Skip to content

Commit d75c7dc

Browse files
thpiercethpierce
committed
fix: prevent script injection in workflows
Move github.event references to env vars to prevent script injection vulnerabilities in run steps
1 parent 7ff9ed0 commit d75c7dc

3 files changed

Lines changed: 34 additions & 18 deletions

File tree

‎.github/workflows/post_release_version_bump.yml‎

Lines changed: 11 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -7,9 +7,13 @@ on:
77
description: 'Version number (e.g., 1.0.1)'
88
required: true
99

10+
VERSION: ${{ env.VERSION }}
11+
1012
env:
1113
AWS_DEFAULT_REGION: us-east-1
1214

15+
VERSION: ${{ env.VERSION }}
16+
1317
permissions:
1418
id-token: write
1519
contents: write
@@ -27,8 +31,8 @@ jobs:
2731

2832
- name: Extract Major.Minor Version and setup Env variable
2933
run: |
30-
echo "VERSION=${{ github.event.inputs.version }}" >> $GITHUB_ENV
31-
echo "MAJOR_MINOR=$(echo ${{ github.event.inputs.version }} | sed -E 's/([0-9]+\.[0-9]+)\.[0-9]+/\1/')" >> $GITHUB_ENV
34+
echo "VERSION=${{ env.VERSION }}" >> $GITHUB_ENV
35+
echo "MAJOR_MINOR=$(echo ${{ env.VERSION }} | sed -E 's/([0-9]+\.[0-9]+)\.[0-9]+/\1/')" >> $GITHUB_ENV
3236
3337
- name: Get current major.minor version from main branch
3438
id: get_version
@@ -85,8 +89,8 @@ jobs:
8589
8690
- name: Extract Major.Minor Version and setup Env variable
8791
run: |
88-
echo "VERSION=${{ github.event.inputs.version }}" >> $GITHUB_ENV
89-
echo "MAJOR_MINOR=$(echo ${{ github.event.inputs.version }} | sed -E 's/([0-9]+\.[0-9]+)\.[0-9]+/\1/')" >> $GITHUB_ENV
92+
echo "VERSION=${{ env.VERSION }}" >> $GITHUB_ENV
93+
echo "MAJOR_MINOR=$(echo ${{ env.VERSION }} | sed -E 's/([0-9]+\.[0-9]+)\.[0-9]+/\1/')" >> $GITHUB_ENV
9094
9195
- name: Determine release branch and checkout
9296
run: |
@@ -96,9 +100,9 @@ jobs:
96100
97101
- name: Update version to next development version in main
98102
run: |
99-
DEV_VERSION="${{ github.event.inputs.version }}.dev0"
103+
DEV_VERSION="${{ env.VERSION }}.dev0"
100104
sed -i 's/__version__ = ".*"/__version__ = "'$DEV_VERSION'"/' aws-opentelemetry-distro/src/amazon/opentelemetry/distro/version.py
101-
VERSION="${{ github.event.inputs.version }}"
105+
VERSION="${{ env.VERSION }}"
102106
sed -i 's/python:v.*"/python:v'$VERSION'"/' .github/workflows/daily_scan.yml
103107
git add aws-opentelemetry-distro/src/amazon/opentelemetry/distro/version.py
104108
git add .github/workflows/daily_scan.yml
@@ -109,7 +113,7 @@ jobs:
109113
env:
110114
GITHUB_TOKEN: ${{ env.BOT_TOKEN_GITHUB_RW_PATOKEN }}
111115
run: |
112-
DEV_VERSION="${{ github.event.inputs.version }}.dev0"
116+
DEV_VERSION="${{ env.VERSION }}.dev0"
113117
gh pr create --title "Post release $VERSION: Update version to $DEV_VERSION" \
114118
--body "This PR prepares the main branch for the next development cycle by updating the version to $DEV_VERSION and updating the image version to be scanned to the latest released.
115119

‎.github/workflows/pre_release_prepare.yml‎

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -11,9 +11,17 @@ on:
1111
required: true
1212
default: 'false'
1313

14+
VERSION: ${{ env.VERSION }}
15+
16+
IS_PATCH: ${{ env.IS_PATCH }}
17+
1418
env:
1519
AWS_DEFAULT_REGION: us-east-1
1620

21+
VERSION: ${{ env.VERSION }}
22+
23+
IS_PATCH: ${{ env.IS_PATCH }}
24+
1725
permissions:
1826
contents: write
1927
pull-requests: write
@@ -51,12 +59,12 @@ jobs:
5159
5260
- name: Extract Major.Minor Version and setup Env variable
5361
run: |
54-
echo "VERSION=${{ github.event.inputs.version }}" >> $GITHUB_ENV
55-
echo "MAJOR_MINOR=$(echo ${{ github.event.inputs.version }} | sed -E 's/([0-9]+\.[0-9]+)\.[0-9]+/\1/')" >> $GITHUB_ENV
62+
echo "VERSION=${{ env.VERSION }}" >> $GITHUB_ENV
63+
echo "MAJOR_MINOR=$(echo ${{ env.VERSION }} | sed -E 's/([0-9]+\.[0-9]+)\.[0-9]+/\1/')" >> $GITHUB_ENV
5664
5765
- name: Create branches
5866
run: |
59-
IS_PATCH=${{ github.event.inputs.is_patch }}
67+
IS_PATCH=${{ env.IS_PATCH }}
6068
if [[ "$IS_PATCH" != "true" && "$IS_PATCH" != "false" ]]; then
6169
echo "Invalid input for IS_PATCH. Must be 'true' or 'false'."
6270
exit 1
@@ -102,5 +110,5 @@ jobs:
102110
--body "This PR updates the version to ${VERSION}.
103111
104112
By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice." \
105-
--head v${{ github.event.inputs.version }}_release \
113+
--head v${{ env.VERSION }}_release \
106114
--base release/v${MAJOR_MINOR}.x

‎.github/workflows/release_build.yml‎

Lines changed: 11 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,8 @@ on:
66
description: The version to tag the release with, e.g., 1.2.0
77
required: true
88

9+
VERSION: ${{ env.VERSION }}
10+
911
env:
1012
AWS_DEFAULT_REGION: us-east-1
1113
AWS_PUBLIC_ECR_REGION: us-east-1
@@ -15,6 +17,8 @@ env:
1517
RELEASE_PRIVATE_REGISTRY: 020628701572.dkr.ecr.us-west-2.amazonaws.com
1618
PACKAGE_NAME: aws-opentelemetry-distro
1719

20+
VERSION: ${{ env.VERSION }}
21+
1822
permissions:
1923
id-token: write
2024
contents: write
@@ -88,15 +92,15 @@ jobs:
8892
TWINE_USERNAME: '__token__'
8993
TWINE_PASSWORD: ${{ env.TEST_PYPI_TOKEN_API_TOKEN }}
9094
run: |
91-
twine upload --repository testpypi --skip-existing --verbose dist/aws_opentelemetry_distro-${{ github.event.inputs.version }}-py3-none-any.whl
95+
twine upload --repository testpypi --skip-existing --verbose dist/aws_opentelemetry_distro-${{ env.VERSION }}-py3-none-any.whl
9296
9397
# Publish to prod PyPI
9498
- name: Publish to PyPI
9599
env:
96100
TWINE_USERNAME: '__token__'
97101
TWINE_PASSWORD: ${{ env.PROD_PYPI_TOKEN_API_TOKEN }}
98102
run: |
99-
twine upload --skip-existing --verbose dist/aws_opentelemetry_distro-${{ github.event.inputs.version }}-py3-none-any.whl
103+
twine upload --skip-existing --verbose dist/aws_opentelemetry_distro-${{ env.VERSION }}-py3-none-any.whl
100104
101105
# Publish to public ECR
102106
- name: Build and push public ECR image
@@ -107,7 +111,7 @@ jobs:
107111
file: ./Dockerfile
108112
platforms: linux/amd64,linux/arm64
109113
tags: |
110-
${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ github.event.inputs.version }}
114+
${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ env.VERSION }}
111115
112116
# Publish to private ECR
113117
- name: Build and push private ECR image
@@ -118,7 +122,7 @@ jobs:
118122
file: ./Dockerfile
119123
platforms: linux/amd64,linux/arm64
120124
tags: |
121-
${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ github.event.inputs.version }}
125+
${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ env.VERSION }}
122126
123127
# Publish to GitHub releases
124128
- name: Create GH release
@@ -127,7 +131,7 @@ jobs:
127131
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # This token is provided by Actions, you do not need to create your own token
128132
run: |
129133
gh release create --target "$GITHUB_REF_NAME" \
130-
--title "Release v${{ github.event.inputs.version }}" \
134+
--title "Release v${{ env.VERSION }}" \
131135
--draft \
132-
"v${{ github.event.inputs.version }}" \
133-
dist/aws_opentelemetry_distro-${{ github.event.inputs.version }}-py3-none-any.whl
136+
"v${{ env.VERSION }}" \
137+
dist/aws_opentelemetry_distro-${{ env.VERSION }}-py3-none-any.whl

0 commit comments

Comments
 (0)