Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(actions): Harden workflows when using variables in strings #384

Merged
merged 1 commit into from
Jun 7, 2024
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 10 additions & 10 deletions .github/workflows/dispatch-workflow.yml
Original file line number Diff line number Diff line change
Expand Up @@ -12,13 +12,13 @@ on:
workflow_dispatch:
inputs:
name:
description: "The workflow to update (with .yml)"
description: 'The workflow to update (with .yml)'
required: true
default: "node.yml"
default: 'node.yml'
page:
description: "Page of the repository list to check (currently 1-3)"
description: 'Page of the repository list to check (currently 1-3)'
required: true
default: "1"
default: '1'

jobs:
repositories:
Expand All @@ -39,7 +39,7 @@ jobs:
id: search-repos
# This is a simple curl to fetch the list of repos containing a file and extracting the repo names
run: |
REPOS=$(curl -H "Accept: application/vnd.github.v3+json" "https://github.com/gitapi/orgs/${{ github.repository_owner }}/repos?per_page=100&page=${{ github.event.inputs.page }}" | jq -c 'map(.name)')
REPOS=$(curl -H 'Accept: application/vnd.github.v3+json' 'https://github.com/gitapi/orgs/${{ github.repository_owner }}/repos?per_page=100&page=${{ github.event.inputs.page }}' | jq -c 'map(.name)')
echo "matrix=$REPOS" >> $GITHUB_OUTPUT

dispatch:
Expand Down Expand Up @@ -74,19 +74,19 @@ jobs:

- name: Copy workflow
if: steps.check_file_existence.outputs.files_exists == 'true'
run: cp ./source/workflow-templates/${{ github.event.inputs.name }} ./target/.github/workflows
run: cp './source/workflow-templates/${{ github.event.inputs.name }}' ./target/.github/workflows

- name: Create Pull Request
if: steps.check_file_existence.outputs.files_exists == 'true'
uses: peter-evans/create-pull-request@6d6857d36972b65feb161a90e484f2984215f83e # v4
with:
body: Automated update of the ${{ github.event.inputs.name }} workflow from https://github.com/${{ github.repository }}
branch: feat/workflow-auto-update-${{ github.event.inputs.name }}
commit-message: "chore(CI): Updating ${{ github.event.inputs.name }} workflow from template"
body: 'Automated update of the ${{ github.event.inputs.name }} workflow from https://github.com/${{ github.repository }}'
branch: 'feat/workflow-auto-update-${{ github.event.inputs.name }}'
commit-message: 'chore(CI): Updating ${{ github.event.inputs.name }} workflow from template'
committer: Nextcloud bot <bot@nextcloud.com>
author: Nextcloud bot <bot@nextcloud.com>
path: target
signoff: true
title: "chore(CI): Updating ${{ github.event.inputs.name }} workflow from template"
title: 'chore(CI): Updating ${{ github.event.inputs.name }} workflow from template'
labels: dependencies
token: ${{ secrets.TEMPLATE_WORKFLOW_DISPATCH_PAT }}
4 changes: 3 additions & 1 deletion .github/workflows/reuse.yml
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,8 @@ jobs:
test:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
- name: Checkout
uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6

- name: REUSE Compliance Check
uses: fsfe/reuse-action@a46482ca367aef4454a87620aa37c2be4b2f8106 # v3.0.0
6 changes: 3 additions & 3 deletions workflow-templates/appstore-build-publish.yml
Original file line number Diff line number Diff line change
Expand Up @@ -63,7 +63,7 @@ jobs:
- name: Set up npm ${{ steps.versions.outputs.npmVersion }}
# Skip if no package.json
if: ${{ steps.versions.outputs.npmVersion }}
run: npm i -g npm@"${{ steps.versions.outputs.npmVersion }}"
run: npm i -g 'npm@${{ steps.versions.outputs.npmVersion }}'

- name: Get php version
id: php-versions
Expand Down Expand Up @@ -129,7 +129,7 @@ jobs:
continue-on-error: true
id: server-checkout
run: |
NCVERSION=${{ fromJSON(steps.appinfo.outputs.result).nextcloud.min-version }}
NCVERSION='${{ fromJSON(steps.appinfo.outputs.result).nextcloud.min-version }}'
wget --quiet https://download.nextcloud.com/server/releases/latest-$NCVERSION.zip
unzip latest-$NCVERSION.zip

Expand All @@ -148,7 +148,7 @@ jobs:
tar -xvf ${{ env.APP_NAME }}.tar.gz
cd ../../../
# Setting up keys
echo "${{ secrets.APP_PRIVATE_KEY }}" > ${{ env.APP_NAME }}.key
echo '${{ secrets.APP_PRIVATE_KEY }}' > ${{ env.APP_NAME }}.key
wget --quiet "https://github.com/nextcloud/app-certificate-requests/raw/master/${{ env.APP_NAME }}/${{ env.APP_NAME }}.crt"
# Signing
php nextcloud/occ integrity:sign-app --privateKey=../${{ env.APP_NAME }}.key --certificate=../${{ env.APP_NAME }}.crt --path=../${{ env.APP_NAME }}/build/artifacts/${{ env.APP_NAME }}
Expand Down
4 changes: 2 additions & 2 deletions workflow-templates/block-merge-freeze.yml
Original file line number Diff line number Diff line change
Expand Up @@ -30,10 +30,10 @@ jobs:
steps:
- name: Register server reference to fallback to master branch
run: |
server_ref="$(if [ "${{ github.base_ref }}" = "main" ]; then echo -n "master"; else echo -n "${{ github.base_ref }}"; fi)"
server_ref="$(if [ '${{ github.base_ref }}' = 'main' ]; then echo -n 'master'; else echo -n '${{ github.base_ref }}'; fi)"
echo "server_ref=$server_ref" >> $GITHUB_ENV
- name: Download version.php from ${{ env.server_ref }}
run: curl https://github.com/raw/nextcloud/server/${{ env.server_ref }}/version.php --output version.php
run: curl 'https://github.com/raw/nextcloud/server/${{ env.server_ref }}/version.php' --output version.php

- name: Run check
run: cat version.php | grep 'OC_VersionString' | grep -i -v 'RC'
24 changes: 12 additions & 12 deletions workflow-templates/command-compile.yml
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,7 @@ jobs:
token: ${{ secrets.COMMAND_BOT_PAT }}
repository: ${{ github.event.repository.full_name }}
comment-id: ${{ github.event.comment.id }}
reactions: "+1"
reactions: '+1'

- name: Parse command
uses: skjnldsv/parse-command-comment@5c955203c52424151e6d0e58fb9de8a9f6a605a1 # v2
Expand Down Expand Up @@ -77,8 +77,8 @@ jobs:

- name: Setup git
run: |
git config --local user.email "nextcloud-command@users.noreply.github.com"
git config --local user.name "nextcloud-command"
git config --local user.email 'nextcloud-command@users.noreply.github.com'
git config --local user.name 'nextcloud-command'

- name: Read package.json node and npm engines version
uses: skjnldsv/read-package-engines-version-actions@06d6baf7d8f41934ab630e97d9e6c0bc9c9ac5e4 # v3
Expand All @@ -94,13 +94,13 @@ jobs:
cache: npm

- name: Set up npm ${{ steps.package-engines-versions.outputs.npmVersion }}
run: npm i -g npm@"${{ steps.package-engines-versions.outputs.npmVersion }}"
run: npm i -g 'npm@${{ steps.package-engines-versions.outputs.npmVersion }}'

- name: Rebase to ${{ needs.init.outputs.base_ref }}
if: ${{ contains(needs.init.outputs.arg1, 'rebase') }}
run: |
git fetch origin ${{ needs.init.outputs.base_ref }}:${{ needs.init.outputs.base_ref }}
git rebase origin/${{ needs.init.outputs.base_ref }}
git fetch origin '${{ needs.init.outputs.base_ref }}:${{ needs.init.outputs.base_ref }}'
git rebase 'origin/${{ needs.init.outputs.base_ref }}'

- name: Install dependencies & build
env:
Expand All @@ -113,30 +113,30 @@ jobs:
- name: Commit default
if: ${{ !contains(needs.init.outputs.arg1, 'fixup') && !contains(needs.init.outputs.arg1, 'amend') }}
run: |
git add ${{ github.workspace }}${{ needs.init.outputs.git_path }}
git add '${{ github.workspace }}${{ needs.init.outputs.git_path }}'
git commit --signoff -m 'chore(assets): Recompile assets'

- name: Commit fixup
if: ${{ contains(needs.init.outputs.arg1, 'fixup') }}
run: |
git add ${{ github.workspace }}${{ needs.init.outputs.git_path }}
git add '${{ github.workspace }}${{ needs.init.outputs.git_path }}'
git commit --fixup=HEAD --signoff

- name: Commit amend
if: ${{ contains(needs.init.outputs.arg1, 'amend') }}
run: |
git add ${{ github.workspace }}${{ needs.init.outputs.git_path }}
git add '${{ github.workspace }}${{ needs.init.outputs.git_path }}'
git commit --amend --no-edit --signoff
# Remove any [skip ci] from the amended commit
git commit --amend -m "$(git log -1 --format='%B' | sed '/\[skip ci\]/d')"

- name: Push normally
if: ${{ !contains(needs.init.outputs.arg1, 'rebase') && !contains(needs.init.outputs.arg1, 'amend') }}
run: git push origin ${{ needs.init.outputs.head_ref }}
run: git push origin '${{ needs.init.outputs.head_ref }}'

- name: Force push
if: ${{ contains(needs.init.outputs.arg1, 'rebase') || contains(needs.init.outputs.arg1, 'amend') }}
run: git push --force origin ${{ needs.init.outputs.head_ref }}
run: git push --force origin '${{ needs.init.outputs.head_ref }}'

- name: Add reaction on failure
uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4.0.0
Expand All @@ -145,4 +145,4 @@ jobs:
token: ${{ secrets.COMMAND_BOT_PAT }}
repository: ${{ github.event.repository.full_name }}
comment-id: ${{ github.event.comment.id }}
reactions: "-1"
reactions: '-1'
8 changes: 4 additions & 4 deletions workflow-templates/cypress.yml
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@ env:

# This represents the server branch to checkout.
# Usually it's the base branch of the PR, but for pushes it's the branch itself.
# e.g. 'main', 'stable27' or 'feature/my-feature
# e.g. 'main', 'stable27' or 'feature/my-feature'
# n.b. server will use head_ref, as we want to test the PR branch.
BRANCH: ${{ github.base_ref || github.ref_name }}

Expand Down Expand Up @@ -61,7 +61,7 @@ jobs:
node-version: ${{ steps.versions.outputs.nodeVersion }}

- name: Set up npm ${{ steps.versions.outputs.npmVersion }}
run: npm i -g npm@"${{ steps.versions.outputs.npmVersion }}"
run: npm i -g 'npm@${{ steps.versions.outputs.npmVersion }}'

- name: Install node dependencies & build app
run: |
Expand All @@ -83,7 +83,7 @@ jobs:
matrix:
# Run multiple copies of the current job in parallel
# Please increase the number or runners as your tests suite grows
containers: ["component", 1, 2, 3]
containers: ['component', '1', '2', '3']

name: runner ${{ matrix.containers }}

Expand All @@ -101,7 +101,7 @@ jobs:
node-version: ${{ needs.init.outputs.nodeVersion }}

- name: Set up npm ${{ needs.init.outputs.npmVersion }}
run: npm i -g npm@"${{ needs.init.outputs.npmVersion }}"
run: npm i -g 'npm@${{ needs.init.outputs.npmVersion }}'

- name: Run ${{ matrix.containers == 'component' && 'component' || 'E2E' }} cypress tests
uses: cypress-io/github-action@f88a151c986cab2e339cdbede6a5c4468bb62c17 # v6.7.0
Expand Down
2 changes: 1 addition & 1 deletion workflow-templates/documentation.yml
Original file line number Diff line number Diff line change
Expand Up @@ -42,7 +42,7 @@ jobs:
node-version: ${{ steps.versions.outputs.nodeVersion }}

- name: Set up npm ${{ steps.versions.outputs.npmVersion }}
run: npm i -g npm@"${{ steps.versions.outputs.npmVersion }}"
run: npm i -g 'npm@${{ steps.versions.outputs.npmVersion }}'

- name: Install dependencies & build
env:
Expand Down
2 changes: 1 addition & 1 deletion workflow-templates/lint-eslint.yml
Original file line number Diff line number Diff line change
Expand Up @@ -68,7 +68,7 @@ jobs:
node-version: ${{ steps.versions.outputs.nodeVersion }}

- name: Set up npm ${{ steps.versions.outputs.npmVersion }}
run: npm i -g npm@"${{ steps.versions.outputs.npmVersion }}"
run: npm i -g 'npm@${{ steps.versions.outputs.npmVersion }}'

- name: Install dependencies
env:
Expand Down
2 changes: 1 addition & 1 deletion workflow-templates/lint-stylelint.yml
Original file line number Diff line number Diff line change
Expand Up @@ -40,7 +40,7 @@ jobs:
node-version: ${{ steps.versions.outputs.nodeVersion }}

- name: Set up npm ${{ steps.versions.outputs.npmVersion }}
run: npm i -g npm@"${{ steps.versions.outputs.npmVersion }}"
run: npm i -g 'npm@${{ steps.versions.outputs.npmVersion }}'

- name: Install dependencies
env:
Expand Down
2 changes: 1 addition & 1 deletion workflow-templates/node-test.yml
Original file line number Diff line number Diff line change
Expand Up @@ -72,7 +72,7 @@ jobs:
node-version: ${{ steps.versions.outputs.nodeVersion }}

- name: Set up npm ${{ steps.versions.outputs.npmVersion }}
run: npm i -g npm@"${{ steps.versions.outputs.npmVersion }}"
run: npm i -g 'npm@${{ steps.versions.outputs.npmVersion }}'

- name: Install dependencies & build
env:
Expand Down
2 changes: 1 addition & 1 deletion workflow-templates/node.yml
Original file line number Diff line number Diff line change
Expand Up @@ -65,7 +65,7 @@ jobs:
node-version: ${{ steps.versions.outputs.nodeVersion }}

- name: Set up npm ${{ steps.versions.outputs.npmVersion }}
run: npm i -g npm@"${{ steps.versions.outputs.npmVersion }}"
run: npm i -g 'npm@${{ steps.versions.outputs.npmVersion }}'

- name: Install dependencies & build
env:
Expand Down
6 changes: 3 additions & 3 deletions workflow-templates/npm-audit-fix.yml
Original file line number Diff line number Diff line change
Expand Up @@ -44,7 +44,7 @@ jobs:
node-version: ${{ steps.versions.outputs.nodeVersion }}

- name: Set up npm ${{ steps.versions.outputs.npmVersion }}
run: npm i -g npm@"${{ steps.versions.outputs.npmVersion }}"
run: npm i -g 'npm@${{ steps.versions.outputs.npmVersion }}'

- name: Fix npm audit
id: npm-audit
Expand All @@ -63,12 +63,12 @@ jobs:
uses: peter-evans/create-pull-request@6d6857d36972b65feb161a90e484f2984215f83e # v6.0.5
with:
token: ${{ secrets.COMMAND_BOT_PAT }}
commit-message: "fix(deps): fix npm audit"
commit-message: 'fix(deps): Fix npm audit'
committer: GitHub <noreply@github.com>
author: nextcloud-command <nextcloud-command@users.noreply.github.com>
signoff: true
branch: automated/noid/${{ matrix.branches }}-fix-npm-audit
title: "[${{ matrix.branches }}] Fix npm audit"
title: '[${{ matrix.branches }}] Fix npm audit'
body: ${{ steps.npm-audit.outputs.markdown }}
labels: |
dependencies
Expand Down
2 changes: 1 addition & 1 deletion workflow-templates/npm-publish.yml
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,7 @@ jobs:
node-version: ${{ steps.versions.outputs.nodeVersion }}

- name: Set up npm ${{ steps.versions.outputs.npmVersion }}
run: npm i -g npm@"${{ steps.versions.outputs.npmVersion }}"
run: npm i -g 'npm@${{ steps.versions.outputs.npmVersion }}'

- name: Install dependencies & build
env:
Expand Down
2 changes: 1 addition & 1 deletion workflow-templates/openapi.yml
Original file line number Diff line number Diff line change
Expand Up @@ -66,7 +66,7 @@ jobs:

- name: Set up npm ${{ steps.node_versions.outputs.npmVersion }}
if: ${{ steps.node_versions.outputs.nodeVersion }}
run: npm i -g npm@"${{ steps.node_versions.outputs.npmVersion }}"
run: npm i -g 'npm@${{ steps.node_versions.outputs.npmVersion }}'

- name: Install dependencies & build
if: ${{ steps.node_versions.outputs.nodeVersion }}
Expand Down
6 changes: 3 additions & 3 deletions workflow-templates/phpunit-mariadb.yml
Original file line number Diff line number Diff line change
Expand Up @@ -110,7 +110,7 @@ jobs:
- name: Enable ONLY_FULL_GROUP_BY MariaDB option
run: |
echo "SET GLOBAL sql_mode=(SELECT CONCAT(@@sql_mode,',ONLY_FULL_GROUP_BY'));" | mysql -h 127.0.0.1 -P 4444 -u root -prootpassword
echo "SELECT @@sql_mode;" | mysql -h 127.0.0.1 -P 4444 -u root -prootpassword
echo 'SELECT @@sql_mode;' | mysql -h 127.0.0.1 -P 4444 -u root -prootpassword

- name: Check composer file existence
id: check_composer
Expand All @@ -137,7 +137,7 @@ jobs:
continue-on-error: true
working-directory: apps/${{ env.APP_NAME }}
run: |
composer run --list | grep "^ test:unit " | wc -l | grep 1
composer run --list | grep '^ test:unit ' | wc -l | grep 1

- name: PHPUnit
# Only run if phpunit config file exists
Expand All @@ -150,7 +150,7 @@ jobs:
continue-on-error: true
working-directory: apps/${{ env.APP_NAME }}
run: |
composer run --list | grep "^ test:integration " | wc -l | grep 1
composer run --list | grep '^ test:integration ' | wc -l | grep 1

- name: Run Nextcloud
# Only run if phpunit integration config file exists
Expand Down
6 changes: 3 additions & 3 deletions workflow-templates/phpunit-mysql.yml
Original file line number Diff line number Diff line change
Expand Up @@ -108,7 +108,7 @@ jobs:
- name: Enable ONLY_FULL_GROUP_BY MySQL option
run: |
echo "SET GLOBAL sql_mode=(SELECT CONCAT(@@sql_mode,',ONLY_FULL_GROUP_BY'));" | mysql -h 127.0.0.1 -P 4444 -u root -prootpassword
echo "SELECT @@sql_mode;" | mysql -h 127.0.0.1 -P 4444 -u root -prootpassword
echo 'SELECT @@sql_mode;' | mysql -h 127.0.0.1 -P 4444 -u root -prootpassword

- name: Check composer file existence
id: check_composer
Expand All @@ -135,7 +135,7 @@ jobs:
continue-on-error: true
working-directory: apps/${{ env.APP_NAME }}
run: |
composer run --list | grep "^ test:unit " | wc -l | grep 1
composer run --list | grep '^ test:unit ' | wc -l | grep 1

- name: PHPUnit
# Only run if phpunit config file exists
Expand All @@ -148,7 +148,7 @@ jobs:
continue-on-error: true
working-directory: apps/${{ env.APP_NAME }}
run: |
composer run --list | grep "^ test:integration " | wc -l | grep 1
composer run --list | grep '^ test:integration ' | wc -l | grep 1

- name: Run Nextcloud
# Only run if phpunit integration config file exists
Expand Down
4 changes: 2 additions & 2 deletions workflow-templates/phpunit-oci.yml
Original file line number Diff line number Diff line change
Expand Up @@ -143,7 +143,7 @@ jobs:
continue-on-error: true
working-directory: apps/${{ env.APP_NAME }}
run: |
composer run --list | grep "^ test:unit " | wc -l | grep 1
composer run --list | grep '^ test:unit ' | wc -l | grep 1

- name: PHPUnit
# Only run if phpunit config file exists
Expand All @@ -156,7 +156,7 @@ jobs:
continue-on-error: true
working-directory: apps/${{ env.APP_NAME }}
run: |
composer run --list | grep "^ test:integration " | wc -l | grep 1
composer run --list | grep '^ test:integration ' | wc -l | grep 1

- name: Run Nextcloud
# Only run if phpunit integration config file exists
Expand Down
4 changes: 2 additions & 2 deletions workflow-templates/phpunit-pgsql.yml
Original file line number Diff line number Diff line change
Expand Up @@ -133,7 +133,7 @@ jobs:
continue-on-error: true
working-directory: apps/${{ env.APP_NAME }}
run: |
composer run --list | grep "^ test:unit " | wc -l | grep 1
composer run --list | grep '^ test:unit ' | wc -l | grep 1

- name: PHPUnit
# Only run if phpunit config file exists
Expand All @@ -146,7 +146,7 @@ jobs:
continue-on-error: true
working-directory: apps/${{ env.APP_NAME }}
run: |
composer run --list | grep "^ test:integration " | wc -l | grep 1
composer run --list | grep '^ test:integration ' | wc -l | grep 1

- name: Run Nextcloud
# Only run if phpunit integration config file exists
Expand Down
Loading