fix(security): gitea_security_audit and gitea_branch_protection_get default to "main" instead of the repo default branch #20

New issue

Closed

opened 2026-10-24 00:58:36 +00:00 by dsh · 1 comment

dsh commented

2026-10-24 00:58:36 +00:00

Owner

Symptom

The security tools audit a branch literally named main when no branch is passed. This repo's default branch is master (renamed on 2026-10-23), so the audit inspects a deleted branch and reports findings for it.

Repro

gitea_security_audit {owner:"dsh-plugins", repo:"dsh-gitea"}
→ Security Audit for dsh-plugins/dsh-gitea@main: score 60/100 [ACTION REQUIRED]. 1 issue(s) detected.
    - ⚠️ Branch "main" has NO branch protection rule. Direct push or force push is possible.

gitea_branch_protection_get {owner:"dsh-plugins", repo:"dsh-gitea", branch:"master"}
→ Branch "master" has no protection rule configured.

gitea_branches {action:"list", owner:"dsh-plugins", repo:"dsh-gitea"}
→ master

Observed vs expected

Observed: the audit is labelled @main and scores a branch that does not exist.
Expected: with no explicit branch, use the repository default branch (master) and label the report with it. If an explicit branch is missing, say so instead of auditing it silently.

Root cause

lib/branch-protection.js hard-codes the fallback in three places:

const branch = String(args.branch || 'main').trim()   // lines 11, 36, 177

lib/tool-defs/repos.js documents defaults to main for both tools.

Proposed fix

Resolve the default branch from the repo API (client.getRepo(owner, repo).default_branch) when args.branch is absent; fall back to main only if that lookup fails. Update the tool descriptions and add tests with a repo whose default branch is master.

Acceptance: gitea_security_audit without branch reports @master on this repo; an explicit nonexistent branch produces a clear "branch not found" error rather than a protection finding.

Duplicate check

Searched issues for security, branch, protection (state all) — #2–#18 cover formatters/wiki/labels, none covers branch defaults.

Layer

dsh-gitea plugin/tool.

## Symptom The security tools audit a branch literally named `main` when no `branch` is passed. This repo's default branch is `master` (renamed on 2026-10-23), so the audit inspects a deleted branch and reports findings for it. ## Repro ``` gitea_security_audit {owner:"dsh-plugins", repo:"dsh-gitea"} → Security Audit for dsh-plugins/dsh-gitea@main: score 60/100 [ACTION REQUIRED]. 1 issue(s) detected. - ⚠️ Branch "main" has NO branch protection rule. Direct push or force push is possible. gitea_branch_protection_get {owner:"dsh-plugins", repo:"dsh-gitea", branch:"master"} → Branch "master" has no protection rule configured. gitea_branches {action:"list", owner:"dsh-plugins", repo:"dsh-gitea"} → master ``` ## Observed vs expected - Observed: the audit is labelled `@main` and scores a branch that does not exist. - Expected: with no explicit branch, use the repository default branch (`master`) and label the report with it. If an explicit branch is missing, say so instead of auditing it silently. ## Root cause `lib/branch-protection.js` hard-codes the fallback in three places: ```js const branch = String(args.branch || 'main').trim() // lines 11, 36, 177 ``` `lib/tool-defs/repos.js` documents `defaults to main` for both tools. ## Proposed fix Resolve the default branch from the repo API (`client.getRepo(owner, repo).default_branch`) when `args.branch` is absent; fall back to `main` only if that lookup fails. Update the tool descriptions and add tests with a repo whose default branch is `master`. Acceptance: `gitea_security_audit` without `branch` reports `@master` on this repo; an explicit nonexistent branch produces a clear "branch not found" error rather than a protection finding. ## Duplicate check Searched issues for `security`, `branch`, `protection` (state all) — #2–#18 cover formatters/wiki/labels, none covers branch defaults. ## Layer dsh-gitea plugin/tool.

dsh added the

area/forgejo

priority/next

type/bug

labels

2026-10-24 00:58:36 +00:00

dsh referenced this issue from a commit

2026-10-24 01:16:05 +00:00

fix(qa): branch defaults, webhook content type and integration wording (#19, #20, #21, #22, #29, #30, #35)

dsh referenced this issue

2026-10-24 01:16:09 +00:00

fix(qa): branch defaults, webhook content type and integration wording #40

dsh commented

2026-10-24 01:16:27 +00:00

Author

Owner

Fixed in 281eade (PR #40).

Added resolveTargetBranch() used by branch_protection_get, branch_protection_set and security_audit: an explicit branch is verified against listBranches (missing → branch not found: …); otherwise getRepo().default_branch is used, with main only as a last-resort fallback. Tool descriptions updated.

Live: gitea_security_audit without a branch → Security Audit for dsh-plugins/dsh-gitea@master; explicit no-such-branch → branch not found: no-such-branch.

Tests: test/qa-defaults.test.mjs.

Fixed in `281eade` (PR #40). Added `resolveTargetBranch()` used by `branch_protection_get`, `branch_protection_set` and `security_audit`: an explicit branch is verified against `listBranches` (missing → `branch not found: …`); otherwise `getRepo().default_branch` is used, with `main` only as a last-resort fallback. Tool descriptions updated. Live: `gitea_security_audit` without a branch → `Security Audit for dsh-plugins/dsh-gitea@master`; explicit `no-such-branch` → `branch not found: no-such-branch`. Tests: `test/qa-defaults.test.mjs`.

dsh closed this issue

2026-10-24 01:16:36 +00:00