 Vince Lozada
|
732ab95906
|
security: address HIGH/MEDIUM findings from skills.sh audit (#35)
* security: address HIGH/MEDIUM findings from skills.sh audit
- Remove eval from mr-review-workflow.sh; add command allowlist
- Replace direct config file parsing with glab auth token in add-inline-comment.sh
- Add external content boundary markers to create-mr-from-issue.sh and ci-debug.sh
- Add private key upload warning to glab-ssh-key/SKILL.md
- Add prompt injection warnings to glab-api, glab-ci, glab-job SKILL.md files
- Add SECURITY.md with full security policy and guidance
Fixes #34
* chore: exclude SECURITY.md from zip export
---------
Co-authored-by: Steven (Bot) <steven@winkintel.com>
|
2026-03-04 19:41:38 -06:00 |
|
|
Vince Lozada
|
06042234cb
|
Add inline comment automation for MR code reviews (#27)
* Add inline comment automation script
- Add glab-add-inline-comment.sh for posting inline MR comments
- Posts comments at specific file:line locations via GitLab API
- Auto-extracts token and fetches MR metadata
- Validates inline placement (DiffNote type)
- Add comprehensive documentation (README-inline-comments.md)
- Update scripts/README.md with new script listing
Closes #26
* Rename script: glab-add-inline-comment.sh → add-inline-comment.sh
Drop glab- prefix per review feedback.
- Rename scripts/glab-add-inline-comment.sh to scripts/add-inline-comment.sh
- Update all references in documentation (README.md, README-inline-comments.md)
- Update usage examples and command names
---------
Co-authored-by: Steven (Bot) <steven@winkintel.com>
|
2026-02-23 16:50:48 -06:00 |
|