Core 1345 support skipping image build and testing when only nomad or nomad pack change made skip test

[tundeaoni]

https://remerge.atlassian.net/browse/CORE-1345

[remerge-hal]

This comment ensures that the correct Slack channel is notified after the team/project label CORE has been added to this pull request.

See this comment for details.

To fix this code injection vulnerability, we should avoid placing ${{ steps.changed.outputs.all_changed_files }} directly inside shell commands. Instead, we should pass the value as an environment variable and reference it using native shell syntax ($ALL_CHANGED_FILES). Specifically, in the affected step, set up an env mapping:

env:
  ALL_CHANGED_FILES: ${{ steps.changed.outputs.all_changed_files }}

and then refer to $ALL_CHANGED_FILES in the shell script. This change should be made in the step named "Check if only irrelevant files changed," covering all uses of steps.changed.outputs.all_changed_files inside the run block.

The affected lines are:

• 100: echo "${{ steps.changed.outputs.all_changed_files }}"
• 123: done <<< "$(echo "${{ steps.changed.outputs.all_changed_files }}" | tr ',' '\n')"

These should both refer to the environment variable using the shell-native form:

• On line 100, change to echo "$ALL_CHANGED_FILES"
• On line 123, change to done <<< "$(echo "$ALL_CHANGED_FILES" | tr ',' '\n')"

We will also add the appropriate env mapping in the step definition.

To fix the issue, we need to avoid interpolating the untrusted input using ${{ ... }} directly in the shell context inside the run: block. The best practice is to pass the value to the shell via an intermediate environment variable (set via env:), and then reference it using $VARIABLE.

Steps to fix:

• In the affected step (Check if only irrelevant files changed), under env:, add a variable like ALL_CHANGED_FILES: ${{ steps.changed.outputs.all_changed_files }}.
• In the shell script, replace direct usage of ${{ steps.changed.outputs.all_changed_files }} with $ALL_CHANGED_FILES.
• Specifically, the line:

  done <<< "$(echo "${{ steps.changed.outputs.all_changed_files }}" | tr ',' '\n')"
  

  should become:

  done <<< "$(echo "$ALL_CHANGED_FILES" | tr ',' '\n')"
  

• Also, any other echo or usage of the same variable via ${{ ... }} should be updated to $ALL_CHANGED_FILES for consistency and safety.

No additional libraries are needed. You only need to add the environment variable definition and reference it using the shell’s $ syntax inside the script.

---