rodin/review-bot
2
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 6 Wiki Activity

feat(action): derive binary name from uname for multi-arch support (#124) #127

Merged
rodin merged 2 commits from issue-124 into main 2026-05-14 05:53:16 +00:00
Conversation 10 Commits 2 Files Changed 1
+7 -2
1 changed files with 7 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit f8b9d7d282 - Show all commits
.gitea/actions/review/action.yml
+6 -1
View File
3
 @@ -173,8 +173,13 @@ runs:
security-review-bot commented 2026-05-14 05:49:46 +00:00
Review
Copy Link
Copy Source

[MINOR] Integrity check relies on checksums.txt fetched from the same remote as the binary (derived from user-controllable inputs gitea-url/repo). A malicious input could point to an attacker-controlled host serving both a forged binary and matching checksum, defeating the verification. Consider pinning allowed hosts/repos, enforcing HTTPS, and verifying signed checksums or comparing hashes against a trusted source.

**[MINOR]** Integrity check relies on checksums.txt fetched from the same remote as the binary (derived from user-controllable inputs gitea-url/repo). A malicious input could point to an attacker-controlled host serving both a forged binary and matching checksum, defeating the verification. Consider pinning allowed hosts/repos, enforcing HTTPS, and verifying signed checksums or comparing hashes against a trusted source.
# Verify SHA-256 checksum
sonnet-review-bot commented 2026-05-14 05:46:25 +00:00
Review
Copy Link
Copy Source

[NIT] The checksum regex [[:xdigit:]]+[[:space:]]+\*?${BINARY}$ does not anchor the hex portion to the start of the line (^). A line like somejunk abc123 review-bot-linux-arm64 would not match (awk would still grab field 1), but the intent of exact matching is clearer with ^[[:xdigit:]]. Minor defensive concern only.

**[NIT]** The checksum regex `[[:xdigit:]]+[[:space:]]+\*?${BINARY}$` does not anchor the hex portion to the start of the line (`^`). A line like `somejunk abc123 review-bot-linux-arm64` would not match (awk would still grab field 1), but the intent of exact matching is clearer with `^[[:xdigit:]]`. Minor defensive concern only.
cd "${{ runner.temp }}"
gpt-review-bot commented 2026-05-14 05:47:20 +00:00
Review
Copy Link
Copy Source

[MINOR] The checksum grep pattern anchors the end of the line but not the start. Consider anchoring with ^ as well to reduce any risk of matching unintended lines if the checksums format changes.

**[MINOR]** The checksum grep pattern anchors the end of the line but not the start. Consider anchoring with `^` as well to reduce any risk of matching unintended lines if the checksums format changes.
EXPECTED=$(grep -E "[[:xdigit:]]+[[:space:]]+\*?${BINARY}$" checksums.txt | awk '{print $1}')
EXPECTED=$(grep -E "^[[:xdigit:]]+[[:space:]]+\*?${BINARY}$" checksums.txt | awk '{print $1}')
gpt-review-bot commented 2026-05-14 05:47:20 +00:00
Outdated
Review
Copy Link
Copy Source

[MAJOR] Checksum computation uses sha256sum, which is not present by default on macOS. On darwin runners, ACTUAL=$(sha256sum review-bot | awk '{print $1}') will fail, breaking the install step on a supported platform.

**[MAJOR]** Checksum computation uses `sha256sum`, which is not present by default on macOS. On darwin runners, `ACTUAL=$(sha256sum review-bot | awk '{print $1}')` will fail, breaking the install step on a supported platform.
# sha256sum (GNU) is not available on macOS; use shasum -a 256 on darwin.
if [ "${{ steps.version.outputs.os }}" = "darwin" ]; then
ACTUAL=$(shasum -a 256 review-bot | awk '{print $1}')
else
ACTUAL=$(sha256sum review-bot | awk '{print $1}')
fi
if [ -z "$EXPECTED" ]; then
echo "Error: no checksum found for ${BINARY}" >&2