@grimoire-rs/indexer 0.1.7 → 0.1.8

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/package.json +1 -1
  2. package/templates/reusable/gitlab-index-ci.yml +6 -1
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@grimoire-rs/indexer",
3
- "version": "0.1.7",
3
+ "version": "0.1.8",
4
4
  "description": "CLI + Astro integration for running your own grim package index",
5
5
  "type": "module",
6
6
  "license": "Apache-2.0",
package/templates/reusable/gitlab-index-ci.yml CHANGED
@@ -73,7 +73,12 @@ grim-indexer:validate:
73
73
  set -eu
74
74
  git fetch --quiet origin "$CI_MERGE_REQUEST_TARGET_BRANCH_NAME"
75
75
  git worktree add --detach ../base "origin/$CI_MERGE_REQUEST_TARGET_BRANCH_NAME"
76
- git diff --name-only --diff-filter=ACMR "$CI_MERGE_REQUEST_DIFF_BASE_SHA" HEAD -- index > changed.txt
76
+ # Every changed path, with no pathspec and no diff filter: rejecting an
77
+ # out-of-bounds path is the gate's first job, and it ownership-checks a
78
+ # deletion before allowing it. Narrowing to `-- index` would let an MR
79
+ # that adds a valid entry and edits this very file pass; dropping `D`
80
+ # would let one that deletes a stranger's entry pass.
81
+ git diff --name-only "$CI_MERGE_REQUEST_DIFF_BASE_SHA" HEAD > changed.txt
77
82
  xargs -a changed.txt npx --yes "@grimoire-rs/indexer@$GRIM_INDEXER_VERSION" validate \
78
83
  --forge gitlab --root ../base --pr-tree .
79
84