Documentation
¶
Overview ¶
Package gitremote deterministically detects the git remotes configured in a local directory tree, so Wardyn can ground a composed run's GitHub grant on the workspace's ACTUAL remotes rather than a guess.
It is read-only and runs NO subprocess: it parses .git/config and .gitmodules as plain files (never triggering a git hook or a malicious include.path / core.fsmonitor). The walk is bounded (depth, .git count, file size), never follows symlinks, reads REGULAR files only, and fails safe — any error yields fewer/zero detected repos, never a grant on uncertainty.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func DetectGitHubRepos ¶
DetectGitHubRepos walks root (bounded, no symlink following) and returns the sorted, de-duplicated set of github.com "owner/repo" remotes found in .git/config and .gitmodules files, plus the sorted set of non-GitHub remote HOSTS (for an operator warning). It never returns an error: detection is best-effort and fail-safe.
func FieldSafe ¶ added in v0.7.4
FieldSafe reports whether s carries no control character and no whitespace. It is THE predicate for both doors that judge an attacker-influenceable repo slug or remote URL: this package's classify(), and internal/api's repoFieldSafe, which delegates here — one predicate, so the two doors can never judge the same value by different rules.
func OpenRegular ¶ added in v0.7.4
OpenRegular opens a file for reading that is PROVABLY an ordinary file and never reached through a symlink — the shared door for every read a workspace walk performs, since such walks run on an HTTP handler goroutine over a tree the scanned party controls. O_NOFOLLOW refuses a symlinked final component; O_NONBLOCK makes open(2) return on a FIFO instead of waiting forever, and the fstat then decides nothing is read from it — race-free, since the flags pick what gets opened and the fstat judges the thing actually opened. The caller closes and bounds what it reads; this only says WHAT may be opened.
func ResolveRoot ¶ added in v0.7.4
ResolveRoot canonicalises a scan root before a walk: cleaned, with every symlink resolved. Dispatch bind-mounts the RESOLVED tree, so a scanner stopping at the link would describe a tree the run never sees. Resolution failure falls back to the cleaned path — the walk then finds nothing, the fail-safe "no evidence" answer both callers already expect. Shared with internal/workspacescan.
Types ¶
This section is empty.
Source Files