Skip to content

fix: prevent script injection in workflows #324

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
thpierce wants to merge 1 commit into from
Closed

fix: prevent script injection in workflows #324

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 8 additions & 7 deletions .github/workflows/post_release_version_bump.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@ on:
required: true

env:
VERSION_INPUT: ${{ env.VERSION_INPUT }}
AWS_DEFAULT_REGION: us-east-1

permissions:
Expand All @@ -27,8 +28,8 @@ jobs:

- name: Extract Major.Minor Version and setup Env variable
run: |
echo "VERSION=${{ github.event.inputs.version }}" >> $GITHUB_ENV
echo "MAJOR_MINOR=$(echo ${{ github.event.inputs.version }} | sed -E 's/([0-9]+\.[0-9]+)\.[0-9]+/\1/')" >> $GITHUB_ENV
echo "VERSION=${{ env.VERSION_INPUT }}" >> $GITHUB_ENV
echo "MAJOR_MINOR=$(echo ${{ env.VERSION_INPUT }} | sed -E 's/([0-9]+\.[0-9]+)\.[0-9]+/\1/')" >> $GITHUB_ENV

- name: Get current major.minor version from main branch
id: get_version
Expand Down Expand Up @@ -84,8 +85,8 @@ jobs:

- name: Extract Major.Minor Version and setup Env variable
run: |
echo "VERSION=${{ github.event.inputs.version }}" >> $GITHUB_ENV
echo "MAJOR_MINOR=$(echo ${{ github.event.inputs.version }} | sed -E 's/([0-9]+\.[0-9]+)\.[0-9]+/\1/')" >> $GITHUB_ENV
echo "VERSION=${{ env.VERSION_INPUT }}" >> $GITHUB_ENV
echo "MAJOR_MINOR=$(echo ${{ env.VERSION_INPUT }} | sed -E 's/([0-9]+\.[0-9]+)\.[0-9]+/\1/')" >> $GITHUB_ENV

- name: Determine release branch and checkout
run: |
Expand All @@ -95,10 +96,10 @@ jobs:

- name: Update version to next development version in main
run: |
DEV_VERSION="${{ github.event.inputs.version }}.dev0"
DEV_VERSION="${{ env.VERSION_INPUT }}.dev0"
sed -i "s/public static string version = \".*\";/public static string version = \"${DEV_VERSION}\";/" src/AWS.Distro.OpenTelemetry.AutoInstrumentation/Version.cs
sed -i "s/private readonly string version = \".*\";/private readonly string version = \"${DEV_VERSION}\";/" build/Build.InstallationScripts.cs
VERSION="${{ github.event.inputs.version }}"
VERSION="${{ env.VERSION_INPUT }}"
sed -i -e 's/dotnet:v.*"/dotnet:v'$VERSION'"/' .github/workflows/daily_scan.yml
git add src/AWS.Distro.OpenTelemetry.AutoInstrumentation/Version.cs
git add build/Build.InstallationScripts.cs
Expand All @@ -110,7 +111,7 @@ jobs:
env:
GITHUB_TOKEN: ${{ env.BOT_TOKEN_GITHUB_RW_PATOKEN }}
run: |
DEV_VERSION="${{ github.event.inputs.version }}.dev0"
DEV_VERSION="${{ env.VERSION_INPUT }}.dev0"
gh pr create --title "Post release $VERSION: Update version to $DEV_VERSION" \
--body "This PR prepares the main branch for the next development cycle by updating the version to $DEV_VERSION and updating the image version to be scanned to the latest released.

Expand Down
10 changes: 6 additions & 4 deletions .github/workflows/pre_release_prepare.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,8 @@ on:
default: 'false'

env:
VERSION_INPUT: ${{ env.VERSION_INPUT }}
IS_PATCH_INPUT: ${{ env.IS_PATCH_INPUT }}
AWS_DEFAULT_REGION: us-east-1

permissions:
Expand Down Expand Up @@ -52,12 +54,12 @@ jobs:

- name: Extract Major.Minor Version and setup Env variable
run: |
echo "VERSION=${{ github.event.inputs.version }}" >> $GITHUB_ENV
echo "MAJOR_MINOR=$(echo ${{ github.event.inputs.version }} | sed -E 's/([0-9]+\.[0-9]+)\.[0-9]+/\1/')" >> $GITHUB_ENV
echo "VERSION=${{ env.VERSION_INPUT }}" >> $GITHUB_ENV
echo "MAJOR_MINOR=$(echo ${{ env.VERSION_INPUT }} | sed -E 's/([0-9]+\.[0-9]+)\.[0-9]+/\1/')" >> $GITHUB_ENV

- name: Create branches
run: |
IS_PATCH=${{ github.event.inputs.is_patch }}
IS_PATCH=${{ env.IS_PATCH_INPUT }}
if [[ "$IS_PATCH" != "true" && "$IS_PATCH" != "false" ]]; then
echo "Invalid input for IS_PATCH. Must be 'true' or 'false'."
exit 1
Expand Down Expand Up @@ -103,5 +105,5 @@ jobs:
--body "This PR updates the version to ${VERSION}.

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice." \
--head v${{ github.event.inputs.version }}_release \
--head v${{ env.VERSION_INPUT }}_release \
--base release/v${MAJOR_MINOR}.x
23 changes: 12 additions & 11 deletions .github/workflows/release-udp-exporter.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@ permissions:
contents: write

env:
VERSION_INPUT: ${{ env.VERSION_INPUT }}
AWS_SIGNING_KEY_REGION: us-west-2

jobs:
Expand Down Expand Up @@ -62,7 +63,7 @@ jobs:
run: >
dotnet pack
.\exporters\AWS.Distro.OpenTelemetry.Exporter.Xray.Udp
/p:Version=${{github.event.inputs.version}}
/p:Version=${{ env.VERSION_INPUT }}
--no-build
-c Release
-o .\Deployment\nuget-packages
Expand Down Expand Up @@ -95,18 +96,18 @@ jobs:
- name: Create Release Notes
run: |
@"
# AWS Distro for OpenTelemetry X-Ray UDP Exporter v${{ github.event.inputs.version }}-${{ steps.commit.outputs.sha_short }}
# AWS Distro for OpenTelemetry X-Ray UDP Exporter v${{ env.VERSION_INPUT }}-${{ steps.commit.outputs.sha_short }}

## Overview
This release contains the AWS Distro for OpenTelemetry X-Ray UDP Exporter for .NET.

## Package Information
- Package Name: AWS.Distro.OpenTelemetry.Exporter.Xray.Udp
- Version: ${{ github.event.inputs.version }}
- Version: ${{ env.VERSION_INPUT }}

## NuGet Package
The package is available on NuGet.org:
https://www.nuget.org/packages/AWS.Distro.OpenTelemetry.Exporter.Xray.Udp/${{ github.event.inputs.version }}
https://www.nuget.org/packages/AWS.Distro.OpenTelemetry.Exporter.Xray.Udp/${{ env.VERSION_INPUT }}

## Release Notes
- This exporter allows you to send OpenTelemetry traces to the AWS X-Ray daemon over UDP
Expand All @@ -116,25 +117,25 @@ jobs:
run: |
New-Item -Path .\Deployment\release-assets -ItemType Directory -Force
Copy-Item -Path .\Deployment\nuget-packages\* -Destination .\Deployment\release-assets\
Compress-Archive -Path .\Deployment\release-assets\* -DestinationPath .\udp-exporter-${{ github.event.inputs.version }}.zip
Compress-Archive -Path .\Deployment\release-assets\* -DestinationPath .\udp-exporter-${{ env.VERSION_INPUT }}.zip

- name: Create SHA256 hash for release package
run: |
# Create SHA256 hash file
$hash = Get-FileHash -Path .\udp-exporter-${{ github.event.inputs.version }}.zip -Algorithm SHA256
$hash.Hash | Out-File -FilePath .\udp-exporter-${{ github.event.inputs.version }}.zip.sha256 -Encoding utf8
$hash = Get-FileHash -Path .\udp-exporter-${{ env.VERSION_INPUT }}.zip -Algorithm SHA256
$hash.Hash | Out-File -FilePath .\udp-exporter-${{ env.VERSION_INPUT }}.zip.sha256 -Encoding utf8

- name: Create GH release (draft)
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: |
gh release create `
--target "$env:GITHUB_REF_NAME" `
--title "ADOT OTLP UDP Exporter v${{ github.event.inputs.version }}-${{ steps.commit.outputs.sha_short }}" `
--title "ADOT OTLP UDP Exporter v${{ env.VERSION_INPUT }}-${{ steps.commit.outputs.sha_short }}" `
--notes-file release_notes.md `
--draft `
"Exporter.Xray.Udp-${{ github.event.inputs.version }}" `
.\udp-exporter-${{ github.event.inputs.version }}.zip
.\udp-exporter-${{ github.event.inputs.version }}.zip.sha256
"Exporter.Xray.Udp-${{ env.VERSION_INPUT }}" `
.\udp-exporter-${{ env.VERSION_INPUT }}.zip
.\udp-exporter-${{ env.VERSION_INPUT }}.zip.sha256

Remove-Item -Path release_notes.md -Force
65 changes: 33 additions & 32 deletions .github/workflows/release_build.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@ on:
required: true

env:
VERSION_INPUT: ${{ env.VERSION_INPUT }}
AWS_DEFAULT_REGION: us-east-1
AWS_PUBLIC_ECR_REGION: us-east-1
AWS_PRIVATE_ECR_REGION: us-west-2
Expand Down Expand Up @@ -89,7 +90,7 @@ jobs:

- name: Upload to Private S3 Bucket
run: |
PREFIX="Release_v${{github.event.inputs.version}}"
PREFIX="Release_v${{ env.VERSION_INPUT }}"

find ./artifacts/ -name "*.zip" | while read file; do
base=$(basename "$file")
Expand All @@ -105,33 +106,33 @@ jobs:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # This token is provided by Actions, you do not need to create your own token
run: |
gh release create --target "$GITHUB_REF_NAME" \
--title "Release v${{ github.event.inputs.version }}" \
--title "Release v${{ env.VERSION_INPUT }}" \
--draft \
"v${{ github.event.inputs.version }}" \
--notes "Release Verions v${{ github.event.inputs.version }}"
"v${{ env.VERSION_INPUT }}" \
--notes "Release Verions v${{ env.VERSION_INPUT }}"

- name: Upload artifacts and checksum to release
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: |
PREFIX="Release_v${{github.event.inputs.version}}_"
PREFIX="Release_v${{ env.VERSION_INPUT }}_"

find ./artifacts/ -name "*.zip" | while read file; do
base=$(basename "$file")
cp "$file" "$base"
shasum -a 256 $base > $base.sha256
gh release upload "v${{ github.event.inputs.version }}" \
gh release upload "v${{ env.VERSION_INPUT }}" \
$base \
$base.sha256 \
--clobber
done
shasum -a 256 ./installationScripts/aws-otel-dotnet-install.sh | sed "s|./installationScripts/||" > aws-otel-dotnet-install.sh.sha256
shasum -a 256 ./installationScripts/AWS.Otel.DotNet.Auto.psm1 | sed "s|./installationScripts/||" > AWS.Otel.DotNet.Auto.psm1.sha256
gh release upload "v${{ github.event.inputs.version }}" \
gh release upload "v${{ env.VERSION_INPUT }}" \
./installationScripts/aws-otel-dotnet-install.sh \
aws-otel-dotnet-install.sh.sha256 \
--clobber
gh release upload "v${{ github.event.inputs.version }}" \
gh release upload "v${{ env.VERSION_INPUT }}" \
./installationScripts/AWS.Otel.DotNet.Auto.psm1 \
AWS.Otel.DotNet.Auto.psm1.sha256 \
--clobber
Expand All @@ -140,7 +141,7 @@ jobs:
mkdir -p layer_artifact
gh release download "$LATEST_SDK_VERSION" --repo "aws-observability/aws-otel-dotnet-instrumentation" --pattern "layer.zip" --dir layer_artifact
shasum -a 256 layer_artifact/layer.zip > layer_artifact/layer.zip.sha256
gh release upload "v${{ github.event.inputs.version }}" \
gh release upload "v${{ env.VERSION_INPUT }}" \
layer_artifact/layer.zip \
layer_artifact/layer.zip.sha256 \
--clobber
Expand Down Expand Up @@ -244,38 +245,38 @@ jobs:
if: runner.os == 'Linux'
run: |
set -e
docker build -t ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ github.event.inputs.version }}-amd64 -f ./Dockerfile.linux .
docker push ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ github.event.inputs.version }}-amd64
docker tag ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ github.event.inputs.version }}-amd64 ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ github.event.inputs.version }}-amd64
docker push ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ github.event.inputs.version }}-amd64
docker build -t ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ env.VERSION_INPUT }}-amd64 -f ./Dockerfile.linux .
docker push ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ env.VERSION_INPUT }}-amd64
docker tag ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ env.VERSION_INPUT }}-amd64 ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ env.VERSION_INPUT }}-amd64
docker push ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ env.VERSION_INPUT }}-amd64

- name: Build Linux arm64 container
if: runner.os == 'Linux'
run: |
set -e
cp THIRD-PARTY-LICENSES ./arm64/THIRD-PARTY-LICENSES
cd ./arm64
docker build --platform linux/arm64 -t ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ github.event.inputs.version }}-arm64 -f ../Dockerfile.linux .
docker push ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ github.event.inputs.version }}-arm64
docker tag ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ github.event.inputs.version }}-arm64 ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ github.event.inputs.version }}-arm64
docker push ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ github.event.inputs.version }}-arm64
docker build --platform linux/arm64 -t ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ env.VERSION_INPUT }}-arm64 -f ../Dockerfile.linux .
docker push ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ env.VERSION_INPUT }}-arm64
docker tag ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ env.VERSION_INPUT }}-arm64 ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ env.VERSION_INPUT }}-arm64
docker push ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ env.VERSION_INPUT }}-arm64

- name: Build Windows container
if: runner.os == 'Windows'
run: |
$osInfo = systeminfo | Select-String "OS Version"
if ($osInfo -match "10.0.17763") {
Echo "Build image for Windows Server 2019"
docker build -t ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ github.event.inputs.version }}-windows2019 -f ./Dockerfile.windows2019 .
docker push ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ github.event.inputs.version }}-windows2019
docker tag ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ github.event.inputs.version }}-windows2019 ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ github.event.inputs.version }}-windows2019
docker push ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ github.event.inputs.version }}-windows2019
docker build -t ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ env.VERSION_INPUT }}-windows2019 -f ./Dockerfile.windows2019 .
docker push ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ env.VERSION_INPUT }}-windows2019
docker tag ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ env.VERSION_INPUT }}-windows2019 ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ env.VERSION_INPUT }}-windows2019
docker push ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ env.VERSION_INPUT }}-windows2019
} elseif ($osInfo -match "10.0.20348") {
Echo "Build image for Windows Server 2022"
docker build -t ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ github.event.inputs.version }}-windows2022 -f ./Dockerfile.windows2022 .
docker push ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ github.event.inputs.version }}-windows2022
docker tag ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ github.event.inputs.version }}-windows2022 ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ github.event.inputs.version }}-windows2022
docker push ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ github.event.inputs.version }}-windows2022
docker build -t ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ env.VERSION_INPUT }}-windows2022 -f ./Dockerfile.windows2022 .
docker push ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ env.VERSION_INPUT }}-windows2022
docker tag ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ env.VERSION_INPUT }}-windows2022 ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ env.VERSION_INPUT }}-windows2022
docker push ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ env.VERSION_INPUT }}-windows2022
} else {
Echo "Unknown Windows Server version: $osInfo"
exit 1
Expand Down Expand Up @@ -310,15 +311,15 @@ jobs:

- name: Create multi-platform image and push to Amazon private ECR
run: |
docker manifest create ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ github.event.inputs.version }} ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ github.event.inputs.version }}-amd64 ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ github.event.inputs.version }}-arm64 ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ github.event.inputs.version }}-windows2019 ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ github.event.inputs.version }}-windows2022
docker manifest inspect ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ github.event.inputs.version }}
docker manifest push ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ github.event.inputs.version }}
docker manifest create ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ env.VERSION_INPUT }} ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ env.VERSION_INPUT }}-amd64 ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ env.VERSION_INPUT }}-arm64 ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ env.VERSION_INPUT }}-windows2019 ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ env.VERSION_INPUT }}-windows2022
docker manifest inspect ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ env.VERSION_INPUT }}
docker manifest push ${{ env.RELEASE_PRIVATE_REPOSITORY }}:v${{ env.VERSION_INPUT }}

- name: Create multi-platform image and push to Amazon public ECR
run: |
docker manifest create ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ github.event.inputs.version }} ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ github.event.inputs.version }}-amd64 ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ github.event.inputs.version }}-arm64 ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ github.event.inputs.version }}-windows2019 ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ github.event.inputs.version }}-windows2022
docker manifest inspect ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ github.event.inputs.version }}
docker manifest push ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ github.event.inputs.version }}
docker manifest create ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ env.VERSION_INPUT }} ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ env.VERSION_INPUT }}-amd64 ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ env.VERSION_INPUT }}-arm64 ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ env.VERSION_INPUT }}-windows2019 ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ env.VERSION_INPUT }}-windows2022
docker manifest inspect ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ env.VERSION_INPUT }}
docker manifest push ${{ env.RELEASE_PUBLIC_REPOSITORY }}:v${{ env.VERSION_INPUT }}

build-release-nuget:
runs-on: windows-latest
Expand Down Expand Up @@ -359,7 +360,7 @@ jobs:
run: >
dotnet pack
.\src\AWS.Distro.OpenTelemetry.AutoInstrumentation
/p:Version=${{github.event.inputs.version}}
/p:Version=${{ env.VERSION_INPUT }}
--no-build
-c Release
-o .\Deployment\nuget-packages
Expand Down
Loading
Loading