airvzxf / airvzxf/ftp-deployment-action
docs(action.yml): mirror_verbose description promises '(0-3)' but validation only checks >= 0
- Dominant language
- Shell
- Stars
- 37
- Forks
- 9
- Avg merge
- 44m
- Merged PRs (30d)
- 47
Description
gh issue create --title "docs(action.yml): mirror_verbose description promises '(0-3)' but validation only checks >= 0" --label "documentation,audit,priority:low" --body "## Finding
The mirror_verbose input description in action.yml says '(0-3)'. The validator in lib.sh only checks >= 0. A value of 5 passes validation; lftp's -v flag does not have an upper bound, but the documented contract says 0-3.
## Affected code
- action.yml — mirror_verbose description
- lib.sh — mirror_verbose validator
## Reproduction
1. Set INPUT_MIRROR_VERBOSE=5.
2. Validation passes; lftp runs with -v 5.
## Suggested fix
Either:
- Loosen the action.yml description to remove the upper bound ('Verbose level for lftp mirror (>= 0). Higher = noisier.').
- Or tighten the validator to reject > 3.
The first option is safer; lftp tolerates any level.
## Source
F2 audit 2026-09-03 (action.yml audit). Reporter: subagent-pekodbj7.
## Related
- Part of EPIC #[epic-number]
- Closes: #NONE (no existing issue)"
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.