3e1240df48
docs: highlight untrusted git-arg interpolation as a warning callout ( #781 )
...
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-08-19 01:04:34 +02:00
66d71debe9
fix: reject glued quotes that string-argv would split into extra git flags ( #778 )
...
* fix: reject glued quotes that string-argv would split into extra git flags
A balanced form like 'main'--force is still two argv tokens under string-argv, so refuse it before git push can see a standalone --force.
Co-authored-by: Cursor <cursoragent@cursor.com >
* docs: describe glued-quote rejection as an argument-boundary check
Co-authored-by: Cursor <cursoragent@cursor.com >
---------
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-08-16 23:48:44 +00:00
c8ad2e2815
fix: reject --pathspec-from-file to prevent log disclosure ( #777 )
...
Git interpolates unmatched pathspecs into fatal errors, so these options can copy an arbitrary runner file into the action log.
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-08-17 01:32:04 +02:00
d809cc8948
docs: add louisabraham as a contributor for ideas ( #775 )
...
* docs: update README.md
* docs: update .all-contributorsrc
---------
Co-authored-by: allcontributors[bot] <46447321+allcontributors[bot]@users.noreply.github.com>
2026-08-14 21:30:07 +00:00
d903e56c18
docs: add ross-spencer as a contributor for bug ( #774 )
...
* docs: update README.md
* docs: update .all-contributorsrc
---------
Co-authored-by: allcontributors[bot] <46447321+allcontributors[bot]@users.noreply.github.com>
2026-08-14 23:29:25 +02:00
f0d523cb47
feat: treat pull: true as a default git pull ( #498 ) ( #773 )
...
YAML true was passed through as git pull arguments, so pull: true ran `git pull true` instead of a default pull.
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-08-14 21:15:51 +00:00
c5e28a6f24
fix: resolve absolute cwd without dumping the minified bundle ( #495 ) ( #772 )
...
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-08-14 21:11:22 +00:00
ce01340b68
fix: block scheme:: remote helpers and restrict git transports ( #771 )
...
* fix: block scheme:: remote helpers and restrict git transports
Harden fetch/pull/push argument handling against ext:: (and other
scheme::) remote-helper URLs, and allowlist safe transports by default,
with allow_unsafe_git_protocols as an explicit opt-out.
Co-authored-by: Cursor <cursoragent@cursor.com >
* fix: quote allow_unsafe description and correct README anchor
Co-authored-by: Cursor <cursoragent@cursor.com >
---------
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-08-14 21:21:17 +02:00
ee94c9b2c5
fix: reject remote-helper overrides skipped by -u ( #770 )
...
matchGitArgs treated -u as always consuming the next token, so fetch/push
args like -u --upl=CMD bypassed the denylist. Validate remote-helper
options on every token and stop treating -u as a value option.
Co-authored-by: Cursor Agent <cursoragent@cursor.com >
2026-08-14 20:54:57 +02:00
d229871fec
docs: add jcbhmr as a contributor for ideas ( #768 )
...
* docs: update README.md
* docs: update .all-contributorsrc
---------
Co-authored-by: allcontributors[bot] <46447321+allcontributors[bot]@users.noreply.github.com>
2026-08-09 23:18:21 +02:00
60fbdfcaec
docs: add nmattia as a contributor for ideas ( #767 )
...
* docs: update README.md
* docs: update .all-contributorsrc
---------
Co-authored-by: allcontributors[bot] <46447321+allcontributors[bot]@users.noreply.github.com>
2026-08-09 21:17:20 +00:00
e1aaefa5cf
feat: add dry_run input ( #765 )
...
* feat: add dry_run input to preview without mutating
Closes #511
Co-authored-by: Cursor <cursoragent@cursor.com >
* fix: tighten dry_run typing and temp-index gitlink checks
Co-authored-by: Cursor <cursoragent@cursor.com >
* fix: seed empty temp index when HEAD is unborn
Co-authored-by: Cursor <cursoragent@cursor.com >
* test: broaden dry_run coverage and add update-tests rule
Co-authored-by: Cursor <cursoragent@cursor.com >
---------
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-08-09 23:16:20 +02:00
df70d113de
feat: add push_attempts to retry failed pushes ( #321 ) ( #764 )
...
Allow concurrent workflows to recover from push races by re-pulling between attempts when pull is configured.
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-08-09 20:33:31 +02:00
ebc24bfdec
fix: refuse unexpected gitlinks staged by git add ( #761 )
...
* fix: refuse unexpected gitlinks staged by git add
Detect new mode-160000 entries after add via git diff --cached --raw so nested .git directories cannot be silently committed as attacker-chosen gitlinks.
Co-authored-by: Cursor <cursoragent@cursor.com >
* fix: harden gitlink raw-diff parsing for renames
Accept scored R/C statuses and destination paths, and use -- in rm remediation hints.
Co-authored-by: Cursor <cursoragent@cursor.com >
---------
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-08-09 00:18:54 +02:00
75038f8fb4
fix: reject unmatched quotes in matchGitArgs to prevent flag injection ( #760 )
...
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-08-09 00:07:23 +02:00
d07c930b6a
fix: reject -F/--file git args that can exfiltrate runner files ( #759 )
...
* fix: reject -F/--file git args that can exfiltrate runner files
Co-authored-by: Cursor <cursoragent@cursor.com >
* docs: document -F/--file blocks on tag and commit inputs
Co-authored-by: Cursor <cursoragent@cursor.com >
* fix: do not treat -m values as -F/--file flags
Co-authored-by: Cursor <cursoragent@cursor.com >
---------
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-08-08 23:36:58 +02:00
b4a0134716
fix: prevent git option injection via new_branch ( #755 )
...
* fix: prevent git option injection via new_branch
Validate new_branch as a branch name and pass it after -- so values like --force cannot force-checkout or force-push.
Co-authored-by: Cursor <cursoragent@cursor.com >
* fix: tighten new_branch validation and simplify checkout
Reject Unicode whitespace/C1 controls in branch names, and drop the checkout -- separator after early validation.
Co-authored-by: Cursor <cursoragent@cursor.com >
* fix: validate new_branch with git check-ref-format
Reject invalid ref forms via check-ref-format --branch, align docs, and clarify the remote-helper warning wording.
Co-authored-by: Cursor <cursoragent@cursor.com >
---------
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-08-08 22:38:05 +02:00
86ab5dca75
fix: reject remote-helper git flags that enable RCE ( #754 )
...
* fix: reject remote-helper git flags that enable RCE
Block --upload-pack, --receive-pack, --exec (and abbreviations) in matchGitArgs so injected fetch/pull/push/tag_push args cannot execute local commands.
Co-authored-by: Cursor <cursoragent@cursor.com >
* chore(deps): bump simple-git to ^3.36.0
Co-authored-by: Cursor <cursoragent@cursor.com >
* fix: reject shortest Git abbreviations of remote-helper flags
Co-authored-by: Cursor <cursoragent@cursor.com >
* npm audit fix
---------
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-08-08 19:55:37 +02:00
Federico Grandi
5190a0ab62
docs: prepare for v10
2026-03-22 22:28:22 +01:00
7b015bddf5
docs: add CodeReaper as a contributor for maintenance ( #723 )
...
* docs: update README.md
* docs: update .all-contributorsrc
---------
Co-authored-by: allcontributors[bot] <46447321+allcontributors[bot]@users.noreply.github.com>
Co-authored-by: Federico Grandi <fgrandi30@gmail.com >
2026-03-22 20:59:16 +00:00
60a33511cb
docs: add tomas-kovanda as a contributor for doc ( #707 )
...
* docs: update README.md
* docs: update .all-contributorsrc
---------
Co-authored-by: allcontributors[bot] <46447321+allcontributors[bot]@users.noreply.github.com>
2025-11-27 16:40:47 +00:00
tomas-kovanda and GitHub
750bd4c7a3
Improve documentation around pathspec error behavior ( #706 )
...
* Clarify pathspec error behavior can be configured
Fixes #705
* Fix typo "this" -> "these"
2025-11-27 16:39:31 +00:00
cd57f6f51c
docs: add tommie as a contributor for code, and test ( #699 )
...
* docs: update README.md
* docs: update .all-contributorsrc
---------
Co-authored-by: allcontributors[bot] <46447321+allcontributors[bot]@users.noreply.github.com>
2025-11-12 11:59:02 +01:00
2afad56181
docs: add icemac as a contributor for doc ( #674 )
...
* docs: update README.md
* docs: update .all-contributorsrc
---------
Co-authored-by: allcontributors[bot] <46447321+allcontributors[bot]@users.noreply.github.com>
2024-11-26 22:37:03 +00:00
Federico Grandi and GitHub
b27b48143f
docs: mention persist-credentials
...
Closes #673
2024-11-26 23:35:49 +01:00
c73ef84c93
docs: add tommie as a contributor for doc ( #647 )
...
* docs: update README.md [skip ci]
* docs: update .all-contributorsrc [skip ci]
---------
Co-authored-by: allcontributors[bot] <46447321+allcontributors[bot]@users.noreply.github.com>
2024-07-19 09:41:34 +00:00
tommie and GitHub
ccb0550b1f
docs: add examples of input arrays. ( #645 )
...
Having to wrap it all as a string is a bit strange, and an example helps.
I don't actually think the `JSON.parse` is needed, because the YAML flow sequence syntax handles that case too: https://yaml.org/spec/1.2.2/#741-flow-sequences
2024-06-28 16:52:59 +02:00
a622cc1f14
docs: add mdboom as a contributor for maintenance ( #615 )
...
* docs: update README.md [skip ci]
* docs: update .all-contributorsrc [skip ci]
---------
Co-authored-by: allcontributors[bot] <46447321+allcontributors[bot]@users.noreply.github.com>
2024-01-25 23:46:16 +01:00
0ac24db40e
docs: add deining as a contributor for doc ( #575 )
...
* docs: update README.md [skip ci]
* docs: update .all-contributorsrc [skip ci]
---------
Co-authored-by: allcontributors[bot] <46447321+allcontributors[bot]@users.noreply.github.com>
2023-11-10 23:01:35 +01:00
Andreas Deininger and GitHub
5c52bddbf4
docs(README): use latest versions of GitHub actions ( #574 )
2023-11-10 22:54:25 +01:00
bc2d0650bf
docs: add cderv as a contributor for doc ( #573 )
...
* docs: update README.md [skip ci]
* docs: update .all-contributorsrc [skip ci]
---------
Co-authored-by: allcontributors[bot] <46447321+allcontributors[bot]@users.noreply.github.com>
2023-11-08 15:54:08 +01:00
Christophe Dervieux and GitHub
eead84d7f3
typo in README git add -> git tag ( #572 )
2023-11-08 15:53:16 +01:00
e72d1b3102
docs: add justanotheranonymoususer as a contributor for bug ( #517 )
...
* docs: update README.md [skip ci]
* docs: update .all-contributorsrc [skip ci]
---------
Co-authored-by: allcontributors[bot] <46447321+allcontributors[bot]@users.noreply.github.com>
2023-07-06 10:42:09 +02:00
Federico Grandi and GitHub
458820b0f0
chore(deps): bump simple-git ( #505 )
...
* chore(deps): bump simple-git
* docs: add @ViacheslavKudinov as a contributor
2023-05-08 14:52:09 +02:00
Federico Grandi and GitHub
fbc09ca59e
docs(README): add "Articles"
2023-05-08 10:37:15 +02:00
Federico Grandi
4200808251
docs: add @azeemba as a contributor
...
ref #468
2023-04-28 19:50:57 +02:00
24b14e7659
docs: add DenverCoder1 as a contributor for bug, and code ( #503 )
...
* docs: update README.md [skip ci]
* docs: update .all-contributorsrc [skip ci]
---------
Co-authored-by: allcontributors[bot] <46447321+allcontributors[bot]@users.noreply.github.com>
2023-04-28 19:34:39 +02:00
7a437dd3d9
docs: add keithrfung as a contributor for doc ( #482 )
...
* docs: update README.md [skip ci]
* docs: update .all-contributorsrc [skip ci]
---------
Co-authored-by: allcontributors[bot] <46447321+allcontributors[bot]@users.noreply.github.com>
2023-02-15 18:54:48 +01:00
Federico Grandi and GitHub
cb041226ef
docs(README): fix wording
...
Closes #481
2023-02-15 18:51:39 +01:00
c7eeaf418e
docs(README): add how to auto-detect deleted files ( #468 )
...
* Add how to autodetect deleted files
The existing instructions make sense for when a predetermined list of files need to be removed. This is likely not a common use case so I shortened that explanation.
Also added the explanation on how to use `--no-ignore-removal` as the `add` setting to have deleted files autodetected.
Fixes #467
* docs(README): update "Deleting files" paragraph
Co-authored-by: Federico <fgrandi30@gmail.com >
2023-01-23 17:37:23 +00:00
20fe0dc7f9
docs: add ggreif as a contributor for doc ( #456 )
...
* docs: update README.md [skip ci]
* docs: update .all-contributorsrc [skip ci]
Co-authored-by: allcontributors[bot] <46447321+allcontributors[bot]@users.noreply.github.com>
2022-11-11 11:16:27 -08:00
72f6e53268
docs(README): fix typos ( #454 )
...
* Fix a few typos in `README.md`
* docs(README): fix typos
Co-authored-by: Federico Grandi <fgrandi30@gmail.com >
2022-11-11 11:13:11 -08:00
a3973579a5
docs: add ggreif as a contributor for maintenance ( #444 )
...
* docs: update README.md [skip ci]
* docs: update .all-contributorsrc [skip ci]
Co-authored-by: allcontributors[bot] <46447321+allcontributors[bot]@users.noreply.github.com>
2022-10-17 11:32:40 +02:00
Federico Grandi
6773ad24bd
docs(README): update examples
2022-10-12 14:19:56 +02:00
385d2d6d3a
docs: add ManuelRauber as a contributor for code ( #441 )
...
* docs: update README.md [skip ci]
* docs: update .all-contributorsrc [skip ci]
Co-authored-by: allcontributors[bot] <46447321+allcontributors[bot]@users.noreply.github.com>
2022-10-11 18:52:25 +02:00
780b0df14e
docs: add kachkaev as a contributor for bug ( #425 )
...
* docs: update README.md [skip ci]
* docs: update .all-contributorsrc [skip ci]
Co-authored-by: allcontributors[bot] <46447321+allcontributors[bot]@users.noreply.github.com>
2022-08-22 19:33:35 +02:00
91b0f62409
docs: add melink14 as a contributor for bug ( #424 )
...
* docs: update README.md [skip ci]
* docs: update .all-contributorsrc [skip ci]
Co-authored-by: allcontributors[bot] <46447321+allcontributors[bot]@users.noreply.github.com>
2022-08-22 19:32:45 +02:00
Federico Grandi and GitHub
f7edecabb7
feat: add fetch input ( #423 )
...
* chore: add additional log notes
* feat: add `fetch` input
Ref #386
* fix: add warnings about not fetching
* docs: `fetch` input & large repos FAQ
* chore: fix typo
2022-08-22 19:26:22 +02:00
ff41bd83fc
docs: add onedr0p as a contributor for bug ( #413 )
...
* docs: update README.md [skip ci]
* docs: update .all-contributorsrc [skip ci]
Co-authored-by: allcontributors[bot] <46447321+allcontributors[bot]@users.noreply.github.com>
2022-06-26 21:04:41 +02:00
f01349f789
docs: add AvivPeledTalon as a contributor for bug ( #412 )
...
* docs: update README.md [skip ci]
* docs: update .all-contributorsrc [skip ci]
Co-authored-by: allcontributors[bot] <46447321+allcontributors[bot]@users.noreply.github.com>
2022-06-26 21:03:18 +02:00
tomas-kovandaandGitHub
tommieandGitHub
Andreas DeiningerandGitHub
Christophe DervieuxandGitHub
Federico Grandi