Remove redundant built-in tasks and restrict compile permissions #6

pi · 2026-07-10T16:05:09Z

pi commented

2026-07-10 16:05:09 +00:00

Changes

Closes #5.

1. Remove redundant Deno built-in task definitions

Removed check, fmt, fmt:check, and lint from deno.json — these were exact aliases of Deno's built-in tasks, so defining them was unnecessary. They continue to work via deno task check / deno task fmt / etc. thanks to the built-in fallback.

Kept the tasks that have a genuine reason to differ from the built-ins:

test — needs --allow-read --allow-write for temp dirs / file I/O in the test suite
login — not a built-in; runs the interactive OAuth bootstrap
compile — not a built-in

2. Restrict `deno compile` permissions

The compiled binary previously had blanket --allow-read, --allow-write, and --allow-env. Now narrowed to least privilege:

Flag	Before	After
`--allow-read`	all paths	`/data` only
`--allow-write`	all paths	`/data` only
`--allow-env`	all vars	`PDS_URL`, `HANDLE`, `GRAVATAR_TOKEN`, `GRAVATAR_EMAIL`, `GRAVATAR_API_URL`, `STATE_FILE`
`--allow-net`	all hosts	(unchanged — PDS/Gravatar URLs are user-configurable)

This matches the runtime design: the state file lives on the /data volume (VOLUME ["/data"]), and loadConfig() reads exactly those six environment variables. Applied to both the deno task compile task and the Containerfile build step.

## Changes Closes #5. ### 1. Remove redundant Deno built-in task definitions Removed `check`, `fmt`, `fmt:check`, and `lint` from `deno.json` — these were exact aliases of [Deno's built-in tasks](https://docs.deno.com/runtime/#use-the-built-in-toolchain), so defining them was unnecessary. They continue to work via `deno task check` / `deno task fmt` / etc. thanks to the built-in fallback. **Kept** the tasks that have a genuine reason to differ from the built-ins: - `test` — needs `--allow-read --allow-write` for temp dirs / file I/O in the test suite - `login` — not a built-in; runs the interactive OAuth bootstrap - `compile` — not a built-in ### 2. Restrict `deno compile` permissions The compiled binary previously had blanket `--allow-read`, `--allow-write`, and `--allow-env`. Now narrowed to least privilege: | Flag | Before | After | |---|---|---| | `--allow-read` | all paths | `/data` only | | `--allow-write` | all paths | `/data` only | | `--allow-env` | all vars | `PDS_URL`, `HANDLE`, `GRAVATAR_TOKEN`, `GRAVATAR_EMAIL`, `GRAVATAR_API_URL`, `STATE_FILE` | | `--allow-net` | all hosts | *(unchanged — PDS/Gravatar URLs are user-configurable)* | This matches the runtime design: the state file lives on the `/data` volume (`VOLUME ["/data"]`), and `loadConfig()` reads exactly those six environment variables. Applied to both the `deno task compile` task and the Containerfile build step.

pi added 1 commit

2026-07-10 16:05:09 +00:00

Remove redundant built-in tasks and restrict compile permissions

Build and Push Container Image / build-and-push (pull_request) Failing after 24s

Details

e4f8ee8674

Co-authored-by: alex <alex@users.noreply.github.com>

pi referenced this pull request

2026-07-10 16:05:19 +00:00

Cleanups #5

alex reviewed

2026-07-10 16:08:32 +00:00

alex left a comment

/pi see comment, push changes

README.md

					
				@ -60,3 +60,2 @@

				deno task test       # deno test (no network — HTTP is mocked in-process)

				deno task fmt        # format

				deno task lint       # lint

				deno task fmt        # format (built-in)

let's remove the "task" and use built-in directly when available, eg "deno fmt --check", etc

alex marked this conversation as resolved

pi commented

2026-07-10 16:08:40 +00:00

No prompt found - cannot proceed

View action run | Model: zai/glm-5.2 (thinking: xhigh) | Time: 0s | Action v2.25.1-develop (develop @ 5c04899)

No prompt found - cannot proceed --- [View action run](https://forge.l3x.in/alex/atproto-gravatar-sync/actions/runs/19) | Model: zai/glm-5.2 (thinking: xhigh) | Time: 0s | Action v2.25.1-develop (develop @ 5c04899)

alex merged commit 8cd84d970c into master

2026-07-10 16:10:13 +00:00

alex referenced this pull request from a commit

2026-07-10 16:10:13 +00:00

Remove redundant built-in tasks and restrict compile permissions (#6)

alex deleted branch pi/issue5-1783699508260

2026-07-10 16:10:13 +00:00

Sign in to join this conversation.

No reviewers