Harden aws-s3 composite action input handling - #117
Open
qti-sbojja wants to merge 1 commit into
Open
qti-sbojja wants to merge 1 commit into
qti-sbojja wants to merge 1 commit into
Conversation
Contributor
Author
|
Change tested please review and merge it. |
Contributor
|
Please add DCO sign-off |
Avoid interpolating workflow inputs directly in bash commands in the composite action. Route input values through explicit environment variables and reference them as quoted shell variables inside the run script. Quote S3 and workspace path arguments consistently and enable strict shell options with set -euo pipefail in the sync step. Preserve the existing upload, download, and presign behavior while reducing script-injection risk and satisfying code-scanning requirements. Signed-off-by: Sairamreddy Bojja <sbojja@qti.qualcomm.com>
Contributor
Author
Done. |
|
AudioReach/audioreach.triage This pull request has been marked as stale due to 30 days of inactivity. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Avoid interpolating workflow inputs directly in bash commands in the composite action. Route input values through explicit environment variables and reference them as quoted shell variables inside the run script.
Quote S3 and workspace path arguments consistently and enable strict shell options with set -euo pipefail in the sync step. Preserve the existing upload, download, and presign behavior while reducing script-injection risk and satisfying code-scanning requirements.