Skip to content

Commit a58d2d3

Browse files
author
github-actions
committed
fix: prevent script injection in workflows
1 parent eb553bd commit a58d2d3

3 files changed

Lines changed: 35 additions & 28 deletions

File tree

‎.github/workflows/patch-release-build.yml‎

Lines changed: 14 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,8 @@ on:
1111
description: Comma separated list of commit shas to cherrypick
1212

1313
env:
14+
VERSION: ${{ env.VERSION }}
15+
COMMITS: ${{ env.COMMITS }}
1416
AWS_DEFAULT_REGION: us-east-1
1517
TEST_TAG: public.ecr.aws/aws-observability/adot-autoinstrumentation-java:test
1618

@@ -30,9 +32,9 @@ jobs:
3032
name: Parse release branch name
3133
run: |
3234
# Sets the release-branch-name output to the version number with the last non-period element replaced with an 'x' and preprended with v.
33-
echo "release-branch-name=$(echo '${{ github.event.inputs.version }}' | sed -E 's/([^.]+)\.([^.]+)\.([^.]+)/v\1.\2.x/')" >> $GITHUB_OUTPUT
35+
echo "release-branch-name=$(echo '${{ env.VERSION }}' | sed -E 's/([^.]+)\.([^.]+)\.([^.]+)/v\1.\2.x/')" >> $GITHUB_OUTPUT
3436
# Sets the release-tag-name output to the version number with the last non-period element replace with a '0' and prepended with v
35-
echo "release-tag-name=$(echo '${{ github.event.inputs.version }}' | sed -E 's/([^.]+)\.([^.]+)\.([^.]+)/v\1.\2.0/')" >> $GITHUB_OUTPUT
37+
echo "release-tag-name=$(echo '${{ env.VERSION }}' | sed -E 's/([^.]+)\.([^.]+)\.([^.]+)/v\1.\2.0/')" >> $GITHUB_OUTPUT
3638
- id: checkout-release-branch
3739
name: Check out release branch
3840
# Will fail if there is no release branch yet or succeed otherwise
@@ -83,15 +85,15 @@ jobs:
8385
if: ${{ github.event.inputs.commits != '' }}
8486
run: |
8587
git fetch origin main
86-
echo ${{ github.event.inputs.commits }} | sed -n 1'p' | tr ',' '\n' | while read word; do
88+
echo ${{ env.COMMITS }} | sed -n 1'p' | tr ',' '\n' | while read word; do
8789
# Trim whitespaces and cherrypick
8890
echo $word | sed 's/ *$//g' | sed 's/^ *//g' | git cherry-pick --stdin
8991
done
9092
9193
- name: Build release with Gradle
9294
uses: gradle/gradle-build-action@v2
9395
with:
94-
arguments: build integrationTests -PlocalDocker=true -Prelease.version=${{ github.event.inputs.version }} --stacktrace
96+
arguments: build integrationTests -PlocalDocker=true -Prelease.version=${{ env.VERSION }} --stacktrace
9597

9698
- name: Configure AWS Credentials
9799
uses: aws-actions/configure-aws-credentials@v1
@@ -114,30 +116,30 @@ jobs:
114116
uses: docker/build-push-action@v4
115117
with:
116118
push: false
117-
build-args: "ADOT_JAVA_VERSION=${{ github.event.inputs.version }}"
119+
build-args: "ADOT_JAVA_VERSION=${{ env.VERSION }}"
118120
context: .
119121
platforms: linux/amd64
120122
tags: ${{ env.TEST_TAG }}
121123
load: true
122124

123125
- name: Test docker image
124126
shell: bash
125-
run: .github/scripts/test-adot-javaagent-image.sh "${{ env.TEST_TAG }}" "${{ github.event.inputs.version }}"
127+
run: .github/scripts/test-adot-javaagent-image.sh "${{ env.TEST_TAG }}" "${{ env.VERSION }}"
126128

127129
- name: Build and push image
128130
uses: docker/build-push-action@v4
129131
with:
130132
push: true
131-
build-args: "ADOT_JAVA_VERSION=${{ github.event.inputs.version }}"
133+
build-args: "ADOT_JAVA_VERSION=${{ env.VERSION }}"
132134
context: .
133135
platforms: linux/amd64,linux/arm64
134136
tags: |
135-
public.ecr.aws/aws-observability/adot-autoinstrumentation-java:v${{ github.event.inputs.version }}
137+
public.ecr.aws/aws-observability/adot-autoinstrumentation-java:v${{ env.VERSION }}
136138
137139
- name: Build and Publish release with Gradle
138140
uses: gradle/gradle-build-action@v2
139141
with:
140-
arguments: build final closeAndReleaseSonatypeStagingRepository -Prelease.version=${{ github.event.inputs.version }} --stacktrace
142+
arguments: build final closeAndReleaseSonatypeStagingRepository -Prelease.version=${{ env.VERSION }} --stacktrace
141143
env:
142144
PUBLISH_USERNAME: ${{ secrets.PUBLISH_USERNAME }}
143145
PUBLISH_PASSWORD: ${{ secrets.PUBLISH_PASSWORD }}
@@ -151,8 +153,8 @@ jobs:
151153
env:
152154
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
153155
with:
154-
tag_name: v${{ github.event.inputs.version }}
155-
release_name: Release v${{ github.event.inputs.version }}
156+
tag_name: v${{ env.VERSION }}
157+
release_name: Release v${{ env.VERSION }}
156158
draft: true
157159
prerelease: false
158160

@@ -163,6 +165,6 @@ jobs:
163165
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
164166
with:
165167
upload_url: ${{ steps.create_release.outputs.upload_url }}
166-
asset_path: otelagent/build/libs/aws-opentelemetry-agent-${{ github.event.inputs.version }}.jar
168+
asset_path: otelagent/build/libs/aws-opentelemetry-agent-${{ env.VERSION }}.jar
167169
asset_name: aws-opentelemetry-agent.jar
168170
asset_content_type: application/java-archive

‎.github/workflows/release-build.yml‎

Lines changed: 11 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,8 @@ on:
77
required: true
88

99
env:
10+
VERSION: ${{ env.VERSION }}
11+
AWS_REGION: ${{ env.AWS_REGION }}
1012
AWS_DEFAULT_REGION: us-east-1
1113
TEST_TAG: public.ecr.aws/aws-observability/adot-autoinstrumentation-java:test
1214

@@ -46,7 +48,7 @@ jobs:
4648
- name: Build release with Gradle
4749
uses: gradle/gradle-build-action@v2
4850
with:
49-
arguments: build integrationTests -PlocalDocker=true -Prelease.version=${{ github.event.inputs.version }} --stacktrace
51+
arguments: build integrationTests -PlocalDocker=true -Prelease.version=${{ env.VERSION }} --stacktrace
5052

5153
- name: Configure AWS Credentials
5254
uses: aws-actions/configure-aws-credentials@v1
@@ -69,30 +71,30 @@ jobs:
6971
uses: docker/build-push-action@v4
7072
with:
7173
push: false
72-
build-args: "ADOT_JAVA_VERSION=${{ github.event.inputs.version }}"
74+
build-args: "ADOT_JAVA_VERSION=${{ env.VERSION }}"
7375
context: .
7476
platforms: linux/amd64
7577
tags: ${{ env.TEST_TAG }}
7678
load: true
7779

7880
- name: Test docker image
7981
shell: bash
80-
run: .github/scripts/test-adot-javaagent-image.sh "${{ env.TEST_TAG }}" "${{ github.event.inputs.version }}"
82+
run: .github/scripts/test-adot-javaagent-image.sh "${{ env.TEST_TAG }}" "${{ env.VERSION }}"
8183

8284
- name: Build and push image
8385
uses: docker/build-push-action@v4
8486
with:
8587
push: true
86-
build-args: "ADOT_JAVA_VERSION=${{ github.event.inputs.version }}"
88+
build-args: "ADOT_JAVA_VERSION=${{ env.VERSION }}"
8789
context: .
8890
platforms: linux/amd64,linux/arm64
8991
tags: |
90-
public.ecr.aws/aws-observability/adot-autoinstrumentation-java:v${{ github.event.inputs.version }}
92+
public.ecr.aws/aws-observability/adot-autoinstrumentation-java:v${{ env.VERSION }}
9193
9294
- name: Build and Publish release with Gradle
9395
uses: gradle/gradle-build-action@v2
9496
with:
95-
arguments: build final closeAndReleaseSonatypeStagingRepository -Prelease.version=${{ github.event.inputs.version }} --stacktrace
97+
arguments: build final closeAndReleaseSonatypeStagingRepository -Prelease.version=${{ env.VERSION }} --stacktrace
9698
env:
9799
PUBLISH_USERNAME: ${{ secrets.PUBLISH_USERNAME }}
98100
PUBLISH_PASSWORD: ${{ secrets.PUBLISH_PASSWORD }}
@@ -106,8 +108,8 @@ jobs:
106108
env:
107109
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
108110
with:
109-
tag_name: v${{ github.event.inputs.version }}
110-
release_name: Release v${{ github.event.inputs.version }}
111+
tag_name: v${{ env.VERSION }}
112+
release_name: Release v${{ env.VERSION }}
111113
draft: true
112114
prerelease: false
113115

@@ -118,6 +120,6 @@ jobs:
118120
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
119121
with:
120122
upload_url: ${{ steps.create_release.outputs.upload_url }}
121-
asset_path: otelagent/build/libs/aws-opentelemetry-agent-${{ github.event.inputs.version }}.jar
123+
asset_path: otelagent/build/libs/aws-opentelemetry-agent-${{ env.VERSION }}.jar
122124
asset_name: aws-opentelemetry-agent.jar
123125
asset_content_type: application/java-archive

‎.github/workflows/soak-testing.yml‎

Lines changed: 10 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,9 @@ env:
2525
CPU_LOAD_THRESHOLD: 55
2626
TOTAL_MEMORY_THRESHOLD: 4294967296 # 4 GiB
2727
MAX_BENCHMARKS_TO_KEEP: 100
28+
TARGET_COMMIT_SHA: ${{ env.TARGET_COMMIT_SHA }}
29+
TEST_DURATION_MINUTES_INPUT: ${{ env.TEST_DURATION_MINUTES_INPUT }}
30+
EVENT_NAME: ${{ env.EVENT_NAME }}
2831
# TODO: We might be able to adapt the "Soak Tests" to be "Overhead Tests".
2932
# This means monitoring the Sample App's performance using high levels of TPS
3033
# for the Load Generator over a shorter period of testing time. For example:
@@ -52,16 +55,16 @@ jobs:
5255
# MARK: - GitHub Workflow Event Type Specific Values
5356

5457
- name: Use INPUT as commit SHA
55-
if: ${{ github.event_name == 'workflow_dispatch' }}
58+
if: ${{ env.EVENT_NAME == 'workflow_dispatch' }}
5659
run: |
57-
echo "TARGET_SHA=${{ github.event.inputs.target_commit_sha }}" | tee --append $GITHUB_ENV;
60+
echo "TARGET_SHA=${{ env.TARGET_COMMIT_SHA }}" | tee --append $GITHUB_ENV;
5861
- name: Use LATEST as commit SHA
59-
if: ${{ github.event_name != 'workflow_dispatch' }}
62+
if: ${{ env.EVENT_NAME != 'workflow_dispatch' }}
6063
run: |
6164
echo "TARGET_SHA=${{ github.sha }}" | tee --append $GITHUB_ENV;
6265
- name: Configure Performance Test Duration
6366
run: |
64-
echo "TEST_DURATION_MINUTES=${{ github.event.inputs.test_duration_minutes || env.DEFAULT_TEST_DURATION_MINUTES }}" | tee --append $GITHUB_ENV;
67+
echo "TEST_DURATION_MINUTES=${{ env.TEST_DURATION_MINUTES_INPUT || env.DEFAULT_TEST_DURATION_MINUTES }}" | tee --append $GITHUB_ENV;
6568
- name: Clone This Repo @ ${{ env.TARGET_SHA }}
6669
uses: actions/checkout@v2
6770
with:
@@ -224,14 +227,14 @@ jobs:
224227
# https://github.com/open-telemetry/opentelemetry-python/pull/1478
225228
# comment-always: true
226229
fail-on-alert: true
227-
auto-push: ${{ github.event_name == 'schedule' &&
230+
auto-push: ${{ env.EVENT_NAME == 'schedule' &&
228231
steps.check-already-have-performance-results.outcome == 'failure' &&
229232
github.ref == 'refs/heads/main' }}
230233
gh-pages-branch: gh-pages
231234
benchmark-data-dir-path: soak-tests/per-commit-overall-results
232235
- name: Publish Issue if failed DURING Performance Tests
233236
uses: JasonEtco/create-an-issue@v2
234-
if: ${{ github.event_name == 'schedule' &&
237+
if: ${{ env.EVENT_NAME == 'schedule' &&
235238
steps.check-failure-during-performance-tests.outcome == 'failure' }}
236239
env:
237240
APP_PLATFORM: ${{ matrix.app-platform }}
@@ -242,7 +245,7 @@ jobs:
242245
update_existing: true
243246
- name: Publish Issue if failed AFTER Performance Tests
244247
uses: JasonEtco/create-an-issue@v2
245-
if: ${{ github.event_name == 'schedule' &&
248+
if: ${{ env.EVENT_NAME == 'schedule' &&
246249
steps.check-failure-after-performance-tests.outcome == 'failure' }}
247250
env:
248251
APP_PLATFORM: ${{ matrix.app-platform }}

0 commit comments

Comments
 (0)