Refactor Github Action per b/485167538#19301
Conversation
Summary of ChangesHello @google-admin, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request systematically refactors the way input variables are handled within several GitHub Actions. The core change involves explicitly defining input values as environment variables before they are used in shell Highlights
Changelog
Ignored Files
Activity
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
|
Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA). View this failed invocation of the CLA check for more information. For the most up to date status, view the checks section at the bottom of the pull request. |
|
Size Change: -2 B (0%) Total Size: 20.5 MB ℹ️ View Unchanged
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request is an automated refactoring to improve the security of your GitHub Actions by using environment variables for inputs within run scripts, which helps prevent shell injection. The changes are generally correct and follow best practices. However, I've identified several instances where shell variables are not quoted in commands. This could lead to unexpected behavior or errors if the variable values contain spaces or special characters. I've added specific suggestions to quote these variables to enhance the robustness and security of the scripts.
| run: | | ||
| npm publish \ | ||
| --dry-run="${{ inputs.dry-run }}" \ | ||
| --workspace="${{ inputs.core-package-name }}" \ | ||
| --dry-run="${INPUTS_DRY_RUN}" \ | ||
| --workspace="${INPUTS_CORE_PACKAGE_NAME}" \ | ||
| --no-tag | ||
| npm dist-tag rm ${{ inputs.core-package-name }} false --silent | ||
| npm dist-tag rm ${INPUTS_CORE_PACKAGE_NAME} false --silent |
There was a problem hiding this comment.
The ${INPUTS_CORE_PACKAGE_NAME} variable should be double-quoted in the npm dist-tag rm command. This prevents potential issues like word splitting or globbing if the package name contains spaces or other shell metacharacters. While npm package names have restrictions, quoting variables in shell scripts is a crucial best practice for robustness and security.
npm publish \
--dry-run="${INPUTS_DRY_RUN}" \
--workspace="${INPUTS_CORE_PACKAGE_NAME}" \
--no-tag
npm dist-tag rm "${INPUTS_CORE_PACKAGE_NAME}" false --silent| run: | | ||
| npm publish \ | ||
| --dry-run="${{ inputs.dry-run }}" \ | ||
| --workspace="${{ inputs.cli-package-name }}" \ | ||
| --dry-run="${INPUTS_DRY_RUN}" \ | ||
| --workspace="${INPUTS_CLI_PACKAGE_NAME}" \ | ||
| --no-tag | ||
| npm dist-tag rm ${{ inputs.cli-package-name }} false --silent | ||
| npm dist-tag rm ${INPUTS_CLI_PACKAGE_NAME} false --silent |
There was a problem hiding this comment.
The ${INPUTS_CLI_PACKAGE_NAME} variable should be double-quoted to prevent shell injection vulnerabilities and ensure the script's robustness. It's a best practice to quote all variable expansions in shell commands.
npm publish \
--dry-run="${INPUTS_DRY_RUN}" \
--workspace="${INPUTS_CLI_PACKAGE_NAME}" \
--no-tag
npm dist-tag rm "${INPUTS_CLI_PACKAGE_NAME}" false --silent| run: | | ||
| npm publish \ | ||
| --dry-run="${{ inputs.dry-run }}" \ | ||
| --workspace="${{ inputs.a2a-package-name }}" \ | ||
| --dry-run="${INPUTS_DRY_RUN}" \ | ||
| --workspace="${INPUTS_A2A_PACKAGE_NAME}" \ | ||
| --no-tag | ||
| npm dist-tag rm ${{ inputs.a2a-package-name }} false --silent | ||
| npm dist-tag rm ${INPUTS_A2A_PACKAGE_NAME} false --silent |
There was a problem hiding this comment.
For consistency and security, the ${INPUTS_A2A_PACKAGE_NAME} variable should be double-quoted. This prevents unexpected behavior if the package name contains special characters.
npm publish \
--dry-run="${INPUTS_DRY_RUN}" \
--workspace="${INPUTS_A2A_PACKAGE_NAME}" \
--no-tag
npm dist-tag rm "${INPUTS_A2A_PACKAGE_NAME}" false --silent| working-directory: '${{ inputs.working-directory }}' | ||
| run: | | ||
| npm dist-tag add ${{ inputs.core-package-name }}@${{ inputs.version }} ${{ inputs.channel }} | ||
| npm dist-tag add ${INPUTS_CORE_PACKAGE_NAME}@${INPUTS_VERSION} ${INPUTS_CHANNEL} |
There was a problem hiding this comment.
The arguments to npm dist-tag add should be quoted to prevent word splitting and globbing. This ensures the command behaves as expected even if the package name, version, or channel contain special characters.
npm dist-tag add "${INPUTS_CORE_PACKAGE_NAME}@${INPUTS_VERSION}" "${INPUTS_CHANNEL}"| working-directory: '${{ inputs.working-directory }}' | ||
| run: | | ||
| npm dist-tag add ${{ inputs.cli-package-name }}@${{ inputs.version }} ${{ inputs.channel }} | ||
| npm dist-tag add ${INPUTS_CLI_PACKAGE_NAME}@${INPUTS_VERSION} ${INPUTS_CHANNEL} |
There was a problem hiding this comment.
For robustness and security, the arguments to npm dist-tag add should be double-quoted. This prevents unexpected behavior from shell expansion.
npm dist-tag add "${INPUTS_CLI_PACKAGE_NAME}@${INPUTS_VERSION}" "${INPUTS_CHANNEL}"| working-directory: '${{ inputs.working-directory }}' | ||
| run: | | ||
| npm dist-tag add ${{ inputs.a2a-package-name }}@${{ inputs.version }} ${{ inputs.channel }} | ||
| npm dist-tag add ${INPUTS_A2A_PACKAGE_NAME}@${INPUTS_VERSION} ${INPUTS_CHANNEL} |
There was a problem hiding this comment.
Please quote the arguments for npm dist-tag add to prevent potential shell injection issues and improve script robustness.
npm dist-tag add "${INPUTS_A2A_PACKAGE_NAME}@${INPUTS_VERSION}" "${INPUTS_CHANNEL}"
gemini-cli
Bot
added
the
status/need-issue
4 participants
This is a http://go/LSC run by http://go/ghss to automatically refactor your Github Actions per http://b/485167538.
This is a PR to help you upgrade to the latest standards in Github Actions.
Please merge this PR to accept the changes. NOTE: if you do not accept this PR, it may be force merged by the GHSS team. See http://b/485167538 for more details.