Skip to content

[scanner] fix: mitigate shell injection via inputs interpolation in 5 workflow files #50

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
hanthor-hive-agent wants to merge 1 commit into
base: main
Choose a base branch
from
+104 −41
Open

[scanner] fix: mitigate shell injection via inputs interpolation in 5 workflow files #50

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
60 changes: 45 additions & 15 deletions .github/workflows/build-distributed.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -91,8 +91,10 @@ jobs:
name: repo-0
path: local-repo
- name: Build package
env:
FORCE: ${FORCE}
run: "touch .build-marker\nARGS=(--backend podman --tier base-tools --package\
\ ${{ matrix.package }})\nif [[ \"${{ github.event.inputs.force }}\" == \"\
\ ${{ matrix.package }})\nif [[ \"${FORCE}\" == \"\
true\" ]]; then\n ARGS+=(--force)\nfi\n./scripts/build-chain.sh \"${ARGS[@]}\"\
\n"
- name: Find new RPMs
Expand Down Expand Up @@ -172,8 +174,10 @@ jobs:
name: repo-1
path: local-repo
- name: Build package
env:
FORCE: ${FORCE}
run: "touch .build-marker\nARGS=(--backend podman --tier build-tools --package\
\ ${{ matrix.package }})\nif [[ \"${{ github.event.inputs.force }}\" == \"\
\ ${{ matrix.package }})\nif [[ \"${FORCE}\" == \"\
true\" ]]; then\n ARGS+=(--force)\nfi\n./scripts/build-chain.sh \"${ARGS[@]}\"\
\n"
- name: Find new RPMs
Expand Down Expand Up @@ -249,8 +253,10 @@ jobs:
name: repo-2
path: local-repo
- name: Build package
env:
FORCE: ${FORCE}
run: "touch .build-marker\nARGS=(--backend podman --tier glib2-bootstrap --package\
\ ${{ matrix.package }})\nif [[ \"${{ github.event.inputs.force }}\" == \"\
\ ${{ matrix.package }})\nif [[ \"${FORCE}\" == \"\
true\" ]]; then\n ARGS+=(--force)\nfi\n./scripts/build-chain.sh \"${ARGS[@]}\"\
\n"
- name: Find new RPMs
Expand Down Expand Up @@ -329,8 +335,10 @@ jobs:
name: repo-3
path: local-repo
- name: Build package
env:
FORCE: ${FORCE}
run: "touch .build-marker\nARGS=(--backend podman --tier bootstrap-libs --package\
\ ${{ matrix.package }})\nif [[ \"${{ github.event.inputs.force }}\" == \"\
\ ${{ matrix.package }})\nif [[ \"${FORCE}\" == \"\
true\" ]]; then\n ARGS+=(--force)\nfi\n./scripts/build-chain.sh \"${ARGS[@]}\"\
\n"
- name: Find new RPMs
Expand Down Expand Up @@ -406,8 +414,10 @@ jobs:
name: repo-4
path: local-repo
- name: Build package
env:
FORCE: ${FORCE}
run: "touch .build-marker\nARGS=(--backend podman --tier cairo-layer --package\
\ ${{ matrix.package }})\nif [[ \"${{ github.event.inputs.force }}\" == \"\
\ ${{ matrix.package }})\nif [[ \"${FORCE}\" == \"\
true\" ]]; then\n ARGS+=(--force)\nfi\n./scripts/build-chain.sh \"${ARGS[@]}\"\
\n"
- name: Find new RPMs
Expand Down Expand Up @@ -483,8 +493,10 @@ jobs:
name: repo-5
path: local-repo
- name: Build package
env:
FORCE: ${FORCE}
run: "touch .build-marker\nARGS=(--backend podman --tier gi-bootstrap --package\
\ ${{ matrix.package }})\nif [[ \"${{ github.event.inputs.force }}\" == \"\
\ ${{ matrix.package }})\nif [[ \"${FORCE}\" == \"\
true\" ]]; then\n ARGS+=(--force)\nfi\n./scripts/build-chain.sh \"${ARGS[@]}\"\
\n"
- name: Find new RPMs
Expand Down Expand Up @@ -560,8 +572,10 @@ jobs:
name: repo-6
path: local-repo
- name: Build package
env:
FORCE: ${FORCE}
run: "touch .build-marker\nARGS=(--backend podman --tier glib2-full --package\
\ ${{ matrix.package }})\nif [[ \"${{ github.event.inputs.force }}\" == \"\
\ ${{ matrix.package }})\nif [[ \"${FORCE}\" == \"\
true\" ]]; then\n ARGS+=(--force)\nfi\n./scripts/build-chain.sh \"${ARGS[@]}\"\
\n"
- name: Find new RPMs
Expand Down Expand Up @@ -637,8 +651,10 @@ jobs:
name: repo-7
path: local-repo
- name: Build package
env:
FORCE: ${FORCE}
run: "touch .build-marker\nARGS=(--backend podman --tier gi-full --package\
\ ${{ matrix.package }})\nif [[ \"${{ github.event.inputs.force }}\" == \"\
\ ${{ matrix.package }})\nif [[ \"${FORCE}\" == \"\
true\" ]]; then\n ARGS+=(--force)\nfi\n./scripts/build-chain.sh \"${ARGS[@]}\"\
\n"
- name: Find new RPMs
Expand Down Expand Up @@ -716,8 +732,10 @@ jobs:
name: repo-8
path: local-repo
- name: Build package
env:
FORCE: ${FORCE}
run: "touch .build-marker\nARGS=(--backend podman --tier core-libraries --package\
\ ${{ matrix.package }})\nif [[ \"${{ github.event.inputs.force }}\" == \"\
\ ${{ matrix.package }})\nif [[ \"${FORCE}\" == \"\
true\" ]]; then\n ARGS+=(--force)\nfi\n./scripts/build-chain.sh \"${ARGS[@]}\"\
\n"
- name: Find new RPMs
Expand Down Expand Up @@ -796,8 +814,10 @@ jobs:
name: repo-9
path: local-repo
- name: Build package
env:
FORCE: ${FORCE}
run: "touch .build-marker\nARGS=(--backend podman --tier system-tools --package\
\ ${{ matrix.package }})\nif [[ \"${{ github.event.inputs.force }}\" == \"\
\ ${{ matrix.package }})\nif [[ \"${FORCE}\" == \"\
true\" ]]; then\n ARGS+=(--force)\nfi\n./scripts/build-chain.sh \"${ARGS[@]}\"\
\n"
- name: Find new RPMs
Expand Down Expand Up @@ -876,8 +896,10 @@ jobs:
name: repo-10
path: local-repo
- name: Build package
env:
FORCE: ${FORCE}
run: "touch .build-marker\nARGS=(--backend podman --tier gtk-core --package\
\ ${{ matrix.package }})\nif [[ \"${{ github.event.inputs.force }}\" == \"\
\ ${{ matrix.package }})\nif [[ \"${FORCE}\" == \"\
true\" ]]; then\n ARGS+=(--force)\nfi\n./scripts/build-chain.sh \"${ARGS[@]}\"\
\n"
- name: Find new RPMs
Expand Down Expand Up @@ -955,8 +977,10 @@ jobs:
name: repo-11
path: local-repo
- name: Build package
env:
FORCE: ${FORCE}
run: "touch .build-marker\nARGS=(--backend podman --tier desktop-foundations\
\ --package ${{ matrix.package }})\nif [[ \"${{ github.event.inputs.force\
\ --package ${{ matrix.package }})\nif [[ \"${FORCE}
\ }}\" == \"true\" ]]; then\n ARGS+=(--force)\nfi\n./scripts/build-chain.sh\
\ \"${ARGS[@]}\"\n"
- name: Find new RPMs
Expand Down Expand Up @@ -1033,8 +1057,10 @@ jobs:
name: repo-12
path: local-repo
- name: Build package
env:
FORCE: ${FORCE}
run: "touch .build-marker\nARGS=(--backend podman --tier shell-foundations\
\ --package ${{ matrix.package }})\nif [[ \"${{ github.event.inputs.force\
\ --package ${{ matrix.package }})\nif [[ \"${FORCE}
\ }}\" == \"true\" ]]; then\n ARGS+=(--force)\nfi\n./scripts/build-chain.sh\
\ \"${ARGS[@]}\"\n"
- name: Find new RPMs
Expand Down Expand Up @@ -1112,8 +1138,10 @@ jobs:
name: repo-13
path: local-repo
- name: Build package
env:
FORCE: ${FORCE}
run: "touch .build-marker\nARGS=(--backend podman --tier gnome-shell --package\
\ ${{ matrix.package }})\nif [[ \"${{ github.event.inputs.force }}\" == \"\
\ ${{ matrix.package }})\nif [[ \"${FORCE}\" == \"\
true\" ]]; then\n ARGS+=(--force)\nfi\n./scripts/build-chain.sh \"${ARGS[@]}\"\
\n"
- name: Find new RPMs
Expand Down Expand Up @@ -1191,8 +1219,10 @@ jobs:
name: repo-14
path: local-repo
- name: Build package
env:
FORCE: ${FORCE}
run: "touch .build-marker\nARGS=(--backend podman --tier session-layer --package\
\ ${{ matrix.package }})\nif [[ \"${{ github.event.inputs.force }}\" == \"\
\ ${{ matrix.package }})\nif [[ \"${FORCE}\" == \"\
true\" ]]; then\n ARGS+=(--force)\nfi\n./scripts/build-chain.sh \"${ARGS[@]}\"\
\n"
- name: Find new RPMs
Expand Down
48 changes: 36 additions & 12 deletions .github/workflows/build-gnome49-distributed.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -88,7 +88,9 @@ jobs:
name: repo-0
path: local-repo
- name: Build package
run: "touch .build-marker\nARGS=(--backend podman --tier base-tools --package ${{ matrix.package }} --manifest build-order-gnome49.yml --mock-config centos-stream-10-ci-gnome49)\nif [[ \"${{ github.event.inputs.force }}\" == \"true\" ]]; then\n ARGS+=(--force)\nfi\n./scripts/build-chain.sh \"${ARGS[@]}\"\n"
env:
FORCE: ${FORCE}
run: "touch .build-marker\nARGS=(--backend podman --tier base-tools --package ${{ matrix.package }} --manifest build-order-gnome49.yml --mock-config centos-stream-10-ci-gnome49)\nif [[ \"${FORCE}\" == \"true\" ]]; then\n ARGS+=(--force)\nfi\n./scripts/build-chain.sh \"${ARGS[@]}\"\n"
- name: Find new RPMs
id: find-rpms
run: 'mkdir -p new-rpms
Expand Down Expand Up @@ -160,7 +162,9 @@ jobs:
name: repo-1
path: local-repo
- name: Build package
run: "touch .build-marker\nARGS=(--backend podman --tier build-tools --package ${{ matrix.package }} --manifest build-order-gnome49.yml --mock-config centos-stream-10-ci-gnome49)\nif [[ \"${{ github.event.inputs.force }}\" == \"true\" ]]; then\n ARGS+=(--force)\nfi\n./scripts/build-chain.sh \"${ARGS[@]}\"\n"
env:
FORCE: ${FORCE}
run: "touch .build-marker\nARGS=(--backend podman --tier build-tools --package ${{ matrix.package }} --manifest build-order-gnome49.yml --mock-config centos-stream-10-ci-gnome49)\nif [[ \"${FORCE}\" == \"true\" ]]; then\n ARGS+=(--force)\nfi\n./scripts/build-chain.sh \"${ARGS[@]}\"\n"
- name: Find new RPMs
id: find-rpms
run: 'mkdir -p new-rpms
Expand Down Expand Up @@ -231,7 +235,9 @@ jobs:
name: repo-2
path: local-repo
- name: Build package
run: "touch .build-marker\nARGS=(--backend podman --tier glib2-bootstrap --package ${{ matrix.package }} --manifest build-order-gnome49.yml --mock-config centos-stream-10-ci-gnome49)\nif [[ \"${{ github.event.inputs.force }}\" == \"true\" ]]; then\n ARGS+=(--force)\nfi\n./scripts/build-chain.sh \"${ARGS[@]}\"\n"
env:
FORCE: ${FORCE}
run: "touch .build-marker\nARGS=(--backend podman --tier glib2-bootstrap --package ${{ matrix.package }} --manifest build-order-gnome49.yml --mock-config centos-stream-10-ci-gnome49)\nif [[ \"${FORCE}\" == \"true\" ]]; then\n ARGS+=(--force)\nfi\n./scripts/build-chain.sh \"${ARGS[@]}\"\n"
- name: Find new RPMs
id: find-rpms
run: 'mkdir -p new-rpms
Expand Down Expand Up @@ -302,7 +308,9 @@ jobs:
name: repo-3
path: local-repo
- name: Build package
run: "touch .build-marker\nARGS=(--backend podman --tier gi-bootstrap --package ${{ matrix.package }} --manifest build-order-gnome49.yml --mock-config centos-stream-10-ci-gnome49)\nif [[ \"${{ github.event.inputs.force }}\" == \"true\" ]]; then\n ARGS+=(--force)\nfi\n./scripts/build-chain.sh \"${ARGS[@]}\"\n"
env:
FORCE: ${FORCE}
run: "touch .build-marker\nARGS=(--backend podman --tier gi-bootstrap --package ${{ matrix.package }} --manifest build-order-gnome49.yml --mock-config centos-stream-10-ci-gnome49)\nif [[ \"${FORCE}\" == \"true\" ]]; then\n ARGS+=(--force)\nfi\n./scripts/build-chain.sh \"${ARGS[@]}\"\n"
- name: Find new RPMs
id: find-rpms
run: 'mkdir -p new-rpms
Expand Down Expand Up @@ -373,7 +381,9 @@ jobs:
name: repo-4
path: local-repo
- name: Build package
run: "touch .build-marker\nARGS=(--backend podman --tier glib2-full --package ${{ matrix.package }} --manifest build-order-gnome49.yml --mock-config centos-stream-10-ci-gnome49)\nif [[ \"${{ github.event.inputs.force }}\" == \"true\" ]]; then\n ARGS+=(--force)\nfi\n./scripts/build-chain.sh \"${ARGS[@]}\"\n"
env:
FORCE: ${FORCE}
run: "touch .build-marker\nARGS=(--backend podman --tier glib2-full --package ${{ matrix.package }} --manifest build-order-gnome49.yml --mock-config centos-stream-10-ci-gnome49)\nif [[ \"${FORCE}\" == \"true\" ]]; then\n ARGS+=(--force)\nfi\n./scripts/build-chain.sh \"${ARGS[@]}\"\n"
- name: Find new RPMs
id: find-rpms
run: 'mkdir -p new-rpms
Expand Down Expand Up @@ -444,7 +454,9 @@ jobs:
name: repo-5
path: local-repo
- name: Build package
run: "touch .build-marker\nARGS=(--backend podman --tier gi-full --package ${{ matrix.package }} --manifest build-order-gnome49.yml --mock-config centos-stream-10-ci-gnome49)\nif [[ \"${{ github.event.inputs.force }}\" == \"true\" ]]; then\n ARGS+=(--force)\nfi\n./scripts/build-chain.sh \"${ARGS[@]}\"\n"
env:
FORCE: ${FORCE}
run: "touch .build-marker\nARGS=(--backend podman --tier gi-full --package ${{ matrix.package }} --manifest build-order-gnome49.yml --mock-config centos-stream-10-ci-gnome49)\nif [[ \"${FORCE}\" == \"true\" ]]; then\n ARGS+=(--force)\nfi\n./scripts/build-chain.sh \"${ARGS[@]}\"\n"
- name: Find new RPMs
id: find-rpms
run: 'mkdir -p new-rpms
Expand Down Expand Up @@ -518,7 +530,9 @@ jobs:
name: repo-6
path: local-repo
- name: Build package
run: "touch .build-marker\nARGS=(--backend podman --tier core-libraries --package ${{ matrix.package }} --manifest build-order-gnome49.yml --mock-config centos-stream-10-ci-gnome49)\nif [[ \"${{ github.event.inputs.force }}\" == \"true\" ]]; then\n ARGS+=(--force)\nfi\n./scripts/build-chain.sh \"${ARGS[@]}\"\n"
env:
FORCE: ${FORCE}
run: "touch .build-marker\nARGS=(--backend podman --tier core-libraries --package ${{ matrix.package }} --manifest build-order-gnome49.yml --mock-config centos-stream-10-ci-gnome49)\nif [[ \"${FORCE}\" == \"true\" ]]; then\n ARGS+=(--force)\nfi\n./scripts/build-chain.sh \"${ARGS[@]}\"\n"
- name: Find new RPMs
id: find-rpms
run: 'mkdir -p new-rpms
Expand Down Expand Up @@ -593,7 +607,9 @@ jobs:
name: repo-7
path: local-repo
- name: Build package
run: "touch .build-marker\nARGS=(--backend podman --tier gtk-core --package ${{ matrix.package }} --manifest build-order-gnome49.yml --mock-config centos-stream-10-ci-gnome49)\nif [[ \"${{ github.event.inputs.force }}\" == \"true\" ]]; then\n ARGS+=(--force)\nfi\n./scripts/build-chain.sh \"${ARGS[@]}\"\n"
env:
FORCE: ${FORCE}
run: "touch .build-marker\nARGS=(--backend podman --tier gtk-core --package ${{ matrix.package }} --manifest build-order-gnome49.yml --mock-config centos-stream-10-ci-gnome49)\nif [[ \"${FORCE}\" == \"true\" ]]; then\n ARGS+=(--force)\nfi\n./scripts/build-chain.sh \"${ARGS[@]}\"\n"
- name: Find new RPMs
id: find-rpms
run: 'mkdir -p new-rpms
Expand Down Expand Up @@ -669,7 +685,9 @@ jobs:
name: repo-8
path: local-repo
- name: Build package
run: "touch .build-marker\nARGS=(--backend podman --tier gjs-layer --package ${{ matrix.package }} --manifest build-order-gnome49.yml --mock-config centos-stream-10-ci-gnome49)\nif [[ \"${{ github.event.inputs.force }}\" == \"true\" ]]; then\n ARGS+=(--force)\nfi\n./scripts/build-chain.sh \"${ARGS[@]}\"\n"
env:
FORCE: ${FORCE}
run: "touch .build-marker\nARGS=(--backend podman --tier gjs-layer --package ${{ matrix.package }} --manifest build-order-gnome49.yml --mock-config centos-stream-10-ci-gnome49)\nif [[ \"${FORCE}\" == \"true\" ]]; then\n ARGS+=(--force)\nfi\n./scripts/build-chain.sh \"${ARGS[@]}\"\n"
- name: Find new RPMs
id: find-rpms
run: 'mkdir -p new-rpms
Expand Down Expand Up @@ -741,7 +759,9 @@ jobs:
name: repo-9
path: local-repo
- name: Build package
run: "touch .build-marker\nARGS=(--backend podman --tier shell-foundations --package ${{ matrix.package }} --manifest build-order-gnome49.yml --mock-config centos-stream-10-ci-gnome49)\nif [[ \"${{ github.event.inputs.force }}\" == \"true\" ]]; then\n ARGS+=(--force)\nfi\n./scripts/build-chain.sh \"${ARGS[@]}\"\n"
env:
FORCE: ${FORCE}
run: "touch .build-marker\nARGS=(--backend podman --tier shell-foundations --package ${{ matrix.package }} --manifest build-order-gnome49.yml --mock-config centos-stream-10-ci-gnome49)\nif [[ \"${FORCE}\" == \"true\" ]]; then\n ARGS+=(--force)\nfi\n./scripts/build-chain.sh \"${ARGS[@]}\"\n"
- name: Find new RPMs
id: find-rpms
run: 'mkdir -p new-rpms
Expand Down Expand Up @@ -814,7 +834,9 @@ jobs:
name: repo-10
path: local-repo
- name: Build package
run: "touch .build-marker\nARGS=(--backend podman --tier gnome-shell --package ${{ matrix.package }} --manifest build-order-gnome49.yml --mock-config centos-stream-10-ci-gnome49)\nif [[ \"${{ github.event.inputs.force }}\" == \"true\" ]]; then\n ARGS+=(--force)\nfi\n./scripts/build-chain.sh \"${ARGS[@]}\"\n"
env:
FORCE: ${FORCE}
run: "touch .build-marker\nARGS=(--backend podman --tier gnome-shell --package ${{ matrix.package }} --manifest build-order-gnome49.yml --mock-config centos-stream-10-ci-gnome49)\nif [[ \"${FORCE}\" == \"true\" ]]; then\n ARGS+=(--force)\nfi\n./scripts/build-chain.sh \"${ARGS[@]}\"\n"
- name: Find new RPMs
id: find-rpms
run: 'mkdir -p new-rpms
Expand Down Expand Up @@ -889,7 +911,9 @@ jobs:
name: repo-11
path: local-repo
- name: Build package
run: "touch .build-marker\nARGS=(--backend podman --tier session-layer --package ${{ matrix.package }} --manifest build-order-gnome49.yml --mock-config centos-stream-10-ci-gnome49)\nif [[ \"${{ github.event.inputs.force }}\" == \"true\" ]]; then\n ARGS+=(--force)\nfi\n./scripts/build-chain.sh \"${ARGS[@]}\"\n"
env:
FORCE: ${FORCE}
run: "touch .build-marker\nARGS=(--backend podman --tier session-layer --package ${{ matrix.package }} --manifest build-order-gnome49.yml --mock-config centos-stream-10-ci-gnome49)\nif [[ \"${FORCE}\" == \"true\" ]]; then\n ARGS+=(--force)\nfi\n./scripts/build-chain.sh \"${ARGS[@]}\"\n"
- name: Find new RPMs
id: find-rpms
run: 'mkdir -p new-rpms
Expand Down
6 changes: 4 additions & 2 deletions .github/workflows/build-gnome49-package.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,11 +34,13 @@ jobs:

- name: Detect changed packages
id: detect
env:
PACKAGE_PATH: ${{ github.event.inputs.package_path || '' }}
run: |
SESSION_PKGS='mutter|gnome-shell|gdm'
if [[ -n "${{ github.event.inputs.package_path }}" ]]; then
if [[ -n "${PACKAGE_PATH}" ]]; then
# Manual dispatch: use explicit path
PACKAGES='["${{ github.event.inputs.package_path }}"]'
PACKAGES=$(python3 -c "import json; print(json.dumps(['${PACKAGE_PATH}']))")
else
# Detect from changed files
BASE="${{ github.event.pull_request.base.sha || github.event.before }}"
Expand Down
6 changes: 4 additions & 2 deletions .github/workflows/build-gnome50-package.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,10 +33,12 @@ jobs:

- name: Detect changed packages
id: detect
env:
PACKAGE_PATH: ${{ github.event.inputs.package_path || '' }}
run: |
SESSION_PKGS='mutter|gnome-shell|gdm'
if [[ -n "${{ github.event.inputs.package_path }}" ]]; then
PACKAGES='["${{ github.event.inputs.package_path }}"]'
if [[ -n "${PACKAGE_PATH}" ]]; then
PACKAGES=$(python3 -c "import json; print(json.dumps(['${PACKAGE_PATH}']))")
else
BASE="${{ github.event.pull_request.base.sha || github.event.before }}"
HEAD="${{ github.sha }}"
Expand Down
Loading
Loading