Skip to content

Commit 285bfc2

Browse files
dreamorosidreamorosi
committed
chore: sanitize CI inputs via env var
1 parent b542da5 commit 285bfc2

File tree

8 files changed

+39
-16
lines changed

8 files changed

+39
-16
lines changed

‎.github/workflows/bootstrap_region.yml‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -65,10 +65,12 @@ jobs:
6565
mkdir -p build/project
6666
- id: cdk-project
6767
name: CDK Project
68+
env:
69+
REGION: ${{ inputs.region }}
6870
working-directory: build/project
6971
run: |
7072
npx cdk init app --language=typescript
71-
AWS_REGION="${{ inputs.region }}" npx cdk bootstrap
73+
AWS_REGION="$REGION" npx cdk bootstrap
7274
7375
copy_layers:
7476
name: Copy Layers
@@ -101,4 +103,5 @@ jobs:
101103
name: Run Balance
102104
env:
103105
BALANCE_ROLE_ARN: ${{ secrets.BALANCE_ROLE_ARN }}
104-
run: balance -read-region us-east-1 -write-region ${{ inputs.region }} -write-role $BALANCE_ROLE_ARN -layer-name AWSLambdaPowertoolsTypeScriptV2 -dry-run=false
106+
REGION: ${{ inputs.region }}
107+
run: balance -read-region us-east-1 -write-region $REGION -write-role $BALANCE_ROLE_ARN -layer-name AWSLambdaPowertoolsTypeScriptV2 -dry-run=false

‎.github/workflows/layer_balance.yml‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -64,8 +64,13 @@ jobs:
6464
- id: run-balance-new-region
6565
name: Run Balance
6666
if: ${{ inputs.start_at == '' }}
67-
run: balance -read-region us-east-1 -write-region ${{ inputs.region }} -write-role $BALANCE_ROLE_ARN -layer-name AWSLambdaPowertoolsTypeScriptV2 -dry-run=false
67+
env:
68+
REGION: ${{ inputs.region }}
69+
run: balance -read-region us-east-1 -write-region $REGION -write-role $BALANCE_ROLE_ARN -layer-name AWSLambdaPowertoolsTypeScriptV2 -dry-run=false
6870
- id: run-balance-existing
6971
name: Run Balance (Existing Region)
7072
if: ${{ inputs.start_at != '' }}
71-
run: balance -read-region us-east-1 -start-at ${{ inputs.start_at }} -write-region ${{ inputs.region }} -write-role $BALANCE_ROLE_ARN -layer-name AWSLambdaPowertoolsTypeScriptV2 -dry-run=false
73+
env:
74+
REGION: ${{ inputs.region }}
75+
START_AT: ${{ inputs.start_at }}
76+
run: balance -read-region us-east-1 -start-at $START_AT -write-region $REGION -write-role $BALANCE_ROLE_ARN -layer-name AWSLambdaPowertoolsTypeScriptV2 -dry-run=false

‎.github/workflows/layers_partition_verify.yml‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -90,9 +90,11 @@ jobs:
9090
aws-region: us-east-1
9191
mask-aws-account-id: true
9292
- name: Output AWSLambdaPowertoolsTypeScriptV2
93+
env:
94+
VERSION: ${{ inputs.version }}
9395
# fetch the specific layer version information from the us-east-1 commercial region
9496
run: |
95-
aws --region us-east-1 lambda get-layer-version-by-arn --arn 'arn:aws:lambda:us-east-1:094274105915:layer:AWSLambdaPowertoolsTypeScriptV2:${{ inputs.version }}' > AWSLambdaPowertoolsTypeScriptV2.json
97+
aws --region us-east-1 lambda get-layer-version-by-arn --arn 'arn:aws:lambda:us-east-1:094274105915:layer:AWSLambdaPowertoolsTypeScriptV2:$VERSION' > AWSLambdaPowertoolsTypeScriptV2.json
9698
- name: Store Metadata
9799
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
98100
with:
@@ -133,8 +135,11 @@ jobs:
133135
audience: ${{ needs.setup.outputs.aud }}
134136
- id: partition_version
135137
name: Partition Layer Version
138+
env:
139+
VERSION: ${{ inputs.version }}
140+
PARTITION_VERSION: ${{ inputs.partition_version }}
136141
run: |
137-
echo 'partition_version=$([[ -n "${{ inputs.partition_version}}" ]] && echo ${{ inputs.partition_version}} || echo ${{ inputs.version }} )' >> "$GITHUB_OUTPUT"
142+
echo 'partition_version=$([[ -n "$PARTITION_VERSION" ]] && echo $PARTITION_VERSION || echo $VERSION )' >> "$GITHUB_OUTPUT"
138143
- name: Verify Layer
139144
run: |
140145
export layer_output='AWSLambdaPowertoolsTypeScriptV2-${{matrix.region}}.json'

‎.github/workflows/layers_partitions.yml‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -99,9 +99,11 @@ jobs:
9999
aws-region: us-east-1
100100
mask-aws-account-id: true
101101
- name: Grab Zip
102+
env:
103+
VERSION: ${{ inputs.version }}
102104
run: |
103-
aws --region us-east-1 lambda get-layer-version-by-arn --arn arn:aws:lambda:us-east-1:094274105915:layer:AWSLambdaPowertoolsTypeScriptV2:${{ inputs.version }} --query 'Content.Location' | xargs curl -L -o AWSLambdaPowertoolsTypeScriptV2.zip
104-
aws --region us-east-1 lambda get-layer-version-by-arn --arn arn:aws:lambda:us-east-1:094274105915:layer:AWSLambdaPowertoolsTypeScriptV2:${{ inputs.version }} > AWSLambdaPowertoolsTypeScriptV2.json
105+
aws --region us-east-1 lambda get-layer-version-by-arn --arn arn:aws:lambda:us-east-1:094274105915:layer:AWSLambdaPowertoolsTypeScriptV2:$VERSION --query 'Content.Location' | xargs curl -L -o AWSLambdaPowertoolsTypeScriptV2.zip
106+
aws --region us-east-1 lambda get-layer-version-by-arn --arn arn:aws:lambda:us-east-1:094274105915:layer:AWSLambdaPowertoolsTypeScriptV2:$VERSION > AWSLambdaPowertoolsTypeScriptV2.json
105107
- name: Store Zip
106108
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
107109
with:
@@ -182,6 +184,7 @@ jobs:
182184
- name: Verify Layer
183185
env:
184186
LAYER_VERSION: ${{ steps.create-layer.outputs.LAYER_VERSION }}
187+
ENVIRONMENT: ${{ inputs.environment }}
185188
run: |
186189
export layer_output='AWSLambdaPowertoolsTypeScriptV2-${{matrix.region}}.json'
187190
# Dynamic secret access is safe here - secrets are scoped per environment
@@ -192,7 +195,7 @@ jobs:
192195
REMOTE_DESCRIPTION=$(jq -r '.Description' $layer_output)
193196
LOCAL_DESCRIPTION=$(jq -r '.Description' AWSLambdaPowertoolsTypeScriptV2.json)
194197
test "$REMOTE_DESCRIPTION" == "$LOCAL_DESCRIPTION" && echo "Version number OK: ${LOCAL_DESCRIPTION}" || exit 1
195-
if [ "${{ inputs.environment }}" == "Prod" ]; then
198+
if [ "$ENVIRONMENT" == "Prod" ]; then
196199
REMOTE_LAYER_VERSION=$(jq -r '.LayerVersionArn' $layer_output | sed 's/.*://')
197200
LOCAL_LAYER_VERSION=$(jq -r '.LayerVersionArn' AWSLambdaPowertoolsTypeScriptV2.json | sed 's/.*://')
198201
test "$REMOTE_LAYER_VERSION" == "$LOCAL_LAYER_VERSION" && echo "Layer Version number OK: ${LOCAL_LAYER_VERSION}" || exit 1

‎.github/workflows/publish_layer.yml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,9 @@ jobs:
4848
- name: Setup dependencies
4949
uses: aws-powertools/actions/.github/actions/cached-node-modules@29979bc5339bf54f76a11ac36ff67701986bb0f0
5050
- name: CDK build
51-
run: npm run cdk -w layers -- synth --context PowertoolsPackageVersion=${{ inputs.latest_published_version }} -o cdk.out
51+
env:
52+
LAYER_VERSION: ${{ inputs.latest_published_version }}
53+
run: npm run cdk -w layers -- synth --context PowertoolsPackageVersion=$LAYER_VERSION -o cdk.out
5254
- name: Zip output
5355
run: zip -r cdk.out.zip layers/cdk.out
5456
- name: Archive CDK artifacts

‎.github/workflows/reusable_publish_docs.yml‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -75,7 +75,9 @@ jobs:
7575
env:
7676
BRANCH: ${{ inputs.git_ref }}
7777
- name: Normalize Version Number
78-
run: echo "VERSION=$(echo ${{ inputs.version }} | sed 's/v//')" >> $GITHUB_ENV
78+
env:
79+
VERSION: ${{ inputs.version }}
80+
run: echo "VERSION=$(echo $VERSION | sed 's/v//')" >> $GITHUB_ENV
7981
- name: Build docs website and API reference
8082
env:
8183
ALIAS: ${{ inputs.alias }}
@@ -132,8 +134,8 @@ jobs:
132134
aws s3 cp \
133135
s3://$AWS_DOCS_BUCKET/lambda-typescript/versions.json \
134136
versions_old.json
135-
jq 'del(.[].aliases[] | select(. == "${{ env.ALIAS }}"))' < versions_old.json > versions_proc.json
136-
jq '. as $o | [{"title": "${{ env.VERSION }}", "version": "${{ env.VERSION }}", "aliases": ["${{ env.ALIAS }}"] }] as $n | $n | if .[0].title | test("[a-z]+") or any($o[].title == $n[0].title;.) then [($o | .[] | select(.title == $n[0].title).aliases += $n[0].aliases | . )] else $n + $o end' < versions_proc.json > versions.json
137+
jq 'del(.[].aliases[] | select(. == "$ALIAS"))' < versions_old.json > versions_proc.json
138+
jq '. as $o | [{"title": "$VERSION", "version": "$VERSION", "aliases": ["$ALIAS"]}] as $n | $n | if .[0].title | test("[a-z]+") or any($o[].title == $n[0].title;.) then [($o | .[] | select(.title == $n[0].title).aliases += $n[0].aliases | . )] else $n + $o end' < versions_proc.json > versions.json
137139
aws s3 cp \
138140
versions.json \
139141
s3://$AWS_DOCS_BUCKET/lambda-typescript/versions.json

‎.github/workflows/run-e2e-tests.yml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -44,8 +44,10 @@ jobs:
4444
# we checkout the PR at that point in time
4545
- name: Checkout PR code
4646
if: ${{ inputs.prNumber != '' }}
47+
env:
48+
PR_NUMBER: ${{ inputs.prNumber }}
4749
run: |
48-
gh pr checkout ${{ inputs.prNumber }}
50+
gh pr checkout $PR_NUMBER
4951
- name: Setup Node.js
5052
uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
5153
with:

‎.github/workflows/update_ssm.yml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -129,9 +129,10 @@ jobs:
129129
mask-aws-account-id: true
130130
- id: write-version
131131
env:
132-
prefix: ${{ inputs.environment == 'beta' && '/aws/service/powertools/beta' || '/aws/service/powertools' }}
132+
PREFIX: ${{ inputs.environment == 'beta' && '/aws/service/powertools/beta' || '/aws/service/powertools' }}
133+
PACKAGE_VERSION: ${{ inputs.package_version }}
133134
run: |
134-
aws ssm put-parameter --name ${{ env.prefix }}/typescript/generic/all/${{ inputs.package_version }} --value "arn:aws:lambda:${{ matrix.region }}:094274105915:layer:AWSLambdaPowertoolsTypeScriptV2:${{ inputs.layer-version }}" --type String --overwrite
135+
aws ssm put-parameter --name $PREFIX/typescript/generic/all/$PACKAGE_VERSION --value "arn:aws:lambda:${{ matrix.region }}:094274105915:layer:AWSLambdaPowertoolsTypeScriptV2:${{ inputs.layer-version }}" --type String --overwrite
135136
136137
- id: write-latest
137138
if: inputs.write_latest == true

0 commit comments

Comments
 (0)