Refactor Github Action per b/485167538#19325
Conversation
Summary of ChangesHello @google-admin, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request systematically refactors several GitHub Actions by migrating direct input variable usage within Highlights
Changelog
Ignored Files
Activity
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
|
Size Change: -2 B (0%) Total Size: 20.5 MB ℹ️ View Unchanged
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request refactors GitHub Actions to use environment variables for inputs, a positive step towards preventing command injection. However, a critical security vulnerability remains as these environment variables are not consistently double-quoted in shell scripts, which can still lead to command injection through word-splitting and argument injection. The review identifies these locations and provides suggestions for proper quoting. Additionally, consider cleaning up the env block in .github/actions/tag-npm-release/action.yml for better code quality.
| --workspace="${INPUTS_CORE_PACKAGE_NAME}" \ | ||
| --no-tag | ||
| npm dist-tag rm ${{ inputs.core-package-name }} false --silent | ||
| npm dist-tag rm ${INPUTS_CORE_PACKAGE_NAME} false --silent |
There was a problem hiding this comment.
The environment variable INPUTS_CORE_PACKAGE_NAME is used unquoted, which is a critical security vulnerability. If the input core-package-name contains shell metacharacters (e.g., ;, &, |), it could lead to arbitrary command execution. Always wrap environment variables in double quotes to prevent word splitting and command injection.
npm dist-tag rm "${INPUTS_CORE_PACKAGE_NAME}" false --silent| --workspace="${INPUTS_CLI_PACKAGE_NAME}" \ | ||
| --no-tag | ||
| npm dist-tag rm ${{ inputs.cli-package-name }} false --silent | ||
| npm dist-tag rm ${INPUTS_CLI_PACKAGE_NAME} false --silent |
There was a problem hiding this comment.
The environment variable INPUTS_CLI_PACKAGE_NAME is used unquoted, posing a security risk. If the input cli-package-name contains shell metacharacters, it could lead to arbitrary command execution. Always wrap environment variables in double quotes to prevent word splitting and command injection.
npm dist-tag rm "${INPUTS_CLI_PACKAGE_NAME}" false --silent| --workspace="${INPUTS_A2A_PACKAGE_NAME}" \ | ||
| --no-tag | ||
| npm dist-tag rm ${{ inputs.a2a-package-name }} false --silent | ||
| npm dist-tag rm ${INPUTS_A2A_PACKAGE_NAME} false --silent |
There was a problem hiding this comment.
The environment variable INPUTS_A2A_PACKAGE_NAME is used unquoted, posing a security risk. If the input a2a-package-name contains shell metacharacters, it could lead to arbitrary command execution. Always wrap environment variables in double quotes to prevent word splitting and command injection.
npm dist-tag rm "${INPUTS_A2A_PACKAGE_NAME}" false --silent| working-directory: '${{ inputs.working-directory }}' | ||
| run: | | ||
| npm dist-tag add ${{ inputs.core-package-name }}@${{ inputs.version }} ${{ inputs.channel }} | ||
| npm dist-tag add ${INPUTS_CORE_PACKAGE_NAME}@${INPUTS_VERSION} ${INPUTS_CHANNEL} |
There was a problem hiding this comment.
The environment variables INPUTS_CORE_PACKAGE_NAME, INPUTS_VERSION, and INPUTS_CHANNEL are used unquoted, which is a security vulnerability. If any of these inputs contain shell metacharacters, it could lead to arbitrary command execution. Always wrap environment variables in double quotes to prevent word splitting and command injection.
npm dist-tag add "${INPUTS_CORE_PACKAGE_NAME}@${INPUTS_VERSION}" "${INPUTS_CHANNEL}"| working-directory: '${{ inputs.working-directory }}' | ||
| run: | | ||
| npm dist-tag add ${{ inputs.cli-package-name }}@${{ inputs.version }} ${{ inputs.channel }} | ||
| npm dist-tag add ${INPUTS_CLI_PACKAGE_NAME}@${INPUTS_VERSION} ${INPUTS_CHANNEL} |
There was a problem hiding this comment.
The environment variables INPUTS_CLI_PACKAGE_NAME, INPUTS_VERSION, and INPUTS_CHANNEL are used unquoted, which is a security vulnerability. If any of these inputs contain shell metacharacters, it could lead to arbitrary command execution. Always wrap environment variables in double quotes to prevent word splitting and command injection.
npm dist-tag add "${INPUTS_CLI_PACKAGE_NAME}@${INPUTS_VERSION}" "${INPUTS_CHANNEL}"| working-directory: '${{ inputs.working-directory }}' | ||
| run: | | ||
| npm dist-tag add ${{ inputs.a2a-package-name }}@${{ inputs.version }} ${{ inputs.channel }} | ||
| npm dist-tag add ${INPUTS_A2A_PACKAGE_NAME}@${INPUTS_VERSION} ${INPUTS_CHANNEL} |
There was a problem hiding this comment.
The environment variables INPUTS_A2A_PACKAGE_NAME, INPUTS_VERSION, and INPUTS_CHANNEL are used unquoted, which is a security vulnerability. If any of these inputs contain shell metacharacters, it could lead to arbitrary command execution. Always wrap environment variables in double quotes to prevent word splitting and command injection.
npm dist-tag add "${INPUTS_A2A_PACKAGE_NAME}@${INPUTS_VERSION}" "${INPUTS_CHANNEL}"| run: |- | ||
| npm run build:sandbox -- \ | ||
| --image google/gemini-cli-sandbox:${{ steps.image_tag.outputs.FINAL_TAG }} \ | ||
| --image google/gemini-cli-sandbox:${STEPS_IMAGE_TAG_OUTPUTS_FINAL_TAG} \ |
There was a problem hiding this comment.
The environment variable STEPS_IMAGE_TAG_OUTPUTS_FINAL_TAG is used unquoted in a shell command. If the tag contains shell metacharacters, it could lead to arbitrary command execution. Wrap the entire argument in double quotes.
--image "google/gemini-cli-sandbox:${STEPS_IMAGE_TAG_OUTPUTS_FINAL_TAG}" \| INPUTS_CHANNEL: ${{ inputs.channel }} | ||
|
|
||
| INPUTS_VERSION: ${{ inputs.version }} | ||
|
|
||
| INPUTS_CLI_PACKAGE_NAME: ${{ inputs.cli-package-name }} | ||
|
|
||
| INPUTS_CORE_PACKAGE_NAME: ${{ inputs.core-package-name }} | ||
|
|
||
| INPUTS_A2A_PACKAGE_NAME: ${{ inputs.a2a-package-name }} |
There was a problem hiding this comment.
The env block contains unnecessary empty lines which reduce readability and deviate from standard YAML formatting patterns used elsewhere in the repository.
INPUTS_CHANNEL: ${{ inputs.channel }}
INPUTS_VERSION: ${{ inputs.version }}
INPUTS_CLI_PACKAGE_NAME: ${{ inputs.cli-package-name }}
INPUTS_CORE_PACKAGE_NAME: ${{ inputs.core-package-name }}
INPUTS_A2A_PACKAGE_NAME: ${{ inputs.a2a-package-name }}References
- Adhere to existing patterns in the repository. The messy formatting with unnecessary empty lines deviates from the established coding style. (link)
gemini-cli
Bot
added
the
status/need-issue
4 participants
This is a http://go/LSC run by http://go/ghss to automatically refactor your Github Actions per http://b/485167538.
This is a PR to help you upgrade to the latest standards in Github Actions.
Please merge this PR to accept the changes. NOTE: if you do not accept this PR, it may be force merged by the GHSS team. See http://b/485167538 for more details.