mirror of
https://github.com/MHSanaei/3x-ui.git
synced 2026-10-12 17:05:01 +03:00
MHSanaei
532392850f
CodeQL alert #121 flags the pr-head checkout in the PR review job. The checkout is deliberate and nothing in the job executes it, but the job still carried `id-token: write`, and so did the issue analyst. claude-code-action only uses OIDC to trade for a Claude GitHub App token when no github_token is passed - that app token asks for contents, pull_requests and issues write - or for workload identity, which neither workflow uses. Both pass github_token, so the permission did nothing for them, yet any code running in either job could have minted that write token, undoing the review's read-only split. Three reviews posted on one morning (#6666, #6675, #6752) also showed rubric gaps. REVIEW.md said both "open with the verdict" and "lead with No blocking issues", so the comments opened three ways and two tallies dropped severities; the opening is now a fixed order - tag line only when blocking, verdict paragraph, one status line whose tally names all three severities. #6675 filed a spoofable X-Forwarded-For IP, which that PR first shows to an admin approving a login, under Design; Design now holds approaches and trade-offs only, and a concrete consequence the change makes reachable or worse is a finding. The coverage list ran to some 25 nested lines on #6752; it is now ten lines at most, one per area, no nested bullets.