How Do I Check What an Unknown GitHub Repo Really Does, Safely?

#!/bin/bash
# check.sh [steps-file]: run each line as its own step; record exit code, time and output.
steps=${1:-steps.txt}; mkdir -p ~/report; cd ~
[ -f ~/report/results.tsv ] || printf 'step\texit\tms\tcommand\n' > ~/report/results.tsv
n=$(( $(wc -l < ~/report/results.tsv) - 1 ))
while IFS= read -r cmd; do
  case "$cmd" in ''|'#'*) continue ;; esac
  n=$((n+1)); t0=$(date +%s%N)
  timeout 600 bash -c "$cmd" > ~/report/step$n.log 2>&1 < /dev/null; rc=$?
  printf '%s\t%s\t%s\t%s\n' $n $rc $(( ($(date +%s%N)-t0)/1000000 )) "$cmd" >> ~/report/results.tsv
done < ~/"$steps"
tar czf ~/report.tgz -C ~ report

# Inside the capped scope: which sandbox variables can the code see? (names only)
env | cut -d= -f1 | grep -cE '^SANDBOXER_'; ls ~/.config/gh ~/.git-credentials 2>&1 | cut -c1-60
# Fetch exactly one commit (fzf v0.74.5) and check it
git init -q ~/.fzf && git -C ~/.fzf fetch -q --depth 1 https://github.com/junegunn/fzf.git c0a193e031f01fb50bf6f7be4381990a3753f7cf && git -C ~/.fzf checkout -q --detach FETCH_HEAD && git -C ~/.fzf log -1 --format='%H %cs %s'
# README "Using git": the install script, verbatim
~/.fzf/install
# What the install changed
~/.fzf/bin/fzf --version; git -C ~/.fzf status --short; ls ~/.fzf.*; tail -1 ~/.bashrc
# Is bin/fzf the published release binary?
cd /tmp && curl -fsSLO https://github.com/junegunn/fzf/releases/download/v0.74.5/fzf-0.74.5-linux_amd64.tar.gz && curl -fsSL https://github.com/junegunn/fzf/releases/download/v0.74.5/fzf_0.74.5_checksums.txt | grep linux_amd64.tar.gz | sha256sum -c && tar xzf fzf-0.74.5-linux_amd64.tar.gz && cmp fzf ~/.fzf/bin/fzf && echo "bin/fzf matches the release"
# BUILD.md: build the pinned source (no tags fetched, so set the version as BUILD.md says)
cd ~/.fzf && FZF_VERSION=0.74.5 FZF_REVISION=c0a193e0 make && ./target/fzf-linux_amd64 --version && sha256sum target/fzf-linux_amd64 bin/fzf
# The project's own tests at this commit
cd ~/.fzf && FZF_VERSION=0.74.5 FZF_REVISION=c0a193e0 make test > /tmp/test.log 2>&1; rc=$?; grep -E '^(ok|FAIL)' /tmp/test.log; grep -c '^--- PASS' /tmp/test.log; exit $rc
# Cut outbound traffic for the claim checks
sudo ufw default deny outgoing >/dev/null && curl -s -m 5 -o /dev/null https://github.com; echo "curl exit $?"
# Claim: "Portable: distributed as a single binary"
file -b ~/.fzf/bin/fzf | cut -d, -f1,2,4; ldd ~/.fzf/bin/fzf
# README "Usage", verbatim
cd ~/.fzf && find * -type f | ~/.fzf/bin/fzf > selected
# Claim: "Fast: optimized to process millions of items in milliseconds"
seq 1000000 > /tmp/1m.txt; TIMEFORMAT='%R s'; for q in 123456 99999 "'777"; do time (~/.fzf/bin/fzf --filter "$q" < /tmp/1m.txt | wc -l); done

#!/bin/bash
# try-repo.sh: run steps.txt in a fresh no-secrets sandbox, bring back the report, delete the sandbox.
set -u
id=$(sbx --json new --name "${NAME:-try-repo}" --type small --ttl 1800 --no-env | jq -r 'select(.event=="ready") | .id')
[ -n "$id" ] || { echo "create failed"; exit 1; }
trap 'sbx delete "$id" --yes >/dev/null; echo "deleted $id"' EXIT
echo "sandbox $id"
# Variable names only, never values
sbx exec "$id" "env | cut -d= -f1 | grep -E 'SANDBOXER|KEY|TOKEN|SECRET' | sort | paste -sd' '"
sbx scp check.sh "$id:/home/user/check.sh" && sbx scp steps.txt "$id:/home/user/steps.txt" || exit 1
# Cap the whole run: 2 GB RAM, 512 tasks, 1.5 CPUs, 20 minutes
pid=$(sbx --json exec "$id" --detach "sudo systemd-run --scope --quiet --uid=user --gid=user \
  --setenv=PATH=\$PATH -p MemoryMax=2G -p TasksMax=512 -p CPUQuota=150% -p RuntimeMaxSec=1200 \
  bash check.sh steps.txt" | jq -r .pid)
sbx exec "$id" --attach "$pid" > /dev/null
sbx scp "$id:/home/user/report.tgz" "./report-$id.tgz"

NAME=try-fzf ./try-repo.sh

sandbox sb_blng135nw7
SANDBOXER_API_URL SANDBOXER_ID SANDBOXER_SUBDOMAIN SANDBOXER_TOKEN
deleted sb_blng135nw7

tar xzf report-sb_blng135nw7.tgz && cut -f1-3 report/results.tsv

step	exit	ms
1	0	13
2	0	370
3	0	183
4	0	11
5	0	271
6	0	11347
7	0	19808
8	0	874
9	1	20
10	2	6
11	0	438