[ci] Use pagination in mirror workflow to get all Selenium releases - #16605

Description: The workflow exports the GitHub token to a shell variable and passes it to curl, which
could be exposed via process listing or echoed logs; use the "Authorization: Bearer"
header via actions/github-script or GITHUB_TOKEN env with masked logging to reduce leakage
risk.
mirror-selenium-releases.yml [21-38]

TOKEN="${{ secrets.GITHUB_TOKEN }}"
JQ_FILTER='[.[] | {tag_name: .tag_name, assets: [.assets[] | {browser_download_url: .browser_download_url} ] } ]'
page=1
tmpfile="$(mktemp)"
: > "$tmpfile"
while :; do
  echo "Fetching SeleniumHQ/selenium releases page $page..."
  resp=$(curl -fsSL \
    -H "Authorization: token $TOKEN" \
    "https://api.github.com/repos/SeleniumHQ/selenium/releases?per_page=100&page=${page}")
  if [ "$(echo "$resp" | jq 'length')" -eq 0 ]; then
    break
  fi
  echo "$resp" | jq "$JQ_FILTER" >> "$tmpfile"
  page=$((page+1))
done
jq -s 'add' "$tmpfile" > selenium
rm "$tmpfile"

Follow the guide to enable codebase context checks.

Objective: Ensure all identifiers clearly express their purpose and intent, making code
self-documenting

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Objective: Ensure comprehensive error handling that provides meaningful context and graceful
degradation

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Objective: To prevent the leakage of sensitive system information through error messages while
providing sufficient detail for internal debugging.

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Objective: To ensure logs are useful for debugging and auditing without exposing sensitive
information like PII, PHI, or cardholder data.

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Objective: Ensure all data inputs are validated, sanitized, and handled securely to prevent
vulnerabilities

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Objective: To create a detailed and reliable record of critical system actions for security analysis
and compliance.

Status:
Missing Audit: The new pagination and download process has no explicit audit/logging of critical actions
beyond simple echo statements, which may be acceptable for CI but lacks structured audit
details like actor and outcomes.

  echo "Fetching SeleniumHQ/selenium releases page $page..."
  resp=$(curl -fsSL \
    -H "Authorization: token $TOKEN" \
    "https://api.github.com/repos/SeleniumHQ/selenium/releases?per_page=100&page=${page}")
  if [ "$(echo "$resp" | jq 'length')" -eq 0 ]; then
    break
  fi
  echo "$resp" | jq "$JQ_FILTER" >> "$tmpfile"
  page=$((page+1))
done
jq -s 'add' "$tmpfile" > selenium
rm "$tmpfile"

Learn more about managing compliance generic rules or creating your own custom rules

Instead of a manual shell loop with curl for GitHub API pagination, use the
pre-installed gh CLI with the gh api --paginate command. This simplifies the
workflow, making it more concise and robust.

Examples:

        set -euo pipefail
        cd common/mirror
        TOKEN="${{ secrets.GITHUB_TOKEN }}"
        JQ_FILTER='[.[] | {tag_name: .tag_name, assets: [.assets[] | {browser_download_url: .browser_download_url} ] } ]'
        page=1
        tmpfile="$(mktemp)"
        : > "$tmpfile"
        while :; do
          echo "Fetching SeleniumHQ/selenium releases page $page..."
          resp=$(curl -fsSL \

 ... (clipped 10 lines)

Solution Walkthrough:

Before:

# .github/workflows/mirror-selenium-releases.yml
page=1
tmpfile="$(mktemp)"
while :; do
  resp=$(curl -fsSL \
    -H "Authorization: token $TOKEN" \
    "https://api.github.com/repos/SeleniumHQ/selenium/releases?per_page=100&page=${page}")
  if [ "$(echo "$resp" | jq 'length')" -eq 0 ]; then
    break
  fi
  echo "$resp" | jq "$JQ_FILTER" >> "$tmpfile"
  page=$((page+1))
done
jq -s 'add' "$tmpfile" > selenium
rm "$tmpfile"

After:

# .github/workflows/mirror-selenium-releases.yml
JQ_FILTER='[.[] | {tag_name: .tag_name, assets: [.assets[] | {browser_download_url: .browser_download_url} ] } ]'

gh api --paginate 'repos/SeleniumHQ/selenium/releases?per_page=100' \
  | jq -s 'add' \
  | jq "$JQ_FILTER" > selenium

Add a trap command to ensure the temporary file is always removed on script
exit, even in case of an error.

.github/workflows/mirror-selenium-releases.yml [24-38]

 tmpfile="$(mktemp)"
-: > "$tmpfile"
+trap 'rm -f "$tmpfile"' EXIT
 while :; do
   echo "Fetching SeleniumHQ/selenium releases page $page..."
   resp=$(curl -fsSL \
     -H "Authorization: token $TOKEN" \
     "https://api.github.com/repos/SeleniumHQ/selenium/releases?per_page=100&page=${page}")
   if [ "$(echo "$resp" | jq 'length')" -eq 0 ]; then
     break
   fi
   echo "$resp" | jq "$JQ_FILTER" >> "$tmpfile"
   page=$((page+1))
 done
 jq -s 'add' "$tmpfile" > selenium
-rm "$tmpfile"

• Apply / Chat

Remove the redundant : > "$tmpfile" command because mktemp already creates a
new, empty file.

.github/workflows/mirror-selenium-releases.yml [25]

-: > "$tmpfile"
 
+

• Apply / Chat

Validate that the token is non-empty and fail fast with a clear message; also
check jq output is valid JSON before proceeding.

.github/workflows/mirror-selenium-releases.yml [21-30]

 TOKEN="${{ secrets.GITHUB_TOKEN }}"
-...
+if [ -z "${TOKEN:-}" ]; then
+  echo "GITHUB_TOKEN is missing; cannot query GitHub API." >&2
+  exit 1
+fi
 resp=$(curl -fsSL \
   -H "Authorization: token $TOKEN" \
   "https://api.github.com/repos/SeleniumHQ/selenium/releases?per_page=100&page=${page}")
+echo "$resp" | jq -e . >/dev/null

[To ensure code accuracy, apply this suggestion manually]