gradershell

package

v0.92.6 Latest Latest Go to latest Published: Oct 20, 2026 License: MIT Imports: 13 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/github/gh-aw

Links

Open Source Insights

Documentation ¶

Overview ¶

Package gradershell loads repository Bash graders and checks a finite set of direct file-write patterns. It is not a sandbox: only trusted repository scripts should run until execution is isolated.

Index ¶

func Load(workflowPath, runPath string) (string, error)
func ValidRunPath(path string) bool
type Finding
- func Check(ctx context.Context, source string) ([]Finding, error)

Constants ¶

This section is empty.

Variables ¶

This section is empty.

Functions ¶

func Load ¶

func Load(workflowPath, runPath string) (string, error)

Load reads a regular UTF-8 Bash source file of at most 64 KiB, without executing it. Both the declaring workflow and resolved source must remain inside the repository, and the source may not be a symlink.

func ValidRunPath ¶

func ValidRunPath(path string) bool

ValidRunPath accepts literal .sh paths, without traversal or shell expressions. A leading ./ selects the declaring workflow's directory; other paths start at the repository root.

Types ¶

type Finding ¶

type Finding struct {
	Line    int
	Message string
}

Finding identifies a direct write or unchecked shell execution. Messages are static and never contain source values.

func Check ¶

func Check(ctx context.Context, source string) ([]Finding, error)

Check parses Bash without executing it. All branches, function bodies and substitutions are inspected, including statically known shell -c strings. The analysis is deliberately finite: it does not model arbitrary programs, interpreter languages, aliases, or runtime-generated command contents.

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL