Merge pull request 'Lock CI checkout credential scope to the injected server and allowlist' (#215) from fix/ci-checkout-credential-scope into main

tests/test_ci_credentials.py

@@ -122,17 +122,45 @@ class CheckoutTests(unittest.TestCase):
         self.git(self.base, "clone", "-q", "--bare", str(source), str(target))
         return sha
 
-    def run_checkout(self, sha):
+    def run_checkout(self, sha, metadata_url=None):
         # Only the fixed transport endpoint changes; execute the actual workflow
         # shell/Python logic, not a test-specific implementation of checkout.
         script = checkout_script().replace(SERVER, self.url)
         return subprocess.run(["bash", "-c", script], cwd=self.checkout,
                               env=self.env | {"TOKEN": ROOT_TOKEN, "SUBMODULE_TOKEN": SUB_TOKEN,
-                                              "GITHUB_SERVER_URL": self.url,
+                                              "GITHUB_SERVER_URL": metadata_url or self.url,
                                               "GITHUB_REPOSITORY": "weichen/Agent-System-Dev",
                                               "GITHUB_SHA": sha},
                               capture_output=True, text=True, timeout=30)
 
+    def test_credential_destination_confined_to_injected_server(self):
+        # 合入语义（PR #213，2026-10-05）：传输基址 = 运行器注入的 GITHUB_SERVER_URL
+        # （run 950 实测为内网 http 形态 http://172.17.0.1:3000），凭据只发往
+        # 「该基址 + 仓库白名单」路径。锁定三点：任一注入拼写（含/不含尾斜杠）检出
+        # 成功；每个带凭据请求都落在白名单仓库路径且 root/子仓令牌分离；注入值
+        # 非 http(s) 时 fail-closed 拒绝——不回落到任何其他端点、不发凭据。
+        core = self.publish("Agent-System-Core")
+        root = self.publish("Agent-System-Dev", [("modules/core", "Agent-System-Core", core, None)])
+        for index, injected in enumerate((self.url, self.url + "/")):
+            with self.subTest(injected=injected):
+                self.checkout = self.base / f"injected-checkout-{index}"
+                self.checkout.mkdir()
+                self.requests.clear()
+                result = self.run_checkout(root, metadata_url=injected)
+                self.assertEqual(result.returncode, 0, result.stderr)
+                self.assertEqual(self.git(self.checkout / "modules/core", "rev-parse", "HEAD"), core)
+                self.assertTrue(self.requests)
+                for path, auth in self.requests:
+                    self.assertRegex(path, r"^/weichen/Agent-System-(Dev|Core)\.git/(info/refs|git-upload-pack)$")
+                    self.assertEqual(auth, "token " + (ROOT_TOKEN if "Agent-System-Dev.git/" in path else SUB_TOKEN))
+        self.checkout = self.base / "injected-checkout-refused"
+        self.checkout.mkdir()
+        self.requests.clear()
+        result = self.run_checkout(root, metadata_url="git-panel.u1680832.nyat.app:30319")
+        self.assertNotEqual(result.returncode, 0)
+        self.assertFalse(self.requests)
+
+
     def test_candidate_cannot_read_checkout_credentials(self):
         sha = self.publish("Agent-System-Dev")
         result = self.run_checkout(sha)