mirror of
https://github.com/QwenLM/qwen-code.git
synced 2026-08-31 02:06:21 +00:00
19a4b973eb
* fix(ci): back-port the checkout-heal wipe guard to the triage and serve-ab wipes The "empty the workspace, keep the directory" idiom exists in three copies; only the review workflow's copy received the #9220 hardening (canonicalization, trailing-slash strip, RUNNER_WORKSPACE allowlist). Measured on main for #9265, the two triage guards let non-canonical spellings of the guarded roots through (/home/, /home/., //usr, /root/, /var/ all reached the rm), and serve-ab's wipe had no guard at all — even `/home` or an empty string arrived at `find … -exec rm -rf`. Port the reference guard to all three sites, keeping each site's exit contract: triage fails loud both before and after external code, serve-ab stays bare under the job's `-eo pipefail` so an unclearable workspace fails before either checkout builds on top of the leftovers. Pin each ported copy with its own tests: bad-path batteries under an rm recorder (the destructive primitive cannot fire under any edit), an allowlist-escaping `..` case gated on a GNU-realpath host probe (the lesson from 90fa6bb4), a realpath-absent trailing-slash RUNNER_WORKSPACE case, and text pins on the ported layers. Every pin was mutation-verified red against a deletion of the layer it guards. * test(ci): pin guarded serve wipe * fix(ci): close wipe guard fallback gaps * fix(ci): fail closed without realpath * fix(ci): keep wipe guards portable * test(ci): pin wipe-guard RWS layers and unmask the pre-run battery - run the rewritten pre-run sweep battery under -e -o pipefail so a failing sweep can no longer report success (bare bash -c masked it) - pin the RWS '..' refusal and degenerate-root refusal text in all copies, and add RUNNER_WORKSPACE='/' exec cases to both copy suites - exercise both pre-run and post-run copies in the realpath-absent refusal test - replace the '..' escape vector with a symlink escape that only the realpath line can refuse, and correct the mutant-outcome comments - add the serve-ab wipe-before-checkouts ordering pin from the sister suite and a happy-path RWS canonicalization pin * test(ci): correct wipe-guard mutant-outcome comments for find -P The symlink-escape comments claimed that with the WS realpath line deleted, find reaches rm through the link target. GNU find's default -P mode does not descend symlink operands: the mutant passes every guard, wipes nothing, and exits 0, so only the non-zero-status assertion catches it — the rm-log assertion passes vacuously. Reword both twin comments (R5-1). --------- Co-authored-by: yiliang114 <yiliang114@users.noreply.github.com> |
||
|---|---|---|
| .. | ||
| ci | ||
| dsw-swe-verified | ||
| assign-issue-owner.mjs | ||
| assign-issue-owner.test.mjs | ||
| auto-minimize-spam.test.mjs | ||
| cap-release-notes.mjs | ||
| cap-release-notes.test.mjs | ||
| check-autofix-contracts.sh | ||
| check-settings-schema.sh | ||
| ci-flaky-rerun.mjs | ||
| ci-runner-routing.test.mjs | ||
| classify-release-notes.mjs | ||
| classify-release-notes.test.mjs | ||
| create-desktop-update-manifest.mjs | ||
| create-electron-bridge-manifest.mjs | ||
| pr-safety-precheck.mjs | ||
| pr-safety-precheck.test.mjs | ||
| qwen-triage-workflow.test.mjs | ||
| resanitize-git-config.sh | ||
| resolve-owning-packages.sh | ||
| resolve-sandbox-image.mjs | ||
| resolve-sandbox-image.test.mjs | ||
| run-autofix-review-verification.sh | ||
| serve-ab-diff.mjs | ||
| serve-ab-diff.test.mjs | ||
| serve-ab-drive.mjs | ||
| upsert-bot-comment.sh | ||
| upsert-bot-comment.test.mjs | ||
| upsert-deferred-issue.sh | ||
| web-shell-visuals-compose.mjs | ||
| web-shell-visuals-compose.test.mjs | ||
| web-shell-visuals-publish.mjs | ||
| web-shell-visuals-publish.test.mjs | ||