Skip to content

Install python-icm when building alert-manager in CICD while keeping it private #98

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
zhogu wants to merge 6 commits into from
Closed

Install python-icm when building alert-manager in CICD while keeping it private #98

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
7b11b91
install python-icm when build alert-manager
zhogu Oct 15, 2025
625fcb8
XXX: trigger building
zhogu Oct 15, 2025
6a9cc6a
update
zhogu Oct 15, 2025
d55a83e
update
zhogu Oct 15, 2025
f4bfe74
update
zhogu Oct 15, 2025
22abada
update
zhogu Oct 15, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 12 additions & 3 deletions .github/workflows/build-deploy-changes.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,9 +55,8 @@ jobs:
changed_files=$(git diff --name-only "$base_sha" "$head_sha")
echo "Changed files: $changed_files"

# extract service folders under src/, skip alert-manager
# extract service folders under src/
folders=$(echo "$changed_files" | grep '^src/' \
| grep -v 'alert-manager' \
| awk -F'/' '{print $2}' \
| sort -u | tr '\n' ' ')
echo "Changed folders: $folders"
Expand All @@ -84,6 +83,17 @@ jobs:
if: steps.check.outputs.has_changed == 'true'
run: python -m pip install --break-system-packages pyyaml jinja2 paramiko etcd3 protobuf==3.20.3 kubernetes gitpython

- name: Install Special libs
if: steps.check.outputs.has_changed == 'true'
run: |
# check whether steps.changes.outputs.folders contains 'alert-manager'
if echo "${{ steps.changes.outputs.folders }}" | grep -q "alert-manager"; then
echo "Installing python-icm alertmanager dependencies..."
echo "${{ secrets.ICM_PACKAGE_B64 }}" | base64 -d > python-icm.zip
Copy link

Copilot AI Oct 15, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Secrets should not be decoded directly in shell commands as they may be exposed in logs. Consider using a temporary file with restricted permissions or a more secure method to handle the secret.

Suggested change
echo "${{ secrets.ICM_PACKAGE_B64 }}" | base64 -d > python-icm.zip
tmpfile=$(mktemp)
echo "${{ secrets.ICM_PACKAGE_B64 }}" | base64 -d > "$tmpfile"
chmod 600 "$tmpfile"
mv "$tmpfile" python-icm.zip

Copilot uses AI. Check for mistakes.
Copy link

Copilot AI Oct 15, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Using unzip with the -o flag to overwrite files without validation could be a security risk. Consider validating the zip contents or using safer extraction methods to prevent potential zip bomb attacks.

Suggested change
echo "${{ secrets.ICM_PACKAGE_B64 }}" | base64 -d > python-icm.zip
echo "${{ secrets.ICM_PACKAGE_B64 }}" | base64 -d > python-icm.zip
# Validate zip contents before extraction
if unzip -l python-icm.zip | awk '{print $4}' | grep -E '(^/|(\.\./))'; then
echo "Error: Zip file contains unsafe paths. Aborting extraction." >&2
exit 1
fi

Copilot uses AI. Check for mistakes.
unzip -o python-icm.zip -d $GITHUB_WORKSPACE/src/alert-manager/src/node-recycler/python-icm
ls -l $GITHUB_WORKSPACE/src/alert-manager/src/node-recycler/python-icm
fi

- name: Decode and unzip config file
if: steps.check.outputs.has_changed == 'true'
run: |
Expand Down Expand Up @@ -169,4 +179,3 @@ jobs:
exit 1
fi
echo "Virtual cluster info: $vc_info"

4 changes: 3 additions & 1 deletion src/alert-manager/.gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,6 @@
# Dependency directories
node_modules/

deploy/icm-certs/
deploy/icm-certs/

**/kusto-sdk/
Loading