Mirror_Repos/ChrisTitusTech_linutil
2
0
Fork 0
Code Issues Pull Requests Actions 3 Packages Projects Releases Wiki Activity

Security workflow fix (#1285)

Browse Source 
* Remove obsolete agent guidelines and configuration files

* Refactor issue slash command handling and improve user authorization checks

Co-authored-by: Copilot <copilot@github.com>

---------

Co-authored-by: Copilot <copilot@github.com>
This commit is contained in:
Chris Titus
2026-05-16 12:58:01 -05:00
committed by GitHub
parent 9dfbe571d6
commit 3548a65952
5 changed files with 80 additions and 273 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/issue-slash-commands.yaml
+54 -92
View File
@@ -15,101 +15,63 @@ jobs:
contents: read
steps:
- run: echo "command=false" >> $GITHUB_ENV
- name: Process slash command
uses: actions/github-script@v7
with:
script: |
const allowedUsers = ["ChrisTitusTech", "og-mrk", "Marterich", "MyDrift-user", "Real-MullaC", "CodingWonders", "GabiNun2", "FluffyPunk"];
const commenter = context.payload.comment.user.login;
- name: Check for /label command
id: check_label_command
run: |
if [[ "${{ contains(github.event.comment.body, '/label') }}" == "true" ]]; then
echo "command=true" >> $GITHUB_ENV
LABEL_NAME=$(echo "${{ github.event.comment.body }}" | awk -F"/label" '/\/label/ {gsub(/^[ \t]+|[ \t]+$/, "", $2); print $2}')
echo "label_command=true" >> $GITHUB_ENV
echo "label_name=${LABEL_NAME}" >> $GITHUB_ENV
else
echo "label_command=false" >> $GITHUB_ENV
fi
- name: Check for /unlabel command
id: check_unlabel_command
run: |
if [[ "${{ contains(github.event.comment.body, '/unlabel') }}" == "true" ]]; then
echo "command=true" >> $GITHUB_ENV
UNLABEL_NAME=$(echo "${{ github.event.comment.body }}" | awk -F"/unlabel" '/\/unlabel/ {gsub(/^[ \t]+|[ \t]+$/, "", $2); print $2}')
echo "unlabel_command=true" >> $GITHUB_ENV
echo "unlabel_name=${UNLABEL_NAME}" >> $GITHUB_ENV
else
echo "unlabel_command=false" >> $GITHUB_ENV
fi
// Authorization check first - before any parsing of comment content
if (!allowedUsers.includes(commenter)) {
console.log(`User ${commenter} is not in the allowlist. Skipping.`);
return;
}
- name: Check for /close command
id: check_close_command
run: |
if [[ "${{ contains(github.event.comment.body, '/close') }}" == "true" ]]; then
echo "command=true" >> $GITHUB_ENV
echo "close_command=true" >> $GITHUB_ENV
echo "reopen_command=false" >> $GITHUB_ENV
else
echo "close_command=false" >> $GITHUB_ENV
fi
// Read comment body as data, never interpolated into shell
const body = context.payload.comment.body;
const issueNumber = context.issue.number;
const owner = context.repo.owner;
const repo = context.repo.repo;
- name: Check for /open or /reopen command
id: check_reopen_command
run: |
if [[ "${{ contains(github.event.comment.body, '/open') }}" == "true" ]] || [[ "${{ contains(github.event.comment.body, '/reopen') }}" == "true" ]]; then
echo "command=true" >> $GITHUB_ENV
echo "reopen_command=true" >> $GITHUB_ENV
echo "close_command=false" >> $GITHUB_ENV
else
echo "reopen_command=false" >> $GITHUB_ENV
fi
// /label 'name' or /label name
const labelMatch = body.match(/\/label\s+'([^']+)'|\/label\s+(\S+?)(?:\s|$)/);
if (labelMatch) {
const labelName = (labelMatch[1] || labelMatch[2]).trim();
console.log(`Adding label: ${labelName}`);
await github.rest.issues.addLabels({
owner, repo, issue_number: issueNumber,
labels: [labelName],
});
}
- name: Check if the user is allowed
id: check_user
if: env.command == 'true'
run: |
ALLOWED_USERS=("ChrisTitusTech" "afonsofrancof" "Marterich" "MyDrift-user" "Real-MullaC" "koibtw" "lj3954" "jeevithakannan2")
if [[ " ${ALLOWED_USERS[@]} " =~ " ${{ github.event.comment.user.login }} " ]]; then
echo "user=true" >> $GITHUB_ENV
else
exit 0
fi
// /unlabel 'name' or /unlabel name
const unlabelMatch = body.match(/\/unlabel\s+'([^']+)'|\/unlabel\s+(\S+?)(?:\s|$)/);
if (unlabelMatch) {
const labelName = (unlabelMatch[1] || unlabelMatch[2]).trim();
console.log(`Removing label: ${labelName}`);
await github.rest.issues.removeLabel({
owner, repo, issue_number: issueNumber,
name: labelName,
});
}
- name: Close issue
if: env.close_command == 'true'
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
ISSUE_NUMBER: ${{ github.event.issue.number }}
run: |
echo Closing the issue...
if [[ "${{ contains(github.event.comment.body, 'not planned') }}" == "true" ]]; then
gh issue close $ISSUE_NUMBER --repo ${{ github.repository }} --reason 'not planned'
else
gh issue close $ISSUE_NUMBER --repo ${{ github.repository }}
fi
- name: Reopen issue
if: env.reopen_command == 'true'
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
ISSUE_NUMBER: ${{ github.event.issue.number }}
run: |
echo Reopening the issue...
gh issue reopen $ISSUE_NUMBER --repo ${{ github.repository }}
// /close (optionally with 'not planned')
if (body.includes('/close')) {
const stateReason = body.includes('not planned') ? 'not_planned' : 'completed';
console.log(`Closing issue (reason: ${stateReason})`);
await github.rest.issues.update({
owner, repo, issue_number: issueNumber,
state: 'closed',
state_reason: stateReason,
});
}
- name: Label issue
if: env.label_command == 'true'
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
ISSUE_NUMBER: ${{ github.event.issue.number }}
run: |
echo Labeling the issue...
gh issue edit $ISSUE_NUMBER --repo ${{ github.repository }} --add-label "${{ env.label_name }}"
- name: Remove labels
if: env.unlabel_command == 'true'
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
ISSUE_NUMBER: ${{ github.event.issue.number }}
run: |
echo Unlabeling the issue...
gh issue edit $ISSUE_NUMBER --repo ${{ github.repository }} --remove-label "${{ env.unlabel_name }}"
// /open or /reopen
if (body.includes('/open') || body.includes('/reopen')) {
console.log('Reopening issue');
await github.rest.issues.update({
owner, repo, issue_number: issueNumber,
state: 'open',
});
}
.gitignore
+26
View File
@@ -10,3 +10,29 @@ docs/public/
docs/.hugo_build.lock
docs/resources/
# OS system files
.DS_Store
.DS_Store?
._*
.Spotlight-V100
.Trashes
ehthumbs.db
Thumbs.db
desktop.ini
# IDE and editor files
.vscode/
.opencode/
.idea/
*.iml
*.iws
*.ipr
.fleet/
.zed/
*.suo
*.ntvs*
*.njsproj
*.sln
*.sw?
*~
.opencode/AGENTS.md
-39
View File
@@ -1,39 +0,0 @@
# OpenCode Agent Guidelines for LinUtil
## Build/Test/Lint Commands
- **Build**: `cargo build --release`
- **Test**: `cargo test`
- **Lint**: `cargo clippy -- -Dwarnings`
- **Format**: `cargo fmt --all` (fix) or `cargo fmt --all --check` (check)
- **Cross-compile**: `cross build --target=aarch64-unknown-linux-musl --release`
- **Shell Scripts**: `find core/tabs -name '*.sh' -exec shellcheck {} +`
## Code Style Guidelines
### Rust
- **Edition**: 2021 (workspace-level)
- **Imports**: Use `imports_granularity = "Crate"` per rustfmt.toml
- **Module Structure**: Use `mod modulename;` declarations at file top
- **Import Order**: std → external crates → local modules
- **Error Handling**: Use `Result<T>` for fallible operations
- **Naming**: snake_case (functions/vars), PascalCase (types/structs)
- **Dependencies**: Check existing Cargo.toml before adding crates
- **Workspace**: Multi-crate (tui, core, xtask) - respect boundaries
### Shell Scripts
- **Shell**: bash (#!/bin/bash)
- **Linting**: Use shellcheck for all .sh files
- **Location**: Organize in `core/tabs/` by category
- **Style**: Follow existing script patterns in codebase
## Project Structure
- `tui/`: Terminal UI crate (main binary)
- `core/`: Core library and shell scripts
- `xtask/`: Build and development tools
- Shell utilities in `core/tabs/` categorized by function
## MCP Integration
OpenCode uses MCP servers defined in `.opencode/mcp-config.json` for:
- Rust language support via rust-analyzer
- Bash scripting support via bash-language-server
- Linting via cargo clippy and shellcheck
.opencode/mcp-config.json
-137
View File
@@ -1,137 +0,0 @@
{
"mcpServers": {
"rust-analyzer": {
"command": "rust-analyzer",
"args": [],
"cwd": "/home/titus/github/linutil",
"env": {
"RUST_LOG": "info"
}
},
"bash-language-server": {
"command": "bash-language-server",
"args": ["start"],
"cwd": "/home/titus/github/linutil",
"env": {}
},
"cargo-tools": {
"command": "cargo",
"args": ["--version"],
"cwd": "/home/titus/github/linutil",
"capabilities": {
"build": {
"command": "cargo",
"args": ["build", "--release"]
},
"test": {
"command": "cargo",
"args": ["test"]
},
"lint": {
"command": "cargo",
"args": ["clippy", "--", "-Dwarnings"]
},
"format": {
"command": "cargo",
"args": ["fmt", "--all"]
},
"format-check": {
"command": "cargo",
"args": ["fmt", "--all", "--check"]
},
"cross-compile-aarch64": {
"command": "cross",
"args": ["build", "--target=aarch64-unknown-linux-musl", "--release"]
}
}
},
"shellcheck": {
"command": "shellcheck",
"args": ["--version"],
"cwd": "/home/titus/github/linutil",
"capabilities": {
"check-script": {
"command": "shellcheck",
"args": ["-f", "gcc"]
}
}
}
},
"workspace": {
"type": "rust-cargo",
"root": "/home/titus/github/linutil",
"members": ["tui", "core", "xtask"],
"defaultMembers": ["tui", "core"],
"edition": "2021",
"profile": {
"release": {
"opt-level": "z",
"lto": true,
"codegen-units": 1,
"panic": "abort",
"strip": true
}
}
},
"fileTypes": {
"rust": {
"extensions": [".rs"],
"languageServer": "rust-analyzer",
"formatter": "cargo-tools",
"linter": "cargo-tools"
},
"bash": {
"extensions": [".sh", ".bash"],
"languageServer": "bash-language-server",
"linter": "shellcheck"
},
"toml": {
"extensions": [".toml"],
"languageServer": "rust-analyzer"
}
},
"tasks": {
"build": {
"command": "cargo build --release",
"description": "Build release binary"
},
"test": {
"command": "cargo test",
"description": "Run all tests"
},
"lint": {
"command": "cargo clippy -- -Dwarnings",
"description": "Run clippy linter"
},
"format": {
"command": "cargo fmt --all",
"description": "Format all Rust code"
},
"format-check": {
"command": "cargo fmt --all --check",
"description": "Check if code is formatted"
},
"check-scripts": {
"command": "find core/tabs -name '*.sh' -exec shellcheck {} +",
"description": "Check all shell scripts with shellcheck"
},
"cross-compile": {
"command": "cross build --target=aarch64-unknown-linux-musl --release",
"description": "Cross-compile for ARM64"
}
},
"settings": {
"rust": {
"edition": "2021",
"features": [],
"clippy": {
"deny": ["warnings"]
}
},
"shellcheck": {
"shell": "bash",
"exclude": [],
"enable": "all"
}
}
}
.vscode/settings.json
Vendored
-5
View File
@@ -1,5 +0,0 @@
{
"chat.tools.terminal.autoApprove": {
"cargo build": true
}
}