3993d0583e
Addresses security concerns from OWASP audit and CodeQL by enforcing strict host key verification and TLS certificate verification. Security Changes: - Enforced strict SSH host key checking in pkg/container and devops. - Removed insecure SSH host key verification from pkg/ansible. - Added synchronous host key discovery during VM boot using ssh-keyscan. - Updated UniFi client to enforce TLS certificate verification by default. - Added --insecure flag and config option for UniFi to allow opt-in to skipping TLS verification for self-signed certificates. CI and Maintenance: - Fixed auto-merge workflow by providing repository context to 'gh' command. - Resolved merge conflicts in .github/workflows/auto-merge.yml. - Added unit tests for secured Ansible SSH client. - Fixed formatting issues identified by QA checks.
48 lines
1.5 KiB
YAML
48 lines
1.5 KiB
YAML
name: Auto Merge
|
|
|
|
on:
|
|
pull_request:
|
|
types: [opened, reopened, ready_for_review]
|
|
|
|
permissions:
|
|
contents: write
|
|
pull-requests: write
|
|
|
|
jobs:
|
|
merge:
|
|
runs-on: ubuntu-latest
|
|
if: github.event.pull_request.draft == false
|
|
steps:
|
|
- name: Enable auto-merge
|
|
uses: actions/github-script@v7
|
|
env:
|
|
PR_NUMBER: ${{ github.event.pull_request.number }}
|
|
with:
|
|
github-token: ${{ secrets.GITHUB_TOKEN }}
|
|
script: |
|
|
const author = context.payload.pull_request.user.login;
|
|
const association = context.payload.pull_request.author_association;
|
|
|
|
// Trusted bot accounts (act as org members)
|
|
const trustedBots = ['google-labs-jules[bot]'];
|
|
const isTrustedBot = trustedBots.includes(author);
|
|
|
|
// Check author association from webhook payload
|
|
const trusted = ['MEMBER', 'OWNER', 'COLLABORATOR'];
|
|
if (!isTrustedBot && !trusted.includes(association)) {
|
|
core.info(`${author} is ${association} — skipping auto-merge`);
|
|
return;
|
|
}
|
|
|
|
try {
|
|
await exec.exec('gh', [
|
|
'pr', 'merge', process.env.PR_NUMBER,
|
|
'--auto',
|
|
'--merge',
|
|
'-R', `${context.repo.owner}/${context.repo.repo}`
|
|
]);
|
|
core.info(`Auto-merge enabled for #${process.env.PR_NUMBER}`);
|
|
} catch (error) {
|
|
core.error(`Failed to enable auto-merge: ${error.message}`);
|
|
throw error;
|
|
}
|