Repository navigation
fix: harden remote publication safety - #153
Conversation
|
Caution Review failedPull request was closed or merged during review 📝 WalkthroughWalkthroughThis PR hardens Git-backed workspace provisioning and publishing by introducing a remote source allowlist configuration, validating Git clone URLs before execution, refactoring diff/patch to use isolated temporary Git indexes, and improving publication URL redaction and environment wiring. ChangesRemote sources validation and Git workspace control flow
Sequence Diagram(s)Not applicable. While the PR introduces significant validation and workflow changes, the core interactions are covered by the layer diagrams above: configuration file → loader → provisioning, URL validation before clone, temporary index operations, and publication validation → push flow. Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Tip 💬 Introducing Slack Agent: The best way for teams to turn conversations into code.Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.
Built for teams:
One agent for your entire SDLC. Right inside Slack. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@coding-agent/tests/coding_agent/environment/test_docker_workspace_provider.py`:
- Line 980: Update the pytest.raises(...) calls in
coding_agent/tests/coding_agent/environment/test_docker_workspace_provider.py so
their match= patterns are raw string literals with regex metacharacters escaped;
specifically change the string "host is not in remote_sources.git.allowed_hosts"
to a raw, escaped regex like r"host is not in
remote_sources\.git\.allowed_hosts" (and apply the same fix for the other two
match= occurrences), ensuring each dot is escaped so the test matches the
literal message rather than any character.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: c83c86bb-72dc-4ee4-9ab5-8af96a394ea6
📒 Files selected for processing (5)
coding-agent/docs/remote-sandbox-production.mdcoding-agent/src/coding_agent/environment/docker_workspace_provider.pycoding-agent/src/coding_agent/ui/http_server.pycoding-agent/tests/coding_agent/environment/test_docker_workspace_provider.pycoding-agent/tests/ui/test_http_server.py
| monkeypatch.setattr(subprocess, "run", fake_run) | ||
|
|
||
| with pytest.raises( | ||
| ValueError, match="host is not in remote_sources.git.allowed_hosts" |
There was a problem hiding this comment.
Escape regex metacharacters in pytest.raises(... match=...) patterns.
The match= arguments at lines 980, 1022, and 1494 contain unescaped . characters that are regex metacharacters. They currently match any character at those positions, so a test could silently pass on a slightly different error message. Use raw strings with escaped dots (Ruff RUF043).
🔧 Proposed fix
- with pytest.raises(
- ValueError, match="host is not in remote_sources.git.allowed_hosts"
- ):
+ with pytest.raises(
+ ValueError, match=r"host is not in remote_sources\.git\.allowed_hosts"
+ ):- with pytest.raises(ValueError, match="workspace_source.remote_url must use https"):
+ with pytest.raises(ValueError, match=r"workspace_source\.remote_url must use https"):- with pytest.raises(ValueError, match="remote_publication.git_token_env is not set"):
+ with pytest.raises(ValueError, match=r"remote_publication\.git_token_env is not set"):Also applies to: 1022-1022, 1494-1494
🧰 Tools
🪛 Ruff (0.15.12)
[warning] 980-980: Pattern passed to match= contains metacharacters but is neither escaped nor raw
(RUF043)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@coding-agent/tests/coding_agent/environment/test_docker_workspace_provider.py`
at line 980, Update the pytest.raises(...) calls in
coding_agent/tests/coding_agent/environment/test_docker_workspace_provider.py so
their match= patterns are raw string literals with regex metacharacters escaped;
specifically change the string "host is not in remote_sources.git.allowed_hosts"
to a raw, escaped regex like r"host is not in
remote_sources\.git\.allowed_hosts" (and apply the same fix for the other two
match= occurrences), ensuring each dot is escaped so the test matches the
literal message rather than any character.
Summary
Verification
Summary by CodeRabbit
New Features
Improvements
Tests