chore: Allow use of run-script-and-commit GitHub action from non-Go projects #4049
Conversation
![semgrep-code-mongodb[bot]](https://avatars.githubusercontent.com/u/45120?s=60&v=4){kind=small}
| run: | | ||
| GO_MOD_PATH="${{ inputs.repo-path }}go.mod" | ||
| echo "go_mod_path=$GO_MOD_PATH" >> $GITHUB_OUTPUT | ||
| if [ -f "$GO_MOD_PATH" ]; then | ||
| echo "is_go_project=true" >> $GITHUB_OUTPUT | ||
| else | ||
| echo "is_go_project=false" >> $GITHUB_OUTPUT | ||
| fi | ||
There was a problem hiding this comment.
Using variable interpolation ${{...}} with github context data in a run: step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. github context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with env: to store the data and use the environment variable in the run: script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".
🚀 Fixed in commit 778f89c 🚀
There was a problem hiding this comment.
/fp no security issue as this code is equivalent to the previous code and we control what paths we pass
There was a problem hiding this comment.
it may help to pass this as an env var or atleast validate via regex that repo-path can only be a path-like string
There was a problem hiding this comment.
@maastha cc @manupedrozo @EspenAlbert at the end I've changed repo-path to go-mod-path as it's only used for that, changed here: 778f89c
and adapted CFN repo which is the only one using it: mongodb/mongodbatlas-cloudformation-resources#1526
There was a problem hiding this comment.
Pull request overview
This PR enables the run-script-and-commit GitHub action to work with non-Go projects (such as Terraform modules) by making Go setup conditional based on the presence of a go.mod file.
- Adds conditional logic to detect whether the repository is a Go project
- Makes the Go setup step conditional based on project type detection
- Adds fetch-tags parameter to checkout action
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c | ||
| with: | ||
| go-version-file: ${{ format('{0}go.mod', inputs.repo-path) }} | ||
| go-version-file: ${{ steps.check-go.outputs.go_mod_path }} |
There was a problem hiding this comment.
| go-version-file: ${{ steps.check-go.outputs.go_mod_path }} | |
| go-version-file: ${{ steps.check-go.outputs.go_mod_path }} | |
| using: "composite" | ||
| steps: | ||
| - name: Checkout repository | ||
| uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 |
There was a problem hiding this comment.
what repository is checked out here when this is called from a different repo?
There was a problem hiding this comment.
callee repo, for example cluster module repo
Description
Allow use of run-script-and-commit GitHub action from non-Go projects, for example Terraform module repos.
Also fetches tags in case they're needed by the script to execute.
Link to any related issue(s): CLOUDP-365072
Type of change:
Required Checklist:
Further comments