fix: complete lesson lint cleanup #540
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Lesson Security Scan | |
| on: | |
| pull_request: | |
| paths: | |
| - "lessons/**" | |
| push: | |
| paths: | |
| - "lessons/**" | |
| permissions: | |
| contents: read | |
| jobs: | |
| lint: | |
| permissions: | |
| contents: read | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Scan lessons for dangerous patterns | |
| run: | | |
| echo "🔍 Scanning lessons for suspicious content..." | |
| EXIT_CODE=0 | |
| PATTERNS=( | |
| 'rm\s+-rf' | |
| 'rm\s+-fr' | |
| ':(){ :|:& };:' | |
| 'curl.+pipe.+sh' | |
| 'wget.+pipe.+sh' | |
| 'curl.+bash' | |
| 'bash.+dev/tcp' | |
| r'\beval\b' | |
| r'\bexec\b' | |
| # '`[^`]*`' — removed: too noisy, flags all inline code | |
| ) | |
| for file in lessons/*.md; do | |
| [ -f "$file" ] || continue | |
| for pattern in "${PATTERNS[@]}"; do | |
| if grep -Eq "$pattern" "$file" 2>/dev/null; then | |
| echo "⚠️ WARNING: Suspicious pattern found in $file: $pattern" | |
| grep -En "$pattern" "$file" || true | |
| EXIT_CODE=1 | |
| fi | |
| done | |
| done | |
| if [ "$EXIT_CODE" -eq 0 ]; then | |
| echo "✅ All lessons passed security scan." | |
| else | |
| echo "❌ Some lessons contain potentially dangerous patterns." | |
| echo "" | |
| echo "These may be legitimate (e.g., explaining a fix)." | |
| echo "Please review and ensure commands are wrapped in code blocks." | |
| fi | |
| exit $EXIT_CODE | |
| - name: Scan for dangling shell commands outside code blocks | |
| run: | | |
| echo "🔍 Checking for unescaped shell commands..." | |
| EXIT_CODE=0 | |
| for file in lessons/*.md; do | |
| [ -f "$file" ] || continue | |
| # Look for lines starting with $ or % that aren't in code blocks | |
| # Simple heuristic: check if backtick-wrapped | |
| while IFS= read -r line; do | |
| if echo "$line" | grep -Eq '^\s*\$[^$]' && \ | |
| ! echo "$line" | grep -Eq '^\s*```'; then | |
| # This might be a shell command outside a code block | |
| echo "ℹ️ Review: $file → $line" | |
| fi | |
| done < "$file" | |
| done | |
| echo "✅ Scan complete." |