Skip to content

[audit] Flag printf with escaped newlines in prefer-write-over-heredoc #638

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
fixedbydev wants to merge 1 commit into
base: main
Choose a base branch
from
Open

[audit] Flag printf with escaped newlines in prefer-write-over-heredoc #638

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
149 changes: 149 additions & 0 deletions .github/workflows/build-daemon.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,149 @@
name: Build failproofaid

# Builds the real per-platform failproofaid binaries. Separate from ci.yml's
# cheap rust-quality job (lint/clippy/test on one native runner) because
# this is a slow 4-way cross-compile matrix — path-filtered so ordinary PRs
# that never touch the Rust workspace don't pay for it.
#
# `workflow_call` is how a release actually gets its binaries: publish.yml
# calls this workflow and then downloads the artifacts below in the same run,
# so the assets it uploads are built from the exact commit being published.
# There is deliberately NO `release: published` trigger — publish.yml owns
# that path now, and a standalone trigger would build the whole matrix twice
# per release.
on:
pull_request:
paths:
- "crates/**"
- "Cargo.toml"
- "Cargo.lock"
- "rust-toolchain.toml"
- ".github/workflows/build-daemon.yml"
workflow_call:
workflow_dispatch:
Comment on lines +14 to +23

@coderabbitai coderabbitai Bot Aug 6, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Neither release workflow declares a default token scope. Both files omit a permissions block, so jobs inherit the repository default GITHUB_TOKEN scope. publish.yml calls build-daemon.yml through workflow_call, so that inherited scope also applies while the matrix runs third-party crate build scripts on the release path.

  • .github/workflows/build-daemon.yml#L14-L23: add a workflow-level permissions: contents: read block between the on: triggers and jobs:; both jobs only need to read the checkout.
  • .github/workflows/publish.yml#L163-L166: add a workflow-level permissions: contents: read default so preflight and the daemon call stop inheriting write scope; keep the existing per-job contents: write on release-assets and contents: write plus id-token: write on publish.
📍 Affects 2 files
  • .github/workflows/build-daemon.yml#L14-L23 (this comment)
  • .github/workflows/publish.yml#L163-L166
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/build-daemon.yml around lines 14 - 23, Add workflow-level
permissions: contents: read to .github/workflows/build-daemon.yml at lines 14-23
and .github/workflows/publish.yml at lines 163-166, placing each block between
the on: triggers and jobs:. Preserve the existing per-job contents: write and
id-token: write permissions for release-assets and publish.

Source: Linters/SAST tools


jobs:
# The Rust workspace does not exist on every ref this workflow can run
# against: `main` carries no `Cargo.toml` until the daemon lands, and the
# path filter above matches this file itself, so a PR that only edits the
# workflow would otherwise run `cargo build` against a checkout with no
# crates in it and fail. Detect the workspace and skip the matrix cleanly —
# a skipped job is also what lets publish.yml call this from a ref that has
# no daemon at all.
detect:
runs-on: ubuntu-latest
outputs:
has_crates: ${{ steps.check.outputs.has_crates }}
steps:
- uses: actions/checkout@v7.0.1
with:
persist-credentials: false

- name: Check for the Rust workspace
id: check
run: |
if [ -f Cargo.toml ] && [ -d crates ]; then
echo "has_crates=true" >> "$GITHUB_OUTPUT"
else
echo "has_crates=false" >> "$GITHUB_OUTPUT"
echo "::notice::No Rust workspace on this ref — skipping the failproofaid build matrix."
fi

build:
needs: detect
if: needs.detect.outputs.has_crates == 'true'
strategy:
fail-fast: false
matrix:
include:
# Linux legs use GitHub-hosted native runners for both
# architectures (including a native arm64 runner) rather than
# `cross`/Docker cross-compilation — a real linker for the target
# triple, no QEMU emulation overhead.
- target: x86_64-unknown-linux-gnu
os: ubuntu-latest
platform: linux-x64
- target: aarch64-unknown-linux-gnu
os: ubuntu-24.04-arm
platform: linux-arm64
# macOS cannot be cross-compiled reliably from Linux (system
# framework linking), so both legs use real Apple Silicon / Intel
# runners. `macos-15-intel` rather than `macos-13`: GitHub retired
# the macOS 13 images, and an unknown runner label doesn't degrade
# — the leg never gets a runner at all.
- target: x86_64-apple-darwin
os: macos-15-intel
platform: darwin-x64
- target: aarch64-apple-darwin
os: macos-14
platform: darwin-arm64
runs-on: ${{ matrix.os }}
steps:
- uses: actions/checkout@v7.0.1
with:
# Nothing here pushes, and everything here runs third-party crate
# build scripts (`cargo build` on the full dependency tree). The
# default leaves GITHUB_TOKEN sitting in .git/config for the rest
# of the job, readable by any of them — and this job publishes a
# release binary.
persist-credentials: false

- run: rustup target add ${{ matrix.target }}

# Split restore/save rather than `actions/cache@v6`, which does both.
# This job runs on `pull_request` AND on the release path (via
# `workflow_call` from publish.yml, where `github.event_name` is the
# caller's `release`/`workflow_dispatch`), and the cache key is shared
# between them: a PR branch could otherwise write a poisoned `target/`
# entry that a later release run restores straight into a published
# binary. PR runs read the cache; only release / manual runs write it.
- uses: actions/cache/restore@v6
id: cargo-cache
with:
path: |
~/.cargo/registry/index
~/.cargo/registry/cache
~/.cargo/git/db
target
key: cargo-build-${{ matrix.target }}-${{ hashFiles('rust-toolchain.toml', 'Cargo.lock') }}
restore-keys: cargo-build-${{ matrix.target }}-

# --locked: this job's output is the binary users install, so it must be
# built from the dependency versions committed in Cargo.lock. Without it
# Cargo is free to resolve something newer and silently rewrite the
# lockfile in the runner, making the published artifact unreproducible
# from the commit it claims to come from.
- name: cargo build --release
run: cargo build --locked --release --target ${{ matrix.target }} -p failproofaid

- uses: actions/cache/save@v6
if: github.event_name != 'pull_request' && steps.cargo-cache.outputs.cache-hit != 'true'
with:
path: |
~/.cargo/registry/index
~/.cargo/registry/cache
~/.cargo/git/db
target
key: cargo-build-${{ matrix.target }}-${{ hashFiles('rust-toolchain.toml', 'Cargo.lock') }}

# Plain gzip, not tar: the CLI decompresses this with `node:zlib` and no
# dependency, and a single-file stream needs no archive format. It also
# sidesteps `upload-artifact` dropping the executable bit — a compressed
# blob carries no mode to lose, and both consumers (the CLI downloader
# and install.sh) chmod after decompressing anyway.
#
# Every leg runs on a runner native to its own target, so executing the
# freshly built binary here is a real smoke test that the artifact is
# not a broken build.
- name: Compress the binary for release
run: |
BIN="target/${{ matrix.target }}/release/failproofaid"
"$BIN" --version
gzip -9 -c "$BIN" > "failproofaid-${{ matrix.platform }}.gz"
ls -l "failproofaid-${{ matrix.platform }}.gz"

- uses: actions/upload-artifact@v4
with:
name: failproofaid-${{ matrix.platform }}
path: failproofaid-${{ matrix.platform }}.gz
if-no-files-found: error
10 changes: 5 additions & 5 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@ jobs:
- uses: actions/cache@v6
with:
path: ~/.bun/install/cache
key: bun-${{ runner.os }}-${{ hashFiles('bun.lockb') }}
key: bun-${{ runner.os }}-${{ hashFiles('bun.lock') }}
restore-keys: bun-${{ runner.os }}-

- name: Install dependencies
Expand Down Expand Up @@ -97,7 +97,7 @@ jobs:
- uses: actions/cache@v6
with:
path: ~/.bun/install/cache
key: bun-${{ runner.os }}-${{ hashFiles('bun.lockb') }}
key: bun-${{ runner.os }}-${{ hashFiles('bun.lock') }}
restore-keys: bun-${{ runner.os }}-

- name: Install dependencies
Expand Down Expand Up @@ -130,7 +130,7 @@ jobs:
- uses: actions/cache@v6
with:
path: ~/.bun/install/cache
key: bun-${{ runner.os }}-${{ hashFiles('bun.lockb') }}
key: bun-${{ runner.os }}-${{ hashFiles('bun.lock') }}
restore-keys: bun-${{ runner.os }}-

- name: Install dependencies
Expand Down Expand Up @@ -159,7 +159,7 @@ jobs:
- uses: actions/cache@v6
with:
path: ~/.bun/install/cache
key: bun-${{ runner.os }}-${{ hashFiles('bun.lockb') }}
key: bun-${{ runner.os }}-${{ hashFiles('bun.lock') }}
restore-keys: bun-${{ runner.os }}-

- name: Install dependencies
Expand Down Expand Up @@ -204,7 +204,7 @@ jobs:
- uses: actions/cache@v6
with:
path: ~/.bun/install/cache
key: bun-${{ runner.os }}-${{ hashFiles('bun.lockb') }}
key: bun-${{ runner.os }}-${{ hashFiles('bun.lock') }}
restore-keys: bun-${{ runner.os }}-

- name: Install dependencies
Expand Down
Loading