Skip to content

Commit f457537

Browse files
author
Alvaro Muñoz
committed
feat(bash): Add support for tee as a way to write to GITHUB special files
1 parent def1704 commit f457537

File tree

4 files changed

+366
-12
lines changed

4 files changed

+366
-12
lines changed

‎ql/lib/codeql/actions/Helper.qll

Lines changed: 12 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -74,9 +74,10 @@ predicate extractVariableAndValue(string raw_content, string key, string value)
7474
bindingset[script]
7575
predicate singleLineFileWrite(string script, string cmd, string file, string content, string filters) {
7676
exists(string regexp |
77-
regexp = "(?i)(echo|printf|write-output)\\s*(.*?)\\s*(>>|>)\\s*(\\S+)" and
77+
regexp =
78+
"(?i)(echo|printf|write-output)\\s*(.*?)\\s*(>>|>|\\s*\\|\\s*tee\\s*(-a|--append)?)\\s*(\\S+)" and
7879
cmd = script.regexpCapture(regexp, 1) and
79-
file = trimQuotes(script.regexpCapture(regexp, 4)) and
80+
file = trimQuotes(script.regexpCapture(regexp, 5)) and
8081
filters = "" and
8182
content = script.regexpCapture(regexp, 2)
8283
)
@@ -100,18 +101,19 @@ predicate singleLineWorkflowCmd(string script, string cmd, string key, string va
100101
bindingset[script]
101102
predicate heredocFileWrite(string script, string cmd, string file, string content, string filters) {
102103
exists(string regexp |
103-
regexp = "(?msi).*^(cat)\\s*(>>|>)\\s*(\\S+)\\s*<<\\s*['\"]?(\\S+)['\"]?\\s*\n(.*?)\n\\4\\s*$.*" and
104+
regexp =
105+
"(?msi).*^(cat)\\s*(>>|>|\\s*\\|\\s*tee\\s*(-a|--append)?)\\s*(\\S+)\\s*<<\\s*['\"]?(\\S+)['\"]?\\s*\n(.*?)\n\\4\\s*$.*" and
104106
cmd = script.regexpCapture(regexp, 1) and
105-
file = trimQuotes(script.regexpCapture(regexp, 3)) and
106-
content = script.regexpCapture(regexp, 5) and
107+
file = trimQuotes(script.regexpCapture(regexp, 4)) and
108+
content = script.regexpCapture(regexp, 6) and
107109
filters = ""
108110
or
109111
regexp =
110-
"(?msi).*^(cat)\\s*(<<|<)\\s*[-]?['\"]?(\\S+)['\"]?\\s*([^>]*)(>>|>)\\s*(\\S+)\\s*\n(.*?)\n\\3\\s*$.*" and
112+
"(?msi).*^(cat)\\s*(<<|<)\\s*[-]?['\"]?(\\S+)['\"]?\\s*([^>]*)(>>|>|\\s*\\|\\s*tee\\s*(-a|--append)?)\\s*(\\S+)\\s*\n(.*?)\n\\3\\s*$.*" and
111113
cmd = script.regexpCapture(regexp, 1) and
112-
file = trimQuotes(script.regexpCapture(regexp, 6)) and
114+
file = trimQuotes(script.regexpCapture(regexp, 7)) and
113115
filters = script.regexpCapture(regexp, 4) and
114-
content = script.regexpCapture(regexp, 7)
116+
content = script.regexpCapture(regexp, 8)
115117
)
116118
}
117119

@@ -142,13 +144,13 @@ predicate blockFileWrite(string script, string cmd, string file, string content,
142144
//
143145
"(.*?)" +
144146
//
145-
"(\\s*\\}\\s*(>>|>)\\s*(\\S+))\\s*$.*" and
147+
"(\\s*\\}\\s*(>>|>|\\s*\\|\\s*tee\\s*(-a|--append)?)\\s*(\\S+))\\s*$.*" and
146148
content =
147149
script
148150
.regexpCapture(regexp, 1)
149151
.regexpReplaceAll("(?m)^\\s*(echo|printf|write-output)\\s*['\"](.*?)['\"]", "$2")
150152
.regexpReplaceAll("(?m)^\\s*(echo|printf|write-output)\\s*", "") and
151-
file = trimQuotes(script.regexpCapture(regexp, 4)) and
153+
file = trimQuotes(script.regexpCapture(regexp, 5)) and
152154
cmd = "echo" and
153155
filters = ""
154156
)

‎ql/test/library-tests/.github/workflows/multiline2.yml

Lines changed: 89 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
on:
2+
workflow_run:
3+
workflows: ["Prev"]
4+
types:
5+
- completed
6+
7+
jobs:
8+
Test:
9+
runs-on: ubuntu-latest
10+
steps:
11+
- run: |
12+
echo "changelog<<CHANGELOGEOF" | tee -a $GITHUB_OUTPUT
13+
echo -e "$FILTERED_CHANGELOG" | tee -a $GITHUB_OUTPUT
14+
echo "CHANGELOGEOF" | tee -a $GITHUB_OUTPUT
15+
- run: |
16+
EOF=$(dd if=/dev/urandom bs=15 count=1 status=none | base64)
17+
echo "status<<$EOF" | tee -a $GITHUB_OUTPUT
18+
echo "$(cat status.output.json)" | tee -a $GITHUB_OUTPUT
19+
echo "$EOF" | tee -a $GITHUB_OUTPUT
20+
- run: |
21+
echo "response<<$EOF" | tee -a $GITHUB_OUTPUT
22+
echo $output | tee -a $GITHUB_OUTPUT
23+
echo "$EOF" | tee -a $GITHUB_OUTPUT
24+
- run: |
25+
{
26+
echo 'JSON_RESPONSE<<EOF'
27+
ls | grep -E "*.(tar.gz|zip)$"
28+
echo EOF
29+
} | tee -a "$GITHUB_ENV"
30+
- run: |
31+
cat <<-"EOF" > event.json
32+
${{ toJson(github.event) }}
33+
EOF
34+
- name: heredoc11
35+
run: |
36+
cat | tee -a $GITHUB_ENV << EOL
37+
${ISSUE_BODY}
38+
FOO
39+
EOL
40+
- name: heredoc12
41+
run: |
42+
cat > issue.txt << EOL
43+
${ISSUE_BODY}
44+
FOO
45+
EOL
46+
- name: heredoc21
47+
run: |
48+
cat << EOL | tee -a $GITHUB_ENV
49+
${ISSUE_BODY}
50+
FOO
51+
EOL
52+
- name: heredoc22
53+
run: |
54+
cat <<EOF | sed 's/l/e/g' > file.txt
55+
Hello
56+
World
57+
EOF
58+
- name: heredoc23
59+
run: |
60+
cat <<-EOF | tee -a "$GITHUB_ENV"
61+
echo "FOO=$TITLE"
62+
EOF
63+
- name: line1
64+
run: |
65+
echo REPO_NAME=$(cat issue.txt | sed 's/\\r/\\n/g' | grep -ioE '\\s*[a-z0-9_-]+/[a-z0-9_-]+\\s*$' | tr -d ' ') | tee -a $GITHUB_ENV
66+
- name: multiline1
67+
run: |
68+
echo "PR_TITLE<<EOF" | tee -a $GITHUB_ENV
69+
echo "$TITLE" | tee -a $GITHUB_ENV
70+
echo "EOF" | tee -a $GITHUB_ENV
71+
- name: block11
72+
run: |
73+
{
74+
echo 'JSON_RESPONSE<<EOF'
75+
echo "$TITLE"
76+
echo EOF
77+
} | tee -a "$GITHUB_ENV"
78+
- name: block12
79+
run: |
80+
{
81+
echo 'JSON_RESPONSE<<EOF'
82+
echo '$ISSUE'
83+
echo 'EOF'
84+
} | tee -a "$GITHUB_ENV"
85+
- name: block13
86+
run: |
87+
{
88+
echo 'JSON_RESPONSE<<EOF'
89+
} | tee -a "$GITHUB_ENV"

‎ql/test/library-tests/poisonable_steps.expected

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
| .github/workflows/multiline2.yml:24:9:30:6 | Run Step |
2+
| .github/workflows/multiline2.yml:63:9:66:6 | Run Step |
13
| .github/workflows/multiline.yml:24:9:30:6 | Run Step |
24
| .github/workflows/multiline.yml:63:9:66:6 | Run Step |
35
| .github/workflows/poisonable_steps.yml:8:9:13:6 | Uses Step |

0 commit comments

Comments
 (0)