stackchain/timmy-talking-turd
1
0
Fork 0
Code Issues 41 Pull Requests 6 Actions Packages Projects Releases 15 Wiki Activity

Harden image ingress: magic bytes, re-encode, limits, metadata stripping, rate control #63

Open
rockachopa wants to merge 4 commits from free/hy3-timmy-16 into main
pull from: free/hy3-timmy-16
merge into: stackchain:main
Conversation 1 Commits 4 Files Changed 49 +2 -1
2 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit 643f774c78 - Show all commits

2
.gitea/workflows/quality.yml
View File

@ -64,6 +64,6 @@ jobs:
npm run check:syntax
node --check tests/staging.acceptance.mjs
- name: Image runtime pin and re-encode smoke
run: python3 -c "import importlib.util,json,pathlib; s=importlib.util.spec_from_file_location('d','scripts/deploy_staging.py'); m=importlib.util.module_from_spec(s); s.loader.exec_module(m); print(json.dumps(m.verify_image_runtime(pathlib.Path('.'))))"
run: python3 -c "import importlib.util,json,pathlib,sys; s=importlib.util.spec_from_file_location('d','scripts/deploy_staging.py'); m=importlib.util.module_from_spec(s); sys.modules[s.name]=m; s.loader.exec_module(m); print(json.dumps(m.verify_image_runtime(pathlib.Path('.'))))"
- name: Diff hygiene
run: npm run check:diff

1
tests/ci-workflow.test.js
View File

@ -20,6 +20,7 @@ test('Gitea CI gates pull requests and main with the reproducible quality suite'
assert.match(workflow, /uses: actions\/setup-python@v5/);
assert.match(workflow, /python-version: ['"]3\.11['"]/);
assert.match(workflow, /TIMMY_PYTHON=.*sys\.executable/);
assert.match(workflow, /sys\.modules\[s\.name\]=m/);
assert.match(workflow, /npm test/);
assert.match(workflow, /npm run test:ui/);
assert.match(workflow, /npm run test:photo/);