Visitar URL original
Prevent raw Git LFS files from being committed through the API by bezabyte · Pull Request #2015 · anthropics/claude-code-action · GitHub
Skip to content

Prevent raw Git LFS files from being committed through the API - #2015

Open
bezabyte wants to merge 2 commits into
anthropics:mainfrom
bezabyte:fix/reject-lfs-api-commits
Open

bezabyte wants to merge 2 commits into
anthropics:mainfrom
bezabyte:fix/reject-lfs-api-commits

Conversation

@bezabyte

Copy link
Copy Markdown

Summary

The commit_files tool writes files through the GitHub Git Data API. When a checkout marks a file with filter=lfs, this path can put the raw file in the tree where Git expects an LFS pointer.

Check Git's working-tree and index attributes before making API requests. If any requested file is LFS-tracked, reject the whole batch with the file name and direct the caller to the Git CLI flow. Ordinary files and workflows without a local checkout keep their existing behavior. The commit-signing docs explain how to configure Git LFS with the Git CLI and how to use SSH signing if signatures are required.

Fixes #91.

Verification

  • The regression test failed on main and passed with the change. It calls the actual MCP server against a loopback GitHub API fixture. It verifies that a mixed batch makes zero API requests, an unstaged edit removing the LFS rule does not bypass the index check, and ordinary commits still succeed.
  • On a GitHub-hosted runner, the Git CLI produced an LFS pointer, uploaded the object to a local bare remote, and recovered the original bytes in a fresh clone.
  • All 1,226 hosted tests, TypeScript, and Prettier passed. Hosted verification

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Action does not commit files to Git LFS

1 participant