vultr/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-07-24 02:51:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(ci): classify proxied APNs TLS tunnel (#110480)

Browse Source 
* fix(ci): classify proxied APNs TLS tunnel

* fix(ci): prove network CodeQL contract changes

Co-authored-by: zhang-guiping <zhang.guiping@xydigit.com>

---------

Co-authored-by: Peter Steinberger <steipete@gmail.com>
This commit is contained in:
xingzhou
2026-07-18 23:18:29 +08:00
committed by GitHub
parent 63a32e360b
commit faf3dbdda8
3 changed files with 13 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
.github/workflows/codeql-critical-quality.yml vendored
View File

@@ -447,6 +447,7 @@ jobs:
added_lines="$(mktemp)"
raw_socket_scan_lines="$(mktemp)"
codex_transport="extensions/codex/src/app-server/transport-websocket.ts"
network_codeql_contract_pattern='^\.github/codeql/(codeql-network-runtime-boundary-critical-quality\.yml|openclaw-boundary/queries/(raw-socket-callsite-classification|managed-proxy-runtime-mutation)\.ql)$'
gh api --paginate "repos/${REPOSITORY}/pulls/${PR_NUMBER}/files" --jq '.[].filename' > "$changed_files"
gh api --paginate "repos/${REPOSITORY}/pulls/${PR_NUMBER}/files" --jq '
@@ -472,10 +473,10 @@ jobs:
| "\($file): \(.)"
' > "$raw_socket_scan_lines"
if grep -Fxq "$codex_transport" "$changed_files"; then
# This transport has an exact owner/function allowlist in the raw-socket
# CodeQL query, so its raw socket calls run there. Proxy policy tokens
# remain in the fast scan below.
# Query/config edits need semantic analysis; the fast diff scan cannot validate QL.
# The Codex transport also has an exact owner/function allowlist in the query.
if grep -Eq "$network_codeql_contract_pattern" "$changed_files" || \
grep -Fxq "$codex_transport" "$changed_files"; then
echo "full_codeql=true" >> "$GITHUB_OUTPUT"
else
echo "full_codeql=false" >> "$GITHUB_OUTPUT"