Marcos
8c491a7626
The reviewer runs an opencode agent with `bash: "*": allow` over a checkout of the PR author's branch, and the pod holds a Gitea Write credential. Those two facts had no wall between them. Security - _build_env now allow-lists the subprocess environment instead of inheriting it, so PRAGENT_BOT_TOKEN and WEBHOOK_SECRET never reach the agent. This was the live hole: a PR body or an AGENTS.md could ask the agent to `curl` the token out, and it had both the value and the tool. - sanitize_workdir deletes author-controlled agent-instruction files from the checkout before opencode starts (AGENTS.md at any depth, CLAUDE.md, .cursorrules, a repo opencode.json/.opencode, copilot-instructions.md). opencode loads nested AGENTS.md as instructions, so a PR could otherwise ship its own system prompt. They are still reviewed, as data. - The brief fences PR title/body and diff in --- UNTRUSTED --- markers under a trust-boundary preamble; the pragent agent, the three lens subagents and the review-methodology skill now treat injection attempts as a critical finding to report rather than an instruction to obey. - .pr-review.json is read from the PR's base branch, not the head sha. Its `instructions` field is spliced into the reviewer's prompt, so head-ref reading let any author rewrite the reviewer's rules. Fields are length-capped. - Untar rejects escaping symlinks, parent traversal, and writes through a planted symlink (tar-slip). - The image runs as uid 10001 instead of root. Robustness - Bounded review concurrency (PRAGENT_MAX_CONCURRENT_REVIEWS, default 2). Each review forks an opencode process; a thread per delivery was a fork bomb on a burst of labels or Gitea retries. - An in-flight (repo, index, sha) claim closes the check-then-act race in the sha-marker dedupe, where two deliveries a second apart both read "not yet reviewed" and both posted. - Request bodies are capped before being read into memory. Correctness - parse_diff_anchors counts a whitespace-stripped blank context line. Skipping it desynced the new-line counter for the rest of the hunk and silently misplaced every later inline comment in that file. - post_inline_review's body-only fallback folds the anchored findings into the body. It previously posted a summary saying "N inline comment(s) below" with no comments and no findings — losing them all on the one path that matters. - fetch_pr_diff's files-endpoint fallback emits real a// b/ prefixes (so changed_files and the anchor parser work on it) and reports both HTTP statuses in its error instead of the same one twice. - The CI workflow template pins PRAGENT_ENGINE=ollama; review_pr defaults to opencode, which does not exist on a Gitea Actions runner. Tests: 68 -> 101, covering each of the above. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01B11e8TZZxJyzHW7jj7KWUN
65 lines
3.0 KiB
Docker
65 lines
3.0 KiB
Docker
# pragent pilot — combined webhook + opencode review-engine image.
|
|
#
|
|
# One container runs the Gitea webhook server (python) and subprocess-calls the
|
|
# opencode CLI headlessly to analyze each PR. Includes node + the LSPs / linters
|
|
# the pragent agent's bash tool can invoke on the checked-out repo. The factory
|
|
# (opencode.json + .opencode/ agents/skills) lives at /app and is discovered via
|
|
# PRAGENT_FACTORY_DIR=/app.
|
|
#
|
|
# Build:
|
|
# docker build -t pragent-webhook:opencode -f pilot/Dockerfile .
|
|
# Import into microk8s containerd (sudoless — the raw socket is group-readable
|
|
# by the microk8s group; the `microk8s ctr` wrapper itself sudo-wraps, so use
|
|
# the raw binary against the socket directly):
|
|
# docker save pragent-webhook:opencode | \
|
|
# /snap/microk8s/current/bin/ctr --address /var/snap/microk8s/common/run/containerd.sock \
|
|
# --namespace k8s.io image import -
|
|
#
|
|
FROM python:3.12-slim
|
|
|
|
# System deps: git (archive/repo reads by the agent), ripgrep (opencode dep),
|
|
# curl + ca-certs (archive fetch), xz-utils (node install).
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
git ripgrep curl ca-certificates xz-utils \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Node 20 — opencode runtime + the npm-installed LSP servers below.
|
|
RUN curl -fsSL https://deb.nodesource.com/setup_20.x | bash - \
|
|
&& apt-get install -y --no-install-recommends nodejs \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# opencode CLI, pinned to the verified version. opencode bun-installs its
|
|
# @opencode-ai runtime into $HOME/.config/opencode/node_modules on first run
|
|
# (cold-start ~30-60s, once per pod lifetime; the webhook returns 202 async so
|
|
# no Gitea delivery timeout is risked). HOME is an emptyDir at runtime.
|
|
RUN npm install -g opencode-ai@1.3.10
|
|
|
|
# LSPs + linters the pragent agent's bash tool can invoke on reviewed repos.
|
|
# (opencode's own LSP tool is opportunistic; the real signal is the agent
|
|
# running the repo's own tsc/ruff/eslint/go vet — these make that available.)
|
|
RUN npm install -g pyright typescript-language-server typescript eslint \
|
|
&& pip install --no-cache-dir ruff
|
|
|
|
# pragent repo: factory (opencode.json + .opencode/) + pilot scripts.
|
|
WORKDIR /app
|
|
COPY . /app
|
|
|
|
ENV PRAGENT_FACTORY_DIR=/app \
|
|
PRAGENT_OPENCODE_BIN=/usr/bin/opencode \
|
|
PRAGENT_ENGINE=opencode \
|
|
OPENCODE_MODEL=headroom/glm-5.2:cloud \
|
|
OPENCODE_EXPERIMENTAL_LSP_TOOL=true \
|
|
PRAGENT_RTK_DIR="" \
|
|
PRAGENT_WORK_ROOT=/tmp/pragent-work
|
|
|
|
# Run unprivileged. The opencode agent gets `bash: "*": allow` over a checkout
|
|
# of the PR author's branch, so hostile code does get executed here eventually
|
|
# (a linter reading a crafted config, a prompt injection that lands). Root in
|
|
# the container is one container-escape CVE away from root on the node; this
|
|
# user owns nothing but its own workdir.
|
|
RUN useradd --uid 10001 --create-home --shell /usr/sbin/nologin pragent \
|
|
&& mkdir -p /tmp/pragent-work \
|
|
&& chown -R pragent:pragent /tmp/pragent-work /app
|
|
USER 10001
|
|
|
|
CMD ["python3", "/app/pilot/webhook_server.py"] |