fix: verify deployed runtime version #50

agent · 2026-09-15T14:54:30Z

agent commented

2026-09-15 14:54:30 +00:00

Усиливает production deploy: проверяет версию в release-архиве и фактическую версию запущенного API, чтобы upload без применения контейнеров не считался успешным. Версия поднята до 0.8.10. Проверки: git diff --check, node --check.

agent added 1 commit 2026-09-15 14:54:31 +00:00

fix: verify deployed runtime version

CI / deploy (pull_request) Has been cancelled

Details

CI / test (pull_request) Has been cancelled

Details

711c6ae7b0

agent commented

2026-09-15 14:56:36 +00:00

Independent review of PR #50 at head 711c6ae.

Blocking finding:

.gitea/workflows/ci.yml:74 — EXPECTED_BACKEND_VERSION is interpolated into a single-quoted remote shell command without escaping. A value containing a single quote or shell metacharacters (the version is derived from app/version.py and written to GITHUB_OUTPUT) can break the remote command and allow command injection during production deploy. Pass the value via stdin/environment using safe serialization, or validate it against a strict SemVer pattern before interpolation.

Checked: complete current diff; Gitea Actions job structure, conditions, and step output wiring; archive version extraction; runtime import and health verification; SSH known-hosts, batch mode, and secret handling; Docker backup/deploy flow; version files, changelog, and test update. YAML parse, bash syntax, node --check, and git diff --check pass. pytest could not run locally because pytest is not installed; Gitea Actions status is still pending.

Verdict: CHANGES REQUESTED — 1 blocking security/correctness finding.

Independent review of PR #50 at head 711c6ae. Blocking finding: - .gitea/workflows/ci.yml:74 — EXPECTED_BACKEND_VERSION is interpolated into a single-quoted remote shell command without escaping. A value containing a single quote or shell metacharacters (the version is derived from app/version.py and written to GITHUB_OUTPUT) can break the remote command and allow command injection during production deploy. Pass the value via stdin/environment using safe serialization, or validate it against a strict SemVer pattern before interpolation. Checked: complete current diff; Gitea Actions job structure, conditions, and step output wiring; archive version extraction; runtime import and health verification; SSH known-hosts, batch mode, and secret handling; Docker backup/deploy flow; version files, changelog, and test update. YAML parse, bash syntax, node --check, and git diff --check pass. pytest could not run locally because pytest is not installed; Gitea Actions status is still pending. Verdict: CHANGES REQUESTED — 1 blocking security/correctness finding.

agent added 1 commit 2026-09-15 14:58:08 +00:00

fix: bust admin stylesheet cache

CI / test (pull_request) Has been cancelled

Details

CI / deploy (pull_request) Has been cancelled

Details

8102556862

agent commented

2026-09-15 14:58:52 +00:00

Independent re-review of PR #50 at head 8102556.

Blocking finding remains:

.gitea/workflows/ci.yml:74 — EXPECTED_BACKEND_VERSION is still interpolated into a single-quoted remote shell command without escaping. A version value containing a single quote or shell metacharacters can break the remote command and enable command injection during production deploy. Pass it through a safely serialized stdin/environment channel, or validate it against strict SemVer before interpolation.

The new CSS cache-busting change is correct: frontend_version is supplied by the shared _render helper, so both base.html and login.html receive the query parameter. Full diff checked: archive/runtime/health verification, Gitea Actions wiring, SSH settings, Docker flow, security, tests, versions, and changelog. git diff --check and node --check pass; Actions for this head are still pending.

Verdict: CHANGES REQUESTED — previous shell-quoting blocker is not resolved.

Independent re-review of PR #50 at head 8102556. Blocking finding remains: - .gitea/workflows/ci.yml:74 — EXPECTED_BACKEND_VERSION is still interpolated into a single-quoted remote shell command without escaping. A version value containing a single quote or shell metacharacters can break the remote command and enable command injection during production deploy. Pass it through a safely serialized stdin/environment channel, or validate it against strict SemVer before interpolation. The new CSS cache-busting change is correct: frontend_version is supplied by the shared _render helper, so both base.html and login.html receive the query parameter. Full diff checked: archive/runtime/health verification, Gitea Actions wiring, SSH settings, Docker flow, security, tests, versions, and changelog. git diff --check and node --check pass; Actions for this head are still pending. Verdict: CHANGES REQUESTED — previous shell-quoting blocker is not resolved.

agent added 1 commit 2026-09-15 14:59:29 +00:00

fix: validate deploy version input

CI / test (pull_request) Successful in 9m11s

Details

CI / deploy (pull_request) Has been skipped

Details

144e62a35e

agent commented

2026-09-15 14:59:58 +00:00

Independent re-review of PR #50 at head 144e62a.

No blocking findings.

Previous shell-quoting blocker is resolved: backend_version is rejected unless it contains only digits and dots before being interpolated into the remote SSH command, so shell metacharacters and quotes cannot reach that command. Archive, runtime, and health version checks remain wired correctly.

Cache-busting CSS is correct in both base.html and login.html; frontend_version is supplied by the shared _render helper. Full current diff, Actions YAML/conditions/output wiring, SSH and Docker flow, security, tests, versions, and changelog checked. git diff --check and node --check pass.

Verdict: APPROVE — no blocking findings.

Independent re-review of PR #50 at head 144e62a. No blocking findings. Previous shell-quoting blocker is resolved: backend_version is rejected unless it contains only digits and dots before being interpolated into the remote SSH command, so shell metacharacters and quotes cannot reach that command. Archive, runtime, and health version checks remain wired correctly. Cache-busting CSS is correct in both base.html and login.html; frontend_version is supplied by the shared _render helper. Full current diff, Actions YAML/conditions/output wiring, SSH and Docker flow, security, tests, versions, and changelog checked. git diff --check and node --check pass. Verdict: APPROVE — no blocking findings.

admin merged commit 5c3883beca into main

2026-09-15 15:13:56 +00:00

admin referenced this issue from a commit

2026-09-15 15:13:56 +00:00

Merge pull request 'fix: verify deployed runtime version' (#50) from fix/verify-production-release into main

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: admin/miem_workers#50