Skip to content

SNOW-2069227 : Update jira_close.yml #2452

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

SNOW-2069227 : Update jira_close.yml #2452

wants to merge 1 commit into from
+25 −17

Conversation

sfc-gh-hpathak
Copy link
Collaborator

Please answer these questions before submitting your pull requests. Thanks!

  1. What GitHub issue is this PR addressing? Make sure that there is an accompanying issue to your PR.

Workflows like jira_close.yml use deprecated atlassian JIRA actions and have a dependency on the gh-actions repo. This is not ideal and unecessarily complex.

  1. Fill out the following pre-review checklist:

    • I am adding a new automated test(s) to verify correctness of my new code
    • I am adding new logging messages
    • I am adding a new telemetry message
    • I am modifying authorization mechanisms
    • I am adding new credentials
    • I am modifying OCSP code
    • I am adding a new dependency

  2. Please describe how your code solves the related issue.

Updated jira_close workflow to use direct API calls via curl. It preserves custom fields used too.

  1. (Optional) PR for stored-proc connector:

github-advanced-security[bot]
github-advanced-security bot found potential problems Aug 5, 2025
View reviewed changes
.github/workflows/jira_close.yml
with:
issue: "${{ steps.extract.outputs.jira }}"
run: |
ISSUE_KEY="${{ steps.extract.outputs.jira }}"

Check failure

Code scanning / CodeQL

Code injection Critical

Potential code injection in
${ steps.extract.outputs.jira }
Loading
, which may be controlled by an external user (
issues
Loading
).

Copilot Autofix

AI 14 days ago

To fix the code injection vulnerability, we should avoid interpolating untrusted input directly into shell commands using ${{ ... }} or shell variable expansion. Instead, we should pass the untrusted value as an environment variable and reference it using the shell's native variable syntax (e.g., $ISSUE_KEY), ensuring it is properly quoted. In this workflow, we should set ISSUE_KEY as an environment variable in the step, and then use "$ISSUE_KEY" in the shell script. This prevents shell injection because the shell will not interpret special characters inside the variable value. The change should be made in the "Close Jira Issue" step, moving the assignment of ISSUE_KEY from the script to the env: block, and referencing it as "$ISSUE_KEY" in the script.

Suggested changeset 1
.github/workflows/jira_close.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/jira_close.yml b/.github/workflows/jira_close.yml
--- a/.github/workflows/jira_close.yml
+++ b/.github/workflows/jira_close.yml
@@ -20,6 +20,6 @@
         if: startsWith(steps.extract.outputs.jira, 'SNOW-')
+        env:
+          ISSUE_KEY: ${{ steps.extract.outputs.jira }}
+          JIRA_API_URL: ${{ secrets.JIRA_BASE_URL }}/rest/api/2/issue/${{ steps.extract.outputs.jira }}/transitions
         run: |
-          ISSUE_KEY="${{ steps.extract.outputs.jira }}"
-          JIRA_API_URL="${{ secrets.JIRA_BASE_URL }}/rest/api/2/issue/${ISSUE_KEY}/transitions"
-
           curl -X POST \
EOF
@@ -20,6 +20,6 @@
if: startsWith(steps.extract.outputs.jira, 'SNOW-')
env:
ISSUE_KEY: ${{ steps.extract.outputs.jira }}
JIRA_API_URL: ${{ secrets.JIRA_BASE_URL }}/rest/api/2/issue/${{ steps.extract.outputs.jira }}/transitions
run: |
ISSUE_KEY="${{ steps.extract.outputs.jira }}"
JIRA_API_URL="${{ secrets.JIRA_BASE_URL }}/rest/api/2/issue/${ISSUE_KEY}/transitions"

curl -X POST \
Copilot is powered by AI and may make mistakes. Always verify output.
@sfc-gh-hpathak sfc-gh-hpathak requested review from sfc-gh-mkeller and a team August 5, 2025 01:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@sfc-gh-mkeller sfc-gh-mkeller Awaiting requested review from sfc-gh-mkeller

At least 1 approving review is required to merge this pull request.

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@sfc-gh-hpathak