Skip to content

Commit e0a99b0

Browse files
committed
fix: prevent script injection in workflows
Move github.event references to env vars to prevent script injection vulnerabilities in run steps
1 parent 0b3ef3a commit e0a99b0

4 files changed

Lines changed: 25 additions & 13 deletions

File tree

.github/workflows/post_release_version_bump.yml

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,8 @@ on:
88
required: true
99

1010
env:
11+
VERSION: ${{ env.VERSION }}
12+
1113
AWS_DEFAULT_REGION: us-east-1
1214

1315
permissions:
@@ -96,9 +98,9 @@ jobs:
9698
9799
- name: Update version to next development version in main
98100
run: |
99-
DEV_VERSION="${{ github.event.inputs.version }}.dev0"
101+
DEV_VERSION="${{ env.VERSION }}.dev0"
100102
sed -i 's/__version__ = ".*"/__version__ = "'$DEV_VERSION'"/' aws-opentelemetry-distro/src/amazon/opentelemetry/distro/version.py
101-
VERSION="${{ github.event.inputs.version }}"
103+
VERSION="${{ env.VERSION }}"
102104
sed -i 's/python:v.*"/python:v'$VERSION'"/' .github/workflows/daily_scan.yml
103105
git add aws-opentelemetry-distro/src/amazon/opentelemetry/distro/version.py
104106
git add .github/workflows/daily_scan.yml
@@ -109,7 +111,7 @@ jobs:
109111
env:
110112
GITHUB_TOKEN: ${{ env.BOT_TOKEN_GITHUB_RW_PATOKEN }}
111113
run: |
112-
DEV_VERSION="${{ github.event.inputs.version }}.dev0"
114+
DEV_VERSION="${{ env.VERSION }}.dev0"
113115
gh pr create --title "Post release $VERSION: Update version to $DEV_VERSION" \
114116
--body "This PR prepares the main branch for the next development cycle by updating the version to $DEV_VERSION and updating the image version to be scanned to the latest released.
115117

.github/workflows/pre_release_prepare.yml

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,10 @@ on:
1212
default: 'false'
1313

1414
env:
15+
VERSION: ${{ env.VERSION }}
16+
IS_PATCH: ${{ env.IS_PATCH }}
17+
18+
1519
AWS_DEFAULT_REGION: us-east-1
1620

1721
permissions:
@@ -56,7 +60,7 @@ jobs:
5660
5761
- name: Create branches
5862
run: |
59-
IS_PATCH=${{ github.event.inputs.is_patch }}
63+
IS_PATCH=${{ env.IS_PATCH }}
6064
if [[ "$IS_PATCH" != "true" && "$IS_PATCH" != "false" ]]; then
6165
echo "Invalid input for IS_PATCH. Must be 'true' or 'false'."
6266
exit 1
@@ -102,5 +106,5 @@ jobs:
102106
--body "This PR updates the version to ${VERSION}.
103107
104108
By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice." \
105-
--head v${{ github.event.inputs.version }}_release \
109+
--head v${{ env.VERSION }}_release \
106110
--base release/v${MAJOR_MINOR}.x

.github/workflows/release_build.yml

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -7,14 +7,16 @@ on:
77
required: true
88

99
env:
10+
VERSION: ${{ env.VERSION }}
11+
1012
AWS_DEFAULT_REGION: us-east-1
1113
AWS_PUBLIC_ECR_REGION: us-east-1
1214
AWS_PRIVATE_ECR_REGION: us-west-2
1315
RELEASE_PUBLIC_REPOSITORY: public.ecr.aws/aws-observability/adot-autoinstrumentation-python
1416
RELEASE_PRIVATE_REPOSITORY: 020628701572.dkr.ecr.us-west-2.amazonaws.com/adot-autoinstrumentation-python
1517
RELEASE_PRIVATE_REGISTRY: 020628701572.dkr.ecr.us-west-2.amazonaws.com
1618
PACKAGE_NAME: aws-opentelemetry-distro
17-
ARTIFACT_NAME: aws_opentelemetry_distro-${{ github.event.inputs.version }}-py3-none-any.whl
19+
ARTIFACT_NAME: aws_opentelemetry_distro-${{ env.VERSION }}-py3-none-any.whl
1820

1921
permissions:
2022
id-token: write
@@ -108,7 +110,7 @@ jobs:
108110
file: ./Dockerfile
109111
platforms: linux/amd64,linux/arm64
110112
tags: |
111-
${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ github.event.inputs.version }}
113+
${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ env.VERSION }}
112114
113115
# Publish to private ECR
114116
- name: Build and push private ECR image
@@ -119,7 +121,7 @@ jobs:
119121
file: ./Dockerfile
120122
platforms: linux/amd64,linux/arm64
121123
tags: |
122-
${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ github.event.inputs.version }}
124+
${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ env.VERSION }}
123125
124126
- name: Get SHA256 checksum of wheel file
125127
id: get_sha256
@@ -133,8 +135,8 @@ jobs:
133135
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # This token is provided by Actions, you do not need to create your own token
134136
run: |
135137
gh release create --target "$GITHUB_REF_NAME" \
136-
--title "Release v${{ github.event.inputs.version }}" \
138+
--title "Release v${{ env.VERSION }}" \
137139
--draft \
138-
"v${{ github.event.inputs.version }}" \
140+
"v${{ env.VERSION }}" \
139141
dist/${{ env.ARTIFACT_NAME }} \
140142
${{ env.ARTIFACT_NAME }}.sha256

.github/workflows/release_lambda.yml

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,10 @@ on:
1212
default: 'us-east-1, us-east-2, us-west-1, us-west-2, ap-south-1, ap-northeast-3, ap-northeast-2, ap-southeast-1, ap-southeast-2, ap-northeast-1, ca-central-1, eu-central-1, eu-west-1, eu-west-2, eu-west-3, eu-north-1, sa-east-1, af-south-1, ap-east-1, ap-south-2, ap-southeast-3, ap-southeast-4, eu-central-2, eu-south-1, eu-south-2, il-central-1, me-central-1, me-south-1'
1313

1414
env:
15+
VERSION: ${{ env.VERSION }}
16+
AWS_REGIONS: ${{ env.AWS_REGIONS }}
17+
18+
1519
COMMERCIAL_REGIONS: us-east-1, us-east-2, us-west-1, us-west-2, ap-south-1, ap-northeast-3, ap-northeast-2, ap-southeast-1, ap-southeast-2, ap-northeast-1, ca-central-1, eu-central-1, eu-west-1, eu-west-2, eu-west-3, eu-north-1, sa-east-1
1620
LAYER_NAME: AWSOpenTelemetryDistroPython
1721

@@ -28,7 +32,7 @@ jobs:
2832
- name: Set up regions matrix
2933
id: set-matrix
3034
run: |
31-
IFS=',' read -ra REGIONS <<< "${{ github.event.inputs.aws_region }}"
35+
IFS=',' read -ra REGIONS <<< "${{ env.AWS_REGIONS }}"
3236
MATRIX="["
3337
for region in "${REGIONS[@]}"; do
3438
trimmed_region=$(echo "$region" | xargs)
@@ -193,7 +197,7 @@ jobs:
193197
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # This token is provided by Actions, you do not need to create your own token
194198
run: |
195199
gh release create --target "$GITHUB_REF_NAME" \
196-
--title "Release lambda-v${{ github.event.inputs.version }}" \
200+
--title "Release lambda-v${{ env.VERSION }}" \
197201
--draft \
198-
"lambda-v${{ github.event.inputs.version }}" \
202+
"lambda-v${{ env.VERSION }}" \
199203
layer.tf

0 commit comments

Comments
 (0)