Commit changes without Sandbox deployment #314
Conversation
|
Thanks for the contribution! Before we can merge this, we need @aruntyagiTutu to sign the Salesforce Inc. Contributor License Agreement. |
| } | ||
|
|
||
| // Create commit | ||
| execFileSync('git', ['commit', '-m', commitMessage], { cwd: workingDir, encoding: 'utf8' }); |
There was a problem hiding this comment.
is this commitMesage the same tool parameter from commit_devops_center_work_item?
There was a problem hiding this comment.
Yes. Commit message is passed via ['-m', commitMessage], so it won’t be treated as flags.
There was a problem hiding this comment.
I meant that commitMessage as a tool param is populated by an LLM, so would this count as passing unsanitized LLM input to a shell exec call?
There was a problem hiding this comment.
update:
execFileSync is spawning the git bin and bypassing the shell middle step so we are fine here.
cristiand391
left a comment
cristiand391
left a comment
There was a problem hiding this comment.
left a question about a possible insecure shell exec
3 participants
What
Compute add/modify/delete via Git, handle deletes from HEAD, map to SDR, commit, return commit SHA with push instructions.
Why
Make committing independent of deployment and avoid manual git errors.
Tests
No-changes error; happy path with commit SHA.
Impact
No breaking changes.