Remove possibly vulnerable LLM check workflow. (#6032)

This commit is contained in:
Rot127 2026-03-13 17:19:34 +00:00 committed by GitHub
parent a0da72a5c9
commit c187aeeb5b
No known key found for this signature in database
GPG key ID: B5690EEEBB952194

View file

@ -1,82 +0,0 @@
# SECURITY:
#
# This workflow runs on pull_request_target and has write privileges.
# Those are used to add labels to the PR.
#
# **IF a user can run code in here, they would be able to extract our secrets.**
#
# This is why it doesn't run external scripts.
# The exception is the get_real_pr_shas.yml workflow.
# The input of it is santized.
name: AI/LLM Checks
on:
pull_request_target:
jobs:
real_pr_shas:
uses: rizinorg/rizin/.github/workflows/get_real_pr_shas.yml@dev
ai_checks:
name: LLM checks
permissions:
pull-requests: write
runs-on: ubuntu-latest
needs: real_pr_shas
steps:
- name: Checkout repository
uses: actions/checkout@v4
with:
fetch-depth: 0 # Full history needed for commit scanning
- name: Validate input hashes
env:
BASE_SHA: ${{ needs.real_pr_shas.outputs.BASE_SHA }}
HEAD_SHA: ${{ needs.real_pr_shas.outputs.HEAD_SHA }}
run: |
if echo "$BASE_SHA" | grep "[^a-f0-9]"; then
echo "BASE_SHA is malformed: $BASE_SHA"
exit 1
fi
if echo "$HEAD_SHA" | grep "[^a-f0-9]"; then
echo "HEAD_SHA is malformed: $HEAD_SHA"
exit 1
fi
- name: Check AGENT.md is unchanged
env:
BASE_SHA: ${{ needs.real_pr_shas.outputs.BASE_SHA }}
run: |
diff=$(git diff --name-status "$BASE_SHA" AGENTS.md)
if [[ $? -eq 128 ]]; then
echo "Failed to diff"
exit 1
fi
if [[ -n "$diff" ]]; then
echo "Edits to 'AGENT.md' are not allowed!"
exit 1
fi
- name: Check for AI usage and label
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
REPO: ${{ github.repository }}
NUMBER: ${{ github.event.number }}
BASE_SHA: ${{ needs.real_pr_shas.outputs.BASE_SHA }}
HEAD_SHA: ${{ needs.real_pr_shas.outputs.HEAD_SHA }}
run: |
LABEL_NAME="AI/LLM"
NEEDLE="Co-authored-by agent"
diff=$(git log --pretty=%B "$BASE_SHA".."$HEAD_SHA" )
if [[ $? -eq 128 ]]; then
echo "Failed to get log"
exit 2
fi
if echo "$diff" | grep "$NEEDLE"; then
echo "Authored by AI agent"
gh pr --repo $REPO edit $NUMBER --add-label "$LABEL_NAME"
fi