* fix(ci): fork-safe compliance review via two-stage workflow_run
Replaces the pull_request_target approach (which would run untrusted fork
code with the AWS Bedrock secrets in env) with the GitHub-recommended split:
- swedish-compliance-diff.yml (pull_request, no secrets, read-only token):
computes the diff and uploads it as an artifact. Never runs project code.
- swedish-compliance-review.yml (workflow_run, has secrets + write token):
checks out ONLY the base repo (trusted script + skills), downloads the
diff artifact, feeds it to the model as DATA, and posts the comment. Never
checks out or executes fork PR code.
scripts/swedish-compliance-review.mjs reads the diff from DIFF_FILE/FILES_FILE
when set, with a fallback to git diff for same-repo runs.
Safe alternative to #829.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(ci): pin workflow actions to commit SHAs (Superagent P1)
Pin actions/checkout, setup-node, upload-artifact, download-artifact and the
peter-evans comment actions to immutable 40-char SHAs with version comments,
closing the two Superagent supply-chain findings. Matters most here since the
review stage holds AWS Bedrock secrets + a write token.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(ci): full base fetch in compliance-diff so merge-base works when branch is behind
The --depth=1 base fetch left git merge-base with no reachable common ancestor
once main advanced past the PR branch, failing the prepare job under bash -e.
checkout already uses fetch-depth: 0, so a full base fetch makes merge-base
reliable regardless of how far base has moved.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(ci): harden compliance review per security audit
Stage 1 (swedish-compliance-diff.yml): pass github.base_ref + PR number via
env instead of interpolating ${{ }} into the run: shell (template-injection
antipattern); add set -euo pipefail; printf over echo.
Stage 2 (swedish-compliance-review.yml): pin @anthropic-ai/bedrock-sdk@0.31.0
and add --ignore-scripts — the privileged job (write token) must not run a
floating @latest or dependency lifecycle scripts. set -euo pipefail on the
PR-number guard.
Script: frame the untrusted diff/files with a per-run unguessable random
sentinel (not a code fence a hostile diff could close) plus an explicit
'treat as data, ignore embedded instructions' system-prompt guard and output
constraints (no images/@-mentions/links/HTML). Legacy getDiff now uses
execFileSync (argv array, no shell).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Jakob Wennberg
a68123bbe8