Skip to content

v0.68.0 - Wider workflow-audit inputs

Choose a tag to compare

View all tags
@grnbtqdbyx-create grnbtqdbyx-create released this 01 Jun 04:23
· 5 commits to main since this release
v0.68.0
6315b88
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

ContextForge v0.68.0

This release expands contextforge workflow-audit so agentic GitHub workflow checks cover attacker-controlled titles and branch/ref fields, not only Markdown bodies or comments.

Highlights

  • Treats issue titles, pull request titles, PR head refs/labels, github.head_ref, github.ref_name, review-comment bodies, and discussion titles as untrusted agent inputs.
  • Adds regression coverage for title/ref text flowing into a Claude-powered workflow with write permissions.
  • Refreshes README, workflow-audit docs, LLM discovery files, generated artifacts, changelog, and research notes.
  • Links the research note to GitHub Actions script-injection guidance, GitHub Security Lab untrusted-input guidance, and recent agentic workflow injection research.

Verification

  • PR #161 passed CI and ContextForge Audit on GitHub.
  • Main commit 6315b88 passed CI and ContextForge Audit.
  • Local validation included red/green regression testing, typecheck, full tests, build, security benchmark, audit, workflow-audit artifact generation, publish-readiness, and npm pack dry-run.
Assets 2
Loading