[generate_manifest] let issue creation trigger the workflow #245
Conversation
WalkthroughThe generate-manifest GitHub Actions workflow now also triggers on issues (opened, labeled) with a guard to run only for “server submission” issues. It adds an issue-body URL extraction step and propagates that repo_url to subsequent steps and PR messages via fallback logic when inputs or client payload lack a URL. Changes
Sequence Diagram(s)sequenceDiagram
autonumber
actor User as Issue Author
participant GH as GitHub Issues
participant WF as generate-manifest Workflow
participant EX as Extract URL Step
participant GM as Generate Manifest
participant PR as Create Pull Request
User->>GH: Open/label issue
GH-->>WF: Trigger workflow (issues event)
WF->>WF: Check label == "server submission"
alt Labeled as server submission
WF->>EX: Parse issue body for https://github.com/... URL
EX-->>WF: repo_url (or fail if missing)
WF->>GM: Run with repo_url (fallback to EX output)
GM-->>WF: Manifest + branch name (uses repo_url fallback)
WF->>PR: Create PR with commit/PR body referencing repo_url
PR-->>User: PR opened
else Not labeled
WF-->>GH: Exit without actions
end
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Poem
Tip 🔌 Remote MCP (Model Context Protocol) integration is now available!Pro plan users can now connect to remote MCP servers from the Integrations page. Connect with popular remote MCPs such as Notion and Linear to add more context to your reviews and chats. ✨ Finishing Touches🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR/Issue comments)Type Other keywords and placeholders
CodeRabbit Configuration File (
|
PR Reviewer Guide 🔍Here are some key observations to aid the review process:
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
PR Code Suggestions ✨Explore these optional code suggestions:
|
||||||||||||
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
| ANYON_API_KEY: ${{ secrets.ANYON_API_KEY }} | ||
| run: | | ||
| REPO_URL="${{ github.event.inputs.repo_url || github.event.client_payload.repo_url }}" | ||
| REPO_URL="${{ github.event.inputs.repo_url || github.event.client_payload.repo_url || steps.extract-url.outputs.repo_url }}" |
Check failure
Code scanning / CodeQL
Code injection Critical
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 3 months ago
To fix this code injection vulnerability, we should avoid interpolating untrusted input directly into the shell command using ${{ ... }}. Instead, we should assign the untrusted value to an environment variable using the env: key, and then reference it in the shell command using native shell variable syntax ($REPO_URL). This prevents shell injection because the shell will treat the value as a single argument, not as code. Specifically, in the "Generate manifest" and "Extract repo name for branch" steps, move the expression for the repository URL into the env: block, and reference it as $REPO_URL in the run: block. No additional dependencies are required.
| @@ -63,14 +63,15 @@ | ||
| - name: Generate manifest | ||
| env: | ||
| ANYON_API_KEY: ${{ secrets.ANYON_API_KEY }} | ||
| REPO_URL: ${{ github.event.inputs.repo_url || github.event.client_payload.repo_url || steps.extract-url.outputs.repo_url }} | ||
| run: | | ||
| REPO_URL="${{ github.event.inputs.repo_url || github.event.client_payload.repo_url || steps.extract-url.outputs.repo_url }}" | ||
| python scripts/get_manifest.py "$REPO_URL" | ||
|
|
||
| - name: Extract repo name for branch | ||
| id: repo-info | ||
| env: | ||
| REPO_URL: ${{ github.event.inputs.repo_url || github.event.client_payload.repo_url || steps.extract-url.outputs.repo_url }} | ||
| run: | | ||
| REPO_URL="${{ github.event.inputs.repo_url || github.event.client_payload.repo_url || steps.extract-url.outputs.repo_url }}" | ||
| REPO_NAME=$(echo "$REPO_URL" | sed 's/.*github\.com[:/]//' | sed 's/\.git$//' | tr '/' '-') | ||
| echo "repo_name=$REPO_NAME" >> $GITHUB_OUTPUT | ||
| echo "branch_name=add-manifest-$REPO_NAME" >> $GITHUB_OUTPUT |
| id: repo-info | ||
| run: | | ||
| REPO_URL="${{ github.event.inputs.repo_url || github.event.client_payload.repo_url }}" | ||
| REPO_URL="${{ github.event.inputs.repo_url || github.event.client_payload.repo_url || steps.extract-url.outputs.repo_url }}" |
Check failure
Code scanning / CodeQL
Code injection Critical
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 3 months ago
To fix the code injection vulnerability, we should avoid using ${{ ... }} interpolation of untrusted input directly in the shell command. Instead, we should assign the untrusted input to an environment variable using the env: block, and then reference it using native shell syntax ("$REPO_URL") in the run: block. Specifically, in the steps "Generate manifest" and "Extract repo name for branch", move the assignment of REPO_URL to the env: block, and update the shell commands to use $REPO_URL directly. This change should be made in lines 64-68 and 72-74. No new methods or imports are needed, just a change in how the input is passed to the shell.
| @@ -63,14 +63,15 @@ | ||
| - name: Generate manifest | ||
| env: | ||
| ANYON_API_KEY: ${{ secrets.ANYON_API_KEY }} | ||
| REPO_URL: ${{ github.event.inputs.repo_url || github.event.client_payload.repo_url || steps.extract-url.outputs.repo_url }} | ||
| run: | | ||
| REPO_URL="${{ github.event.inputs.repo_url || github.event.client_payload.repo_url || steps.extract-url.outputs.repo_url }}" | ||
| python scripts/get_manifest.py "$REPO_URL" | ||
|
|
||
| - name: Extract repo name for branch | ||
| id: repo-info | ||
| env: | ||
| REPO_URL: ${{ github.event.inputs.repo_url || github.event.client_payload.repo_url || steps.extract-url.outputs.repo_url }} | ||
| run: | | ||
| REPO_URL="${{ github.event.inputs.repo_url || github.event.client_payload.repo_url || steps.extract-url.outputs.repo_url }}" | ||
| REPO_NAME=$(echo "$REPO_URL" | sed 's/.*github\.com[:/]//' | sed 's/\.git$//' | tr '/' '-') | ||
| echo "repo_name=$REPO_NAME" >> $GITHUB_OUTPUT | ||
| echo "branch_name=add-manifest-$REPO_NAME" >> $GITHUB_OUTPUT |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
♻️ Duplicate comments (2)
.github/workflows/generate-manifest.yml (2)
67-69: Fix CodeQL “code injection” finding: don’t inline expressions into shell scriptsInlining the expression into the run script can allow command substitution at parse time if the value contains $() or backticks. Move the interpolation to the step’s env and use the variable in the script.
Apply this diff:
- name: Generate manifest env: ANYON_API_KEY: ${{ secrets.ANYON_API_KEY }} + REPO_URL: ${{ github.event.inputs.repo_url || github.event.client_payload.repo_url || steps.extract-url.outputs.repo_url }} run: | - REPO_URL="${{ github.event.inputs.repo_url || github.event.client_payload.repo_url || steps.extract-url.outputs.repo_url }}" python scripts/get_manifest.py "$REPO_URL"Optional: Add a preceding “Validate repository URL” step to enforce the same strict regex before use. I can provide that if you want it wired in.
71-76: Fix CodeQL “code injection” finding and quote GITHUB_OUTPUTSame issue here. Also, quote $GITHUB_OUTPUT and enable strict bash flags.
Apply this diff:
- name: Extract repo name for branch id: repo-info + env: + REPO_URL: ${{ github.event.inputs.repo_url || github.event.client_payload.repo_url || steps.extract-url.outputs.repo_url }} run: | - REPO_URL="${{ github.event.inputs.repo_url || github.event.client_payload.repo_url || steps.extract-url.outputs.repo_url }}" + set -Eeuo pipefail REPO_NAME=$(echo "$REPO_URL" | sed 's/.*github\.com[:/]//' | sed 's/\.git$//' | tr '/' '-') - echo "repo_name=$REPO_NAME" >> $GITHUB_OUTPUT - echo "branch_name=add-manifest-$REPO_NAME" >> $GITHUB_OUTPUT + echo "repo_name=$REPO_NAME" >> "$GITHUB_OUTPUT" + echo "branch_name=add-manifest-$REPO_NAME" >> "$GITHUB_OUTPUT"
🧹 Nitpick comments (2)
.github/workflows/generate-manifest.yml (2)
46-62: Harden URL extraction from issue body and avoid logging the entire bodyTighten the regex to avoid capturing trailing punctuation, enable strict bash mode, quote GITHUB_OUTPUT, and avoid echoing the full issue body to logs.
Apply this diff:
- name: Extract repository URL from issue id: extract-url if: github.event_name == 'issues' + shell: bash env: ISSUE_BODY: ${{ github.event.issue.body }} run: | + set -Eeuo pipefail # Extract the repository URL from the GitHub issue form # The form renders the repository field as a URL line after the label - REPO_URL=$(echo "$ISSUE_BODY" | grep -oP 'https://github\.com/[^\s]+' | head -1) + REPO_URL=$(printf '%s' "$ISSUE_BODY" | grep -oE 'https://github\.com/[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+(\.git)?' | head -1) if [ -z "$REPO_URL" ]; then echo "No GitHub repository URL found in issue body" - echo "Issue body: $ISSUE_BODY" exit 1 fi + if ! printf '%s' "$REPO_URL" | grep -Eq '^https://github\.com/[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+(\.git)?/?$'; then + echo "Invalid GitHub repository URL: $REPO_URL" + exit 1 + fi echo "Found repository URL: $REPO_URL" - echo "repo_url=$REPO_URL" >> $GITHUB_OUTPUT + echo "repo_url=$REPO_URL" >> "$GITHUB_OUTPUT"
85-86: Trim trailing spaces to satisfy YAMLlintRemove trailing spaces on these lines to make YAMLlint happy.
Apply this diff:
- Generated manifest JSON for repository: ${{ github.event.inputs.repo_url || github.event.client_payload.repo_url || steps.extract-url.outputs.repo_url }} - + Generated manifest JSON for repository: ${{ github.event.inputs.repo_url || github.event.client_payload.repo_url || steps.extract-url.outputs.repo_url }} + @@ - +Also applies to: 91-91
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (1)
.github/workflows/generate-manifest.yml(3 hunks)
🧰 Additional context used
🪛 GitHub Check: CodeQL
.github/workflows/generate-manifest.yml
[failure] 67-67: Code injection
Potential code injection in ${{ github.event.inputs.repo_url || github.event.client_payload.repo_url || steps.extract-url.outputs.repo_url }}, which may be controlled by an external user (issues).
[failure] 73-73: Code injection
Potential code injection in ${{ github.event.inputs.repo_url || github.event.client_payload.repo_url || steps.extract-url.outputs.repo_url }}, which may be controlled by an external user (issues).
🪛 YAMLlint (1.37.1)
.github/workflows/generate-manifest.yml
[error] 86-86: trailing spaces
(trailing-spaces)
[error] 91-91: trailing spaces
(trailing-spaces)
🔇 Additional comments (2)
.github/workflows/generate-manifest.yml (2)
12-13: Issues trigger added — looks correctThe new issues trigger (opened, labeled) is wired correctly and complements the existing dispatch triggers.
18-18: Guard condition correctly restricts to labeled “server submission” issuesThe job-level if prevents execution except for issues that have the “server submission” label. Good balance vs. trigger scope.
|
🎉 This PR is included in version 2.7.1 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
PR Type
Enhancement
Description
Add GitHub issue trigger to generate-manifest workflow
Extract repository URL from issue body automatically
Support 'server submission' labeled issues for manifest generation
Update all workflow steps to handle issue-based repository URLs
Diagram Walkthrough
File Walkthrough
generate-manifest.yml
Add issue-based workflow trigger and URL extraction.github/workflows/generate-manifest.yml
issuestrigger withopenedandlabeledevent typesissues
Summary by CodeRabbit
New Features
Chores