From 41dbca054484f790f076a213e44d62d0a88a2b84 Mon Sep 17 00:00:00 2001 From: Shubham Chaturvedi Date: Wed, 15 Jul 2026 16:02:00 -0700 Subject: [PATCH 1/3] fix(ci): Prevent script injection in GitHub Actions workflows Untrusted GitHub context (workflow_dispatch inputs, PR author login, github.actor) was interpolated directly into inline run: scripts, allowing shell script injection into the runner. Bind these values to env: variables and reference them as quoted shell variables so they are never evaluated as shell code. Fixes ACAT finding for go-release.yml and smithy-diff.yml. sim: https://t.corp.amazon.com/V2263112241 --- .github/workflows/go-release.yml | 19 +++++++++++++------ .github/workflows/smithy-diff.yml | 9 ++++++--- 2 files changed, 19 insertions(+), 9 deletions(-) diff --git a/.github/workflows/go-release.yml b/.github/workflows/go-release.yml index 7fe0016842..3b72cd2635 100644 --- a/.github/workflows/go-release.yml +++ b/.github/workflows/go-release.yml @@ -68,9 +68,12 @@ jobs: - name: Get release directory name id: release-dir + env: + PROJECT_NAME: ${{ github.event.inputs.project-name }} + VERSION: ${{ github.event.inputs.version }} run: | chmod +x ./submodules/MaterialProviders/scripts/go-release-automation.sh - RELEASE_DIR_NAME=$(./submodules/MaterialProviders/scripts/go-release-automation.sh get_release_dir_name "${{ github.event.inputs.project-name }}" "${{ github.event.inputs.version }}") + RELEASE_DIR_NAME=$(./submodules/MaterialProviders/scripts/go-release-automation.sh get_release_dir_name "$PROJECT_NAME" "$VERSION") echo "releaseDirName=$RELEASE_DIR_NAME" >> $GITHUB_OUTPUT - name: Generate a changelog @@ -80,13 +83,17 @@ jobs: args: --bump -u --prepend releases/go/${{ steps.release-dir.outputs.releaseDirName }}/CHANGELOG.md - name: Run Go release automation script + env: + PROJECT_NAME: ${{ github.event.inputs.project-name }} + VERSION: ${{ github.event.inputs.version }} run: | chmod +x ./submodules/MaterialProviders/scripts/go-release-automation.sh - ./submodules/MaterialProviders/scripts/go-release-automation.sh run_release_script ${{ github.event.inputs.project-name }} ${{ github.event.inputs.version }} + ./submodules/MaterialProviders/scripts/go-release-automation.sh run_release_script "$PROJECT_NAME" "$VERSION" - name: print diff between development and release directory + env: + PROJECT_NAME: ${{ github.event.inputs.project-name }} + RELEASE_DIR_NAME: ${{ steps.release-dir.outputs.releaseDirName }} run: | - RELEASE_DIR_NAME="${{ steps.release-dir.outputs.releaseDirName }}" - PROJECT_NAME="${{ github.event.inputs.project-name }}" - DIFF_FILES=$(diff -qr $PROJECT_NAME/runtimes/go/ImplementationFromDafny-go releases/go/$RELEASE_DIR_NAME || true) - echo $DIFF_FILES + DIFF_FILES=$(diff -qr "$PROJECT_NAME/runtimes/go/ImplementationFromDafny-go" "releases/go/$RELEASE_DIR_NAME" || true) + echo "$DIFF_FILES" diff --git a/.github/workflows/smithy-diff.yml b/.github/workflows/smithy-diff.yml index eb37d5b040..a46790dfb7 100644 --- a/.github/workflows/smithy-diff.yml +++ b/.github/workflows/smithy-diff.yml @@ -33,9 +33,12 @@ jobs: PR_NUMBER: ${{ github.event.pull_request.number }} GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} FILES: ${{ steps.file-changes.outputs.FILES }} + PR_USER: ${{ github.event.pull_request.user.login }} + ACTOR: ${{ github.actor }} + REPO: ${{ github.repository }} if: ${{env.FILES != ''}} run: | # If https://github.com/smithy-lang/smithy-dafny/issues/491 is resolved, remove comment about this issue. - COMMENT="@${{github.event.pull_request.user.login}} and @${{github.actor}}, I noticed you are updating the smithy model files.\nDoes this update need new or updated javadoc trait documentation?\n Are you adding constraints inside list, map or union? Do you know about this issue: https://github.com/smithy-lang/smithy-dafny/issues/491?" - COMMENT_URL="https://api.github.com/repos/${{ github.repository }}/issues/${PR_NUMBER}/comments" - curl -s -H "Authorization: token ${GITHUB_TOKEN}" -X POST $COMMENT_URL -d "{\"body\":\"$COMMENT\"}" + COMMENT="@${PR_USER} and @${ACTOR}, I noticed you are updating the smithy model files.\nDoes this update need new or updated javadoc trait documentation?\n Are you adding constraints inside list, map or union? Do you know about this issue: https://github.com/smithy-lang/smithy-dafny/issues/491?" + COMMENT_URL="https://api.github.com/repos/${REPO}/issues/${PR_NUMBER}/comments" + curl -s -H "Authorization: token ${GITHUB_TOKEN}" -X POST "$COMMENT_URL" -d "{\"body\":\"$COMMENT\"}" From 804dd51ffc7acac2f77564d4c4a98b8cf6c20dbc Mon Sep 17 00:00:00 2001 From: Shubham Chaturvedi Date: Mon, 20 Jul 2026 14:48:47 -0700 Subject: [PATCH 2/3] fix(ci): Harden step output and JSON body construction Address PR review feedback: - Write releaseDirName via heredoc delimiter and quote $GITHUB_OUTPUT to avoid step-output injection. - Build the PR comment JSON body with jq so special characters are safely encoded. sim: https://t.corp.amazon.com/V2263112241 --- .github/workflows/go-release.yml | 6 +++++- .github/workflows/smithy-diff.yml | 6 ++++-- 2 files changed, 9 insertions(+), 3 deletions(-) diff --git a/.github/workflows/go-release.yml b/.github/workflows/go-release.yml index 3b72cd2635..662ae9211d 100644 --- a/.github/workflows/go-release.yml +++ b/.github/workflows/go-release.yml @@ -74,7 +74,11 @@ jobs: run: | chmod +x ./submodules/MaterialProviders/scripts/go-release-automation.sh RELEASE_DIR_NAME=$(./submodules/MaterialProviders/scripts/go-release-automation.sh get_release_dir_name "$PROJECT_NAME" "$VERSION") - echo "releaseDirName=$RELEASE_DIR_NAME" >> $GITHUB_OUTPUT + { + echo "releaseDirName<<__GH_OUTPUT_EOF__" + echo "$RELEASE_DIR_NAME" + echo "__GH_OUTPUT_EOF__" + } >> "$GITHUB_OUTPUT" - name: Generate a changelog uses: orhun/git-cliff-action@v4 diff --git a/.github/workflows/smithy-diff.yml b/.github/workflows/smithy-diff.yml index a46790dfb7..a7c33570a8 100644 --- a/.github/workflows/smithy-diff.yml +++ b/.github/workflows/smithy-diff.yml @@ -39,6 +39,8 @@ jobs: if: ${{env.FILES != ''}} run: | # If https://github.com/smithy-lang/smithy-dafny/issues/491 is resolved, remove comment about this issue. - COMMENT="@${PR_USER} and @${ACTOR}, I noticed you are updating the smithy model files.\nDoes this update need new or updated javadoc trait documentation?\n Are you adding constraints inside list, map or union? Do you know about this issue: https://github.com/smithy-lang/smithy-dafny/issues/491?" + COMMENT="@${PR_USER} and @${ACTOR}, I noticed you are updating the smithy model files. + Does this update need new or updated javadoc trait documentation? + Are you adding constraints inside list, map or union? Do you know about this issue: https://github.com/smithy-lang/smithy-dafny/issues/491?" COMMENT_URL="https://api.github.com/repos/${REPO}/issues/${PR_NUMBER}/comments" - curl -s -H "Authorization: token ${GITHUB_TOKEN}" -X POST "$COMMENT_URL" -d "{\"body\":\"$COMMENT\"}" + curl -s -H "Authorization: token ${GITHUB_TOKEN}" -X POST "$COMMENT_URL" -d "$(jq -nc --arg body "$COMMENT" '{body: $body}')" From eb6ffddd195af2a1140d4479ac54ef531e639779 Mon Sep 17 00:00:00 2001 From: Shubham Chaturvedi Date: Mon, 20 Jul 2026 15:18:08 -0700 Subject: [PATCH 3/3] fix(rust): Bump direct aws-lc-sys to 0.43 to match aws-lc-rs aws-lc-rs 1.17.3 now resolves aws-lc-sys to 0.43.0, while the direct dependency was pinned to 0.42, causing two copies of AWS-LC to resolve and failing the duplicate-aws-lc CI check. Align the direct pin to 0.43. The fips profile (aws-lc-fips-sys 0.13.1) is unaffected. sim: https://t.corp.amazon.com/V2263112241 --- DynamoDbEncryption/runtimes/rust/Cargo.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/DynamoDbEncryption/runtimes/rust/Cargo.toml b/DynamoDbEncryption/runtimes/rust/Cargo.toml index dc405a2a49..bfebc57433 100644 --- a/DynamoDbEncryption/runtimes/rust/Cargo.toml +++ b/DynamoDbEncryption/runtimes/rust/Cargo.toml @@ -17,7 +17,7 @@ readme = "README.md" [dependencies] aws-config = "1.8.12" aws-lc-rs = {version = "1.17.0"} -aws-lc-sys = { version = "0.42", optional = true } +aws-lc-sys = { version = "0.43", optional = true } aws-lc-fips-sys = { version = "0.13.1", optional = true } aws-sdk-dynamodb = "1.103.0" aws-sdk-kms = "1.98.0"