Skip to content

Commit 9b68af7

Browse files
thpiercethpierce
committed
fix: prevent script injection in workflows
Move github.event references to env vars to prevent script injection vulnerabilities in run steps
1 parent 855b5ec commit 9b68af7

3 files changed

Lines changed: 22 additions & 18 deletions

File tree

‎.github/workflows/post_release_version_bump.yml‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -23,8 +23,8 @@ jobs:
2323

2424
- name: Extract Major.Minor Version and setup Env variable
2525
run: |
26-
echo "VERSION=${{ github.event.inputs.version }}" >> $GITHUB_ENV
27-
echo "MAJOR_MINOR=$(echo ${{ github.event.inputs.version }} | sed -E 's/([0-9]+\.[0-9]+)\.[0-9]+/\1/')" >> $GITHUB_ENV
26+
echo "VERSION=${{ env.VERSION }}" >> $GITHUB_ENV
27+
echo "MAJOR_MINOR=$(echo ${{ env.VERSION }} | sed -E 's/([0-9]+\.[0-9]+)\.[0-9]+/\1/')" >> $GITHUB_ENV
2828
2929
- name: Get current major.minor version from main branch
3030
id: get_version
@@ -66,8 +66,8 @@ jobs:
6666
6767
- name: Extract Major.Minor Version and setup Env variable
6868
run: |
69-
echo "VERSION=${{ github.event.inputs.version }}" >> $GITHUB_ENV
70-
echo "MAJOR_MINOR=$(echo ${{ github.event.inputs.version }} | sed -E 's/([0-9]+\.[0-9]+)\.[0-9]+/\1/')" >> $GITHUB_ENV
69+
echo "VERSION=${{ env.VERSION }}" >> $GITHUB_ENV
70+
echo "MAJOR_MINOR=$(echo ${{ env.VERSION }} | sed -E 's/([0-9]+\.[0-9]+)\.[0-9]+/\1/')" >> $GITHUB_ENV
7171
7272
- name: Determine release branch and checkout
7373
run: |
@@ -77,9 +77,9 @@ jobs:
7777
7878
- name: Update version to next development version in main
7979
run: |
80-
DEV_VERSION="${{ github.event.inputs.version }}.dev0"
80+
DEV_VERSION="${{ env.VERSION }}.dev0"
8181
sed -i 's/__version__ = ".*"/__version__ = "'$DEV_VERSION'"/' aws-opentelemetry-distro/src/amazon/opentelemetry/distro/version.py
82-
VERSION="${{ github.event.inputs.version }}"
82+
VERSION="${{ env.VERSION }}"
8383
sed -i 's/python:v.*"/python:v'$VERSION'"/' .github/workflows/released_image_scan.yml
8484
git add aws-opentelemetry-distro/src/amazon/opentelemetry/distro/version.py
8585
git add .github/workflows/released_image_scan.yml
@@ -90,7 +90,7 @@ jobs:
9090
env:
9191
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
9292
run: |
93-
DEV_VERSION="${{ github.event.inputs.version }}.dev0"
93+
DEV_VERSION="${{ env.VERSION }}.dev0"
9494
gh pr create --title "Post release $VERSION: Update version to $DEV_VERSION" \
9595
--body "This PR prepares the main branch for the next development cycle by updating the version to $DEV_VERSION and updating the image version to be scanned to the latest released.
9696

‎.github/workflows/pre_release_prepare.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -32,12 +32,12 @@ jobs:
3232
3333
- name: Extract Major.Minor Version and setup Env variable
3434
run: |
35-
echo "VERSION=${{ github.event.inputs.version }}" >> $GITHUB_ENV
36-
echo "MAJOR_MINOR=$(echo ${{ github.event.inputs.version }} | sed -E 's/([0-9]+\.[0-9]+)\.[0-9]+/\1/')" >> $GITHUB_ENV
35+
echo "VERSION=${{ env.VERSION }}" >> $GITHUB_ENV
36+
echo "MAJOR_MINOR=$(echo ${{ env.VERSION }} | sed -E 's/([0-9]+\.[0-9]+)\.[0-9]+/\1/')" >> $GITHUB_ENV
3737
3838
- name: Create branches
3939
run: |
40-
IS_PATCH=${{ github.event.inputs.is_patch }}
40+
IS_PATCH=${{ env.IS_PATCH }}
4141
if [[ "$IS_PATCH" != "true" && "$IS_PATCH" != "false" ]]; then
4242
echo "Invalid input for IS_PATCH. Must be 'true' or 'false'."
4343
exit 1
@@ -83,5 +83,5 @@ jobs:
8383
--body "This PR updates the version to ${VERSION}.
8484
8585
By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice." \
86-
--head ${{ github.event.inputs.version }}_release \
86+
--head ${{ env.VERSION }}_release \
8787
--base release/${MAJOR_MINOR}.x

‎.github/workflows/release_build.yml‎

Lines changed: 11 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,8 @@ on:
66
description: The version to tag the release with, e.g., 1.2.0
77
required: true
88

9+
VERSION: ${{ env.VERSION }}
10+
911
env:
1012
AWS_DEFAULT_REGION: us-east-1
1113
AWS_PUBLIC_ECR_REGION: us-east-1
@@ -15,6 +17,8 @@ env:
1517
RELEASE_PRIVATE_REGISTRY: 020628701572.dkr.ecr.us-west-2.amazonaws.com
1618
PACKAGE_NAME: aws-opentelemetry-distro
1719

20+
VERSION: ${{ env.VERSION }}
21+
1822
permissions:
1923
id-token: write
2024
contents: write
@@ -88,15 +92,15 @@ jobs:
8892
TWINE_USERNAME: '__token__'
8993
TWINE_PASSWORD: ${{ env.TEST_PYPI_TOKEN_API_TOKEN }}
9094
run: |
91-
twine upload --repository testpypi --skip-existing --verbose dist/aws_opentelemetry_distro-${{ github.event.inputs.version }}-py3-none-any.whl
95+
twine upload --repository testpypi --skip-existing --verbose dist/aws_opentelemetry_distro-${{ env.VERSION }}-py3-none-any.whl
9296
9397
# Publish to prod PyPI
9498
- name: Publish to PyPI
9599
env:
96100
TWINE_USERNAME: '__token__'
97101
TWINE_PASSWORD: ${{ env.PROD_PYPI_TOKEN_API_TOKEN }}
98102
run: |
99-
twine upload --skip-existing --verbose dist/aws_opentelemetry_distro-${{ github.event.inputs.version }}-py3-none-any.whl
103+
twine upload --skip-existing --verbose dist/aws_opentelemetry_distro-${{ env.VERSION }}-py3-none-any.whl
100104
101105
# Publish to public ECR
102106
- name: Build and push public ECR image
@@ -107,7 +111,7 @@ jobs:
107111
file: ./Dockerfile
108112
platforms: linux/amd64,linux/arm64
109113
tags: |
110-
${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ github.event.inputs.version }}
114+
${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ env.VERSION }}
111115
112116
# Publish to private ECR
113117
- name: Build and push private ECR image
@@ -118,7 +122,7 @@ jobs:
118122
file: ./Dockerfile
119123
platforms: linux/amd64,linux/arm64
120124
tags: |
121-
${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ github.event.inputs.version }}
125+
${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ env.VERSION }}
122126
123127
# Publish to GitHub releases
124128
- name: Create GH release
@@ -127,7 +131,7 @@ jobs:
127131
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # This token is provided by Actions, you do not need to create your own token
128132
run: |
129133
gh release create --target "$GITHUB_REF_NAME" \
130-
--title "Release v${{ github.event.inputs.version }}" \
134+
--title "Release v${{ env.VERSION }}" \
131135
--draft \
132-
"v${{ github.event.inputs.version }}" \
133-
dist/aws_opentelemetry_distro-${{ github.event.inputs.version }}-py3-none-any.whl
136+
"v${{ env.VERSION }}" \
137+
dist/aws_opentelemetry_distro-${{ env.VERSION }}-py3-none-any.whl

0 commit comments

Comments
 (0)