| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
修改文档 | 1 个月前 | |
fix(security): account uses trigger actor instead of pr author 评论触发 PR 同步时 account 误取 PR 作者，同步流水线执行人归属错误 （冒用他人身份的审计问题）。改为取运行时注入的触发人账号： GitCode=ATOMGIT_ACTOR、GitHub=GITHUB_ACTOR、Gitee=GITEE_ACTOR/GITEE_LOGIN； ACTOR 缺失时触发请求不带 account（宁缺毋滥），不再回退 PR 作者。 Co-authored-by: DeepSeek Harness <noreply@tool-provider.com> Generated-by: glm-5.3 | 3 天前 | |
支持插件触发pr同步 | 1 个月前 | |
feat(security): disable AppCode fallback, OIDC only Per review of issue #10: remove the static AppCode credential fallback entirely. The plugin now requires the OIDC runtime (permissions: id-token: write) and skips execution with guidance when it is absent. - main.ts: drop apigAppCode input handling; skip when no OIDC runtime - apig-client.ts: remove appCode config, X-Apig-AppCode headers and the requestViaAppCode transport; OIDC via callApig is the only path - credential-config.ts: remove isApigCredentialProvided - types.ts / action.yml: drop openlibing_apig_code input - tests: remove AppCode-mode cases; suite 145/145 green, dist rebuilt | 6 天前 | |
feat(security): disable AppCode fallback, OIDC only Per review of issue #10: remove the static AppCode credential fallback entirely. The plugin now requires the OIDC runtime (permissions: id-token: write) and skips execution with guidance when it is absent. - main.ts: drop apigAppCode input handling; skip when no OIDC runtime - apig-client.ts: remove appCode config, X-Apig-AppCode headers and the requestViaAppCode transport; OIDC via callApig is the only path - credential-config.ts: remove isApigCredentialProvided - types.ts / action.yml: drop openlibing_apig_code input - tests: remove AppCode-mode cases; suite 145/145 green, dist rebuilt | 6 天前 | |
refactor(apig): pipelineInfo 查询路径升级为 cross-region/v1/pipelineInfo - ApigClient.getPipelineInfo 请求路径追加 v1 版本段（OIDC / AppCode 双通道） - mock-apig-server 同步新路由；路径断言收紧为完整 v1 路径 - README 时序图与 error-codes 注释同步 Co-authored-by: DeepSeek Harness <noreply@tool-provider.com> Generated-by: glm-5.3-flash | 1 个月前 | |
fix(security): batch security hardening for issues #5-#13 #15-#22 - #5/#7/#11/#16/#22: APIG request body logs masked via maskAccessToken (merged feat/pr-sync-trigger-security) - #6/#17/#21: Gitee token moved from URL query to Authorization Bearer header (merged feat/pr-sync-trigger-security) - #9: trigger request no longer carries repo token (merged feat/pr-sync-trigger-security) - #12: enforce 30s minimum for poll_interval_seconds to protect APIG rate limits - #10: emit strong warning when falling back to static AppCode credential - #13: label add/delete failures now logged as warnings instead of being silently swallowed (GitHub/Gitee clients) - #18: outbound requests reject non-HTTPS URLs instead of downgrading - #15: pin pr-label-action/pre-commit-action to immutable commit SHAs - #20: sanitize bundled @actions/io chmod 0666 to 0755 post-build (scripts/fix-bundle-chmod.js wired into package-main) - #19: add api-scan workflow per platform api-scan spec - #8: platform API base URLs overridable via GITCODE_API_BASE_URL / GITEE_API_BASE_URL env, openlibing_apig_url no longer defaults to a hardcoded public gateway, pre-commit mirror documented Co-authored-by: DeepSeek Harness <noreply@tool-provider.com> Generated-by: glm-5.3 | 11 天前 | |
feat(config): default label_enabled to false 将 PR 标签回写改为默认关闭，需显式声明 label_enabled=true 才会回写标签： - action.yml：label_enabled 默认值 true → false，描述同步更新 - src/label-config.ts：缺省值 true → false（含解析注释与兜底默认） - test/unit/label-config.test.ts：默认关闭断言；依赖"默认开启"的四个用例改为显式开启 说明：默认值由 action.yml 注入，故本次不重新打包 dist（dist 现有未提交改动，避免混入）。 Co-authored-by: DeepSeek Harness <noreply@tool-provider.com> Generated-by: deepseek-v4-flash | 1 个月前 | |
fix(security): batch security hardening for issues #5-#13 #15-#22 - #5/#7/#11/#16/#22: APIG request body logs masked via maskAccessToken (merged feat/pr-sync-trigger-security) - #6/#17/#21: Gitee token moved from URL query to Authorization Bearer header (merged feat/pr-sync-trigger-security) - #9: trigger request no longer carries repo token (merged feat/pr-sync-trigger-security) - #12: enforce 30s minimum for poll_interval_seconds to protect APIG rate limits - #10: emit strong warning when falling back to static AppCode credential - #13: label add/delete failures now logged as warnings instead of being silently swallowed (GitHub/Gitee clients) - #18: outbound requests reject non-HTTPS URLs instead of downgrading - #15: pin pr-label-action/pre-commit-action to immutable commit SHAs - #20: sanitize bundled @actions/io chmod 0666 to 0755 post-build (scripts/fix-bundle-chmod.js wired into package-main) - #19: add api-scan workflow per platform api-scan spec - #8: platform API base URLs overridable via GITCODE_API_BASE_URL / GITEE_API_BASE_URL env, openlibing_apig_url no longer defaults to a hardcoded public gateway, pre-commit mirror documented Co-authored-by: DeepSeek Harness <noreply@tool-provider.com> Generated-by: glm-5.3 | 11 天前 | |
fix(security): account uses trigger actor instead of pr author 评论触发 PR 同步时 account 误取 PR 作者，同步流水线执行人归属错误 （冒用他人身份的审计问题）。改为取运行时注入的触发人账号： GitCode=ATOMGIT_ACTOR、GitHub=GITHUB_ACTOR、Gitee=GITEE_ACTOR/GITEE_LOGIN； ACTOR 缺失时触发请求不带 account（宁缺毋滥），不再回退 PR 作者。 Co-authored-by: DeepSeek Harness <noreply@tool-provider.com> Generated-by: glm-5.3 | 3 天前 | |
适配oidc | 1 个月前 | |
修改文档 | 1 个月前 | |
feat(plugin): 任务结果页收敛为三项并切换 targetMrUrl 契约 - 任务结果页只展示三项：结果（中文终态：成功/失败/超时/跳过/无记录）、 目标仓库MR链接、同步任务详情链接；错误码/修复建议/耗时仅保留在执行日志 - displayFinalStatus 扩展为五种终态的全量中文映射 - APIG 契约字段 yellowUrl 更名 targetMrUrl（与 openlibing-cicd 平台侧 getPipelineStatus 同步修改），插件仅读取新字段，缺失归一化为 null - mock-apig-server 同步切换新契约 Co-authored-by: DeepSeek Harness <noreply@tool-provider.com> Generated-by: glm-5.3-flash | 1 个月前 | |
feat(security): disable AppCode fallback, OIDC only Per review of issue #10: remove the static AppCode credential fallback entirely. The plugin now requires the OIDC runtime (permissions: id-token: write) and skips execution with guidance when it is absent. - main.ts: drop apigAppCode input handling; skip when no OIDC runtime - apig-client.ts: remove appCode config, X-Apig-AppCode headers and the requestViaAppCode transport; OIDC via callApig is the only path - credential-config.ts: remove isApigCredentialProvided - types.ts / action.yml: drop openlibing_apig_code input - tests: remove AppCode-mode cases; suite 145/145 green, dist rebuilt | 6 天前 | |
上传代码 | 2 个月前 |
| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
| 1 个月前 | ||
| 3 天前 | ||
| 1 个月前 | ||
| 6 天前 | ||
| 6 天前 | ||
| 1 个月前 | ||
| 11 天前 | ||
| 1 个月前 | ||
| 11 天前 | ||
| 3 天前 | ||
| 1 个月前 | ||
| 1 个月前 | ||
| 1 个月前 | ||
| 6 天前 | ||
| 2 个月前 |