Fix security vulnerability and bugs in Ollama API integration

.github/ISSUE_TEMPLATE/config.yml

@@ -24,4 +24,4 @@ contact_links:
     url: https://g.co/vulnz
     about: >
       To report a security issue, please use https://g.co/vulnz. The Google Security Team will
-      respond within 5 working days of your report on https://g.co/vulnz.
+      respond within 5 working days of your report on https://g.co/vulnz.

.github/scripts/add-new-checks.sh

@@ -0,0 +1,39 @@
+#!/bin/bash
+# Copyright 2025 Google LLC.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Script to add new required status checks to an existing branch protection rule.
+# This preserves all your current settings and just adds the new checks
+
+echo "Adding new PR validation checks to existing branch protection..."
+
+# Add the new checks to existing ones
+echo "Adding new checks: enforce, size, and protect-infrastructure..."
+gh api repos/:owner/:repo/branches/main/protection/required_status_checks/contexts \
+  --method POST \
+  --input - <<< '["enforce", "size", "protect-infrastructure"]'
+
+echo ""
+echo "✓ New checks added!"
+echo ""
+echo "Updated required status checks will include:"
+echo "- test (3.10)                    [existing]"
+echo "- test (3.11)                    [existing]"
+echo "- test (3.12)                    [existing]"
+echo "- Validate PR Template           [existing]"
+echo "- live-api-tests                 [existing]"
+echo "- ollama-integration-test        [existing]"
+echo "- enforce                        [NEW - linked issue validation]"
+echo "- size                           [NEW - PR size limit]"
+echo "- protect-infrastructure         [NEW - infrastructure file protection]"

.github/scripts/add-size-labels.sh

@@ -0,0 +1,55 @@
+#!/bin/bash
+# Copyright 2025 Google LLC.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Add size labels to PRs based on their change count
+
+echo "Adding size labels to PRs..."
+
+# Get all open PRs with their additions and deletions
+gh pr list --limit 50 --json number,additions,deletions --jq '.[]' | while read -r pr_data; do
+    pr_number=$(echo "$pr_data" | jq -r '.number')
+    additions=$(echo "$pr_data" | jq -r '.additions')
+    deletions=$(echo "$pr_data" | jq -r '.deletions')
+    total_changes=$((additions + deletions))
+
+    # Determine size label
+    if [ $total_changes -lt 50 ]; then
+        size_label="size/XS"
+    elif [ $total_changes -lt 150 ]; then
+        size_label="size/S"
+    elif [ $total_changes -lt 600 ]; then
+        size_label="size/M"
+    elif [ $total_changes -lt 1000 ]; then
+        size_label="size/L"
+    else
+        size_label="size/XL"
+    fi
+
+    echo "PR #$pr_number: $total_changes lines -> $size_label"
+
+    # Remove any existing size labels first
+    existing_labels=$(gh pr view $pr_number --json labels --jq '.labels[].name' | grep "^size/" || true)
+    if [ ! -z "$existing_labels" ]; then
+        echo "  Removing existing label: $existing_labels"
+        gh pr edit $pr_number --remove-label "$existing_labels"
+    fi
+
+    # Add the new size label
+    gh pr edit $pr_number --add-label "$size_label"
+
+    sleep 1  # Avoid rate limiting
+done
+
+echo "Done adding size labels!"

.github/scripts/revalidate-all-prs.sh

@@ -0,0 +1,42 @@
+#!/bin/bash
+# Copyright 2025 Google LLC.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Revalidate all open PRs
+
+echo "Fetching all open PRs..."
+PR_NUMBERS=$(gh pr list --limit 50 --json number --jq '.[].number')
+TOTAL=$(echo "$PR_NUMBERS" | wc -w | tr -d ' ')
+
+echo "Found $TOTAL open PRs"
+echo "Starting revalidation..."
+echo ""
+
+COUNT=0
+for pr in $PR_NUMBERS; do
+    COUNT=$((COUNT + 1))
+    echo "[$COUNT/$TOTAL] Triggering revalidation for PR #$pr..."
+    gh workflow run revalidate-pr.yml -f pr_number=$pr
+
+    # Small delay to avoid rate limiting
+    sleep 2
+done
+
+echo ""
+echo "All workflows triggered!"
+echo ""
+echo "To monitor progress:"
+echo "  gh run list --workflow=revalidate-pr.yml --limit=$TOTAL"
+echo ""
+echo "To see results, check comments on each PR"

.github/workflows/auto-update-pr.yaml

@@ -0,0 +1,166 @@
+# Copyright 2025 Google LLC.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: Auto Update PR
+
+on:
+  push:
+    branches: [main]
+  schedule:
+    # Run daily at 2 AM UTC to catch stale PRs
+    - cron: '0 2 * * *'
+  workflow_dispatch:
+    inputs:
+      pr_number:
+        description: 'PR number to update (optional, updates all if not specified)'
+        required: false
+        type: string
+
+permissions:
+  contents: write  # Required for updateBranch API
+  pull-requests: write
+  issues: write
+
+jobs:
+  update-prs:
+    runs-on: ubuntu-latest
+    concurrency:
+      group: auto-update-pr-${{ github.event_name }}
+      cancel-in-progress: true
+    steps:
+      - name: Update PRs that are behind main
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const prNumber = context.payload.inputs?.pr_number;
+
+            // Get list of open PRs
+            const prs = prNumber
+              ? [(await github.rest.pulls.get({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  pull_number: parseInt(prNumber)
+                })).data]
+              : await github.paginate(github.rest.pulls.list, {
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  state: 'open',
+                  sort: 'updated',
+                  direction: 'desc'
+                });
+
+            console.log(`Found ${prs.length} open PRs to check`);
+
+            // Constants for comment flood control
+            const UPDATE_COMMENT_COOLDOWN_DAYS = 7;
+            const COOLDOWN_MS = UPDATE_COMMENT_COOLDOWN_DAYS * 24 * 60 * 60 * 1000;
+
+            for (const pr of prs) {
+              // Skip bot PRs and drafts
+              if (pr.user.login.includes('[bot]')) {
+                console.log(`Skipping bot PR #${pr.number} from ${pr.user.login}`);
+                continue;
+              }
+              if (pr.draft) {
+                console.log(`Skipping draft PR #${pr.number}`);
+                continue;
+              }
+
+              try {
+                // Check if PR is behind main (base...head comparison)
+                const { data: comparison } = await github.rest.repos.compareCommits({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  base: pr.base.ref,  // main branch
+                  head: `${pr.head.repo.owner.login}:${pr.head.ref}`  // Fully qualified ref for forks
+                });
+
+                if (comparison.behind_by > 0) {
+                  console.log(`PR #${pr.number} is ${comparison.behind_by} commits behind ${pr.base.ref}`);
+
+                  // Check if the PR allows maintainer edits
+                  if (pr.maintainer_can_modify) {
+                    // Try to update the branch
+                    try {
+                      await github.rest.pulls.updateBranch({
+                        owner: context.repo.owner,
+                        repo: context.repo.repo,
+                        pull_number: pr.number
+                      });
+
+                      console.log(`✅ Updated PR #${pr.number}`);
+
+                      // Add a comment
+                      await github.rest.issues.createComment({
+                        owner: context.repo.owner,
+                        repo: context.repo.repo,
+                        issue_number: pr.number,
+                        body: `🔄 **Branch Updated**\n\nYour branch was ${comparison.behind_by} commits behind \`${pr.base.ref}\` and has been automatically updated. CI checks will re-run shortly.`
+                      });
+                    } catch (updateError) {
+                      console.log(`Could not auto-update PR #${pr.number}: ${updateError.message}`);
+
+                      // Determine the reason for failure
+                      let failureReason = '';
+                      if (updateError.status === 409 || updateError.message.includes('merge conflict')) {
+                        failureReason = '\n\n**Note:** Automatic update failed due to merge conflicts. Please resolve them manually.';
+                      } else if (updateError.status === 422) {
+                        failureReason = '\n\n**Note:** Cannot push to fork. Please update manually.';
+                      }
+
+                      // Notify the contributor to update manually
+                      await github.rest.issues.createComment({
+                        owner: context.repo.owner,
+                        repo: context.repo.repo,
+                        issue_number: pr.number,
+                        body: `⚠️ **Branch Update Required**\n\nYour branch is ${comparison.behind_by} commits behind \`${pr.base.ref}\`.${failureReason}\n\nPlease update your branch:\n\n\`\`\`bash\ngit fetch origin ${pr.base.ref}\ngit merge origin/${pr.base.ref}\ngit push\n\`\`\`\n\nOr use GitHub's "Update branch" button if available.`
+                      });
+                    }
+                  } else {
+                    // Can't modify, just notify
+                    console.log(`PR #${pr.number} doesn't allow maintainer edits`);
+
+                    // Check if we already commented recently (within last 7 days)
+                    const { data: comments } = await github.rest.issues.listComments({
+                      owner: context.repo.owner,
+                      repo: context.repo.repo,
+                      issue_number: pr.number,
+                      since: new Date(Date.now() - COOLDOWN_MS).toISOString()
+                    });
+
+                    const hasRecentUpdateComment = comments.some(c =>
+                      c.body?.includes('Branch Update Required') &&
+                      c.user?.login === 'github-actions[bot]'
+                    );
+
+                    if (!hasRecentUpdateComment) {
+                      await github.rest.issues.createComment({
+                        owner: context.repo.owner,
+                        repo: context.repo.repo,
+                        issue_number: pr.number,
+                        body: `⚠️ **Branch Update Required**\n\nYour branch is ${comparison.behind_by} commits behind \`${pr.base.ref}\`. Please update your branch to ensure CI checks run with the latest code:\n\n\`\`\`bash\ngit fetch origin ${pr.base.ref}\ngit merge origin/${pr.base.ref}\ngit push\n\`\`\`\n\nNote: Enable "Allow edits by maintainers" to allow automatic updates.`
+                      });
+                    }
+                  }
+                } else {
+                  console.log(`PR #${pr.number} is up to date`);
+                }
+              } catch (error) {
+                console.error(`Error processing PR #${pr.number}:`, error.message);
+              }
+            }
+
+            // Log rate limit status
+            const { data: rateLimit } = await github.rest.rateLimit.get();
+            console.log(`API rate limit remaining: ${rateLimit.rate.remaining}/${rateLimit.rate.limit}`);