Harden security across publishing, auth, and input validation

[theoephraim]

Summary

• Git token auth: Use ephemeral git -c http.extraheader instead of rewriting the remote URL — prevents token persistence in .git/config if the process crashes mid-push (relevant for self-hosted runners)
• Custom command gating: Add allowCustomCommands root config option so per-package publishCommand/buildCommand/checkPublished in package.json must be explicitly allowed by the root config. Commands in .bumpy/_config.json packages are always trusted.
• Input validation: Validate package names (reject shell/HTML metacharacters) and bump types (major|minor|patch|none) during bump file parsing
• Tarball path parsing: Use --json flag for npm/pnpm pack to get deterministic tarball filenames instead of fragile regex parsing
• Changelog formatter path traversal: Resolve symlinks with realpathSync and use path.relative() check instead of string prefix matching
• Force-push safeguard: Refuse to force-push if the target branch is main, master, or the current HEAD branch

Test plan

• Verify bumpy ci release still pushes version PR branch correctly with BUMPY_GH_TOKEN
• Verify bumpy publish works with npm and pnpm pack --json output
• Test that a package.json with publishCommand throws without allowCustomCommands in root config
• Test that allowCustomCommands: true and glob patterns allow the commands through
• Verify bump files with invalid package names or bump types are skipped with warnings
• Test custom changelog formatter loading with relative paths

🤖 Generated with Claude Code

[bumpy-bot]

The changes in this PR will be included in the next version bump.

Patch releases

• @varlock/bumpy 0.0.2 → 0.0.3

Bump files in this PR

• security-hardening.md (view diff) (edit)

Click here if you want to add another bump file to this PR

---

This comment is maintained by bumpy.