Skip to content

fix: release-start handle re-run step#7215

Merged
filfreire merged 1 commit intoKong:developfrom
filfreire:fix/release-start-handle-re-run
Mar 27, 2024
Merged

fix: release-start handle re-run step#7215
filfreire merged 1 commit intoKong:developfrom
filfreire:fix/release-start-handle-re-run

Conversation

@filfreire
Copy link
Contributor

@filfreire filfreire commented Mar 27, 2024

follow-up to #7212

@filfreire filfreire requested a review from a team March 27, 2024 12:53
# handle botched alpha/beta releases, e.g. for iterations that were merged before running release-publish
- name: (Re-run) App version (alpha/beta, with a specific version)
if: github.event.inputs.channel != 'stable' && github.event.inputs.version && contains(github.event.inputs.version, "-${{ github.event.inputs.channel }}")
run: npm --workspaces version "${{ github.event.inputs.version }}"

Check failure

Code scanning / Semgrep OSS

Semgrep Finding: yaml.github-actions.security.run-shell-injection.run-shell-injection

Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".
@filfreire filfreire enabled auto-merge (squash) March 27, 2024 12:58
@filfreire filfreire merged commit acc1935 into Kong:develop Mar 27, 2024
@filfreire filfreire deleted the fix/release-start-handle-re-run branch March 27, 2024 13:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants