garrytan-gstack

mirror of https://github.com/garrytan/gstack.git synced 2026-07-03 15:22:30 +08:00

Files

Garry Tan d53ee9f9e4 fix(ci): pr-title-sync covers fork PRs via hardened pull_request_target

Under plain pull_request the GITHUB_TOKEN is read-only on fork PRs, so the
title-sync backstop could never edit a fork/agent PR title. Switch to
pull_request_target (write token in base context) and make it safe:

- Check out the base repo only (no ref:) — execute trusted infra, never
  fork-head code.
- All attacker-controlled PR fields (title, head repo, head sha) pass via
  env: and are referenced as shell-quoted "$VAR", never inlined into run:.
- Read the PR-head VERSION as data (raw media type) from the head repo at the
  head sha; guard the assignment under set -e.
- Same-repo read failure fails loudly; fork miss warns and skips (the backstop
  stays green without going silently optional).
- Never echo the raw fork title (Actions parses ::workflow-command:: from stdout).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-07 19:27:50 -07:00

actionlint.yml

v1.38.0.0 fix wave: Windows install hardening + Unicode sanitization at server egress (4 community PRs) (#1505 )

2026-05-14 21:19:58 -07:00

ci-image.yml

v1.38.0.0 fix wave: Windows install hardening + Unicode sanitization at server egress (4 community PRs) (#1505 )

2026-05-14 21:19:58 -07:00

evals-periodic.yml

v1.38.0.0 fix wave: Windows install hardening + Unicode sanitization at server egress (4 community PRs) (#1505 )

2026-05-14 21:19:58 -07:00

evals.yml

v1.56.1.0 fix(sync): staging-dir ownership guard + resume-correctness fixes (#1802 ) (#1856 )