Skip to content

Commit c1544b8

Browse files
thpiercethpierce
committed
fix: prevent script injection in workflows
Cherry-picked from main with additional fixes for older workflow files
1 parent 01a2340 commit c1544b8

File tree

6 files changed

+951
-24
lines changed

6 files changed

+951
-24
lines changed

‎.github/workflows/post-release-version-bump.yml‎

Lines changed: 149 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,149 @@
1+
name: Post Release - Prepare Main for Next Development Cycle
2+
3+
on:
4+
workflow_dispatch:
5+
inputs:
6+
version:
7+
description: 'Version number (e.g., 1.0.1)'
8+
required: true
9+
is_patch:
10+
description: 'Is this a patch? (true or false)'
11+
required: true
12+
default: 'false'
13+
14+
env:
15+
AWS_DEFAULT_REGION: us-east-1
16+
VERSION_INPUT: ${{ env.VERSION_INPUT }}
17+
IS_PATCH_INPUT: ${{ env.IS_PATCH_INPUT }}
18+
19+
permissions:
20+
id-token: write
21+
contents: write
22+
pull-requests: write
23+
24+
jobs:
25+
check-version:
26+
runs-on: ubuntu-latest
27+
steps:
28+
- name: Checkout main
29+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 #v5.0.0
30+
with:
31+
ref: main
32+
fetch-depth: 0
33+
34+
- name: Extract Major.Minor Version and setup Env variable
35+
run: |
36+
echo "VERSION=${{ env.VERSION_INPUT }}" >> $GITHUB_ENV
37+
echo "MAJOR_MINOR=$(echo ${{ env.VERSION_INPUT }} | sed -E 's/([0-9]+\.[0-9]+)\.[0-9]+/\1/')" >> $GITHUB_ENV
38+
39+
- name: Get current major.minor version from main branch
40+
id: get_version
41+
run: |
42+
CURRENT_VERSION=$(grep 'public static string version' src/AWS.Distro.OpenTelemetry.AutoInstrumentation/Version.cs | sed -E 's/ public static string version = "([0-9]+\.[0-9]+)\.[0-9]+.*";/\1/')
43+
echo "CURRENT_MAJOR_MINOR_VERSION=$CURRENT_VERSION" >> $GITHUB_ENV
44+
45+
- name: Set major and minor for current version
46+
run: |
47+
echo "CURRENT_MAJOR=$(echo $CURRENT_MAJOR_MINOR_VERSION | cut -d. -f1)" >> $GITHUB_ENV
48+
echo "CURRENT_MINOR=$(echo $CURRENT_MAJOR_MINOR_VERSION | cut -d. -f2)" >> $GITHUB_ENV
49+
50+
- name: Set major and minor for input version
51+
run: |
52+
echo "INPUT_MAJOR=$(echo $MAJOR_MINOR | cut -d. -f1)" >> $GITHUB_ENV
53+
echo "INPUT_MINOR=$(echo $MAJOR_MINOR | cut -d. -f2)" >> $GITHUB_ENV
54+
55+
- name: Compare major.minor version and skip if behind
56+
run: |
57+
if [ "$CURRENT_MAJOR" -gt "$INPUT_MAJOR" ] || { [ "$CURRENT_MAJOR" -eq "$INPUT_MAJOR" ] && [ "$CURRENT_MINOR" -gt "$INPUT_MINOR" ]; }; then
58+
echo "Input version is behind main's current major.minor version, don't need to update major version"
59+
exit 1
60+
fi
61+
62+
prepare-main:
63+
runs-on: ubuntu-latest
64+
needs: check-version
65+
steps:
66+
- name: Configure AWS credentials for BOT secrets
67+
uses: aws-actions/configure-aws-credentials@a03048d87541d1d9fcf2ecf528a4a65ba9bd7838 #v5.0.0
68+
with:
69+
role-to-assume: ${{ secrets.AWS_ROLE_ARN_SECRETS_MANAGER }}
70+
aws-region: ${{ env.AWS_DEFAULT_REGION }}
71+
72+
- name: Get Bot secrets
73+
uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802 #v2.0.10
74+
id: bot_secrets
75+
with:
76+
secret-ids: |
77+
BOT_TOKEN ,${{ secrets.BOT_TOKEN_SECRET_ARN }}
78+
parse-json-secrets: true
79+
80+
- name: Setup Git
81+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 #v5.0.0
82+
with:
83+
fetch-depth: 0
84+
token: ${{ env.BOT_TOKEN_GITHUB_RW_PATOKEN }}
85+
86+
- name: Configure Git
87+
run: |
88+
git config user.name "github-actions"
89+
git config user.email "github-actions@github.com"
90+
91+
- name: Extract Major.Minor Version and setup Env variable
92+
run: |
93+
echo "VERSION=${{ env.VERSION_INPUT }}" >> $GITHUB_ENV
94+
echo "MAJOR_MINOR=$(echo ${{ env.VERSION_INPUT }} | sed -E 's/([0-9]+\.[0-9]+)\.[0-9]+/\1/')" >> $GITHUB_ENV
95+
96+
- name: Determine release branch and checkout
97+
run: |
98+
RELEASE_BRANCH="release/v${MAJOR_MINOR}.x"
99+
git fetch origin $RELEASE_BRANCH
100+
git checkout -b "prepare-main-for-next-dev-cycle-${VERSION}" origin/$RELEASE_BRANCH
101+
102+
- name: Update version to next development version in main
103+
run: |
104+
DEV_VERSION="${{ env.VERSION_INPUT }}.dev0"
105+
sed -i "s/public static string version = \".*\";/public static string version = \"${DEV_VERSION}\";/" src/AWS.Distro.OpenTelemetry.AutoInstrumentation/Version.cs
106+
sed -i "s/private readonly string version = \".*\";/private readonly string version = \"${DEV_VERSION}\";/" build/Build.InstallationScripts.cs
107+
VERSION="${{ env.VERSION_INPUT }}"
108+
sed -i -e 's/dotnet:v.*"/dotnet:v'$VERSION'"/' .github/workflows/daily-scan.yml
109+
110+
# for patch releases, avoid merge conflict by manually resolving CHANGELOG with main
111+
if [[ "${{ env.IS_PATCH_INPUT }}" == "true" ]]; then
112+
# Copy the patch release entries
113+
sed -n "/^## v${VERSION}/,/^## v[0-9]/p" CHANGELOG.md | sed '$d' > /tmp/patch_release_section.txt
114+
git fetch origin main
115+
git show origin/main:CHANGELOG.md > CHANGELOG.md
116+
# Insert the patch release entries after Unreleased
117+
awk -i inplace '/^## v[0-9]/ && !inserted { system("cat /tmp/patch_release_section.txt"); inserted=1 } {print}' CHANGELOG.md
118+
fi
119+
120+
git add src/AWS.Distro.OpenTelemetry.AutoInstrumentation/Version.cs
121+
git add build/Build.InstallationScripts.cs
122+
git add .github/workflows/daily-scan.yml
123+
git add CHANGELOG.md
124+
git commit -m "Prepare main for next development cycle: Update version to $DEV_VERSION"
125+
git push --set-upstream origin "prepare-main-for-next-dev-cycle-${VERSION}"
126+
127+
- name: Create Pull Request to main
128+
env:
129+
GITHUB_TOKEN: ${{ env.BOT_TOKEN_GITHUB_RW_PATOKEN }}
130+
run: |
131+
DEV_VERSION="${{ env.VERSION_INPUT }}.dev0"
132+
gh pr create --title "Post release $VERSION: Update version to $DEV_VERSION" \
133+
--body "This PR prepares the main branch for the next development cycle by updating the version to $DEV_VERSION and updating the image version to be scanned to the latest released.
134+
135+
This PR should only be merge when release for version v$VERSION is success.
136+
137+
By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice." \
138+
--head prepare-main-for-next-dev-cycle-${VERSION} \
139+
--base main
140+
141+
- name: Force our CHANGELOG to override merge conflicts
142+
run: |
143+
git merge origin/main || true
144+
git checkout --ours CHANGELOG.md
145+
git add CHANGELOG.md
146+
if ! git diff --quiet --cached; then
147+
git commit -m "Force our CHANGELOG to override merge conflicts"
148+
git push origin "prepare-main-for-next-dev-cycle-${VERSION}"
149+
fi

‎.github/workflows/pre_release_prepare.yml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,8 +14,13 @@ on:
1414

1515
env:
1616
AWS_DEFAULT_REGION: us-east-1
17+
<<<<<<< HEAD:.github/workflows/pre_release_prepare.yml
1718
VERSION: ${{ inputs.version }}
1819
IS_PATCH: ${{ inputs.is_patch }}
20+
=======
21+
VERSION_INPUT: ${{ env.VERSION_INPUT }}
22+
IS_PATCH_INPUT: ${{ env.IS_PATCH_INPUT }}
23+
>>>>>>> 371c614 (fix: prevent script injection in workflows (#318)):.github/workflows/pre-release-prepare.yml
1924

2025
permissions:
2126
contents: write
@@ -54,12 +59,21 @@ jobs:
5459
5560
- name: Extract Major.Minor Version and setup Env variable
5661
run: |
62+
<<<<<<< HEAD:.github/workflows/pre_release_prepare.yml
5763
echo "VERSION=${{ env.VERSION }}" >> $GITHUB_ENV
5864
echo "MAJOR_MINOR=$(echo ${{ env.VERSION }} | sed -E 's/([0-9]+\.[0-9]+)\.[0-9]+/\1/')" >> $GITHUB_ENV
5965

6066
- name: Create branches
6167
run: |
6268
IS_PATCH=${{ env.IS_PATCH }}
69+
=======
70+
echo "VERSION=${{ env.VERSION_INPUT }}" >> $GITHUB_ENV
71+
echo "MAJOR_MINOR=$(echo ${{ env.VERSION_INPUT }} | sed -E 's/([0-9]+\.[0-9]+)\.[0-9]+/\1/')" >> $GITHUB_ENV
72+
73+
- name: Create branches
74+
run: |
75+
IS_PATCH=${{ env.IS_PATCH_INPUT }}
76+
>>>>>>> 371c614 (fix: prevent script injection in workflows (#318)):.github/workflows/pre-release-prepare.yml
6377
if [[ "$IS_PATCH" != "true" && "$IS_PATCH" != "false" ]]; then
6478
echo "Invalid input for IS_PATCH. Must be 'true' or 'false'."
6579
exit 1
@@ -105,5 +119,9 @@ jobs:
105119
--body "This PR updates the version to ${VERSION}.
106120
107121
By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice." \
122+
<<<<<<< HEAD:.github/workflows/pre_release_prepare.yml
108123
--head v${{ env.VERSION }}_release \
124+
=======
125+
--head v${{ env.VERSION_INPUT }}_release \
126+
>>>>>>> 371c614 (fix: prevent script injection in workflows (#318)):.github/workflows/pre-release-prepare.yml
109127
--base release/v${MAJOR_MINOR}.x

0 commit comments

Comments
 (0)