BUILD-7996: Security fixes#95
Conversation
There was a problem hiding this comment.
Pull Request Overview
This PR implements security fixes to prevent command injection vulnerabilities in GitHub Actions workflows and shell scripts by adding input validation and using environment variables instead of direct parameter interpolation.
- Adds version format validation to prevent environment variable injection in shell scripts
- Replaces direct parameter interpolation with environment variables in GitHub Actions steps
- Implements tag format validation for workflow inputs
Reviewed Changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| releasability-status/find_version.sh | Adds regex validation for version format to prevent injection attacks |
| releasability-status/action.yml | Uses environment variables instead of direct step output interpolation |
| .github/workflows/update-v-branch.yml | Adds tag validation and uses environment variables for safe parameter passing |
Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.
28349db to
591ad08
Compare
Signed-off-by: Jayadeep Kinavoor Madam <jayadeep.kinavoormadam@sonarsource.com>
591ad08 to
43078ce
Compare
🤖 Pull Request summaryUpdates GitHub workflows with security hardening and input validation. • Quote GitHub Actions variables in pre-commit workflow to prevent shell injection Review focus: Verify the regex patterns correctly validate expected formats and ensure the security improvements don't break existing functionality with edge cases.
|
julien-carsique-sonarsource
left a comment
There was a problem hiding this comment.
Some inconsistency remains: why using an ENV intermediate in some cases and not in others (like ${{ inputs.optional_checks }})?
Can you clarify the rules that were applied? Not the descriptions that are generated by Copilot and SQ, but the intention, the goal to achieve.
Maybe https://sonarsource.atlassian.net/browse/BUILD-7996?focusedCommentId=823178?
|
Hi @julien-carsique-sonarsource , thanks a lot for your review! The rules are described here. 
Regarding You can find the excel sheet and other relevant information in the parent ticket |
BUILD-7996: Security fixes