mirror of
https://github.com/dotnet/skills.git
synced 2026-09-20 09:49:54 +08:00
Dan Moseley
64464e87e3
* Add external reference scanner for skill/agent content - PowerShell scanner (eng/reference-scanner/scan.ps1) checks for: - http:// URLs (blocked except localhost and XML namespace URIs) - External <script> tags without SRI integrity attribute - Pipe-to-shell patterns (except dotnet install scripts) - URLs referencing domains not in .github/known-domains.txt - CI workflow runs on PRs and pushes touching skill/agent paths - CONTRIBUTING.md updated with external references policy - README.md: fixed http:// to https:// for agentskills.io Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Move known-domains.txt to eng/reference-scanner/, fix comments, add ollama.com - Moved from .github/ to eng/reference-scanner/ (co-located with scanner) - Updated header comments: errors not informational notices, removed misleading org-scoping language - Added ollama.com (pre-existing reference in dotnet-ai skill) - Updated all references in scan.ps1, CI workflow, CONTRIBUTING.md Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Address PR review feedback - Add ? and # as valid URL terminators in path-scoped domain matching - Strip # from host extraction in Test-KnownDomain and Test-HttpNotHttps - Make script/SRI regex patterns case-insensitive - Emit error finding on file read failure instead of silent skip - Fix help comment (two levels up, not three) - Unify CONTRIBUTING.md error language (all checks are CI-blocking) - Add eng/reference-scanner/** to workflow path triggers Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Add cdn.jsdelivr.net to known-domains (used by dashboard after #331 adds SRI) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Remove cdn.jsdelivr.net from known-domains jsdelivr serves arbitrary npm packages -- keeping it off the allowlist means any use requires both SRI and reviewer approval (two gates). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Skip domain check for scripts with SRI, fix single-line file handling Scripts with integrity attributes are secured by hash -- the domain is irrelevant. This means cdn.jsdelivr.net does not need to be in known-domains.txt as long as SRI is present. Also wrap Get-Content in @() to handle single-line files correctly. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Address round-2 review feedback - Multi-line <script> tag detection: join file content so SRI attributes spanning lines are correctly detected - Safe relative path: use GetRelativePath() with fallback instead of bare Substring that throws for out-of-repo files - Remove dead notice plumbing: all findings are errors now Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Scan only changed files on PRs, full scan on push to main PRs scan only changed .md/.html files so pre-existing issues on main don't block unrelated PRs. Push to main runs the full -All scan. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>