Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
49 changes: 49 additions & 0 deletions .github/workflows/apollo_deployments_service_ack.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,49 @@
name: Apollo deployments service.rs acknowledgment

on:
pull_request:
types:
- opened
- reopened
- synchronize
paths:
- "crates/apollo_deployments/src/service.rs"
- ".github/workflows/apollo_deployments_service_ack.yml"

# On PR events, cancel existing CI runs on this same PR for this workflow.
concurrency:
group: >
${{ github.workflow }}-
${{ github.ref }}-
${{ github.event_name == 'pull_request' && 'PR' || github.sha }}
cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
assert-file-exists:
runs-on: ubuntu-24.04
steps:
- uses: actions/checkout@v6

- name: Assert service.rs exists
run: |
if [ ! -f crates/apollo_deployments/src/service.rs ]; then
echo "::error::crates/apollo_deployments/src/service.rs was removed or is missing."
exit 1
fi
echo "File crates/apollo_deployments/src/service.rs exists."

manual-confirmation:
runs-on: ubuntu-24.04
needs: [assert-file-exists]
environment: apollo-deployments-service-ack
steps:
- name: Display acknowledgment message
run: |
echo "--- Acknowledgment message ---"
if [ -n "${{ vars.APOLLO_SERVICE_RS_MESSAGE }}" ]; then
echo "${{ vars.APOLLO_SERVICE_RS_MESSAGE }}"
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Shell script injection via direct variable interpolation

Low Severity

${{ vars.APOLLO_SERVICE_RS_MESSAGE }} is directly interpolated into the shell script before execution. If the variable value contains shell metacharacters (e.g., double quotes, backticks, or $(...)), they will be interpreted by the shell, potentially causing unexpected command execution or script failure. The safe pattern is to pass the value via env: and reference it as a shell variable (e.g., $MESSAGE), which avoids inline expansion.

Fix in Cursor Fix in Web

else
echo "Replace this placeholder: set APOLLO_SERVICE_RS_MESSAGE in the environment or edit this workflow with your custom message."
fi
echo "---"
echo "This job passed after manual approval of the environment."
2 changes: 2 additions & 0 deletions crates/apollo_deployments/src/service.rs
Original file line number Diff line number Diff line change
Expand Up @@ -41,6 +41,8 @@ use crate::test_utils::FIX_BINARY_NAME;
const SERVICES_DIR_NAME: &str = "services/";
const REMOTE_SERVICE_URL_PLACEHOLDER: &str = "remote_service";



Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Extra blank lines appear accidentally committed for testing

Low Severity

Two extra blank lines were added to service.rs between the constant declarations and the KEYS_TO_BE_REPLACED definition. Given the PR title "test checkbox," these appear to be a trivial change committed solely to trigger the new workflow during testing, rather than an intentional formatting improvement.

Fix in Cursor Fix in Web

// TODO(Tsabary): remove ports and mempool ttl from this list.
pub static KEYS_TO_BE_REPLACED: phf::Set<&'static str> = phf_set! {
"base_layer_config.bpo1_start_block_number",
Expand Down
Loading