Skip to content

Commit c8d8087

Browse files
coffeegodddcoffeegoddd
authored
Merge pull request #3282 from dolthub/db/workflow-fix
/.github/workflows/bump-dependency.yaml: sanatize stuff
2 parents d977e49 + 037b7d1 commit c8d8087

File tree

2 files changed

+126
-42
lines changed

2 files changed

+126
-42
lines changed

‎.github/workflows/bump-dependency.yaml‎

Lines changed: 63 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -5,28 +5,31 @@ on:
55
types: [ bump-dependency ]
66

77
jobs:
8-
get-label:
9-
name: Get Label
10-
outputs:
11-
label: ${{ steps.get-label.outputs.label }}
8+
sanitize-payload:
9+
name: Sanitize Payload
1210
runs-on: ubuntu-22.04
11+
outputs:
12+
label: ${{ steps.sanitize.outputs.label }}
13+
safe_module: ${{ steps.sanitize.outputs.safe_module }}
14+
safe_head: ${{ steps.sanitize.outputs.safe_head }}
15+
safe_assignee: ${{ steps.sanitize.outputs.safe_assignee }}
16+
safe_email: ${{ steps.sanitize.outputs.safe_email }}
17+
safe_branch: ${{ steps.sanitize.outputs.safe_branch }}
18+
safe_short: ${{ steps.sanitize.outputs.safe_short }}
1319
steps:
14-
- name: Get Label
15-
id: get-label
20+
- uses: actions/checkout@v4
21+
- name: Validate & Sanitize Payload (script)
22+
id: sanitize
1623
env:
17-
REPO: ${{ github.event.client_payload.dependency }}
18-
run: |
19-
if [ "$REPO" == "vitess" ]
20-
then
21-
echo "label=vitess-bump" >> $GITHUB_OUTPUT
22-
else
23-
echo "$REPO is unsupported"
24-
exit 1
25-
fi
24+
RAW_DEP: ${{ github.event.client_payload.dependency }}
25+
RAW_SHA: ${{ github.event.client_payload.head_commit_sha }}
26+
RAW_USER: ${{ github.event.client_payload.assignee }}
27+
RAW_MAIL: ${{ github.event.client_payload.assignee_email }}
28+
run: bash .github/workflows/scripts/sanitize_payload.sh
2629

2730
stale-bump-prs:
2831
name: Retrieving Stale Bump PRs
29-
needs: get-label
32+
needs: sanitize-payload
3033
outputs:
3134
stale-pulls: ${{ steps.get-stale-prs.outputs.open-pulls }}
3235
runs-on: ubuntu-22.04
@@ -35,7 +38,7 @@ jobs:
3538
id: get-stale-prs
3639
uses: actions/github-script@v7
3740
env:
38-
LABEL: ${{ needs.get-label.outputs.label }}
41+
LABEL: ${{ needs.sanitize-payload.outputs.label }}
3942
with:
4043
debug: true
4144
github-token: ${{ secrets.REPO_ACCESS_TOKEN }}
@@ -85,7 +88,7 @@ jobs:
8588
}
8689
8790
open-bump-pr:
88-
needs: [get-label, stale-bump-prs]
91+
needs: [sanitize-payload, stale-bump-prs]
8992
name: Open Bump PR
9093
runs-on: ubuntu-22.04
9194
outputs:
@@ -94,48 +97,66 @@ jobs:
9497
- uses: actions/checkout@v4
9598
with:
9699
token: ${{ secrets.REPO_ACCESS_TOKEN || secrets.GITHUB_TOKEN }}
100+
97101
- name: Set up Go 1.x
98102
uses: actions/setup-go@v5
99103
with:
100104
go-version-file: go.mod
101-
- name: Bump dependency
102-
run: GOOS=linux go get github.com/dolthub/${{ github.event.client_payload.dependency }}@${{ github.event.client_payload.head_commit_sha }}
103-
- name: Get Assignee and Reviewer
105+
106+
- name: Bump dependency (safe)
107+
env:
108+
SAFE_MODULE: ${{ needs.sanitize-payload.outputs.safe_module }}
109+
SAFE_HEAD: ${{ needs.sanitize-payload.outputs.safe_head }}
110+
run: |
111+
set -euo pipefail
112+
IFS=$'\n\t'
113+
echo "Installing ${SAFE_MODULE}@${SAFE_HEAD}"
114+
GOOS=linux go get "${SAFE_MODULE}@${SAFE_HEAD}"
115+
116+
- name: Get Assignee and Reviewer (safe)
104117
id: get_reviewer
118+
env:
119+
ASSIGNEE: ${{ needs.sanitize-payload.outputs.safe_assignee }}
105120
run: |
106-
if [ "${{ github.event.client_payload.assignee }}" == "zachmu" ]
107-
then
108-
echo "reviewer=Hydrocharged" >> $GITHUB_OUTPUT
121+
set -euo pipefail
122+
if [ "${ASSIGNEE}" = "zachmu" ]; then
123+
echo "reviewer=Hydrocharged" >> "$GITHUB_OUTPUT"
109124
else
110-
echo "reviewer=zachmu" >> $GITHUB_OUTPUT
125+
echo "reviewer=zachmu" >> "$GITHUB_OUTPUT"
111126
fi
112-
- name: Get short hash
113-
id: short-sha
114-
run: |
115-
commit=${{ github.event.client_payload.head_commit_sha }}
116-
short=${commit:0:8}
117-
echo "short=$short" >> $GITHUB_OUTPUT
118-
- name: Create and Push new branch
127+
128+
- name: Create and Push new branch (safe)
129+
env:
130+
GIT_USER: ${{ needs.sanitize-payload.outputs.safe_assignee }}
131+
GIT_MAIL: ${{ needs.sanitize-payload.outputs.safe_email }}
132+
BRANCH: ${{ needs.sanitize-payload.outputs.safe_branch }}
133+
COMMIT_BY: ${{ needs.sanitize-payload.outputs.safe_assignee }}
119134
run: |
120-
git config --global --add user.name "${{ github.event.client_payload.assignee }}"
121-
git config --global --add user.email "${{ github.event.client_payload.assignee_email }}"
122-
branchname=${{ format('{0}-{1}', github.event.client_payload.assignee, steps.short-sha.outputs.short) }}
123-
git checkout -b "$branchname"
135+
set -euo pipefail
136+
IFS=$'\n\t'
137+
138+
git config --global user.name "${GIT_USER}"
139+
git config --global user.email "${GIT_MAIL}"
140+
141+
git checkout -b -- "${BRANCH}"
124142
git add .
125-
git commit -m "${{ format('[ga-bump-dep] Bump dependency in GMS by {0}', github.event.client_payload.assignee) }}"
126-
git push origin "$branchname"
143+
144+
# Commit message uses sanitized assignee only
145+
git commit -m "[ga-bump-dep] Bump dependency in GMS by ${COMMIT_BY}"
146+
git push origin "${BRANCH}"
147+
127148
- name: pull-request
128149
uses: repo-sync/pull-request@v2
129150
id: latest-pr
130151
with:
131-
source_branch: ${{ format('{0}-{1}', github.event.client_payload.assignee, steps.short-sha.outputs.short ) }}
152+
source_branch: ${{ needs.sanitize-payload.outputs.safe_branch }}
132153
destination_branch: "main"
133154
github_token: ${{ secrets.REPO_ACCESS_TOKEN }}
134-
pr_title: "[auto-bump] [no-release-notes] dependency by ${{ github.event.client_payload.assignee }}"
155+
pr_title: "[auto-bump] [no-release-notes] dependency by ${{ needs.sanitize-payload.outputs.safe_assignee }}"
135156
pr_template: ".github/markdown-templates/dep-bump.md"
136157
pr_reviewer: ${{ steps.get_reviewer.outputs.reviewer }}
137-
pr_assignee: ${{ github.event.client_payload.assignee }}
138-
pr_label: ${{ needs.get-label.outputs.label }}
158+
pr_assignee: ${{ needs.sanitize-payload.outputs.safe_assignee }}
159+
pr_label: ${{ needs.sanitize-payload.outputs.label }}
139160

140161
comment-on-stale-prs:
141162
needs: [open-bump-pr, stale-bump-prs]

‎.github/workflows/scripts/sanitize_payload.sh‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
#!/usr/bin/env bash
2+
3+
set -euo pipefail
4+
IFS=$'\n\t'
5+
6+
# Inputs via environment variables
7+
RAW_DEP=${RAW_DEP:-}
8+
RAW_SHA=${RAW_SHA:-}
9+
RAW_USER=${RAW_USER:-}
10+
RAW_MAIL=${RAW_MAIL:-}
11+
12+
# --- Validate dependency via allow-list and map to module path + label
13+
case "${RAW_DEP:-}" in
14+
vitess)
15+
MODULE='github.com/dolthub/vitess'
16+
LABEL='vitess-bump'
17+
;;
18+
*)
19+
echo "Unsupported dependency '${RAW_DEP:-}'" >&2
20+
exit 1
21+
;;
22+
esac
23+
24+
# --- Validate head SHA/tag (conservative)
25+
# allow only hex SHAs or safe tag-ish: letters, digits, dot, dash, underscore, plus
26+
if [ -z "${RAW_SHA:-}" ] || ! printf '%s' "$RAW_SHA" | grep -qE '^[A-Za-z0-9._+-]+$'; then
27+
echo "Invalid head_commit_sha" >&2
28+
exit 1
29+
fi
30+
31+
# Keep a short 8-char form if it's a hex SHA; otherwise derive short safe token
32+
if printf '%s' "$RAW_SHA" | grep -qiE '^[0-9a-f]{40}$'; then
33+
SHORT_SHA="${RAW_SHA:0:8}"
34+
else
35+
SHORT_SHA="$(printf '%s' "$RAW_SHA" | tr -cd 'A-Za-z0-9._+-' | cut -c1-12)"
36+
fi
37+
38+
# --- Validate assignee username (GitHub-compatible subset)
39+
if [ -z "${RAW_USER:-}" ] || ! printf '%s' "$RAW_USER" | grep -qE '^[A-Za-z0-9-]{1,39}$'; then
40+
echo "Invalid assignee username" >&2
41+
exit 1
42+
fi
43+
44+
# --- Validate email; if invalid, fall back to GitHub noreply
45+
if [ -n "${RAW_MAIL:-}" ] && printf '%s' "$RAW_MAIL" | grep -qE '^[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}$'; then
46+
SAFE_EMAIL="$RAW_MAIL"
47+
else
48+
SAFE_EMAIL="${RAW_USER}+noreply@users.noreply.github.com"
49+
fi
50+
51+
# --- Build a safe branch name: <assignee>-<short>
52+
BRANCH_NAME="$(printf '%s-%s' "$RAW_USER" "$SHORT_SHA" | tr -cd 'A-Za-z0-9._-')"
53+
54+
# Expose sanitized values as step outputs
55+
{
56+
echo "label=$LABEL"
57+
echo "safe_module=$MODULE"
58+
echo "safe_head=$RAW_SHA"
59+
echo "safe_assignee=$RAW_USER"
60+
echo "safe_email=$SAFE_EMAIL"
61+
echo "safe_branch=$BRANCH_NAME"
62+
echo "safe_short=$SHORT_SHA"
63+
} >> "${GITHUB_OUTPUT}"

0 commit comments

Comments
 (0)