Repository navigation
Apply opt-in mise trust to eligible new worktrees - #77
Merged
Merged
Conversation
Let users save their choice with `timber config` before worktree creation starts using the policy. Default to disabled because trusting a repository permits mise configuration to execute code. Reject unknown settings so changing a value cannot silently discard them.
Cache the authenticated github.com username and all organizations to provide ownership evidence for the next worktree trust change. Reuse valid entries for 24 hours to avoid repeated network requests. Require a successful refresh when the cache is missing, malformed, expired, or future-dated so invalid identity data cannot serve as ownership evidence. Limit refresh time to 15 seconds and replace the cache atomically with owner-only permissions.
Trust mise configuration after worktree creation and before opening Herdr so eligible worktrees are ready for use when automatic trust is explicitly enabled. Because trusted configuration can execute code, require a regular root-level `mise.toml` and a GitHub repository owned by the cached user or an organization they belong to. Determine ownership from the selected upstream's remote, including local branches that track a remote, rather than assuming origin or relying on a registry name. Reject symlinks to avoid trusting files outside the checkout. Warn if a required identity cache refresh or mise trust fails, but keep worktree creation successful. Document the security opt-in and the need to clear the identity cache after account or membership changes.
Offer to enable automatic mise trust when an interactive user creates an eligible worktree with trust disabled and no recorded choice. Default to No because trusting mise configuration permits code execution. Save either answer in a separate decision marker to distinguish an explicit refusal from the disabled default and prevent repeated prompts. Explicit configuration flags also record a decision. After refusal, show `timber config --auto-mise-trust` so users can enable trust later. Skip the prompt and identity lookup for undecided noninteractive creation.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.