Skip to content

fix(.github/workflows): use literal pathspec when materializing PR module content #1070

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
bpmct merged 1 commit into from
Aug 20, 2026
Merged

fix(.github/workflows): use literal pathspec when materializing PR module content #1070

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 9 additions & 7 deletions .github/workflows/module-scorecard-check.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@
#
# Both paths execute only trusted code: the checkout is the base
# repository, and PR content is fetched separately and materialized ONLY
# under registry/*/modules/, where the scoring script reads it as
# under registry/, where the scoring script reads it as
# inert text for the LLM prompt. Nothing from the PR head is executed.
#
# Required repository secrets:
Expand Down Expand Up @@ -97,13 +97,15 @@ jobs:

- name: Materialize PR module content (data only)
if: steps.changed.outputs.modules != ''
# Overlay ONLY the module directories from the PR merge commit onto
# the trusted checkout. The scoring script reads these files as
# plain text for the LLM prompt; it never executes them. Everything
# under .github/ stays at the trusted base.
# Overlay the registry/ tree from the PR merge commit onto the
# trusted checkout. The scoring script reads these files as plain
# text for the LLM prompt; it never executes them. Everything under
# .github/ stays at the trusted base. A literal pathspec is used
# because wildcard pathspecs (registry/*/modules) do not
# directory-prefix match and fail to match any files.
run: |
git rm -rq --ignore-unmatch 'registry/*/modules'
git checkout FETCH_HEAD -- 'registry/*/modules'
git rm -rq --ignore-unmatch registry
git checkout FETCH_HEAD -- registry

- name: Score changed modules
if: steps.changed.outputs.modules != ''
Expand Down