Path injection (#22, #28, #29, #30):
- Switch from Path.relative_to() to os.path.realpath() + str.startswith()
in all four path-validation sites across finetune and rl UI data_loader.py
and finetune app.py. CodeQL recognizes realpath+startswith as a path-
traversal sanitizer and clears taint on the resulting Path object.
- Also simplify finetune/app.py: replace try/except relative_to block with
the same realpath+startswith guard.
Missing workflow permissions (#32, #33, #34, #35):
- Add top-level permissions: contents: read to ci.yml, docs.yml, lint.yml,
and security.yml. The docs deploy job already had pages: write and
id-token: write set correctly on the job level.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* test fix release CI
* test fix release CI
* test fix release CI
* test fix release CI
* test fix release CI
* test fix release CI
* test fix release CI
* test fix release CI
* remove bump2version from release CI
* change code
* split release CI
* format with toml-sort
* change triggers
* Update pyproject.toml
* optimize code
* fix sort-toml error
* merge release & upload
* fix release error
* test release ci
* test release ci
* test release ci
* test release ci
* test release ci
* test release ci
* test release ci
* test release ci
* test release ci
* test release ci
* test release ci
* test release ci
* test release ci
* test release ci
* test release ci
---------
Co-authored-by: you-n-g <you-n-g@users.noreply.github.com>
* fix mypy error
* fix mypy error
* fix ruff error
* change command
* delete python 3.8&3.9 from CI
* change command
* Some modifications according to the comments
* Add literal type
* Update .github/workflows/ci.yml
* Some modifications according to the comments
* fix ruff error
* fix meta dict
* Fix type
* Some modifications according to the comments
* merge latest code
* Some modifications according to the comments
* Some modifications according to the comments
* fix ci error
* fix ruff error
* Update Makefile
* Update Makefile
---------
Co-authored-by: Ubuntu <debug@debug.qjtqi00gqezu1eqs55bqdrf51f.px.internal.cloudapp.net>
Co-authored-by: Young <afe.young@gmail.com>
Co-authored-by: you-n-g <you-n-g@users.noreply.github.com>
* refine CI script
* refine all the code to higher quality
* refine the script to factor extraction and implementation
* add task loader interface
* add a task loader interface && move pdf analysis to pdf task loader
* change the name to global variables
---------
Co-authored-by: xuyang1 <xuyang1@microsoft.com>
dependabot[bot]