chore: run security fix generator #1

	name: apply-security-fix

	on:
	push:
	branches:
	- fix/security-transport-completion-marker

	permissions:
	contents: write

	concurrency:
	group: apply-security-fix-${{ github.ref }}
	cancel-in-progress: true

	jobs:
	apply:
	if: github.actor != 'github-actions[bot]'
	runs-on: ubuntu-latest
	timeout-minutes: 20

	steps:
	- uses: actions/checkout@v7
	with:
	ref: fix/security-transport-completion-marker
	fetch-depth: 0

	- uses: oven-sh/setup-bun@v2

	- uses: actions/setup-java@v5
	with:
	distribution: temurin
	java-version: '17'

	- name: Apply source changes
	run: python3 .github/scripts/apply-security-fix.py

	- name: Install dependencies
	run: bun install --frozen-lockfile

	- name: Run JS tests
	run: bun test src/__tests__

	- name: Run lint and type checks
	run: bun lint

	- name: Run archive safety regression test
	run: bash scripts/test-safe-zip-file.sh

	- name: Validate diff
	run: git diff --check

	- name: Commit generated fix
	run: \|
	git config user.name "github-actions[bot]"
	git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
	git add -A
	git commit -m "fix(security): block transport downgrade and forged completion markers"
	git push origin HEAD:fix/security-transport-completion-marker

Navigation Menu