\s+|(?=[^-\s])|$)|(?:(?:\/[^/\s]+)*\/)?node\b[^;&|]*\s(?:-e|--eval|-p|--print)(?:\s+|(?=[^-\s])|$)|(?:(?:\/[^/\s]+)*\/)?(?:perl|python(?:\d+(?:\.\d+)*)?|ruby)\b[^;&|]*\s-(?:c|e)(?:\s+|(?=[^-\s])|$)|(?:(?:\/[^/\s]+)*\/)?php\b[^;&|]*\s-r(?:\s+|(?=[^-\s])|$)|(?:(?:\/[^/\s]+)*\/)?deno\b[^;&|]*\beval(?:\s|$)|(?:iex|invoke-expression)\b|(?:(?:\/[^/\s]+)*\/)?(?:powershell|pwsh)(?:\.exe)?\b[^;&|]*\s-(?:command|c)(?:\s+|(?=[^-\s])|$))/iu; |
There was a problem hiding this comment.
Fresh evidence beyond the resolved read and printf -v cases is mapfile -C "$CODE" -c 1 <<< fixed in a privileged issue_comment workflow, with CODE derived from the comment: Bash evaluates the callback immediately, yet the exact workflow passes with zero findings because mapfile is absent from this evaluator matcher. Bash's installed help mapfile explicitly describes -C callback as evaluating the callback, so tainted callback operands must be treated as executable program input.
Useful? React with 👍 / 👎.
| if (commandName === "npm") { | ||
| return npmPackageExecutionSources(words.slice(cursor)); | ||
| } | ||
| if (/^pip\d*(?:\.\d+)*$/u.test(commandName)) { | ||
| return pipLocalProjectExecutionSources(words.slice(cursor)); |
There was a problem hiding this comment.
Fresh evidence beyond the resolved pip-project case is a privileged workflow_run step running cargo build --manifest-path payload/Cargo.toml after downloading an untrusted artifact to payload; Cargo executes an artifact-controlled build.rs on the runner, but the exact workflow passes with zero findings because this dispatcher recognizes npm and pip package projects but not Cargo. Installed cargo build --help describes the command as compiling a local package and documents --manifest-path <PATH> as selecting its Cargo.toml, and a local invocation confirmed that the selected package's build script runs; classify the manifest path or effective package directory as an execution source.
Useful? React with 👍 / 👎.
| if (!["node", "perl", "php", "ruby"].includes(commandName) | ||
| && !/^python\d*(?:\.\d+)*$/u.test(commandName)) return false; |
There was a problem hiding this comment.
Fresh evidence beyond the resolved shell-interpreter stdin cases is printf '%s' "$CODE" | make -f - in a privileged issue_comment workflow, where the comment supplies a Makefile recipe: GNU Make executes the recipe, but the exact workflow passes with zero findings because this stdin-program classifier excludes make. Installed make --help says -f FILE reads FILE as a makefile, and - selects the piped standard input; recognize make -f - and equivalent --file forms as executable stdin consumers.
Useful? React with 👍 / 👎.
| if (["builtin", "command", "exec", "nohup", "time"].includes(command)) { | ||
| cursor += 1; | ||
| while (words[cursor]?.startsWith("-")) cursor += 1; | ||
| continue; |
There was a problem hiding this comment.
In a privileged issue_comment workflow, nice -n 5 bash -c "$CODE" executes comment-derived shell text, but the exact workflow passes with zero findings because this wrapper cursor leaves nice as the apparent command and the evaluator matcher never reaches Bash. Installed nice --help defines the command as nice [OPTION] [COMMAND [ARG]...] and says it runs COMMAND; consume its adjustment option and recursively classify the wrapped command just as this function already does for timeout, nohup, and time.
Useful? React with 👍 / 👎.
| } | ||
|
|
||
| function artifactSourceMatchesPath(source, artifactPath, workingDirectory = ".") { | ||
| const normalized = source.replace(/^["']|["']$/gu, "").replace(/^\.\//u, ""); |
There was a problem hiding this comment.
On the inspected windows-latest workflow, downloading an untrusted workflow_run artifact to payload and then running pwsh -File payload\run.ps1 executes the artifact, but the exact workflow passes with zero findings. The interpreter analysis does recover payload\run.ps1; this matcher then normalizes only POSIX separators, so it never recognizes the Windows path as a descendant of the known payload artifact directory. Normalize backslashes or compare using runner-appropriate path semantics before testing provenance.
Useful? React with 👍 / 👎.
1 participant
Summary
public-source-release-auditskill backed by a deterministic, dependency-free gatescripts/verify.shwith the new gate and 16 fixture-backed acceptance casesVerification
python3 .../quick_validate.py public-source-release-audit./scripts/verify.shnode public-source-release-audit/scripts/public-source-release-audit.mjs --repo . --github fiveonecode/agent-skills --required-check verifyBoundaries
workflow-mutable-action-refadvisory for tagged action references