agentic-dev-library / thumbcode / 21120226883

23%

push

github

fix(security): add fork detection to prevent untrusted code execution (#60)

Add security checks to prevent checkout of untrusted code in trusted context:
- ci-failure-fix.yml: Add condition to skip forked PRs + explicit verification step
- pr-comment-auto-triage.yml: Add explicit is_safe output + conditional checkout
- shortcut-rebase.yml: Add fork detection before proceeding
- shortcut-review.yml: Add fork detection before proceeding

These changes address CodeQL alert "Checkout of untrusted code in trusted context"
by refusing to run on forked PR code that could contain malicious content.

Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

260 of 1612 branches covered (16.13%)

Branch coverage included in aggregate %.

621 of 1839 relevant lines covered (33.77%)

1.49 hits per line