Skip to content

Commit ff62560

Browse files
ZePan110ZePan110
authored
Fix code scan issues (opea-project#1877)
Signed-off-by: ZePan110 <ze.pan@intel.com>
1 parent 56c7c1b commit ff62560

18 files changed

+146
-41
lines changed

‎.github/workflows/_comps-workflow.yml‎

Lines changed: 18 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,8 @@
22
# SPDX-License-Identifier: Apache-2.0
33

44
name: Comps jobs
5-
# permissions: read-all
5+
6+
permissions: read-all
67
on:
78
workflow_call:
89
inputs:
@@ -113,6 +114,22 @@ jobs:
113114
####################################################################################################
114115
test-service-compose:
115116
if: ${{ fromJSON(inputs.test_compose) }}
117+
permissions:
118+
actions: read
119+
attestations: read
120+
checks: read
121+
contents: read
122+
deployments: read
123+
discussions: read
124+
id-token: write
125+
issues: read
126+
models: read
127+
packages: read
128+
pages: read
129+
pull-requests: read
130+
repository-projects: read
131+
security-events: read
132+
statuses: read
116133
uses: ./.github/workflows/_run-docker-compose.yml
117134
with:
118135
tag: ${{ inputs.tag }}

‎.github/workflows/_run-docker-compose.yml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,8 @@
22
# SPDX-License-Identifier: Apache-2.0
33

44
name: Image Build
5-
# permissions: read-all
5+
6+
permissions: read-all
67
on:
78
workflow_call:
89
inputs:

‎.github/workflows/_run-helm-chart.yml‎

Lines changed: 67 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -127,15 +127,28 @@ jobs:
127127
env:
128128
service: ${{ inputs.service }}
129129
run: |
130+
# Validate and sanitize the service input
131+
if [[ ! "$service" =~ ^[a-zA-Z0-9_/.-]+$ ]]; then
132+
echo "ERROR: Invalid service name format: $service"
133+
exit 1
134+
fi
135+
130136
service_name="${service,,}" # third_parties/bridgetower
131137
if [[ "${service,,}" == *"third_parties"* ]]; then
132-
CHART_NAME="$(echo "${service,,}"|cut -d'/' -f2)" # bridgetower
138+
CHART_NAME="$(echo "${service,,}" | cut -d'/' -f2)" # bridgetower
133139
else
134140
CHART_NAME="${service_name}" # web_retrievers
135141
fi
136142
CHART_NAME=$(echo "$CHART_NAME" | tr -cd 'a-z0-9')
137-
echo "service_name=$service_name" >> $GITHUB_ENV
138-
echo "CHART_NAME=$CHART_NAME" >> $GITHUB_ENV
143+
144+
# Validate CHART_NAME is not empty after sanitization
145+
if [[ -z "$CHART_NAME" ]]; then
146+
echo "ERROR: Chart name is empty after sanitization"
147+
exit 1
148+
fi
149+
150+
echo "service_name=${service_name}" >> $GITHUB_ENV
151+
echo "CHART_NAME=${CHART_NAME}" >> $GITHUB_ENV
139152
echo "RELEASE_NAME=${CHART_NAME}$(date +%d%H%M%S)" >> $GITHUB_ENV
140153
echo "NAMESPACE=comp-${CHART_NAME}-$(head -c 4 /dev/urandom | xxd -p)" >> $GITHUB_ENV
141154
echo "ROLLOUT_TIMEOUT_SECONDS=600s" >> $GITHUB_ENV
@@ -147,8 +160,21 @@ jobs:
147160
148161
- name: get template name
149162
run: |
150-
echo "template_link=$(grep 'helm install' comps/${service_name}/deployment/kubernetes/README.md | awk -F' ' '{print $4}' | head -n 1)"
151-
echo "template_link=$(grep 'helm install' comps/${service_name}/deployment/kubernetes/README.md | awk -F' ' '{print $4}' | head -n 1)" >> $GITHUB_ENV
163+
# Validate service_name is safe for path construction
164+
if [[ ! "$service_name" =~ ^[a-zA-Z0-9_/.-]+$ ]]; then
165+
echo "ERROR: Invalid service_name format for path construction"
166+
exit 1
167+
fi
168+
169+
readme_path="comps/${service_name}/deployment/kubernetes/README.md"
170+
if [[ -f "$readme_path" ]]; then
171+
template_link=$(grep 'helm install' "$readme_path" | awk -F' ' '{print $4}' | head -n 1)
172+
echo "template_link=${template_link}"
173+
echo "template_link=${template_link}" >> $GITHUB_ENV
174+
else
175+
echo "ERROR: README.md not found at $readme_path"
176+
exit 1
177+
fi
152178
153179
- name: Helm install
154180
id: install
@@ -160,38 +186,59 @@ jobs:
160186
value_file: ${{ matrix.value_file }}
161187
run: |
162188
set -xe
189+
190+
# Validate value_file input
191+
if [[ ! "$value_file" =~ ^[a-zA-Z0-9_.-]+\.yaml$ ]]; then
192+
echo "ERROR: Invalid value file format: $value_file"
193+
exit 1
194+
fi
195+
163196
echo "should_cleanup=true" >> $GITHUB_ENV
164-
if [[ ! -f ${{ github.workspace }}/${{ env.CHART_FOLDER }}/${value_file} ]]; then
165-
echo "No value file found, exiting test!"
197+
value_file_path="${{ github.workspace }}/${{ env.CHART_FOLDER }}/${value_file}"
198+
if [[ ! -f "$value_file_path" ]]; then
199+
echo "No value file found at: $value_file_path"
166200
echo "skip_validate=true" >> $GITHUB_ENV
167201
echo "should_cleanup=false" >> $GITHUB_ENV
168202
exit 0
169203
fi
170204
171-
for img in `helm template -n $NAMESPACE $RELEASE_NAME ${template_link} -f comps/${{ inputs.service }}/deployment/kubernetes/${value_file} --version ${{ inputs.version }} | grep 'image:' | grep 'opea/' | awk '{print $2}' | xargs`;
172-
do
205+
# Validate inputs.service for path construction
206+
service_input="${{ inputs.service }}"
207+
if [[ ! "$service_input" =~ ^[a-zA-Z0-9_/.-]+$ ]]; then
208+
echo "ERROR: Invalid service input format"
209+
exit 1
210+
fi
211+
212+
helm_values_path="comps/${service_input}/deployment/kubernetes/${value_file}"
213+
if [[ ! -f "$helm_values_path" ]]; then
214+
echo "ERROR: Helm values file not found at: $helm_values_path"
215+
exit 1
216+
fi
217+
218+
for img in $(helm template -n "$NAMESPACE" "$RELEASE_NAME" "${template_link}" -f "$helm_values_path" --version "${{ inputs.version }}" | grep 'image:' | grep 'opea/' | awk '{print $2}'); do
173219
# increase helm install wait for for vllm-gaudi case
174-
if [[ $img == *"vllm-gaudi"* ]]; then
220+
if [[ "$img" == *"vllm-gaudi"* ]]; then
175221
ROLLOUT_TIMEOUT_SECONDS=900s
176222
fi
177223
done
224+
178225
# oci://ghcr.io/opea-project/charts/${CHART_NAME} \
179-
if ! helm install --create-namespace --namespace $NAMESPACE $RELEASE_NAME \
180-
${template_link} \
181-
--set global.HUGGINGFACEHUB_API_TOKEN=${HFTOKEN} \
182-
--set global.modelUseHostPath=/data2/hf_model \
183-
--set GOOGLE_API_KEY=${{ env.GOOGLE_API_KEY}} \
184-
--set GOOGLE_CSE_ID=${{ env.GOOGLE_CSE_ID}} \
185-
-f comps/${{ inputs.service }}/deployment/kubernetes/${value_file} \
186-
--version ${{ inputs.version }} \
226+
if ! helm install --create-namespace --namespace "$NAMESPACE" "$RELEASE_NAME" \
227+
"${template_link}" \
228+
--set "global.HUGGINGFACEHUB_API_TOKEN=${HFTOKEN}" \
229+
--set "global.modelUseHostPath=/data2/hf_model" \
230+
--set "GOOGLE_API_KEY=${{ env.GOOGLE_API_KEY}}" \
231+
--set "GOOGLE_CSE_ID=${{ env.GOOGLE_CSE_ID}}" \
232+
-f "$helm_values_path" \
233+
--version "${{ inputs.version }}" \
187234
--wait --timeout "$ROLLOUT_TIMEOUT_SECONDS"; then
188235
echo "Failed to install chart ${{ inputs.service }}"
189236
echo "skip_validate=true" >> $GITHUB_ENV
190-
.github/workflows/scripts/k8s-utils.sh dump_pods_status $NAMESPACE
237+
.github/workflows/scripts/k8s-utils.sh dump_pods_status "$NAMESPACE"
191238
exit 1
192239
fi
193240
helm list -A
194-
kubectl get pods -n $NAMESPACE
241+
kubectl get pods -n "$NAMESPACE"
195242
196243
- name: Validate e2e test
197244
if: always()

‎.github/workflows/daily-update-vllm-version.yml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,8 @@
33

44
name: Daily update vLLM & vLLM-fork version
55

6+
permissions: read-all
7+
68
on:
79
schedule:
810
- cron: "30 22 * * *"
@@ -27,7 +29,6 @@ jobs:
2729
ver_name: VLLM_FORK_VER
2830
fail-fast: false
2931
permissions:
30-
contents: write
3132
pull-requests: write
3233
steps:
3334
- name: Checkout repository

‎.github/workflows/daily_check_issue_and_pr.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33

44
name: Check stale issue and pr
55

6+
permissions: read-all
67
on:
78
schedule:
89
- cron: "30 22 * * *"

‎.github/workflows/manual-comps-test.yml‎

Lines changed: 18 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,8 @@
22
# SPDX-License-Identifier: Apache-2.0
33

44
name: Comps CD workflow on manual event
5+
6+
permissions: read-all
57
on:
68
workflow_dispatch:
79
inputs:
@@ -46,8 +48,6 @@ on:
4648
required: false
4749
type: boolean
4850

49-
# permissions: read-all
50-
5151
jobs:
5252
get-test-matrix:
5353
runs-on: ubuntu-latest
@@ -67,6 +67,22 @@ jobs:
6767
6868
run-services:
6969
needs: [get-test-matrix]
70+
permissions:
71+
actions: read
72+
attestations: read
73+
checks: read
74+
contents: read
75+
deployments: read
76+
discussions: read
77+
id-token: write
78+
issues: read
79+
packages: read
80+
pages: read
81+
pull-requests: read
82+
repository-projects: read
83+
security-events: read
84+
statuses: read
85+
models: read
7086
strategy:
7187
matrix:
7288
service: ${{ fromJson(needs.get-test-matrix.outputs.services) }}

‎.github/workflows/manual-freeze-images.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33

44
name: Freeze base images and 3rd part images on manual event
55

6+
permissions: read-all
67
on:
78
workflow_dispatch:
89

‎.github/workflows/manual-freeze-requirements.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33

44
name: Freeze-requirements
55

6+
permissions: read-all
67
on:
78
workflow_dispatch:
89

‎.github/workflows/mix-code-scan.yml‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,8 @@
33

44
name: Code Scan
55

6+
permissions: read-all
7+
68
on:
79
pull_request:
810
branches: [main]
@@ -68,7 +70,6 @@ jobs:
6870
shell-check:
6971
runs-on: ubuntu-latest
7072
permissions:
71-
security-events: write
7273
actions: read
7374
contents: read
7475
steps:
@@ -79,12 +80,15 @@ jobs:
7980

8081
- name: Get changed shell files
8182
id: get-changed-files
83+
env:
84+
PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
85+
GITHUB_SHA: ${{ github.sha }}
8286
run: |
83-
base_commit="${{ github.event.pull_request.base.sha }}"
84-
merged_commit="${{ github.sha }}"
87+
base_commit="$PR_BASE_SHA"
88+
merged_commit="$GITHUB_SHA"
8589
echo "base_commit=${base_commit}" >> $GITHUB_ENV
8690
echo "merged_commit=${merged_commit}" >> $GITHUB_ENV
87-
changed_files="$(git diff --name-only --diff-filter=AM ${base_commit} ${merged_commit} | grep -E '\.sh$' | tr '\n' ' ')" || true
91+
changed_files="$(git diff --name-only --diff-filter=AM "${base_commit}" "${merged_commit}" | grep -E '\.sh$' | tr '\n' ' ')" || true
8892
echo "changed_files=${changed_files}"
8993
echo "changed_files=${changed_files}" >> $GITHUB_ENV
9094

‎.github/workflows/mix-trellix.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33

44
name: Trellix Command Line Scanner
55

6+
permissions: read-all
67
on:
78
workflow_dispatch:
89
schedule:

0 commit comments

Comments
 (0)