From f191fa8587f0dc54e83b8badbec9a2f37c323ba7 Mon Sep 17 00:00:00 2001 From: Diego Marquez Date: Mon, 19 Aug 2024 16:31:36 -0400 Subject: [PATCH 1/3] chore: secure hermetic_library_generation workflow Thanks to @diogoteles08 for the inspection on our repos. This PR inlines environment variables to avoid overriding script injections. --- .github/workflows/hermetic_library_generation.yaml | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/.github/workflows/hermetic_library_generation.yaml b/.github/workflows/hermetic_library_generation.yaml index 75183c673..a1cce5119 100644 --- a/.github/workflows/hermetic_library_generation.yaml +++ b/.github/workflows/hermetic_library_generation.yaml @@ -17,10 +17,14 @@ name: Hermetic library generation upon generation config change through pull req on: pull_request: +env: + HEAD_REF: ${{ github.head_ref }} + REPO_FULL_NAME: ${{ github.event.pull_request.head.repo.full_name }} + jobs: library_generation: # skip pull requests come from a forked repository - if: github.event.pull_request.head.repo.full_name == github.repository + if: github.env.REPO_FULL_NAME == github.repository runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 @@ -30,11 +34,11 @@ jobs: - name: Generate changed libraries shell: bash run: | - set -x + set -ex [ -z "$(git config user.email)" ] && git config --global user.email "cloud-java-bot@google.com" [ -z "$(git config user.name)" ] && git config --global user.name "cloud-java-bot" bash .github/scripts/hermetic_library_generation.sh \ --target_branch ${{ github.base_ref }} \ - --current_branch ${{ github.head_ref }} + --current_branch $HEAD_REF env: GH_TOKEN: ${{ secrets.CLOUD_JAVA_BOT_TOKEN }} From 7907bbc2cb7e0a8e423921b69ae48789741e242b Mon Sep 17 00:00:00 2001 From: Diego Marquez Date: Mon, 19 Aug 2024 16:36:51 -0400 Subject: [PATCH 2/3] fix wording --- .github/workflows/hermetic_library_generation.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/hermetic_library_generation.yaml b/.github/workflows/hermetic_library_generation.yaml index a1cce5119..ab23b9fec 100644 --- a/.github/workflows/hermetic_library_generation.yaml +++ b/.github/workflows/hermetic_library_generation.yaml @@ -23,7 +23,7 @@ env: jobs: library_generation: - # skip pull requests come from a forked repository + # skip pull requests coming from a forked repository if: github.env.REPO_FULL_NAME == github.repository runs-on: ubuntu-latest steps: From 3a5236b083dd4a70ccd5237a7341c86a215cbe56 Mon Sep 17 00:00:00 2001 From: Diego Marquez Date: Thu, 5 Sep 2024 10:25:41 -0400 Subject: [PATCH 3/3] Update hermetic_library_generation.yaml --- .github/workflows/hermetic_library_generation.yaml | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/.github/workflows/hermetic_library_generation.yaml b/.github/workflows/hermetic_library_generation.yaml index ab23b9fec..51a087f8e 100644 --- a/.github/workflows/hermetic_library_generation.yaml +++ b/.github/workflows/hermetic_library_generation.yaml @@ -20,11 +20,10 @@ on: env: HEAD_REF: ${{ github.head_ref }} REPO_FULL_NAME: ${{ github.event.pull_request.head.repo.full_name }} + GITHUB_REPOSITORY: ${{ github.repository }} jobs: library_generation: - # skip pull requests coming from a forked repository - if: github.env.REPO_FULL_NAME == github.repository runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 @@ -35,6 +34,10 @@ jobs: shell: bash run: | set -ex + if [[ "${GITHUB_REPOSITORY}" != "${REPO_FULL_NAME}" ]]; then + echo "This PR comes from a fork. Generation will be skipped" + exit 0 + fi [ -z "$(git config user.email)" ] && git config --global user.email "cloud-java-bot@google.com" [ -z "$(git config user.name)" ] && git config --global user.name "cloud-java-bot" bash .github/scripts/hermetic_library_generation.sh \