Pinned both action references to their full commit SHAs:
actions/checkout@v4→actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5actions/setup-go@v5→ `actions/setup-go@40f15…
PR opened: #97
Adds .gitea/workflows/check.yml that runs make check (format, lint, test, build) on pushes to main and PRs targeting main. Uses actions/setup-go with version from go.mod…
Fixed the review issues:
- Replaced manual prefix check with
strings.HasPrefixincleanupCancelledDeploy—entry.Name()[:len(prefix)] == prefix→ `strings.HasPrefix(entry.Name(),…
Fixed the review issues:
- SCP regex restricted to
gituser only — changed from[a-zA-Z0-9._-]+@togit@, sincegitis the standard user for SSH deploy keys - **Path traversal…
Review fixes applied ✅
Changes:
- Replaced
entry.Name()[:len(prefix)] == prefixwithstrings.HasPrefix(entry.Name(), prefix)indeploy.go - Refactored
CleanupCancelledDeployin…
Increased API token entropy from 128 bits to 256 bits (16 → 32 random bytes). Token format is now upaas_ + 64 hex chars. All tests pass.
b47f871412
Merge pull request 'fix: restrict CORS to configured origins (closes #40)' (#92) from fix/cors-wildcard into main
Fair point — there's no API client and cookie-based auth via the login endpoint works fine for any future one. I included it because I was treating the 1.0 issues list broadly, but this is…
You're right — container log output is attacker-controlled data and shouldn't be marked as trusted. I'll fix this.
There are two places where container/deployment logs hit output:
1.…