bazel
/
bazel-lib
mirror of https://github.com/bazel-contrib/bazel-lib
2
0
Fork 0
Code Issues Releases Activity

fix: github workflow vulnerable to script injection (#899) 

Signed-off-by: Diogo Teles Sant'Anna <diogoteles@google.com>
Co-authored-by: Alex Eagle <alex@aspect.dev>
This commit is contained in:
Diogo Teles Sant'Anna 2024-08-21 20:25:00 -03:00 committed by GitHub
parent 0870fadf4c
commit 07b98dc477
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 5 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
.github/workflows/ci.yaml vendored
View File

@ -13,6 +13,8 @@ concurrency:
# See https://docs.github.com/en/actions/using-jobs/using-concurrency and https://docs.github.com/en/actions/learn-github-actions/contexts for more info. # See https://docs.github.com/en/actions/using-jobs/using-concurrency and https://docs.github.com/en/actions/learn-github-actions/contexts for more info.
group: concurrency-group::${{ github.workflow }}::${{ github.event.pull_request.number > 0 && format('pr-{0}', github.event.pull_request.number) || github.ref_name }}${{ github.ref_name == 'main' && format('::{0}', github.run_id) || ''}} group: concurrency-group::${{ github.workflow }}::${{ github.event.pull_request.number > 0 && format('pr-{0}', github.event.pull_request.number) || github.ref_name }}${{ github.ref_name == 'main' && format('::{0}', github.run_id) || ''}}
cancel-in-progress: ${{ github.ref_name != 'main' }} cancel-in-progress: ${{ github.ref_name != 'main' }}
env:
HEAD_REF: ${{ github.head_ref }}
jobs: jobs:
# Prepares dynamic test matrix values # Prepares dynamic test matrix values
matrix-prep: matrix-prep:
@ -35,7 +37,7 @@ jobs:
# Don't run RBE if there is no API key which is the case on forks. # Don't run RBE if there is no API key which is the case on forks.
run: | run: |
a=( local ) a=( local )
if [[ "${{ github.ref_name }}" == "main" ]] || [[ "${{ github.head_ref }}" == *"rbe"* ]]; then if [[ "${{ github.ref_name }}" == "main" ]] || [[ "$HEAD_REF" == *"rbe"* ]]; then
if [[ "${{ env.BUILDBUDDY_API_KEY }}" ]]; then if [[ "${{ env.BUILDBUDDY_API_KEY }}" ]]; then
a+=( rbe ) a+=( rbe )
fi fi
@ -50,10 +52,10 @@ jobs:
# https://docs.github.com/en/billing/managing-billing-for-github-actions/about-billing-for-github-actions#included-storage-and-minutes # https://docs.github.com/en/billing/managing-billing-for-github-actions/about-billing-for-github-actions#included-storage-and-minutes
run: | run: |
a=( ubuntu ) a=( ubuntu )
if [[ "${{ github.ref_name }}" == "main" ]] || [[ "${{ github.head_ref }}" == *"macos"* ]]; then if [[ "${{ github.ref_name }}" == "main" ]] || [[ "$HEAD_REF" == *"macos"* ]]; then
a+=( macos ) a+=( macos )
fi fi
if [[ "${{ github.ref_name }}" == "main" ]] || [[ "${{ github.head_ref }}" == *"windows"* ]]; then if [[ "${{ github.ref_name }}" == "main" ]] || [[ "$HEAD_REF" == *"windows"* ]]; then
a+=( windows ) a+=( windows )
fi fi
printf -v j '"%s",' "${a[@]}" printf -v j '"%s",' "${a[@]}"