Release/bigfiles 20260530 - #85
Merged
Merged
Conversation
Add support for verifying GitHub user permissions on the LFS batch endpoint. A new GITHUB_MODEL config switch selects between the existing Gitee/GitCode authorization+metadata path and the GitHub authorization +metadata path within the same /objects/batch route. Key changes: - auth: new GitHub auth module with org whitelist and permission check - config: new DefaultGithubToken and GithubModel fields - server: handleBatch dispatches to GitHub or Gitee auth/metadata based on GITHUB_MODEL; IsGithubAuthorized wired through Options - main: register GithubAuth() as IsGithubAuthorized - config.example.yml: document GIT_CODE_SWITCH and GITHUB_MODEL - ignore local coverage and test output artifacts
- gitleaks: replace demo API keys in .ai/skills/local-ci-go/ docs with
low-entropy placeholders (sk-YOUR_API_KEY_HERE), eliminating 5 false
positives from the generic-api-key rule
- bandit: fix command injection in scripts/lfsNameQuery.py force_remove
(B605 HIGH) by removing os.system + f-string; use shutil.which("git")
for subprocess invocations (B607); annotate safe list-args subprocess
calls with # nosec B603/B404
- trivy: upgrade Go 1.24.11 -> 1.26.5 in go.mod / workflow-validation.yml
to fix 26 stdlib CVEs (crypto/tls, net/url, html/template, etc.); sync
version references in CLAUDE.md and .ai/architect docs
Add lessons-learned LL-006/007/008 and anti-patterns AP-004/005 to
prevent recurrence per CLAUDE.md rule 6.
Previous commit only replaced placeholders in the working tree, but gitleaks scans the full git history (166 commits). The original demo API keys still exist in commit 44db7ce, so PR #83 gate re-failed. Add .gitleaksignore with the 5 fingerprints from 44db7ce (all inside .ai/skills/local-ci-go/ example docs). Fingerprints are stable as long as history is not rewritten. Also correct LL-006: gitleaks scans git log --all, so working-tree edits alone are insufficient once a secret is committed; the .gitleaksignore file is the only low-risk cleanup path (short of force-pushing rewritten history).
Add unit tests for the GitHub LFS integration paths that were left
uncovered (61.8% incremental coverage < 80% gate):
server/server_test.go:
- TestAddGithubMetaData (+ AfterFuncRecover variant)
- TestAddMetaData (gitee / atomGit / insert-error, + AfterFuncRecover)
- TestDealWithGithubAuthError (no-auth / invalid-format / 401/403/500)
- TestHandleBatch_GithubModel, TestHandleBatch_InvalidOwnerRepo
- TestHandleGithubBatch_InvalidOwnerRepo, _DownloadSuccess
auth/github_auth_test.go:
- TestVerifyGithubDownload_NonCollaboratorFallback{Pass,Forbidden}
- TestVerifyGithubDownload_InsufficientPermission
- TestVerifyGithubUpload_APIError
Key function coverage after: addGithubMetaData 0% -> 100%,
addMetaData 0% -> 100%, handleBatch 63.3% -> 80%,
dealWithGithubAuthError 50% -> 95.5%, handleGithubBatch 68.2% -> 95.5%,
verifyGithubUpload/Download/Delete 100%.
The AfterFunc variants monkey-patch time.AfterFunc to run the
callback immediately and use a panicking checkRepoOidName mock to
exercise the defer/recover branch inside the async metadata step.
PR #83 gate reports Python(Inc) ERROR because diff-cover cannot find coverage.xml -- the project had no pytest infrastructure before, so the bandit fix in scripts/lfsNameQuery.py had no coverage data to analyze. Changes: - scripts/lfsNameQuery.py: move `sys.exit(1)` for missing git binary from module top level into _require_git() called from main(), so pytest can import the module in environments without git - scripts/test_lfsNameQuery.py: 22 test cases mocking subprocess.run; covers force_remove, _handle_remove_readonly, branch_has_lfsconfig, clone_repo_skip_lfs, get_all_branches_lfs_mapping and main (88% branch coverage) - pytest.ini: testpaths=scripts, addopts include --cov=scripts --cov-report=xml:coverage.xml --cov-branch, exclude venv/.ai - requirements-dev.txt: pytest>=7.4 and pytest-cov>=4.1 (ASCII-only to avoid Windows GBK decode error during pip install) - .github/workflows/workflow-validation.yml: new python-test job (setup-python 3.11 + pytest + upload coverage.xml artifact) - .gitignore: exclude coverage.xml, .coverage, .pytest_cache/, __pycache__/, *.pyc, venv/, .venv/ Local: `python -m pytest` -> 22 passed; coverage.xml generated at repo root; `go test ./...` still passes.
feat(github-lfs): add GitHub authorization for LFS batch endpoint
Welcome To opensourceways CommunityHey @Zherphy , thanks for your contribution to the community. Bot Usage ManualI'm the Bot here serving you. You can find the instructions on how to interact with me at Here . That means you can comment below every pull request or issue to trigger Bot Commands. Contact GuideIf you have any questions, please contact the SIG: infratructure , |
CLA Signature PassZherphy, thanks for your pull request. All authors of the commits have signed the CLA. 👍 |
Linking Issue Notice@Zherphy , the pull request must be linked to at least one issue. |
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
Goalina
approved these changes
Aug 12, 2026
|
|||||||||||||||||||
Collaborator
Author
|
/retest |
|
|||||||||||||||||||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
描述
相关 Issue
resolve https://github.com/opensourceways/backlog/issues/179
变更类型