fix(lanes): scan every lane and eval upload for credentials before it leaves

.github/actions/resolve-config/callers.test.mjs

@@ -2878,7 +2878,9 @@ test("pr-run-activity-read.yml: a PR run that stops before head code still uploa
   assert.equal(atStep(scan.if, { ...stopped, "needs.run.outputs.go": "true" }), true);
   // The verdict steps keep the default success(): they run when no step before
   // them failed, so a skipped scan still posts the skip and a hit posts nothing.
-  for (const name of ["Write the verdict", "Upload the verdict"]) assert.equal(step(name).if, undefined, name);
+  // The upload also needs its own scan's clean output.
+  for (const name of ["Write the verdict", "Scan the upload for credentials"]) assert.equal(step(name).if, undefined, name);
+  assert.equal(step("Upload the verdict").if, "steps.scan-upload.outputs.clean == 'true'");
   for (const name of ["Upload the skill's final reply", "Upload the patch", "Show the skill's run in the step summary"]) {
     assert.equal(atStep(step(name).if, stopped), false, `${name} has nothing to upload`);
   }
@@ -5380,7 +5382,7 @@ test("pr-unblock.yml: the select job runs only base code with a read-only token
   assert.equal(proceed("skipped", "", ""), "", "a kill-switch stop");
   assert.equal(proceed("success", "true", "", "true"), "", "a pass-only round proceeds to no model");
   const upload = select.steps.find((s) => s.id === "upload");
-  assert.equal(upload.if, "steps.select.outputs.proceed == 'true' || steps.select.outputs.resolve-only == 'true'");
+  assert.equal(upload.if, "(steps.select.outputs.proceed == 'true' || steps.select.outputs.resolve-only == 'true') && steps.scan-upload.outputs.clean == 'true'");
   assert.equal(upload.with.name, "feedback-context-${{ github.run_attempt }}");
 });
 
@@ -7446,6 +7448,44 @@ test("work-resolve-issue.yml: every resolve without pinned dimensions passes adm
   assert.ok(unpinned.includes("pick-slot") && unpinned.includes("run-checks"), `unpinned resolves: ${unpinned}`);
 });
 
+// A checkout with no path: replaces the workspace, .base included, so an
+// action loaded from ./.base/ after it is head code.
+test("no job loads an action from ./.base/ after a checkout that replaced it", () => {
+  for (const file of workflowFiles()) {
+    for (const [id, job] of Object.entries(workflow(file).jobs ?? {})) {
+      let replaced = null;
+      for (const step of job.steps ?? []) {
+        const uses = String(step.uses ?? "");
+        if (uses.startsWith("actions/checkout@")) {
+          if (step.with?.path === ".base") replaced = null;
+          else if (!step.with?.path) replaced = step.name;
+        }
+        if (replaced !== null && uses.startsWith("./.base/")) assert.fail(`${file} ${id}: ${step.name} loads ${uses} after ${replaced}`);
+      }
+    }
+  }
+});
+
+test("the read runner's scan job and the write runner's run job scan uploads with a scanner staged in RUNNER_TEMP before the head checkout", () => {
+  const run = 'node "$RUNNER_TEMP/scan-gate/.github/actions/scan-upload/scan-upload.mjs"';
+  const jobs = [
+    [workflow("pr-run-activity-read.yml").jobs.scan, "Check out the gated head"],
+    [workflow("pr-run-activity-write.yml").jobs.run, "Check out the PR head"],
+  ];
+  for (const [job, head] of jobs) {
+    const index = (find) => job.steps.findIndex(find);
+    const stage = index((s) => s.name === "Stage the upload scanner");
+    assert.ok(stage >= 0 && stage < index((s) => s.name === head), "staged before the head checkout");
+    assert.equal(job.steps[stage].if, undefined, "staged on every run");
+    const scans = job.steps.filter((s) => /^scan-upload/.test(s.id ?? ""));
+    assert.ok(scans.length > 0);
+    for (const scan of scans) {
+      assert.equal(scan.uses, undefined, scan.id);
+      assert.equal(scan.run, run, scan.id);
+    }
+  }
+});
+
 // sync-shared-copies-select decides from base code alone: it proceeds once
 // the sync ran on the clean merge (a written patch, or an empty run whose
 // merge alone the push job commits), names each stop's skip reason, and

.github/actions/scan-upload/action.yml

@@ -0,0 +1,29 @@
+name: Scan an upload for credentials
+description: >
+  Run lib/publish-gate.mjs scanLeak over every file an actions/upload-artifact
+  step is about to send, with the same `path` input. A credential, a hidden
+  assignment, a link, a compressed file or a glob fails the step and sets no
+  `clean` output; the upload's `if:` must require clean == 'true', so a hit
+  withholds the upload even when the upload runs always(). Nothing printed
+  carries a matched value or a file name. Needs node 18 or later on PATH and
+  lib/publish-gate.mjs three directories above this action.
+
+inputs:
+  path:
+    description: The upload step's `path` input, verbatim.
+    required: true
+
+outputs:
+  clean:
+    description: "`true` only when every file was judged clean."
+    value: ${{ steps.scan.outputs.clean }}
+
+runs:
+  using: composite
+  steps:
+    - name: Scan the files
+      id: scan
+      shell: bash
+      env:
+        SCAN_PATHS: ${{ inputs.path }}
+      run: node "$GITHUB_ACTION_PATH/scan-upload.mjs"

.github/actions/scan-upload/package.json

@@ -0,0 +1,7 @@
+{
+  "name": "scan-upload",
+  "private": true,
+  "scripts": {
+    "test": "node --test"
+  }
+}

.github/actions/scan-upload/scan-upload.mjs

@@ -0,0 +1,101 @@
+#!/usr/bin/env node
+// The pre-upload leak scan for lane and eval artifacts: scanLeak from
+// lib/publish-gate.mjs, the rule set the read runner's leak-scan step uses,
+// over every file an upload is about to send, its relative name included.
+// A credential format or a hidden assignment withholds the upload; the broad
+// assignment label only warns. A link, a non-regular file, a glob or `!`
+// entry, a compressed file (whose bytes the scan cannot read) or an
+// unreadable path is a fault, which withholds it too. Nothing it prints
+// carries a matched value or a file name.
+//
+//   SCAN_PATHS=<the upload's path input> scan-upload.mjs
+// Writes clean=true to GITHUB_OUTPUT only when every file was judged clean.
+// Exit 0 clean, 1 withheld.
+
+import { appendFileSync, lstatSync, readdirSync, readFileSync } from "node:fs";
+import path from "node:path";
+import process from "node:process";
+import { fileURLToPath } from "node:url";
+import { scanLeak, WARN_ONLY } from "../../../lib/publish-gate.mjs";
+
+const COMPRESSED = [Buffer.from([0x1f, 0x8b]), Buffer.from("PK\x03\x04", "latin1"), Buffer.from("(\xb5/\xfd", "latin1")];
+
+/**
+ * Every file under each of `entries` (the upload's path lines), judged by
+ * scanLeak. Returns `{ withheld: {label, credential} | null, warned, files }`.
+ */
+export function scanPaths(entries) {
+  let warned = false;
+  let files = 0;
+  const withhold = (label, credential = false) => ({ withheld: { label, credential }, warned, files });
+  const judge = (bytes) => {
+    const { block, credential, warn } = scanLeak(bytes);
+    if (block) return { label: block, credential };
+    warned ||= Boolean(warn);
+    return null;
+  };
+  const walk = (at, name) => {
+    let stat;
+    try {
+      stat = lstatSync(at);
+    } catch {
+      return { label: "a path the scan cannot read" };
+    }
+    if (stat.isSymbolicLink()) return { label: "a link, which the upload would follow" };
+    if (stat.isDirectory()) {
+      for (const child of readdirSync(at).sort()) {
+        const hit = walk(path.join(at, child), name ? `${name}/${child}` : child);
+        if (hit) return hit;
+      }
+      return null;
+    }
+    if (!stat.isFile()) return { label: "a file that is not a regular file" };
+    files += 1;
+    const bytes = readFileSync(at);
+    if (COMPRESSED.some((magic) => bytes.subarray(0, magic.length).equals(magic))) {
+      return { label: "a compressed file, whose bytes the scan cannot read" };
+    }
+    return judge(Buffer.from(name, "utf8")) ?? judge(bytes);
+  };
+  for (const line of entries) {
+    const entry = line.trim();
+    if (entry === "") continue;
+    if (entry.startsWith("!") || /[*?[\]{}]/.test(entry)) return withhold("a glob or exclude pattern, which the scan cannot follow");
+    let exists = true;
+    try {
+      lstatSync(entry);
+    } catch {
+      exists = false;
+    }
+    // A missing path uploads nothing; the upload's if-no-files-found decides it.
+    if (!exists) continue;
+    const hit = walk(entry, lstatSync(entry).isDirectory() ? "" : path.basename(entry));
+    if (hit) return { withheld: hit, warned, files };
+  }
+  return { withheld: null, warned, files };
+}
+
+export function main(env = process.env) {
+  const entries = String(env.SCAN_PATHS ?? "").split(/\r?\n/);
+  let result;
+  try {
+    result = scanPaths(entries);
+  } catch (error) {
+    result = { withheld: { label: `no finished scan (${error.name})`, credential: false }, warned: false, files: 0 };
+  }
+  const { withheld, warned, files } = result;
+  if (withheld) {
+    process.stdout.write(
+      `::error::scan-upload: ${withheld.label}; nothing is uploaded${withheld.credential ? ". Rotate this credential" : ""}\n`,
+    );
+    return 1;
+  }
+  if (warned) process.stdout.write(`::warning::scan-upload: ${WARN_ONLY} in an upload file; not blocking, check it is no real credential\n`);
+  if (env.GITHUB_OUTPUT) appendFileSync(env.GITHUB_OUTPUT, "clean=true\n");
+  process.stdout.write(`scan-upload: ${files} file(s) clean\n`);
+  return 0;
+}
+
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  process.exitCode = main();
+}

.github/actions/scan-upload/scan-upload.test.mjs

@@ -0,0 +1,94 @@
+import assert from "node:assert/strict";
+import { spawnSync } from "node:child_process";
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { test } from "node:test";
+import { gzipSync } from "node:zlib";
+
+const HERE = import.meta.dirname;
+const SCRIPT = path.join(HERE, "scan-upload.mjs");
+// Built at run time, so no tracked file holds a credential shape: a GitHub
+// token prefix and 36 letters spelling FAKE, never a live token.
+const PLANTED = ["gh", "p_", "FAKE".repeat(9)].join("");
+
+function workDir(t) {
+  const dir = mkdtempSync(path.join(tmpdir(), "scan-upload-"));
+  t.after(() => rmSync(dir, { recursive: true, force: true }));
+  return dir;
+}
+
+function run(dir, paths) {
+  const output = path.join(dir, "github-output");
+  writeFileSync(output, "");
+  const result = spawnSync(process.execPath, [SCRIPT], {
+    env: { PATH: process.env.PATH, SCAN_PATHS: paths, GITHUB_OUTPUT: output },
+    encoding: "utf8",
+  });
+  return { ...result, outputs: readFileSync(output, "utf8") };
+}
+
+function withheld(result, label) {
+  assert.equal(result.status, 1, result.stdout + result.stderr);
+  assert.equal(result.outputs, "", "a withheld upload sets no clean output");
+  assert.match(result.stdout, new RegExp(`::error::scan-upload: ${label}`));
+  assert.ok(!result.stdout.includes(PLANTED) && !result.stderr.includes(PLANTED), "the matched value is never printed");
+}
+
+test("clean files pass and set clean=true", (t) => {
+  const dir = workDir(t);
+  mkdirSync(path.join(dir, "out", "nested"), { recursive: true });
+  writeFileSync(path.join(dir, "out", "reply.txt"), "a clean reply\n");
+  writeFileSync(path.join(dir, "out", "nested", "verdict.json"), '{"verdict":"merge"}\n');
+  const result = run(dir, `${path.join(dir, "out")}\n${path.join(dir, "absent.json")}\n`);
+  assert.equal(result.status, 0, result.stdout + result.stderr);
+  assert.equal(result.outputs, "clean=true\n");
+  assert.match(result.stdout, /2 file\(s\) clean/);
+});
+
+test("a planted credential withholds the upload and asks for rotation, never printing the value", (t) => {
+  const dir = workDir(t);
+  mkdirSync(path.join(dir, "out"));
+  writeFileSync(path.join(dir, "out", "clean.txt"), "nothing here\n");
+  writeFileSync(path.join(dir, "out", "handoff.json"), `{"review":"token ${PLANTED} in the text"}\n`);
+  const result = run(dir, path.join(dir, "out"));
+  withheld(result, "GitHub token; nothing is uploaded");
+  assert.match(result.stdout, /Rotate this credential/);
+});
+
+test("a credential in a file name withholds the upload", (t) => {
+  const dir = workDir(t);
+  mkdirSync(path.join(dir, "out"));
+  writeFileSync(path.join(dir, "out", `${PLANTED}.txt`), "clean bytes\n");
+  withheld(run(dir, path.join(dir, "out")), "GitHub token");
+});
+
+test("a link, a compressed file and a glob each withhold the upload", (t) => {
+  const dir = workDir(t);
+  writeFileSync(path.join(dir, "target.txt"), "clean\n");
+  symlinkSync(path.join(dir, "target.txt"), path.join(dir, "link.txt"));
+  withheld(run(dir, path.join(dir, "link.txt")), "a link");
+  writeFileSync(path.join(dir, "trace.gz"), gzipSync(Buffer.from(PLANTED)));
+  withheld(run(dir, path.join(dir, "trace.gz")), "a compressed file");
+  withheld(run(dir, path.join(dir, "*.txt")), "a glob or exclude pattern");
+  withheld(run(dir, `!${path.join(dir, "target.txt")}`), "a glob or exclude pattern");
+});
+
+test("the broad assignment label only warns", (t) => {
+  const dir = workDir(t);
+  // Joined at run time, so no tracked line reads as a password assignment.
+  writeFileSync(path.join(dir, "fixture.txt"), `${["pass", "word"].join("")} = "not-a-real-one"\n`);
+  const result = run(dir, path.join(dir, "fixture.txt"));
+  assert.equal(result.status, 0, result.stdout + result.stderr);
+  assert.equal(result.outputs, "clean=true\n");
+  assert.match(result.stdout, /::warning::scan-upload: password or secret assignment/);
+});
+
+test("the lane transcript is scanned as plaintext before it is sealed", () => {
+  const action = readFileSync(path.join(HERE, "..", "upload-lane-transcript", "action.yml"), "utf8");
+  const scan = action.indexOf("id: scan\n");
+  const seal = action.indexOf("id: seal\n");
+  assert.ok(scan > 0 && scan < seal, "the scan step comes before the seal step");
+  assert.match(action, /SCAN_PATHS: \$\{\{ inputs\.execution-file \}\}\n\s+run: node "\$GITHUB_ACTION_PATH\/\.\.\/scan-upload\/scan-upload\.mjs"/);
+  assert.match(action, /id: seal\n\s+if: steps\.scan\.outputs\.clean == 'true'\n/);
+});

.github/actions/upload-lane-transcript/action.yml

@@ -5,7 +5,9 @@ description: >
   and job-id, and upload only the sealed file as a 7-day artifact for the
   transcript puller. An empty public key skips with a notice; a missing or
   empty execution file uploads nothing; a malformed key or job-id fails the
-  step. Needs node 18 or later on PATH and ../seal-lane-output beside it.
+  step. The plaintext is scanned first (../scan-upload), and a credential in
+  it fails the step with nothing sealed. Needs node 18 or later on PATH,
+  ../seal-lane-output and ../scan-upload beside it, and lib/publish-gate.mjs.
 
 inputs:
   execution-file:
@@ -21,8 +23,18 @@ inputs:
 runs:
   using: composite
   steps:
+    # The plaintext, before the seal: the sealed upload is ciphertext, which
+    # no scan can read. A hit fails here and nothing is sealed or uploaded.
+    - name: Scan the transcript for credentials
+      id: scan
+      shell: bash
+      env:
+        SCAN_PATHS: ${{ inputs.execution-file }}
+      run: node "$GITHUB_ACTION_PATH/../scan-upload/scan-upload.mjs"
+
     - name: Seal the transcript
       id: seal
+      if: steps.scan.outputs.clean == 'true'
       shell: bash
       env:
         EXECUTION_FILE: ${{ inputs.execution-file }}