Repository navigation
修复 Actions 输入安全、扫描范围绕过和报告脱敏 - #28
Open
RyanCoreAI wants to merge 2 commits into
Open
RyanCoreAI wants to merge 2 commits into
RyanCoreAI wants to merge 2 commits into
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| const match = /^diff --git a\/(.+) b\/(.+)$/.exec(raw); | ||
| const oldPath = match ? normalizePath(match[1]) : "unknown"; | ||
| const newPath = match ? normalizePath(match[2]) : oldPath; | ||
| const match = /^diff --git ("(?:[^"\\]|\\.)*"|a\/.+) ("(?:[^"\\]|\\.)*"|b\/.+)$/.exec(raw); |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
PatchBrake 的扫描范围和密钥检测可被普通 glob、占位词注释绕过；同一行命中其他规则时，密钥还会重新出现在报告中。此 PR 修复这些实际复现问题，并保留已有的 Actions 参数注入和 Git C-quoted 路径修复。
**/支持零层目录，?不跨目录；解析后保留真实 a/、b/ 根目录。验证（2026-11-04，本地 Node 22）：TypeScript build、58/58 Vitest、30/30 确定性 benchmark、git diff --cached --check。测试仅使用合成值。新增补丁提交使用 [skip ci] 减少重复 CI；托管状态以 GitHub 实际检查为准，本地通过不等同托管通过。没有合并或部署。
这是启发式 diff 扫描，不能保证检测所有密钥。脱敏内容变化可能改变 secret 规则 fingerprint，更新 baseline 前需复核。详见 docs/deep-audit-20261104.md。