fix(action): block symlink escape past GITHUB_WORKSPACE

[anupamme]

Context

Follow-up to #4, which was closed after discussion:

• fix: add path validation in cli.ts (CWE-22) #4 (comment)
• fix: add path validation in cli.ts (CWE-22) #4 (comment)

Conclusion of that thread:

1. The CLI's readInput() should not reject relative .. paths — that's legitimate CLI usage (../staging/... etc.), and rejecting it would regress it.
2. Literal .. traversal isn't reachable via the Action anyway — changedFiles() only ever passes git diff --name-only output to confdiff, and git refuses to track paths containing ...
3. The real residual vector is scoped to the Action: runConfdiff(oldPath, f, …) reads the new side straight off the working tree at f. If a file tracked as a symlink has its target retargeted to point outside GITHUB_WORKSPACE (e.g. a repo that legitimately tracks a symlinked shared config, and a PR repoints it to something like /etc/passwd), reading f follows the symlink and the target's contents can end up in the sticky, public PR comment.

I verified the mechanics with real git repos: a plain file turning into a symlink between base/head is a git type-change (T), which the Action's existing --diff-filter=M already excludes. But a file already tracked as a symlink, with only its target changed in the PR, is reported as a normal M — and does reach runConfdiff. That's the exploitable path this PR closes.

Fix

action/index.mjs: before reading a changed file's new-side content, realpathSync(f) and skip (with a visible warning, same pattern as existing parse errors) any file whose resolved path isn't inside realpathSync(GITHUB_WORKSPACE).

No changes to src/cli.ts / readInput() — intentionally out of scope per the discussion above.

Test plan

• npm test — all existing tests pass, plus two new cases in test/action-symlink.test.ts:
  • a tracked symlink retargeted outside the workspace is skipped and its target's content never appears in output
  • a normal in-workspace config change still produces the expected semantic diff (no regression)

🤖 Generated with Claude Code

[esperanza-volkov]

Reviewed and reproduced end-to-end. Confirmed the residual vector is real for lenient formats: with a config tracked as a symlink at base (e.g. config.csv), git show base: returns the link text which a strict parser (JSON) rejects — but CSV/.env parse it fine, so retargeting the symlink to an out-of-workspace file (/tmp/secret.csv) leaked its contents straight into the sticky PR comment. Your realpathSync(f) containment check (skip-with-warning, using workspace + sep to avoid the /foo vs /foobar prefix trap) blocks it cleanly, and the two new tests plus the full suite (123/123) confirm no regression for normal in-workspace changes. Correctly scoped to the Action boundary with src/cli.ts untouched, exactly as discussed. Nicely done — thank you.