viyatb-oai
9f6879944e
## Summary - stop treating every `[bot]` actor as trusted when `allow-bots` is enabled - add `allow-bot-users` for explicit custom bot allowlists without wildcard support - document bot allowlist semantics and add CLI regression tests ## Test plan - `pnpm run check` - `pnpm test` - `git diff --check`
71 lines
2.3 KiB
JavaScript
71 lines
2.3 KiB
JavaScript
import assert from "node:assert/strict";
|
|
import { spawnSync } from "node:child_process";
|
|
import { test } from "node:test";
|
|
import { fileURLToPath } from "node:url";
|
|
|
|
const mainPath = fileURLToPath(new URL("../dist/main.js", import.meta.url));
|
|
|
|
function runCheckWriteAccess(actor, args = []) {
|
|
const env = {
|
|
...process.env,
|
|
GITHUB_ACTOR: actor,
|
|
GITHUB_REPOSITORY: "openai/codex-action",
|
|
};
|
|
delete env.GH_TOKEN;
|
|
delete env.GITHUB_TOKEN;
|
|
|
|
return spawnSync(process.execPath, [mainPath, "check-write-access", ...args], {
|
|
encoding: "utf8",
|
|
env,
|
|
});
|
|
}
|
|
|
|
test("does not trust arbitrary bot actor suffixes", () => {
|
|
const result = runCheckWriteAccess("openai-internal[bot]", ["--allow-bots", "true"]);
|
|
|
|
assert.notEqual(result.status, 0);
|
|
assert.match(result.stderr, /A GitHub token is required/);
|
|
});
|
|
|
|
test("allows trusted GitHub bot actors when enabled", () => {
|
|
const result = runCheckWriteAccess("dependabot[bot]", ["--allow-bots", "true"]);
|
|
|
|
assert.equal(result.status, 0, result.stderr);
|
|
assert.match(result.stdout, /permitted to continue/);
|
|
});
|
|
|
|
test("requires explicit opt-in for trusted GitHub bot actors", () => {
|
|
const result = runCheckWriteAccess("dependabot[bot]");
|
|
|
|
assert.notEqual(result.status, 0);
|
|
assert.match(result.stderr, /A GitHub token is required/);
|
|
});
|
|
|
|
test("allows custom bot actors when explicitly listed", () => {
|
|
const result = runCheckWriteAccess("renovate[bot]", ["--allow-bot-users", "renovate"]);
|
|
|
|
assert.equal(result.status, 0, result.stderr);
|
|
assert.match(result.stdout, /permitted to continue/);
|
|
});
|
|
|
|
test("does not allow unlisted custom bot actors", () => {
|
|
const result = runCheckWriteAccess("openai-internal[bot]", ["--allow-bot-users", "renovate"]);
|
|
|
|
assert.notEqual(result.status, 0);
|
|
assert.match(result.stderr, /A GitHub token is required/);
|
|
});
|
|
|
|
test("does not apply custom bot allowlists to human actors", () => {
|
|
const result = runCheckWriteAccess("renovate", ["--allow-bot-users", "renovate"]);
|
|
|
|
assert.notEqual(result.status, 0);
|
|
assert.match(result.stderr, /A GitHub token is required/);
|
|
});
|
|
|
|
test("rejects wildcard custom bot allowlists", () => {
|
|
const result = runCheckWriteAccess("openai-internal[bot]", ["--allow-bot-users", "*"]);
|
|
|
|
assert.notEqual(result.status, 0);
|
|
assert.match(result.stderr, /allow-bot-users does not support '\*'/);
|
|
});
|