Merge branch 'main' into main

Author: jjw24

.github/workflows/security-vt-scan.yml

@@ -4,32 +4,56 @@ on:
   workflow_dispatch:
   schedule:
     - cron: "0 17 * * *"
-  pull_request:
+  pull_request_target:
     types: [opened, synchronize]
 
+permissions:
+  contents: read  # Restrict GITHUB_TOKEN
+
 jobs:
-  changes:
+  vt-plugin-scan-changes-check:
+    if: github.event_name == 'pull_request_target'
     runs-on: ubuntu-latest
     outputs:
       plugins: ${{ steps.filter.outputs.plugins }}
+      non_plugin_files: ${{ steps.filter.outputs.non_plugin_files }}
     steps:
       - name: Check out repository code
         uses: actions/checkout@v6
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
       - uses: dorny/paths-filter@v4
-        if: github.event_name == 'pull_request'
         id: filter
         with:
+          predicate-quantifier: 'every'
           filters: |
             plugins:
-              - 'plugins/**'
+              - 'plugins/*.json'
+            non_plugin_files:
+              - '**'
+              - '!plugins/*.json'
+      - name: Fail if non-plugin files changed
+        if: github.event_name == 'pull_request_target' && steps.filter.outputs.plugins == 'true' && steps.filter.outputs.non_plugin_files == 'true'
+        run: |
+          echo "This PR contains changes to files outside the plugins directory."
+          echo "Plugin submission PRs must only create/modify plugin manifest files in the plugins directory."
+          exit 1
 
   vt-plugin-scan:
-    needs: changes
-    if: needs.changes.outputs.plugins == 'true' || github.event_name == 'workflow_dispatch' || github.event_name == 'schedule'
+    needs: vt-plugin-scan-changes-check
+    if: |
+      always() && (
+        (github.event_name == 'pull_request_target' && needs.vt-plugin-scan-changes-check.outputs.plugins == 'true' && needs.vt-plugin-scan-changes-check.outputs.non_plugin_files == 'false') ||
+        github.event_name == 'workflow_dispatch' ||
+        github.event_name == 'schedule'
+      )
     runs-on: ubuntu-latest
     steps:
       - name: Check out repository code
         uses: actions/checkout@v6
+        # To actually check out and run the plugin downloader from the fork's PR
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
 
       - name: Set up Python
         uses: actions/setup-python@v6
@@ -44,7 +68,7 @@ jobs:
         uses: actions/cache/restore@v5
         # No need to restore cache, PR's plugin is downloaded and scanned each time.
         # Plugin dev may repeatedly only update one version
-        if: github.event_name != 'pull_request'
+        if: github.event_name != 'pull_request_target'
         with:
           path: |
             scan-files/
@@ -53,21 +77,17 @@ jobs:
           restore-keys: plugin-zips-
 
       - name: Download plugin submitted in this PR
-        if: github.event_name == 'pull_request'
+        if: github.event_name == 'pull_request_target'
         run: python ci/src/download_plugins.py --mode new --output-dir scan-files
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Download all plugins with cache metadata
-        if: github.event_name != 'pull_request'
+        if: github.event_name != 'pull_request_target'
         run: python ci/src/download_plugins.py --output-dir scan-files --cache-meta plugin-download-cache.json
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Restore VirusTotal scan cache from previous runs
         uses: actions/cache/restore@v5
         # Don't use cache, upload/retrieve report from VirustTotal each time for new submissions
-        if: github.event_name != 'pull_request'
+        if: github.event_name != 'pull_request_target'
         with:
           path: vt_cache.json
           key: vt-cache-restore-not-used
@@ -91,15 +111,15 @@ jobs:
       - name: Save VirusTotal scan cache for future runs
         uses: actions/cache/save@v5
         # Cache not used for PR plugin submissions
-        if: always() && github.event_name != 'pull_request'
+        if: always() && github.event_name != 'pull_request_target'
         with:
           path: vt_cache.json
           key: vt-cache-${{ hashFiles('vt_cache.json') }}
 
       - name: Save plugin ZIPs and cache metadata for future runs
         uses: actions/cache/save@v5
         # Upload even if scan fails
-        if: always() && github.event_name != 'pull_request'
+        if: always() && github.event_name != 'pull_request_target'
         with:
           path: |
             scan-files/
@@ -116,15 +136,15 @@ jobs:
       - name: Upload VirusTotal scan cache as viewable artifact
         uses: actions/upload-artifact@v7
         # Cache not used for PR plugin submissions
-        if: always() && github.event_name != 'pull_request'
+        if: always() && github.event_name != 'pull_request_target'
         with:
           path: vt_cache.json
           archive: false
 
       - name: Upload plugin download cache metadata as viewable artifact
         uses: actions/upload-artifact@v7
         # Upload even if scan fails
-        if: always() && github.event_name != 'pull_request'
+        if: always() && github.event_name != 'pull_request_target'
         with:
           path: plugin-download-cache.json
-          archive: false
+          archive: false

.github/workflows/test-src-files.yml

@@ -1,4 +1,4 @@
-name: src unit tests
+name: Src unit tests
 
 on:
   push:
@@ -17,6 +17,7 @@ jobs:
           filters: |
             src_files:
               - 'ci/src/download_plugins.py'
+              - 'tests/**'
 
   unit-tests:
     needs: changes