Skip to content

Commit fe616de

Browse files
ActoryOuActoryOu
authored
Follow Security Guide to update YAML files. (#1925)
* Follow Security Guide to update YAML files. * Update checkout version to v4
1 parent fa50223 commit fe616de

File tree

3 files changed

+46
-21
lines changed

3 files changed

+46
-21
lines changed

‎.github/workflows/tag-and-zip.yml‎

Lines changed: 26 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -16,22 +16,27 @@ jobs:
1616
runs-on: ubuntu-20.04
1717
steps:
1818
- name: Checkout code
19-
uses: actions/checkout@v2
19+
uses: actions/checkout@v4
2020
with:
2121
ref: ${{ github.event.inputs.commit_id }}
2222
- name: Configure git identity
2323
run: |
2424
git config --global user.name "Release Workflow"
2525
- name: Tag Commit and Push to remote
26+
env:
27+
VERSION_NUMBER: ${{ github.event.inputs.version_number }}
2628
run: |
27-
git tag ${{ github.event.inputs.version_number }} -a -m "AWS IoT Device SDK for Embedded C version ${{ github.event.inputs.version_number }}"
29+
git tag "$VERSION_NUMBER" -a -m "AWS IoT Device SDK for Embedded C version $VERSION_NUMBER"
2830
git push origin --tags
2931
- name: Verify tag on remote
32+
env:
33+
VERSION_NUMBER: ${{ github.event.inputs.version_number }}
34+
COMMIT_ID: ${{ github.event.inputs.commit_id }}
3035
run: |
31-
git tag -d ${{ github.event.inputs.version_number }}
36+
git tag -d "$VERSION_NUMBER"
3237
git remote update
33-
git checkout tags/${{ github.event.inputs.version_number }}
34-
git diff ${{ github.event.inputs.commit_id }} tags/${{ github.event.inputs.version_number }}
38+
git checkout tags/"$VERSION_NUMBER"
39+
git diff "$COMMIT_ID" tags/"$VERSION_NUMBER"
3540
create-zip:
3641
needs: tag-commit
3742
name: Create ZIP and verify package for release asset.
@@ -40,7 +45,7 @@ jobs:
4045
- name: Install ZIP tools
4146
run: sudo apt-get install zip unzip
4247
- name: Checkout code
43-
uses: actions/checkout@v2
48+
uses: actions/checkout@v4
4449
with:
4550
ref: ${{ github.event.inputs.commit_id }}
4651
path: aws-iot-device-sdk-embedded-C
@@ -54,18 +59,22 @@ jobs:
5459
zip -r aws-iot-device-sdk-embedded-C-${{ github.event.inputs.version_number }}.zip aws-iot-device-sdk-embedded-C -x "*.git*"
5560
ls ./
5661
- name: Validate created ZIP
62+
env:
63+
VERSION_NUMBER: ${{ github.event.inputs.version_number }}
5764
run: |
5865
mkdir zip-check
59-
mv aws-iot-device-sdk-embedded-C-${{ github.event.inputs.version_number }}.zip zip-check
66+
mv aws-iot-device-sdk-embedded-C-"$VERSION_NUMBER".zip zip-check
6067
cd zip-check
61-
unzip aws-iot-device-sdk-embedded-C-${{ github.event.inputs.version_number }}.zip -d aws-iot-device-sdk-embedded-C-${{ github.event.inputs.version_number }}
62-
ls aws-iot-device-sdk-embedded-C-${{ github.event.inputs.version_number }}
63-
diff -r -x "*.git*" aws-iot-device-sdk-embedded-C-${{ github.event.inputs.version_number }}/aws-iot-device-sdk-embedded-C/ ../aws-iot-device-sdk-embedded-C/
68+
unzip aws-iot-device-sdk-embedded-C-"$VERSION_NUMBER".zip -d aws-iot-device-sdk-embedded-C-"$VERSION_NUMBER"
69+
ls aws-iot-device-sdk-embedded-C-"$VERSION_NUMBER"
70+
diff -r -x "*.git*" aws-iot-device-sdk-embedded-C-"$VERSION_NUMBER"/aws-iot-device-sdk-embedded-C/ ../aws-iot-device-sdk-embedded-C/
6471
cd ../
6572
- name : Build Check Demos
73+
env:
74+
VERSION_NUMBER: ${{ github.event.inputs.version_number }}
6675
run: |
6776
sudo apt-get install -y libmosquitto-dev
68-
cd zip-check/aws-iot-device-sdk-embedded-C-${{ github.event.inputs.version_number }}/aws-iot-device-sdk-embedded-C/
77+
cd zip-check/aws-iot-device-sdk-embedded-C-"$VERSION_NUMBER"/aws-iot-device-sdk-embedded-C/
6978
cmake -S . -B build/ \
7079
-G "Unix Makefiles" \
7180
-DBUILD_DEMOS=1 \
@@ -89,8 +98,10 @@ jobs:
8998
make -C build/ help | grep demo | tr -d '. ' | xargs make -C build/ -j8
9099
make -C demos/jobs/jobs_demo_mosquitto -j8
91100
- name : Build Check Tests
101+
env:
102+
VERSION_NUMBER: ${{ github.event.inputs.version_number }}
92103
run: |
93-
cd zip-check/aws-iot-device-sdk-embedded-C-${{ github.event.inputs.version_number }}/aws-iot-device-sdk-embedded-C/
104+
cd zip-check/aws-iot-device-sdk-embedded-C-"$VERSION_NUMBER"/aws-iot-device-sdk-embedded-C/
94105
rm -rf ./build
95106
cmake -S . -B build/ \
96107
-G "Unix Makefiles" \
@@ -105,8 +116,10 @@ jobs:
105116
-DCLIENT_IDENTIFIER="ci-identifier"
106117
make -C build/ all -j8
107118
- name: Run Unit Tests
119+
env:
120+
VERSION_NUMBER: ${{ github.event.inputs.version_number }}
108121
run: |
109-
cd zip-check/aws-iot-device-sdk-embedded-C-${{ github.event.inputs.version_number }}/aws-iot-device-sdk-embedded-C/build/
122+
cd zip-check/aws-iot-device-sdk-embedded-C-"$VERSION_NUMBER"/aws-iot-device-sdk-embedded-C/build/
110123
ctest -E system --output-on-failure
111124
cd ..
112125
- name: Create artifact of ZIP

‎.github/workflows/update-submodules.yml‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25,8 +25,10 @@ jobs:
2525
run: |
2626
git config --global user.name "Submodule Updater"
2727
- name: Update the submodules
28+
env:
29+
ALLOWED: ${{ github.event.inputs.allowed }}
2830
run: |
29-
libs=$(find libraries/standard libraries/aws -maxdepth 1 -mindepth 1 | grep "${{ github.event.inputs.allowed }}")
31+
libs=$(find libraries/standard libraries/aws -maxdepth 1 -mindepth 1 | grep "$ALLOWED")
3032
git submodule update --remote $libs
3133
- name: Commit changes and Push to remote
3234
run: |
@@ -38,5 +40,6 @@ jobs:
3840
- name: Raise a Pull-Request
3941
env:
4042
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
43+
BRANCH: ${{ github.event.inputs.branch }}
4144
run: |
42-
gh pr create --base ${{ github.event.inputs.branch }} --title 'Update library submodules to the latest' --body 'Update library submodules to the latest'
45+
gh pr create --base "$BRANCH" --title 'Update library submodules to the latest' --body 'Update library submodules to the latest'

‎.github/workflows/version-updater.yml‎

Lines changed: 15 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -19,26 +19,35 @@ jobs:
1919
runs-on: ubuntu-latest
2020
steps:
2121
- name: Checkout code
22-
uses: actions/checkout@v2
22+
uses: actions/checkout@v4
2323
with:
2424
ref: ${{ github.event.inputs.branch }}
2525
- name: Configure git identity
2626
run: |
2727
git config --global user.name "Version Updater"
2828
- name: Update source files with new version
29+
env:
30+
OLD_VERSION_NUMBER: ${{ github.event.inputs.old_version_number }}
31+
NEW_VERSION_NUMBER: ${{ github.event.inputs.new_version_number }}
2932
run: |
30-
grep -ilr ${{ github.event.inputs.old_version_number }} . | grep -Ev ".git|CHANGELOG.md|README.md|CONTRIBUTING.md" | xargs sed -i s/${{ github.event.inputs.old_version_number }}/${{ github.event.inputs.new_version_number }}/g
33+
grep -ilr "$OLD_VERSION_NUMBER" . | grep -Ev ".git|CHANGELOG.md|README.md|CONTRIBUTING.md" | xargs sed -i s/"$OLD_VERSION_NUMBER"/"$NEW_VERSION_NUMBER"/g
3134
- name: Commit changes and Push to remote
35+
env:
36+
OLD_VERSION_NUMBER: ${{ github.event.inputs.old_version_number }}
37+
NEW_VERSION_NUMBER: ${{ github.event.inputs.new_version_number }}
3238
run: |
33-
git checkout -b updater-job/update-to-${{ github.event.inputs.new_version_number }}
34-
git commit -am 'Update versioning in file from ${{ github.event.inputs.old_version_number }} to ${{ github.event.inputs.new_version_number }}'
35-
git push --set-upstream origin updater-job/update-to-${{ github.event.inputs.new_version_number }}
39+
git checkout -b updater-job/update-to-"$NEW_VERSION_NUMBER"
40+
git commit -am "Update versioning in file from "$OLD_VERSION_NUMBER" to $NEW_VERSION_NUMBER"
41+
git push --set-upstream origin updater-job/update-to-"$NEW_VERSION_NUMBER"
3642
- name: Raise a Pull-Request
3743
env:
3844
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
45+
OLD_VERSION_NUMBER: ${{ github.event.inputs.old_version_number }}
46+
NEW_VERSION_NUMBER: ${{ github.event.inputs.new_version_number }}
47+
BRANCH: ${{ github.event.inputs.branch }}
3948
run: |
4049
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-key 23F3D4EA75716059
4150
sudo apt-add-repository https://cli.github.com/packages
4251
sudo apt update
4352
sudo apt-get install gh
44-
gh pr create --base ${{ github.event.inputs.branch }} --title 'Update source file versioning to ${{ github.event.inputs.new_version_number }}' --body 'Updater-Job: PR to update versioning in source files from ${{ github.event.inputs.old_version_numver }} to ${{ github.event.inputs.new_version_number }}'
53+
gh pr create --base "$BRANCH" --title "Update source file versioning to $NEW_VERSION_NUMBER" --body "Updater-Job: PR to update versioning in source files from $OLD_VERSION_NUMBER to $NEW_VERSION_NUMBER"

0 commit comments

Comments
 (0)