mirror of
https://github.com/github/awesome-copilot.git
synced 2026-07-14 01:51:02 +00:00
Aaron Powell
79cda6bb19
* Add canvas schema and extension submission checks Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix: use namespace import for js-yaml Co-authored-by: aaronpowell <434140+aaronpowell@users.noreply.github.com> * Fix contributors page build markup Co-authored-by: aaronpowell <434140+aaronpowell@users.noreply.github.com> * Address PR feedback on canvas schema validation - Add ajv-cli@5 as a pinned devDependency; install via npm ci in CI instead of npx --yes - Fix screenshot path regex to prevent .. traversal segments - Validate canvas.schema.json is parseable JSON even on schema-only PRs Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Harden canvas extension workflow against injection attacks Switch from newline to null-terminated git diff output (git diff -z) so filenames containing newlines are read atomically, matching the existing skill-check.yml pattern. Add an allowlist regex guard on the extracted extension directory name immediately after it is parsed from git diff output. Any name not matching ^[a-z0-9][a-z0-9-]*$ (e.g. names containing dollar signs, parentheses, spaces, or other shell metacharacters) is silently skipped before being used anywhere in the script. Add a matching allowlist guard on each screenshot path extracted from canvas.json before the file-existence check, so a crafted manifest cannot supply a path with shell metacharacters or traversal segments even after the schema check passes. Follows the same defence-in-depth pattern introduced after the injection PoCs in #1236 and #1240. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Replace ajv-cli with in-repo schema validator - Remove ajv-cli to avoid vulnerable/deprecated transitive dependencies - Add eng/validate-json-schema.mjs using ajv + ajv-formats - Update validate-canvas-extensions workflow to use local script - Use npm ci --ignore-scripts in PR validation job Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: aaronpowell <434140+aaronpowell@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
52 lines
1.7 KiB
JSON
52 lines
1.7 KiB
JSON
{
|
|
"name": "awesome-copilot",
|
|
"version": "1.0.0",
|
|
"description": "Enhance your GitHub Copilot experience with community-contributed instructions, prompts, agents, and skills.",
|
|
"main": "./eng/update-readme.js",
|
|
"private": true,
|
|
"scripts": {
|
|
"start": "npm run build",
|
|
"build": "node ./eng/update-readme.mjs && node ./eng/generate-marketplace.mjs",
|
|
"contributors:add": "all-contributors add",
|
|
"contributors:report": "node ./eng/contributor-report.mjs",
|
|
"contributors:generate": "all-contributors generate",
|
|
"contributors:check": "all-contributors check",
|
|
"plugin:validate": "node ./eng/validate-plugins.mjs",
|
|
"plugin:create": "node ./eng/create-plugin.mjs",
|
|
"skill:validate": "node ./eng/validate-skills.mjs",
|
|
"skill:create": "node ./eng/create-skill.mjs",
|
|
"plugin:clean": "node ./eng/clean-materialized-plugins.mjs",
|
|
"plugin:generate-marketplace": "node ./eng/generate-marketplace.mjs",
|
|
"website:data": "node ./eng/generate-website-data.mjs",
|
|
"website:dev": "npm run website:data && npm run --prefix website dev",
|
|
"website:build": "npm run build && npm run website:data && npm run --prefix website build",
|
|
"website:preview": "npm run --prefix website preview"
|
|
},
|
|
"repository": {
|
|
"type": "git",
|
|
"url": "https://github.com/github/awesome-copilot.git"
|
|
},
|
|
"keywords": [
|
|
"github",
|
|
"copilot",
|
|
"ai",
|
|
"prompts",
|
|
"instructions",
|
|
"skills",
|
|
"agents"
|
|
],
|
|
"author": "GitHub",
|
|
"license": "MIT",
|
|
"devDependencies": {
|
|
"ajv": "^8.20.0",
|
|
"ajv-formats": "^3.0.1",
|
|
"@microsoft/vally": "^0.6.0",
|
|
"all-contributors-cli": "^6.26.1"
|
|
},
|
|
"dependencies": {
|
|
"js-yaml": "^5.2.0",
|
|
"vfile": "^6.0.3",
|
|
"vfile-matter": "^5.0.1"
|
|
}
|
|
}
|