Repository navigation
docs: record 2026-11-11 issue, security and dead-code sweep - #448
cursor[bot] wants to merge 2 commits into
Conversation
审查者指南实现扩展 live-pin 检查器，要求 BUILD_PROMPT.md 和两个可复用工作流都与当前源代码 gitlink 一致。
配置将发布工作流中可复用工作流的引用更新为新的源代码提交，以便 CI 使用固定版本的实现。
文档同步构建提示、依赖记录、验证索引，以及英文和俄文 README 中的源代码固定版本，使其与当前实现和发布版本一致。
记录问题状态、安全性和死代码审查，包括说明为何 #447 无需新的面板集成，以及为何 #436 和 #440 仍保持开放。
测试添加回归测试，确保过时的 BUILD_PROMPT 和可复用工作流固定版本会被拒绝。
锁定文件和 vendored 代码将实现子模块的 gitlink 更新至更新后的固定版本和文档所引用的源代码提交。
提示和命令与 Sourcery 交互
自定义使用体验访问你的控制面板，即可：
获取帮助Original review guide in EnglishReviewer's GuideImplementationExtend the live-pin checker to require BUILD_PROMPT.md and both reusable workflows to match the current source gitlink.
ConfigurationUpdate the release workflow’s reusable workflow references to the new source commit so CI uses the pinned implementation.
DocumentationSynchronize the build prompt, dependency record, verification index, and English and Russian README source pins with the current implementation and release.
Record the issue-status, security, and dead-code review, including why #447 needs no new panel integration and #436 and #440 remain open.
TestsAdd regression coverage that rejects stale BUILD_PROMPT and reusable workflow pins.
Lock files and vendored codeAdvance the implementation submodule gitlink to the source commit referenced by the updated pins and documentation.
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
嘿——我发现了 2 个问题
Prompt for AI Agents
Please address the comments from this code review:
## Individual Comments
### Comment 1
<location path="scripts/check-recipes.py" line_range="51" />
<code_context>
raise ValueError("DEPENDENCIES.md does not record the current source gitlink")
if gitlink not in readme:
raise ValueError("README.md does not record the current source gitlink")
+ if gitlink not in prompt:
+ raise ValueError("BUILD_PROMPT.md does not record the current source gitlink")
+ for workflow_name in ("exec.yml", "android-kernelsu-acceptance.yml"):
</code_context>
<issue_to_address>
**Stale pins pass validation**
When the live BUILD_PROMPT pin or reusable-workflow `uses` value is stale while the expected gitlink appears elsewhere in that file, `verify_live_pins` accepts the substring match, so `recipe-check` passes with stale build instructions or CI invoking an older reusable workflow.
Parse the authoritative BUILD_PROMPT field and validate each actual reusable-workflow `uses` value against the current gitlink.
Also at `scripts/check-recipes.py:54-57`.
</issue_to_address>
### Comment 2
<location path="scripts/test-check-recipes.py" line_range="81-82" />
<code_context>
+ def test_stale_build_prompt_gitlink_is_rejected(self):
+ path = self.root / "recipes" / "magicnet" / "BUILD_PROMPT.md"
+ path.write_text(path.read_text().replace(GITLINK, OTHER))
+ with self.assertRaisesRegex(ValueError, "BUILD_PROMPT.md"):
+ CHECK.verify_live_pins(self.root)
+
+ def test_stale_reusable_workflow_pin_is_rejected(self):
+ path = self.root / ".github" / "workflows" / "release.yml"
+ path.write_text(path.read_text().replace(GITLINK, OTHER))
+ with self.assertRaisesRegex(ValueError, "release.yml reusable exec.yml"):
+ CHECK.verify_live_pins(self.root)
+
</code_context>
<issue_to_address>
**Acceptance pin drift goes unnoticed**
When acceptance-workflow pin validation is removed or broken, `test_stale_reusable_workflow_pin_is_rejected` replaces both workflow SHAs at line 81, then only asserts the `exec.yml` error at line 82. If the checker stops validating the acceptance workflow pin, the stale `exec.yml` pin still raises first and the test passes.
Add a case that changes only the acceptance workflow pin and asserts that it is rejected.
</issue_to_address>Sourcery 评估
等待批准。 请先处理 2 项发现。
阻塞性发现：scripts/check-recipes.py:51、scripts/test-check-recipes.py:82
Original comment in English
Hey - I've found 2 issues
Prompt for AI Agents
Please address the comments from this code review:
## Individual Comments
### Comment 1
<location path="scripts/check-recipes.py" line_range="51" />
<code_context>
raise ValueError("DEPENDENCIES.md does not record the current source gitlink")
if gitlink not in readme:
raise ValueError("README.md does not record the current source gitlink")
+ if gitlink not in prompt:
+ raise ValueError("BUILD_PROMPT.md does not record the current source gitlink")
+ for workflow_name in ("exec.yml", "android-kernelsu-acceptance.yml"):
</code_context>
<issue_to_address>
**Stale pins pass validation**
When the live BUILD_PROMPT pin or reusable-workflow `uses` value is stale while the expected gitlink appears elsewhere in that file, `verify_live_pins` accepts the substring match, so `recipe-check` passes with stale build instructions or CI invoking an older reusable workflow.
Parse the authoritative BUILD_PROMPT field and validate each actual reusable-workflow `uses` value against the current gitlink.
Also at `scripts/check-recipes.py:54-57`.
</issue_to_address>
### Comment 2
<location path="scripts/test-check-recipes.py" line_range="81-82" />
<code_context>
+ def test_stale_build_prompt_gitlink_is_rejected(self):
+ path = self.root / "recipes" / "magicnet" / "BUILD_PROMPT.md"
+ path.write_text(path.read_text().replace(GITLINK, OTHER))
+ with self.assertRaisesRegex(ValueError, "BUILD_PROMPT.md"):
+ CHECK.verify_live_pins(self.root)
+
+ def test_stale_reusable_workflow_pin_is_rejected(self):
+ path = self.root / ".github" / "workflows" / "release.yml"
+ path.write_text(path.read_text().replace(GITLINK, OTHER))
+ with self.assertRaisesRegex(ValueError, "release.yml reusable exec.yml"):
+ CHECK.verify_live_pins(self.root)
+
</code_context>
<issue_to_address>
**Acceptance pin drift goes unnoticed**
When acceptance-workflow pin validation is removed or broken, `test_stale_reusable_workflow_pin_is_rejected` replaces both workflow SHAs at line 81, then only asserts the `exec.yml` error at line 82. If the checker stops validating the acceptance workflow pin, the stale `exec.yml` pin still raises first and the test passes.
Add a case that changes only the acceptance workflow pin and asserts that it is rejected.
</issue_to_address>Sourcery assessment
Approval pending. 2 findings to address first.
Blocking findings: scripts/check-recipes.py:51, scripts/test-check-recipes.py:82
| raise ValueError("DEPENDENCIES.md does not record the current source gitlink") | ||
| if gitlink not in readme: | ||
| raise ValueError("README.md does not record the current source gitlink") | ||
| if gitlink not in prompt: |
There was a problem hiding this comment.
🟡 Medium · 过期的固定版本仍能通过验证
如果当前的 BUILD_PROMPT 固定版本或可复用工作流的 uses 值已过期，但预期的 gitlink 出现在该文件的其他位置，verify_live_pins 就会接受子字符串匹配，因此 recipe-check 会在构建说明已过期或 CI 调用旧版可复用工作流的情况下通过。
解析权威的 BUILD_PROMPT 字段，并根据当前 gitlink 验证每个实际的可复用工作流 uses 值。
另请检查 scripts/check-recipes.py:54-57。
给 AI 代理的提示
在 `scripts/check-recipes.py` 第 51 行：
**过期的固定版本仍能通过验证**
如果当前的 BUILD_PROMPT 固定版本或可复用工作流的 `uses` 值已过期，但预期的 gitlink 出现在该文件的其他位置，`verify_live_pins` 就会接受子字符串匹配，因此 `recipe-check` 会在构建说明已过期或 CI 调用旧版可复用工作流的情况下通过。
解析权威的 BUILD_PROMPT 字段，并根据当前 gitlink 验证每个实际的可复用工作流 `uses` 值。
另请检查 `scripts/check-recipes.py:54-57`。Original comment in English
🟡 Medium · Stale pins pass validation
When the live BUILD_PROMPT pin or reusable-workflow uses value is stale while the expected gitlink appears elsewhere in that file, verify_live_pins accepts the substring match, so recipe-check passes with stale build instructions or CI invoking an older reusable workflow.
Parse the authoritative BUILD_PROMPT field and validate each actual reusable-workflow uses value against the current gitlink.
Also at scripts/check-recipes.py:54-57.
Prompt for AI agents
In `scripts/check-recipes.py` at line 51:
**Stale pins pass validation**
When the live BUILD_PROMPT pin or reusable-workflow `uses` value is stale while the expected gitlink appears elsewhere in that file, `verify_live_pins` accepts the substring match, so `recipe-check` passes with stale build instructions or CI invoking an older reusable workflow.
Parse the authoritative BUILD_PROMPT field and validate each actual reusable-workflow `uses` value against the current gitlink.
Also at `scripts/check-recipes.py:54-57`.| path.write_text(path.read_text().replace(GITLINK, OTHER)) | ||
| with self.assertRaisesRegex(ValueError, "release.yml reusable exec.yml"): |
There was a problem hiding this comment.
🟡 Medium · 验收工作流固定版本偏移未被发现
如果验收工作流固定版本的验证被移除或遭到破坏，test_stale_reusable_workflow_pin_is_rejected 会在第 81 行替换两个工作流 SHA，然后只在第 82 行断言 exec.yml 错误。如果检查器不再验证验收工作流固定版本，过期的 exec.yml 固定版本仍会先触发错误，导致测试通过。
添加一个仅更改验收工作流固定版本并断言其会被拒绝的测试用例。
给 AI 代理的提示
在 `scripts/test-check-recipes.py` 第 81-82 行：
**验收工作流固定版本偏移未被发现**
如果验收工作流固定版本的验证被移除或遭到破坏，`test_stale_reusable_workflow_pin_is_rejected` 会在第 81 行替换两个工作流 SHA，然后只在第 82 行断言 `exec.yml` 错误。如果检查器不再验证验收工作流固定版本，过期的 `exec.yml` 固定版本仍会先触发错误，导致测试通过。
添加一个仅更改验收工作流固定版本并断言其会被拒绝的测试用例。Original comment in English
🟡 Medium · Acceptance pin drift goes unnoticed
When acceptance-workflow pin validation is removed or broken, test_stale_reusable_workflow_pin_is_rejected replaces both workflow SHAs at line 81, then only asserts the exec.yml error at line 82. If the checker stops validating the acceptance workflow pin, the stale exec.yml pin still raises first and the test passes.
Add a case that changes only the acceptance workflow pin and asserts that it is rejected.
Prompt for AI agents
In `scripts/test-check-recipes.py` at lines 81-82:
**Acceptance pin drift goes unnoticed**
When acceptance-workflow pin validation is removed or broken, `test_stale_reusable_workflow_pin_is_rejected` replaces both workflow SHAs at line 81, then only asserts the `exec.yml` error at line 82. If the checker stops validating the acceptance workflow pin, the stale `exec.yml` pin still raises first and the test passes.
Add a case that changes only the acceptance workflow pin and asserts that it is rejected.![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
不要合并
本 PR 已与 main 冲突（mergeable=false）。v1.8.7 已把 gitlink 与可复用工作流推进到 dc4433d1cfbeade114d51f3f3c429378d3d7b68d。若合并本分支，会把发布固定点回退到旧 SHA。
有用部分已重新接入当前 main：
BUILD_PROMPT.md配方标题 0.3.21check-recipes.py拒绝 BUILD_PROMPT /release.yml与 gitlink 漂移- 2026-11-12 的 Issue/安全/死代码记录
#436、#440、#447 仍应保持开放；#449 是与 #447 相同的重复申请。
Sent by Cursor Automation: LIght’s Automation
Align reusable workflow pins and BUILD_PROMPT with gitlink
406938e3. Keep #436 and #440 open. Record that #447 is the already-locked zashboard v3.16.0 default, not a new panel. Reject BUILD_PROMPT andrelease.ymllive-pin drift incheck-recipes.py.Local verification:
test-check-recipes.py6 passed,test-release-plan.py37 passed,test-release.py16 passed,check-recipes.py8 packages / 62 Markdown,check-workflows.shpassed. Source workflows at 406938e3 are byte-identical to 9163064; product TUN/NAS work still needs magicnet-android.Sourcery 摘要
同步实时源代码固定版本和发布元数据，记录最新问题与审计发现，并为可复用工作流和构建说明强制执行一致性检查。
Bug 修复：
增强功能：
文档：
测试：
Original summary in English
Sourcery 摘要
同步 MagicNet 的实时源代码引用和发行文档，记录审计结果，并确保构建与发行元数据中的版本固定信息保持一致。
错误修复：
功能增强：
文档：
测试：
Original summary in English
Summary by Sourcery
Synchronize MagicNet’s live source references and release documentation, record audit outcomes, and enforce pin consistency across build and release metadata.
Bug Fixes:
Enhancements:
Documentation:
Tests: