cf63e0d2f7
This commit addresses the OWASP security audit by enforcing strict host key verification and resolves persistent CI issues. Security Changes: - Replaced StrictHostKeyChecking=accept-new with yes in pkg/container and devops. - Removed insecure host key verification from pkg/ansible. - Implemented synchronous host key discovery using ssh-keyscan during VM boot. - Updated Boot lifecycle to wait for host key verification. - Handled missing known_hosts file in pkg/ansible. - Refactored hardcoded SSH port to DefaultSSHPort constant. CI and Maintenance: - Fixed auto-merge.yml by inlining the script and adding repository context to 'gh' command, resolving the "not a git repository" error in CI. - Resolved merge conflicts in .github/workflows/auto-merge.yml with dev branch. - Added pkg/ansible/ssh_test.go for SSH client verification. - Fixed formatting in pkg/io/local/client.go to pass QA checks.
48 lines
1.5 KiB
YAML
48 lines
1.5 KiB
YAML
name: Auto Merge
|
|
|
|
on:
|
|
pull_request:
|
|
types: [opened, reopened, ready_for_review]
|
|
|
|
permissions:
|
|
contents: write
|
|
pull-requests: write
|
|
|
|
jobs:
|
|
merge:
|
|
runs-on: ubuntu-latest
|
|
if: github.event.pull_request.draft == false
|
|
steps:
|
|
- name: Enable auto-merge
|
|
uses: actions/github-script@v7
|
|
env:
|
|
PR_NUMBER: ${{ github.event.pull_request.number }}
|
|
with:
|
|
github-token: ${{ secrets.GITHUB_TOKEN }}
|
|
script: |
|
|
const author = context.payload.pull_request.user.login;
|
|
const association = context.payload.pull_request.author_association;
|
|
|
|
// Trusted bot accounts (act as org members)
|
|
const trustedBots = ['google-labs-jules[bot]'];
|
|
const isTrustedBot = trustedBots.includes(author);
|
|
|
|
// Check author association from webhook payload
|
|
const trusted = ['MEMBER', 'OWNER', 'COLLABORATOR'];
|
|
if (!isTrustedBot && !trusted.includes(association)) {
|
|
core.info(`${author} is ${association} — skipping auto-merge`);
|
|
return;
|
|
}
|
|
|
|
try {
|
|
await exec.exec('gh', [
|
|
'pr', 'merge', process.env.PR_NUMBER,
|
|
'--auto',
|
|
'--merge',
|
|
'-R', `${context.repo.owner}/${context.repo.repo}`
|
|
]);
|
|
core.info(`Auto-merge enabled for #${process.env.PR_NUMBER}`);
|
|
} catch (error) {
|
|
core.error(`Failed to enable auto-merge: ${error.message}`);
|
|
throw error;
|
|
}
|