Fix security review archive exclusions - #1771
Merged
Merged
Conversation
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Contributor
🟡 Impact Analysis — PR #1771Risk tier: 🟡 MEDIUM 📊 Summary
🎯 Risk Factors
📦 Modules Affectedscripts (1 file)
tests (1 file)
This report is generated automatically for every PR. See #733 for details. |
Contributor
🛫 PR Readiness Check
PR Scope: 🔧 Infrastructure
|
| Status | Check | Details |
|---|---|---|
| ❌ | Single commit | 2 commits — consider squashing before review |
| ✅ | Not in draft | Ready for review |
| ✅ | Branch up to date | Up to date with dev |
| ❌ | Copilot review | No Copilot review yet — it may still be processing |
| ✅ | Changeset present | No source files changed — changeset not required |
| ✅ | Scope clean | No .squad/ or docs/proposals/ files |
| ✅ | No merge conflicts | No merge conflicts |
| ❌ | Copilot threads resolved | 1 unresolved Copilot thread(s) — fix and resolve before merging |
| ❌ | CI passing | 6 check(s) still running |
Files Changed (2 files, +84 −0)
| File | +/− |
|---|---|
scripts/security-review.mjs |
+3 −0 |
test/scripts/security-review.test.ts |
+81 −0 |
Total: +84 −0
This check runs automatically on every push. Fix any ❌ items and push again.
See CONTRIBUTING.md and PR Requirements for details.
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates the security-review script’s “unsafe git” scanner to ignore rotated agent history archive files (matching the existing exclusion for active history.md), and adds a regression test to ensure charters remain in scope.
Changes:
- Exclude
.squad/agents/*/history-archive-*.mdfromunsafe-gitprose findings. - Add a Vitest regression test covering both the archive exclusion and the charter inclusion.
Show a summary per file
| File | Description |
|---|---|
| test/scripts/security-review.test.ts | Adds coverage to prevent unsafe-git false positives for rotated history archives while ensuring charters still trigger findings. |
| scripts/security-review.mjs | Narrows the unsafe-git excluded paths to include rotated history archives, leaving instruction surfaces in scope. |
Review details
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
- Files reviewed: 2/2 changed files
- Comments generated: 1
- Review effort level: Lite
Comment on lines
+1
to
+12
| import { describe, it, expect, beforeEach, afterEach } from 'vitest'; | ||
| import { execFileSync } from 'node:child_process'; | ||
| import { mkdirSync, rmSync, writeFileSync } from 'node:fs'; | ||
| import { randomBytes } from 'node:crypto'; | ||
| import { dirname, join, resolve } from 'node:path'; | ||
| import { fileURLToPath } from 'node:url'; | ||
|
|
||
| const __dirname = dirname(fileURLToPath(import.meta.url)); | ||
| const repoRoot = resolve(__dirname, '..', '..'); | ||
| const scriptPath = join(repoRoot, 'scripts', 'security-review.mjs'); | ||
| const testRoot = join(repoRoot, `.test-security-review-${process.pid}-${randomBytes(4).toString('hex')}`); | ||
|
|
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
.squad/agents/*/history-archive-*.mdfiles from unsafe-git prose findings, matching activehistory.mdbehavior.Context
PR #1754 is blocked by a security-review false positive in restored agent history archives. This change narrows the exclusion to rotated history archives only.
Validation
npm test -- test/scripts/security-review.test.tsnpm run buildNo changeset: changelog gate excludes
scripts/andtest/paths.