Усиливает production deploy: проверяет версию в release-архиве и фактическую версию запущенного API, чтобы upload без применения контейнеров не считался успешным. Версия поднята до 0.8.10. Проверки: git diff --check, node --check.
Усиливает production deploy: проверяет версию в release-архиве и фактическую версию запущенного API, чтобы upload без применения контейнеров не считался успешным. Версия поднята до 0.8.10. Проверки: git diff --check, node --check.
.gitea/workflows/ci.yml:74 — EXPECTED_BACKEND_VERSION is interpolated into a single-quoted remote shell command without escaping. A value containing a single quote or shell metacharacters (the version is derived from app/version.py and written to GITHUB_OUTPUT) can break the remote command and allow command injection during production deploy. Pass the value via stdin/environment using safe serialization, or validate it against a strict SemVer pattern before interpolation.
Checked: complete current diff; Gitea Actions job structure, conditions, and step output wiring; archive version extraction; runtime import and health verification; SSH known-hosts, batch mode, and secret handling; Docker backup/deploy flow; version files, changelog, and test update. YAML parse, bash syntax, node --check, and git diff --check pass. pytest could not run locally because pytest is not installed; Gitea Actions status is still pending.
Independent review of PR #50 at head 711c6ae.
Blocking finding:
- .gitea/workflows/ci.yml:74 — EXPECTED_BACKEND_VERSION is interpolated into a single-quoted remote shell command without escaping. A value containing a single quote or shell metacharacters (the version is derived from app/version.py and written to GITHUB_OUTPUT) can break the remote command and allow command injection during production deploy. Pass the value via stdin/environment using safe serialization, or validate it against a strict SemVer pattern before interpolation.
Checked: complete current diff; Gitea Actions job structure, conditions, and step output wiring; archive version extraction; runtime import and health verification; SSH known-hosts, batch mode, and secret handling; Docker backup/deploy flow; version files, changelog, and test update. YAML parse, bash syntax, node --check, and git diff --check pass. pytest could not run locally because pytest is not installed; Gitea Actions status is still pending.
Verdict: CHANGES REQUESTED — 1 blocking security/correctness finding.
.gitea/workflows/ci.yml:74 — EXPECTED_BACKEND_VERSION is still interpolated into a single-quoted remote shell command without escaping. A version value containing a single quote or shell metacharacters can break the remote command and enable command injection during production deploy. Pass it through a safely serialized stdin/environment channel, or validate it against strict SemVer before interpolation.
The new CSS cache-busting change is correct: frontend_version is supplied by the shared _render helper, so both base.html and login.html receive the query parameter. Full diff checked: archive/runtime/health verification, Gitea Actions wiring, SSH settings, Docker flow, security, tests, versions, and changelog. git diff --check and node --check pass; Actions for this head are still pending.
Verdict: CHANGES REQUESTED — previous shell-quoting blocker is not resolved.
Independent re-review of PR #50 at head 8102556.
Blocking finding remains:
- .gitea/workflows/ci.yml:74 — EXPECTED_BACKEND_VERSION is still interpolated into a single-quoted remote shell command without escaping. A version value containing a single quote or shell metacharacters can break the remote command and enable command injection during production deploy. Pass it through a safely serialized stdin/environment channel, or validate it against strict SemVer before interpolation.
The new CSS cache-busting change is correct: frontend_version is supplied by the shared _render helper, so both base.html and login.html receive the query parameter. Full diff checked: archive/runtime/health verification, Gitea Actions wiring, SSH settings, Docker flow, security, tests, versions, and changelog. git diff --check and node --check pass; Actions for this head are still pending.
Verdict: CHANGES REQUESTED — previous shell-quoting blocker is not resolved.
Previous shell-quoting blocker is resolved: backend_version is rejected unless it contains only digits and dots before being interpolated into the remote SSH command, so shell metacharacters and quotes cannot reach that command. Archive, runtime, and health version checks remain wired correctly.
Cache-busting CSS is correct in both base.html and login.html; frontend_version is supplied by the shared _render helper. Full current diff, Actions YAML/conditions/output wiring, SSH and Docker flow, security, tests, versions, and changelog checked. git diff --check and node --check pass.
Verdict: APPROVE — no blocking findings.
Independent re-review of PR #50 at head 144e62a.
No blocking findings.
Previous shell-quoting blocker is resolved: backend_version is rejected unless it contains only digits and dots before being interpolated into the remote SSH command, so shell metacharacters and quotes cannot reach that command. Archive, runtime, and health version checks remain wired correctly.
Cache-busting CSS is correct in both base.html and login.html; frontend_version is supplied by the shared _render helper. Full current diff, Actions YAML/conditions/output wiring, SSH and Docker flow, security, tests, versions, and changelog checked. git diff --check and node --check pass.
Verdict: APPROVE — no blocking findings.
admin
merged commit 5c3883beca into main2026-09-15 15:13:56 +00:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Усиливает production deploy: проверяет версию в release-архиве и фактическую версию запущенного API, чтобы upload без применения контейнеров не считался успешным. Версия поднята до 0.8.10. Проверки: git diff --check, node --check.
Independent review of PR #50 at head
711c6ae.Blocking finding:
Checked: complete current diff; Gitea Actions job structure, conditions, and step output wiring; archive version extraction; runtime import and health verification; SSH known-hosts, batch mode, and secret handling; Docker backup/deploy flow; version files, changelog, and test update. YAML parse, bash syntax, node --check, and git diff --check pass. pytest could not run locally because pytest is not installed; Gitea Actions status is still pending.
Verdict: CHANGES REQUESTED — 1 blocking security/correctness finding.
Independent re-review of PR #50 at head
8102556.Blocking finding remains:
The new CSS cache-busting change is correct: frontend_version is supplied by the shared _render helper, so both base.html and login.html receive the query parameter. Full diff checked: archive/runtime/health verification, Gitea Actions wiring, SSH settings, Docker flow, security, tests, versions, and changelog. git diff --check and node --check pass; Actions for this head are still pending.
Verdict: CHANGES REQUESTED — previous shell-quoting blocker is not resolved.
Independent re-review of PR #50 at head
144e62a.No blocking findings.
Previous shell-quoting blocker is resolved: backend_version is rejected unless it contains only digits and dots before being interpolated into the remote SSH command, so shell metacharacters and quotes cannot reach that command. Archive, runtime, and health version checks remain wired correctly.
Cache-busting CSS is correct in both base.html and login.html; frontend_version is supplied by the shared _render helper. Full current diff, Actions YAML/conditions/output wiring, SSH and Docker flow, security, tests, versions, and changelog checked. git diff --check and node --check pass.
Verdict: APPROVE — no blocking findings.