mirror of
https://github.com/stablyai/orca.git
synced 2026-09-21 16:02:20 +00:00
OrcaWinandOrca Worker
3ae51076b1
* fix(tooling): run oxlint gates without a Windows .cmd shim
`check:code-quality:changed` spawned `pnpm.cmd` without a shell, which Node
refuses under the CVE-2024-27980 mitigation, so the gate died with EINVAL
before linting anything. Resolve oxlint's own Node bin and run it under this
process's node instead — no shim, no shell, no quoting question — and add a
ratchet so the idiom cannot spread back into config/scripts.
* fix(tooling): validate the react-doctor diff base and widen the shim ratchet
`base` reaches cmd.exe unquoted on the shell fallback, so reject anything
outside a git revision before spawning. The ratchet matched only a handful of
runner names, which let `vitest.cmd` through even though config/scripts already
spawns vitest, playwright and electron-builder; match any batch-shim literal
instead, walk subdirectories, and cover tests/tools.
* docs(tooling): state what the shim ratchet and diff-base check miss
Both comments read as complete accounts of their guard's coverage. The revision
class rejects reflog syntax like HEAD@{1}, deliberately, since braces have no
business in a cmd.exe-bound argument; the ratchet misses a drive-lettered
literal because a colon is not in its class. Say so beside the template-literal
ceiling already noted.
---------
Co-authored-by: Orca Worker <orca-worker@localhost>
50 lines
1.7 KiB
JavaScript
50 lines
1.7 KiB
JavaScript
import { spawnSync } from 'node:child_process'
|
|
import process from 'node:process'
|
|
import { resolvePullRequestDiffBase } from './git-pull-request-diff-base.mjs'
|
|
import { resolvePnpmCliInvocation } from './pnpm-cli-invocation.mjs'
|
|
|
|
const requestedBase =
|
|
process.argv.slice(2).find((argument) => argument !== '--') ??
|
|
process.env.ORCA_CODE_QUALITY_BASE ??
|
|
'origin/main'
|
|
const base = resolvePullRequestDiffBase(process.cwd(), requestedBase)
|
|
// Why validate rather than trust: `base` arrives from argv or the environment and
|
|
// below it can reach cmd.exe unquoted, because resolvePnpmCliInvocation still
|
|
// falls back to a shell when it cannot find a directly spawnable pnpm. It accepts
|
|
// SHAs, tags, ref paths and the ^ ~ .. suffixes -- not reflog syntax like HEAD@{1},
|
|
// because braces stay out of anything bound for cmd.exe. The error names the base.
|
|
const GIT_REVISION = /^[A-Za-z0-9._/@^~-]+$/
|
|
if (!GIT_REVISION.test(base)) {
|
|
throw new Error(`Refusing to pass an unsafe diff base to pnpm: ${base}`)
|
|
}
|
|
// Why the shim and not a direct binary: `dlx` fetches react-doctor on demand, so
|
|
// only the pnpm CLI can run it. resolvePnpmCliInvocation prefers whatever
|
|
// npm_execpath exposes -- pnpm 12's own pnpm.exe, spawned with no shell.
|
|
const { command, prefixArgs, shell } = resolvePnpmCliInvocation()
|
|
const result = spawnSync(
|
|
command,
|
|
[
|
|
...prefixArgs,
|
|
'dlx',
|
|
'react-doctor@0.9.1',
|
|
'.',
|
|
'--yes',
|
|
'--scope',
|
|
'lines',
|
|
'--base',
|
|
base,
|
|
'--include-untracked',
|
|
'--no-dead-code',
|
|
'--no-supply-chain',
|
|
'--no-telemetry',
|
|
'--blocking',
|
|
'error'
|
|
],
|
|
{ stdio: 'inherit', shell, windowsHide: true }
|
|
)
|
|
|
|
if (result.error) {
|
|
throw result.error
|
|
}
|
|
process.exit(result.status ?? 1)
|