@@ -25,6 +25,8 @@ permissions: {}
2525jobs :
2626 create-prs :
2727 runs-on : ubuntu-latest
28+ permissions :
29+ contents : read
2830 strategy :
2931 fail-fast : ${{ inputs.fail-fast }}
3032 matrix :
4850 - trino-operator
4951 - zookeeper-operator
5052 steps :
51- - uses : actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5 .0.0
53+ - uses : actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 .0.0
5254 with :
5355 persist-credentials : false
5456 - uses : cachix/install-nix-action@fd24c48048070c1be9acd18c9d369a83f0fe94d7 # v31.8.1
@@ -76,33 +78,35 @@ jobs:
7678name : Install jinja2
7779 run : pip install -r requirements.txt
7880
79- # Create commit message depending on whether this is run manually or due to a scheduled run
80- - name : Set commit message for manual dispatch
81- if : ${{ github.event_name == 'workflow_dispatch' }}
82- env :
83- REASON : ${{ github.event.inputs.message }}
84- AUTHOR : ${{ github.event.sender.login }}
85- run : |
86- echo "AUTHOR=$AUTHOR" >> "$GITHUB_ENV"
87- echo "REASON=$REASON" >> "$GITHUB_ENV"
88- name : Set commit message for schedule
89- if : ${{ github.event_name == 'schedule' }}
90- run : |
91- echo "AUTHOR=stackabletech/developers"
92- echo "REASON=Daily run triggered" >> "$GITHUB_ENV"
93-
81+ # Create commit message and run the playbook
9482 - name : Run playbook
9583 env :
9684 CUSTOM_PR_TITLE : ${{ inputs.custom-pr-title }}
9785 GH_ACCESS_TOKEN : ${{ secrets.gh_access_token }}
9886 REPOSITORY : ${{ matrix.repository }}
99- # tags local excludes all actions that actually generate PRs
100- DRY_RUN_FLAGS : ${{ inputs.dry-run && '--tags=local' || '' }}
101- # shellsheck disable=SC2086
87+ DRY_RUN_FLAGS : ${{ (github.event_name != 'schedule' && inputs.dry-run != false) && '--tags=local' || '' }}
88+ # Safely pass inputs/context via environment variables to prevent injection
89+ INPUT_MESSAGE : ${{ github.event.inputs.message }}
90+ SENDER_LOGIN : ${{ github.event.sender.login }}
91+ EVENT_NAME : ${{ github.event_name }}
10292 run : |
103- echo '{}' | jq '{commit_hash: $ENV.GITHUB_SHA, author: $ENV.AUTHOR, reason: $ENV.REASON, custom_pr_title: $ENV.CUSTOM_PR_TITLE, base_dir: $pwd, gh_access_token: $ENV.GH_ACCESS_TOKEN, shard_repositories: [$ENV.REPOSITORY]} | with_entries(select(.value != null and .value != ""))' --arg pwd "$(pwd)" > vars.json
104- # $DRY_RUN_FLAGS is intentionally not quoted, since we need to avoid
105- # passing an argument if we're not in dry mode.
106- # This is safe, since it always has one of two hard-coded values.
107- # shellcheck disable=SC2086
93+ if [ "$EVENT_NAME" = "schedule" ]; then
94+ AUTHOR="stackabletech/developers"
95+ REASON="Weekly run triggered"
96+ else
97+ AUTHOR="$SENDER_LOGIN"
98+ REASON="$INPUT_MESSAGE"
99+ fi
100+
101+ # Encode parameters safely using jq, without serializing the GH_ACCESS_TOKEN
102+ jq -n \
103+ --arg commit_hash "$GITHUB_SHA" \
104+ --arg author "$AUTHOR" \
105+ --arg reason "$REASON" \
106+ --arg custom_pr_title "$CUSTOM_PR_TITLE" \
107+ --arg base_dir "$(pwd)" \
108+ --arg repository "$REPOSITORY" \
109+ '{commit_hash: $commit_hash, author: $author, reason: $reason, custom_pr_title: $custom_pr_title, base_dir: $base_dir, shard_repositories: [$repository]} | with_entries(select(.value != null and .value != ""))' > vars.json
110+
111+ # Run the Ansible playbook. The token is read directly from the GH_ACCESS_TOKEN environment variable.
108112 ansible-playbook playbook/playbook.yaml --extra-vars "@vars.json" $DRY_RUN_FLAGS
0 commit comments