diff --git a/.github/workflows/smoke-copilot.lock.yml b/.github/workflows/smoke-copilot.lock.yml index bb8eb9abb82..156d988faf1 100644 --- a/.github/workflows/smoke-copilot.lock.yml +++ b/.github/workflows/smoke-copilot.lock.yml @@ -37,7 +37,7 @@ name: "Smoke Copilot" types: - labeled schedule: - - cron: "37 */12 * * *" + - cron: "46 */12 * * *" workflow_dispatch: null permissions: {} diff --git a/actions/setup/js/merge_remote_agent_github_folder.cjs b/actions/setup/js/merge_remote_agent_github_folder.cjs index 6f843a36ac2..77a0a58356d 100644 --- a/actions/setup/js/merge_remote_agent_github_folder.cjs +++ b/actions/setup/js/merge_remote_agent_github_folder.cjs @@ -146,23 +146,23 @@ function validateGitParameter(value, name) { */ function validateSafePath(userPath, basePath, name) { // Reject paths with null bytes - if (userPath.includes('\0')) { + if (userPath.includes("\0")) { throw new Error(`Invalid ${name}: contains null bytes`); } - + // Reject paths that attempt to traverse up (..) - if (userPath.includes('..')) { + if (userPath.includes("..")) { throw new Error(`Invalid ${name}: path traversal detected`); } - + // Resolve the full path and ensure it's within the base path const resolvedPath = path.resolve(basePath, userPath); const resolvedBase = path.resolve(basePath); - + if (!resolvedPath.startsWith(resolvedBase + path.sep) && resolvedPath !== resolvedBase) { throw new Error(`Invalid ${name}: path escapes base directory`); } - + return resolvedPath; } @@ -239,7 +239,7 @@ function mergeGithubFolder(sourcePath, destPath) { for (const relativePath of sourceFiles) { // Validate relative path to prevent path traversal validateSafePath(relativePath, sourcePath, "relative file path"); - + // Check if the file is in one of the allowed subfolders const pathParts = relativePath.split(path.sep); const topLevelFolder = pathParts[0]; diff --git a/actions/setup/js/safe_output_handler_manager.cjs b/actions/setup/js/safe_output_handler_manager.cjs index 4783af00cc9..e4bb70d8b47 100644 --- a/actions/setup/js/safe_output_handler_manager.cjs +++ b/actions/setup/js/safe_output_handler_manager.cjs @@ -768,7 +768,8 @@ async function main() { core.warning(`✗ Failed to submit PR review: ${reviewResult.error}`); } } catch (reviewError) { - core.warning(`✗ Exception while submitting PR review: ${reviewError.message || reviewError}`); + const errorMessage = reviewError instanceof Error ? reviewError.message : String(reviewError); + core.warning(`✗ Exception while submitting PR review: ${errorMessage}`); } } diff --git a/actions/setup/js/safe_output_unified_handler_manager.cjs b/actions/setup/js/safe_output_unified_handler_manager.cjs index c0caecee3fe..2c1a553613b 100644 --- a/actions/setup/js/safe_output_unified_handler_manager.cjs +++ b/actions/setup/js/safe_output_unified_handler_manager.cjs @@ -970,7 +970,8 @@ async function main() { core.warning(`✗ Failed to submit PR review: ${reviewResult.error}`); } } catch (reviewError) { - core.warning(`✗ Exception while submitting PR review: ${reviewError.message || reviewError}`); + const errorMessage = reviewError instanceof Error ? reviewError.message : String(reviewError); + core.warning(`✗ Exception while submitting PR review: ${errorMessage}`); } }