36320200764
42%

Ran 27 Sep 2026 12:56PM UTC

Jobs 1

Files 145

Run time 1min

Badge

Embed ▾

Committed 27 Sep 2026 12:48PM UTC coverage: 41.874% (-1.2%) from 43.086%

Build # 36320200764

Build Type

push

github

Committed by

web-flow

Commit Message

fix: restrict install.python_packages paths to the build context (#2112)

The requirements file and local wheels accepted arbitrary paths. The
requirements file was read on the host without any containment check,
so a path like ../../etc/passwd escaped the build context and its
content leaked into build logs and image metadata.

- frontend: resolve paths against the build context (thread-local),
  reject paths escaping it (absolute, .., symlinks), and normalize to
  a context-relative path for reuse inside the container
- compile: verify the symlink-resolved requirements file stays inside
  the build context before reading it on the host, which also covers
  graphs reloaded from image labels

Signed-off-by: Keming <kemingy94@gmail.com>

Coverage Stats

49 of 66 new or added lines in 4 files covered. (74.24%)

53 existing lines in 16 files now uncovered.

4787 of 11432 relevant lines covered (41.87%)

136.97 hits per line

Uncovered Changes

Lines	Coverage	∆	File
8	79.49		pkg/lang/frontend/starlark/v1/install/util.go
6	49.25	-2.2%	pkg/lang/frontend/starlark/v1/install/install.go
3	55.86	-0.99%	pkg/lang/ir/v1/util.go

Coverage Regressions

Lines	Coverage	∆	File
15	52.27	-11.87%	pkg/types/envd.go
11	76.29	-11.83%	pkg/app/formatter/table/env.go
7	0.0	-14.52%	pkg/app/formatter/data.go
4	41.1	-1.16%	pkg/envd/docker.go
2	58.23	-0.86%	pkg/app/init.go
2	62.91	-1.14%	pkg/app/up.go
2	57.14	-3.9%	pkg/ssh/config/ssh_config.go
2	51.69	-2.57%	pkg/syncthing/syncthing.go
1	60.0	-6.67%	pkg/autocomplete/bash.go
1	75.0	-13.89%	pkg/lang/ir/v1/cache.go
1	73.1	-2.05%	pkg/lang/ir/v1/compile.go
1	63.83	-3.52%	pkg/lang/ir/v1/user.go
1	65.91	1.39%	pkg/lang/version/version.go
1	33.8	-1.78%	pkg/progress/compileui/display.go
1	86.84	0.4%	pkg/progress/progressui/printer.go
1	59.18	-3.11%	pkg/version/version.go

Jobs

ID	Job ID	Ran	Files	Coverage
1	36320200764.1	27 Sep 2026 12:56PM UTC	145	41.87	GitHub Action Run

tensorchord / envd / 36320200764
42%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Uncovered Changes

Coverage Regressions

Jobs

Source Files on build 36320200764

tensorchord / envd / 36320200764 42%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Uncovered Changes

Coverage Regressions

Jobs

Source Files on build 36320200764

tensorchord / envd / 36320200764
42%

README BADGES
x