Skip to content

ci: skip symlinks in public artifact sanitizer#29

Merged
Rul1an merged 2 commits into
mainfrom
codex/sanitizer-skip-symlinks
Jun 11, 2026
Merged

ci: skip symlinks in public artifact sanitizer#29
Rul1an merged 2 commits into
mainfrom
codex/sanitizer-skip-symlinks

Conversation

@Rul1an

@Rul1an Rul1an commented Jun 11, 2026

Copy link
Copy Markdown
Owner

Summary

  • skip symlinks in the public artifact sanitizer before reading file contents
  • treat filesystem metadata errors as a non-scannable path
  • add self-test coverage proving a symlink to marked content outside the repo is ignored

Verification

  • python3 <sanitizer> --self-test
  • python3 -m py_compile <sanitizer>
  • uvx ruff check <sanitizer>

Notes

This does not change sanitizer categories, matched-text handling, trusted HMAC behavior, or log output. It is defense-in-depth for the path handling reviewed in Slice 6.

@Rul1an Rul1an merged commit ac871e6 into main Jun 11, 2026
10 checks passed
@Rul1an Rul1an deleted the codex/sanitizer-skip-symlinks branch June 11, 2026 21:28
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant