Repository navigation

Security hardening: input validation and resource limits - #6

Merged

nodeselector merged 12 commits into

mainfrom

nodeselector/lockfile-security-hardening

Jun 22, 2026

Merged

Security hardening: input validation and resource limits#6
nodeselector merged 12 commits into
mainfrom
nodeselector/lockfile-security-hardening

Commits on Jun 19, 2026
- Reject empty commit SHA in lockfile dependency entries
  nodeselector
  committed
  29db3dd
- Validate commit field as algo-hex digest
  nodeselector
  committed
  5b9599b
- Reject commit field that disagrees with pin key digest
  nodeselector
  committed
  df9a049
- Validate ref component in ParsePin via isValidRef
  nodeselector
  committed
  f1bde12
- Reject path traversal and absolute paths in workflow map keys
  nodeselector
  committed
  772ab0a
- Validate branch and tag fields against injection denylist
  nodeselector
  committed
  1875e94
- Add MaxParseSize input size limit (1 MiB) to Parse
  nodeselector
  committed
  da9f42b
- Detect and reject cycles in the action uses graph
  nodeselector
  committed
  5eaa668
- Cap uses list length per action at MaxUsesPerAction (500)
  nodeselector
  committed
  365b997
- ParseActionMeta: add MaxActionMetaSize and MaxNestedUses limits
  nodeselector
  committed
  3701b46
Commits on Jun 22, 2026
- Address review: reject YAML anchors, drop limits runner doesn't enforce
  nodeselector
  committed
  ce7d703
- Address Copilot review: Windows paths, recursive DFS docs, pin comment
  nodeselector
  committed
  484f680