Conversation
|
This comment ensures that the correct Slack channel is notified after the team/project label See this comment for details. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
|
||
| - if: ${{ env.use_deprecated_ssh_var == 'false' }} | ||
| name: Set up SSH | ||
| uses: webfactory/ssh-agent@v0.9.0 |
Check warning
Code scanning / CodeQL
Unpinned tag for a non-immutable Action in workflow Medium
|
|
||
| - if: ${{ env.use_deprecated_ssh_var == 'true' }} | ||
| name: Set up SSH | ||
| uses: webfactory/ssh-agent@v0.9.0 |
Check warning
Code scanning / CodeQL
Unpinned tag for a non-immutable Action in workflow Medium
| ${{ inputs.gen-cache-path}} | ||
|
|
||
| - name: Set up Docker Buildx | ||
| uses: useblacksmith/setup-docker-builder@v1 |
Check warning
Code scanning / CodeQL
Unpinned tag for a non-immutable Action in workflow Medium
| - if: ${{ env.use_workload_identity == 'false' }} | ||
| name: Authenticate with Google Cloud (Service Account Key) | ||
| id: auth | ||
| uses: google-github-actions/auth@v2 |
Check warning
Code scanning / CodeQL
Unpinned tag for a non-immutable Action in workflow Medium
| if: ${{ env.use_workload_identity == 'false' }} | ||
| run: | | ||
| docker login -u _json_key \ | ||
| --password-stdin ${{ inputs.registry }} < ${{ steps.auth.outputs.credentials_file_path }} |
Check warning
Code scanning / CodeQL
Code injection Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 4 months ago
To fix this problem, we should avoid direct use of ${{ inputs.registry }} inside the shell script. Instead, declare an environment variable (e.g., REGISTRY) set to ${{ inputs.registry }} in the workflow step, then reference $REGISTRY inside the shell script using native shell syntax (double quotes). This is best-practice for preventing code injection because it removes the risk of parsing user input as shell code. Only edit the affected step(s), leaving other functionality untouched.
Specifically, edit the step at original line 231, modifying its declaration to add the environment variable and reference it natively as $REGISTRY in the script. No additional dependencies or imports are required.
| @@ -228,9 +228,11 @@ | ||
|
|
||
| - name: Docker login (Google Crediential file) | ||
| if: ${{ env.use_workload_identity == 'false' }} | ||
| env: | ||
| REGISTRY: ${{ inputs.registry }} | ||
| run: | | ||
| docker login -u _json_key \ | ||
| --password-stdin ${{ inputs.registry }} < ${{ steps.auth.outputs.credentials_file_path }} | ||
| --password-stdin "$REGISTRY" < ${{ steps.auth.outputs.credentials_file_path }} | ||
|
|
||
| # Auth with workload-identity | ||
| # to become defacto |
| - id: auth_with_workload_identity | ||
| name: Authenticate with Google Cloud (Workload Identity) | ||
| if: ${{ env.use_workload_identity == 'true' }} | ||
| uses: google-github-actions/auth@v2 |
Check warning
Code scanning / CodeQL
Unpinned tag for a non-immutable Action in workflow Medium
| workload_identity_provider: ${{ inputs.workload-identity-provider }} | ||
| service_account: ${{ inputs.service-account }} | ||
|
|
||
| - uses: docker/login-action@v3 |
Check warning
Code scanning / CodeQL
Unpinned tag for a non-immutable Action in workflow Medium
|
|
||
| - name: Extract metadata (tags, labels) for Docker | ||
| id: meta | ||
| uses: docker/metadata-action@v5 |
Check warning
Code scanning / CodeQL
Unpinned tag for a non-immutable Action in workflow Medium
| ${{ inputs.tag }} | ||
|
|
||
| - name: Build (and push) Docker image | ||
| uses: useblacksmith/build-push-action@v2 |
Check warning
Code scanning / CodeQL
Unpinned tag for a non-immutable Action in workflow Medium
| ssh: default | ||
| # We use Blacksmith's implicit cache | ||
|
|
||
| - uses: remerge/action-slack-deploy-pipeline@v2.0.0-remerge |
Check warning
Code scanning / CodeQL
Unpinned tag for a non-immutable Action in workflow Medium
thekondor
changed the title
2 participants
Copy of
dockerwith changes to ease referring to the file (instead hashes in path etc). Either dropped or renamed back todocker.yml.Ticket: https://remerge.atlassian.net/browse/CORE-1502