Make releaseNumberSDK configurable parameter in checkVersions.yml #3418
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Co-authored-by: laeubi <[email protected]>
Co-authored-by: laeubi <[email protected]>
Copilot
AI
changed the title
[WIP] Make releaseNumberSDK configurable in checkVersions.yml
Make releaseNumberSDK configurable parameter in checkVersions.yml
Oct 18, 2025
Copilot finished work on behalf of
laeubi
October 18, 2025 10:16
laeubi
approved these changes
Oct 18, 2025
HannesWell
reviewed
Oct 18, 2025
Comment on lines
+97
to
+102
| # Validate property name to prevent injection | ||
| propertyName="${{ inputs.currentStreamVersionProperty }}" | ||
| if [[ ! "$propertyName" =~ ^[a-zA-Z0-9._-]+$ ]]; then | ||
| echo "::error::Invalid property name: $propertyName. Must contain only alphanumeric characters, dots, hyphens, and underscores." | ||
| exit 1 | ||
| fi |
There was a problem hiding this comment.
I'm not sure if this is necessary as this job doesn't have any permissions:
and with extra-setup-command we have another argument that is also executed as it is.
So this extra check does not really buy us extra safety and therefore I suggest to keep it simple and remove it.
|
@laeubi how should we proceed here? |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Problem
The
checkVersions.ymlworkflow currently hardcodes the Maven property namereleaseNumberSDKfor determining the stream version used in commit messages. Different projects may need to use different Maven property names for this purpose, making the workflow less flexible.Solution
This PR adds a new optional input parameter
currentStreamVersionPropertyto thecheckVersions.ymlworkflow, allowing callers to specify which Maven property to use for determining the stream version.Changes
currentStreamVersionPropertywith a default value of'releaseNumberSDK'to maintain backward compatibility^[a-zA-Z0-9._-]+$) to prevent potential Maven expression injection attacksreleaseNumberSDKto use the configurable parameterBackward Compatibility
This change is fully backward compatible. Existing workflows that call
checkVersions.yml(such aspr-checks.yml) will continue to work without any modifications, as the parameter has a sensible default value.Usage Examples
Default behavior (uses
releaseNumberSDK):Custom property:
Security
Added input validation to prevent injection attacks. The parameter must contain only alphanumeric characters, dots, hyphens, and underscores. Any invalid input will result in a clear error message and workflow failure.
Fixes the issue by making the stream version property configurable while maintaining security and backward compatibility.
Original prompt
✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.