Skip to content

Commit 4e5d376

Browse files
matttrachmatttrach
authored
fix: security vulnerabilities and tracking workflow label (#2130)
Signed-off-by: matttrach <matt.trachier@suse.com>
1 parent b115402 commit 4e5d376

6 files changed

Lines changed: 81 additions & 29 deletions

File tree

‎.github/ISSUE_TEMPLATE/feature.md‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
---
2+
name: Request a New Behavior
3+
about: Something is missing or outdated
4+
title: '[Feature] '
5+
labels: 'internal/user'
6+
assignees: ''
7+
8+
---
9+
10+
### Environment Information
11+
<!--Please add information on the same line in quotes. Eg. - Terraform version: "v1.13.0" -->
12+
- Rancher2 Provider version:
13+
- Rancher version:
14+
- Infrastructure Provider (AWS/GCP/vSphere/etc):
15+
16+
### Describe the Feature
17+
18+
<!---
19+
Please add relevant Terraform configs or examples so that we can fully understand what you would like.
20+
Please give us enough information to build an API or project plan.
21+
--->

‎.github/workflows/pull_request.yaml‎

Lines changed: 34 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,8 @@ env:
77
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
88
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
99
GITHUB_OWNER: ${{ github.repository_owner }}
10+
NIX_INSTALL_SHA: de490f61fcbaf9a5cabf2fa621ddb9ef93ad35d9a23a04e7d51b26e092b63691
11+
NIX_INSTALL_VERSION: 2.34.4
1012
jobs:
1113
build:
1214
runs-on: ubuntu-latest
@@ -26,7 +28,10 @@ jobs:
2628
fetch-depth: 0
2729
- name: install-nix
2830
run: |
29-
curl -L https://nixos.org/nix/install | sh
31+
curl -L -o install.sh "https://releases.nixos.org/nix/nix-${NIX_INSTALL_VERSION}/install"
32+
echo "${NIX_INSTALL_SHA} install.sh" | sha256sum -c -
33+
chmod +x install.sh
34+
./install.sh
3035
source /home/runner/.nix-profile/etc/profile.d/nix.sh
3136
nix --version
3237
which nix
@@ -43,7 +48,10 @@ jobs:
4348
fetch-depth: 0
4449
- name: install-nix
4550
run: |
46-
curl -L https://nixos.org/nix/install | sh
51+
curl -L -o install.sh "https://releases.nixos.org/nix/nix-${NIX_INSTALL_VERSION}/install"
52+
echo "${NIX_INSTALL_SHA} install.sh" | sha256sum -c -
53+
chmod +x install.sh
54+
./install.sh
4755
source /home/runner/.nix-profile/etc/profile.d/nix.sh
4856
nix --version
4957
which nix
@@ -62,7 +70,10 @@ jobs:
6270
fetch-depth: 0
6371
- name: install-nix
6472
run: |
65-
curl -L https://nixos.org/nix/install | sh
73+
curl -L -o install.sh "https://releases.nixos.org/nix/nix-${NIX_INSTALL_VERSION}/install"
74+
echo "${NIX_INSTALL_SHA} install.sh" | sha256sum -c -
75+
chmod +x install.sh
76+
./install.sh
6677
source /home/runner/.nix-profile/etc/profile.d/nix.sh
6778
nix --version
6879
which nix
@@ -79,7 +90,10 @@ jobs:
7990
fetch-depth: 0
8091
- name: install-nix
8192
run: |
82-
curl -L https://nixos.org/nix/install | sh
93+
curl -L -o install.sh "https://releases.nixos.org/nix/nix-${NIX_INSTALL_VERSION}/install"
94+
echo "${NIX_INSTALL_SHA} install.sh" | sha256sum -c -
95+
chmod +x install.sh
96+
./install.sh
8397
source /home/runner/.nix-profile/etc/profile.d/nix.sh
8498
nix --version
8599
which nix
@@ -100,7 +114,10 @@ jobs:
100114
fetch-depth: 0
101115
- name: install-nix
102116
run: |
103-
curl -L https://nixos.org/nix/install | sh
117+
curl -L -o install.sh "https://releases.nixos.org/nix/nix-${NIX_INSTALL_VERSION}/install"
118+
echo "${NIX_INSTALL_SHA} install.sh" | sha256sum -c -
119+
chmod +x install.sh
120+
./install.sh
104121
source /home/runner/.nix-profile/etc/profile.d/nix.sh
105122
nix --version
106123
which nix
@@ -118,7 +135,10 @@ jobs:
118135
fetch-depth: 0
119136
- name: install-nix
120137
run: |
121-
curl -L https://nixos.org/nix/install | sh
138+
curl -L -o install.sh "https://releases.nixos.org/nix/nix-${NIX_INSTALL_VERSION}/install"
139+
echo "${NIX_INSTALL_SHA} install.sh" | sha256sum -c -
140+
chmod +x install.sh
141+
./install.sh
122142
source /home/runner/.nix-profile/etc/profile.d/nix.sh
123143
nix --version
124144
which nix
@@ -138,7 +158,10 @@ jobs:
138158
fetch-depth: 0
139159
- name: install-nix
140160
run: |
141-
curl -L https://nixos.org/nix/install | sh
161+
curl -L -o install.sh "https://releases.nixos.org/nix/nix-${NIX_INSTALL_VERSION}/install"
162+
echo "${NIX_INSTALL_SHA} install.sh" | sha256sum -c -
163+
chmod +x install.sh
164+
./install.sh
142165
source /home/runner/.nix-profile/etc/profile.d/nix.sh
143166
nix --version
144167
which nix
@@ -224,7 +247,10 @@ jobs:
224247
fetch-depth: 0
225248
- name: install-nix
226249
run: |
227-
curl -L https://nixos.org/nix/install | sh
250+
curl -L -o install.sh "https://releases.nixos.org/nix/nix-${NIX_INSTALL_VERSION}/install"
251+
echo "${NIX_INSTALL_SHA} install.sh" | sha256sum -c -
252+
chmod +x install.sh
253+
./install.sh
228254
source /home/runner/.nix-profile/etc/profile.d/nix.sh
229255
nix --version
230256
which nix

‎.github/workflows/release.yml‎

Lines changed: 17 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,8 @@ env:
1010
AWS_ROLE: arn:aws:iam::270074865685:role/terraform-module-ci-test
1111
GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
1212
ALL_TESTS_JSON: '["TestOneBasic","TestThreeBasic","TestProductionBasic"]'
13+
NIX_INSTALL_SHA: de490f61fcbaf9a5cabf2fa621ddb9ef93ad35d9a23a04e7d51b26e092b63691
14+
NIX_INSTALL_VERSION: 2.34.4
1315

1416
permissions:
1517
contents: write
@@ -96,7 +98,13 @@ jobs:
9698
await script({ core });
9799
- name: Get IP
98100
id: get-ip
99-
run: echo "ip=$(curl -s https://ipinfo.io/ip)" >> "$GITHUB_OUTPUT"
101+
run: |
102+
IP=$(curl -s https://ipinfo.io/ip)
103+
if ! [[ "$IP" =~ ^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$ ]]; then
104+
echo "Error: Invalid IP address format: $IP" >&2
105+
exit 1
106+
fi
107+
echo "ip=$IP" >> "$GITHUB_OUTPUT"
100108
# artifacts are available to other jobs as soon as the step completes
101109
# unlike job outputs which are only available after the job completes
102110
# this artifact is a placeholder only, it has no content
@@ -163,7 +171,10 @@ jobs:
163171
- name: install-nix
164172
if: (steps.check-lock.outputs.status == 'clean' && steps.check-ip.outputs.status == 'clean') || strategy.job-index == 0
165173
run: |
166-
curl -L https://nixos.org/nix/install | sh
174+
curl -L -o install.sh "https://releases.nixos.org/nix/nix-${NIX_INSTALL_VERSION}/install"
175+
echo "${NIX_INSTALL_SHA} install.sh" | sha256sum -c -
176+
chmod +x install.sh
177+
./install.sh
167178
source /home/runner/.nix-profile/etc/profile.d/nix.sh
168179
nix --version
169180
which nix
@@ -256,7 +267,10 @@ jobs:
256267
output-credentials: true
257268
- name: install-nix
258269
run: |
259-
curl -L https://nixos.org/nix/install | sh
270+
curl -L -o install.sh "https://releases.nixos.org/nix/nix-${NIX_INSTALL_VERSION}/install"
271+
echo "${NIX_INSTALL_SHA} install.sh" | sha256sum -c -
272+
chmod +x install.sh
273+
./install.sh
260274
source /home/runner/.nix-profile/etc/profile.d/nix.sh
261275
nix --version
262276
which nix

‎.github/workflows/scripts/tracking-issue.js‎

Lines changed: 3 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ export default async ({ github, core, process }) => {
4141
let pulls;
4242
try {
4343
pulls = await github.paginate(github.rest.search.issuesAndPullRequests, {
44-
q: `repo:${owner}/${repo} is:pr state:open base:main -draft:true -label:internal/pr-tracked -label:internal/pr-backport -label:"autorelease: pending" -label:"autorelease: tagged"`
44+
q: `repo:${owner}/${repo} is:pr state:open base:main -draft:true -label:internal/ignore -label:internal/pr-backport -label:"autorelease: pending" -label:"autorelease: tagged"`
4545
});
4646
} catch (error) {
4747
throw new Error(`Failed to retrieve pull requests for tracking issue: ${error.message}`);
@@ -76,12 +76,7 @@ export default async ({ github, core, process }) => {
7676
});
7777

7878
if (existingIssues.length > 0) {
79-
await github.rest.issues.addLabels({
80-
owner: owner,
81-
repo: repo,
82-
issue_number: pr.number,
83-
labels: ["internal/pr-tracked"]
84-
});
79+
// Note: You can't add labels to PRs submitted from forks.
8580
core.info(`Tracking issue already exists for PR #${pr.number}. Skipping.`);
8681
continue;
8782
}
@@ -132,12 +127,7 @@ export default async ({ github, core, process }) => {
132127
}
133128
});
134129

135-
await github.rest.issues.addLabels({
136-
owner: owner,
137-
repo: repo,
138-
issue_number: pr.number,
139-
labels: ["internal/pr-tracked"]
140-
});
130+
// Note: Labels can't be added to PRs from forks
141131
} catch (error) {
142132
errors.push(`Failed to process PR [${pr.number}](${pr.html_url}): ${error.message}`);
143133
}

‎.variables‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,10 @@
1-
#!/bin/env sh
1+
#!/usr/bin/env bash
22
export TF_IN_AUTOMATION=1
33
TF_VAR_ip="$(curl -s 'https://api.ipify.org')"
4+
if ! [[ "$TF_VAR_ip" =~ ^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$ ]]; then
5+
echo "Error: Invalid IP address format: $IP" >&2
6+
exit 1
7+
fi
48
export TF_VAR_ip
59
export ACME_SERVER_URL="https://acme-v02.api.letsencrypt.org/directory"
610
# shellcheck disable=SC2140

‎GNUmakefile‎

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
default: fmt lint build install generate test testacc
1+
default: fmt lint build generate test testacc
22

33
fmt:
44
gofmt -s -w -e .
@@ -10,9 +10,6 @@ build:
1010
rm -f ./bin/terraform-provider-rancher2
1111
go build -o ./bin/ -v ./...
1212

13-
install:
14-
go install -v ./...
15-
1613
generate:
1714
cd tools; go generate ./...
1815

0 commit comments

Comments
 (0)