From 233f4538ce57fecfd5cd980a1d939de6d3de5238 Mon Sep 17 00:00:00 2001 From: KeelMatrix Date: Sun, 18 Oct 2026 20:07:28 +0500 Subject: [PATCH 1/5] fix(security): patch vulnerable crypto fixtures --- fixtures/Ef10/Ef10Fixture.csproj | 1 + fixtures/Ef10Design/Ef10DesignFixture.csproj | 2 +- fixtures/Ef10DesignPrivate/Ef10DesignPrivateFixture.csproj | 2 +- 3 files changed, 3 insertions(+), 2 deletions(-) diff --git a/fixtures/Ef10/Ef10Fixture.csproj b/fixtures/Ef10/Ef10Fixture.csproj index 2c11d60..c9fd611 100644 --- a/fixtures/Ef10/Ef10Fixture.csproj +++ b/fixtures/Ef10/Ef10Fixture.csproj @@ -10,5 +10,6 @@ + diff --git a/fixtures/Ef10Design/Ef10DesignFixture.csproj b/fixtures/Ef10Design/Ef10DesignFixture.csproj index 4d868bf..0cfbe84 100644 --- a/fixtures/Ef10Design/Ef10DesignFixture.csproj +++ b/fixtures/Ef10Design/Ef10DesignFixture.csproj @@ -12,6 +12,6 @@ - + diff --git a/fixtures/Ef10DesignPrivate/Ef10DesignPrivateFixture.csproj b/fixtures/Ef10DesignPrivate/Ef10DesignPrivateFixture.csproj index c596786..f430f6d 100644 --- a/fixtures/Ef10DesignPrivate/Ef10DesignPrivateFixture.csproj +++ b/fixtures/Ef10DesignPrivate/Ef10DesignPrivateFixture.csproj @@ -12,6 +12,6 @@ - + From 5421a14c4980c1cf08afa3cbf0d7469f5163d9de Mon Sep 17 00:00:00 2001 From: KeelMatrix Date: Sun, 18 Oct 2026 20:10:04 +0500 Subject: [PATCH 2/5] fix(ci): check only newly introduced history --- .github/workflows/history-hygiene.yml | 5 +++- build/Test-CommitHistoryGate.ps1 | 39 ++++++++++++++++++++------- 2 files changed, 34 insertions(+), 10 deletions(-) diff --git a/.github/workflows/history-hygiene.yml b/.github/workflows/history-hygiene.yml index ca4da7d..2c31507 100644 --- a/.github/workflows/history-hygiene.yml +++ b/.github/workflows/history-hygiene.yml @@ -17,8 +17,11 @@ jobs: fetch-depth: 0 - name: Check all reachable commits + env: + HISTORY_BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.before }} + HISTORY_HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }} shell: bash - run: sh .githooks/check-history + run: sh .githooks/check-history "$HISTORY_BASE_SHA" "$HISTORY_HEAD_SHA" - name: Verify commit-message gate regression coverage shell: pwsh diff --git a/build/Test-CommitHistoryGate.ps1 b/build/Test-CommitHistoryGate.ps1 index 2cf1701..a6a9a08 100644 --- a/build/Test-CommitHistoryGate.ps1 +++ b/build/Test-CommitHistoryGate.ps1 @@ -29,10 +29,11 @@ function Invoke-CommitMessageHook([string] $Path, [string] $Message) { return [int]$status } -function Invoke-HistoryHook([string] $Head) { - Push-Location $repositoryRoot +function Invoke-HistoryHook([string] $WorkingDirectory, [string] $Start, [string] $End) { + Push-Location $WorkingDirectory try { - & $bashPath --login -c 'sh "$1" "$2" "$3"' efguard-history-gate .githooks/check-history "0000000000000000000000000000000000000000" $Head | Out-Null + $historyHook = Join-Path $repositoryRoot ".githooks/check-history" + & $bashPath --login -c 'sh "$1" "$2" "$3"' efguard-history-gate $historyHook $Start $End | Out-Null $status = $LASTEXITCODE } finally { @@ -95,15 +96,35 @@ fix: preserve useful metadata diagnostics throw "The commit-message gate accepted conflict-marker lines (exit $markerStatus)." } - $head = (& git -C $repositoryRoot rev-parse HEAD).Trim() - if ($LASTEXITCODE -ne 0 -or [string]::IsNullOrWhiteSpace($head)) { - throw "Could not determine the current repository commit." + $historyRepository = Join-Path $temporaryRoot "history-repository" + New-Item -ItemType Directory -Path $historyRepository -Force | Out-Null + & git -C $historyRepository init --quiet + if ($LASTEXITCODE -ne 0) { throw "Could not initialize the synthetic history repository." } + & git -C $historyRepository config user.name "KeelMatrix" + & git -C $historyRepository config user.email "keelmatrix@gmail.com" + "legacy baseline" | Set-Content -LiteralPath (Join-Path $historyRepository "baseline.txt") + & git -C $historyRepository add baseline.txt + & git -C $historyRepository commit --quiet -m "legacy baseline" -m "Signed-off-by: dependabot[bot] " + if ($LASTEXITCODE -ne 0) { throw "Could not create the synthetic legacy baseline." } + $base = (& git -C $historyRepository rev-parse HEAD).Trim() + "clean change" | Set-Content -LiteralPath (Join-Path $historyRepository "clean.txt") + & git -C $historyRepository add clean.txt + & git -C $historyRepository commit --quiet -m "fix: add clean change" + if ($LASTEXITCODE -ne 0) { throw "Could not create the synthetic clean commit." } + $cleanHead = (& git -C $historyRepository rev-parse HEAD).Trim() + if ((Invoke-HistoryHook $historyRepository $base $cleanHead) -ne 0) { + throw "The history gate rejected clean introduced history after an older baseline commit." } - if ((Invoke-HistoryHook $head) -ne 0) { - throw "The history gate rejected the current reachable branch history." + "polluted change" | Set-Content -LiteralPath (Join-Path $historyRepository "polluted.txt") + & git -C $historyRepository add polluted.txt + & git -C $historyRepository commit --quiet -m "fix: add polluted change" -m "Co-authored-by: unauthorized identity" + if ($LASTEXITCODE -ne 0) { throw "Could not create the synthetic polluted commit." } + $pollutedHead = (& git -C $historyRepository rev-parse HEAD).Trim() + if ((Invoke-HistoryHook $historyRepository $cleanHead $pollutedHead) -eq 0) { + throw "The history gate accepted an introduced commit with a prohibited identity trailer." } - Write-Output "Commit-message and reachable-history gate regression coverage passed." + Write-Output "Commit-message and introduced-history gate regression coverage passed." } finally { if (Test-Path -LiteralPath $temporaryRoot) { From c7bca6cd89eef516fdf357eaa4927e0543d0f94d Mon Sep 17 00:00:00 2001 From: KeelMatrix Date: Sun, 18 Oct 2026 20:13:11 +0500 Subject: [PATCH 3/5] fix(ci): scope history checks to main and PRs --- .github/workflows/history-hygiene.yml | 4 +++- build/Test-CommitHistoryGate.ps1 | 8 +------- 2 files changed, 4 insertions(+), 8 deletions(-) diff --git a/.github/workflows/history-hygiene.yml b/.github/workflows/history-hygiene.yml index 2c31507..954abe8 100644 --- a/.github/workflows/history-hygiene.yml +++ b/.github/workflows/history-hygiene.yml @@ -2,6 +2,8 @@ name: Commit history hygiene on: push: + branches: + - main pull_request: permissions: @@ -16,7 +18,7 @@ jobs: with: fetch-depth: 0 - - name: Check all reachable commits + - name: Check introduced commits env: HISTORY_BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.before }} HISTORY_HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }} diff --git a/build/Test-CommitHistoryGate.ps1 b/build/Test-CommitHistoryGate.ps1 index a6a9a08..e0cb641 100644 --- a/build/Test-CommitHistoryGate.ps1 +++ b/build/Test-CommitHistoryGate.ps1 @@ -30,15 +30,9 @@ function Invoke-CommitMessageHook([string] $Path, [string] $Message) { } function Invoke-HistoryHook([string] $WorkingDirectory, [string] $Start, [string] $End) { - Push-Location $WorkingDirectory - try { $historyHook = Join-Path $repositoryRoot ".githooks/check-history" - & $bashPath --login -c 'sh "$1" "$2" "$3"' efguard-history-gate $historyHook $Start $End | Out-Null + & $bashPath --login -c 'cd "$1" && sh "$2" "$3" "$4"' efguard-history-gate $WorkingDirectory $historyHook $Start $End | Out-Null $status = $LASTEXITCODE - } - finally { - Pop-Location - } return [int]$status } From 88dbbc06d94235927695a2c6afb3f6fb7f30d3a1 Mon Sep 17 00:00:00 2001 From: KeelMatrix Date: Sun, 18 Oct 2026 20:14:58 +0500 Subject: [PATCH 4/5] fix(ci): run history range check from test repo --- build/Test-CommitHistoryGate.ps1 | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/build/Test-CommitHistoryGate.ps1 b/build/Test-CommitHistoryGate.ps1 index e0cb641..4fc8ede 100644 --- a/build/Test-CommitHistoryGate.ps1 +++ b/build/Test-CommitHistoryGate.ps1 @@ -30,9 +30,18 @@ function Invoke-CommitMessageHook([string] $Path, [string] $Message) { } function Invoke-HistoryHook([string] $WorkingDirectory, [string] $Start, [string] $End) { + $shellCommand = Get-Command sh -ErrorAction SilentlyContinue + $shellPath = if ($shellCommand) { $shellCommand.Source } else { Join-Path (Split-Path $bashPath) "sh.exe" } + if (-not (Test-Path -LiteralPath $shellPath)) { throw "Could not locate the POSIX shell for the history hook." } + Push-Location $WorkingDirectory + try { $historyHook = Join-Path $repositoryRoot ".githooks/check-history" - & $bashPath --login -c 'cd "$1" && sh "$2" "$3" "$4"' efguard-history-gate $WorkingDirectory $historyHook $Start $End | Out-Null + & $shellPath $historyHook $Start $End | Out-Null $status = $LASTEXITCODE + } + finally { + Pop-Location + } return [int]$status } From 5bd83d4f162adf56c66e3e866bd3ac964e571f93 Mon Sep 17 00:00:00 2001 From: KeelMatrix Date: Sun, 18 Oct 2026 20:24:43 +0500 Subject: [PATCH 5/5] fix(ci): clear expected negative check status --- build/Test-CommitHistoryGate.ps1 | 1 + 1 file changed, 1 insertion(+) diff --git a/build/Test-CommitHistoryGate.ps1 b/build/Test-CommitHistoryGate.ps1 index 4fc8ede..ca8850b 100644 --- a/build/Test-CommitHistoryGate.ps1 +++ b/build/Test-CommitHistoryGate.ps1 @@ -126,6 +126,7 @@ fix: preserve useful metadata diagnostics if ((Invoke-HistoryHook $historyRepository $cleanHead $pollutedHead) -eq 0) { throw "The history gate accepted an introduced commit with a prohibited identity trailer." } + $global:LASTEXITCODE = 0 Write-Output "Commit-message and introduced-history gate regression coverage passed." }