Refactor Github Action per b/485167538#19327
Conversation
Summary of ChangesHello @google-admin, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request implements an automated refactoring across several GitHub Actions to enhance their security and adhere to the latest standards. The core modification involves transitioning from direct interpolation of action inputs within Highlights
Changelog
Ignored Files
Activity
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request is an automated refactoring of GitHub Actions workflows to improve security by preventing script injection. It replaces direct context access (e.g., ${{ inputs.var }}) in run steps with environment variables. The changes are generally correct and follow best practices. However, I've identified one instance where the refactoring was incomplete, leaving a potential vulnerability. My review includes a suggestion to address this.
| env: | ||
| GITHUB_TOKEN: '${{ inputs.github-token }}' | ||
| INPUTS_RELEASE_TAG: ${{ inputs.release-tag }} | ||
| STEPS_RELEASE_BRANCH_OUTPUTS_BRANCH_NAME: ${{ steps.release_branch.outputs.BRANCH_NAME }} | ||
| INPUTS_PREVIOUS_TAG: ${{ inputs.previous-tag }} | ||
| shell: 'bash' | ||
| run: | | ||
| gh release create "${{ inputs.release-tag }}" \ | ||
| gh release create "${INPUTS_RELEASE_TAG}" \ | ||
| bundle/gemini.js \ | ||
| --target "${{ steps.release_branch.outputs.BRANCH_NAME }}" \ | ||
| --title "Release ${{ inputs.release-tag }}" \ | ||
| --notes-start-tag "${{ inputs.previous-tag }}" \ | ||
| --target "${STEPS_RELEASE_BRANCH_OUTPUTS_BRANCH_NAME}" \ | ||
| --title "Release ${INPUTS_RELEASE_TAG}" \ | ||
| --notes-start-tag "${INPUTS_PREVIOUS_TAG}" \ | ||
| --generate-notes \ | ||
| ${{ inputs.npm-tag != 'latest' && '--prerelease' || '' }} |
There was a problem hiding this comment.
The automated refactoring to prevent script injection missed one case. The expression ${{ inputs.npm-tag != 'latest' && '--prerelease' || '' }} still uses an input context directly within the run script. To fully mitigate the risk of script injection, this should be refactored to use an environment variable and perform the conditional logic within the shell script.
env:
GITHUB_TOKEN: '${{ inputs.github-token }}'
INPUTS_RELEASE_TAG: ${{ inputs.release-tag }}
STEPS_RELEASE_BRANCH_OUTPUTS_BRANCH_NAME: ${{ steps.release_branch.outputs.BRANCH_NAME }}
INPUTS_PREVIOUS_TAG: ${{ inputs.previous-tag }}
INPUTS_NPM_TAG: ${{ inputs.npm-tag }}
shell: 'bash'
run: |
prerelease_arg=""
if [[ "${INPUTS_NPM_TAG}" != 'latest' ]]; then
prerelease_arg="--prerelease"
fi
gh release create "${INPUTS_RELEASE_TAG}" \
bundle/gemini.js \
--target "${STEPS_RELEASE_BRANCH_OUTPUTS_BRANCH_NAME}" \
--title "Release ${INPUTS_RELEASE_TAG}" \
--notes-start-tag "${INPUTS_PREVIOUS_TAG}" \
--generate-notes \
$prerelease_arg
|
Size Change: -2 B (0%) Total Size: 22.2 MB ℹ️ View Unchanged
|
gemini-cli
Bot
added
the
status/need-issue
4 participants
This is a http://go/LSC run by http://go/ghss to automatically refactor your Github Actions per http://b/485167538.
This is a PR to help you upgrade to the latest standards in Github Actions.
Please merge this PR to accept the changes. NOTE: if you do not accept this PR, it may be force merged by the GHSS team. See http://b/485167538 for more details.