Skip to content

Fix script injection in release.yml via env-var indirection #7

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
felicityzhao9 merged 1 commit into from
Jul 28, 2026
Merged

Fix script injection in release.yml via env-var indirection #7

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .github/.cSpellWords.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,7 @@ GPIOs
Gpio
MOSI
OHCI
Ofbytes
Pmic
Rxbuf
SDIO
Expand Down
37 changes: 22 additions & 15 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,17 +47,21 @@ jobs:
needs: clean-existing-tag-and-release
name: Tag commit
runs-on: ubuntu-latest
env:
VERSION_NUMBER: ${{ github.event.inputs.version_number }}
COMMIT_ID: ${{ github.event.inputs.commit_id }}
ACTOR: ${{ github.actor }}
steps:
- name: Checkout code
uses: actions/checkout@v3
with:
ref: ${{ github.event.inputs.commit_id }}
- name: Configure git identity
run: |
git config --global user.name ${{ github.actor }}
git config --global user.email ${{ github.actor }}@users.noreply.github.com
git config --global user.name "$ACTOR"
git config --global user.email "$ACTOR@users.noreply.github.com"
- name: create a new branch that references commit id
run: git checkout -b ${{ github.event.inputs.version_number }} ${{ github.event.inputs.commit_id }}
run: git checkout -b "$VERSION_NUMBER" "$COMMIT_ID"
- name: Generate SBOM
uses: FreeRTOS/CI-CD-Github-Actions/sbom-generator@main
with:
Expand All @@ -67,22 +71,25 @@ jobs:
run: |
git add .
git commit -m 'Update SBOM'
git push -u origin ${{ github.event.inputs.version_number }}
git push -u origin "$VERSION_NUMBER"
- name: Tag Commit and Push to remote
run: |
git tag ${{ github.event.inputs.version_number }} -a -m "coreMQTT Library ${{ github.event.inputs.version_number }}"
git tag "$VERSION_NUMBER" -a -m "coreMQTT Library $VERSION_NUMBER"
git push origin --tags
- name: Verify tag on remote
run: |
git tag -d ${{ github.event.inputs.version_number }}
git tag -d "$VERSION_NUMBER"
git remote update
git checkout tags/${{ github.event.inputs.version_number }}
git diff ${{ github.event.inputs.commit_id }} tags/${{ github.event.inputs.version_number }}
git checkout tags/"$VERSION_NUMBER"
git diff "$COMMIT_ID" tags/"$VERSION_NUMBER"
create-zip:
if: ${{ ( github.event.inputs.delete_existing_tag_release == 'true' && success() ) || ( github.event.inputs.delete_existing_tag_release == 'false' && always() ) }}
needs: add-sbom-and-tag-commit
name: Create ZIP and verify package for release asset.
runs-on: ubuntu-latest
env:
VERSION_NUMBER: ${{ github.event.inputs.version_number }}
COMMIT_ID: ${{ github.event.inputs.commit_id }}
steps:
- name: Install ZIP tools
run: sudo apt-get install zip unzip
Expand All @@ -98,20 +105,20 @@ jobs:
git submodule update --init --checkout --recursive
- name: Create ZIP
run: |
zip -r common-io-basic-${{ github.event.inputs.version_number }}.zip common-io-basic -x "*.git*"
zip -r common-io-basic-"$VERSION_NUMBER".zip common-io-basic -x "*.git*"
ls ./
- name: Validate created ZIP
run: |
mkdir zip-check
mv common-io-basic-${{ github.event.inputs.version_number }}.zip zip-check
mv common-io-basic-"$VERSION_NUMBER".zip zip-check
cd zip-check
unzip common-io-basic-${{ github.event.inputs.version_number }}.zip -d common-io-basic-${{ github.event.inputs.version_number }}
ls common-io-basic-${{ github.event.inputs.version_number }}
diff -r -x "*.git*" common-io-basic-${{ github.event.inputs.version_number }}/common-io-basic/ ../common-io-basic/
unzip common-io-basic-"$VERSION_NUMBER".zip -d common-io-basic-"$VERSION_NUMBER"
ls common-io-basic-"$VERSION_NUMBER"
diff -r -x "*.git*" common-io-basic-"$VERSION_NUMBER"/common-io-basic/ ../common-io-basic/
cd ../
# - name: Build
# run: |
# cd zip-check/common-io-basic-${{ github.event.inputs.version_number }}/common-io-basic
# cd zip-check/common-io-basic-"$VERSION_NUMBER"/common-io-basic
# sudo apt-get install -y lcov
# cmake -S test -B build/ \
# -G "Unix Makefiles" \
Expand All @@ -121,7 +128,7 @@ jobs:
# make -C build/ all
# - name: Test
# run: |
# cd zip-check/common-io-basic-${{ github.event.inputs.version_number }}/common-io-basic/build/
# cd zip-check/common-io-basic-"$VERSION_NUMBER"/common-io-basic/build/
# ctest -E system --output-on-failure
# cd ..
- name: Create artifact of ZIP
Expand Down
Loading