Skip to content

Commit 49f77c9

Browse files
xaosciencexaoscience
committed
fix(security): resolve CodeQL envvar-injection and code-injection alerts
- release.yml: remove unused VERSION env var from 'List build artifacts' step; switch all GITHUB_ENV writes to heredoc delimiter pattern (GHEOF) to prevent environment variable injection (actions/envvar-injection/critical) - release.yml: move vars.SIGNPATH_ORG_ID and vars.SIGNPATH_PROJECT_SLUG to env block in signing step (proactive code-injection prevention) - sign-artifacts.yml: move all ${{ }} expressions (inputs.*, vars.*, steps.*.outputs.*) from run blocks to env blocks (actions/code-injection/medium × 7) - sign-artifacts.yml: pin signpath/github-action-submit-signing-request to SHA ced31329c0317e779dad2eec2a7c3bb46ea1343e (actions/unpinned-tag) Resolves: EGS-LL CodeQL alerts #7-#15
1 parent 6cf0e3a commit 49f77c9

3 files changed

Lines changed: 88 additions & 40 deletions

File tree

‎.github/workflows/release.yml‎

Lines changed: 36 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -608,45 +608,63 @@ jobs:
608608
609609
- name: List build artifacts
610610
if: steps.check_release.outputs.exists != 'true'
611-
env:
612-
VERSION: ${{ steps.version.outputs.version }}
613611
run: |
614612
if [[ ! -d "dist" ]]; then
615613
echo "⚠️ No dist/ directory - no tarballs were built"
616-
SAFE_TARBALL_COUNT=$(printf '%s' "0" | tr -d '\n\r')
617-
echo "tarball_count=${SAFE_TARBALL_COUNT}" >> $GITHUB_ENV
614+
{
615+
echo 'tarball_count<<GHEOF'
616+
echo '0'
617+
echo 'GHEOF'
618+
} >> "$GITHUB_ENV"
618619
exit 0
619620
fi
620-
621+
621622
echo "📦 Build artifacts:"
622623
ls -la dist/ || true
623-
624+
624625
# Get main tarball info (first .tar.gz that's not a sub-package)
625626
TARBALL=$(ls dist/*.tar.gz 2>/dev/null | head -1 || echo "")
626627
if [[ -n "$TARBALL" ]]; then
627-
# Sanitize values to a single line before exporting to GITHUB_ENV
628628
SAFE_TARBALL=$(printf '%s' "$TARBALL" | tr -d '\n\r')
629629
SAFE_TARBALL_NAME=$(basename "$SAFE_TARBALL" | tr -d '\n\r')
630-
echo "tarball_path=${SAFE_TARBALL}" >> $GITHUB_ENV
631-
echo "tarball_name=${SAFE_TARBALL_NAME}" >> $GITHUB_ENV
632-
630+
{
631+
echo 'tarball_path<<GHEOF'
632+
printf '%s\n' "$SAFE_TARBALL"
633+
echo 'GHEOF'
634+
echo 'tarball_name<<GHEOF'
635+
printf '%s\n' "$SAFE_TARBALL_NAME"
636+
echo 'GHEOF'
637+
} >> "$GITHUB_ENV"
638+
633639
if [[ -f "${TARBALL}.sha256" ]]; then
634640
SHA256=$(cat "${TARBALL}.sha256" | awk '{print $1}')
635641
SAFE_SHA256=$(printf '%s' "$SHA256" | tr -d '\n\r')
636-
echo "tarball_sha256=${SAFE_SHA256}" >> $GITHUB_ENV
642+
{
643+
echo 'tarball_sha256<<GHEOF'
644+
printf '%s\n' "$SAFE_SHA256"
645+
echo 'GHEOF'
646+
} >> "$GITHUB_ENV"
637647
echo "🔐 Tarball SHA256: ${SAFE_SHA256}"
638648
fi
639649
fi
640-
650+
641651
# Count all tarballs for summary
642652
TARBALL_COUNT=$(ls dist/*.tar.gz 2>/dev/null | wc -l || echo "0")
643653
SAFE_TARBALL_COUNT=$(printf '%s' "$TARBALL_COUNT" | tr -d '\n\r')
644-
echo "tarball_count=${SAFE_TARBALL_COUNT}" >> $GITHUB_ENV
654+
{
655+
echo 'tarball_count<<GHEOF'
656+
printf '%s\n' "$SAFE_TARBALL_COUNT"
657+
echo 'GHEOF'
658+
} >> "$GITHUB_ENV"
645659
646660
# Count build workflow artifacts (non-tarball files)
647661
BUILD_ARTIFACT_COUNT=$(find dist/ -maxdepth 1 -type f ! -name "*.tar.gz" ! -name "*.sha256" ! -name "SHA256SUMS.txt" 2>/dev/null | wc -l || echo "0")
648662
SAFE_BUILD_ARTIFACT_COUNT=$(printf '%s' "$BUILD_ARTIFACT_COUNT" | tr -d '\n\r')
649-
echo "build_artifact_count=${SAFE_BUILD_ARTIFACT_COUNT}" >> $GITHUB_ENV
663+
{
664+
echo 'build_artifact_count<<GHEOF'
665+
printf '%s\n' "$SAFE_BUILD_ARTIFACT_COUNT"
666+
echo 'GHEOF'
667+
} >> "$GITHUB_ENV"
650668
651669
# ========================================================================
652670
# CODE SIGNING: Authenticode signing via SignPath.io (optional)
@@ -672,9 +690,11 @@ jobs:
672690
&& steps.build_workflows.outputs.has_builds == 'true'
673691
env:
674692
SIGNPATH_API_TOKEN: ${{ secrets.SIGNPATH_API_TOKEN }}
693+
SIGNPATH_ORG_ID: ${{ vars.SIGNPATH_ORG_ID }}
694+
SIGNPATH_PROJECT_SLUG: ${{ vars.SIGNPATH_PROJECT_SLUG }}
675695
run: |
676-
ORG_ID="${{ vars.SIGNPATH_ORG_ID }}"
677-
PROJECT="${{ vars.SIGNPATH_PROJECT_SLUG }}"
696+
ORG_ID="${SIGNPATH_ORG_ID}"
697+
PROJECT="${SIGNPATH_PROJECT_SLUG}"
678698
POLICY="release-signing"
679699
CONFIG="exe"
680700

‎workflows-templates/release.yml‎

Lines changed: 36 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -611,45 +611,63 @@ jobs:
611611
612612
- name: List build artifacts
613613
if: steps.check_release.outputs.exists != 'true'
614-
env:
615-
VERSION: ${{ steps.version.outputs.version }}
616614
run: |
617615
if [[ ! -d "dist" ]]; then
618616
echo "⚠️ No dist/ directory - no tarballs were built"
619-
SAFE_TARBALL_COUNT=$(printf '%s' "0" | tr -d '\n\r')
620-
echo "tarball_count=${SAFE_TARBALL_COUNT}" >> $GITHUB_ENV
617+
{
618+
echo 'tarball_count<<GHEOF'
619+
echo '0'
620+
echo 'GHEOF'
621+
} >> "$GITHUB_ENV"
621622
exit 0
622623
fi
623-
624+
624625
echo "📦 Build artifacts:"
625626
ls -la dist/ || true
626-
627+
627628
# Get main tarball info (first .tar.gz that's not a sub-package)
628629
TARBALL=$(ls dist/*.tar.gz 2>/dev/null | head -1 || echo "")
629630
if [[ -n "$TARBALL" ]]; then
630-
# Sanitize values to a single line before exporting to GITHUB_ENV
631631
SAFE_TARBALL=$(printf '%s' "$TARBALL" | tr -d '\n\r')
632632
SAFE_TARBALL_NAME=$(basename "$SAFE_TARBALL" | tr -d '\n\r')
633-
echo "tarball_path=${SAFE_TARBALL}" >> $GITHUB_ENV
634-
echo "tarball_name=${SAFE_TARBALL_NAME}" >> $GITHUB_ENV
635-
633+
{
634+
echo 'tarball_path<<GHEOF'
635+
printf '%s\n' "$SAFE_TARBALL"
636+
echo 'GHEOF'
637+
echo 'tarball_name<<GHEOF'
638+
printf '%s\n' "$SAFE_TARBALL_NAME"
639+
echo 'GHEOF'
640+
} >> "$GITHUB_ENV"
641+
636642
if [[ -f "${TARBALL}.sha256" ]]; then
637643
SHA256=$(cat "${TARBALL}.sha256" | awk '{print $1}')
638644
SAFE_SHA256=$(printf '%s' "$SHA256" | tr -d '\n\r')
639-
echo "tarball_sha256=${SAFE_SHA256}" >> $GITHUB_ENV
645+
{
646+
echo 'tarball_sha256<<GHEOF'
647+
printf '%s\n' "$SAFE_SHA256"
648+
echo 'GHEOF'
649+
} >> "$GITHUB_ENV"
640650
echo "🔐 Tarball SHA256: ${SAFE_SHA256}"
641651
fi
642652
fi
643-
653+
644654
# Count all tarballs for summary
645655
TARBALL_COUNT=$(ls dist/*.tar.gz 2>/dev/null | wc -l || echo "0")
646656
SAFE_TARBALL_COUNT=$(printf '%s' "$TARBALL_COUNT" | tr -d '\n\r')
647-
echo "tarball_count=${SAFE_TARBALL_COUNT}" >> $GITHUB_ENV
657+
{
658+
echo 'tarball_count<<GHEOF'
659+
printf '%s\n' "$SAFE_TARBALL_COUNT"
660+
echo 'GHEOF'
661+
} >> "$GITHUB_ENV"
648662
649663
# Count build workflow artifacts (non-tarball files)
650664
BUILD_ARTIFACT_COUNT=$(find dist/ -maxdepth 1 -type f ! -name "*.tar.gz" ! -name "*.sha256" ! -name "SHA256SUMS.txt" 2>/dev/null | wc -l || echo "0")
651665
SAFE_BUILD_ARTIFACT_COUNT=$(printf '%s' "$BUILD_ARTIFACT_COUNT" | tr -d '\n\r')
652-
echo "build_artifact_count=${SAFE_BUILD_ARTIFACT_COUNT}" >> $GITHUB_ENV
666+
{
667+
echo 'build_artifact_count<<GHEOF'
668+
printf '%s\n' "$SAFE_BUILD_ARTIFACT_COUNT"
669+
echo 'GHEOF'
670+
} >> "$GITHUB_ENV"
653671
654672
# ========================================================================
655673
# CODE SIGNING: Authenticode signing via SignPath.io (optional)
@@ -675,9 +693,11 @@ jobs:
675693
&& steps.build_workflows.outputs.has_builds == 'true'
676694
env:
677695
SIGNPATH_API_TOKEN: ${{ secrets.SIGNPATH_API_TOKEN }}
696+
SIGNPATH_ORG_ID: ${{ vars.SIGNPATH_ORG_ID }}
697+
SIGNPATH_PROJECT_SLUG: ${{ vars.SIGNPATH_PROJECT_SLUG }}
678698
run: |
679-
ORG_ID="${{ vars.SIGNPATH_ORG_ID }}"
680-
PROJECT="${{ vars.SIGNPATH_PROJECT_SLUG }}"
699+
ORG_ID="${SIGNPATH_ORG_ID}"
700+
PROJECT="${SIGNPATH_PROJECT_SLUG}"
681701
POLICY="release-signing"
682702
CONFIG="exe"
683703

‎workflows-templates/sign-artifacts.yml‎

Lines changed: 16 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -112,10 +112,14 @@ jobs:
112112
steps:
113113
- name: Check signing prerequisites
114114
id: preflight
115+
env:
116+
INPUT_PROJECT_SLUG: ${{ inputs.project_slug }}
117+
VAR_PROJECT_SLUG: ${{ vars.SIGNPATH_PROJECT_SLUG }}
118+
VAR_ORG_ID: ${{ vars.SIGNPATH_ORG_ID }}
115119
run: |
116-
PROJECT="${{ inputs.project_slug }}"
117-
[[ -z "$PROJECT" ]] && PROJECT="${{ vars.SIGNPATH_PROJECT_SLUG }}"
118-
ORG_ID="${{ vars.SIGNPATH_ORG_ID }}"
120+
PROJECT="${INPUT_PROJECT_SLUG}"
121+
[[ -z "$PROJECT" ]] && PROJECT="${VAR_PROJECT_SLUG}"
122+
ORG_ID="${VAR_ORG_ID}"
119123
120124
if [[ -z "$ORG_ID" ]]; then
121125
echo "⚠️ SIGNPATH_ORG_ID not set — skipping code signing"
@@ -146,7 +150,7 @@ jobs:
146150
- name: Submit signing request
147151
id: sign
148152
if: steps.preflight.outputs.skip != 'true'
149-
uses: signpath/github-action-submit-signing-request@v1
153+
uses: signpath/github-action-submit-signing-request@ced31329c0317e779dad2eec2a7c3bb46ea1343e # v1
150154
with:
151155
api-token: ${{ secrets.SIGNPATH_API_TOKEN }}
152156
organization-id: ${{ steps.preflight.outputs.org_id }}
@@ -168,14 +172,18 @@ jobs:
168172

169173
- name: Report signing result
170174
if: always()
175+
env:
176+
PREFLIGHT_SKIP: ${{ steps.preflight.outputs.skip }}
177+
SIGN_OUTCOME: ${{ steps.sign.outcome }}
178+
ARTIFACT_NAME: ${{ inputs.artifact_name }}
171179
run: |
172-
if [[ "${{ steps.preflight.outputs.skip }}" == "true" ]]; then
180+
if [[ "$PREFLIGHT_SKIP" == "true" ]]; then
173181
echo "outcome=skipped" >> "$GITHUB_OUTPUT"
174182
echo "⏭️ Code signing was skipped (missing configuration)"
175-
elif [[ "${{ steps.sign.outcome }}" == "success" ]]; then
183+
elif [[ "$SIGN_OUTCOME" == "success" ]]; then
176184
echo "outcome=success" >> "$GITHUB_OUTPUT"
177-
echo "✅ Artefact '${{ inputs.artifact_name }}' signed successfully"
185+
echo "✅ Artefact '${ARTIFACT_NAME}' signed successfully"
178186
else
179187
echo "outcome=failure" >> "$GITHUB_OUTPUT"
180-
echo "❌ Signing failed for '${{ inputs.artifact_name }}'"
188+
echo "❌ Signing failed for '${ARTIFACT_NAME}'"
181189
fi

0 commit comments

Comments
 (0)