pvharmo2/gha-lab-b1fe4918c0Authorized security-research lab: reproduction of CVE-2025-32958 (GHSA-8c7v-vccv-cx4q) — GITHUB_TOKEN leaked into workflow artifacts by Adept's remoteBuild.yml (snapshot of AdeptLanguage/Adept @ 6a64554)
Automated research artifact — not the upstream project.
This repository is a disposable lab built by an automated harness for a master's thesis at Université Laval on reproducing published GitHub Actions workflow vulnerabilities. It is a verbatim snapshot of
AdeptLanguage/Adeptat commit6a6455463213dabe52d49ceaaebd1f13cfee9018(2025-04-01), redistributed under that project's own licence, whose file is included unchanged in this snapshot.The upstream project is not involved, is never targeted, and the vulnerability studied here is already public. Every secret and variable in this repository is a randomly generated dummy value — no real credential is present. Action references and runner images are pinned to what they resolved to on 2025-04-01; see
pinning.mdin the harness output for every change made to the snapshot.Questions or objections: [email protected]
A blazing fast language for general purpose programming.
Download Adept v2.7 for Windows
Download Adept v2.7 Cross-Compilation Extensions
Adept v2.7 Working with Domestic and Foreign Libraries
Adept v2.7 Vim Bare-Bones Syntax Highlighting
Adept v2.7 VSCode Syntax Highlighting
Adept v2.7 VSCode Language Server
Adept v2.7 Sublime Text Syntax Highlighting
Adept v2.7 Geany Syntax Highlighting
adept [filename] [options]
You can optionally use adept2-7 instead of adept if you have multiple versions installed.
import basics
func main {
print("Hello World!")
}
import basics
func main {
name String = "Alan"
age int = 36
height uint = 189
print("Name is " + name)
print("Age is " + age)
print("Height is " + height + " cm")
}
import basics
func main {
greet("Alice")
}
func greet(name String) {
print("Hello " + name)
}
import basics
record Person (name String, age int) {
func print {
print(this.name + " is " + this.age + " years old")
}
}
func main {
Person("John Smith", 36).print()
}
import basics
struct Configuration (
filename String,
numBatteries int,
numPorts int,
){
constructor(filename String) {
this.filename = filename.commit()
this.numBatteries = 4
this.numPorts = 10
}
}
func toString(config Configuration) String {
return config.filename + ":" + config.numBatteries + ":" + config.numPorts
}
func main {
print(Configuration("settings.config"))
}
import basics
func main {
x, y int = 0
x++
y++
addOneTo(&x)
print("x = " + x)
print("y = " + y)
}
func addOneTo(pointerToNumber *$T~__number__) {
(*pointerToNumber)++
}
import basics
func main {
name String = scan("What is your name? ")
age int = scanInt("How old are you? ")
// If conditional
if name == "Isaac" {
print("Hello Isaac :)")
} else {
print("Nice to meet you " + name)
}
// Unless conditional
unless age > 21 {
print("You are too young to drink")
}
// While loops
while age < 18 {
print("**birthday**")
age += 1
}
print("You are now old enough to smoke")
// Until loops
until age >= 21 {
print("**birthday**")
age += 1
}
print("You are now old enough to drink")
}
import basics
record Invitation (to, from String, priority int)
func main {
invites <Invitation> List
invites.add(Invitation("Isaac", "Peter", 4))
invites.add(Invitation("Mr. Smith", "Mrs. Smith", 12))
invites.add(Invitation("James", "Paul", 3))
each Invitation in invites {
printf("invites[%zu] = %S\n", idx, toString(it))
}
}
func toString(invite Invitation) String {
return invite.to + " invited " + invite.from + " with priority " + invite.priority
}
/*
For values that use ownership-based memory management
(e.g. String, List, Grid)
we must transfer ownership if we want to keep them
alive for longer than their owner's scope
*/
import basics
func main {
everyone <String> List = getEveryoneAttending()
each fullname String in everyone {
print("=> " + fullname)
}
}
func getEveryoneAttending() <String> List {
everyone <String> List
person1 String = getFullnameReturnImmediately("Alice", "Golden")
person2 String = getFullnameStoreAndThenLaterReturn("Bob", "Johnson")
// Commit ownership of strings held by 'person1' and 'person2'
// to be managed by the list
everyone.add(person1.commit())
everyone.add(person2.commit())
// Commit ownership of the list to the caller
return everyone.commit()
}
func getFullnameReturnImmediately(firstname, lastname String) String {
// '.commit()' is not necessary here
return firstname + " " + lastname
}
func getFullnameStoreAndThenLaterReturn(firstname, lastname String) String {
fullname String = firstname + " " + lastname
// Ownership of the result is held by 'fullname',
// so we must transfer ownership to the caller in order
// to keep it alive after this function returns
// '.commit()' is necessary here
return fullname.commit()
}
import basics
func main {
print(makeNumericSkewer())
print(makeAlphabetSkewer())
}
func makeNumericSkewer String {
// Example output: `0-2-4-6-8-10-13-16-19-22-25-28`
skewer String
while continue preparing {
skewer.append(skewer.length)
if skewer.length < 30 {
skewer.append("-")
continue preparing
}
}
return skewer.commit()
}
func makeAlphabetSkewer String {
// Example output: `a-c-e-g-i-k-m-o-q-s-u-w-y`
skewer String
while still_making_skewer : skewer.length < 30 {
skewer.append('a'ub + skewer.length as ubyte)
if skewer[skewer.length - 1] == 'y'ub {
break still_making_skewer
}
skewer.append("-")
}
return skewer.commit()
}
import basics
// Will be re-evaluated with each use
define GREETING = "Welcome"
define STRANGER_NAME = "guest"
define WELCOME_MESSAGE = GREETING + " " + STRANGER_NAME + "!"
// Will only be evaluated once when the program starts
ARCH_STRING String = #get __arm64__ ? "arm64" : #get __x86_64__ ? "x86_64" : "other"
func main {
print(WELCOME_MESSAGE)
print("You are using architecture: " + ARCH_STRING)
}