Use env key to avoid action injection (#513)

* use env key to avoid action injection * fix gaps * fix * use unified slack actions
Privado-Inc · Sep 5, 2024 · 58ca333 · 58ca333
1 parent 52def67
commit 58ca333
Showing 1 changed file with 45 additions and 32 deletions.
diff --git a/.github/workflows/comparison-result.yml b/.github/workflows/comparison-result.yml
@@ -1,40 +1,51 @@
-name: Monitoring Stability and Comparing Results for privado
+name: Monitoring Stability and Comparing Results
 
 # Triggers when a pull_request is created
 on:
   pull_request_target:
     branches:
       - "**"
 
+env:
+  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  CORE_AT: ${{ secrets.CORE_AT }}
+  BASE_REF: ${{ github.BASE_REF }}
+  HEAD_REF: ${{ github.HEAD_REF }}
+  BASE_RULE_URL: ${{ github.event.pull_request.base.repo.html_url }}
+  HEAD_RULE_URL: ${{ github.event.pull_request.head.repo.html_url }}
+  PR_NUMBER: ${{ github.event.number }}
+  REPOSITORY_NAME: ${{github.event.repository.name}}
+  PR_URL: ${{ github.event.pull_request.html_url }}
+  SLACK_BOT_TOKEN: ${{ secrets.SLACK_TOKEN }}
+  SLACK_CHANNEL_ID: ${{ secrets.SLACK_CHANNEL_ID }}
+
 jobs:
   start_workflow:
     runs-on: ubuntu-latest
+    env:
+      PR_URL: ${{ github.event.pull_request.html_url }}
     steps:
       - name: Send message to slack
         id: initial-message
-        uses: archive/github-actions-slack@master
+        uses: slackapi/slack-github-action@v1.27.0
         with:
-          slack-optional-parse: full
-          slack-bot-user-oauth-access-token: ${{ secrets.SLACK_TOKEN }}
-          slack-channel: ${{ secrets.SLACK_CHANNEL_ID }}
-          slack-text: "Comparison workflow started for ${{github.event.pull_request.html_url}}"
+          channel-id: ${{ secrets.SLACK_CHANNEL_ID }}
+          slack-message : "Comparison workflow started for ${{env.PR_URL}}"
 
       - name: Save output to env
         id: save-output
-        run: echo "INIT_MSG_TS=${{ fromJson(steps.initial-message.outputs.slack-result).response.message.ts }}" >> $GITHUB_OUTPUT
+        run: echo "INIT_MSG_TS=${{ steps.initial-message.outputs.ts }}" >> $GITHUB_OUTPUT
     outputs:
       init_message_ts: ${{steps.save-output.outputs.INIT_MSG_TS}}
-
   setup_and_scan:
     needs: start_workflow
     strategy:
       matrix:
-        language: ['java-1', 'java-2' , 'python', 'js', 'ruby-1', 'ruby-2', 'go', 'kotlin']
+        language: ['java-1', 'java-2' ,'python', 'js', 'ruby-1', 'ruby-2', 'go', 'kotlin']
     continue-on-error: true
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
-
       - name: Install JDK-18
         uses: actions/setup-java@v3
         with:
@@ -51,44 +62,44 @@ jobs:
         with:
           python-version: '3.10'
 
-      - name: Clone standalone-monitoring-stability/main
+      - name: Clone standalone-monitoring-stability/private-fork
         uses: actions/checkout@v3
         with:
           repository: Privado-Inc/standalone-monitoring-stability
           path: ./temp/standalone-monitoring-stability
           ref: private-fork
 
-      - name: Run the script for ${{github.head_ref}} and ${{github.base_ref}}
-        # It is important to sanitize the branch name from forks, otherwise it can be used to inject code.
-        env:
-          HEAD_REF: ${{ github.head_ref }}
-        run: export GITHUB_TOKEN=${{ secrets.GITHUB_TOKEN }} && export PAT=${{ secrets.PAT }} && cd ./temp/standalone-monitoring-stability && pip install -r requirements.txt && python3 ./run.py -r ./repos/${{matrix.language}}.txt -rbb ${{github.base_ref}} -rbh $HEAD_REF -brr ${{ github.event.pull_request.base.repo.html_url }} -hrr ${{ github.event.pull_request.head.repo.html_url }} -guf -urc
-
+      # langauge specific repository file
+      - name: Run the script for ${{ env.HEAD_REF }} and ${{ env.BASE_REF }}
+        run: cd ./temp/standalone-monitoring-stability && pip install -r requirements.txt && python3 ./run.py -r ./repos/${{matrix.language}}.txt -rbb ${{ env.BASE_REF }}} -rbh ${{ env.HEAD_REF }} -brr ${{ env.BASE_RULE_URL }} -hrr ${{ env.HEAD_RULE_URL }} -guf -urc
+
       - name: Run aws-export
-        run: cd ./temp/standalone-monitoring-stability/ && python3 aws-export.py ${{matrix.language}}-${{github.event.number}}
+        run: cd ./temp/standalone-monitoring-stability/ && python3 aws-export.py ${{matrix.language}}-${{ env.PR_NUMBER }}
 
       - name: Move results to a folder
-        run: cd ./temp/standalone-monitoring-stability/ && mkdir results && mv output-${{matrix.language}}-${{github.event.number}}.xlsx ./results/output-${{matrix.language}}-${{github.event.number}}.xlsx && mv ./temp/result-${{matrix.language}}-${{github.event.number}}.zip ./results/result-${{matrix.language}}-${{github.event.number}}.zip && mv slack_summary.txt ./results/slack_summary.txt
+        run: cd ./temp/standalone-monitoring-stability/ && mkdir results && mv output-${{matrix.language}}-${{ env.PR_NUMBER }}.xlsx ./results/output-${{matrix.language}}-$${{ env.PR_NUMBER }}.xlsx && mv ./temp/result-${{matrix.language}}-${{ env.PR_NUMBER }}.zip ./results/result-${{matrix.language}}-${{ env.PR_NUMBER }}.zip && mv slack_summary.txt ./results/slack_summary.txt
 
+      # Zip the results by name
       - name: Zip the results
-        run: cd /home/runner/work/privado/privado/temp/standalone-monitoring-stability && zip result-${{matrix.language}}-${{github.event.number}}.zip -r ./results
+        run: cd /home/runner/work/privado/privado/temp/standalone-monitoring-stability && zip result-${{matrix.language}}-${{ env.PR_NUMBER }}.zip -r ./results
 
       - name: Set summary variable
         run: |
           echo "MESSAGE<<EOF" >> $GITHUB_ENV
           echo "$(cat /home/runner/work/privado/privado/temp/standalone-monitoring-stability/results/slack_summary.txt)" >> $GITHUB_ENV
           echo "EOF" >> $GITHUB_ENV
-      
-      - name: Post results to slack
-        uses: adrey/slack-file-upload-action@master
-        with:
-          thread_ts: ${{needs.start_workflow.outputs.init_message_ts}}
-          channel: ${{ secrets.SLACK_CHANNEL_ID }} # check
-          path: "/home/runner/work/privado/privado/temp/standalone-monitoring-stability/result-${{matrix.language}}-${{github.event.number}}.zip"
-          initial_comment: "Comparison Results generated on ${{github.event.repository.name}} by PR ${{github.event.number}} from branch ${{github.head_ref}} to ${{github.base_ref}} \nPR link https://github.com/Privado-Inc/privado/pull/${{github.event.number}}\n Language: ${{matrix.language}} \nSummary Report:\n ${{ env.MESSAGE }}"
-          filetype: "zip"
-          token: ${{ secrets.SLACK_TOKEN }}
 
+      - name: Post results to slack
+        run: curl -o- https://raw.githubusercontent.com/Privado-Inc/standalone-monitoring-stability/private-fork/slack_upload.sh | bash
+        env:
+          SLACK_TOKEN: ${{ secrets.SLACK_TOKEN }}
+          SLACK_CHANNEL_ID: ${{ secrets.SLACK_CHANNEL_ID }}
+          FILE_NAME: "result-${{matrix.language}}-${{ env.PR_NUMBER }}.zip"
+          INIT_TS: ${{ needs.start_workflow.outputs.init_message_ts }}
+          FILE_PATH: "/home/runner/work/joern/joern/temp/standalone-monitoring-stability/result-${{matrix.language}}-${{ env.PR_NUMBER }}.zip"
+          PR_MESSAGE: "Comparison Results generated on ${{ env.REPOSITORY_NAME }} by PR ${{ env.PR_NUMBER }} from branch ${{ env.HEAD_REF }} to ${{ env.BASE_REF }} \nPR link ${{ env.PR_URL }}\n Language: ${{matrix.language}} \nSummary Report:\n ${{ env.MESSAGE }}"
+
+
       - name: Export workflow output
         run: cd ./temp/standalone-monitoring-stability && python3 ./workflow_check.py /home/runner/work/privado/privado/temp/standalone-monitoring-stability/results/slack_summary.txt
 
@@ -98,6 +109,9 @@ jobs:
           echo "$(cat ./temp/standalone-monitoring-stability/action_result.txt)" >> $GITHUB_ENV
           echo "EOF" >> $GITHUB_ENV 
 
+      - name: Print action result
+        run: cat ./temp/standalone-monitoring-stability/action_result.txt
+
       - name: Upload summary file
         uses: actions/upload-artifact@master
         with:
@@ -129,7 +143,6 @@ jobs:
           path: ./temp/standalone-monitoring-stability
           ref: main
 
-
       - name: Collate summary
         run: cd ./temp/standalone-monitoring-stability && pip install -r requirements.txt && python3 ./collate_summary.py -s /home/runner/work/privado/privado/language_summary
 
@@ -144,6 +157,6 @@ jobs:
         with:
           update-ts: ${{needs.start_workflow.outputs.init_message_ts}}
           channel-id: ${{ secrets.SLACK_CHANNEL_ID }}
-          slack-message: "\nComparison Results generated on ${{github.event.repository.name}} by PR ${{github.event.number}} from branch ${{github.head_ref}} to ${{github.base_ref}} \nPR link https://github.com/Privado-Inc/privado/pull/${{github.event.number}}\nLanguage: All \nSummary Report:\n ${{ env.MESSAGE }}"
+          slack-message: "\nComparison Results generated on ${{ env.REPOSITORY_NAME }} by PR ${{ env.PR_NUMBER }} from branch ${{ env.HEAD_REF }} to ${{ env.BASE_REF }} \nPR link https://github.com/Privado-Inc/privado/pull/${{ env.PR_NUMBER }}\nLanguage: All \nSummary Report:\n ${{ env.MESSAGE }}"
         env:
           SLACK_BOT_TOKEN: ${{ secrets.SLACK_TOKEN }}