Skip to content

Commit 72c7195

Browse files
thpiercethpierce
committed
fix: prevent script injection in workflows
Move github.event references to env vars to prevent script injection vulnerabilities in workflow run steps
1 parent 561d028 commit 72c7195

File tree

3 files changed

+39
-35
lines changed

3 files changed

+39
-35
lines changed

‎.github/workflows/post_release_version_bump.yml‎

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ on:
88
required: true
99

1010
env:
11+
VERSION_INPUT: ${{ env.VERSION_INPUT }}
1112
AWS_DEFAULT_REGION: us-east-1
1213

1314
permissions:
@@ -27,8 +28,8 @@ jobs:
2728

2829
- name: Extract Major.Minor Version and setup Env variable
2930
run: |
30-
echo "VERSION=${{ github.event.inputs.version }}" >> $GITHUB_ENV
31-
echo "MAJOR_MINOR=$(echo ${{ github.event.inputs.version }} | sed -E 's/([0-9]+\.[0-9]+)\.[0-9]+/\1/')" >> $GITHUB_ENV
31+
echo "VERSION=${{ env.VERSION_INPUT }}" >> $GITHUB_ENV
32+
echo "MAJOR_MINOR=$(echo ${{ env.VERSION_INPUT }} | sed -E 's/([0-9]+\.[0-9]+)\.[0-9]+/\1/')" >> $GITHUB_ENV
3233
3334
- name: Get current major.minor version from main branch
3435
id: get_version
@@ -84,8 +85,8 @@ jobs:
8485
8586
- name: Extract Major.Minor Version and setup Env variable
8687
run: |
87-
echo "VERSION=${{ github.event.inputs.version }}" >> $GITHUB_ENV
88-
echo "MAJOR_MINOR=$(echo ${{ github.event.inputs.version }} | sed -E 's/([0-9]+\.[0-9]+)\.[0-9]+/\1/')" >> $GITHUB_ENV
88+
echo "VERSION=${{ env.VERSION_INPUT }}" >> $GITHUB_ENV
89+
echo "MAJOR_MINOR=$(echo ${{ env.VERSION_INPUT }} | sed -E 's/([0-9]+\.[0-9]+)\.[0-9]+/\1/')" >> $GITHUB_ENV
8990
9091
- name: Determine release branch and checkout
9192
run: |
@@ -96,9 +97,9 @@ jobs:
9697
- name: Update version to next development version in main
9798
# TODO update version in daily_scan.yml
9899
run: |
99-
DEV_VERSION="${{ github.event.inputs.version }}.dev0"
100+
DEV_VERSION="${{ env.VERSION_INPUT }}.dev0"
100101
sed -i "s/public static string version = \".*\";/public static string version = \"${DEV_VERSION}\";/" src/AWS.Distro.OpenTelemetry.AutoInstrumentation/Version.cs
101-
VERSION="${{ github.event.inputs.version }}"
102+
VERSION="${{ env.VERSION_INPUT }}"
102103
git add src/AWS.Distro.OpenTelemetry.AutoInstrumentation/Version.cs
103104
git commit -m "Prepare main for next development cycle: Update version to $DEV_VERSION"
104105
git push --set-upstream origin "prepare-main-for-next-dev-cycle-${VERSION}"
@@ -107,7 +108,7 @@ jobs:
107108
env:
108109
GITHUB_TOKEN: ${{ env.BOT_TOKEN_GITHUB_RW_PATOKEN }}
109110
run: |
110-
DEV_VERSION="${{ github.event.inputs.version }}.dev0"
111+
DEV_VERSION="${{ env.VERSION_INPUT }}.dev0"
111112
gh pr create --title "Post release $VERSION: Update version to $DEV_VERSION" \
112113
--body "This PR prepares the main branch for the next development cycle by updating the version to $DEV_VERSION and updating the image version to be scanned to the latest released.
113114

‎.github/workflows/pre_release_prepare.yml‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,8 @@ on:
1313
default: 'false'
1414

1515
env:
16+
VERSION_INPUT: ${{ env.VERSION_INPUT }}
17+
IS_PATCH_INPUT: ${{ env.IS_PATCH_INPUT }}
1618
AWS_DEFAULT_REGION: us-east-1
1719

1820
permissions:
@@ -52,12 +54,12 @@ jobs:
5254
5355
- name: Extract Major.Minor Version and setup Env variable
5456
run: |
55-
echo "VERSION=${{ github.event.inputs.version }}" >> $GITHUB_ENV
56-
echo "MAJOR_MINOR=$(echo ${{ github.event.inputs.version }} | sed -E 's/([0-9]+\.[0-9]+)\.[0-9]+/\1/')" >> $GITHUB_ENV
57+
echo "VERSION=${{ env.VERSION_INPUT }}" >> $GITHUB_ENV
58+
echo "MAJOR_MINOR=$(echo ${{ env.VERSION_INPUT }} | sed -E 's/([0-9]+\.[0-9]+)\.[0-9]+/\1/')" >> $GITHUB_ENV
5759
5860
- name: Create branches
5961
run: |
60-
IS_PATCH=${{ github.event.inputs.is_patch }}
62+
IS_PATCH=${{ env.IS_PATCH_INPUT }}
6163
if [[ "$IS_PATCH" != "true" && "$IS_PATCH" != "false" ]]; then
6264
echo "Invalid input for IS_PATCH. Must be 'true' or 'false'."
6365
exit 1
@@ -102,5 +104,5 @@ jobs:
102104
--body "This PR updates the version to ${VERSION}.
103105
104106
By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice." \
105-
--head v${{ github.event.inputs.version }}_release \
107+
--head v${{ env.VERSION_INPUT }}_release \
106108
--base release/v${MAJOR_MINOR}.x

‎.github/workflows/release_build.yml‎

Lines changed: 25 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ on:
77
required: true
88

99
env:
10+
VERSION_INPUT: ${{ env.VERSION_INPUT }}
1011
AWS_DEFAULT_REGION: us-east-1
1112
AWS_PUBLIC_ECR_REGION: us-east-1
1213
AWS_PRIVATE_ECR_REGION: us-west-2
@@ -64,7 +65,7 @@ jobs:
6465

6566
- name: Upload to Private S3 Bucket
6667
run: |
67-
PREFIX="Release_v${{github.event.inputs.version}}"
68+
PREFIX="Release_v${{ env.VERSION_INPUT }}"
6869
6970
find ./artifacts/ -name "*.zip" | while read file; do
7071
base=$(basename "$file")
@@ -78,20 +79,20 @@ jobs:
7879
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # This token is provided by Actions, you do not need to create your own token
7980
run: |
8081
gh release create --target "$GITHUB_REF_NAME" \
81-
--title "Release v${{ github.event.inputs.version }}" \
82-
"v${{ github.event.inputs.version }}" \
83-
--notes "Release Verions v${{ github.event.inputs.version }}"
82+
--title "Release v${{ env.VERSION_INPUT }}" \
83+
"v${{ env.VERSION_INPUT }}" \
84+
--notes "Release Verions v${{ env.VERSION_INPUT }}"
8485
8586
- name: Upload artifacts to release
8687
env:
8788
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
8889
run: |
89-
PREFIX="Release_v${{github.event.inputs.version}}_"
90+
PREFIX="Release_v${{ env.VERSION_INPUT }}_"
9091
9192
find ./artifacts/ -name "*.zip" | while read file; do
9293
base=$(basename "$file")
9394
cp "$file" "$base"
94-
gh release upload "v${{ github.event.inputs.version }}" \
95+
gh release upload "v${{ env.VERSION_INPUT }}" \
9596
$base \
9697
--clobber
9798
done
@@ -176,27 +177,27 @@ jobs:
176177
if: runner.os == 'Linux'
177178
run: |
178179
set -e
179-
docker build -t ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ github.event.inputs.version }}-amd64 -f ./Dockerfile.linux .
180-
docker push ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ github.event.inputs.version }}-amd64
181-
docker tag ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ github.event.inputs.version }}-amd64 ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ github.event.inputs.version }}-amd64
182-
docker push ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ github.event.inputs.version }}-amd64
180+
docker build -t ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ env.VERSION_INPUT }}-amd64 -f ./Dockerfile.linux .
181+
docker push ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ env.VERSION_INPUT }}-amd64
182+
docker tag ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ env.VERSION_INPUT }}-amd64 ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ env.VERSION_INPUT }}-amd64
183+
docker push ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ env.VERSION_INPUT }}-amd64
183184
184185
- name: Build Windows container
185186
if: runner.os == 'Windows'
186187
run: |
187188
$osInfo = systeminfo | Select-String "OS Version"
188189
if ($osInfo -match "10.0.17763") {
189190
Echo "Build image for Windows Server 2019"
190-
docker build -t ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ github.event.inputs.version }}-windows2019 -f ./Dockerfile.windows2019 .
191-
docker push ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ github.event.inputs.version }}-windows2019
192-
docker tag ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ github.event.inputs.version }}-windows2019 ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ github.event.inputs.version }}-windows2019
193-
docker push ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ github.event.inputs.version }}-windows2019
191+
docker build -t ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ env.VERSION_INPUT }}-windows2019 -f ./Dockerfile.windows2019 .
192+
docker push ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ env.VERSION_INPUT }}-windows2019
193+
docker tag ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ env.VERSION_INPUT }}-windows2019 ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ env.VERSION_INPUT }}-windows2019
194+
docker push ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ env.VERSION_INPUT }}-windows2019
194195
} elseif ($osInfo -match "10.0.20348") {
195196
Echo "Build image for Windows Server 2022"
196-
docker build -t ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ github.event.inputs.version }}-windows2022 -f ./Dockerfile.windows2022 .
197-
docker push ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ github.event.inputs.version }}-windows2022
198-
docker tag ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ github.event.inputs.version }}-windows2022 ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ github.event.inputs.version }}-windows2022
199-
docker push ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ github.event.inputs.version }}-windows2022
197+
docker build -t ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ env.VERSION_INPUT }}-windows2022 -f ./Dockerfile.windows2022 .
198+
docker push ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ env.VERSION_INPUT }}-windows2022
199+
docker tag ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ env.VERSION_INPUT }}-windows2022 ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ env.VERSION_INPUT }}-windows2022
200+
docker push ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ env.VERSION_INPUT }}-windows2022
200201
} else {
201202
Echo "Unknown Windows Server version: $osInfo"
202203
exit 1
@@ -231,12 +232,12 @@ jobs:
231232

232233
- name: Create multi-platform image and push to Amazon private ECR
233234
run: |
234-
docker manifest create ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ github.event.inputs.version }} ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ github.event.inputs.version }}-amd64 ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ github.event.inputs.version }}-windows2019 ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ github.event.inputs.version }}-windows2022
235-
docker manifest inspect ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ github.event.inputs.version }}
236-
docker manifest push ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ github.event.inputs.version }}
235+
docker manifest create ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ env.VERSION_INPUT }} ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ env.VERSION_INPUT }}-amd64 ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ env.VERSION_INPUT }}-windows2019 ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ env.VERSION_INPUT }}-windows2022
236+
docker manifest inspect ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ env.VERSION_INPUT }}
237+
docker manifest push ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ env.VERSION_INPUT }}
237238
238239
- name: Create multi-platform image and push to Amazon public ECR
239240
run: |
240-
docker manifest create ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ github.event.inputs.version }} ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ github.event.inputs.version }}-amd64 ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ github.event.inputs.version }}-windows2019 ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ github.event.inputs.version }}-windows2022
241-
docker manifest inspect ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ github.event.inputs.version }}
242-
docker manifest push ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ github.event.inputs.version }}
241+
docker manifest create ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ env.VERSION_INPUT }} ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ env.VERSION_INPUT }}-amd64 ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ env.VERSION_INPUT }}-windows2019 ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ env.VERSION_INPUT }}-windows2022
242+
docker manifest inspect ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ env.VERSION_INPUT }}
243+
docker manifest push ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ env.VERSION_INPUT }}

0 commit comments

Comments
 (0)