mirror of
https://github.com/Screenly/Anthias.git
synced 2026-07-30 09:15:51 -04:00
9429dade5d
Two legitimate findings from a shoulder.dev security scan (the rest of that report triaged as false positives). - .github/workflows/marketing-screenshots.yaml — drop the workflow_dispatch `inputs.ref`. The GH UI's "Use workflow from" picker already sets github.ref for operator-triggered runs, so the explicit input only added capability to API callers: a stolen GITHUB_TOKEN with actions:write could dispatch this workflow against an attacker-supplied SHA / fork ref and execute it on a runner. Checkout now defaults to github.ref with no `ref:` override. - src/anthias_common/device_helper.py — replace `except Exception: pass` in parse_cpu_info with an explicit split-length guard + continue. Also fixes a latent bug: under the old fall-through, a colon-less line whose token matched a captured key (Serial/Hardware/Revision/Model) recorded the previous line's stale `value`. Adds a regression test. - .gitignore — shoulder.dev's local cache directory. Supersedes and takes over the stale worktree-branch PR (opened 2026-05; all three findings still present on master). Reimplemented against current master (the checkout action has since advanced to v7.0.1). Claude-Session: https://claude.ai/code/session_01HJ3ucEkn62cbgPoisAZ5LQ Co-authored-by: vpetersson-bot <307551610+vpetersson-bot@users.noreply.github.com> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>