Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

The global-ci.yml workflow does not sanatize PR body text before using it #31

Closed
sjd78 opened this issue Mar 16, 2024 · 0 comments · Fixed by #32
Closed

The global-ci.yml workflow does not sanatize PR body text before using it #31

sjd78 opened this issue Mar 16, 2024 · 0 comments · Fixed by #32

Comments

@sjd78
Copy link
Member

sjd78 commented Mar 16, 2024

Attempting to run the global-ci workflow from a tackle2-ui PR (konveyor/tackle2-ui#1781), I encountered a pretty big issue. The PR description is blindly copied to a shell command. PR descriptions can contain a lot of markdown formatting. In this case, I initially had a typo with two backticks next to each other.

This is causing the workflow to crash:
https://github.com/konveyor/tackle2-ui/actions/runs/8304215558/job/22729664960#step:2:21

Even after fixing the typo, any text inside a backtick pair, which is useful formatting for a package name, that text will run as a command.

Please update the workflow to at least quote escape the PR body text before parsing it.
sjd78 added a commit to sjd78/konveyor-ci that referenced this issue Apr 11, 2024
@sjd78
🌱 Fix global-ci workflow parsing for test refs
e9645c3 
Resolves: konveyor#31

  - Pass the github event PR description via a step env variable
    to avoid any string interpolation problems.

  - Report the calculated test ref (`GOLANG_TESTS_REF` and `UI_TESTS_REF`)
    via step summary so it is easy to see in the action summary page.

  - Bump `actions/checkout` to `@v4` to fix its deprecated warning.

Signed-off-by: Scott J Dickerson <[email protected]>
@sjd78 sjd78 mentioned this issue Apr 11, 2024
Merged
sjd78 added a commit to sjd78/konveyor-ci that referenced this issue Apr 11, 2024
@sjd78
🌱 Fix global-ci workflow parsing for test refs
a56648a 
Resolves: konveyor#31

  - Pass the github event PR description via a step env variable
    to avoid any string interpolation problems.

  - Report the calculated test ref (`GOLANG_TESTS_REF` and `UI_TESTS_REF`)
    via step summary so it is easy to see in the action summary page.

  - Bump `actions/checkout` to `@v4` to fix its deprecated warning.

Signed-off-by: Scott J Dickerson <[email protected]>
sjd78 added a commit to sjd78/konveyor-ci that referenced this issue Apr 11, 2024
@sjd78
🌱 Fix global-ci workflow parsing for test refs
24d8f98 
Resolves: konveyor#31

  - Pass the github event PR description via a step env variable
    to avoid any string interpolation problems.

  - Report the calculated test ref (`GOLANG_TESTS_REF` and `UI_TESTS_REF`)
    via step summary so it is easy to see in the action summary page.

  - Drop `pathfinder-image` input from the `install-tackle` action since
    that input has been removed.

  - Bump `actions/checkout` to `@v4` to fix its deprecated warning.

Signed-off-by: Scott J Dickerson <[email protected]>
@aufi aufi closed this as completed in #32 Apr 17, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

🌱 Fix global-ci workflow parsing for test refs sjd78/konveyor-ci
1 participant
@sjd78