snorkel/root-repository-maintenance-e2b9480e3cde42

Fork 0

github-image-allowlist-cleanup: Clean Up GitHub Image Allowlist #2

Open

std-bot wants to merge 1 commit from task/github-image-allowlist-cleanup into main

std-bot commented

2026-06-08 00:09:07 +00:00

First-time contributor

Assigned idea

Benchmark authoring specification.

Summary: Create a deterministic Next.js maintenance work item that removes the overly broad github.com remote image allowance while preserving the existing Cloudinary, Unsplash, and GitHub avatar CDN image configuration.

Task intent: For this repo, update next.config.js so Next/Image no longer allows arbitrary HTTPS images from github.com; keep avatars.githubusercontent.com and the other existing trusted image hosts unchanged, and do not alter the existing strict mode, trailing slash, powered header, TypeScript, or ESLint build settings.

Benchmark plan: Construct the task package from the specified commit with a solver-facing request focused only on tightening the remote image allowlist in next.config.js. The work should be framed as ordinary upstream configuration cleanup for a Next.js app. The hidden checker should be supplied separately as test_outputs.py and should validate the exported config rather than relying only on text matching.

Environment plan: Environment/repo is the checked-out Next.js repository at the fixed commit, with next.config.js exporting the current config object. Task/environment should add only the hidden Python pytest verifier and use Node.js to require the config file; no network access or full Next build is required for verification.

Verifier plan: test_outputs.py should run from the repository root, invoke Node to require('./next.config.js'), serialize the exported config to JSON, and assert that images.remotePatterns contains exactly the HTTPS hostnames res.cloudinary.com, images.unsplash.com, and avatars.githubusercontent.com, with no github.com entry and no images.domains fallback containing github.com. It should also assert that reactStrictMode remains true, trailingSlash remains false, poweredByHeader remains false, typescript.ignoreBuildErrors remains true, and eslint.ignoreDuringBuilds remains true.

Oracle plan: The oracle solution is a minimal edit to next.config.js: remove only the remotePatterns object whose hostname is github.com, leaving the remaining three remotePatterns entries and all other exported config fields unchanged. The oracle path should be represented as a small patch against next.config.js.

Difficulty plan: Current coding agents may overcorrect by deleting avatars.githubusercontent.com, switching to deprecated images.domains, adding unrelated hosts, or changing other build flags while touching the config. The verifier should catch those common misreadings by checking both the host allowlist and preservation of unrelated settings.

Repo patch scope: Expected upstream edit scope is next.config.js only; no page, component, package, or build-system files should be changed.

Anti-leakage notes: Solver-facing text must not mention benchmark, harness, Snorkel, Harbor, std-ts, agent, stage, attempt, retry, generated task, or evaluation context. Present the work only as normal Next.js configuration cleanup.

Approach: Ask the solver to inspect the existing images.remotePatterns configuration, identify the redundant broad GitHub host allowance, and remove that single host entry while preserving the avatar CDN and other trusted providers.

Verification: Run python -m pytest test_outputs.py from the repository root; the verifier should use a Node command to load next.config.js and check the concrete exported config values.

Risk: Low implementation risk because the intended patch is a single configuration deletion. The main risk is accidental broad rewrites of the Next config, which the hidden verifier should reject.

Path rules: task package is tasks/; mutable upstream checkout is tasks//environment/repo; benchmark package files are under tasks//task; verifier/container environment belongs under tasks//task/environment; regular and UI verifier logic belongs in task/tests/test_outputs.py and test.sh only runs that file through pytest.

Agent context

Task slug: github-image-allowlist-cleanup
Branch: task/github-image-allowlist-cleanup

## Assigned idea Benchmark authoring specification. Summary: Create a deterministic Next.js maintenance work item that removes the overly broad `github.com` remote image allowance while preserving the existing Cloudinary, Unsplash, and GitHub avatar CDN image configuration. Task intent: For this repo, update `next.config.js` so Next/Image no longer allows arbitrary HTTPS images from `github.com`; keep `avatars.githubusercontent.com` and the other existing trusted image hosts unchanged, and do not alter the existing strict mode, trailing slash, powered header, TypeScript, or ESLint build settings. Benchmark plan: Construct the task package from the specified commit with a solver-facing request focused only on tightening the remote image allowlist in `next.config.js`. The work should be framed as ordinary upstream configuration cleanup for a Next.js app. The hidden checker should be supplied separately as `test_outputs.py` and should validate the exported config rather than relying only on text matching. Environment plan: Environment/repo is the checked-out Next.js repository at the fixed commit, with `next.config.js` exporting the current config object. Task/environment should add only the hidden Python pytest verifier and use Node.js to require the config file; no network access or full Next build is required for verification. Verifier plan: `test_outputs.py` should run from the repository root, invoke Node to `require('./next.config.js')`, serialize the exported config to JSON, and assert that `images.remotePatterns` contains exactly the HTTPS hostnames `res.cloudinary.com`, `images.unsplash.com`, and `avatars.githubusercontent.com`, with no `github.com` entry and no `images.domains` fallback containing `github.com`. It should also assert that `reactStrictMode` remains true, `trailingSlash` remains false, `poweredByHeader` remains false, `typescript.ignoreBuildErrors` remains true, and `eslint.ignoreDuringBuilds` remains true. Oracle plan: The oracle solution is a minimal edit to `next.config.js`: remove only the remotePatterns object whose hostname is `github.com`, leaving the remaining three remotePatterns entries and all other exported config fields unchanged. The oracle path should be represented as a small patch against `next.config.js`. Difficulty plan: Current coding agents may overcorrect by deleting `avatars.githubusercontent.com`, switching to deprecated `images.domains`, adding unrelated hosts, or changing other build flags while touching the config. The verifier should catch those common misreadings by checking both the host allowlist and preservation of unrelated settings. Repo patch scope: Expected upstream edit scope is `next.config.js` only; no page, component, package, or build-system files should be changed. Anti-leakage notes: Solver-facing text must not mention benchmark, harness, Snorkel, Harbor, std-ts, agent, stage, attempt, retry, generated task, or evaluation context. Present the work only as normal Next.js configuration cleanup. Approach: Ask the solver to inspect the existing `images.remotePatterns` configuration, identify the redundant broad GitHub host allowance, and remove that single host entry while preserving the avatar CDN and other trusted providers. Verification: Run `python -m pytest test_outputs.py` from the repository root; the verifier should use a Node command to load `next.config.js` and check the concrete exported config values. Risk: Low implementation risk because the intended patch is a single configuration deletion. The main risk is accidental broad rewrites of the Next config, which the hidden verifier should reject. Path rules: task package is tasks/<slug>; mutable upstream checkout is tasks/<slug>/environment/repo; benchmark package files are under tasks/<slug>/task; verifier/container environment belongs under tasks/<slug>/task/environment; regular and UI verifier logic belongs in task/tests/test_outputs.py and test.sh only runs that file through pytest. ## Agent context Task slug: github-image-allowlist-cleanup Branch: task/github-image-allowlist-cleanup

std-bot added 1 commit

2026-06-08 00:09:07 +00:00

std: sync github-image-allowlist-cleanup 1cff1be564

This pull request can be merged automatically.

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin task/github-image-allowlist-cleanup:task/github-image-allowlist-cleanup

git switch task/github-image-allowlist-cleanup

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main

git merge --no-ff task/github-image-allowlist-cleanup

git switch task/github-image-allowlist-cleanup

git rebase main

git switch main

git merge --ff-only task/github-image-allowlist-cleanup

git switch task/github-image-allowlist-cleanup

git rebase main

git switch main

git merge --no-ff task/github-image-allowlist-cleanup

git switch main

git merge --squash task/github-image-allowlist-cleanup

git switch main

git merge --ff-only task/github-image-allowlist-cleanup

git switch main

git merge task/github-image-allowlist-cleanup

git push origin main

No reviewers

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

snorkel/root-repository-maintenance-e2b9480e3cde42!2

No description provided.

Rows
Columns