Sync with upstream/main (+ GITHUB_TOKEN credential fix) - #3
Merged
Conversation
…nimation, codeblock accent
# Conflicts: # bol/util.py
…i elements and version picker
Added regular expressions for markdown token and link parsing. Enhanced the changelog view with a new tab and improved UI elements for better user interaction.
…list, force refresh changelogs on tab click, unified bottom panel widgets
Refactor GUI code by removing unused regex patterns and updating comments for clarity. Adjust layout and functionality of settings and changelog views.
…, dynamic theme syncing
…DK and vkd3d hashes
…-scroll filter by version in Game changelog
ci: verify release pins in config.py resolve to a matching published asset
feat(gui/cli): several tweaks to the interface and script logic
- ruff (pyflakes F rules) and zizmor (GitHub Actions security auditor) run in the ci.yml static job; CodeQL scans Python and the native C sources (DLL injector, cryptbase RNG stub, XCurl CA shim, cross-compiled with mingw so the extractor sees them) via a new codeql.yml. - Harden the workflows to pass zizmor: persist-credentials: false on all actions/checkout steps, and bind workflow_dispatch inputs to env vars instead of expanding them inline in run blocks (template-injection). - codeql-action pinned to its commit SHA (not the annotated-tag object). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014pmkUWS6teoMZUUnMJG7Gr
- Bug: acct_click() (and code_dialog's on_close) re-imported msa_signed_in locally, which shadows the module-level import. In acct_click that made the sign-out error path reference msa_signed_in before assignment, an UnboundLocalError when msa_logout() raises. Drop the redundant local imports so both use the module-level one. - Remove the unused top-level `from PIL import Image, ImageDraw` (PIL is imported lazily where the QR image is built, so gui.py no longer needs Pillow at import time); drop a redundant local `from .util import load_settings, save_settings`; and remove the dead `code_in_quote` variable. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014pmkUWS6teoMZUUnMJG7Gr
ci: add ruff, zizmor, and CodeQL static analysis
# Conflicts: # .github/workflows/ci.yml
http_json() read GITHUB_TOKEN from the environment and attached it as an Authorization header to every request. It fetches both api.github.com (releases) and feedback.minecraft.net (game changelog), so a user or dev with GITHUB_TOKEN set leaked their GitHub credential to a non-GitHub host. These are public, read-only endpoints that need no credential, and the feature already degrades to its disk cache on error, so the token only ever raised GitHub's rate limit. Drop the ambient read entirely (least authority): no token, nothing to leak. Update the 403 hint to match, and add a regression test asserting no Authorization header is sent even when GITHUB_TOKEN is set. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014pmkUWS6teoMZUUnMJG7Gr
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Syncs the fork with
upstream/main(Wyze3306/BedrockOnLinux) and carries the credential-hygiene fix.Brought in from upstream
bol/qrcodegen.py(offline QR), and relatedauth.py/cli.py/games.py/util.pywork.ci.ymlstatic-analysis merge (ruff, zizmor,persist-credentials) plus upstream's newpinsjob.Fork divergence preserved (deliberate)
bol/config.pyis unchanged: engine SHA pins,WINEGDK_PREBUILT_REPO→ this fork, andSELF_REPOdecoupling all intact. Upstream did not touchconfig.py,third_party/,src/, orscripts/.Conflict resolution
.github/workflows/ci.yml. Resolved by taking upstream's version, which is a strict superset of ours (same ruff/zizmor/persist-credentials steps plus the newpinsjob).Credential fix included
GITHUB_TOKENread fromhttp_json(see the upstream PR toWyze3306/BedrockOnLinux). Landed here too so the fork is protected now; it converges when upstream merges the same change.Verification
python3 -m pytest -q: 223 passed, 2 skipped.ruff check --select F bol/ tests/: clean.git diff origin/main -- bol/config.py: empty (fork pins preserved).Note
Upstream's new
pinsCI job readsWINEGDK_PREBUILT_REPO(this fork) and verifies theconfig.pyengine/xcurl SHAs resolve to published releases on the fork. Both already exist and match:engine-wow64-archs-native5(GDK-Proton-xuser-...tar.gz, SHA4c0b8b0f...) andxcurl-504bb166e4e7(openssl-xcurl-set-...tar.gz, SHA504bb166...), so the job passes as-is.Written with Claude Code
🤖 Generated with Claude Code