mirror of
https://github.com/aws/agent-toolkit-for-aws.git
synced 2026-09-14 14:30:26 +08:00
anasstahr
4f0e97be31
* ci: add frontmatter allowlist check for SKILL.md files Automatically closes PRs that contain disallowed frontmatter fields in SKILL.md. Only name, version, and description are permitted in the public repo. * fix: pin action hashes, broaden SKILL.md path, add persist-credentials: false Addresses review feedback: - Pin actions/checkout and actions/github-script to commit hashes - Match any SKILL.md file, not just under skills/ - Add persist-credentials: false to mitigate pull_request_target risk * refactor: use GitHub API instead of checkout to eliminate CodeQL alert Replace actions/checkout with GitHub API calls (listFiles + getContent) to read SKILL.md frontmatter. No untrusted code ever touches the runner filesystem, fully resolving the CodeQL "Checkout of untrusted code in a privileged context" finding. * fix: switch from allowlist to denylist for frontmatter check Use a denylist of internal-only fields (owner_team, owner_cti, stages) instead of an allowlist. The public repo legitimately uses metadata, allowed-tools, and argument-hint which the allowlist was rejecting. * fix: use owner_ prefix match instead of enumerating owner fields * fix: add retries for transient API failures