mirror of
https://github.com/garrytan/gstack.git
synced 2026-06-20 16:50:08 +02:00
Garry Tan
dd4dd9e1f5
- /ship: scan the composed PR body + title before create AND edit, from a temp file (exact bytes scanned = bytes sent). HIGH blocks the PR (no skip); MEDIUM confirms per finding. Codex/Greptile/eval sections go in tool-attributed fences so example credentials those tools quote WARN-degrade instead of blocking the PR — a live-format credential inside the fence still blocks. - /document-release: scan the PR-body temp file before gh pr edit. - /document-generate: scan the staged doc diff (added lines) before commit — generated docs often carry example credentials; a live-format secret blocks. Tests: ship-template-redaction (incl. tool-fence WARN-degrade contract), document-skills-redaction. All skills stay under the v1.47 size budget. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
38 lines
1.4 KiB
TypeScript
38 lines
1.4 KiB
TypeScript
/**
|
|
* /document-release + /document-generate redaction wiring (T6/T7).
|
|
*/
|
|
import { describe, test, expect } from "bun:test";
|
|
import * as fs from "fs";
|
|
import * as path from "path";
|
|
|
|
const ROOT = path.resolve(import.meta.dir, "..");
|
|
const RELEASE = fs.readFileSync(path.join(ROOT, "document-release", "SKILL.md.tmpl"), "utf-8");
|
|
const GENERATE = fs.readFileSync(path.join(ROOT, "document-generate", "SKILL.md.tmpl"), "utf-8");
|
|
|
|
describe("/document-release redaction", () => {
|
|
test("scans the PR-body temp file before gh pr edit", () => {
|
|
const scanIdx = RELEASE.indexOf("gstack-redact --from-file /tmp/gstack-pr-body");
|
|
const editIdx = RELEASE.indexOf("gh pr edit --body-file /tmp/gstack-pr-body");
|
|
expect(scanIdx).toBeGreaterThan(-1);
|
|
expect(editIdx).toBeGreaterThan(scanIdx);
|
|
});
|
|
test("HIGH blocks the edit", () => {
|
|
expect(RELEASE).toMatch(/exit 3 \(HIGH\).*do NOT edit/i);
|
|
});
|
|
});
|
|
|
|
describe("/document-generate redaction", () => {
|
|
test("scans staged doc diff before commit", () => {
|
|
const scanIdx = GENERATE.indexOf("gstack-redact --repo-visibility");
|
|
const commitIdx = GENERATE.indexOf("git commit -m");
|
|
expect(scanIdx).toBeGreaterThan(-1);
|
|
expect(commitIdx).toBeGreaterThan(scanIdx);
|
|
});
|
|
test("scans added lines of the staged diff", () => {
|
|
expect(GENERATE).toMatch(/git diff --cached[\s\S]{0,80}gstack-redact/);
|
|
});
|
|
test("HIGH blocks the commit", () => {
|
|
expect(GENERATE).toMatch(/Do NOT commit/i);
|
|
});
|
|
});
|