Skip to content

Make releaseNumberSDK configurable parameter in checkVersions.yml #3418

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 3 commits into
base: master
Choose a base branch
from
Open

Make releaseNumberSDK configurable parameter in checkVersions.yml #3418

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
0ff293c
Initial plan
Copilot Oct 18, 2025
96945ff
Make releaseNumberSDK configurable in checkVersions.yml
Copilot Oct 18, 2025
1198be7
Add validation for currentStreamVersionProperty parameter
Copilot Oct 18, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 16 additions & 4 deletions .github/workflows/checkVersions.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,11 @@ on:
type: string
required: false
default: '.'
currentStreamVersionProperty:
description: Maven property name to use for determining the stream version in commit messages
type: string
required: false
default: 'releaseNumberSDK'

permissions: {} # all none

Expand Down Expand Up @@ -89,11 +94,18 @@ jobs:
if [[ $(git diff --name-only --cached) != '' ]]; then
# Relevant files were staged, i.e. some version were changed

# Read 'releaseNumberSDK' property as stream version
# Validate property name to prevent injection
propertyName="${{ inputs.currentStreamVersionProperty }}"
if [[ ! "$propertyName" =~ ^[a-zA-Z0-9._-]+$ ]]; then
echo "::error::Invalid property name: $propertyName. Must contain only alphanumeric characters, dots, hyphens, and underscores."
exit 1
fi
Comment on lines +97 to +102
Copy link
Member

@HannesWell HannesWell Oct 18, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not sure if this is necessary as this job doesn't have any permissions:

eclipse.platform.releng.aggregator/.github/workflows/checkVersions.yml

Line 30 in 6b119f9

permissions: {} # all none

and with extra-setup-command we have another argument that is also executed as it is.
So this extra check does not really buy us extra safety and therefore I suggest to keep it simple and remove it.


# Read property as stream version
pushd ${{ inputs.working-directory }}
mvn help:evaluate -Dexpression=releaseNumberSDK ${{ inputs.extra-maven-args }} --quiet '-Doutput=releaseNumberSDK-value.txt'
streamVersion=$(<releaseNumberSDK-value.txt)
rm -f releaseNumberSDK-value.txt
mvn help:evaluate -Dexpression="$propertyName" ${{ inputs.extra-maven-args }} --quiet '-Doutput=currentStreamVersion-value.txt'
streamVersion=$(<currentStreamVersion-value.txt)
rm -f currentStreamVersion-value.txt
popd

git config --global user.email '${{ inputs.botMail }}'
Expand Down