sneak
18469e236f
check / check (push) Waiting to run
script/gitea-requests runs gitea 1.27.3 behind the image at its defaults, sends through it the requests that reading gitea's source found the Core Rule Set refuses, with a short sample of ordinary use, and prints each request with the rule ids that matched it. make gitea-requests runs it; make check does not. Every case still holds, and each fix would let through what SPEC.md says stays refused, so the notes specific to gitea now name them with how each refusal plays out: file names in query parameters that read as Java, script, PowerShell or SQL, such paths, and an image push that reuses a layer of an image named like a command. Model: opus-5-5
52 lines
909 B
Makefile
52 lines
909 B
Makefile
.PHONY: bootstrap setup test lint fmt fmt-check tidy check docker hooks build \
|
|
run example-app gitea-requests
|
|
|
|
# Makefile targets are thin shims; the implementations live in script/
|
|
# per the scripts-to-rule-them-all pattern (see the Entrypoints section
|
|
# of README.md). tidy writes go.mod and go.sum as `go mod tidy` does,
|
|
# which test checks. build and run are for working on the code by hand;
|
|
# example-app checks the image with an app built on it; gitea-requests
|
|
# reports the gitea requests the Core Rule Set refuses at the defaults.
|
|
|
|
bootstrap:
|
|
@script/bootstrap
|
|
|
|
setup:
|
|
@script/setup
|
|
|
|
test:
|
|
@script/test
|
|
|
|
lint:
|
|
@script/lint
|
|
|
|
fmt:
|
|
@script/fmt
|
|
|
|
fmt-check:
|
|
@script/fmt-check
|
|
|
|
tidy:
|
|
@script/tidy
|
|
|
|
check:
|
|
@script/check
|
|
|
|
docker:
|
|
@script/docker
|
|
|
|
hooks:
|
|
@script/install-precommit
|
|
|
|
build:
|
|
@script/build
|
|
|
|
run:
|
|
@script/run
|
|
|
|
example-app:
|
|
@script/example-app
|
|
|
|
gitea-requests:
|
|
@script/gitea-requests
|