feat(ci): compare lists of packages to deliver to testing repositories (#3206)#3209
feat(ci): compare lists of packages to deliver to testing repositories (#3206)#3209mushroomempires wants to merge 14 commits into
Conversation
|
Important Review skippedAuto reviews are limited based on label configuration. 🏷️ Required labels (at least one) (1)
Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Repository UI Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
📝 Coding Plan
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment Tip CodeRabbit can approve the review once all CodeRabbit's comments are resolved.Enable the |
mushroomempires
requested review from
kduret and
tuntoja
and removed request for
a team
…llect into MON-195796-dev-25.10.x
![aikido-pr-checks[bot]](https://avatars.githubusercontent.com/in/898896?s=60&v=4){kind=small}
| @@ -85,7 +93,8 @@ runs: | |||
| ROOT_REPO_PATH_SUFFIX="-internal" | |||
| fi | |||
|
|
|||
| ROOT_REPO_PATH="${ROOT_REPO_PATH_PREFIX}standard${ROOT_REPO_PATH_SUFFIX}" | |||
| ROOT_REPO_PATH="${ROOT_REPO_PATH_PREFIX}kdu${ROOT_REPO_PATH_SUFFIX}" | |||
| echo "root_repo_path=$ROOT_REPO_PATH" >> $GITHUB_OUTPUT | |||
|
|
|||
| # Cleanup (equivalent to --sync-deletes done with RPMs) | |||
| # This is a workaround the fact that jfrog cli does not allow upload | |||
| @@ -133,4 +142,18 @@ runs: | |||
| done | |||
|
|
|||
| curl -H "Authorization: Bearer ${{ inputs.artifactory_token }}" -X POST "https://centreon.jfrog.io/artifactory/api/deb/reindex/$ROOT_REPO_PATH?async=0" | |||
|
|
|||
There was a problem hiding this comment.
Template Injection in GitHub Workflows Action - critical severity
A GitHub Actions workflow step contains a template expression referencing potentially untrusted GitHub context fields. This may allow malicious input to be injected into shell commands, leading to a potential supply chain attack as tokens of the CI/CD pipeline could be exfiltrated.
Show fix
Remediation: Review your GitHub Actions workflow for any template expressions that interpolate GitHub context values, especially those ending with unsafe suffixes such as 'body', 'title', 'email', 'head_ref', etc. Sanitize or validate these inputs before use, or refactor the workflow to avoid directly embedding untrusted data in shell commands.
Reply @AikidoSec ignore: [REASON] to ignore this issue.
More info
| run: | | ||
| DELIVERED_PACKAGES=$(jf rt search "${{ steps.publish-debs.outputs.root_repo_path }}/pool/${{ inputs.version }}/${{ inputs.stability }}/${{ inputs.release_type }}/${{ inputs.module_name }}/*.deb" | jq -r '.[].path | split("/") | last') | ||
| ORIGINAL_PACKAGES=$(cat deb_packages.txt) | ||
| MISSING_PACKAGES=0 | ||
| for PACKAGE in $ORIGINAL_PACKAGES; do | ||
| if ! echo "$DELIVERED_PACKAGES" | grep -q "$(basename "$PACKAGE")"; then | ||
| echo "::error::[${{ github.job }}] Package $PACKAGE was not successfully delivered or found in repository." | ||
| MISSING_PACKAGES=1 | ||
| fi | ||
| done | ||
| [[ $MISSING_PACKAGES -eq 0 ]] || exit 1 |
There was a problem hiding this comment.
Template Injection in GitHub Workflows Action - critical severity
A GitHub Actions workflow step contains a template expression referencing potentially untrusted GitHub context fields. This may allow malicious input to be injected into shell commands, leading to a potential supply chain attack as tokens of the CI/CD pipeline could be exfiltrated.
Show fix
Remediation: Review your GitHub Actions workflow for any template expressions that interpolate GitHub context values, especially those ending with unsafe suffixes such as 'body', 'title', 'email', 'head_ref', etc. Sanitize or validate these inputs before use, or refactor the workflow to avoid directly embedding untrusted data in shell commands.
Reply @AikidoSec ignore: [REASON] to ignore this issue.
More info
| run: | | ||
| DELIVERED_PACKAGES=$(jf rt search "${{ steps.publish-rpms.outputs.root_repo_path }}/${{ inputs.version }}/${{ inputs.distrib }}/${{ inputs.stability }}-${{ inputs.release_type }}/${{ inputs.module_name }}/*.rpm" | jq -r '.[].path | split("/") | last') | ||
| ORIGINAL_PACKAGES=$(cat rpm_packages.txt) | ||
| MISSING_PACKAGES=0 | ||
| for PACKAGE in $ORIGINAL_PACKAGES; do | ||
| if ! echo "$DELIVERED_PACKAGES" | grep -q "$(basename "$PACKAGE")"; then | ||
| echo "::error::[${{ github.job }}] Package $PACKAGE was not successfully delivered or found in repository." | ||
| MISSING_PACKAGES=1 | ||
| continue | ||
| fi | ||
| done | ||
| [[ $MISSING_PACKAGES -eq 0 ]] || exit 1 |
There was a problem hiding this comment.
Template Injection in GitHub Workflows Action - critical severity
A GitHub Actions workflow step contains a template expression referencing potentially untrusted GitHub context fields. This may allow malicious input to be injected into shell commands, leading to a potential supply chain attack as tokens of the CI/CD pipeline could be exfiltrated.
Show fix
Remediation: Review your GitHub Actions workflow for any template expressions that interpolate GitHub context values, especially those ending with unsafe suffixes such as 'body', 'title', 'email', 'head_ref', etc. Sanitize or validate these inputs before use, or refactor the workflow to avoid directly embedding untrusted data in shell commands.
Reply @AikidoSec ignore: [REASON] to ignore this issue.
More info
|
🤖 This is an automatic comment generated by an internal tool. Complexity Classification: StandardJustification: Automatic classification failed; defaulting to standard.
A maintainer can override this classification at any time. |
3 participants
Description
Fixes # MON-195796
Type of change
Target serie
How this pull request can be tested ?
Please describe the procedure to verify that the goal of the PR is matched. Provide clear instructions so that it can be correctly tested.
Any relevant details of the configuration to perform the test should be added.
Checklist
Summary by Aikido
⚡ Enhancements
More info