Skip to content
Merged

S3 #78

Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .github/actions/build/action.yml
Original file line number Diff line number Diff line change
Expand Up @@ -27,9 +27,9 @@
# Load the build arguments
set +x
export GITHUB_WORKSPACE="${{ github.workspace }}"
[ -f "./${{ env.CONFIG_SCRIPT }}" ] && export CONFIG_SCRIPT="${{ env.CONFIG_SCRIPT }}"

Check failure on line 30 in .github/actions/build/action.yml

View workflow job for this annotation

GitHub Actions / Scan workflows for security issues

template-injection

action.yml:30: code injection via template expansion: may expand into attacker-controllable code

Check failure on line 30 in .github/actions/build/action.yml

View workflow job for this annotation

GitHub Actions / Scan workflows for security issues

template-injection

action.yml:30: code injection via template expansion: may expand into attacker-controllable code

Check failure on line 30 in .github/actions/build/action.yml

View workflow job for this annotation

GitHub Actions / Scan workflows for security issues

template-injection

action.yml:30: code injection via template expansion: may expand into attacker-controllable code

Check failure on line 30 in .github/actions/build/action.yml

View workflow job for this annotation

GitHub Actions / Scan workflows for security issues

template-injection

action.yml:30: code injection via template expansion: may expand into attacker-controllable code
[ -f "./${{ env.SYNC_SCRIPT }}" ] && source "./${{ env.SYNC_SCRIPT }}"

Check failure on line 31 in .github/actions/build/action.yml

View workflow job for this annotation

GitHub Actions / Scan workflows for security issues

template-injection

action.yml:31: code injection via template expansion: may expand into attacker-controllable code

Check failure on line 31 in .github/actions/build/action.yml

View workflow job for this annotation

GitHub Actions / Scan workflows for security issues

template-injection

action.yml:31: code injection via template expansion: may expand into attacker-controllable code

Check failure on line 31 in .github/actions/build/action.yml

View workflow job for this annotation

GitHub Actions / Scan workflows for security issues

template-injection

action.yml:31: code injection via template expansion: may expand into attacker-controllable code

Check failure on line 31 in .github/actions/build/action.yml

View workflow job for this annotation

GitHub Actions / Scan workflows for security issues

template-injection

action.yml:31: code injection via template expansion: may expand into attacker-controllable code
[ -f "./${{ env.APPLY_PATCH_SCRIPT }}" ] && source "./${{ env.APPLY_PATCH_SCRIPT }}"

Check failure on line 32 in .github/actions/build/action.yml

View workflow job for this annotation

GitHub Actions / Scan workflows for security issues

template-injection

action.yml:32: code injection via template expansion: may expand into attacker-controllable code

Check failure on line 32 in .github/actions/build/action.yml

View workflow job for this annotation

GitHub Actions / Scan workflows for security issues

template-injection

action.yml:32: code injection via template expansion: may expand into attacker-controllable code

Check failure on line 32 in .github/actions/build/action.yml

View workflow job for this annotation

GitHub Actions / Scan workflows for security issues

template-injection

action.yml:32: code injection via template expansion: may expand into attacker-controllable code

Check failure on line 32 in .github/actions/build/action.yml

View workflow job for this annotation

GitHub Actions / Scan workflows for security issues

template-injection

action.yml:32: code injection via template expansion: may expand into attacker-controllable code

# Build inside a docker container
docker run \
Expand All @@ -38,10 +38,10 @@
-v $PWD/..:$PWD/.. \
-w $PWD \
-e GITHUB_WORKSPACE="${{ github.workspace }}" \
-e BUILD_ARGS="${{ env.BUILD_ARGS }}" \

Check failure on line 41 in .github/actions/build/action.yml

View workflow job for this annotation

GitHub Actions / Scan workflows for security issues

template-injection

action.yml:41: code injection via template expansion: may expand into attacker-controllable code

Check failure on line 41 in .github/actions/build/action.yml

View workflow job for this annotation

GitHub Actions / Scan workflows for security issues

template-injection

action.yml:41: code injection via template expansion: may expand into attacker-controllable code
-e BUILD_SCRIPT="${{ env.BUILD_SCRIPT }}" \

Check failure on line 42 in .github/actions/build/action.yml

View workflow job for this annotation

GitHub Actions / Scan workflows for security issues

template-injection

action.yml:42: code injection via template expansion: may expand into attacker-controllable code

Check failure on line 42 in .github/actions/build/action.yml

View workflow job for this annotation

GitHub Actions / Scan workflows for security issues

template-injection

action.yml:42: code injection via template expansion: may expand into attacker-controllable code
--privileged \
${{ inputs.docker_image }} \

Check failure on line 44 in .github/actions/build/action.yml

View workflow job for this annotation

GitHub Actions / Scan workflows for security issues

template-injection

action.yml:44: code injection via template expansion: may expand into attacker-controllable code

Check failure on line 44 in .github/actions/build/action.yml

View workflow job for this annotation

GitHub Actions / Scan workflows for security issues

template-injection

action.yml:44: code injection via template expansion: may expand into attacker-controllable code
bash -c '
echo "Running build script... : ${BUILD_SCRIPT}"
ls -l "${BUILD_SCRIPT}" || (echo "Build script not found!" && exit 1)
Expand All @@ -53,7 +53,7 @@
shell: bash
run: |
# Create a tarball of the build directory
tar -czf build_${{ env.IMAGE_NAME }}.tar -C ${{ github.workspace }}/build .

Check failure on line 56 in .github/actions/build/action.yml

View workflow job for this annotation

GitHub Actions / Scan workflows for security issues

template-injection

action.yml:56: code injection via template expansion: may expand into attacker-controllable code

Check failure on line 56 in .github/actions/build/action.yml

View workflow job for this annotation

GitHub Actions / Scan workflows for security issues

template-injection

action.yml:56: code injection via template expansion: may expand into attacker-controllable code
echo "Build tar created at ${{ github.workspace }}/build_${{ env.IMAGE_NAME }}.tar"

- name: Upload build.tar
Expand All @@ -63,3 +63,4 @@
name: build_${{ env.IMAGE_NAME }}.tar
path: ${{ github.workspace }}/build_${{ env.IMAGE_NAME }}.tar
retention-days: 1

1 change: 1 addition & 0 deletions .github/workflows/build.yml
Original file line number Diff line number Diff line change
Expand Up @@ -137,3 +137,4 @@ jobs:
rm -rf install/ ${{ env.SDK_NAME }}
rm -rf build/ ${{ github.workspace }}/build_${{ env.IMAGE_NAME }}.tar
echo "Workspace cleaned up successfully"

43 changes: 32 additions & 11 deletions .github/workflows/process_image.yml
Original file line number Diff line number Diff line change
Expand Up @@ -84,13 +84,16 @@ jobs:
- name: Extract build artifact
id: extract_build_artifact
shell: bash
env:
WORKSPACE_DIR: ${{ github.workspace }}
IMAGE_NAME_LOCAL: ${{ env.IMAGE_NAME }}
run: |
#!/bin/bash
set -e

mkdir -p ${{ github.workspace }}/build
mkdir -p "${WORKSPACE_DIR}/build"
echo "Extracting the build artifact"
tar -xvf ${{ github.workspace }}/build_${{ env.IMAGE_NAME }}.tar -C ${{ github.workspace }}/build
tar -xvf "${WORKSPACE_DIR}/build_${IMAGE_NAME_LOCAL}.tar" -C "${WORKSPACE_DIR}/build"
echo "Build artifact extracted successfully"

- name: Pull meta-audioreach pre compiled image
Expand All @@ -108,18 +111,30 @@ jobs:
id: extract_image
if: ${{ env.IMAGE_NAME != 'raspberrypi4' }}
shell: bash
env:
IMAGE_NAME_LOCAL: ${{ env.IMAGE_NAME }}
FILES_TO_COPY: ${{ inputs.files_to_copy }}
DOCKER_IMAGE: ${{ steps.get-docker-image.outputs.image_name }}
run: |
#!/bin/bash
set -e

IMAGE_ARCHIVE="qcom-multimedia-proprietary-image-${IMAGE_NAME_LOCAL}.rootfs.qcomflash.tar.gz"
echo "Extracting the image"
tar -xvf qcom-multimedia-proprietary-image-${{ env.IMAGE_NAME }}.rootfs.qcomflash.tar.gz
ROOTFS_IMG=$(tar -tf qcom-multimedia-proprietary-image-${{ env.IMAGE_NAME }}.rootfs.qcomflash.tar.gz | grep 'rootfs.img$')
tar -xvf "$IMAGE_ARCHIVE"
ROOTFS_IMG=$(tar -tf "$IMAGE_ARCHIVE" | grep 'rootfs.img$')
ROOTFS_DIR=$(dirname "$ROOTFS_IMG")
EXPECTED_ROOTFS_DIR="qcom-multimedia-proprietary-image-${IMAGE_NAME_LOCAL}"
if [ "$ROOTFS_DIR" != "$EXPECTED_ROOTFS_DIR" ] && [ -d "$ROOTFS_DIR" ]; then
rm -rf "$EXPECTED_ROOTFS_DIR"
mv "$ROOTFS_DIR" "$EXPECTED_ROOTFS_DIR"
ROOTFS_DIR="$EXPECTED_ROOTFS_DIR"
ROOTFS_IMG="$ROOTFS_DIR/rootfs.img"
fi
# Export as GitHub Actions environment variables
echo "ROOTFS_IMG=$ROOTFS_IMG" >> $GITHUB_ENV
echo "ROOTFS_DIR=$ROOTFS_DIR" >> $GITHUB_ENV
rm -rf qcom-multimedia-proprietary-image-${{ env.IMAGE_NAME }}.rootfs.qcomflash.tar.gz
rm -rf "$IMAGE_ARCHIVE"
echo "Image extracted successfully"

ls -l "$ROOTFS_DIR/rootfs.img"
Expand Down Expand Up @@ -160,8 +175,8 @@ jobs:
-v $PWD:/workspace \
-v /tmp/rootfs:/tmp/rootfs \
-w /workspace \
-e "FILES_TO_COPY=${{ inputs.files_to_copy }}" \
${{ steps.get-docker-image.outputs.image_name }} \
-e "FILES_TO_COPY=${FILES_TO_COPY}" \
"${DOCKER_IMAGE}" \
bash -c '
set -xe
set +e
Expand Down Expand Up @@ -189,30 +204,36 @@ jobs:
id: create_tar_image
if: ${{ env.IMAGE_NAME != 'raspberrypi4' }}
shell: bash
env:
IMAGE_NAME_LOCAL: ${{ env.IMAGE_NAME }}
ROOTFS_DIR_LOCAL: ${{ env.ROOTFS_DIR }}
run: |
#!/bin/bash
set -e
echo $PWD
echo "Creating tar image for qcomflash directory"
tar -czvf qcom-multimedia-proprietary-image-${{ env.IMAGE_NAME }}.rootfs.qcomflash.tar.gz ${{ env.ROOTFS_DIR }}/
tar -czvf "qcom-multimedia-proprietary-image-${IMAGE_NAME_LOCAL}.rootfs.qcomflash.tar.gz" "${ROOTFS_DIR_LOCAL}/"

# ✅ Moving newly created tar files into presigned_urls path
- name: Move tar to presigned_urls directory
if: ${{ env.IMAGE_NAME != 'raspberrypi4' }}
shell: bash
env:
WORKSPACE_DIR: ${{ github.workspace }}
IMAGE_NAME_LOCAL: ${{ env.IMAGE_NAME }}
run: |
set -e
mkdir -p ${{ github.workspace }}/presigned_urls
mkdir -p "${WORKSPACE_DIR}/presigned_urls"

FILE="qcom-multimedia-proprietary-image-${{ env.IMAGE_NAME }}.rootfs.qcomflash.tar.gz"
FILE="qcom-multimedia-proprietary-image-${IMAGE_NAME_LOCAL}.rootfs.qcomflash.tar.gz"


if [ ! -f "$FILE" ]; then
echo "ERROR: $FILE not found!"
exit 1
fi

mv "$FILE" ${{ github.workspace }}/presigned_urls/
mv "$FILE" "${WORKSPACE_DIR}/presigned_urls/"
echo "Moved $FILE to presigned_urls/"

- name: Upload tar image
Expand Down
Loading