nanakura/moeka-project
1
0
Fork 0
Code Issues Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

fix(*): harden local service boundaries (#2062)

Browse Source
This commit is contained in:
0xSelenicDove
2026-07-17 17:50:50 +08:00
committed by GitHub
parent f453a967f1
commit 8893ba81a6
31 changed files with 248 additions and 124 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/deploy-cloudflare-workers-preview-deploy.yml
+38 -12
View File
@@ -33,12 +33,25 @@ jobs:
- name: Parse metadata
id: meta
run: |
source preview-meta/preview_meta
echo "PR_NUM=$PR_NUM" >> "$GITHUB_OUTPUT"
echo "REPO_FULL_NAME=$REPO_FULL_NAME" >> "$GITHUB_OUTPUT"
echo "HEAD_REF=$HEAD_REF" >> "$GITHUB_OUTPUT"
echo "HEAD_SHA=$HEAD_SHA" >> "$GITHUB_OUTPUT"
echo "BRANCH_NAME=$HEAD_REF" >> "$GITHUB_ENV"
node --input-type=module <<'NODE'
import { appendFile, readFile } from 'node:fs/promises'
const metadata = JSON.parse(await readFile('preview-meta/preview-meta.json', 'utf8'))
if (
!/^\d+$/.test(metadata.prNumber)
|| !/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(metadata.repositoryFullName)
|| !/^[a-f0-9]{40}$/i.test(metadata.headSha)
) {
throw new Error('Preview metadata has an invalid shape')
}
await appendFile(process.env.GITHUB_OUTPUT, [
`PR_NUM=${metadata.prNumber}`,
`REPO_FULL_NAME=${metadata.repositoryFullName}`,
`HEAD_SHA=${metadata.headSha}`,
'',
].join('\n'))
NODE
- name: Find Comment
if: ${{ always() }}
@@ -103,12 +116,25 @@ jobs:
- name: Parse metadata
id: meta
run: |
source preview-meta/preview_meta
echo "PR_NUM=$PR_NUM" >> "$GITHUB_OUTPUT"
echo "REPO_FULL_NAME=$REPO_FULL_NAME" >> "$GITHUB_OUTPUT"
echo "HEAD_REF=$HEAD_REF" >> "$GITHUB_OUTPUT"
echo "HEAD_SHA=$HEAD_SHA" >> "$GITHUB_OUTPUT"
echo "BRANCH_NAME=$HEAD_REF" >> "$GITHUB_ENV"
node --input-type=module <<'NODE'
import { appendFile, readFile } from 'node:fs/promises'
const metadata = JSON.parse(await readFile('preview-meta/preview-meta.json', 'utf8'))
if (
!/^\d+$/.test(metadata.prNumber)
|| !/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(metadata.repositoryFullName)
|| !/^[a-f0-9]{40}$/i.test(metadata.headSha)
) {
throw new Error('Preview metadata has an invalid shape')
}
await appendFile(process.env.GITHUB_OUTPUT, [
`PR_NUM=${metadata.prNumber}`,
`REPO_FULL_NAME=${metadata.repositoryFullName}`,
`HEAD_SHA=${metadata.headSha}`,
'',
].join('\n'))
NODE
- name: Checkout repository
uses: actions/checkout@v6
.github/workflows/deploy-cloudflare-workers-preview-prepare.yml
+14 -7
View File
@@ -14,17 +14,24 @@ jobs:
steps:
- name: Persist checkout metadata
env:
PR_NUM: ${{ github.event.number }}
REPO_FULL_NAME: ${{ github.event.pull_request.head.repo.full_name }}
HEAD_SHA: ${{ github.event.pull_request.head.sha }}
run: |
cat <<EOF > preview_meta
PR_NUM=${{ github.event.number }}
REPO_FULL_NAME=${{ github.event.pull_request.head.repo.full_name }}
HEAD_REF=${{ github.event.pull_request.head.ref }}
HEAD_SHA=${{ github.event.pull_request.head.sha }}
EOF
node --input-type=module <<'NODE'
import { writeFile } from 'node:fs/promises'
await writeFile('preview-meta.json', JSON.stringify({
prNumber: process.env.PR_NUM,
repositoryFullName: process.env.REPO_FULL_NAME,
headSha: process.env.HEAD_SHA,
}))
NODE
- name: Upload metadata artifact
uses: actions/upload-artifact@v7
with:
name: preview-meta
path: ./preview_meta
path: ./preview-meta.json
overwrite: true
.github/workflows/release-docker.yaml
+1 -1
View File
@@ -20,7 +20,7 @@ jobs:
# failed to build archive at `/home/runner/work/airi/airi/target/x86_64-unknown-linux-gnu/release/deps/libapp_lib.rlib`:
# No space left on device (os error 28)
- name: Free Disk Space
uses: jlumbroso/free-disk-space@main
uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # v1.3.1
- uses: actions/checkout@v6
.github/workflows/release-tamagotchi.yml
+1 -1
View File
@@ -103,7 +103,7 @@ jobs:
# No space left on device (os error 28)
- name: Free Disk Space
if: matrix.os == 'ubuntu-latest' || matrix.os == 'ubuntu-24.04-arm'
uses: jlumbroso/free-disk-space@main
uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # v1.3.1
- uses: actions/checkout@v6
.github/workflows/update-nix-assets-hash.yaml
+1 -1
View File
@@ -25,7 +25,7 @@ jobs:
# > airi-pnpm-deps> Running phase: fixupPhase
# > error: writing to file: No space left on device
- name: Free Disk Space
uses: jlumbroso/free-disk-space@main
uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # v1.3.1
- uses: actions/checkout@v6
with:
.github/workflows/update-nix-pnpm-deps-hash.yaml
+1 -1
View File
@@ -24,7 +24,7 @@ jobs:
# > airi-pnpm-deps> Running phase: fixupPhase
# > error: writing to file: No space left on device
- name: Free Disk Space
uses: jlumbroso/free-disk-space@main
uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # v1.3.1
- uses: actions/checkout@v6
with: