Skip to content

Commit ac0259d

Browse files
thpiercethpierce
committed
fix: prevent script injection in workflows
Move github.event references to env vars to prevent script injection vulnerabilities in workflow run steps
1 parent d18baa8 commit ac0259d

File tree

4 files changed

+48
-43
lines changed

4 files changed

+48
-43
lines changed

‎.github/workflows/post_release_version_bump.yml‎

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ on:
88
required: true
99

1010
env:
11+
VERSION_INPUT: ${{ env.VERSION_INPUT }}
1112
AWS_DEFAULT_REGION: us-east-1
1213

1314
permissions:
@@ -27,8 +28,8 @@ jobs:
2728

2829
- name: Extract Major.Minor Version and setup Env variable
2930
run: |
30-
echo "VERSION=${{ github.event.inputs.version }}" >> $GITHUB_ENV
31-
echo "MAJOR_MINOR=$(echo ${{ github.event.inputs.version }} | sed -E 's/([0-9]+\.[0-9]+)\.[0-9]+/\1/')" >> $GITHUB_ENV
31+
echo "VERSION=${{ env.VERSION_INPUT }}" >> $GITHUB_ENV
32+
echo "MAJOR_MINOR=$(echo ${{ env.VERSION_INPUT }} | sed -E 's/([0-9]+\.[0-9]+)\.[0-9]+/\1/')" >> $GITHUB_ENV
3233
3334
- name: Get current major.minor version from main branch
3435
id: get_version
@@ -84,8 +85,8 @@ jobs:
8485
8586
- name: Extract Major.Minor Version and setup Env variable
8687
run: |
87-
echo "VERSION=${{ github.event.inputs.version }}" >> $GITHUB_ENV
88-
echo "MAJOR_MINOR=$(echo ${{ github.event.inputs.version }} | sed -E 's/([0-9]+\.[0-9]+)\.[0-9]+/\1/')" >> $GITHUB_ENV
88+
echo "VERSION=${{ env.VERSION_INPUT }}" >> $GITHUB_ENV
89+
echo "MAJOR_MINOR=$(echo ${{ env.VERSION_INPUT }} | sed -E 's/([0-9]+\.[0-9]+)\.[0-9]+/\1/')" >> $GITHUB_ENV
8990
9091
- name: Determine release branch and checkout
9192
run: |
@@ -96,10 +97,10 @@ jobs:
9697
- name: Update version to next development version in main
9798
# TODO update version in daily_scan.yml
9899
run: |
99-
DEV_VERSION="${{ github.event.inputs.version }}.dev0"
100+
DEV_VERSION="${{ env.VERSION_INPUT }}.dev0"
100101
sed -i "s/public static string version = \".*\";/public static string version = \"${DEV_VERSION}\";/" src/AWS.Distro.OpenTelemetry.AutoInstrumentation/Version.cs
101102
sed -i "s/private readonly string version = \".*\";/private readonly string version = \"${DEV_VERSION}\";/" build/Build.InstallationScripts.cs
102-
VERSION="${{ github.event.inputs.version }}"
103+
VERSION="${{ env.VERSION_INPUT }}"
103104
git add src/AWS.Distro.OpenTelemetry.AutoInstrumentation/Version.cs
104105
git add build/Build.InstallationScripts.cs
105106
git commit -m "Prepare main for next development cycle: Update version to $DEV_VERSION"
@@ -109,7 +110,7 @@ jobs:
109110
env:
110111
GITHUB_TOKEN: ${{ env.BOT_TOKEN_GITHUB_RW_PATOKEN }}
111112
run: |
112-
DEV_VERSION="${{ github.event.inputs.version }}.dev0"
113+
DEV_VERSION="${{ env.VERSION_INPUT }}.dev0"
113114
gh pr create --title "Post release $VERSION: Update version to $DEV_VERSION" \
114115
--body "This PR prepares the main branch for the next development cycle by updating the version to $DEV_VERSION and updating the image version to be scanned to the latest released.
115116

‎.github/workflows/pre_release_prepare.yml‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,8 @@ on:
1313
default: 'false'
1414

1515
env:
16+
VERSION_INPUT: ${{ env.VERSION_INPUT }}
17+
IS_PATCH_INPUT: ${{ env.IS_PATCH_INPUT }}
1618
AWS_DEFAULT_REGION: us-east-1
1719

1820
permissions:
@@ -52,12 +54,12 @@ jobs:
5254
5355
- name: Extract Major.Minor Version and setup Env variable
5456
run: |
55-
echo "VERSION=${{ github.event.inputs.version }}" >> $GITHUB_ENV
56-
echo "MAJOR_MINOR=$(echo ${{ github.event.inputs.version }} | sed -E 's/([0-9]+\.[0-9]+)\.[0-9]+/\1/')" >> $GITHUB_ENV
57+
echo "VERSION=${{ env.VERSION_INPUT }}" >> $GITHUB_ENV
58+
echo "MAJOR_MINOR=$(echo ${{ env.VERSION_INPUT }} | sed -E 's/([0-9]+\.[0-9]+)\.[0-9]+/\1/')" >> $GITHUB_ENV
5759
5860
- name: Create branches
5961
run: |
60-
IS_PATCH=${{ github.event.inputs.is_patch }}
62+
IS_PATCH=${{ env.IS_PATCH_INPUT }}
6163
if [[ "$IS_PATCH" != "true" && "$IS_PATCH" != "false" ]]; then
6264
echo "Invalid input for IS_PATCH. Must be 'true' or 'false'."
6365
exit 1
@@ -103,5 +105,5 @@ jobs:
103105
--body "This PR updates the version to ${VERSION}.
104106
105107
By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice." \
106-
--head v${{ github.event.inputs.version }}_release \
108+
--head v${{ env.VERSION_INPUT }}_release \
107109
--base release/v${MAJOR_MINOR}.x

‎.github/workflows/release_build.yml‎

Lines changed: 32 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ on:
77
required: true
88

99
env:
10+
VERSION_INPUT: ${{ env.VERSION_INPUT }}
1011
AWS_DEFAULT_REGION: us-east-1
1112
AWS_PUBLIC_ECR_REGION: us-east-1
1213
AWS_PRIVATE_ECR_REGION: us-west-2
@@ -95,7 +96,7 @@ jobs:
9596

9697
- name: Upload to Private S3 Bucket
9798
run: |
98-
PREFIX="Release_v${{github.event.inputs.version}}"
99+
PREFIX="Release_v${{ env.VERSION_INPUT }}"
99100
100101
find ./artifacts/ -name "*.zip" | while read file; do
101102
base=$(basename "$file")
@@ -111,27 +112,27 @@ jobs:
111112
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # This token is provided by Actions, you do not need to create your own token
112113
run: |
113114
gh release create --target "$GITHUB_REF_NAME" \
114-
--title "Release v${{ github.event.inputs.version }}" \
115-
"v${{ github.event.inputs.version }}" \
116-
--notes "Release Verions v${{ github.event.inputs.version }}"
115+
--title "Release v${{ env.VERSION_INPUT }}" \
116+
"v${{ env.VERSION_INPUT }}" \
117+
--notes "Release Verions v${{ env.VERSION_INPUT }}"
117118
118119
- name: Upload artifacts to release
119120
env:
120121
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
121122
run: |
122-
PREFIX="Release_v${{github.event.inputs.version}}_"
123+
PREFIX="Release_v${{ env.VERSION_INPUT }}_"
123124
124125
find ./artifacts/ -name "*.zip" | while read file; do
125126
base=$(basename "$file")
126127
cp "$file" "$base"
127-
gh release upload "v${{ github.event.inputs.version }}" \
128+
gh release upload "v${{ env.VERSION_INPUT }}" \
128129
$base \
129130
--clobber
130131
done
131-
gh release upload "v${{ github.event.inputs.version }}" \
132+
gh release upload "v${{ env.VERSION_INPUT }}" \
132133
./installationScripts/aws-otel-dotnet-install.sh \
133134
--clobber
134-
gh release upload "v${{ github.event.inputs.version }}" \
135+
gh release upload "v${{ env.VERSION_INPUT }}" \
135136
./installationScripts/AWS.Otel.DotNet.Auto.psm1 \
136137
--clobber
137138
@@ -234,37 +235,37 @@ jobs:
234235
if: runner.os == 'Linux'
235236
run: |
236237
set -e
237-
docker build -t ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ github.event.inputs.version }}-amd64 -f ./Dockerfile.linux .
238-
docker push ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ github.event.inputs.version }}-amd64
239-
docker tag ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ github.event.inputs.version }}-amd64 ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ github.event.inputs.version }}-amd64
240-
docker push ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ github.event.inputs.version }}-amd64
238+
docker build -t ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ env.VERSION_INPUT }}-amd64 -f ./Dockerfile.linux .
239+
docker push ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ env.VERSION_INPUT }}-amd64
240+
docker tag ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ env.VERSION_INPUT }}-amd64 ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ env.VERSION_INPUT }}-amd64
241+
docker push ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ env.VERSION_INPUT }}-amd64
241242
242243
- name: Build Linux arm64 container
243244
if: runner.os == 'Linux'
244245
run: |
245246
set -e
246247
cd ./arm64
247-
docker build --platform linux/arm64 -t ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ github.event.inputs.version }}-arm64 -f ../Dockerfile.linux .
248-
docker push ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ github.event.inputs.version }}-arm64
249-
docker tag ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ github.event.inputs.version }}-arm64 ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ github.event.inputs.version }}-arm64
250-
docker push ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ github.event.inputs.version }}-arm64
248+
docker build --platform linux/arm64 -t ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ env.VERSION_INPUT }}-arm64 -f ../Dockerfile.linux .
249+
docker push ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ env.VERSION_INPUT }}-arm64
250+
docker tag ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ env.VERSION_INPUT }}-arm64 ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ env.VERSION_INPUT }}-arm64
251+
docker push ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ env.VERSION_INPUT }}-arm64
251252
252253
- name: Build Windows container
253254
if: runner.os == 'Windows'
254255
run: |
255256
$osInfo = systeminfo | Select-String "OS Version"
256257
if ($osInfo -match "10.0.17763") {
257258
Echo "Build image for Windows Server 2019"
258-
docker build -t ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ github.event.inputs.version }}-windows2019 -f ./Dockerfile.windows2019 .
259-
docker push ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ github.event.inputs.version }}-windows2019
260-
docker tag ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ github.event.inputs.version }}-windows2019 ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ github.event.inputs.version }}-windows2019
261-
docker push ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ github.event.inputs.version }}-windows2019
259+
docker build -t ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ env.VERSION_INPUT }}-windows2019 -f ./Dockerfile.windows2019 .
260+
docker push ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ env.VERSION_INPUT }}-windows2019
261+
docker tag ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ env.VERSION_INPUT }}-windows2019 ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ env.VERSION_INPUT }}-windows2019
262+
docker push ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ env.VERSION_INPUT }}-windows2019
262263
} elseif ($osInfo -match "10.0.20348") {
263264
Echo "Build image for Windows Server 2022"
264-
docker build -t ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ github.event.inputs.version }}-windows2022 -f ./Dockerfile.windows2022 .
265-
docker push ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ github.event.inputs.version }}-windows2022
266-
docker tag ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ github.event.inputs.version }}-windows2022 ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ github.event.inputs.version }}-windows2022
267-
docker push ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ github.event.inputs.version }}-windows2022
265+
docker build -t ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ env.VERSION_INPUT }}-windows2022 -f ./Dockerfile.windows2022 .
266+
docker push ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ env.VERSION_INPUT }}-windows2022
267+
docker tag ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ env.VERSION_INPUT }}-windows2022 ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ env.VERSION_INPUT }}-windows2022
268+
docker push ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ env.VERSION_INPUT }}-windows2022
268269
} else {
269270
Echo "Unknown Windows Server version: $osInfo"
270271
exit 1
@@ -299,15 +300,15 @@ jobs:
299300

300301
- name: Create multi-platform image and push to Amazon private ECR
301302
run: |
302-
docker manifest create ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ github.event.inputs.version }} ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ github.event.inputs.version }}-amd64 ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ github.event.inputs.version }}-arm64 ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ github.event.inputs.version }}-windows2019 ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ github.event.inputs.version }}-windows2022
303-
docker manifest inspect ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ github.event.inputs.version }}
304-
docker manifest push ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ github.event.inputs.version }}
303+
docker manifest create ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ env.VERSION_INPUT }} ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ env.VERSION_INPUT }}-amd64 ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ env.VERSION_INPUT }}-arm64 ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ env.VERSION_INPUT }}-windows2019 ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ env.VERSION_INPUT }}-windows2022
304+
docker manifest inspect ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ env.VERSION_INPUT }}
305+
docker manifest push ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ env.VERSION_INPUT }}
305306
306307
- name: Create multi-platform image and push to Amazon public ECR
307308
run: |
308-
docker manifest create ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ github.event.inputs.version }} ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ github.event.inputs.version }}-amd64 ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ github.event.inputs.version }}-arm64 ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ github.event.inputs.version }}-windows2019 ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ github.event.inputs.version }}-windows2022
309-
docker manifest inspect ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ github.event.inputs.version }}
310-
docker manifest push ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ github.event.inputs.version }}
309+
docker manifest create ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ env.VERSION_INPUT }} ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ env.VERSION_INPUT }}-amd64 ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ env.VERSION_INPUT }}-arm64 ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ env.VERSION_INPUT }}-windows2019 ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ env.VERSION_INPUT }}-windows2022
310+
docker manifest inspect ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ env.VERSION_INPUT }}
311+
docker manifest push ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ env.VERSION_INPUT }}
311312
312313
build-release-nuget:
313314
runs-on: windows-latest
@@ -347,7 +348,7 @@ jobs:
347348
run: >
348349
dotnet pack
349350
.\src\AWS.Distro.OpenTelemetry.AutoInstrumentation
350-
/p:Version=${{github.event.inputs.version}}
351+
/p:Version=${{ env.VERSION_INPUT }}
351352
--no-build
352353
-c Release
353354
-o .\Deployment\nuget-packages

‎.github/workflows/unlist_nuget.yml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ on:
77
required: true
88

99
env:
10+
VERSION_INPUT: ${{ env.VERSION_INPUT }}
1011
AWS_SIGNING_KEY_REGION: us-west-2
1112

1213
permissions:
@@ -35,6 +36,6 @@ jobs:
3536
--output text
3637
--query SecretString | ConvertFrom-Json
3738
38-
nuget delete AWS.Distro.OpenTelemetry.AutoInstrumentation ${{github.event.inputs.version}}
39+
nuget delete AWS.Distro.OpenTelemetry.AutoInstrumentation ${{ env.VERSION_INPUT }}
3940
-Source https://api.nuget.org/v3/index.json
4041
-ApiKey $nugetKey.Key

0 commit comments

Comments
 (0)