From d6f57ddf10352e712dc046c68ccc9da98bea60d3 Mon Sep 17 00:00:00 2001
From: Max Litruv Boonzaayer <litruv@gmail.com>
Date: Fri, 17 Apr 2026 02:50:49 +1000
Subject: [PATCH] Security fix: prevent validation script injection in PRs

---
 .gitea/workflows/validate-pr.yml | 31 ++++++++++++++++++++++++++-----
 1 file changed, 26 insertions(+), 5 deletions(-)

diff --git a/.gitea/workflows/validate-pr.yml b/.gitea/workflows/validate-pr.yml
index 1186b38..a284687 100644
--- a/.gitea/workflows/validate-pr.yml
+++ b/.gitea/workflows/validate-pr.yml
@@ -2,15 +2,21 @@ name: Validate Plugin PR
 on:
   pull_request:
     branches: [ main ]
-    paths:
-      - 'plugins/**'
 
 jobs:
   validate:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - name: Checkout base branch (main) for validation scripts
+        uses: actions/checkout@v3
         with:
+          ref: main
+          path: base
+          
+      - name: Checkout PR branch for plugin files
+        uses: actions/checkout@v3
+        with:
+          path: pr
           fetch-depth: 0
           
       - name: Setup Node.js
@@ -21,11 +27,26 @@ jobs:
       - name: Get changed files
         id: changed-files
         run: |
+          cd pr
           echo "files=$(git diff --name-only origin/${{ github.base_ref }}...HEAD | grep '^plugins/' || echo '')" >> $GITHUB_OUTPUT
           
-      - name: Validate PR
+      - name: Block attempts to modify infrastructure
         run: |
-          node .gitea/scripts/validate-pr.js "${{ github.event.pull_request.user.login }}" "${{ steps.changed-files.outputs.files }}"
+          cd pr
+          INFRA_CHANGES=$(git diff --name-only origin/${{ github.base_ref }}...HEAD | grep -E '^\.gitea/' || echo '')
+          if [ -n "$INFRA_CHANGES" ]; then
+            echo "❌ ERROR: PRs cannot modify .gitea/ directory files"
+            echo "Changed infrastructure files:"
+            echo "$INFRA_CHANGES"
+            echo ""
+            echo "Only plugins/ directory changes are allowed."
+            exit 1
+          fi
+          
+      - name: Validate PR (using trusted validation script from main)
+        run: |
+          node base/.gitea/scripts/validate-pr.js "${{ github.event.pull_request.user.login }}" "${{ steps.changed-files.outputs.files }}"
+        working-directory: pr
           
       - name: Auto-merge PR
         if: success()