Skip to content

Commit 67664c0

Browse files
thpiercethpierce
committed
fix: prevent script injection in workflows
Move github.event references to env vars to prevent script injection vulnerabilities in run steps
1 parent 49d3fdd commit 67664c0

4 files changed

Lines changed: 44 additions & 20 deletions

File tree

‎.github/workflows/post_release_version_bump.yml‎

Lines changed: 11 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -7,9 +7,13 @@ on:
77
description: 'Version number (e.g., 1.0.1)'
88
required: true
99

10+
VERSION: ${{ env.VERSION }}
11+
1012
env:
1113
AWS_DEFAULT_REGION: us-east-1
1214

15+
VERSION: ${{ env.VERSION }}
16+
1317
permissions:
1418
id-token: write
1519
contents: write
@@ -27,8 +31,8 @@ jobs:
2731

2832
- name: Extract Major.Minor Version and setup Env variable
2933
run: |
30-
echo "VERSION=${{ github.event.inputs.version }}" >> $GITHUB_ENV
31-
echo "MAJOR_MINOR=$(echo ${{ github.event.inputs.version }} | sed -E 's/([0-9]+\.[0-9]+)\.[0-9]+/\1/')" >> $GITHUB_ENV
34+
echo "VERSION=${{ env.VERSION }}" >> $GITHUB_ENV
35+
echo "MAJOR_MINOR=$(echo ${{ env.VERSION }} | sed -E 's/([0-9]+\.[0-9]+)\.[0-9]+/\1/')" >> $GITHUB_ENV
3236
3337
- name: Get current major.minor version from main branch
3438
id: get_version
@@ -85,8 +89,8 @@ jobs:
8589
8690
- name: Extract Major.Minor Version and setup Env variable
8791
run: |
88-
echo "VERSION=${{ github.event.inputs.version }}" >> $GITHUB_ENV
89-
echo "MAJOR_MINOR=$(echo ${{ github.event.inputs.version }} | sed -E 's/([0-9]+\.[0-9]+)\.[0-9]+/\1/')" >> $GITHUB_ENV
92+
echo "VERSION=${{ env.VERSION }}" >> $GITHUB_ENV
93+
echo "MAJOR_MINOR=$(echo ${{ env.VERSION }} | sed -E 's/([0-9]+\.[0-9]+)\.[0-9]+/\1/')" >> $GITHUB_ENV
9094
9195
- name: Determine release branch and checkout
9296
run: |
@@ -96,9 +100,9 @@ jobs:
96100
97101
- name: Update version to next development version in main
98102
run: |
99-
DEV_VERSION="${{ github.event.inputs.version }}.dev0"
103+
DEV_VERSION="${{ env.VERSION }}.dev0"
100104
sed -i 's/__version__ = ".*"/__version__ = "'$DEV_VERSION'"/' aws-opentelemetry-distro/src/amazon/opentelemetry/distro/version.py
101-
VERSION="${{ github.event.inputs.version }}"
105+
VERSION="${{ env.VERSION }}"
102106
sed -i 's/python:v.*"/python:v'$VERSION'"/' .github/workflows/daily_scan.yml
103107
git add aws-opentelemetry-distro/src/amazon/opentelemetry/distro/version.py
104108
git add .github/workflows/daily_scan.yml
@@ -109,7 +113,7 @@ jobs:
109113
env:
110114
GITHUB_TOKEN: ${{ env.BOT_TOKEN_GITHUB_RW_PATOKEN }}
111115
run: |
112-
DEV_VERSION="${{ github.event.inputs.version }}.dev0"
116+
DEV_VERSION="${{ env.VERSION }}.dev0"
113117
gh pr create --title "Post release $VERSION: Update version to $DEV_VERSION" \
114118
--body "This PR prepares the main branch for the next development cycle by updating the version to $DEV_VERSION and updating the image version to be scanned to the latest released.
115119

‎.github/workflows/pre_release_prepare.yml‎

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -11,9 +11,17 @@ on:
1111
required: true
1212
default: 'false'
1313

14+
VERSION: ${{ env.VERSION }}
15+
16+
IS_PATCH: ${{ env.IS_PATCH }}
17+
1418
env:
1519
AWS_DEFAULT_REGION: us-east-1
1620

21+
VERSION: ${{ env.VERSION }}
22+
23+
IS_PATCH: ${{ env.IS_PATCH }}
24+
1725
permissions:
1826
contents: write
1927
pull-requests: write
@@ -51,12 +59,12 @@ jobs:
5159
5260
- name: Extract Major.Minor Version and setup Env variable
5361
run: |
54-
echo "VERSION=${{ github.event.inputs.version }}" >> $GITHUB_ENV
55-
echo "MAJOR_MINOR=$(echo ${{ github.event.inputs.version }} | sed -E 's/([0-9]+\.[0-9]+)\.[0-9]+/\1/')" >> $GITHUB_ENV
62+
echo "VERSION=${{ env.VERSION }}" >> $GITHUB_ENV
63+
echo "MAJOR_MINOR=$(echo ${{ env.VERSION }} | sed -E 's/([0-9]+\.[0-9]+)\.[0-9]+/\1/')" >> $GITHUB_ENV
5664
5765
- name: Create branches
5866
run: |
59-
IS_PATCH=${{ github.event.inputs.is_patch }}
67+
IS_PATCH=${{ env.IS_PATCH }}
6068
if [[ "$IS_PATCH" != "true" && "$IS_PATCH" != "false" ]]; then
6169
echo "Invalid input for IS_PATCH. Must be 'true' or 'false'."
6270
exit 1
@@ -102,5 +110,5 @@ jobs:
102110
--body "This PR updates the version to ${VERSION}.
103111
104112
By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice." \
105-
--head v${{ github.event.inputs.version }}_release \
113+
--head v${{ env.VERSION }}_release \
106114
--base release/v${MAJOR_MINOR}.x

‎.github/workflows/release-lambda.yml‎

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -11,10 +11,18 @@ on:
1111
required: true
1212
default: 'us-east-1, us-east-2, us-west-1, us-west-2, ap-south-1, ap-northeast-3, ap-northeast-2, ap-southeast-1, ap-southeast-2, ap-northeast-1, ca-central-1, eu-central-1, eu-west-1, eu-west-2, eu-west-3, eu-north-1, sa-east-1, af-south-1, ap-east-1, ap-south-2, ap-southeast-3, ap-southeast-4, eu-central-2, eu-south-1, eu-south-2, il-central-1, me-central-1, me-south-1, ap-southeast-5, ap-southeast-7, mx-central-1, ca-west-1, cn-north-1, cn-northwest-1'
1313

14+
VERSION: ${{ env.VERSION }}
15+
16+
AWS_REGIONS: ${{ env.AWS_REGIONS }}
17+
1418
env:
1519
COMMERCIAL_REGIONS: us-east-1, us-east-2, us-west-1, us-west-2, ap-south-1, ap-northeast-3, ap-northeast-2, ap-southeast-1, ap-southeast-2, ap-northeast-1, ca-central-1, eu-central-1, eu-west-1, eu-west-2, eu-west-3, eu-north-1, sa-east-1, ap-southeast-5, ap-southeast-7, mx-central-1, ca-west-1, cn-north-1, cn-northwest-1
1620
LAYER_NAME: AWSOpenTelemetryDistroPython
1721

22+
VERSION: ${{ env.VERSION }}
23+
24+
AWS_REGIONS: ${{ env.AWS_REGIONS }}
25+
1826
permissions:
1927
id-token: write
2028
contents: write
@@ -29,7 +37,7 @@ jobs:
2937
- name: Set up regions matrix
3038
id: set-matrix
3139
run: |
32-
IFS=',' read -ra REGIONS <<< "${{ github.event.inputs.aws_region }}"
40+
IFS=',' read -ra REGIONS <<< "${{ env.AWS_REGIONS }}"
3341
MATRIX="["
3442
for region in "${REGIONS[@]}"; do
3543
trimmed_region=$(echo "$region" | xargs)
@@ -205,7 +213,7 @@ jobs:
205213
run: echo "sha_short=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT
206214
- name: Create Release Notes
207215
run: |
208-
echo "AWS OpenTelemetry Lambda Layer for Python version ${{ github.event.inputs.version }}-${{ steps.commit.outputs.sha_short }}" > release_notes.md
216+
echo "AWS OpenTelemetry Lambda Layer for Python version ${{ env.VERSION }}-${{ steps.commit.outputs.sha_short }}" > release_notes.md
209217
echo "" >> release_notes.md
210218
echo "" >> release_notes.md
211219
echo "See new Lambda Layer ARNs:" >> release_notes.md
@@ -219,10 +227,10 @@ jobs:
219227
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # This token is provided by Actions, you do not need to create your own token
220228
run: |
221229
gh release create --target "$GITHUB_REF_NAME" \
222-
--title "Release lambda-v${{ github.event.inputs.version }}-${{ steps.commit.outputs.sha_short }}" \
230+
--title "Release lambda-v${{ env.VERSION }}-${{ steps.commit.outputs.sha_short }}" \
223231
--notes-file release_notes.md \
224232
--draft \
225-
"lambda-v${{ github.event.inputs.version }}-${{ steps.commit.outputs.sha_short }}" \
233+
"lambda-v${{ env.VERSION }}-${{ steps.commit.outputs.sha_short }}" \
226234
layer_arns.tf layer.zip
227235
echo Removing release_notes.md ...
228236
rm -f release_notes.md

‎.github/workflows/release_build.yml‎

Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,8 @@ on:
66
description: The version to tag the release with, e.g., 1.2.0
77
required: true
88

9+
VERSION: ${{ env.VERSION }}
10+
911
env:
1012
AWS_DEFAULT_REGION: us-east-1
1113
AWS_PUBLIC_ECR_REGION: us-east-1
@@ -14,7 +16,9 @@ env:
1416
RELEASE_PRIVATE_REPOSITORY: 020628701572.dkr.ecr.us-west-2.amazonaws.com/adot-autoinstrumentation-python
1517
RELEASE_PRIVATE_REGISTRY: 020628701572.dkr.ecr.us-west-2.amazonaws.com
1618
PACKAGE_NAME: aws-opentelemetry-distro
17-
ARTIFACT_NAME: aws_opentelemetry_distro-${{ github.event.inputs.version }}-py3-none-any.whl
19+
ARTIFACT_NAME: aws_opentelemetry_distro-${{ env.VERSION }}-py3-none-any.whl
20+
21+
VERSION: ${{ env.VERSION }}
1822

1923
permissions:
2024
id-token: write
@@ -108,7 +112,7 @@ jobs:
108112
file: ./Dockerfile
109113
platforms: linux/amd64,linux/arm64
110114
tags: |
111-
${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ github.event.inputs.version }}
115+
${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ env.VERSION }}
112116
113117
# Publish to private ECR
114118
- name: Build and push private ECR image
@@ -119,7 +123,7 @@ jobs:
119123
file: ./Dockerfile
120124
platforms: linux/amd64,linux/arm64
121125
tags: |
122-
${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ github.event.inputs.version }}
126+
${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ env.VERSION }}
123127
124128
- name: Get SHA256 checksum of wheel file
125129
id: get_sha256
@@ -139,9 +143,9 @@ jobs:
139143
shasum -a 256 layer_artifact/layer.zip > layer_artifact/layer.zip.sha256
140144
141145
gh release create --target "$GITHUB_REF_NAME" \
142-
--title "Release v${{ github.event.inputs.version }}" \
146+
--title "Release v${{ env.VERSION }}" \
143147
--draft \
144-
"v${{ github.event.inputs.version }}" \
148+
"v${{ env.VERSION }}" \
145149
dist/${{ env.ARTIFACT_NAME }} \
146150
${{ env.ARTIFACT_NAME }}.sha256 \
147151
layer_artifact/layer.zip \

0 commit comments

Comments
 (0)