Skip to content

Commit df9dc81

Browse files
thpiercethpierce
committed
fix: prevent script injection in workflows
Move github.event references to env vars to prevent script injection vulnerabilities in run steps
1 parent 399c749 commit df9dc81

5 files changed

Lines changed: 29 additions & 16 deletions

File tree

‎.github/workflows/post_release_version_bump.yml‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,8 @@ on:
88
required: true
99

1010
env:
11+
VERSION: ${{ github.event.inputs.version }}
12+
1113
AWS_DEFAULT_REGION: us-east-1
1214

1315
permissions:
@@ -96,9 +98,9 @@ jobs:
9698
9799
- name: Update version to next development version in main
98100
run: |
99-
DEV_VERSION="${{ github.event.inputs.version }}.dev0"
101+
DEV_VERSION="${{ env.VERSION }}.dev0"
100102
sed -i 's/__version__ = ".*"/__version__ = "'$DEV_VERSION'"/' aws-opentelemetry-distro/src/amazon/opentelemetry/distro/version.py
101-
VERSION="${{ github.event.inputs.version }}"
103+
VERSION="${{ env.VERSION }}"
102104
sed -i 's/python:v.*"/python:v'$VERSION'"/' .github/workflows/daily_scan.yml
103105
git add aws-opentelemetry-distro/src/amazon/opentelemetry/distro/version.py
104106
git add .github/workflows/daily_scan.yml
@@ -109,7 +111,7 @@ jobs:
109111
env:
110112
GITHUB_TOKEN: ${{ env.BOT_TOKEN_GITHUB_RW_PATOKEN }}
111113
run: |
112-
DEV_VERSION="${{ github.event.inputs.version }}.dev0"
114+
DEV_VERSION="${{ env.VERSION }}.dev0"
113115
gh pr create --title "Post release $VERSION: Update version to $DEV_VERSION" \
114116
--body "This PR prepares the main branch for the next development cycle by updating the version to $DEV_VERSION and updating the image version to be scanned to the latest released.
115117

‎.github/workflows/pre_release_prepare.yml‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,9 @@ on:
1212
default: 'false'
1313

1414
env:
15+
VERSION: ${{ github.event.inputs.version }}
16+
IS_PATCH: ${{ github.event.inputs.is_patch }}
17+
1518
AWS_DEFAULT_REGION: us-east-1
1619

1720
permissions:
@@ -56,7 +59,7 @@ jobs:
5659
5760
- name: Create branches
5861
run: |
59-
IS_PATCH=${{ github.event.inputs.is_patch }}
62+
IS_PATCH=${{ env.IS_PATCH }}
6063
if [[ "$IS_PATCH" != "true" && "$IS_PATCH" != "false" ]]; then
6164
echo "Invalid input for IS_PATCH. Must be 'true' or 'false'."
6265
exit 1
@@ -102,5 +105,5 @@ jobs:
102105
--body "This PR updates the version to ${VERSION}.
103106
104107
By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice." \
105-
--head v${{ github.event.inputs.version }}_release \
108+
--head v${{ env.VERSION }}_release \
106109
--base release/v${MAJOR_MINOR}.x

‎.github/workflows/release-lambda.yml‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,10 @@ on:
1212
default: 'us-east-1, us-east-2, us-west-1, us-west-2, ap-south-1, ap-northeast-3, ap-northeast-2, ap-southeast-1, ap-southeast-2, ap-northeast-1, ca-central-1, eu-central-1, eu-west-1, eu-west-2, eu-west-3, eu-north-1, sa-east-1, af-south-1, ap-east-1, ap-south-2, ap-southeast-3, ap-southeast-4, eu-central-2, eu-south-1, eu-south-2, il-central-1, me-central-1, me-south-1'
1313

1414
env:
15+
VERSION: ${{ github.event.inputs.version }}
16+
AWS_REGIONS: ${{ github.event.inputs.aws_region }}
17+
18+
1519
COMMERCIAL_REGIONS: us-east-1, us-east-2, us-west-1, us-west-2, ap-south-1, ap-northeast-3, ap-northeast-2, ap-southeast-1, ap-southeast-2, ap-northeast-1, ca-central-1, eu-central-1, eu-west-1, eu-west-2, eu-west-3, eu-north-1, sa-east-1
1620
LAYER_NAME: AWSOpenTelemetryDistroPython
1721

@@ -28,7 +32,7 @@ jobs:
2832
- name: Set up regions matrix
2933
id: set-matrix
3034
run: |
31-
IFS=',' read -ra REGIONS <<< "${{ github.event.inputs.aws_region }}"
35+
IFS=',' read -ra REGIONS <<< "${{ env.AWS_REGIONS }}"
3236
MATRIX="["
3337
for region in "${REGIONS[@]}"; do
3438
trimmed_region=$(echo "$region" | xargs)
@@ -191,7 +195,7 @@ jobs:
191195
run: echo "sha_short=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT
192196
- name: Create Release Notes
193197
run: |
194-
echo "AWS OpenTelemetry Lambda Layer for Python version ${{ github.event.inputs.version }}-${{ steps.commit.outputs.sha_short }}" > release_notes.md
198+
echo "AWS OpenTelemetry Lambda Layer for Python version ${{ env.VERSION }}-${{ steps.commit.outputs.sha_short }}" > release_notes.md
195199
echo "" >> release_notes.md
196200
echo "" >> release_notes.md
197201
echo "See new Lambda Layer ARNs:" >> release_notes.md
@@ -205,10 +209,10 @@ jobs:
205209
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # This token is provided by Actions, you do not need to create your own token
206210
run: |
207211
gh release create --target "$GITHUB_REF_NAME" \
208-
--title "Release lambda-v${{ github.event.inputs.version }}-${{ steps.commit.outputs.sha_short }}" \
212+
--title "Release lambda-v${{ env.VERSION }}-${{ steps.commit.outputs.sha_short }}" \
209213
--notes-file release_notes.md \
210214
--draft \
211-
"lambda-v${{ github.event.inputs.version }}-${{ steps.commit.outputs.sha_short }}" \
215+
"lambda-v${{ env.VERSION }}-${{ steps.commit.outputs.sha_short }}" \
212216
layer_arns.tf layer.zip
213217
echo Removing release_notes.md ...
214218
rm -f release_notes.md

‎.github/workflows/release-udp-exporter.yml‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,11 @@ on:
88
required: true
99
type: string
1010
env:
11+
VERSION: ${{ github.event.inputs.version }}
12+
13+
1114
AWS_DEFAULT_REGION: us-east-1
12-
ARTIFACT_NAME: aws_otel_otlp_udp_exporter-${{ github.event.inputs.version }}-py3-none-any.whl
15+
ARTIFACT_NAME: aws_otel_otlp_udp_exporter-${{ env.VERSION }}-py3-none-any.whl
1316

1417
permissions:
1518
id-token: write

‎.github/workflows/release_build.yml‎

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -7,15 +7,16 @@ on:
77
required: true
88

99
env:
10+
VERSION: ${{ github.event.inputs.version }}
11+
1012
AWS_DEFAULT_REGION: us-east-1
1113
AWS_PUBLIC_ECR_REGION: us-east-1
1214
AWS_PRIVATE_ECR_REGION: us-west-2
1315
RELEASE_PUBLIC_REPOSITORY: public.ecr.aws/aws-observability/adot-autoinstrumentation-python
1416
RELEASE_PRIVATE_REPOSITORY: 020628701572.dkr.ecr.us-west-2.amazonaws.com/adot-autoinstrumentation-python
1517
RELEASE_PRIVATE_REGISTRY: 020628701572.dkr.ecr.us-west-2.amazonaws.com
1618
PACKAGE_NAME: aws-opentelemetry-distro
17-
ARTIFACT_NAME: aws_opentelemetry_distro-${{ github.event.inputs.version }}-py3-none-any.whl
18-
19+
ARTIFACT_NAME: aws_opentelemetry_distro-${{ env.VERSION }}-py3-none-any.whl
1920
permissions:
2021
id-token: write
2122
contents: write
@@ -108,7 +109,7 @@ jobs:
108109
file: ./Dockerfile
109110
platforms: linux/amd64,linux/arm64
110111
tags: |
111-
${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ github.event.inputs.version }}
112+
${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ env.VERSION }}
112113
113114
# Publish to private ECR
114115
- name: Build and push private ECR image
@@ -119,7 +120,7 @@ jobs:
119120
file: ./Dockerfile
120121
platforms: linux/amd64,linux/arm64
121122
tags: |
122-
${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ github.event.inputs.version }}
123+
${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ env.VERSION }}
123124
124125
- name: Get SHA256 checksum of wheel file
125126
id: get_sha256
@@ -139,9 +140,9 @@ jobs:
139140
shasum -a 256 layer_artifact/layer.zip > layer_artifact/layer.zip.sha256
140141
141142
gh release create --target "$GITHUB_REF_NAME" \
142-
--title "Release v${{ github.event.inputs.version }}" \
143+
--title "Release v${{ env.VERSION }}" \
143144
--draft \
144-
"v${{ github.event.inputs.version }}" \
145+
"v${{ env.VERSION }}" \
145146
dist/${{ env.ARTIFACT_NAME }} \
146147
${{ env.ARTIFACT_NAME }}.sha256 \
147148
layer_artifact/layer.zip \

0 commit comments

Comments
 (0)