pvharmo2/gha-lab-ba981941f0Security-research lab reproducing CVE-2025-54430 (GHSA-wrg3-xqw8-m85p): secrets exfiltration via issue_comment-triggered Benchmark Bot in dedupeio/dedupe. Snapshot of dedupeio/dedupe@54ecfe77d41390da66899596834a2bde3712c966.
Automated research artifact — not the upstream project.
This repository is a disposable lab built by an automated harness for a master's thesis at Université Laval on reproducing published GitHub Actions workflow vulnerabilities. It is a verbatim snapshot of
dedupeio/dedupeat commit54ecfe77d41390da66899596834a2bde3712c966(2024-11-01), redistributed under that project's own licence, whose file is included unchanged in this snapshot.The upstream project is not involved, is never targeted, and the vulnerability studied here is already public. Every secret and variable in this repository is a randomly generated dummy value — no real credential is present. Action references and runner images are pinned to what they resolved to on 2024-11-01; see
pinning.mdin the harness output for every change made to the snapshot.Questions or objections: [email protected]
dedupe is a python library that uses machine learning to perform fuzzy matching, deduplication and entity resolution quickly on structured data.
dedupe will help you:
dedupe takes in human training data and comes up with the best rules for your dataset to quickly and automatically find similar records, even with very large databases.
If you or your organization would like professional assistance in working with the dedupe library, Dedupe.io LLC offers consulting services. Read more about pricing and available services here.
A cloud service powered by the dedupe library for de-duplicating and finding matches in your data. It provides a step-by-step wizard for uploading your data, setting up a model, training, clustering and reviewing the results.
Dedupe.io also supports record linkage across data sources and continuous matching and training through an API.
For more, see the Dedupe.io product site, tutorials on how to use it, and differences between it and the dedupe library.
Dedupe is well adopted by the Python community. Check out this blogpost, a YouTube video on how to use Dedupe with Python and a Youtube video on how to apply Dedupe at scale using Spark.
Command line tool for de-duplicating and linking CSV files. Read about it on Source Knight-Mozilla OpenNews.
If you only want to use dedupe, install it this way:
pip install dedupe
Familiarize yourself with dedupe's API, and get started on your project. Need inspiration? Have a look at some examples.
We recommend using virtualenv and virtualenvwrapper for working in a virtualized development environment. Read how to set up virtualenv.
Once you have virtualenvwrapper set up,
mkvirtualenv dedupe
git clone https://github.com/dedupeio/dedupe.git
cd dedupe
pip install -e . --config-settings editable_mode=compat
pip install -r requirements.txt
If these tests pass, then everything should have been installed correctly!
pytest
Afterwards, whenever you want to work on dedupe,
workon dedupe
Unit tests of core dedupe functions
pytest
Using Deduplication
python -m pip install -e ./benchmarks
python benchmarks/benchmarks/canonical.py
Using Record Linkage
python -m pip install -e ./benchmarks
python benchmarks/benchmarks/canonical_matching.py
Dedupe is based on Mikhail Yuryevich Bilenko's Ph.D. dissertation: Learnable Similarity Functions and their Application to Record Linkage and Clustering.
If something is not behaving intuitively, it is a bug, and should be reported. Report it here
Copyright (c) 2022 Forest Gregg and Derek Eder. Released under the MIT License.
Third-party copyright in this distribution is noted where applicable.
If you use Dedupe in an academic work, please give this citation:
Forest Gregg and Derek Eder. 2022. Dedupe. https://github.com/dedupeio/dedupe.