Repository navigation
chore(lint): Require GitHub plugin requests to use host egress - #2222
Merged
Merged
Conversation
Add an ast-grep rule that rejects direct GitHub tokens and requests in the GitHub plugin. Code must use ctx.egress.fetch, so egress policy, grant selection, the shared credential lease, and egress audit logs apply. Credential issuing and webhook routes may still call GitHub directly. They run without a Turn or an egress context. Co-Authored-By: BYK <burak.kaya@sentry.io>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Replace the ast-grep rule with built-in oxlint rules. In the GitHub plugin source, no-restricted-imports bans githubRequest and issueInstallationToken, and no-restricted-globals and no-restricted-properties ban fetch. Only credential-support.ts and webhooks/ may call GitHub directly. These rules work per file, so move the direct GitHub calls out of plugin.ts. The webhook commit-page and feedback-reaction requests move to webhooks/installation-requests.ts. The issueCredential body moves to issueGitHubCredential in credential-support.ts, and the installation and user credential helpers are no longer exported. The rules live in the shared oxlint config with **/junior-github globs. A package config that extends it fails in oxlint 1.79, because relative jsPlugins paths do not resolve from a base config in another directory. Co-Authored-By: BYK <burak.kaya@sentry.io>
github-actions
Bot
added
risk: high
BYK
approved these changes
Oct 25, 2026
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
#2218 first shipped a GitHub plugin hook that minted its own installation token and called
api.github.comdirectly. That skipped Junior's credential proxy: egress policy, grant selection, the shared credential lease, and egress audit logs. Review caught it, and #2218 now reads throughctx.egress. This adds lint rules so the next one fails CI instead of relying on review.The rules are built-in oxlint rules, applied to
packages/junior-github/src:no-restricted-importsbansgithubRequestandissueInstallationTokenfromcredential-support.js.no-restricted-globalsbansfetch, andno-restricted-propertiesbansglobalThis.fetch.The error tells the author to use
ctx.egress.fetch. Onlycredential-support.tsandwebhooks/may call GitHub directly. A webhook delivery has no Turn and no egress context.These rules work per file, so this PR also moves the direct GitHub calls out of
plugin.ts:webhooks/installation-requests.ts.issueCredentialbody moves toissueGitHubCredentialincredential-support.ts. It needs anIssueCredentialHookContext, so other hooks cannot easily misuse it. The installation and user credential helpers are no longer exported.The rules live in the shared
packages/junior/.oxlintrc.jsonwith**/junior-github/...globs. I first tried a package config that extends the shared one, but oxlint 1.79 then fails to load theanti-slopJS plugin. The relativejsPluginspath does not resolve when the base config is in another directory. Override globs also resolve from the config's own directory, so the globs must use**/junior-github.Verification:
pnpm lint,pnpm typecheck, and the GitHub plugin tests (233) pass.src/that importsissueInstallationTokenandgithubRequest(direct and nested paths) and callsfetchandglobalThis.fetchgets 8 errors. That is the same pattern as the original feat(conversations): Name conversations after linked issues #2218 bypass. The newwebhooks/installation-requests.tspasses.The rules only cover the GitHub plugin. Someone could still get around them, for example by re-exporting a function from another module. The rules are there to catch honest mistakes, not to enforce a security boundary.
If #2218 merges first, this branch needs a rebase. Both change the imports in
plugin.ts.via BYK.
--
View Junior Session in Sentry