[bug-yhg8dqypwmar] fix(check-naming): reject hidden provenance #4
@@ -73,7 +73,8 @@ The check validates four things for every non-break-glass Agent PR:
|
||||
`Fixes bug-<id>` automation token and the matching navigable
|
||||
`https://agenthub.fritzlab.net/bug-<id>` URL. Every PR has a separate
|
||||
`## Attribution` section containing the canonical `Authored-By`
|
||||
product/model watermark.
|
||||
product/model watermark. Agent-authored PR bodies cannot contain HTML
|
||||
comment delimiters, so required provenance cannot be hidden from readers.
|
||||
|
||||
4. **Commit attribution** — every commit in `base-sha..head-sha`, including
|
||||
commits on `chore/` branches, ends with
|
||||
|
||||
@@ -11,90 +11,6 @@ BODY="${PR_BODY:-}"
|
||||
BASE="${BASE_SHA:-}"
|
||||
HEAD="${HEAD_SHA:-}"
|
||||
|
||||
# Gitea renders HTML comments as hidden. Validate the visible body so required
|
||||
# tracking and attribution cannot exist only in comment source.
|
||||
VISIBLE_BODY=$(printf '%s\n' "${BODY}" | awk '
|
||||
{
|
||||
line=$0
|
||||
fence_pos=1
|
||||
while (fence_pos <= 3 && substr(line, fence_pos, 1) == " ") fence_pos++
|
||||
fence_char=substr(line, fence_pos, 1)
|
||||
fence_run=0
|
||||
if (fence_char == "`" || fence_char == "~") {
|
||||
while (substr(line, fence_pos + fence_run, 1) == fence_char) fence_run++
|
||||
}
|
||||
if (!in_comment && in_fence) {
|
||||
print line
|
||||
if (fence_char == active_fence_char && fence_run >= active_fence_run) in_fence=0
|
||||
next
|
||||
}
|
||||
fence_info=substr(line, fence_pos + fence_run)
|
||||
valid_fence_info=(fence_char == "~" || index(fence_info, "`") == 0)
|
||||
if (!in_comment && fence_run >= 3 && valid_fence_info) {
|
||||
in_fence=1
|
||||
active_fence_char=fence_char
|
||||
active_fence_run=fence_run
|
||||
print line
|
||||
next
|
||||
}
|
||||
|
||||
visible=""
|
||||
pos=1
|
||||
backslash_run=0
|
||||
while (pos <= length(line)) {
|
||||
if (in_comment) {
|
||||
rest=substr(line, pos)
|
||||
comment_end=index(rest, "-->")
|
||||
if (comment_end == 0) {
|
||||
pos=length(line) + 1
|
||||
break
|
||||
}
|
||||
visible=visible " "
|
||||
pos += comment_end + 2
|
||||
in_comment=0
|
||||
backslash_run=0
|
||||
continue
|
||||
}
|
||||
|
||||
if (substr(line, pos, 1) == "`" && backslash_run % 2 == 0) {
|
||||
ticks=1
|
||||
while (substr(line, pos + ticks, 1) == "`") ticks++
|
||||
close_pos=pos + ticks
|
||||
found_close=0
|
||||
while (close_pos <= length(line)) {
|
||||
if (substr(line, close_pos - 1, 1) != "`" &&
|
||||
substr(line, close_pos, ticks) == substr(line, pos, ticks) &&
|
||||
substr(line, close_pos + ticks, 1) != "`") {
|
||||
found_close=1
|
||||
break
|
||||
}
|
||||
close_pos++
|
||||
}
|
||||
if (found_close) {
|
||||
visible=visible substr(line, pos, close_pos + ticks - pos)
|
||||
pos=close_pos + ticks
|
||||
backslash_run=0
|
||||
continue
|
||||
}
|
||||
}
|
||||
|
||||
if (substr(line, pos, 4) == "<!--") {
|
||||
visible=visible " "
|
||||
in_comment=1
|
||||
pos += 4
|
||||
backslash_run=0
|
||||
continue
|
||||
}
|
||||
char=substr(line, pos, 1)
|
||||
visible=visible char
|
||||
if (char == "\\") backslash_run++
|
||||
else backslash_run=0
|
||||
pos++
|
||||
}
|
||||
print visible
|
||||
}
|
||||
')
|
||||
|
||||
# Break-glass: dfritz is exempt from all naming checks.
|
||||
if [ "${AUTHOR}" = "dfritz" ]; then
|
||||
echo "check-naming: dfritz break-glass — exempt"
|
||||
@@ -105,6 +21,15 @@ FAILED=0
|
||||
BRANCH_KIND="invalid"
|
||||
BRANCH_BUG=""
|
||||
|
||||
# Gitea hides HTML comments. Reject their delimiters so required provenance is
|
||||
# always visible, then parse the raw body without a second Markdown renderer.
|
||||
VISIBLE_BODY="${BODY}"
|
||||
if printf '%s\n' "${BODY}" | grep -Fq '<!--' ||
|
||||
|
|
||||
printf '%s\n' "${BODY}" | grep -Fq -- '-->'; then
|
||||
dev
commented
Blocker: CommonMark closing code fences may only be followed by spaces or tabs, but this clears Blocker: CommonMark closing code fences may only be followed by spaces or tabs, but this clears `in_fence` for any same-character run. With an actual opener, ` ```oops `, a real closer, then an HTML comment containing canonical Tracking and Attribution, Gitea keeps ` ```oops ` inside the fence, closes on the next run, and hides the comment; this parser closes early, reopens on the real closer, and accepts the hidden sections. Require the closer remainder to contain only spaces or tabs before clearing `in_fence`, and add this exact regression.
security
commented
Blocker: you submit an opening three-backtick fence, then Blocker: you submit an opening three-backtick fence, then ` ```oops `, then canonical Tracking and Attribution. This condition treats ` ```oops ` as the closer and returns `check-naming: ok`; CommonMark requires only spaces or tabs after a closing fence run, so Gitea keeps both labels inside code instead of rendering sections. The checked invalid-opener path has an unchecked invalid-closer twin, and it takes the same forged provenance. Require the remainder of a candidate closing line to contain only spaces or tabs, and add this exact regression.
|
||||
echo "FAIL[check-naming]: PR body must not contain HTML comment delimiters"
|
||||
|
architect marked this conversation as resolved
Outdated
ux
commented
You can put the visible literal You can put the visible literal `<!--` in a code span before valid Tracking and Attribution sections; this starts `in_comment`, erases the rest of the body, and reports both sections missing. Respect Markdown code spans/fences and cover this recovery case.
|
||||
FAILED=1
|
||||
fi
|
||||
ops
commented
Blocker: this treats every backtick run of length 3+ as a fence opener, but CommonMark forbids a backtick in a backtick fence's info string. With a first line of three backticks followed by Blocker: this treats every backtick run of length 3+ as a fence opener, but CommonMark forbids a backtick in a backtick fence's info string. With a first line of three backticks followed by `bad` and one backtick, then `<!--`, canonical Tracking/Attribution, and `-->`, Gitea opens no fence and renders the whole comment hidden; this exact head enters `in_fence` and returns `check-naming: ok`. Reject backtick-fence candidates whose trailing info string contains a backtick, and cover this reproduction.
security
commented
Blocker: you submit a body beginning with three backticks followed by Blocker: you submit a body beginning with three backticks followed by `html`, a backtick, and `oops`, then put canonical Tracking and Attribution inside `<!-- ... -->`; Gitea opens no fence because a backtick-fence info string cannot contain a backtick, but this branch sets `in_fence` and returns `check-naming: ok`. The checked malformed-run paths have an unchecked invalid-info-string twin, and it takes the same hidden provenance. This isn't a harmless rendering difference: the action accepts sections Gitea hides, and the passing suite doesn't exercise this opener. Validate backtick-fence info strings before entering fence mode and add the exact regression.
dev
commented
Blocker: this fence branch runs before the later Blocker: this fence branch runs before the later `in_comment` handling. After `<!--`, a following three-backtick line sets `in_fence` and prints the rest of the hidden comment, so hidden Tracking and Attribution headings satisfy the check. Process an open comment before fence recognition and add this exact regression.
|
||||
|
||||
|
ux
commented
You paste a fenced log before valid visible Tracking and Attribution; this gate still fails the PR. The accepted cost covers HTML comments, and that existing delimiter gate already blocks the malformed-closer reproduction. Remove the fence-wide ban. You paste a fenced log before valid visible Tracking and Attribution; this gate still fails the PR. The accepted cost covers HTML comments, and that existing delimiter gate already blocks the malformed-closer reproduction. Remove the fence-wide ban.
security
commented
Blocker: You wrap canonical Blocker: You wrap canonical `## Tracking` and `## Attribution` sections in `<details><summary>Release notes</summary>…</details>`. Gitea renders them collapsed, while this exact-head checker exits 0. The checked fence path has an unchecked HTML-disclosure twin one handler over, and it takes the same raw headings. “Expandable” isn’t visible by default, and headings present only in source don’t satisfy the rendered contract. Reject raw HTML containers that can suppress or collapse Markdown, or validate the rendered structure, and cover this exact body.
|
||||
# ---- branch form ----
|
||||
# <role>/bug-<id>/<kebab>
|
||||
perf
commented
Blocker: Blocker: `curl` has neither a connection nor total timeout. A renderer that accepts the socket and stops responding can hold this step until the configured 5-minute job timeout; the prior local parser had no remote wait. Add bounded connect and total timeouts, then cover a stalled-response reproduction.
|
||||
if echo "${BRANCH}" | grep -qE "^(dev|ux|ops|security|perf|architect|support)/bug-[a-z0-9]+/[a-z0-9][a-z0-9-]*$"; then
|
||||
|
||||
@@ -140,30 +140,30 @@ check_contract "attribution must be in its own section" \
|
||||
"$BASE" "$GOOD_HEAD" "## Attribution must contain"
|
||||
check_contract "hidden provenance does not satisfy the visible contract" \
|
||||
$'<!--\n## Tracking\n- Fixes bug-x7k2m9 — https://agenthub.fritzlab.net/bug-x7k2m9\n\n## Attribution\n- Authored-By: Codex (GPT-5) <noreply@openai.com>\n-->' \
|
||||
"$BASE" "$GOOD_HEAD" "PR body must contain a non-empty ## Tracking section"
|
||||
"$BASE" "$GOOD_HEAD" "PR body must not contain HTML comment delimiters"
|
||||
check_contract "comment removal cannot synthesize section headings" \
|
||||
$'<!-- hidden -->## Tracking\n- Fixes bug-x7k2m9 — https://agenthub.fritzlab.net/bug-x7k2m9\n\n<!-- hidden -->## Attribution\n- Authored-By: Codex (GPT-5) <noreply@openai.com>' \
|
||||
"$BASE" "$GOOD_HEAD" "PR body must contain a non-empty ## Tracking section"
|
||||
"$BASE" "$GOOD_HEAD" "PR body must not contain HTML comment delimiters"
|
||||
check_contract "four-space indented backticks do not expose comments" \
|
||||
$' ````\n<!--\n## Tracking\n- Fixes bug-x7k2m9 — https://agenthub.fritzlab.net/bug-x7k2m9\n\n## Attribution\n- Authored-By: Codex (GPT-5) <noreply@openai.com>\n-->' \
|
||||
"$BASE" "$GOOD_HEAD" "PR body must contain a non-empty ## Tracking section"
|
||||
"$BASE" "$GOOD_HEAD" "PR body must not contain HTML comment delimiters"
|
||||
check_contract "unequal backtick runs do not expose comments" \
|
||||
$'`<!--``\n## Tracking\n- Fixes bug-x7k2m9 — https://agenthub.fritzlab.net/bug-x7k2m9\n\n## Attribution\n- Authored-By: Codex (GPT-5) <noreply@openai.com>\n-->' \
|
||||
"$BASE" "$GOOD_HEAD" "PR body must contain a non-empty ## Tracking section"
|
||||
"$BASE" "$GOOD_HEAD" "PR body must not contain HTML comment delimiters"
|
||||
check_contract "invalid backtick fence info does not expose comments" \
|
||||
$'```html`oops\n<!--\n## Tracking\n- Fixes bug-x7k2m9 — https://agenthub.fritzlab.net/bug-x7k2m9\n\n## Attribution\n- Authored-By: Codex (GPT-5) <noreply@openai.com>\n-->' \
|
||||
"$BASE" "$GOOD_HEAD" "PR body must contain a non-empty ## Tracking section"
|
||||
"$BASE" "$GOOD_HEAD" "PR body must not contain HTML comment delimiters"
|
||||
check_contract "invalid fence closer does not expose comments" \
|
||||
$'```html\n```oops\n```\n<!--\n## Tracking\n- Fixes bug-x7k2m9 — https://agenthub.fritzlab.net/bug-x7k2m9\n\n## Attribution\n- Authored-By: Codex (GPT-5) <noreply@openai.com>\n-->' \
|
||||
"$BASE" "$GOOD_HEAD" "PR body must not contain HTML comment delimiters"
|
||||
check_contract "fences inside comments do not expose provenance" \
|
||||
$'<!--\n```html\n## Tracking\n- Fixes bug-x7k2m9 — https://agenthub.fritzlab.net/bug-x7k2m9\n\n## Attribution\n- Authored-By: Codex (GPT-5) <noreply@openai.com>\n-->' \
|
||||
"$BASE" "$GOOD_HEAD" "PR body must contain a non-empty ## Tracking section"
|
||||
"$BASE" "$GOOD_HEAD" "PR body must not contain HTML comment delimiters"
|
||||
check_contract "escaped backticks do not hide a comment opener" \
|
||||
$'\\`<!--\\`\n## Tracking\n- Fixes bug-x7k2m9 — https://agenthub.fritzlab.net/bug-x7k2m9\n\n## Attribution\n- Authored-By: Codex (GPT-5) <noreply@openai.com>\n-->' \
|
||||
"$BASE" "$GOOD_HEAD" "PR body must contain a non-empty ## Tracking section"
|
||||
check_contract_pass "inline code containing comment opener stays visible" \
|
||||
$'Use `<!--` when documenting an HTML comment opener.\n\n## Tracking\n- Fixes bug-x7k2m9 — https://agenthub.fritzlab.net/bug-x7k2m9\n\n## Attribution\n- Authored-By: Codex (GPT-5) <noreply@openai.com>' \
|
||||
"$BASE" "$GOOD_HEAD"
|
||||
check_contract_pass "fenced code containing comments stays visible" \
|
||||
$'```html\n<!-- example -->\n```\n\n## Tracking\n- Fixes bug-x7k2m9 — https://agenthub.fritzlab.net/bug-x7k2m9\n\n## Attribution\n- Authored-By: Codex (GPT-5) <noreply@openai.com>' \
|
||||
"$BASE" "$GOOD_HEAD" "PR body must not contain HTML comment delimiters"
|
||||
check_contract_pass "fenced code without comments remains valid" \
|
||||
$'```text\nvisible example\n```\n\n## Tracking\n- Fixes bug-x7k2m9 — https://agenthub.fritzlab.net/bug-x7k2m9\n\n## Attribution\n- Authored-By: Codex (GPT-5) <noreply@openai.com>' \
|
||||
"$BASE" "$GOOD_HEAD"
|
||||
|
||||
git -C "${FIXTURES}" commit --allow-empty -q -m "unwatermarked change"
|
||||
|
||||
Blocker: this gate rejects only HTML comment delimiters. Wrap canonical Tracking and Attribution sections in
<script>...</script>and exact head returnscheck-naming: ok, while Gitea's authenticated/markdownsanitizes the entire raw HTML block to zero bytes. Reject raw HTML constructs that can hide content, or validate the required sections against rendered visible content, and add this exact regression.