tag_create / release_create accept any tag name. A tag refs/heads/main would create refs/tags/refs/heads/main; plausibly the same "matches more than one" wedge #65 fixed for branches. Not yet reproduced against a real Gitea.
ValidateBranchName (added in #66) admits heads/main and tags/x. No harm shown; worth checking against a scratch Gitea whether these shadow refs.
The duplicate-key scan over-rejects case-variant keys inside workflow_run_trigger.inputs (a map, matched exactly). Fail-closed by choice; revisit only if it bites.
Done when: tag names are validated with a test reproducing the wedge on scratch Gitea, or the wedge is shown not to occur.
Source: PR #66 gatekeeper review (non-blocking findings), outside #65's scope.
- `tag_create` / `release_create` accept any tag name. A tag `refs/heads/main` would create `refs/tags/refs/heads/main`; plausibly the same "matches more than one" wedge #65 fixed for branches. Not yet reproduced against a real Gitea.
- `ValidateBranchName` (added in #66) admits `heads/main` and `tags/x`. No harm shown; worth checking against a scratch Gitea whether these shadow refs.
- Unvalidated ref args that don't create refs today: `file_write_branch.base`, `file_delete.branch`, `branch_delete`, `pr_create head/base`, `workflow_run_trigger.ref`, `repo_update.default_branch`.
- The duplicate-key scan over-rejects case-variant keys inside `workflow_run_trigger.inputs` (a map, matched exactly). Fail-closed by choice; revisit only if it bites.
Done when: tag names are validated with a test reproducing the wedge on scratch Gitea, or the wedge is shown not to occur.
---
_Created via git-mcp on behalf of @mathias_
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Source: PR #66 gatekeeper review (non-blocking findings), outside #65's scope.
tag_create/release_createaccept any tag name. A tagrefs/heads/mainwould createrefs/tags/refs/heads/main; plausibly the same "matches more than one" wedge #65 fixed for branches. Not yet reproduced against a real Gitea.ValidateBranchName(added in #66) admitsheads/mainandtags/x. No harm shown; worth checking against a scratch Gitea whether these shadow refs.file_write_branch.base,file_delete.branch,branch_delete,pr_create head/base,workflow_run_trigger.ref,repo_update.default_branch.workflow_run_trigger.inputs(a map, matched exactly). Fail-closed by choice; revisit only if it bites.Done when: tag names are validated with a test reproducing the wedge on scratch Gitea, or the wedge is shown not to occur.
Created via git-mcp on behalf of @mathias