[goanpeca]

Summary:

• Add explicit read-only GitHub Actions token permissions to the CI workflow.
• Tighten Backblaze endpoint detection to exact backblazeb2.com hosts or valid subdomains.
• Add regression coverage for domain-boundary URL matching.

Linked Dependabot alerts:

• https://github.com/backblaze-labs/hf-cache-sync/security/code-scanning/1
• https://github.com/backblaze-labs/hf-cache-sync/security/code-scanning/2
• https://github.com/backblaze-labs/hf-cache-sync/security/code-scanning/3

Tests run:

• conda run -n hf-cache-sync-codeql pytest -q tests/test_storage.py
• conda run -n hf-cache-sync-codeql ruff check .
• conda run -n hf-cache-sync-codeql ruff format --check .
• conda run -n hf-cache-sync-codeql mypy src
• conda run -n hf-cache-sync-codeql pytest -q

Follow-up notes:

• mypy completed successfully, but emitted a warning that the installed mypy version no longer supports the configured python_version = 3.9.

[Copilot]

🟢 Approval recommended

The endpoint-matching change is precise, security-improving, and is backed by targeted regression tests, and the CI permissions change is a safe least-privilege adjustment.

Pull request overview

This PR hardens endpoint detection for Backblaze B2 S3-compatible URLs to avoid substring-based false positives and aligns the CI workflow with least-privilege GitHub Actions token permissions (addressing CodeQL/workflow security alerts).

Changes:

• Restricts Backblaze endpoint detection to the exact backblazeb2.com host or valid *.backblazeb2.com subdomains (case-insensitive, tolerating a trailing dot).
• Adds regression tests to cover domain-boundary and casing/trailing-dot edge cases.
• Sets explicit read-only GITHUB_TOKEN permissions (contents: read) for the CI workflow.

File summaries

File	Description
src/hf_cache_sync/storage.py	Tightens _is_backblaze_endpoint host matching to prevent substring-based misclassification.
tests/test_storage.py	Adds regression coverage for exact-host/subdomain matching and negative boundary cases.
.github/workflows/ci.yml	Adds explicit minimal workflow token permissions (contents: read).

Review details

• Files reviewed: 3/3 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.