downgrade version v0.82.10 and add validation#1626
Conversation
github-actions
Bot
added
the
medium_boom
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Request changes: the new validation can silently miss invalid uses references in standard workflow steps and on macOS.
Warning
Firewall blocked 1 domain
The following domain was blocked by the firewall during workflow execution:
awmgmcpg
To allow these domains, add them to the
network.allowedlist in your workflow frontmatter:
network:
allowed:
- defaults
- "awmgmcpg"See Network Configuration for more information.
What is this? | From workflow: Trigger PR Review
Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.
| while IFS= read -r match; do | ||
| invalid_count=$((invalid_count + 1)) | ||
| echo "Invalid uses reference: ${workflow_file#$REPO_ROOT/}:$match" | ||
| done < <(grep -nE '^[[:space:]]*uses:[[:space:]]+[^[:space:]#]+@[[:space:]]*(#.*)?$' "$workflow_file" || true) |
There was a problem hiding this comment.
[P1] Match the standard - uses: step form\n\nGitHub Actions steps are normally written as - uses: owner/action@ref, but this expression anchors at the start of uses: and therefore skips the leading list marker. The repository already uses that form (for example, .github/workflows/ci.yml:16), so an invalid - uses: ruby/setup-ruby@ can pass this validation and reach GitHub unchanged. Allow the optional list marker before uses:.
| invalid_count=$((invalid_count + 1)) | ||
| echo "Invalid uses reference: ${workflow_file#$REPO_ROOT/}:$match" | ||
| done < <(grep -nE '^[[:space:]]*uses:[[:space:]]+[^[:space:]#]+@[[:space:]]*(#.*)?$' "$workflow_file" || true) | ||
| done < <(find "$WORKFLOWS_DIR" -maxdepth 1 \( -name '*.yml' -o -name '*.yaml' \) -print0) |
There was a problem hiding this comment.
[P1] Avoid GNU-only find options here\n\nThe Makefile supports macOS, but BSD /usr/bin/find does not implement -maxdepth. In that environment this process substitution emits the find error and yields no files; because the process-substitution status is not propagated, invalid_count remains zero and the validator exits successfully. An invalid workflow reference can therefore bypass the guard on macOS.
2 participants
Summary
As part of github/gh-aw#47285 , let's downgrade and add a validation
Validation
Pre-Completion Checklist
make compileandmake lintwith no errors