Commit Graph

3 Commits

Author SHA1 Message Date
Aaron Powell 8c10dfb7df Fix skill-check command injection (#1869)
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-05-29 14:09:52 +10:00
Jan Krivanek 1c6002448d Fix eval workflows (#1228)
* Fix eval workflows

* Address review: secure two-phase PR comment & byte-based truncation

- skill-check.yml: Revert to pull_request trigger (read-only token).
  Remove PR comment posting; upload results as artifact instead.
- skill-check-comment.yml: New workflow_run-triggered workflow that
  downloads the artifact and posts/updates the PR comment with
  write permissions, without ever checking out PR code.
- skill-quality-report.yml: Replace character-based truncation with
  byte-based (Buffer.byteLength) limit. Shrink <details> sections
  structurally before falling back to hard byte-trim, keeping
  markdown rendering intact.
2026-03-31 10:47:54 +11:00
Jan Krivanek 85d690908b Add static eval via skill-validator (#1195)
* Add static eval via skill-validator

* Add issues: write permission for PR comment posting
2026-03-30 12:02:11 +11:00