Skip to content

Commit d22cdfe

Browse files
[UPDATE] Multiple Version Bumps and CI enhancements
5 parents 4de8d11 + d05c633 + 56aaa06 + 8c1e121 + 408fcd1 commit d22cdfe

File tree

12 files changed

+318
-66
lines changed

12 files changed

+318
-66
lines changed

.github/actions/check-control/action.yml

Lines changed: 122 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -107,9 +107,75 @@ runs:
107107
using: composite
108108
steps:
109109
- id: output_sha
110-
if: ${{ !cancelled() }}
110+
if: ${{ (github.repository == 'reactive-firewall-org/multicast') && !cancelled() }}
111+
env:
112+
CI_INPUT_TARGET_SHA: '${{ inputs.sha }}'
111113
shell: bash
112-
run: printf "sha=%s\n" $(git rev-parse --verify '${{ inputs.sha }}') >> "$GITHUB_OUTPUT"
114+
run: |
115+
set -euo pipefail
116+
117+
raw_input="${CI_INPUT_TARGET_SHA}"
118+
119+
# Reject NUL or newline immediately
120+
if printf '%s' "$raw_input" | grep -q '[^[:print:]]'; then
121+
printf "::error title='Invalid':: %s\n" "Error: input contains disallowed control characters" >&2
122+
exit 1
123+
fi
124+
125+
# Strip one level of surrounding quotes and trim whitespace
126+
normalize() {
127+
local s="$1"
128+
s="${s#"${s%%[![:space:]]*}"}"
129+
s="${s%"${s##*[![:space:]]}"}"
130+
if [[ (${s:0:1} == "'" && ${s: -1} == "'") || (${s:0:1} == '"' && ${s: -1} == '"') ]]; then
131+
s="${s:1:-1}"
132+
fi
133+
printf '%s' "$s"
134+
}
135+
input="$(normalize "$raw_input")"
136+
137+
# Reject inputs starting with '-' (options)
138+
if [[ "${input:0:1}" == "-" ]]; then
139+
printf "::error title='Invalid':: %s\n" "Error: input may not start with '-'" >&2
140+
exit 1
141+
fi
142+
143+
# If it's a 40-char SHA, accept directly
144+
if [[ "$input" =~ ^[0-9a-f]{40}$ ]]; then
145+
resolved_sha="$input"
146+
else
147+
# Try explicit namespaces in order: full refs, refs/heads/, refs/tags/, then bare branch/tag
148+
resolved_sha=""
149+
# 1) If input is a full ref path starting with refs/, resolve only that
150+
if [[ "$input" == refs/* ]]; then
151+
if git rev-parse --verify "$input" >/dev/null 2>&1; then
152+
resolved_sha="$(git rev-parse --verify "$input")"
153+
else
154+
printf "::error title='Invalid':: %s\n" "Error: ref not found: $input" >&2
155+
exit 1
156+
fi
157+
else
158+
# 2) Try refs/heads/<input>
159+
if git rev-parse --verify "refs/heads/$input" >/dev/null 2>&1; then
160+
resolved_sha="$(git rev-parse --verify "refs/heads/$input")"
161+
# 3) Try refs/tags/<input>
162+
elif git rev-parse --verify "refs/tags/$input" >/dev/null 2>&1; then
163+
resolved_sha="$(git rev-parse --verify "refs/tags/$input")"
164+
else
165+
printf "::error title='Invalid':: %s\n" "Error: no matching branch or tag found for: $input" >&2
166+
exit 1
167+
fi
168+
fi
169+
fi
170+
171+
# Ensure final resolved value is a full 40-char commit SHA
172+
if [[ ! "$resolved_sha" =~ ^[0-9a-f]{40}$ ]]; then
173+
printf "::error title='Invalid':: %s\n" "Error: resolved value is not a full commit SHA" >&2
174+
exit 1
175+
fi
176+
177+
printf "sha=%s\n" "$resolved_sha" >> "$GITHUB_OUTPUT"
178+
113179
- id: output_uuid
114180
if: ${{ !cancelled() && (inputs.check-id == '') }}
115181
shell: bash
@@ -128,7 +194,7 @@ runs:
128194
if: ${{ !cancelled() && (github.repository == 'reactive-firewall-org/multicast') }}
129195
shell: bash
130196
run: |
131-
if [[ "${{ inputs.details-url }}" != "" ]] ; then
197+
if [[ "${{ inputs.details-url }}" != "DEFAULT" ]] ; then
132198
printf "details_url=%s\n" '${{ inputs.details-url }}' >> "$GITHUB_OUTPUT"
133199
printf "::debug:: %s\n" "Check detail url was provided: ${{ inputs.details-url }}" ;
134200
else
@@ -151,17 +217,28 @@ runs:
151217
shell: bash
152218
env:
153219
GH_TOKEN: ${{ inputs.token }}
220+
CHECK_NAME_INPUT: '${{ inputs.name }}'
221+
CHECK_TITLE_INPUT: '${{ inputs.title || inputs.name }}'
154222
run: |
223+
printf "%s\n" "::group::validate-name"
224+
name_input=${CHECK_NAME_INPUT}
225+
printf "::debug:: %s\n" "Will use name $name_input" ;
226+
printf "%s\n" "::endgroup::"
227+
printf "%s\n" "::group::validate-title"
228+
title_input=${CHECK_TITLE_INPUT}
229+
printf "::debug:: %s\n" "Will use name $title_input" ;
230+
sanitized_input_title_field=$(printf "%s%s" 'output[title]=' "$title_input" ;)
231+
printf "%s\n" "::endgroup::"
155232
printf "%s\n" "::group::create-new-check"
156233
# GitHub CLI api
157234
# https://cli.github.com/manual/gh_api
158235
CHECK_ID=$(gh api --method POST -H "Accept: application/vnd.github+json" \
159236
/repos/reactive-firewall-org/multicast/check-runs \
160-
-f "name=${{ inputs.name }}" -f "head_sha=${{ steps.output_sha.outputs.sha }}" \
161-
-f "status=${{ inputs.status }}" -f "external_id=${{ steps.output_uuid.outputs.uuid }}" \
237+
-f "name=$name_input" -f "head_sha=${{ steps.output_sha.outputs.sha }}" \
238+
-f 'status=${{ inputs.status }}' -f "external_id=${{ steps.output_uuid.outputs.uuid }}" \
162239
-f "started_at=${{ steps.output_date.outputs.check_date }}Z" \
163240
-f "details_url=${{ steps.output_check_details_url.outputs.details_url }}" \
164-
-f 'output[title]=${{ inputs.title }}' \
241+
-f "$sanitized_input_title_field" \
165242
-f 'output[summary]=' -f 'output[text]=' --jq '.id');
166243
printf "check_id=%s\n" "${CHECK_ID}" >> "$GITHUB_OUTPUT"
167244
printf "%s\n" "::endgroup::"
@@ -171,17 +248,28 @@ runs:
171248
shell: bash
172249
env:
173250
GH_TOKEN: ${{ inputs.token }}
251+
CHECK_NAME_INPUT: '${{ inputs.name }}'
252+
CHECK_TITLE_INPUT: '${{ inputs.title || inputs.name }}'
174253
run: |
254+
printf "%s\n" "::group::validate-name"
255+
name_input=${CHECK_NAME_INPUT}
256+
printf "::debug:: %s\n" "Will use name $name_input" ;
257+
printf "%s\n" "::endgroup::"
258+
printf "%s\n" "::group::validate-title"
259+
title_input=${CHECK_TITLE_INPUT}
260+
printf "::debug:: %s\n" "Will use name $title_input" ;
261+
sanitized_input_title_field=$(printf "%s%s" 'output[title]=' "$title_input" ;)
262+
printf "%s\n" "::endgroup::"
175263
printf "%s\n" "::group::update-new-check"
176264
# GitHub CLI api
177265
# https://cli.github.com/manual/gh_api
178266
CHECK_ID=$(gh api --method POST -H "Accept: application/vnd.github+json" \
179267
/repos/reactive-firewall-org/multicast/check-runs \
180-
-f "name=${{ inputs.name }}" -f "head_sha=${{ steps.output_sha.outputs.sha }}" \
268+
-f "name=$name_input" -f "head_sha=${{ steps.output_sha.outputs.sha }}" \
181269
-f "status=in_progress" -f "external_id=${{ steps.output_uuid.outputs.uuid }}" \
182270
-f "started_at=${{ steps.output_date.outputs.check_date }}Z" \
183271
-f "details_url=${{ steps.output_check_details_url.outputs.details_url }}" \
184-
-f 'output[title]=${{ inputs.title }}' \
272+
-f "$sanitized_input_title_field" \
185273
-f 'output[summary]=Check is in progress.' -f 'output[text]=' --jq '.id');
186274
printf "check_id=%s\n" "${CHECK_ID}" >> "$GITHUB_OUTPUT"
187275
printf "%s\n" "::endgroup::"
@@ -215,16 +303,27 @@ runs:
215303
shell: bash
216304
env:
217305
GH_TOKEN: ${{ inputs.token }}
306+
CHECK_NAME_INPUT: '${{ inputs.name }}'
307+
CHECK_TITLE_INPUT: '${{ inputs.title || inputs.name }}'
218308
run: |
309+
printf "%s\n" "::group::validate-name"
310+
name_input=${CHECK_NAME_INPUT}
311+
printf "::debug:: %s\n" "Will use name $name_input" ;
312+
printf "%s\n" "::endgroup::"
313+
printf "%s\n" "::group::validate-title"
314+
title_input=${CHECK_TITLE_INPUT}
315+
printf "::debug:: %s\n" "Will use name $title_input" ;
316+
sanitized_input_title_field=$(printf "%s%s" 'output[title]=' "$title_input" ;)
317+
printf "%s\n" "::endgroup::"
219318
printf "%s\n" "::group::update-check"
220319
# GitHub CLI api
221320
# https://cli.github.com/manual/gh_api
222321
gh api --method PATCH -H "Accept: application/vnd.github+json" \
223322
/repos/reactive-firewall-org/multicast/check-runs/${{ steps.output_check_id.outputs.check_id }} \
224-
-f "name=${{ inputs.name }}" -f "head_sha=${{ steps.output_sha.outputs.sha }}" \
323+
-f "name=$name_input" -f "head_sha=${{ steps.output_sha.outputs.sha }}" \
225324
-f "status=${{ inputs.status }}" \
226325
-f "details_url=${{ steps.output_check_details_url.outputs.details_url }}" \
227-
-f 'output[title]=${{ inputs.title }}' \
326+
-f "$sanitized_input_title_field" \
228327
-f 'output[summary]=${{ inputs.summary }}' -f 'output[text]=${{ inputs.text }}'
229328
printf "%s\n" "::endgroup::"
230329
- name: "Update Check"
@@ -233,17 +332,28 @@ runs:
233332
shell: bash
234333
env:
235334
GH_TOKEN: ${{ inputs.token }}
335+
CHECK_NAME_INPUT: '${{ inputs.name }}'
336+
CHECK_TITLE_INPUT: '${{ inputs.title || inputs.name }}'
236337
run: |
338+
printf "%s\n" "::group::validate-name"
339+
name_input=${CHECK_NAME_INPUT}
340+
printf "::debug:: %s\n" "Will use name $name_input" ;
341+
printf "%s\n" "::endgroup::"
342+
printf "%s\n" "::group::validate-title"
343+
title_input=${CHECK_TITLE_INPUT}
344+
printf "::debug:: %s\n" "Will use name $title_input" ;
345+
sanitized_input_title_field=$(printf "%s%s" 'output[title]=' "$title_input" ;)
346+
printf "%s\n" "::endgroup::"
237347
printf "%s\n" "::group::complete-check"
238348
# GitHub CLI api
239349
# https://cli.github.com/manual/gh_api
240350
gh api --method PATCH -H "Accept: application/vnd.github+json" \
241351
/repos/reactive-firewall-org/multicast/check-runs/${{ steps.output_check_id.outputs.check_id }} \
242-
-f "name=${{ inputs.name }}" -f "head_sha=${{ steps.output_sha.outputs.sha }}" \
352+
-f "name=$name_input" -f "head_sha=${{ steps.output_sha.outputs.sha }}" \
243353
-f "status=completed" -f "conclusion=${{ inputs.conclusion }}" \
244354
-f "completed_at=${{ steps.output_date.outputs.check_date }}Z" \
245355
-f "details_url=${{ steps.output_check_details_url.outputs.details_url }}" \
246-
-f 'output[title]=${{ inputs.title }}' \
356+
-f "$sanitized_input_title_field" \
247357
-f 'output[summary]=${{ inputs.summary }}' -f 'output[text]=${{ inputs.text }}'
248358
printf "%s\n" "::endgroup::"
249359
- name: "Report outcome of checks API"

.github/actions/checkout-and-rebuild/action.yml

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -72,9 +72,11 @@ runs:
7272
token: ${{ inputs.token }}
7373
- name: "Checkout Target Commit by SHA"
7474
shell: bash
75+
env:
76+
CI_INPUT_TARGET_SHA: ${{ inputs.sha }}
7577
run: |
7678
printf "%s\n" "::group::target-commit"
77-
git checkout --force --detach ${{ inputs.sha }} --
79+
git checkout --force --detach "${CI_INPUT_TARGET_SHA}" --
7880
printf "%s\n" "::endgroup::"
7981
if: ${{ (github.sha != inputs.sha) && success() }}
8082
- id: output_branch_name
@@ -125,7 +127,7 @@ runs:
125127
- id: fetch_artifact_files
126128
name: "Fetch Build Files"
127129
if: ${{ (github.repository == 'reactive-firewall-org/multicast') && success() }}
128-
uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
130+
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
129131
with:
130132
path: ${{ inputs.path }}/dist
131133
pattern: multicast-build-${{ steps.output_sha.outputs.sha }}

.github/actions/run-minimal-acceptance-tests/action.yml

Lines changed: 68 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -80,10 +80,75 @@ runs:
8080
steps:
8181
- name: "Calculate Commit SHA"
8282
id: output_sha
83+
if: ${{ !cancelled() }}
84+
env:
85+
CI_INPUT_TARGET_SHA: '${{ inputs.sha }}'
8386
shell: bash
8487
run: |
85-
printf "sha=%s\n" $(git rev-parse --verify '${{ inputs.sha }}') >> "$GITHUB_OUTPUT"
86-
printf "BUILD_SHA=%s\n" $(git rev-parse --verify '${{ inputs.sha }}') >> "$GITHUB_ENV"
88+
set -euo pipefail
89+
90+
raw_input="${CI_INPUT_TARGET_SHA}"
91+
92+
# Reject NUL or newline immediately
93+
if printf '%s' "$raw_input" | grep -q '[^[:print:]]'; then
94+
printf "::error title='Invalid':: %s\n" "Error: input contains disallowed control characters" >&2
95+
exit 1
96+
fi
97+
98+
# Strip one level of surrounding quotes and trim whitespace
99+
normalize() {
100+
local s="$1"
101+
s="${s#"${s%%[![:space:]]*}"}"
102+
s="${s%"${s##*[![:space:]]}"}"
103+
if [[ (${s:0:1} == "'" && ${s: -1} == "'") || (${s:0:1} == '"' && ${s: -1} == '"') ]]; then
104+
s="${s:1:-1}"
105+
fi
106+
printf '%s' "$s"
107+
}
108+
input="$(normalize "$raw_input")"
109+
110+
# Reject inputs starting with '-' (options)
111+
if [[ "${input:0:1}" == "-" ]]; then
112+
printf "::error title='Invalid':: %s\n" "Error: input may not start with '-'" >&2
113+
exit 1
114+
fi
115+
116+
# If it's a 40-char SHA, accept directly
117+
if [[ "$input" =~ ^[0-9a-f]{40}$ ]]; then
118+
resolved_sha="$input"
119+
else
120+
# Try explicit namespaces in order: full refs, refs/heads/, refs/tags/, then bare branch/tag
121+
resolved_sha=""
122+
# 1) If input is a full ref path starting with refs/, resolve only that
123+
if [[ "$input" == refs/* ]]; then
124+
if git rev-parse --verify "$input" >/dev/null 2>&1; then
125+
resolved_sha="$(git rev-parse --verify "$input")"
126+
else
127+
printf "::error title='Invalid':: %s\n" "Error: ref not found: $input" >&2
128+
exit 1
129+
fi
130+
else
131+
# 2) Try refs/heads/<input>
132+
if git rev-parse --verify "refs/heads/$input" >/dev/null 2>&1; then
133+
resolved_sha="$(git rev-parse --verify "refs/heads/$input")"
134+
# 3) Try refs/tags/<input>
135+
elif git rev-parse --verify "refs/tags/$input" >/dev/null 2>&1; then
136+
resolved_sha="$(git rev-parse --verify "refs/tags/$input")"
137+
else
138+
printf "::error title='Invalid':: %s\n" "Error: no matching branch or tag found for: $input" >&2
139+
exit 1
140+
fi
141+
fi
142+
fi
143+
144+
# Ensure final resolved value is a full 40-char commit SHA
145+
if [[ ! "$resolved_sha" =~ ^[0-9a-f]{40}$ ]]; then
146+
printf "::error title='Invalid':: %s\n" "Error: resolved value is not a full commit SHA" >&2
147+
exit 1
148+
fi
149+
150+
printf "sha=%s\n" "$resolved_sha" >> "$GITHUB_OUTPUT"
151+
printf "BUILD_SHA=%s\n" "$resolved_sha" >> "$GITHUB_ENV" ;
87152
- name: "Setup Python"
88153
id: output_python
89154
if: ${{ !cancelled() }}
@@ -288,7 +353,7 @@ runs:
288353
- name: "Upload Details"
289354
id: upload
290355
if: ${{ !cancelled() && (github.repository == 'reactive-firewall-org/multicast') }}
291-
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
356+
uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
292357
with:
293358
path: MATS
294359
name: ${{ steps.output_artifact_name.outputs.artifact-name }}

0 commit comments

Comments
 (0)