Skip to content

Commit 60d174f

Browse files
thpiercethpierce
committed
fix: prevent script injection in workflows
Move github.event references to env vars to prevent script injection vulnerabilities in workflow run steps. This follows the same pattern as the main branch fix in commit 371c614.
1 parent 1c9e128 commit 60d174f

File tree

5 files changed

+45
-37
lines changed

5 files changed

+45
-37
lines changed

‎.github/workflows/post-release-version-bump.yml‎

Lines changed: 10 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,8 @@ on:
1212
default: 'false'
1313

1414
env:
15+
VERSION_INPUT: ${{ env.VERSION_INPUT }}
16+
IS_PATCH_INPUT: ${{ env.IS_PATCH_INPUT }}
1517
AWS_DEFAULT_REGION: us-east-1
1618

1719
permissions:
@@ -31,8 +33,8 @@ jobs:
3133

3234
- name: Extract Major.Minor Version and setup Env variable
3335
run: |
34-
echo "VERSION=${{ github.event.inputs.version }}" >> $GITHUB_ENV
35-
echo "MAJOR_MINOR=$(echo ${{ github.event.inputs.version }} | sed -E 's/([0-9]+\.[0-9]+)\.[0-9]+/\1/')" >> $GITHUB_ENV
36+
echo "VERSION=${{ env.VERSION_INPUT }}" >> $GITHUB_ENV
37+
echo "MAJOR_MINOR=$(echo ${{ env.VERSION_INPUT }} | sed -E 's/([0-9]+\.[0-9]+)\.[0-9]+/\1/')" >> $GITHUB_ENV
3638
3739
- name: Get current major.minor version from main branch
3840
id: get_version
@@ -88,8 +90,8 @@ jobs:
8890
8991
- name: Extract Major.Minor Version and setup Env variable
9092
run: |
91-
echo "VERSION=${{ github.event.inputs.version }}" >> $GITHUB_ENV
92-
echo "MAJOR_MINOR=$(echo ${{ github.event.inputs.version }} | sed -E 's/([0-9]+\.[0-9]+)\.[0-9]+/\1/')" >> $GITHUB_ENV
93+
echo "VERSION=${{ env.VERSION_INPUT }}" >> $GITHUB_ENV
94+
echo "MAJOR_MINOR=$(echo ${{ env.VERSION_INPUT }} | sed -E 's/([0-9]+\.[0-9]+)\.[0-9]+/\1/')" >> $GITHUB_ENV
9395
9496
- name: Determine release branch and checkout
9597
run: |
@@ -99,14 +101,14 @@ jobs:
99101
100102
- name: Update version to next development version in main
101103
run: |
102-
DEV_VERSION="${{ github.event.inputs.version }}.dev0"
104+
DEV_VERSION="${{ env.VERSION_INPUT }}.dev0"
103105
sed -i "s/public static string version = \".*\";/public static string version = \"${DEV_VERSION}\";/" src/AWS.Distro.OpenTelemetry.AutoInstrumentation/Version.cs
104106
sed -i "s/private readonly string version = \".*\";/private readonly string version = \"${DEV_VERSION}\";/" build/Build.InstallationScripts.cs
105-
VERSION="${{ github.event.inputs.version }}"
107+
VERSION="${{ env.VERSION_INPUT }}"
106108
sed -i -e 's/dotnet:v.*"/dotnet:v'$VERSION'"/' .github/workflows/daily-scan.yml
107109
108110
# for patch releases, avoid merge conflict by manually resolving CHANGELOG with main
109-
if [[ "${{ github.event.inputs.is_patch }}" == "true" ]]; then
111+
if [[ "${{ env.IS_PATCH_INPUT }}" == "true" ]]; then
110112
# Copy the patch release entries
111113
sed -n "/^## v${VERSION}/,/^## v[0-9]/p" CHANGELOG.md | sed '$d' > /tmp/patch_release_section.txt
112114
git fetch origin main
@@ -126,7 +128,7 @@ jobs:
126128
env:
127129
GITHUB_TOKEN: ${{ env.BOT_TOKEN_GITHUB_RW_PATOKEN }}
128130
run: |
129-
DEV_VERSION="${{ github.event.inputs.version }}.dev0"
131+
DEV_VERSION="${{ env.VERSION_INPUT }}.dev0"
130132
gh pr create --title "Post release $VERSION: Update version to $DEV_VERSION" \
131133
--body "This PR prepares the main branch for the next development cycle by updating the version to $DEV_VERSION and updating the image version to be scanned to the latest released.
132134

‎.github/workflows/pre-release-prepare.yml‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,8 @@ on:
1313
default: 'false'
1414

1515
env:
16+
VERSION_INPUT: ${{ env.VERSION_INPUT }}
17+
IS_PATCH_INPUT: ${{ env.IS_PATCH_INPUT }}
1618
AWS_DEFAULT_REGION: us-east-1
1719

1820
permissions:
@@ -52,12 +54,12 @@ jobs:
5254
5355
- name: Extract Major.Minor Version and setup Env variable
5456
run: |
55-
echo "VERSION=${{ github.event.inputs.version }}" >> $GITHUB_ENV
56-
echo "MAJOR_MINOR=$(echo ${{ github.event.inputs.version }} | sed -E 's/([0-9]+\.[0-9]+)\.[0-9]+/\1/')" >> $GITHUB_ENV
57+
echo "VERSION=${{ env.VERSION_INPUT }}" >> $GITHUB_ENV
58+
echo "MAJOR_MINOR=$(echo ${{ env.VERSION_INPUT }} | sed -E 's/([0-9]+\.[0-9]+)\.[0-9]+/\1/')" >> $GITHUB_ENV
5759
5860
- name: Create branches
5961
run: |
60-
IS_PATCH=${{ github.event.inputs.is_patch }}
62+
IS_PATCH=${{ env.IS_PATCH_INPUT }}
6163
if [[ "$IS_PATCH" != "true" && "$IS_PATCH" != "false" ]]; then
6264
echo "Invalid input for IS_PATCH. Must be 'true' or 'false'."
6365
exit 1
@@ -110,5 +112,5 @@ jobs:
110112
--body "This PR updates the version to ${VERSION}.
111113
112114
By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice." \
113-
--head v${{ github.event.inputs.version }}_release \
115+
--head v${{ env.VERSION_INPUT }}_release \
114116
--base release/v${MAJOR_MINOR}.x

‎.github/workflows/release-build.yml‎

Lines changed: 15 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,8 @@ on:
1111
default: 'us-east-1, us-east-2, us-west-1, us-west-2, ap-south-1, ap-northeast-3, ap-northeast-2, ap-southeast-1, ap-southeast-2, ap-northeast-1, ca-central-1, eu-central-1, eu-west-1, eu-west-2, eu-west-3, eu-north-1, sa-east-1, af-south-1, ap-east-1, ap-south-2, ap-southeast-3, ap-southeast-4, eu-central-2, eu-south-1, eu-south-2, il-central-1, me-central-1, me-south-1, ap-southeast-5, ap-southeast-7, mx-central-1, ca-west-1, cn-north-1, cn-northwest-1'
1212

1313
env:
14+
VERSION_INPUT: ${{ env.VERSION_INPUT }}
15+
AWS_REGION_INPUT: ${{ env.AWS_REGION_INPUT }}
1416
AWS_DEFAULT_REGION: us-east-1
1517
AWS_PUBLIC_ECR_REGION: us-east-1
1618
AWS_PRIVATE_ECR_REGION: us-west-2
@@ -77,7 +79,7 @@ jobs:
7779
7880
- name: Pack nugets
7981
env:
80-
VERSION: ${{ github.event.inputs.version }}
82+
VERSION: ${{ env.VERSION_INPUT }}
8183
run: >
8284
dotnet pack
8385
.\src\AWS.Distro.OpenTelemetry.AutoInstrumentation
@@ -155,18 +157,18 @@ jobs:
155157
if: runner.os == 'Linux'
156158
uses: ./.github/actions/build-and-scan-image
157159
with:
158-
image-name: ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ github.event.inputs.version }}
160+
image-name: ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ env.VERSION_INPUT }}
159161

160162
- name: Build and scan Windows image
161163
if: runner.os == 'Windows'
162164
uses: ./.github/actions/build-and-scan-image
163165
with:
164-
image-name: ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ github.event.inputs.version }}-windows2022
166+
image-name: ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ env.VERSION_INPUT }}-windows2022
165167

166168
- name: Push Linux x64 Image
167169
if: runner.os == 'Linux'
168170
env:
169-
VERSION: ${{ github.event.inputs.version }}
171+
VERSION: ${{ env.VERSION_INPUT }}
170172
run: |
171173
set -e
172174
docker push ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v$VERSION-amd64
@@ -176,7 +178,7 @@ jobs:
176178
- name: Push Linux arm64 Image
177179
if: runner.os == 'Linux'
178180
env:
179-
VERSION: ${{ github.event.inputs.version }}
181+
VERSION: ${{ env.VERSION_INPUT }}
180182
run: |
181183
set -e
182184
docker push ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v$VERSION-arm64
@@ -186,7 +188,7 @@ jobs:
186188
- name: Push Windows Images
187189
if: runner.os == 'Windows'
188190
env:
189-
VERSION: ${{ github.event.inputs.version }}
191+
VERSION: ${{ env.VERSION_INPUT }}
190192
run: |
191193
$osInfo = systeminfo | Select-String "OS Version"
192194
if ($osInfo -match "10.0.20348") {
@@ -228,15 +230,15 @@ jobs:
228230

229231
- name: Create multi-platform image and push to Amazon private ECR
230232
env:
231-
VERSION: ${{ github.event.inputs.version }}
233+
VERSION: ${{ env.VERSION_INPUT }}
232234
run: |
233235
docker manifest create ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v$VERSION ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v$VERSION-amd64 ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v$VERSION-arm64 ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v$VERSION-windows2022
234236
docker manifest inspect ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v$VERSION
235237
docker manifest push ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v$VERSION
236238
237239
- name: Create multi-platform image and push to Amazon public ECR
238240
env:
239-
VERSION: ${{ github.event.inputs.version }}
241+
VERSION: ${{ env.VERSION_INPUT }}
240242
run: |
241243
docker manifest create ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v$VERSION ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v$VERSION-amd64 ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v$VERSION-arm64 ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v$VERSION-windows2022
242244
docker manifest inspect ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v$VERSION
@@ -251,7 +253,7 @@ jobs:
251253
- name: Set up regions matrix
252254
id: set-matrix
253255
env:
254-
AWS_REGIONS: ${{ github.event.inputs.aws_region }}
256+
AWS_REGIONS: ${{ env.AWS_REGION_INPUT }}
255257
run: |
256258
IFS=',' read -ra REGIONS <<< "$AWS_REGIONS"
257259
MATRIX="["
@@ -307,7 +309,7 @@ jobs:
307309
name: aws-distro-opentelemetry-dotnet-instrumentation-linux-glibc-x64.zip
308310
- name: publish
309311
env:
310-
VERSION: ${{ github.event.inputs.version }}
312+
VERSION: ${{ env.VERSION_INPUT }}
311313
run: |
312314
aws s3 mb s3://${{ env.BUCKET_NAME }}
313315
aws s3 cp aws-distro-opentelemetry-dotnet-instrumentation-linux-glibc-x64.zip s3://${{ env.BUCKET_NAME }}
@@ -476,7 +478,7 @@ jobs:
476478

477479
- name: Upload to Private S3 Bucket
478480
env:
479-
VERSION: ${{ github.event.inputs.version }}
481+
VERSION: ${{ env.VERSION_INPUT }}
480482
run: |
481483
PREFIX="Release_v$VERSION"
482484
@@ -492,7 +494,7 @@ jobs:
492494
id: create_release
493495
env:
494496
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # This token is provided by Actions, you do not need to create your own token
495-
VERSION: ${{ github.event.inputs.version }}
497+
VERSION: ${{ env.VERSION_INPUT }}
496498
run: |
497499
# Extract version from Build.cs
498500
OTEL_INSTRUMENTATION_VERSION=$(grep "OpenTelemetryAutoInstrumentationDefaultVersion = " build/Build.cs | sed 's/.*= "\(.*\)";/\1/' | sed 's/^v//')
@@ -544,7 +546,7 @@ jobs:
544546
- name: Upload artifacts and checksum to release
545547
env:
546548
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
547-
VERSION: ${{ github.event.inputs.version }}
549+
VERSION: ${{ env.VERSION_INPUT }}
548550
run: |
549551
find ./artifacts/ -name "*.zip" | while read file; do
550552
base=$(basename "$file")

‎.github/workflows/release-udp-exporter.yml‎

Lines changed: 12 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ permissions:
1313
contents: write
1414

1515
env:
16+
VERSION_INPUT: ${{ env.VERSION_INPUT }}
1617
AWS_SIGNING_KEY_REGION: us-west-2
1718

1819
jobs:
@@ -62,7 +63,7 @@ jobs:
6263
run: >
6364
dotnet pack
6465
.\exporters\AWS.Distro.OpenTelemetry.Exporter.Xray.Udp
65-
/p:Version=${{github.event.inputs.version}}
66+
/p:Version=${{ env.VERSION_INPUT }}
6667
--no-build
6768
-c Release
6869
-o .\Deployment\nuget-packages
@@ -95,18 +96,18 @@ jobs:
9596
- name: Create Release Notes
9697
run: |
9798
@"
98-
# AWS Distro for OpenTelemetry X-Ray UDP Exporter v${{ github.event.inputs.version }}
99+
# AWS Distro for OpenTelemetry X-Ray UDP Exporter v${{ env.VERSION_INPUT }}
99100
100101
## Overview
101102
This release contains the AWS Distro for OpenTelemetry X-Ray UDP Exporter for .NET.
102103
103104
## Package Information
104105
- Package Name: AWS.Distro.OpenTelemetry.Exporter.Xray.Udp
105-
- Version: ${{ github.event.inputs.version }}
106+
- Version: ${{ env.VERSION_INPUT }}
106107
107108
## NuGet Package
108109
The package is available on NuGet.org:
109-
https://www.nuget.org/packages/AWS.Distro.OpenTelemetry.Exporter.Xray.Udp/${{ github.event.inputs.version }}
110+
https://www.nuget.org/packages/AWS.Distro.OpenTelemetry.Exporter.Xray.Udp/${{ env.VERSION_INPUT }}
110111
111112
## Release Notes
112113
- This exporter allows you to send OpenTelemetry traces to the AWS X-Ray daemon over UDP
@@ -116,25 +117,25 @@ jobs:
116117
run: |
117118
New-Item -Path .\Deployment\release-assets -ItemType Directory -Force
118119
Copy-Item -Path .\Deployment\nuget-packages\* -Destination .\Deployment\release-assets\
119-
Compress-Archive -Path .\Deployment\release-assets\* -DestinationPath .\udp-exporter-${{ github.event.inputs.version }}.zip
120+
Compress-Archive -Path .\Deployment\release-assets\* -DestinationPath .\udp-exporter-${{ env.VERSION_INPUT }}.zip
120121
121122
- name: Create SHA256 hash for release package
122123
run: |
123124
# Create SHA256 hash file
124-
$hash = Get-FileHash -Path .\udp-exporter-${{ github.event.inputs.version }}.zip -Algorithm SHA256
125-
$hash.Hash | Out-File -FilePath .\udp-exporter-${{ github.event.inputs.version }}.zip.sha256 -Encoding utf8
125+
$hash = Get-FileHash -Path .\udp-exporter-${{ env.VERSION_INPUT }}.zip -Algorithm SHA256
126+
$hash.Hash | Out-File -FilePath .\udp-exporter-${{ env.VERSION_INPUT }}.zip.sha256 -Encoding utf8
126127
127128
- name: Create GH release (draft)
128129
env:
129130
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
130131
run: |
131132
gh release create `
132133
--target "$env:GITHUB_REF_NAME" `
133-
--title "Release ADOT X-Ray UDP Exporter v${{ github.event.inputs.version }}" `
134+
--title "Release ADOT X-Ray UDP Exporter v${{ env.VERSION_INPUT }}" `
134135
--notes-file release_notes.md `
135136
--draft `
136-
"Exporter.Xray.Udp-${{ github.event.inputs.version }}" `
137-
.\udp-exporter-${{ github.event.inputs.version }}.zip
138-
.\udp-exporter-${{ github.event.inputs.version }}.zip.sha256
137+
"Exporter.Xray.Udp-${{ env.VERSION_INPUT }}" `
138+
.\udp-exporter-${{ env.VERSION_INPUT }}.zip
139+
.\udp-exporter-${{ env.VERSION_INPUT }}.zip.sha256
139140
140141
Remove-Item -Path release_notes.md -Force

‎.github/workflows/unlist-nuget.yml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ on:
77
required: true
88

99
env:
10+
VERSION_INPUT: ${{ env.VERSION_INPUT }}
1011
AWS_SIGNING_KEY_REGION: us-west-2
1112

1213
permissions:
@@ -35,6 +36,6 @@ jobs:
3536
--output text
3637
--query SecretString | ConvertFrom-Json
3738
38-
nuget delete AWS.Distro.OpenTelemetry.AutoInstrumentation ${{github.event.inputs.version}}
39+
nuget delete AWS.Distro.OpenTelemetry.AutoInstrumentation ${{ env.VERSION_INPUT }}
3940
-Source https://api.nuget.org/v3/index.json
4041
-ApiKey $nugetKey.Key

0 commit comments

Comments
 (0)