Skip to content

BUILD-7996 security fixes#89

Merged
tomverin merged 1 commit intomasterfrom
feat/tom/BUILD-7996
Jul 8, 2025
Merged

BUILD-7996 security fixes#89
tomverin merged 1 commit intomasterfrom
feat/tom/BUILD-7996

Conversation

@tomverin
Copy link
Copy Markdown
Contributor

@tomverin tomverin commented Jul 1, 2025

No description provided.

@tomverin tomverin force-pushed the feat/tom/BUILD-7996 branch 10 times, most recently from 69a6d24 to af5f9c0 Compare July 3, 2025 13:39
@tomverin tomverin marked this pull request as ready for review July 3, 2025 13:41
Copilot AI review requested due to automatic review settings July 3, 2025 13:41
@tomverin tomverin requested a review from a team as a code owner July 3, 2025 13:41
Copy link
Copy Markdown

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

Enhance security by validating environment variables and action inputs, and restrict modifications to the CODEOWNERS file.

  • Add presence and format checks for GitHub environment variables and version output in find_version.sh
  • Introduce input and context variable validations in workflow definitions (releasability-status/action.yml, action.yml)
  • Protect the CODEOWNERS file itself by assigning owners explicitly

Reviewed Changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File Description
releasability-status/find_version.sh Added env var presence checks, regex validations, and safe API URL build
releasability-status/action.yml Validated optional_checks input and GitHub context variables
action.yml Validated action inputs (organization, repository, branch, version, commit-sha, environment) before running commands
.github/CODEOWNERS Assigned explicit ownership to protect the CODEOWNERS file
Comments suppressed due to low confidence (4)

action.yml:119

  • The input name releasabily-env is misspelled, so this validation block never runs. It should be releasability-env to match the intended input.
        if [[ ! "${{ inputs.releasabily-env }}" =~ ^(prod|staging|dev)$ ]]; then

releasability-status/action.yml:35

  • [nitpick] The optional_checks regex only allows alphanumeric, commas, and spaces, but context names often include hyphens and underscores. Consider adding - and _ to the allowed characters.
        if [[ ! "${{ inputs.optional_checks }}" =~ ^[a-zA-Z0-9, ]*$ ]]; then

action.yml:96

  • The repository name validation includes \s to allow spaces, but GitHub repository names cannot contain spaces. Consider removing whitespace from the allowed pattern.
        if [[ ! "${{ inputs.repository }}" =~ ^[a-zA-Z0-9][a-zA-Z0-9._\s-]*[a-zA-Z0-9]$ ]] || [[ "${{ inputs.repository }}" =~ \.git$ ]]; then

releasability-status/find_version.sh:8

  • Consider adding automated tests for the new environment variable and version format validations to ensure they behave correctly under both valid and invalid inputs.
# Validate environment variables

Comment thread releasability-status/find_version.sh Outdated
@tomverin tomverin force-pushed the feat/tom/BUILD-7996 branch 4 times, most recently from 71cd8bd to e2d727f Compare July 3, 2025 13:49
@tomverin tomverin force-pushed the feat/tom/BUILD-7996 branch from e2d727f to 93e5259 Compare July 3, 2025 14:30
@sonarqubecloud
Copy link
Copy Markdown

sonarqubecloud Bot commented Jul 3, 2025

@tomverin tomverin merged commit df307da into master Jul 8, 2025
7 checks passed
@tomverin tomverin deleted the feat/tom/BUILD-7996 branch July 8, 2025 09:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants