Skip to content

fix(wework): compile browser data clearing on Windows #2473

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
qdaxb merged 4 commits into from
Aug 6, 2026
Merged

fix(wework): compile browser data clearing on Windows #2473

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
25da1ec
fix(wework): check Windows browser data clearing
qdaxb Aug 6, 2026
9c5b387
test(ci): scope Wework Windows Rust check
qdaxb Aug 6, 2026
9f805e5
fix(wework): avoid Windows result type shadowing
qdaxb Aug 6, 2026
e1f2096
Merge branch 'main' into fix/windows-webview2-data-clearing
qdaxb Aug 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 7 additions & 1 deletion .github/scripts/classify-ci-changes.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,7 @@ declare -A changed=(
[knowledge_engine]=false
[frontend]=false
[wework]=false
[wework_rust]=false
[wegent_cli]=false
[platform_e2e]=false
[wework_e2e]=false
Expand Down Expand Up @@ -88,6 +89,11 @@ classify_path() {
changed[platform_e2e]=true
changed[wework_e2e]=true
;;
wework/src-tauri/*)
changed[wework]=true
changed[wework_rust]=true
changed[wework_e2e]=true
;;
wework/*)
changed[wework]=true
changed[wework_e2e]=true
Expand All @@ -114,6 +120,6 @@ else
fi

output_file="${GITHUB_OUTPUT:-/dev/stdout}"
for key in backend executor executor_manager shared knowledge_engine frontend wework wegent_cli platform_e2e wework_e2e; do
for key in backend executor executor_manager shared knowledge_engine frontend wework wework_rust wegent_cli platform_e2e wework_e2e; do
printf '%s=%s\n' "$key" "${changed[$key]}" >> "$output_file"
done
6 changes: 6 additions & 0 deletions .github/scripts/test-classify-ci-changes.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -124,6 +124,7 @@ shared=false
knowledge_engine=false
frontend=false
wework=false
wework_rust=false
wegent_cli=false
platform_e2e=false
wework_e2e=false
Expand All @@ -136,6 +137,10 @@ wework_expected="${all_false/wework=false/wework=true}"
wework_expected="${wework_expected/wework_e2e=false/wework_e2e=true}"
assert_case "wework only" "$wework_expected" "wework/src/App.tsx"

wework_rust_expected="${wework_expected/wework_rust=false/wework_rust=true}"
assert_case "wework Rust only" "$wework_rust_expected" \
"wework/src-tauri/src/lib.rs"

shared_expected=$(
cat <<'EOF'
backend=true
Expand All @@ -145,6 +150,7 @@ shared=true
knowledge_engine=true
frontend=false
wework=false
wework_rust=false
wegent_cli=true
platform_e2e=true
wework_e2e=false
Expand Down
34 changes: 33 additions & 1 deletion .github/workflows/test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,6 +34,7 @@ jobs:
knowledge_engine: ${{ steps.classify.outputs.knowledge_engine }}
frontend: ${{ steps.classify.outputs.frontend }}
wework: ${{ steps.classify.outputs.wework }}
wework_rust: ${{ steps.classify.outputs.wework_rust }}
wegent_cli: ${{ steps.classify.outputs.wegent_cli }}

steps:
Expand Down Expand Up @@ -388,6 +389,36 @@ jobs:
flags: wework
name: wework-coverage

check-wework-windows-rust:
name: Check Wework Windows Rust
needs: changes
if: needs.changes.outputs.wework_rust == 'true'
runs-on: windows-latest
timeout-minutes: 20

steps:
- name: Checkout code
uses: actions/checkout@v4
Comment on lines +400 to +401

@coderabbitai coderabbitai Bot Aug 6, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== workflow outline matching lines =="
if [ -f .github/workflows/test.yml ]; then
  wc -l .github/workflows/test.yml
  sed -n '360,430p' .github/workflows/test.yml
  echo "== workflow trigger and permissions nearby =="
  sed -n '1,80p' .github/workflows/test.yml
else
  echo ".github/workflows/test.yml not found"
  git ls-files .github/workflows
fi

echo "== checkout usages in workflow =="
rg -n "actions/checkout|persist-credentials|permissions:|contents:|cargo check|wework_rust" .github/workflows/test.yml || true

Repository: wecode-ai/Wegent

Length of output: 5693

🌐 Web query:

actions/checkout persist-credentials default true README

💡 Result:

In the actions/checkout GitHub Action, the persist-credentials input determines whether the authentication token or SSH key used for the checkout is configured with the local git config [1][2][3]. Key details include: - Default Value: The default is true [1][2][3]. - Functionality: When set to true, the action configures the local git environment with the necessary credentials, allowing your workflow steps to execute authenticated git commands (e.g., git push or git pull) without additional manual configuration [1][4][3]. - Security: Credentials are automatically removed during the post-job cleanup process [1][4][3]. Recent updates have improved security by storing these credentials in a file under $RUNNER_TEMP rather than directly within the.git/config file [5][6]. - Opt-out: You can disable this behavior by setting persist-credentials to false [1][4][3]. This is recommended if you do not need to run authenticated git commands in subsequent steps or wish to manage credentials manually [1][4][3].

Citations:

🌐 Web query:

GitHub Actions GITHUB_TOKEN permissions persisted credentials Rust build scripts procedural macros unsafe code documentation

💡 Result:

In the context of GitHub Actions and Rust development, the primary security concern involves the potential for malicious code execution during the compilation phase to access and exfiltrate sensitive environment credentials, such as the GITHUB_TOKEN [1]. Key Security Considerations: 1. GITHUB_TOKEN Permissions: GitHub Actions automatically provides a short-lived GITHUB_TOKEN for every job [2][3]. By default, this token may have broad permissions depending on repository settings [4][5]. To mitigate risk, you should follow the principle of least privilege: - Set default permissions to read-only at the organization or repository level [5][6]. - Use the permissions key in your workflow YAML to explicitly grant only the necessary permissions for each job [3][7][8]. - Use permissions: {} at the workflow level to disable all permissions by default, then elevate them only as required for specific jobs [4][8]. 2. Rust Build Scripts and Procedural Macros: Both build.rs scripts and procedural macros are executed at compile time by the host machine (the CI runner) with the same privileges as the cargo process [9][1]. If a dependency in your project includes malicious code within these components, it can execute arbitrary commands in your CI environment [1]. This allows it to: - Access environment variables, including the GITHUB_TOKEN and other secrets [1]. - Exfiltrate source code or sensitive data [1]. - Inject backdoors or malicious logic into your project [1]. 3. Mitigation Strategies: - Audit Dependencies: Because procedural macros run during compilation, they are essentially privileged dependencies [1]. Consider using tools like cargo-vet to manage and audit the security of your dependencies, especially those that include procedural macros [1]. - Isolate CI Runners: Avoid using CI runners that have access to production credentials for building untrusted or unverified code [1]. - Limit Exposure: Minimize the scope of the GITHUB_TOKEN to prevent attackers from using it to modify repository contents or publish releases if a build script or macro is compromised [4][8]. - Review Build Scripts: Manually review build.rs files for suspicious network activity or file system access, as these are often overlooked compared to standard application code [1]. Because there is currently no native sandboxing for procedural macros or build scripts within the Rust toolchain, relying on strict environment isolation and thorough dependency auditing is essential to maintaining the security of your CI/CD pipeline [9][1].

Citations:

Disable persisted checkout credentials before Rust compilation.

This workflow runs untrusted PR code in cargo check, and actions/checkout@v4 preserves credentials for later steps. Set permissions: { contents: read } on the job and persist-credentials: false on checkout to reduce token access by build scripts or macros.

🧰 Tools
🪛 zizmor (1.29.0)

[warning] 400-401: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/test.yml around lines 400 - 401, Update the job containing
the Rust compilation step to set permissions to contents: read, and configure
the actions/checkout@v4 step with persist-credentials: false. Preserve the
existing checkout behavior while preventing untrusted build scripts or macros
from accessing persisted credentials.

Source: Linters/SAST tools


- name: Set up Rust
uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8
with:
targets: x86_64-pc-windows-msvc

- name: Cache Cargo dependencies
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830
with:
path: |
~/.cargo/registry
~/.cargo/git
key: ${{ runner.os }}-wework-windows-rust-check-v1-${{ hashFiles('wework/src-tauri/Cargo.lock') }}
restore-keys: |
${{ runner.os }}-wework-windows-rust-check-v1-

- name: Check Wework Rust for Windows
working-directory: ./wework/src-tauri
run: cargo check --locked --target x86_64-pc-windows-msvc

test-wegent-cli:
name: Test wegent CLI
needs: changes
Expand Down Expand Up @@ -530,7 +561,7 @@ jobs:
test-summary:
name: Test Summary
runs-on: ubuntu-latest
needs: [changes, test-backend, test-executor, test-executor-manager, test-shared, test-knowledge-engine, test-frontend, test-wework, test-wegent-cli, test-wegent-cli-integration]
needs: [changes, test-backend, test-executor, test-executor-manager, test-shared, test-knowledge-engine, test-frontend, test-wework, check-wework-windows-rust, test-wegent-cli, test-wegent-cli-integration]
if: always()

steps:
Expand All @@ -555,5 +586,6 @@ jobs:
assert_result "${{ needs.changes.outputs.knowledge_engine }}" "${{ needs.test-knowledge-engine.result }}" "Knowledge Engine tests"
assert_result "${{ needs.changes.outputs.frontend }}" "${{ needs.test-frontend.result }}" "Frontend tests"
assert_result "${{ needs.changes.outputs.wework }}" "${{ needs.test-wework.result }}" "Wework tests"
assert_result "${{ needs.changes.outputs.wework_rust }}" "${{ needs.check-wework-windows-rust.result }}" "Wework Windows Rust check"
assert_result "${{ needs.changes.outputs.wegent_cli }}" "${{ needs.test-wegent-cli.result }}" "wegent CLI tests"
assert_result "${{ needs.changes.outputs.wegent_cli }}" "${{ needs.test-wegent-cli-integration.result }}" "wegent CLI integration tests"
2 changes: 1 addition & 1 deletion wework/src-tauri/src/embedded_browser/data_clearing.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ use tauri::{LogicalPosition, LogicalSize, Manager, Webview, WebviewUrl, Wry};
use tokio::{sync::oneshot, time::timeout};

#[cfg(target_os = "windows")]
use webview2_com::{Microsoft::Web::WebView2::Win32::*, *};
use webview2_com::{ClearBrowsingDataCompletedHandler, Microsoft::Web::WebView2::Win32::*};
#[cfg(target_os = "windows")]
use windows::core::Interface;

Expand Down
Loading