The GitHub Actions job "prek" on airflow-steward.git/contribitor-onboarding has failed. Run started by GitHub user justinmclean (triggered by justinmclean).
Head commit for run: 8eed962262903c95e26349edee82c0eca1f28e96 / Justin McLean <[email protected]> fix(skill-evals): close 3 advisory findings from self-review Self-review findings on PR #229: - committer-onboarding step-0 output-spec.md: enumerate the `injection_detected` field in the bullet list. The expected.json in every step-0 case asserts it, but the spec's prose only described injection-detection behaviour without naming the output field — a model following the bullets strictly would have omitted the key. - committer-onboarding step-2 output-spec.md: enumerate the `whimsy_url_contains` field (the PPMC-vs-PMC discriminator substring). Same pattern: asserted by expected.json, not in the spec's bullets. - skill-evals runner.py --cli mode: switch run_cli from `subprocess.run(cli, shell=True)` to `subprocess.run(shlex.split(cli), shell=False)`. The operator's command string was already trusted (the docstring said so), but using an argv list rather than a shell string keeps the attacker-controlled prompt content (injection-case fixtures and their like) firmly on stdin, well away from any shell interpretation, and removes a class of accidental-metacharacter footgun in the operator's --cli value. Operators who genuinely need shell features wrap their command in `bash -c '<pipeline>'`. One test follow-on (test_runner.py): the MANUAL-skips-CLI case used `"exit 1"` (a shell builtin) to assert non-zero-rc handling; under shell=False the builtin is not on PATH and would FileNotFoundError instead of exiting 1. Swapped to `"false"` — a real binary that exits 1 the same way — with an inline comment explaining the constraint. Verified: `skill-evals` pytest green; `skill-validate --strict` reports OK (no violations); `skill-validator` pytest green. Generated-by: Claude Code (Opus 4.7) Report URL: https://github.com/apache/airflow-steward/actions/runs/26430470417 With regards, GitHub Actions via GitBox --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
