Skip to content

Commit 034bd9f

Browse files
author
github-actions
committed
fix: prevent script injection in workflows
1 parent f2cd80a commit 034bd9f

3 files changed

Lines changed: 35 additions & 28 deletions

File tree

‎.github/workflows/patch-release-build.yml‎

Lines changed: 14 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,8 @@ on:
1111
description: Comma separated list of commit shas to cherrypick
1212

1313
env:
14+
VERSION: ${{ env.VERSION }}
15+
COMMITS: ${{ env.COMMITS }}
1416
AWS_DEFAULT_REGION: us-east-1
1517
TEST_TAG: public.ecr.aws/aws-observability/adot-autoinstrumentation-java:test
1618

@@ -30,9 +32,9 @@ jobs:
3032
name: Parse release branch name
3133
run: |
3234
# Sets the release-branch-name output to the version number with the last non-period element replaced with an 'x' and preprended with v.
33-
echo "release-branch-name=$(echo '${{ github.event.inputs.version }}' | sed -E 's/([^.]+)\.([^.]+)\.([^.]+)/v\1.\2.x/')" >> $GITHUB_OUTPUT
35+
echo "release-branch-name=$(echo '${{ env.VERSION }}' | sed -E 's/([^.]+)\.([^.]+)\.([^.]+)/v\1.\2.x/')" >> $GITHUB_OUTPUT
3436
# Sets the release-tag-name output to the version number with the last non-period element replace with a '0' and prepended with v
35-
echo "release-tag-name=$(echo '${{ github.event.inputs.version }}' | sed -E 's/([^.]+)\.([^.]+)\.([^.]+)/v\1.\2.0/')" >> $GITHUB_OUTPUT
37+
echo "release-tag-name=$(echo '${{ env.VERSION }}' | sed -E 's/([^.]+)\.([^.]+)\.([^.]+)/v\1.\2.0/')" >> $GITHUB_OUTPUT
3638
- id: checkout-release-branch
3739
name: Check out release branch
3840
# Will fail if there is no release branch yet or succeed otherwise
@@ -84,15 +86,15 @@ jobs:
8486
if: ${{ github.event.inputs.commits != '' }}
8587
run: |
8688
git fetch origin main
87-
echo ${{ github.event.inputs.commits }} | sed -n 1'p' | tr ',' '\n' | while read word; do
89+
echo ${{ env.COMMITS }} | sed -n 1'p' | tr ',' '\n' | while read word; do
8890
# Trim whitespaces and cherrypick
8991
echo $word | sed 's/ *$//g' | sed 's/^ *//g' | git cherry-pick --stdin
9092
done
9193
9294
- name: Build release with Gradle
9395
uses: gradle/gradle-build-action@v2
9496
with:
95-
arguments: build integrationTests -PlocalDocker=true -Prelease.version=${{ github.event.inputs.version }} --stacktrace
97+
arguments: build integrationTests -PlocalDocker=true -Prelease.version=${{ env.VERSION }} --stacktrace
9698

9799
- name: Configure AWS Credentials
98100
uses: aws-actions/configure-aws-credentials@v2
@@ -115,30 +117,30 @@ jobs:
115117
uses: docker/build-push-action@v4
116118
with:
117119
push: false
118-
build-args: "ADOT_JAVA_VERSION=${{ github.event.inputs.version }}"
120+
build-args: "ADOT_JAVA_VERSION=${{ env.VERSION }}"
119121
context: .
120122
platforms: linux/amd64
121123
tags: ${{ env.TEST_TAG }}
122124
load: true
123125

124126
- name: Test docker image
125127
shell: bash
126-
run: .github/scripts/test-adot-javaagent-image.sh "${{ env.TEST_TAG }}" "${{ github.event.inputs.version }}"
128+
run: .github/scripts/test-adot-javaagent-image.sh "${{ env.TEST_TAG }}" "${{ env.VERSION }}"
127129

128130
- name: Build and push image
129131
uses: docker/build-push-action@v4
130132
with:
131133
push: true
132-
build-args: "ADOT_JAVA_VERSION=${{ github.event.inputs.version }}"
134+
build-args: "ADOT_JAVA_VERSION=${{ env.VERSION }}"
133135
context: .
134136
platforms: linux/amd64,linux/arm64
135137
tags: |
136-
public.ecr.aws/aws-observability/adot-autoinstrumentation-java:v${{ github.event.inputs.version }}
138+
public.ecr.aws/aws-observability/adot-autoinstrumentation-java:v${{ env.VERSION }}
137139
138140
- name: Build and Publish release with Gradle
139141
uses: gradle/gradle-build-action@v2
140142
with:
141-
arguments: build final closeAndReleaseSonatypeStagingRepository -Prelease.version=${{ github.event.inputs.version }} --stacktrace
143+
arguments: build final closeAndReleaseSonatypeStagingRepository -Prelease.version=${{ env.VERSION }} --stacktrace
142144
env:
143145
PUBLISH_USERNAME: ${{ secrets.PUBLISH_USERNAME }}
144146
PUBLISH_PASSWORD: ${{ secrets.PUBLISH_PASSWORD }}
@@ -150,9 +152,9 @@ jobs:
150152
env:
151153
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # This token is provided by Actions, you do not need to create your own token
152154
run: |
153-
cp "otelagent/build/libs/aws-opentelemetry-agent-${{ github.event.inputs.version }}.jar" aws-opentelemetry-agent.jar
155+
cp "otelagent/build/libs/aws-opentelemetry-agent-${{ env.VERSION }}.jar" aws-opentelemetry-agent.jar
154156
gh release create --target "$GITHUB_REF_NAME" \
155-
--title "Release v${{ github.event.inputs.version }}" \
157+
--title "Release v${{ env.VERSION }}" \
156158
--draft \
157-
"v${{ github.event.inputs.version }}" \
159+
"v${{ env.VERSION }}" \
158160
aws-opentelemetry-agent.jar

‎.github/workflows/release-build.yml‎

Lines changed: 11 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,8 @@ on:
77
required: true
88

99
env:
10+
VERSION: ${{ env.VERSION }}
11+
AWS_REGION: ${{ env.AWS_REGION }}
1012
AWS_DEFAULT_REGION: us-east-1
1113
TEST_TAG: public.ecr.aws/aws-observability/adot-autoinstrumentation-java:test
1214

@@ -47,7 +49,7 @@ jobs:
4749
- name: Build release with Gradle
4850
uses: gradle/gradle-build-action@v2
4951
with:
50-
arguments: build integrationTests -PlocalDocker=true -Prelease.version=${{ github.event.inputs.version }} --stacktrace
52+
arguments: build integrationTests -PlocalDocker=true -Prelease.version=${{ env.VERSION }} --stacktrace
5153

5254
- name: Configure AWS Credentials
5355
uses: aws-actions/configure-aws-credentials@v2
@@ -70,30 +72,30 @@ jobs:
7072
uses: docker/build-push-action@v4
7173
with:
7274
push: false
73-
build-args: "ADOT_JAVA_VERSION=${{ github.event.inputs.version }}"
75+
build-args: "ADOT_JAVA_VERSION=${{ env.VERSION }}"
7476
context: .
7577
platforms: linux/amd64
7678
tags: ${{ env.TEST_TAG }}
7779
load: true
7880

7981
- name: Test docker image
8082
shell: bash
81-
run: .github/scripts/test-adot-javaagent-image.sh "${{ env.TEST_TAG }}" "${{ github.event.inputs.version }}"
83+
run: .github/scripts/test-adot-javaagent-image.sh "${{ env.TEST_TAG }}" "${{ env.VERSION }}"
8284

8385
- name: Build and push image
8486
uses: docker/build-push-action@v4
8587
with:
8688
push: true
87-
build-args: "ADOT_JAVA_VERSION=${{ github.event.inputs.version }}"
89+
build-args: "ADOT_JAVA_VERSION=${{ env.VERSION }}"
8890
context: .
8991
platforms: linux/amd64,linux/arm64
9092
tags: |
91-
public.ecr.aws/aws-observability/adot-autoinstrumentation-java:v${{ github.event.inputs.version }}
93+
public.ecr.aws/aws-observability/adot-autoinstrumentation-java:v${{ env.VERSION }}
9294
9395
- name: Build and Publish release with Gradle
9496
uses: gradle/gradle-build-action@v2
9597
with:
96-
arguments: build final closeAndReleaseSonatypeStagingRepository -Prelease.version=${{ github.event.inputs.version }} --stacktrace
98+
arguments: build final closeAndReleaseSonatypeStagingRepository -Prelease.version=${{ env.VERSION }} --stacktrace
9799
env:
98100
PUBLISH_USERNAME: ${{ secrets.PUBLISH_USERNAME }}
99101
PUBLISH_PASSWORD: ${{ secrets.PUBLISH_PASSWORD }}
@@ -105,9 +107,9 @@ jobs:
105107
env:
106108
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # This token is provided by Actions, you do not need to create your own token
107109
run: |
108-
cp "otelagent/build/libs/aws-opentelemetry-agent-${{ github.event.inputs.version }}.jar" aws-opentelemetry-agent.jar
110+
cp "otelagent/build/libs/aws-opentelemetry-agent-${{ env.VERSION }}.jar" aws-opentelemetry-agent.jar
109111
gh release create --target "$GITHUB_REF_NAME" \
110-
--title "Release v${{ github.event.inputs.version }}" \
112+
--title "Release v${{ env.VERSION }}" \
111113
--draft \
112-
"v${{ github.event.inputs.version }}" \
114+
"v${{ env.VERSION }}" \
113115
aws-opentelemetry-agent.jar

‎.github/workflows/soak-testing.yml‎

Lines changed: 10 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,9 @@ env:
2525
CPU_LOAD_THRESHOLD: 55
2626
TOTAL_MEMORY_THRESHOLD: 4294967296 # 4 GiB
2727
MAX_BENCHMARKS_TO_KEEP: 100
28+
TARGET_COMMIT_SHA: ${{ env.TARGET_COMMIT_SHA }}
29+
TEST_DURATION_MINUTES_INPUT: ${{ env.TEST_DURATION_MINUTES_INPUT }}
30+
EVENT_NAME: ${{ env.EVENT_NAME }}
2831
# TODO: We might be able to adapt the "Soak Tests" to be "Overhead Tests".
2932
# This means monitoring the Sample App's performance using high levels of TPS
3033
# for the Load Generator over a shorter period of testing time. For example:
@@ -52,16 +55,16 @@ jobs:
5255
# MARK: - GitHub Workflow Event Type Specific Values
5356

5457
- name: Use INPUT as commit SHA
55-
if: ${{ github.event_name == 'workflow_dispatch' }}
58+
if: ${{ env.EVENT_NAME == 'workflow_dispatch' }}
5659
run: |
57-
echo "TARGET_SHA=${{ github.event.inputs.target_commit_sha }}" | tee --append $GITHUB_ENV;
60+
echo "TARGET_SHA=${{ env.TARGET_COMMIT_SHA }}" | tee --append $GITHUB_ENV;
5861
- name: Use LATEST as commit SHA
59-
if: ${{ github.event_name != 'workflow_dispatch' }}
62+
if: ${{ env.EVENT_NAME != 'workflow_dispatch' }}
6063
run: |
6164
echo "TARGET_SHA=${{ github.sha }}" | tee --append $GITHUB_ENV;
6265
- name: Configure Performance Test Duration
6366
run: |
64-
echo "TEST_DURATION_MINUTES=${{ github.event.inputs.test_duration_minutes || env.DEFAULT_TEST_DURATION_MINUTES }}" | tee --append $GITHUB_ENV;
67+
echo "TEST_DURATION_MINUTES=${{ env.TEST_DURATION_MINUTES_INPUT || env.DEFAULT_TEST_DURATION_MINUTES }}" | tee --append $GITHUB_ENV;
6568
- name: Clone This Repo @ ${{ env.TARGET_SHA }}
6669
uses: actions/checkout@v3
6770
with:
@@ -224,14 +227,14 @@ jobs:
224227
# https://github.com/open-telemetry/opentelemetry-python/pull/1478
225228
# comment-always: true
226229
fail-on-alert: true
227-
auto-push: ${{ github.event_name == 'schedule' &&
230+
auto-push: ${{ env.EVENT_NAME == 'schedule' &&
228231
steps.check-already-have-performance-results.outcome == 'failure' &&
229232
github.ref == 'refs/heads/main' }}
230233
gh-pages-branch: gh-pages
231234
benchmark-data-dir-path: soak-tests/per-commit-overall-results
232235
- name: Publish Issue if failed DURING Performance Tests
233236
uses: JasonEtco/create-an-issue@v2
234-
if: ${{ github.event_name == 'schedule' &&
237+
if: ${{ env.EVENT_NAME == 'schedule' &&
235238
steps.check-failure-during-performance-tests.outcome == 'failure' }}
236239
env:
237240
APP_PLATFORM: ${{ matrix.app-platform }}
@@ -242,7 +245,7 @@ jobs:
242245
update_existing: true
243246
- name: Publish Issue if failed AFTER Performance Tests
244247
uses: JasonEtco/create-an-issue@v2
245-
if: ${{ github.event_name == 'schedule' &&
248+
if: ${{ env.EVENT_NAME == 'schedule' &&
246249
steps.check-failure-after-performance-tests.outcome == 'failure' }}
247250
env:
248251
APP_PLATFORM: ${{ matrix.app-platform }}

0 commit comments

Comments
 (0)