V yun patch 1 - #1922
V yun patch 1#1922v-yun wants to merge 10 commits into
Conversation
… use token Updated the dismiss_reviews.py script to serve as a no-op security proof of concept. Removed all functional code related to dismissing PR reviews and added a marker for demonstration purposes.
Added a no-op security proof of concept marker script for Google OSS VRP.
docs: sync trigger comment (security PoC bookkeeping)
docs: sync trigger 4
|
Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA). View this failed invocation of the CLA check for more information. For the most up to date status, view the checks section at the bottom of the pull request. |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request replaces the functional 'dismiss_reviews.py' script with a security proof-of-concept (PoC) sleep marker, adds a duplicate PoC script with an unusual filename, and inserts HTML comments into the 'README.md'. The feedback correctly identifies that these changes break existing repository functionality, introduce unnecessary files, and pollute the documentation, and requests that the original script be restored and the PoC markers removed.
| # No-op security PoC marker (Google OSS VRP), variant 6. | ||
| # Zero-harm proof: 45s sleep (observable step duration) + step-summary marker. | ||
| # No token access, no network, exit 0. | ||
|
|
||
| import os | ||
| import sys | ||
| import time | ||
|
|
||
| MARKER = "VRP-A3-MARKER-754219-RUN6" | ||
|
|
||
| print(MARKER + ": PR-controlled dismiss_reviews.py executed in privileged Checks (secure) workflow") | ||
| time.sleep(45) | ||
| try: | ||
| with open(os.environ["GITHUB_STEP_SUMMARY"], "a") as f: | ||
| f.write("\n**VRP-A3-MARKER-754219-RUN6**: PR-controlled dismiss_reviews.py executed by the privileged pull_request_target workflow (Checks (secure)). 45s sleep proves attacker-controlled code ran. Zero-harm PoC: no credentials read, no network.\n") | ||
| except Exception as e: | ||
| print("summary write skipped:", e) | ||
| sys.exit(0) |
There was a problem hiding this comment.
This change completely removes the original implementation of the dismiss_reviews.py utility and replaces it with a placeholder script that sleeps for 45 seconds and writes a security PoC marker. This breaks the repository's automated review dismissal functionality. The original implementation must be restored.
| # No-op security PoC marker (Google OSS VRP), variant 5. | ||
| # Zero-harm proof: 45s sleep (observable step duration) + step-summary marker. | ||
| # No token access, no network, exit 0. | ||
|
|
||
| import os | ||
| import sys | ||
| import time | ||
|
|
||
| MARKER = "VRP-A3-MARKER-754219-RUN5" | ||
|
|
||
| print(MARKER + ": PR-controlled dismiss_reviews.py executed in privileged Checks (secure) workflow") | ||
| time.sleep(45) | ||
| try: | ||
| with open(os.environ["GITHUB_STEP_SUMMARY"], "a") as f: | ||
| f.write("\n**VRP-A3-MARKER-754219-RUN5**: PR-controlled dismiss_reviews.py executed by the privileged pull_request_target workflow; 45s sleep proves attacker-controlled code ran. Zero-harm PoC, no credentials touched.\n") | ||
| except Exception as e: | ||
| print("summary write skipped:", e) | ||
| sys.exit(0) |
There was a problem hiding this comment.
This file appears to be a duplicate placeholder script with an invalid/unusual filename containing spaces and special characters. It does not serve any functional purpose in the codebase and should be removed.
| <!-- sync trigger 3 (security PoC bookkeeping) --> | ||
|
|
||
| <!-- sync trigger 4 --> |
There was a problem hiding this comment.
These HTML comments appear to be placeholder markers for a security proof-of-concept and do not belong in the production documentation. They should be removed to keep the README clean.
1 participant
Security PoC (Google OSS VRP) - zero-harm marker: this PR demonstrates that the "Checks (secure)" pull_request_target workflow checks out the PR merge ref and runs scripts/gha/dismiss_reviews.py (PR-controlled) in a privileged context. This variant only sleeps 45s and writes a step-summary marker. No credentials are read or transmitted; no network access. Will be closed immediately after the single test run. POC_ID: VRP-A3-20260918-B