ci(release): add workflow to deprecate version#2128
Conversation
📝 WalkthroughSummary by CodeRabbit
WalkthroughA new GitHub Actions workflow file has been added at Comment |
c8fca6f to
3e9958f
Compare
074b8b1 to
e179b67
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/deprecate-version.yml:
- Around line 72-77: The workflow step "Deprecate package versions" is
vulnerable because it interpolates inputs directly into the run script as
VERSION="${{ inputs.version }}" and MESSAGE="${{ inputs.message }}"; change the
step to set those values as step-level environment variables (env: VERSION: ${{
inputs.version }}, MESSAGE: ${{ inputs.message }}) and then reference the safe
shell variables ($VERSION, $MESSAGE) inside the run block so GitHub Actions will
escape the inputs and prevent command injection.
| - name: Deprecate package versions | ||
| env: | ||
| NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} | ||
| run: | | ||
| VERSION="${{ inputs.version }}" | ||
| MESSAGE="${{ inputs.message }}" |
There was a problem hiding this comment.
Command injection vulnerability via direct input interpolation.
Direct interpolation of ${{ inputs.version }} and ${{ inputs.message }} into shell scripts allows command injection. Even with team authorization checks, an authorized user could inject shell metacharacters (accidental or intentional). Move inputs to step-level environment variables where GitHub Actions will properly escape them.
🔒 Proposed fix
- name: Deprecate package versions
env:
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+ VERSION: ${{ inputs.version }}
+ MESSAGE: ${{ inputs.message }}
run: |
- VERSION="${{ inputs.version }}"
- MESSAGE="${{ inputs.message }}"
-
PACKAGES=(
"supabase-js"🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/deprecate-version.yml around lines 72 - 77, The workflow
step "Deprecate package versions" is vulnerable because it interpolates inputs
directly into the run script as VERSION="${{ inputs.version }}" and MESSAGE="${{
inputs.message }}"; change the step to set those values as step-level
environment variables (env: VERSION: ${{ inputs.version }}, MESSAGE: ${{
inputs.message }}) and then reference the safe shell variables ($VERSION,
$MESSAGE) inside the run block so GitHub Actions will escape the inputs and
prevent command injection.
2 participants
Add workflow so that we can easily deprecate a version