allowlist-check: match owner/repo case-insensitively (closes #1304) - #1305
Merged
Merged
Conversation
GitHub resolves owner and repository identifiers case-insensitively, so `uses: Swatinem/rust-cache@v2` and `uses: swatinem/rust-cache@v2` name the same action. fnmatch applies os.path.normcase, which is the identity on POSIX, so on the Linux runners an entry whose casing differed from what a consumer wrote rejected a legitimately approved action -- and said only that it was not on the allowlist, which is not what was actually wrong. apache/sedona-spatialbench hit exactly that (#950, entry fixed in #1300). Folds only the owner/repo half. Tags and SHAs are case-sensitive on GitHub, so folding the part after "@" would let an exactly-pinned entry match a ref it never approved; two precision tests pin that, along with one asserting the fold cannot make a different repo match. The trusted-owner check needed the same treatment: `Actions/checkout@v4` was not recognised as belonging to the `actions` owner. Generated-by: Claude Opus 5
raboof
approved these changes
Sep 18, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #1304. Follow-up to #1300, which fixed the one miscased entry; this removes the class.
GitHub resolves owner and repository identifiers case-insensitively, so
uses: Swatinem/rust-cache@v2anduses: swatinem/rust-cache@v2name the same action.fnmatchappliesos.path.normcase, which is the identity on POSIX, so on the Linux runners:An entry whose casing differed from what a consumer wrote therefore rejected a legitimately approved action, reporting only that it was not on the allowlist - which is not what was actually wrong. apache/sedona-spatialbench hit exactly that (#950).
fold_ref_case()lower-cases theowner/repohalf of a ref or pattern and leaves the part after@alone.Actions/checkout@v4was not recognised as belonging to theactionsowner.Only
owner/repofolds. Tags and SHAs are case-sensitive on GitHub, so folding the ref would let an exactly-pinned entry match something it never approved. Two precision tests pin that (owner/action@v1.0.0-RC1must not match...-rc1), plus one asserting the fold cannot make a different repo match (Swatinem/rust-cache-evil,evil/rust-cache).Test plan: five new tests, written first - the three case-insensitivity ones failed against the old matcher and the two precision guards passed, so they pin behaviour that already held.
allowlist-checksuite 53 passed;uv run pytest utils/tests/357 passed; prek clean. Verified against the real #950 shape.🤖 Generated with Claude Code