sverka 0.2.30 → 0.2.32

package/dist/index.mjs

@@ -2630,10 +2630,23 @@ async function applyGitlabComment(write, declarations) {
 	await postJson(`${api}${on === "merge_request" ? `/projects/${encodeURIComponent(project)}/merge_requests/${iid}/notes` : `/projects/${encodeURIComponent(project)}/issues/${iid}/notes`}`, token, { body }, "PRIVATE-TOKEN");
 	return `comment on ${on} !${iid}`;
 }
+/** The provider API base must be https — the apply token and the comment
+*  body travel with every request, so a plaintext base would put both on
+*  the wire in the clear. */
+function requireHttpsApi(url) {
+	let parsed;
+	try {
+		parsed = new URL(url);
+	} catch {
+		throw new CliError(`sverka apply: provider API URL is not a valid URL: ${url}`, "PACKAGE_ERROR", ExitCode.RuntimeError);
+	}
+	if (parsed.protocol !== "https:") throw new CliError("sverka apply: provider API URL must be https", "PACKAGE_ERROR", ExitCode.RuntimeError);
+	return url;
+}
 /** Provider-supplied env for a GitLab apply call — all CI-controlled. */
 function gitlabApplyEnv() {
 	const env = process$1.env;
-	const api = env["CI_API_V4_URL"] ?? "https://gitlab.com/api/v4";
+	const api = requireHttpsApi(env["CI_API_V4_URL"] ?? "https://gitlab.com/api/v4");
 	const project = env["CI_PROJECT_ID"];
 	if (project === void 0 || project === "") throw new CliError("sverka apply: CI_PROJECT_ID is not set — run inside a GitLab job or set it explicitly", "MISSING_ARG", ExitCode.RuntimeError);
 	const token = env["SVERKA_APPLY_TOKEN"] || env["GITLAB_TOKEN"];
@@ -2646,7 +2659,7 @@ function gitlabApplyEnv() {
 }
 async function applyGithubComment(write) {
 	const env = process$1.env;
-	const api = env["GITHUB_API_URL"] ?? "https://api.github.com";
+	const api = requireHttpsApi(env["GITHUB_API_URL"] ?? "https://api.github.com");
 	const repo = env["GITHUB_REPOSITORY"];
 	if (repo === void 0 || repo === "") throw new CliError("sverka apply: GITHUB_REPOSITORY is not set — run inside a GitHub Actions job or set it explicitly", "MISSING_ARG", ExitCode.RuntimeError);
 	const token = env["SVERKA_APPLY_TOKEN"] || env["GH_TOKEN"] || env["GITHUB_TOKEN"];
@@ -2663,7 +2676,8 @@ async function postJson(url, token, body, auth) {
 	const res = await fetch(url, {
 		method: "POST",
 		headers,
-		body: JSON.stringify(body)
+		body: JSON.stringify(body),
+		redirect: "error"
 	});
 	if (!res.ok) {
 		const text = await res.text().catch(() => "");