@secureci/cli 0.7.0 → 0.8.0

package/dist/runner/action-fetcher.js

@@ -43,6 +43,7 @@ exports.lsRemoteSha = lsRemoteSha;
 exports.parseLsRemoteTags = parseLsRemoteTags;
 exports.lsRemoteTags = lsRemoteTags;
 exports.getText = getText;
+exports.followRedirect = followRedirect;
 exports.fetchAction = fetchAction;
 exports.fetchRepoFile = fetchRepoFile;
 exports.clearActionCache = clearActionCache;
@@ -62,6 +63,11 @@ const execFileAsync = (0, util_1.promisify)(child_process_1.execFile);
 /** Default connect/idle timeout for action downloads. */
 const DOWNLOAD_TIMEOUT_MS = 30000;
 const MAX_REDIRECTS = 5;
+// GitHub owner and repository names; never `.`/`..` (they'd be cache paths).
+const NAME = /^[A-Za-z0-9_.][A-Za-z0-9_.-]*$/;
+const validName = (name) => NAME.test(name) && name !== '.' && name !== '..';
+/** API lookups are small; refuse anything bigger than this. */
+const MAX_TEXT_BYTES = 16 * 1024 * 1024;
 /**
  * Parse an action reference like "actions/checkout@v3" or "owner/repo/path@ref"
  */
@@ -73,6 +79,10 @@ function parseActionReference(uses) {
         return null;
     }
     const [, owner, repo, actionPath, ref] = match;
+    if (!validName(owner) || !validName(repo)) {
+        logger_1.logger.warn(`Invalid action reference format: ${uses}`);
+        return null;
+    }
     return {
         owner,
         repo,
@@ -216,8 +226,16 @@ function getText(url, headers, timeoutMs) {
         const client = url.startsWith('http://') ? http : https;
         const request = client.get(url, { headers }, (response) => {
             let body = '';
+            let size = 0;
             response.setEncoding('utf8');
-            response.on('data', (chunk) => (body += chunk));
+            response.on('data', (chunk) => {
+                size += Buffer.byteLength(chunk);
+                if (size > MAX_TEXT_BYTES) {
+                    request.destroy(new Error(`Response too large: ${url}`));
+                    return;
+                }
+                body += chunk;
+            });
             response.on('end', () => response.statusCode === 200
                 ? resolve(body)
                 : reject(Object.assign(new Error(`HTTP ${response.statusCode}`), {
@@ -252,6 +270,22 @@ async function resolveSha(ref, token, timeoutMs) {
         sha: await lsRemoteSha(`${serverUrl()}/${ref.owner}/${ref.repo}.git`, ref.ref)
     };
 }
+/**
+ * Where a redirect from `url` to `location` goes, and with which headers:
+ * the Authorization header only stays on the same host, and an https URL
+ * never redirects to http.
+ */
+function followRedirect(url, location, headers) {
+    const from = new URL(url);
+    const next = new URL(location, url);
+    if (from.protocol === 'https:' && next.protocol !== 'https:') {
+        throw new Error(`Refusing insecure redirect from ${url} to ${next}`);
+    }
+    const nextHeaders = { ...headers };
+    if (next.host !== from.host)
+        delete nextHeaders.Authorization;
+    return { url: next.toString(), headers: nextHeaders };
+}
 /**
  * Download a URL to a file, following up to MAX_REDIRECTS redirects. The
  * Authorization header is only sent to the original host (GitHub's API
@@ -274,12 +308,15 @@ function downloadFile(url, dest, timeoutMs, headers, redirectsLeft = MAX_REDIREC
                     reject(new Error(`Too many redirects downloading ${url}`));
                 }
                 else {
-                    const next = new URL(location, url);
-                    const nextHeaders = { ...headers };
-                    if (next.host !== new URL(url).host) {
-                        delete nextHeaders.Authorization;
+                    let next;
+                    try {
+                        next = followRedirect(url, location, headers);
+                    }
+                    catch (error) {
+                        reject(error);
+                        return;
                     }
-                    downloadFile(next.toString(), dest, timeoutMs, nextHeaders, redirectsLeft - 1).then(resolve, reject);
+                    downloadFile(next.url, dest, timeoutMs, next.headers, redirectsLeft - 1).then(resolve, reject);
                 }
                 return;
             }

package/dist/runner/builtin-actions.js

@@ -58,7 +58,7 @@ function hostFileSystem(workspace) {
         workspace,
         home: os.homedir(),
         path: path,
-        readable: async (logical) => (fs.existsSync(logical) ? logical : null),
+        readable: async (logical) => fs.existsSync(logical) ? fs.realpathSync(logical) : null,
         writeInto: async (logical, fill) => {
             fs.mkdirSync(logical, { recursive: true });
             fill(logical);
@@ -76,24 +76,58 @@ function containerFileSystem(access) {
         return dir;
     };
     const inWorkspace = (logical) => logical === access.workspace || logical.startsWith(access.workspace + '/');
-    const toHost = (logical) => path.join(access.hostWorkspace, ...p.relative(access.workspace, logical).split('/'));
+    const segments = (logical) => p.relative(access.workspace, logical).split('/').filter(Boolean);
+    // The container can put symlinks in the mounted workspace; on the host
+    // they resolve against the host's filesystem. Every workspace path is
+    // resolved and must stay inside the workspace.
+    const hostRoot = () => fs.realpathSync(access.hostWorkspace);
+    const contained = (root, real) => real === root || real.startsWith(root + path.sep);
     return {
         workspace: access.workspace,
         home: access.home,
         path: p,
         readable: async (logical) => {
             if (inWorkspace(logical)) {
-                const host = toHost(logical);
-                return fs.existsSync(host) ? host : null;
+                const root = hostRoot();
+                let real;
+                try {
+                    real = fs.realpathSync(path.join(root, ...segments(logical)));
+                }
+                catch {
+                    return null;
+                }
+                return contained(root, real) ? real : null;
             }
             const target = path.join(tempDir(), 'copy');
             return (await access.copyFrom(logical, target)) ? target : null;
         },
         writeInto: async (logical, fill) => {
             if (inWorkspace(logical)) {
-                const host = toHost(logical);
-                fs.mkdirSync(host, { recursive: true });
-                fill(host);
+                const root = hostRoot();
+                let dir = root;
+                for (const part of segments(logical)) {
+                    const next = path.join(dir, part);
+                    const stat = lstatOrNull(next);
+                    if (!stat) {
+                        fs.mkdirSync(next);
+                        dir = next;
+                    }
+                    else if (stat.isDirectory()) {
+                        dir = next;
+                    }
+                    else {
+                        const real = stat.isSymbolicLink() ? realpathOrNull(next) : null;
+                        if (!real || !contained(root, real)) {
+                            throw new Error(`Refusing to write to ${logical}: it is outside the workspace or not a directory`);
+                        }
+                        dir = real;
+                    }
+                }
+                // Fill a private staging directory, then merge it in without
+                // following any symlink the container left in the destination.
+                const stage = tempDir();
+                fill(stage);
+                mergeNoFollow(stage, dir);
                 return;
             }
             const stage = tempDir();
@@ -110,8 +144,63 @@ function containerFileSystem(access) {
         }
     };
 }
+function lstatOrNull(file) {
+    try {
+        return fs.lstatSync(file);
+    }
+    catch {
+        return null;
+    }
+}
+function realpathOrNull(file) {
+    try {
+        return fs.realpathSync(file);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Copy the tree `from` into `to`, replacing (never following) symlinks in
+ * `to`, so the copy can't land outside it.
+ */
+function mergeNoFollow(from, to) {
+    for (const entry of fs.readdirSync(from, { withFileTypes: true })) {
+        const src = path.join(from, entry.name);
+        const dst = path.join(to, entry.name);
+        let stat = lstatOrNull(dst);
+        if (stat?.isSymbolicLink()) {
+            fs.unlinkSync(dst);
+            stat = null;
+        }
+        if (entry.isDirectory()) {
+            if (!stat)
+                fs.mkdirSync(dst);
+            else if (!stat.isDirectory()) {
+                throw new Error(`Cannot overwrite non-directory ${dst} with a directory`);
+            }
+            mergeNoFollow(src, dst);
+        }
+        else if (entry.isFile()) {
+            const fd = fs.openSync(dst, fs.constants.O_WRONLY |
+                fs.constants.O_CREAT |
+                fs.constants.O_TRUNC |
+                (fs.constants.O_NOFOLLOW ?? 0));
+            try {
+                fs.writeFileSync(fd, fs.readFileSync(src));
+                fs.fchmodSync(fd, fs.statSync(src).mode & 0o7777);
+            }
+            finally {
+                fs.closeSync(fd);
+            }
+        }
+    }
+}
 function listFiles(hostRoot, base = '') {
-    const stat = fs.statSync(hostRoot);
+    // Never follow a symlink (e.g. one copied out of a container).
+    const stat = fs.lstatSync(hostRoot);
+    if (stat.isSymbolicLink())
+        return [];
     if (stat.isFile())
         return [base];
     const files = [];
@@ -170,7 +259,7 @@ async function collectFiles(fsys, patterns, options) {
         const host = await fsys.readable(searchPath);
         if (!host)
             continue;
-        const isFile = fs.statSync(host).isFile();
+        const isFile = fs.lstatSync(host).isFile();
         searchPaths.push(isFile ? p.dirname(searchPath) : searchPath);
         const matcher = globAt === -1 ? undefined : (0, hash_files_1.globToRegExp)(pattern);
         for (const rel of listFiles(host)) {

package/dist/runner/checkout.js

@@ -86,6 +86,21 @@ function isLocalCheckout(uses, withValues, ctx) {
  * cloned and `.git` is never touched. With `path:`, the working copy is
  * copied into that subdirectory and the copy is removed at job end.
  */
+/**
+ * Whether `dest` (or the closest part of it that exists) resolves outside
+ * `workspace` through a symlink, e.g. one a container step planted.
+ */
+function escapesViaSymlink(workspace, dest) {
+    const root = fs.realpathSync(workspace);
+    let existing = dest;
+    while (!fs.existsSync(existing) && existing !== path.dirname(existing)) {
+        if (fs.lstatSync(existing, { throwIfNoEntry: false }))
+            return true; // dangling link
+        existing = path.dirname(existing);
+    }
+    const real = fs.realpathSync(existing);
+    return real !== root && !real.startsWith(root + path.sep);
+}
 function localCheckout(step, ctx, runtime, startTime) {
     const withValues = (0, expression_1.substituteRecord)(step.with, ctx);
     const outputs = {
@@ -104,7 +119,9 @@ function localCheckout(step, ctx, runtime, startTime) {
     const workspace = process.cwd();
     const dest = path.resolve(workspace, withValues.path || '.');
     const relative = path.relative(workspace, dest);
-    if (relative.startsWith('..') || path.isAbsolute(relative)) {
+    if (relative.startsWith('..') ||
+        path.isAbsolute(relative) ||
+        escapesViaSymlink(workspace, dest)) {
         return fail(`actions/checkout: path "${withValues.path}" is outside the workspace`);
     }
     let output = 'Using local working copy';

package/dist/runner/container-policy.js

@@ -0,0 +1,166 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.invalidImageReason = invalidImageReason;
+exports.unsafeServiceOptions = unsafeServiceOptions;
+exports.unsafeServiceVolumeReason = unsafeServiceVolumeReason;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+/**
+ * What the CLI lets workflow and action content pass to the container
+ * engine. Container isolation is the boundary between third-party code
+ * (remote actions, remote reusable workflows) and this machine, so anything
+ * that would let a container reach the host is refused.
+ */
+// A Docker image reference: never an option, never whitespace.
+const IMAGE = /^[A-Za-z0-9][A-Za-z0-9._\-/:@]*$/;
+/** Why `image` can't be passed to the container engine, if it can't. */
+function invalidImageReason(image) {
+    return IMAGE.test(image)
+        ? undefined
+        : `Invalid image reference ${JSON.stringify(image)}: an image name can't be empty, start with "-" or contain whitespace`;
+}
+/**
+ * `docker run` options that give a container the host's privileges,
+ * namespaces, devices or filesystem.
+ */
+const UNSAFE_LONG_OPTIONS = new Set([
+    '--privileged',
+    '--cap-add',
+    '--security-opt',
+    '--pid',
+    '--network',
+    '--net',
+    '--ipc',
+    '--userns',
+    '--uts',
+    '--cgroupns',
+    '--device',
+    '--device-cgroup-rule',
+    '--volume',
+    '--mount',
+    '--volumes-from',
+    '--runtime',
+    '--cgroup-parent'
+]);
+const UNSAFE_SHORT_OPTIONS = new Set(['-v']);
+/** Long options that take a value as the next argument (when no `=`). */
+const VALUE_OPTIONS = new Set([
+    ...[...UNSAFE_LONG_OPTIONS].filter((o) => o !== '--privileged'),
+    '--health-cmd',
+    '--health-interval',
+    '--health-timeout',
+    '--health-retries',
+    '--health-start-period',
+    '--entrypoint',
+    '--env',
+    '--shm-size',
+    '--tmpfs',
+    '--user',
+    '--hostname',
+    '--workdir',
+    '--name',
+    '--memory',
+    '--cpus',
+    '--label',
+    '--add-host',
+    '--ulimit'
+]);
+const SHORT_VALUE_OPTIONS = new Set(['-v', '-e', '-u', '-w', '-h', '-l', '-m']);
+/**
+ * The unsafe options in `args` (`services.<id>.options`), by flag name, in
+ * order. Values of options are skipped, so `--health-cmd --privileged` is
+ * fine.
+ */
+function unsafeServiceOptions(args) {
+    const found = [];
+    for (let i = 0; i < args.length; i++) {
+        const arg = args[i];
+        if (arg.startsWith('--')) {
+            const [name, value] = arg.split(/=(.*)/s);
+            if (UNSAFE_LONG_OPTIONS.has(name))
+                found.push(name);
+            if (value === undefined && VALUE_OPTIONS.has(name))
+                i++;
+        }
+        else if (arg.startsWith('-') && arg.length > 1) {
+            const name = arg.slice(0, 2);
+            if (UNSAFE_SHORT_OPTIONS.has(name))
+                found.push(name);
+            if (arg.length === 2 && SHORT_VALUE_OPTIONS.has(name))
+                i++;
+        }
+    }
+    return found;
+}
+const VOLUME_NAME = /^[A-Za-z0-9][A-Za-z0-9_.-]*$/;
+function realpathOrSelf(p) {
+    try {
+        return fs.realpathSync(p);
+    }
+    catch {
+        return p;
+    }
+}
+/**
+ * Why a `services.<id>.volumes` entry is refused, if it is. Named and
+ * anonymous volumes are fine; a host bind mount must stay inside the
+ * workspace (after following symlinks) and away from its `.git`.
+ */
+function unsafeServiceVolumeReason(spec, workspace) {
+    const parts = spec.split(':');
+    if (parts.length < 2)
+        return undefined; // anonymous volume: `/data`
+    const source = parts[0];
+    if (VOLUME_NAME.test(source))
+        return undefined; // named volume
+    if (!path.isAbsolute(source)) {
+        return `Volume ${JSON.stringify(spec)} uses a relative or unsupported host path; use an absolute path inside the workspace or a named volume`;
+    }
+    const root = realpathOrSelf(workspace);
+    const real = realpathOrSelf(source);
+    const rel = path.relative(root, real);
+    if (rel.startsWith('..') || path.isAbsolute(rel)) {
+        return `Volume ${JSON.stringify(spec)} mounts a host path outside the workspace`;
+    }
+    const git = path.join(root, '.git');
+    if (real === git ||
+        real.startsWith(git + path.sep) ||
+        (rel === '' && fs.existsSync(git))) {
+        return `Volume ${JSON.stringify(spec)} would expose the repository's .git to the container`;
+    }
+    return undefined;
+}
+//# sourceMappingURL=container-policy.js.map

package/dist/runner/container-runtime.js

@@ -41,6 +41,7 @@ const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const util_1 = require("util");
+const container_policy_1 = require("./container-policy");
 const execAsync = (0, util_1.promisify)(child_process_1.exec);
 /** The CLI binary invoked for each runtime. `containerd` has no Docker-CLI-
  * compatible binary of its own, so `nerdctl` is used as its front-end. */
@@ -98,6 +99,21 @@ function envTransport(env = {}) {
         }
     };
 }
+/**
+ * `-v` mounts that put existing `paths` under `workingDir` back read-only
+ * over the workspace mount, so a container can't rewrite them (a step
+ * writing `.git/hooks` would otherwise run code on the host later).
+ */
+function readOnlyMounts(workingDir, paths = []) {
+    const args = [];
+    for (const rel of paths) {
+        const host = path.join(workingDir, rel);
+        if (!fs.existsSync(host))
+            continue;
+        args.push('-v', `${host}:${path.posix.join(exports.CONTAINER_WORKDIR, ...rel.split(path.sep))}:ro`);
+    }
+    return args;
+}
 /** Probe timeout for `<bin> version` availability checks. */
 const PROBE_TIMEOUT_MS = 3000;
 class CliContainerRuntime {
@@ -123,6 +139,17 @@ class CliContainerRuntime {
         return this.availableCache;
     }
     execute(options) {
+        const invalid = (0, container_policy_1.invalidImageReason)(options.image);
+        if (invalid) {
+            return Promise.resolve({
+                success: false,
+                stdout: '',
+                stderr: invalid,
+                exitCode: null,
+                timedOut: false,
+                durationMs: 0
+            });
+        }
         const args = [
             'run',
             '--rm',
@@ -130,6 +157,7 @@ class CliContainerRuntime {
             exports.CONTAINER_WORKDIR,
             '-v',
             `${options.workingDir}:${exports.CONTAINER_WORKDIR}`,
+            ...readOnlyMounts(options.workingDir, options.readOnlyPaths),
             '-v',
             `${options.exchangeDir}:${exports.CONTAINER_EXCHANGE_DIR}`
         ];
@@ -154,9 +182,12 @@ class CliContainerRuntime {
         return this.runCli(args, options.timeoutMs, env);
     }
     start(options) {
+        const invalid = (0, container_policy_1.invalidImageReason)(options.image);
+        if (invalid)
+            return Promise.resolve({ success: false, error: invalid });
         const args = ['run', '-d'];
         if (options.workingDir) {
-            args.push('-w', exports.CONTAINER_WORKDIR, '-v', `${options.workingDir}:${exports.CONTAINER_WORKDIR}`);
+            args.push('-w', exports.CONTAINER_WORKDIR, '-v', `${options.workingDir}:${exports.CONTAINER_WORKDIR}`, ...readOnlyMounts(options.workingDir, options.readOnlyPaths));
         }
         if (options.exchangeDir) {
             args.push('-v', `${options.exchangeDir}:${exports.CONTAINER_EXCHANGE_DIR}`);

package/dist/runner/docker-action.js

@@ -43,6 +43,7 @@ const expression_1 = require("./expression");
 const container_runtime_1 = require("./container-runtime");
 const runner_env_1 = require("./runner-env");
 const job_runtime_1 = require("./job-runtime");
+const job_container_1 = require("./job-container");
 const node_action_1 = require("./node-action");
 /**
  * Execute a Docker-type action (`runs.using: docker`). Unlike `run:` steps,
@@ -114,6 +115,12 @@ async function executeDockerAction(action, actionPath, step, actionInputs, calle
     // `runs.args` may reference ${{ inputs.* }} / ${{ secrets.* }}.
     const actionCtx = (0, expression_1.createContext)({}, actionInputs, options.secrets);
     const args = (action.runs.args || []).map((arg) => (0, expression_1.substituteExpressions)(arg, actionCtx));
+    // Args go on the engine client's command line, which other local users
+    // can read (`ps`); env values don't, so say so when a secret lands here.
+    const secretValues = Object.values(options.secrets ?? {}).filter((value) => value && value.length >= 3);
+    if (args.some((arg) => secretValues.some((value) => arg.includes(value)))) {
+        logger_1.logger.warn(`Docker action "${step.uses}": a secret is passed in its args, so it is on the container engine's command line, visible to other users of this machine. Pass secrets through env: instead.`);
+    }
     logger_1.logger.info(`Executing Docker action: ${action.name}`);
     const exchangeDir = fs.mkdtempSync(path.join(os.tmpdir(), 'secureci-exchange-'));
     const files = (0, runner_env_1.createStepFiles)(exchangeDir);
@@ -125,6 +132,7 @@ async function executeDockerAction(action, actionPath, step, actionInputs, calle
             args,
             entrypoint: action.runs.entrypoint,
             workingDir: process.cwd(),
+            readOnlyPaths: (0, job_container_1.protectedWorkspacePaths)(options),
             exchangeDir,
             env: {
                 ...(0, job_runtime_1.containerRunnerEnv)(runtime),

package/dist/runner/job-container.js

@@ -41,6 +41,7 @@ exports.runnerImage = runnerImage;
 exports.stopJobContainer = stopJobContainer;
 exports.startJobServices = startJobServices;
 exports.stopJobServices = stopJobServices;
+exports.protectedWorkspacePaths = protectedWorkspacePaths;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const crypto = __importStar(require("crypto"));
@@ -48,6 +49,7 @@ const logger_1 = require("../utils/logger");
 const expression_1 = require("./expression");
 const container_runtime_1 = require("./container-runtime");
 const shell_1 = require("./shell");
+const container_policy_1 = require("./container-policy");
 /**
  * Image for jobs whose `runs-on` has no image mapping. Runner-like (Node.js,
  * git, curl and common tools), as used by nektos/act.
@@ -145,6 +147,7 @@ async function startJobContainer(job, ctx, options, runtime, runDir) {
     const started = await containerRuntime.start({
         image,
         workingDir: process.cwd(),
+        readOnlyPaths: protectedWorkspacePaths(options),
         exchangeDir,
         env: containerEnv,
         memoryLimit: options.containerMemoryLimit,
@@ -254,6 +257,22 @@ async function startJobServices(job, ctx, options, runtime) {
     const contexts = {};
     for (const [serviceId, spec] of specs) {
         const service = typeof spec === 'string' ? { image: spec } : spec;
+        const extraArgs = service.options
+            ? (0, shell_1.splitArgs)((0, expression_1.substituteExpressions)(service.options, ctx))
+            : [];
+        const volumes = (service.volumes ?? []).map((v) => (0, expression_1.substituteExpressions)(v, ctx));
+        const unsafe = (0, container_policy_1.unsafeServiceOptions)(extraArgs);
+        if (unsafe.length > 0) {
+            logger_1.logger.error(`services.${serviceId}: refusing unsafe options ${[...new Set(unsafe)].join(', ')}: they would give the container access to this machine.`);
+            return false;
+        }
+        for (const volume of volumes) {
+            const reason = (0, container_policy_1.unsafeServiceVolumeReason)(volume, process.cwd());
+            if (reason) {
+                logger_1.logger.error(`services.${serviceId}: ${reason}.`);
+                return false;
+            }
+        }
         if (service.credentials) {
             logger_1.logger.warn(`services.${serviceId}: credentials are ignored; log in with \`docker login\` instead.`);
         }
@@ -266,10 +285,8 @@ async function startJobServices(job, ctx, options, runtime) {
                 ? { network: services.network, networkAlias: serviceId }
                 : {}),
             ports: (service.ports ?? []).map((port) => (0, expression_1.substituteExpressions)(String(port), ctx)),
-            volumes: (service.volumes ?? []).map((v) => (0, expression_1.substituteExpressions)(v, ctx)),
-            extraArgs: service.options
-                ? (0, shell_1.splitArgs)((0, expression_1.substituteExpressions)(service.options, ctx))
-                : [],
+            volumes,
+            extraArgs,
             env: (0, expression_1.substituteRecord)(service.env, ctx)
         });
         if (!started.success || !started.id) {
@@ -319,4 +336,12 @@ async function stopJobServices(runtime) {
         await services.runtime.removeNetwork(services.network);
     }
 }
+/**
+ * Workspace paths mounted read-only into containers: the working copy's
+ * `.git`, so a step can't plant hooks or config that run on the host. Not
+ * with --no-local-checkout, where the real actions/checkout manages it.
+ */
+function protectedWorkspacePaths(options) {
+    return options.localCheckout === false ? [] : ['.git'];
+}
 //# sourceMappingURL=job-container.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@secureci/cli",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "SecureCI: validate, check against pipeline standards, and run GitHub Actions workflows locally",
   "main": "dist/index.js",
   "bin": {
@@ -68,11 +68,11 @@
     "@types/node": "^20.10.6",
     "@typescript-eslint/eslint-plugin": "^8.71.1",
     "@typescript-eslint/parser": "^8.71.1",
-    "@vitest/coverage-v8": "^4.1.11",
+    "@vitest/coverage-v8": "^4.1.12",
     "eslint": "^8.56.0",
     "postject": "1.0.0-alpha.6",
     "typescript": "^5.3.3",
-    "vitest": "^4.1.11"
+    "vitest": "^4.1.12"
   },
   "volta": {
     "node": "24.0.0"