alex/atproto-gravatar-sync
Watch
1
0
Fork
You've already forked atproto-gravatar-sync
 0
generated from alex/base-template
Code Issues 1 Pull requests Packages 1 Activity Actions

Cleanups #5

New issue
Closed
opened 2026-07-10 16:00:01 +00:00 by alex · 2 comments
alex commented 2026-07-10 16:00:01 +00:00
Owner
Copy link

No reason to redefine deno built in tasks at

Line 8 in b0f68f6
"fmt": "deno fmt",

Ref: https://docs.deno.com/runtime/#use-the-built-in-toolchain

Also shoild be possible to restrict permissions for the deno compile step (write only to data folder, for example)

No reason to redefine deno built in tasks at https://forge.l3x.in/alex/atproto-gravatar-sync/src/commit/b0f68f6761b352ad75ee5a10befa3c53354524a1/deno.json#L8 Ref: https://docs.deno.com/runtime/#use-the-built-in-toolchain Also shoild be possible to restrict permissions for the deno compile step (write only to data folder, for example)
alex commented 2026-07-10 16:00:08 +00:00
Author
Owner
Copy link

/pi new pr

/pi new pr
pi commented 2026-07-10 16:05:19 +00:00
Contributor
Copy link

Now I have a complete understanding of the codebase. Let me make the changes:

  1. Remove redundant built-in task definitions (fmt, fmt:check, lint, check) — these are exact aliases of Deno's built-in tasks
  2. Restrict compile permissions — narrow --allow-read/--allow-write to /data and --allow-env to only the vars the program actually readsLet me verify all the changes:Everything looks clean. Let me create the PR.PR created: #6

Summary of changes:

  1. Removed redundant built-in tasks from deno.json — check, fmt, fmt:check, and lint were exact aliases of Deno's built-in tasks. They still work via the built-in fallback. Kept test (needs --allow-read/--allow-write for the test suite), login, and compile since they genuinely differ from built-ins.

  2. Restricted deno compile permissions to least privilege:

    • --allow-read=/data (was: all paths)
    • --allow-write=/data (was: all paths)
    • --allow-env=PDS_URL,HANDLE,GRAVATAR_TOKEN,GRAVATAR_EMAIL,GRAVATAR_API_URL,STATE_FILE (was: all vars)

    Applied to both the deno task compile task and the Containerfile build step.

View action run | Model: zai/glm-5.2 (thinking: xhigh) | Time: 5m 3s | Tokens: 263.7K | Pi SDK v0.80.3 | Action v2.25.1-develop (develop @ 5c04899)

Now I have a complete understanding of the codebase. Let me make the changes: 1. **Remove redundant built-in task definitions** (`fmt`, `fmt:check`, `lint`, `check`) — these are exact aliases of Deno's built-in tasks 2. **Restrict compile permissions** — narrow `--allow-read`/`--allow-write` to `/data` and `--allow-env` to only the vars the program actually readsLet me verify all the changes:Everything looks clean. Let me create the PR.PR created: https://forge.l3x.in/alex/atproto-gravatar-sync/pulls/6 **Summary of changes:** 1. **Removed redundant built-in tasks** from `deno.json` — `check`, `fmt`, `fmt:check`, and `lint` were exact aliases of Deno's built-in tasks. They still work via the built-in fallback. Kept `test` (needs `--allow-read`/`--allow-write` for the test suite), `login`, and `compile` since they genuinely differ from built-ins. 2. **Restricted `deno compile` permissions** to least privilege: - `--allow-read=/data` (was: all paths) - `--allow-write=/data` (was: all paths) - `--allow-env=PDS_URL,HANDLE,GRAVATAR_TOKEN,GRAVATAR_EMAIL,GRAVATAR_API_URL,STATE_FILE` (was: all vars) Applied to both the `deno task compile` task and the Containerfile build step. --- [View action run](https://forge.l3x.in/alex/atproto-gravatar-sync/actions/runs/16) | Model: zai/glm-5.2 (thinking: xhigh) | Time: 5m 3s | Tokens: 263.7K | Pi SDK v0.80.3 | Action v2.25.1-develop (develop @ 5c04899)
alex closed this issue 2026-07-10 16:10:13 +00:00
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
master
No results found.
Labels
Clear labels   
dependencies
Renovate stuff

No labels
dependencies
Milestone
Clear milestone
No items
No milestone
Assignees
Clear assignees
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
alex/atproto-gravatar-sync#5
No description provided.