-
-
Notifications
You must be signed in to change notification settings - Fork 11.9k
feat: 支持协作式取消下载与共享 Runtime 调度 #574
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -20,7 +20,7 @@ jobs: | |
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Checkout code | ||
| uses: actions/checkout@v4 | ||
| uses: actions/checkout@v6 | ||
|
|
||
| - name: Close PR | ||
| run: | | ||
|
|
@@ -36,4 +36,4 @@ jobs: | |
| gh pr comment ${{ github.event.pull_request.number }} --repo ${{ github.repository }} --body '${{ env.comment }}' | ||
| gh pr close ${{ github.event.pull_request.number }} --repo ${{ github.repository }} | ||
| env: | ||
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🔒 Security & Privacy | 🛡️ Analyzed with Security Review | 🟡 Minor | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -eu
file=".github/workflows/close_specific_pr.yml"
printf '%s\n' "--- $file ---"
cat -n "$file"
printf '%s\n' "--- workflow permission declarations ---"
rg -n -C 3 '(^|[[:space:]])permissions:|contents:|pull-requests:|GH_TOKEN|github\.token|secrets\.GITHUB_TOKEN|gh pr' "$file"Repository: hect0x7/JMComic-Crawler-Python Length of output: 2328 🏁 Script executed: #!/bin/bash
set -eu
url='https://api.github.com/repos/hect0x7/JMComic-Crawler-Python/actions/permissions/workflow'
curl -fsSL -H 'Accept: application/vnd.github+json' "$url" | python3 -c '
import json, sys
data=json.load(sys.stdin)
for key in ("default_workflow_permissions", "can_approve_pull_request_reviews"):
if key in data:
print(f"{key}: {data[key]}")
if not data:
print("{}")
'Repository: hect0x7/JMComic-Crawler-Python Length of output: 823 Security Misconfiguration Reachability: External Declare the minimum permissions for Add: permissions:
contents: read
pull-requests: writeThe workflow needs read access for checkout and pull-request write access for 🧰 Tools🪛 zizmor (1.29.0)[warning] 12-40: overly broad permissions (excessive-permissions): default permissions used due to no permissions: block (excessive-permissions) 🤖 Prompt for AI AgentsSources: MCP tools, Linters/SAST tools |
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🔒 Security & Privacy | 🛡️ Analyzed with Security Review | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
Repository: hect0x7/JMComic-Crawler-Python
Length of output: 6439
Sensitive Data Exposure
Reachability: External
Exploitability: Moderate
CWE: CWE-522 — Insufficiently Protected Credentials
Disable checkout credential persistence before running repository code.
Each listed workflow runs repository-controlled Python code after checkout. Add
persist-credentials: falseto each checkout step unless authenticated Git operations are required..github/workflows/benchmark.yml#L22-L22.github/workflows/download.yml#L32-L32.github/workflows/test_api.yml#L30-L30.github/workflows/test_html.yml#L30-L30🧰 Tools
🪛 zizmor (1.29.0)
[warning] 22-22: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[warning] 17-57: overly broad permissions (excessive-permissions): default permissions used due to no permissions: block
(excessive-permissions)
📍 Affects 4 files
.github/workflows/benchmark.yml#L22-L22(this comment).github/workflows/download.yml#L32-L32.github/workflows/test_api.yml#L30-L30.github/workflows/test_html.yml#L30-L30🤖 Prompt for AI Agents
Sources: MCP tools, Linters/SAST tools