Security hardening: input validation and resource limits - #6

Merged

nodeselector merged 12 commits into

mainfrom

nodeselector/lockfile-security-hardening

Jun 22, 2026

Commits on Jun 19, 2026

Reject empty commit SHA in lockfile dependency entries
nodeselector
committed
29db3dd
Validate commit field as algo-hex digest
nodeselector
committed
5b9599b
Reject commit field that disagrees with pin key digest
nodeselector
committed
df9a049
Validate ref component in ParsePin via isValidRef
nodeselector
committed
f1bde12
Reject path traversal and absolute paths in workflow map keys
nodeselector
committed
772ab0a
Validate branch and tag fields against injection denylist
nodeselector
committed
1875e94
Add MaxParseSize input size limit (1 MiB) to Parse
nodeselector
committed
da9f42b
Detect and reject cycles in the action uses graph
nodeselector
committed
5eaa668
Cap uses list length per action at MaxUsesPerAction (500)
nodeselector
committed
365b997
ParseActionMeta: add MaxActionMetaSize and MaxNestedUses limits
nodeselector
committed
3701b46

Commits on Jun 22, 2026