fix(security): command-mode bypass-reason, run timeout, env-file paths - #45
Merged
Conversation
Avoid shadowing Run named return in requireBypassReason. Command mode now accepts --bypass-reason= as a real flag so it is not treated as the remote command. The explicit-force E2E now supplies a reason. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Follow-up from a v0.5.0 /
2df64c3review. This PR is onreview/docs-and-guardrails-v2(cut frommain) so the tree stays compile-clean.0.5.x+ N-10.4.x. Vulnerability reports go to GitHub Security Advisories / private reporting (no invented email).--force/--no-safety-checknow require a non-empty--bypass-reason, matchingsshx run. The flag is lifted from argv inRun()so it is not treated as the start of the remote command.sshx runcommand timeout: defaults to 60s when--timeout/SSH_TIMEOUTare unset. SSH dial timeout is unchanged (30s).--db-cred-from=env-file:: requires an absolute remote path and rejects..segments.docker:sources are unchanged.Test plan
go test ./internal/app/ ./internal/sqlsafe/go test -short ./...sshx -h=host --json --force --no-audit "sudo reboot"returnserror_kind=configmentioning--bypass-reasonsshx -h=host --force --bypass-reason="maintenance reboot" --dry-run --json "sudo reboot"is not a config errorsshx run --target=prod-web --dry-run --json -- uptimeshows a 60s command timeoutenv-file:/opt/app/.envstill parses andenv-file:../.env/env-file:/tmp/../.envare rejectedFollow-ups
.github/workflows/ci.ymlcould not be updated (GitHub token lacks theworkflowscope; Contents/Git Data APIs return 404). Intended change: pinsecurego/gosec@v2.28.0, keep SARIF./...observational (-no-fail), and add a failing gate oninternal/sshclient,internal/sqlsafe,internal/app.go.mod1.25.13); CHANGELOG[Unreleased]still points atv0.4.1...HEADand needs av0.5.0compare link.docs/security-guidelines.mdshould show--force --bypass-reason=.Note
Please ignore / delete branch
review/docs-and-guardrailsif it exists. An earlier attempt accidentally truncatedinternal/sshclient/client.go. This v2 branch does not touch that file.