[Safe Outputs Conformance] SEC-005: Conformance checker false-positive on frontmatter_hash_pure.cjs (cross-repo allowlist)

[github-actions]

Conformance Check Failure

Check ID: SEC-005
Severity: HIGH
Category: Security

Problem Description

The daily Safe Outputs conformance run reports:

[HIGH] SEC-005: actions/setup/js/frontmatter_hash_pure.cjs supports target-repo but lacks allowlist check

Investigation shows this is a false positive in the conformance checker, not a real cross-repository security violation. The SEC-005 detector (scripts/check-safe-outputs-conformance.sh, check_cross_repo) flags any handler matching the regex target.*[Rr]epo and then requires an allowlist pattern (allowed.*[Rr]epos|validateTargetRepo|checkAllowedRepo).

In actions/setup/js/frontmatter_hash_pure.cjs the only match is line 627:

const target = await checkRemoteSymlink(github, owner, repo, dirPath, ref, symlinkLookupCache);

Here target is a local variable holding a resolved symlink target and repo is an unrelated positional argument. This file computes frontmatter hashes and resolves remote symlinks — it is not a safe-output handler with a configurable target-repo parameter, so no cross-repo allowlist applies.

Affected Components

• Files: scripts/check-safe-outputs-conformance.sh (SEC-005 check_cross_repo), actions/setup/js/frontmatter_hash_pure.cjs (falsely flagged)
• Handlers: frontmatter_hash_pure.cjs

🔍 Current vs Expected Behavior

Current Behavior

The regex target.*[Rr]epo matches the substring target = await checkRemoteSymlink(github, owner, repo on a single line, causing SEC-005 to treat a symlink-resolution utility as a cross-repo handler and emit a HIGH failure. This turns the daily run red (exit code 1) even though no genuine cross-repo allowlist gap exists.

Expected Behavior

SEC-005 should only flag handlers that actually accept a target-repo / targetRepo configuration parameter for cross-repository writes, and those handlers must validate an allowlist. Utility modules that merely use variables named target alongside a repo argument should not be matched.

Remediation Steps

Pick one (regex refinement preferred, exemption acceptable):

1. Tighten the SEC-005 detector in scripts/check-safe-outputs-conformance.sh so it matches an actual config surface, e.g. anchor on target-repo, targetRepo, or target_repo (kebab/camel/snake identifiers) rather than the loose target.*[Rr]epo that spans unrelated tokens on one line.
2. Alternatively, add the already-supported annotation @safe-outputs-exempt SEC-005 to actions/setup/js/frontmatter_hash_pure.cjs with a short comment explaining it is a symlink/hash utility, not a cross-repo handler.
3. If option 1 is chosen, confirm no genuine cross-repo handler is now silently skipped by the tightened pattern.

Verification

After remediation, verify the fix by running:

bash scripts/check-safe-outputs-conformance.sh

The check SEC-005 should PASS without errors and the script exit code should no longer be 1 solely due to this finding.

References

• Safe Outputs Specification: docs/src/content/docs/specs/safe-outputs-specification.md
• Conformance Checker: scripts/check-safe-outputs-conformance.sh
• Run ID: 29676471968
• Date: 2026-07-19

Generated by ✅ Daily Safe Outputs Conformance Checker · 86.7 AIC · ⌖ 13.3 AIC · ⊞ 6.6K · ◷

• expires on Jul 19, 2026, 10:35 PM UTC-08:00