-
Notifications
You must be signed in to change notification settings - Fork 2
ci(security): add guard against hono/jsx ErrorBoundary usage #236
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Conversation
…ystems-ase-a5 humanized
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
…in permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
- Add test for skipping modules with contentStatus="humanized" - Add test for error handling when call_ollama raises exceptions - Add test for streaming mode with TTFT capture - Add test for modules.json dict format with 'modules' key - Add test for modules.json plain array format - Fix existing test to meet quality guard requirements Co-authored-by: 73junito <86015877+73junito@users.noreply.github.com>
Co-authored-by: 73junito <86015877+73junito@users.noreply.github.com>
Co-authored-by: 73junito <86015877+73junito@users.noreply.github.com>
…rator/validator to satisfy CI tests
…install and PYTHONPATH
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Pull request overview
This PR introduces additional CI/security guardrails (notably around Storybook and Hono usage) and expands Python/JS test workflows, but it also includes a very large set of changes under .venv3.10/Lib/* that look like accidental vendored stdlib/virtualenv churn.
Changes:
- Add new GitHub Actions workflows for Playwright E2E, orchestrator tests, stub-blocking, and a Hono “ErrorBoundary” scan.
- Harden Storybook CI with Node/pnpm verification and retry logic.
- Update Python CI workflows to install more dependencies and run additional tests (plus editable install of
lib/ollama-python).
Reviewed changes
Copilot reviewed 144 out of 1321 changed files in this pull request and generated 5 comments.
Show a summary per file
| File | Description |
|---|---|
| .venv3.10/Lib/abc.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/antigravity.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/asynchat.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/asyncore.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/asyncio/main.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/asyncio/base_futures.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/asyncio/base_subprocess.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/asyncio/base_tasks.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/asyncio/coroutines.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/asyncio/events.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/asyncio/exceptions.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/asyncio/format_helpers.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/asyncio/futures.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/asyncio/locks.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/asyncio/mixins.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/asyncio/protocols.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/asyncio/queues.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/asyncio/runners.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/asyncio/sslproto.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/asyncio/staggered.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/asyncio/subprocess.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/asyncio/tasks.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/asyncio/transports.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/asyncio/trsock.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/asyncio/windows_events.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/asyncio/windows_utils.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/bdb.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/bisect.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/cProfile.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/chunk.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/cmd.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/code.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/codecs.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/codeop.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/collections/abc.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/concurrent/futures/init.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/concurrent/futures/_base.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/concurrent/futures/process.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/concurrent/futures/thread.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/contextvars.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/copy.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/copyreg.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/crypt.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/csv.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/ctypes/init.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/ctypes/_aix.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/ctypes/macholib/init.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/ctypes/macholib/dylib.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/ctypes/macholib/dyld.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/ctypes/macholib/framework.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/ctypes/test/init.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/ctypes/test/main.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/ctypes/test/test_arrays.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/ctypes/test/test_as_parameter.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/ctypes/test/test_bitfields.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/ctypes/test/test_buffers.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/ctypes/test/test_bytes.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/ctypes/test/test_byteswap.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/ctypes/test/test_callbacks.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/ctypes/test/test_cast.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/ctypes/test/test_cfuncs.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/ctypes/test/test_checkretval.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/ctypes/test/test_errno.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/ctypes/test/test_find.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/ctypes/test/test_frombuffer.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/ctypes/test/test_functions.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/ctypes/test/test_funcptr.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/ctypes/test/test_incomplete.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/ctypes/test/test_internals.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/ctypes/test/test_keeprefs.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/ctypes/test/test_loading.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/ctypes/test/test_macholib.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/ctypes/test/test_memfunctions.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/ctypes/test/test_numbers.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/ctypes/test/test_objects.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/ctypes/test/test_parameters.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/ctypes/test/test_pep3118.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/ctypes/test/test_pickling.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/ctypes/test/test_pointers.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/ctypes/test/test_prototypes.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/ctypes/test/test_random_things.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/ctypes/test/test_refcounts.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/ctypes/test/test_repr.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/ctypes/test/test_slicing.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/ctypes/test/test_stringptr.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/ctypes/test/test_strings.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/ctypes/test/test_struct_fields.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/ctypes/test/test_unaligned_structures.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/ctypes/test/test_unicode.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/ctypes/test/test_values.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/ctypes/test/test_win32.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/ctypes/test/test_wintypes.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/ctypes/wintypes.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/curses/init.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/curses/textpad.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/dbm/init.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/dbm/dumb.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/decimal.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/_bootsubprocess.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/_markupbase.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/_py_abc.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/_sitebuiltins.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/_threading_local.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .venv3.10/Lib/_weakrefset.py | Virtualenv/stdlib formatting/behavior changes (likely unintended) |
| .github/workflows/ci.yml | Expand Python CI dependency installs |
| .github/workflows/orchestrate-test.yml | Add orchestrator test workflow |
| .github/workflows/playwright.yml | Add Playwright E2E workflow |
| .github/workflows/python-ci.yml | Harden Python CI + editable install verification |
| .github/workflows/python-lint-test.yml | Expand pytest deps + editable install |
| .github/workflows/security-hono-grep.yml | Add Hono “ErrorBoundary” grep gate |
| .github/workflows/storybook-monitor.yml | Reduce schedule frequency + add concurrency + error handling |
| .github/workflows/storybook.yml | Add Node/pnpm verification and retry logic for installs |
| .github/workflows/block-stubs.yml | Add PR stub-content blocking workflow |
| .github/scripts/watch_and_fix.js | Add workflow watcher that opens automated “retry” PR |
| .github/scripts/watch_and_fix.cjs | Add CJS variant with GH CLI token fallback |
| .github/scripts/run_watcher.ps1 | Add secure PowerShell wrapper to run watcher |
| .github/scripts/README.md | Document watch-and-fix usage |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| from _decimal import __libmpdec_version__ | ||
| except ImportError: | ||
| from _pydecimal import * |
Copilot
AI
Jan 29, 2026
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This PR includes extensive changes under .venv3.10/Lib/*, which appears to be a committed virtualenv/stdlib directory. Checking in a virtualenv typically creates large, noisy diffs and can introduce accidental behavior changes that are not intended to be part of application code. Recommend removing .venv3.10/ from version control and adding it to .gitignore, then keeping CI changes scoped to repository source and workflow files.
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
…in permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
73junito
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
viewed
Summary:
Adds a CI workflow to detect any imports of
hono/jsxand usage of theErrorBoundarycomponent in the frontend code. This prevents accidental introduction of a known XSS vulnerability.Motivation:
The
ErrorBoundarycomponent inhono/jsxcan render untrusted user input as raw HTML, creating a reflected XSS risk. While our current code doesn’t usehono/jsx, this workflow ensures future PRs do not accidentally introduce it.Changes:
security/hono-ci-guard.yml)import { ErrorBoundary } from 'hono/jsx'orErrorBoundaryusageTesting / Verification:
ErrorBoundaryshould cause CI to fail (demonstrating the guard works)Security Impact:
Prevents accidental inclusion of a vulnerable component, proactively reducing XSS exposure.