sds / overcommit / 42971423110

100%

push

github

Fix all open CodeQL security findings (#941)

Fix the sources of all 10 open code-scanning alerts (#1–#10). File reads
now treat pipe-prefixed paths as filenames, the flagged regular
expressions avoid overlapping backtracking, branch discovery uses Git's
ref output instead of parsing detached-HEAD display text, and the test
workflow explicitly limits its token to `contents: read`. The remaining
action version tags are pinned to their resolved commit SHAs to satisfy
repository policy.

Regression tests cover literal and missing pipe-prefixed files, real
JSON/XML parse failures, all six affected hook-output parsers, long
malformed inputs, concurrency arithmetic, acronym conversion, and
detached or ambiguous branch names.

Validation:
- `bundle exec ruby script/parallel_rspec.rb`: 2,202 examples passed
with 100% line coverage (3,844/3,844 lines).
- `bundle exec overcommit --run`: passed.
- The adversarial regex inputs also complete within two seconds on Ruby
2.6.10, without relying on newer Ruby regex caching.

GitHub validation on commit `6ad65d2a`:
- All 24 PR checks passed, including the complete Linux/Windows matrix
across Ruby 3.3, 3.4, and 4.0 and the combined 100% coverage gate.
- Ruby, Actions, and JavaScript/TypeScript CodeQL analyses each report
zero findings; the PR has zero open code-scanning alerts.

1002 of 1077 branches covered (93.04%)

Branch coverage included in aggregate %.

7 of 7 new or added lines in 6 files covered. (100.0%)

3846 of 3846 relevant lines covered (100.0%)

3336.56 hits per line