Issues

A secret in a scenario's name: reaches the log filename unmasked

kexi/pitty#43 · opened

on Sep 11, 2026

action.yml: an existing pitty on PATH silently overrides an explicit version: pin

kexi/pitty#42 · opened

on Sep 7, 2026

release_grants_only_contents_write asserts presence, not exclusivity — the gate cannot fail

kexi/pitty#41 · opened

on Sep 7, 2026

Schema misses two constraints pitty enforces: unknown step keys and expect_json's one-of both validate green but exit 2

kexi/pitty#40 · opened

on Sep 7, 2026

GitHub annotations are printed to stdout, corrupting --json output on a runner

kexi/pitty#39 · opened

on Sep 7, 2026

Scenario-level env values are not ${var}-expanded, unlike spawn-level env and contrary to SCHEMA.md

kexi/pitty#38 · opened

on Sep 7, 2026

Snapshot write containment is bypassed by a dangling symlink, writing outside the workspace

kexi/pitty#37 · opened

on Sep 7, 2026

Two scenario files sharing a name: overwrite each other's log in a directory run

kexi/pitty#36 · opened

on Sep 7, 2026

Per-scenario log loses output: only the last spawn's buffer is written, and a spawn-less run writes no log at all

kexi/pitty#35 · opened

on Sep 7, 2026

1

spawn splits the command on whitespace with no quote handling, so quoted arguments are silently mangled

kexi/pitty#34 · opened

on Sep 7, 2026

Snapshot files are written world-readable (0644) although they may contain secrets, unlike logs (0600)

kexi/pitty#33 · opened

on Sep 7, 2026

source keyword accepts case/whitespace variants the published JSON schema rejects

kexi/pitty#32 · opened

on Sep 7, 2026

matrix: every cell writes the same logs/<name>.log, so all but the last cell's diagnostics are destroyed

kexi/pitty#31 · opened

on Sep 7, 2026

expect_json: `equals: null` is silently dropped, making null unassertable and bypassing the one-of guard

kexi/pitty#30 · opened

on Sep 7, 2026

expect_json: an odd number of quotes in surrounding output corrupts string_mask, yielding a stale block or no match

kexi/pitty#29 · opened

on Sep 7, 2026

1

Navigation Menu

Repository navigation

Issues

A secret in a scenario's name: reaches the log filename unmasked

action.yml: an existing pitty on PATH silently overrides an explicit version: pin

release_grants_only_contents_write asserts presence, not exclusivity — the gate cannot fail

Schema misses two constraints pitty enforces: unknown step keys and expect_json's one-of both validate green but exit 2

GitHub annotations are printed to stdout, corrupting --json output on a runner

Scenario-level env values are not ${var}-expanded, unlike spawn-level env and contrary to SCHEMA.md

Snapshot write containment is bypassed by a dangling symlink, writing outside the workspace

Two scenario files sharing a name: overwrite each other's log in a directory run

Per-scenario log loses output: only the last spawn's buffer is written, and a spawn-less run writes no log at all

spawn splits the command on whitespace with no quote handling, so quoted arguments are silently mangled

Snapshot files are written world-readable (0644) although they may contain secrets, unlike logs (0600)

source keyword accepts case/whitespace variants the published JSON schema rejects

matrix: every cell writes the same logs/<name>.log, so all but the last cell's diagnostics are destroyed

expect_json: `equals: null` is silently dropped, making null unassertable and bypassing the one-of guard

expect_json: an odd number of quotes in surrounding output corrupts string_mask, yielding a stale block or no match