Files
NexQuant/.github/workflows/docs.yml
T
TPTBusiness d8ab86d6cf fix(security): replace relative_to() with realpath+startswith for CodeQL sanitization
Path injection (#22, #28, #29, #30):
- Switch from Path.relative_to() to os.path.realpath() + str.startswith()
  in all four path-validation sites across finetune and rl UI data_loader.py
  and finetune app.py. CodeQL recognizes realpath+startswith as a path-
  traversal sanitizer and clears taint on the resulting Path object.
- Also simplify finetune/app.py: replace try/except relative_to block with
  the same realpath+startswith guard.

Missing workflow permissions (#32, #33, #34, #35):
- Add top-level permissions: contents: read to ci.yml, docs.yml, lint.yml,
  and security.yml. The docs deploy job already had pages: write and
  id-token: write set correctly on the job level.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-17 21:59:03 +02:00

87 lines
1.8 KiB
YAML

name: Documentation
on:
push:
branches: [ main ]
paths:
- 'docs/**'
- 'README.md'
- '**/*.rst'
- '.github/workflows/docs.yml'
pull_request:
branches: [ main ]
paths:
- 'docs/**'
- 'README.md'
- '**/*.rst'
permissions:
contents: read
jobs:
docs:
name: Build Documentation
runs-on: ubuntu-latest
steps:
- name: Checkout repository
uses: actions/checkout@v4
- name: Set up Python
uses: actions/setup-python@v5
with:
python-version: "3.10"
- name: Cache pip dependencies
uses: actions/cache@v4
with:
path: ~/.cache/pip
key: ${{ runner.os }}-pip-docs-${{ hashFiles('**/pyproject.toml') }}
restore-keys: |
${{ runner.os }}-pip-docs-
- name: Install docs dependencies
run: |
python -m pip install --upgrade pip
pip install -e ".[docs]"
- name: Build Sphinx documentation
run: |
cd docs
make clean
make html SPHINXOPTS="-W --keep-going" || {
echo "::error::Sphinx build failed with warnings"
exit 1
}
- name: Check for broken links
run: |
cd docs
make linkcheck || {
echo "::warning::Some links are broken (non-blocking)"
exit 0
}
- name: Upload docs artifact
if: github.ref == 'refs/heads/main'
uses: actions/upload-pages-artifact@v3
with:
path: docs/_build/html
deploy:
name: Deploy to GitHub Pages
needs: docs
if: github.ref == 'refs/heads/main'
runs-on: ubuntu-latest
permissions:
pages: write
id-token: write
environment:
name: github-pages
url: ${{ steps.deployment.outputs.page_url }}
steps:
- name: Deploy to GitHub Pages
id: deployment
uses: actions/deploy-pages@v4