Skip to content

Commit 8e84a77

Browse files
cx-luis-ventuzeloscx-luis-ventuzelos
committed
harden release workflow security
- Add permissions: workflow level contents:read, job level contents:write - Replace deprecated ::set-output with GITHUB_OUTPUT - Fix script injection by moving inputs to env vars in run steps - Fix env context injection in mvn and artifactId steps - Replace PERSONAL_ACCESS_TOKEN with GITHUB_TOKEN - Update action pins: checkout v6.0.3, setup-java v5.2.0, cache v5.0.5 - Comment out cache, notify and dispatch_auto_release jobs
1 parent 6fb3166 commit 8e84a77

1 file changed

Lines changed: 55 additions & 45 deletions

File tree

‎.github/workflows/release.yml‎

Lines changed: 55 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -32,32 +32,39 @@ on:
3232
required: false
3333
type: string
3434

35+
permissions:
36+
contents: read
37+
3538
jobs:
3639
release:
40+
permissions:
41+
contents: write
3742
runs-on: cx-public-ubuntu-x64
3843
outputs:
3944
CLI_VERSION: ${{ steps.extract_cli_version.outputs.CLI_VERSION }}
4045
TAG_NAME: ${{ steps.set_tag_name.outputs.TAG_NAME }}
4146
steps:
4247
- name: Checkout
43-
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
48+
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
4449
with:
45-
token: ${{ secrets.PERSONAL_ACCESS_TOKEN }}
50+
token: ${{ secrets.GITHUB_TOKEN }}
4651
lfs: true
4752

4853
- name: Download CLI
4954
if: inputs.cliTag
55+
env:
56+
INPUT_CLI_TAG: ${{ inputs.cliTag }}
5057
run: |
5158
chmod +x ./.github/scripts/update_cli.sh
52-
./.github/scripts/update_cli.sh ${{ inputs.cliTag }}
59+
./.github/scripts/update_cli.sh "$INPUT_CLI_TAG"
5360
5461
- name: Extract CLI version
5562
id: extract_cli_version
5663
run: |
5764
CLI_VERSION=$(./src/main/resources/cx-linux version | grep -Eo '^[0-9]+\.[0-9]+\.[0-9]+')
5865
echo "CLI version being packed is $CLI_VERSION"
5966
echo "CLI_VERSION=$CLI_VERSION" >> $GITHUB_ENV
60-
echo "::set-output name=CLI_VERSION::$CLI_VERSION"
67+
echo "CLI_VERSION=$CLI_VERSION" >> $GITHUB_OUTPUT
6168
6269
- name: Check if CLI version is latest
6370
if: ${{ github.event.inputs.dev == 'false' && !github.event.inputs.cliTag && github.ref == 'refs/heads/main' }}
@@ -72,31 +79,31 @@ jobs:
7279
else
7380
echo "CLI_VERSION ($CLI_VERSION) does not match the latest released version ($LATEST_CLI_VERSION). Failing workflow."
7481
exit 1
75-
fi
82+
fi
7683
7784
- name: Tag
7885
id: set_tag_name
86+
env:
87+
INPUT_TAG: ${{ inputs.tag }}
7988
run: |
80-
echo ${{ inputs.tag }}
81-
tag=${{ inputs.tag }}
82-
echo "RELEASE_VERSION=${{ inputs.tag }}" >> $GITHUB_ENV
83-
message='${{ inputs.tag }}'
89+
echo "$INPUT_TAG"
90+
echo "RELEASE_VERSION=$INPUT_TAG" >> $GITHUB_ENV
8491
git config user.name "${GITHUB_ACTOR}"
8592
git config user.email "${GITHUB_ACTOR}@users.noreply.github.com"
86-
git tag -a "${tag}" -m "${message}"
87-
git push origin "${tag}"
88-
echo "::set-output name=TAG_NAME::${{ inputs.tag }}"
93+
git tag -a "$INPUT_TAG" -m "$INPUT_TAG"
94+
git push origin "$INPUT_TAG"
95+
echo "TAG_NAME=$INPUT_TAG" >> $GITHUB_OUTPUT
8996
90-
- name: Cache local Maven repository
91-
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
92-
with:
93-
path: ~/.m2/repository
94-
key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
95-
restore-keys: |
96-
${{ runner.os }}-maven-
97+
# - name: Cache local Maven repository
98+
# uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
99+
# with:
100+
# path: ~/.m2/repository
101+
# key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
102+
# restore-keys: |
103+
# ${{ runner.os }}-maven-
97104

98105
- name: Set up Maven Central Repository
99-
uses: actions/setup-java@2dfa2011c5b2a0f1489bf9e433881c92c1631f88 # v4.3.0
106+
uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
100107
with:
101108
java-version: '11'
102109
distribution: 'temurin'
@@ -107,18 +114,21 @@ jobs:
107114
gpg-passphrase: MAVEN_GPG_PASSPHRASE
108115

109116
- name: Update the POM version.
110-
run: mvn -B versions:set -DnewVersion='${{ env.RELEASE_VERSION }}' --file pom.xml -DskipTests
117+
run: mvn -B versions:set -DnewVersion="$RELEASE_VERSION" --file pom.xml -DskipTests
111118

112119
- name: Build artifactId property
120+
env:
121+
INPUT_DEV: ${{ inputs.dev }}
122+
INPUT_TAG: ${{ inputs.tag }}
113123
run: |
114124
prop=''
115-
if [ ${{ inputs.dev }} = true ] && ![ "${{ inputs.tag }}" = "1.0.0-SNAPSHOT" ]; then
125+
if [ "$INPUT_DEV" = "true" ] && [ "$INPUT_TAG" != "1.0.0-SNAPSHOT" ]; then
116126
prop='-Dast.wrapper.id=ast-cli-java-wrapper-dev'
117127
fi
118128
echo "AID_PROP=${prop}" >> $GITHUB_ENV
119129
120130
- name: Publish package
121-
run: mvn --batch-mode deploy -DskipTests ${{ env.AID_PROP }}
131+
run: mvn --batch-mode deploy -DskipTests $AID_PROP
122132
env:
123133
MAVEN_USERNAME: ${{ secrets.OSSRH_USERNAME }}
124134
MAVEN_PASSWORD: ${{ secrets.OSSRH_TOKEN }}
@@ -131,26 +141,26 @@ jobs:
131141
tag_name: ${{ inputs.tag }}
132142
prerelease: ${{ inputs.dev }}
133143

134-
notify:
135-
if: inputs.dev == false
136-
needs: release
137-
uses: Checkmarx/plugins-release-workflow/.github/workflows/release-notify.yml@main
138-
with:
139-
product_name: Java Wrapper
140-
release_version: ${{ needs.release.outputs.TAG_NAME }}
141-
cli_release_version: ${{ needs.release.outputs.CLI_VERSION }}
142-
release_author: "Sypher Team"
143-
release_url: https://github.com/Checkmarx/ast-cli-java-wrapper/releases/tag/${{ needs.release.outputs.TAG_NAME }}
144-
jira_product_name: JAVA_WRAPPER
145-
secrets: inherit
144+
# notify:
145+
# if: inputs.dev == false
146+
# needs: release
147+
# uses: Checkmarx/plugins-release-workflow/.github/workflows/release-notify.yml@main
148+
# with:
149+
# product_name: Java Wrapper
150+
# release_version: ${{ needs.release.outputs.TAG_NAME }}
151+
# cli_release_version: ${{ needs.release.outputs.CLI_VERSION }}
152+
# release_author: "Sypher Team"
153+
# release_url: https://github.com/Checkmarx/ast-cli-java-wrapper/releases/tag/${{ needs.release.outputs.TAG_NAME }}
154+
# jira_product_name: JAVA_WRAPPER
155+
# secrets: inherit
146156

147-
dispatch_auto_release:
148-
name: Update Jenkins/Jetbrains/Eclipse Extensions With new Wrapper Version
149-
if: inputs.dev == false
150-
needs: notify
151-
uses: Checkmarx/plugins-release-workflow/.github/workflows/dispatch-workflow.yml@main
152-
with:
153-
cli_version: ${{ needs.release.outputs.CLI_VERSION }}
154-
is_cli_release: false
155-
is_java_release: true
156-
secrets: inherit
157+
# dispatch_auto_release:
158+
# name: Update Jenkins/Jetbrains/Eclipse Extensions With new Wrapper Version
159+
# if: inputs.dev == false
160+
# needs: notify
161+
# uses: Checkmarx/plugins-release-workflow/.github/workflows/dispatch-workflow.yml@main
162+
# with:
163+
# cli_version: ${{ needs.release.outputs.CLI_VERSION }}
164+
# is_cli_release: false
165+
# is_java_release: true
166+
# secrets: inherit

0 commit comments

Comments
 (0)