Refactor Github Action per b/485167538#19340
Conversation
Summary of ChangesHello @google-admin, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request systematically refactors several Github Actions to align with updated best practices for handling input variables within Highlights
Changelog
Ignored Files
Activity
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request refactors the GitHub Actions workflows to improve security by passing inputs as environment variables instead of directly injecting them into scripts. This is a good practice. However, the refactoring is incomplete and introduces command injection vulnerabilities in several places because the environment variables are used without proper quoting in shell commands. These vulnerabilities are critical and must be fixed. I've added specific comments with suggestions on how to fix them.
| --workspace="${INPUTS_CORE_PACKAGE_NAME}" \ | ||
| --no-tag | ||
| npm dist-tag rm ${{ inputs.core-package-name }} false --silent | ||
| npm dist-tag rm ${INPUTS_CORE_PACKAGE_NAME} false --silent |
There was a problem hiding this comment.
This automated refactoring correctly moves the input to an environment variable. However, the variable is then used unquoted in the shell command. This can lead to a command injection vulnerability if the package name contains shell metacharacters. Please quote the variable to prevent this.
npm dist-tag rm "${INPUTS_CORE_PACKAGE_NAME}" false --silent| --workspace="${INPUTS_CLI_PACKAGE_NAME}" \ | ||
| --no-tag | ||
| npm dist-tag rm ${{ inputs.cli-package-name }} false --silent | ||
| npm dist-tag rm ${INPUTS_CLI_PACKAGE_NAME} false --silent |
There was a problem hiding this comment.
This automated refactoring correctly moves the input to an environment variable. However, the variable is then used unquoted in the shell command. This can lead to a command injection vulnerability if the package name contains shell metacharacters. Please quote the variable to prevent this.
npm dist-tag rm "${INPUTS_CLI_PACKAGE_NAME}" false --silent| --workspace="${INPUTS_A2A_PACKAGE_NAME}" \ | ||
| --no-tag | ||
| npm dist-tag rm ${{ inputs.a2a-package-name }} false --silent | ||
| npm dist-tag rm ${INPUTS_A2A_PACKAGE_NAME} false --silent |
There was a problem hiding this comment.
This automated refactoring correctly moves the input to an environment variable. However, the variable is then used unquoted in the shell command. This can lead to a command injection vulnerability if the package name contains shell metacharacters. Please quote the variable to prevent this.
npm dist-tag rm "${INPUTS_A2A_PACKAGE_NAME}" false --silent| working-directory: '${{ inputs.working-directory }}' | ||
| run: | | ||
| npm dist-tag add ${{ inputs.core-package-name }}@${{ inputs.version }} ${{ inputs.channel }} | ||
| npm dist-tag add ${INPUTS_CORE_PACKAGE_NAME}@${INPUTS_VERSION} ${INPUTS_CHANNEL} |
There was a problem hiding this comment.
This automated refactoring correctly moves inputs to environment variables. However, the variables are then used unquoted in the shell command. This can lead to a command injection vulnerability if the package name, version, or channel contain shell metacharacters. Please quote the variables to prevent this.
npm dist-tag add "${INPUTS_CORE_PACKAGE_NAME}@${INPUTS_VERSION}" "${INPUTS_CHANNEL}"| working-directory: '${{ inputs.working-directory }}' | ||
| run: | | ||
| npm dist-tag add ${{ inputs.cli-package-name }}@${{ inputs.version }} ${{ inputs.channel }} | ||
| npm dist-tag add ${INPUTS_CLI_PACKAGE_NAME}@${INPUTS_VERSION} ${INPUTS_CHANNEL} |
There was a problem hiding this comment.
This automated refactoring correctly moves inputs to environment variables. However, the variables are then used unquoted in the shell command. This can lead to a command injection vulnerability if the package name, version, or channel contain shell metacharacters. Please quote the variables to prevent this.
npm dist-tag add "${INPUTS_CLI_PACKAGE_NAME}@${INPUTS_VERSION}" "${INPUTS_CHANNEL}"| working-directory: '${{ inputs.working-directory }}' | ||
| run: | | ||
| npm dist-tag add ${{ inputs.a2a-package-name }}@${{ inputs.version }} ${{ inputs.channel }} | ||
| npm dist-tag add ${INPUTS_A2A_PACKAGE_NAME}@${INPUTS_VERSION} ${INPUTS_CHANNEL} |
There was a problem hiding this comment.
This automated refactoring correctly moves inputs to environment variables. However, the variables are then used unquoted in the shell command. This can lead to a command injection vulnerability if the package name, version, or channel contain shell metacharacters. Please quote the variables to prevent this.
npm dist-tag add "${INPUTS_A2A_PACKAGE_NAME}@${INPUTS_VERSION}" "${INPUTS_CHANNEL}"| run: |- | ||
| npm run build:sandbox -- \ | ||
| --image google/gemini-cli-sandbox:${{ steps.image_tag.outputs.FINAL_TAG }} \ | ||
| --image google/gemini-cli-sandbox:${STEPS_IMAGE_TAG_OUTPUTS_FINAL_TAG} \ |
There was a problem hiding this comment.
The image tag from the previous step is used here unquoted. While the expected values (Git SHA or release tag) are likely safe, it is a security best practice to always quote variables in shell commands to prevent unexpected behavior or vulnerabilities from special characters. Please add quotes around the image argument.
--image "google/gemini-cli-sandbox:${STEPS_IMAGE_TAG_OUTPUTS_FINAL_TAG}" \
|
Size Change: -2 B (0%) Total Size: 20.5 MB ℹ️ View Unchanged
|
gemini-cli
Bot
added
the
status/need-issue
4 participants
This is a http://go/LSC run by http://go/ghss to automatically refactor your Github Actions per http://b/485167538.
This is a PR to help you upgrade to the latest standards in Github Actions.
Please merge this PR to accept the changes. NOTE: if you do not accept this PR, it may be force merged by the GHSS team. See http://b/485167538 for more details.