ci(skills): propose exact hashes needed by PR 7049 (#7596)

This commit is contained in:
Willem Jiang 2026-10-27 11:22:50 +08:00 committed by GitHub
parent 137c721d2b
commit bfd599e840
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 12 additions and 4 deletions

View File

@ -10,7 +10,8 @@
"evidence": "subprocess.run",
"file_sha256": "sha256:87d864570220b699fac52da309d2d6efdb060647bfebc74f768128e646accf80",
"preapproved_file_sha256s": [
"sha256:2877bde08bf3f437b9dae3d57585a0840b9b1024736d2e5c6c657b71899269d0"
"sha256:2877bde08bf3f437b9dae3d57585a0840b9b1024736d2e5c6c657b71899269d0",
"sha256:83e82d6049147a1d8b28a5155b35eed270e9053e9bde8f99893b597a2e7c3974"
],
"reason": "Required Claude CLI invocation uses a fixed executable, an argv list, prompt input over stdin, and shell=False.",
"expires_on": "2027-02-28"
@ -24,7 +25,8 @@
"evidence": "subprocess.Popen",
"file_sha256": "sha256:43e3b8f80dbf69c343967ba77e268fae991d9fa3ed68b32a0ff02532cd48657f",
"preapproved_file_sha256s": [
"sha256:ea2521ba41c8fd16b2900758c890bb6c6d2b4b01da10b4a860facb8587ed0bde"
"sha256:ea2521ba41c8fd16b2900758c890bb6c6d2b4b01da10b4a860facb8587ed0bde",
"sha256:f86a5c9a3339ae90ffd59635201d09f2c8019dc35b72e517228d31d6b3e1912c"
],
"reason": "Required Claude CLI invocation uses a fixed executable, an argv list, captured output streams, and shell=False.",
"expires_on": "2027-02-28"

View File

@ -99,8 +99,14 @@ def test_committed_manifest_matches_schema_and_strict_parser() -> None:
parsed = parse_manifest(manifest_path.read_bytes(), source=str(manifest_path))
assert len(parsed.waivers) == 2
assert parsed.waivers[0].preapproved_file_sha256s == ("sha256:2877bde08bf3f437b9dae3d57585a0840b9b1024736d2e5c6c657b71899269d0",)
assert parsed.waivers[1].preapproved_file_sha256s == ("sha256:ea2521ba41c8fd16b2900758c890bb6c6d2b4b01da10b4a860facb8587ed0bde",)
assert parsed.waivers[0].preapproved_file_sha256s == (
"sha256:2877bde08bf3f437b9dae3d57585a0840b9b1024736d2e5c6c657b71899269d0",
"sha256:83e82d6049147a1d8b28a5155b35eed270e9053e9bde8f99893b597a2e7c3974",
)
assert parsed.waivers[1].preapproved_file_sha256s == (
"sha256:ea2521ba41c8fd16b2900758c890bb6c6d2b4b01da10b4a860facb8587ed0bde",
"sha256:f86a5c9a3339ae90ffd59635201d09f2c8019dc35b72e517228d31d6b3e1912c",
)
def test_skill_creator_waivers_match_current_error_findings() -> None: