Repository navigation
am-i-hacked 2.1.0: run git with core.fsmonitor=false, scan dot-directories and ignored files - #17
Merged
Merged
Conversation
Release prep for `am-i-hacked` 2.1.0, a security release. - The scan and `safe-pull` now run git with `core.fsmonitor=false`, so a `.git/config` shipped inside an archive cannot run a command. `safe-pull` has a regression test (it fails against the old script). - 2.0.1 was never published (npm has 2.0.0 only), so its changes are folded into 2.1.0. The changelog was checked against the code and tests; the dark-corner list and the upgrade line are corrected. - Version, security gate pin, README, ROADMAP, root changelog, site and `llms.txt` are updated for 2.1.0. ROADMAP's old 2.1.0 candidates move to 2.2.0. - `secure-skill-pull`'s download-and-run regex also catches `yarn dlx`, `bunx`, `bun x` and `npm exec`/`npm x`. ## Before merging - Publish 2.1.0 to npm first. `main`'s gate pins a version that is not on npm, so the gate is red until 2.1.0 exists. This PR's gate fails for the same reason, because `pull_request_target` runs the base branch's workflow. - If this is squash-merged, tag `[email protected]` after the merge. ## Verified - `pnpm run check` in `apps/am-i-hacked`: 379 tests pass, shellcheck and shfmt clean. - `scripts/npx-docs.sh`: clean. - `mise run secure-devtools:check`: scan, check and docs-npx pass. `leak-check` could not run (`scripts/silver-gate-patterns.json` is missing); not caused by this change. ## Not in this PR - Moving `safe-pull` into its own app and skill. - The two skills' `verified-against: am-i-hacked 2.0.1` lines. BODY
scripts/export-public.sh staged the public repo from an allowlist and a patterns file that no longer exist, so it could not run. Its mise task and the "Public repository" section of RELEASING.md go with it. The scanner test used a real Serena MCP server config as its example of a legitimate uvx server that must not be flagged. It now uses a neutral name. The test still passes.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Release prep for
am-i-hacked2.1.0, a security release.safe-pullnow run git withcore.fsmonitor=false, so a.git/configshipped inside an archive cannot run a command.safe-pullhas a regression test (it fails against the old script).llms.txtare updated for 2.1.0. ROADMAP's old 2.1.0 candidates move to 2.2.0.secure-skill-pull's download-and-run regex also catchesyarn dlx,bunx,bun xandnpm exec/npm x.scripts/export-public.sh, itsmisetask and the RELEASING.md section (it read an allowlist and a patterns file that no longer exist, so it could not run), and renames the last third-party MCP server in the scanner test fixture to a neutral name.Before merging
main.main's gate pins a version that is not on npm, so the gate is red until 2.1.0 exists. This PR's gate fails for the same reason, becausepull_request_targetruns the base branch's workflow.[email protected]after the merge.Verified
pnpm checkfrom the repo root: exit 0 across 3 workspace packages; 379 tests pass inam-i-hacked, shellcheck and shfmt clean.release.sh dry-run apps/am-i-hacked:[email protected], 12 files (bin/,CHANGELOG.md,LICENSE,package.json,README.md).scripts/npx-docs.sh: clean.leak-checkon the unpushed commits: clean.Not in this PR
safe-pullinto its own app and skill.verified-against: am-i-hacked 2.0.1lines.