## Summary
Fixes the open **critical** code scanning alert
(`actions/code-injection/critical`) in
`.github/workflows/status-check.yml`.
The "Get PR number" step interpolated `${{
github.event.workflow_run.head_branch }}` directly into a `run:` shell
script. A PR author controls their own branch name, so a branch named
`rce$(...)` executes arbitrary commands on the runner — which holds a
`GITHUB_TOKEN` with `statuses: write` and `checks: write`. This is a
live target: PR #32's branch name is a working injection payload against
this exact line.
## Fix
Move the branch name (and the other two templated values in the step)
into `env:` and reference them as quoted shell variables. GitHub Actions
template expansion no longer touches the script body, so
attacker-controlled input can't break out of the string.
No behavior change for legitimate runs.
## Not addressed here
The other open alert — critical vitest advisory (Dependabot #4) — is
already covered by open PR #14, so it's intentionally left out of this
PR.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
135 lines
4.5 KiB
YAML
135 lines
4.5 KiB
YAML
name: Status Check
|
|
|
|
# This workflow enforces that all relevant CI checks pass based on which files changed.
|
|
# It's the only required status check in branch protection settings.
|
|
|
|
on:
|
|
pull_request:
|
|
types: [opened, synchronize, reopened]
|
|
workflow_run:
|
|
workflows: ["C# CI", "Python CI", "Go CI", "TypeScript CI"]
|
|
types: [completed]
|
|
|
|
permissions:
|
|
contents: read
|
|
statuses: write
|
|
checks: write
|
|
pull-requests: read
|
|
|
|
jobs:
|
|
verify-required-checks:
|
|
name: Verify Required Checks
|
|
runs-on: ubuntu-latest
|
|
if: github.event_name == 'pull_request' || github.event.workflow_run.conclusion != 'cancelled'
|
|
steps:
|
|
- name: Check out code
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Get changed files
|
|
id: changed-files
|
|
uses: dorny/paths-filter@v3
|
|
with:
|
|
filters: |
|
|
csharp:
|
|
- 'csharp/**'
|
|
- '.github/workflows/csharp.yml'
|
|
python:
|
|
- 'python/**'
|
|
- '.github/workflows/python.yml'
|
|
go:
|
|
- 'go/**'
|
|
- '.github/workflows/go.yml'
|
|
typescript:
|
|
- 'typescript/**'
|
|
- '.github/workflows/typescript.yml'
|
|
|
|
- name: Check required statuses
|
|
uses: actions/github-script@v7
|
|
with:
|
|
script: |
|
|
const owner = context.repo.owner;
|
|
const repo = context.repo.repo;
|
|
const ref = context.payload.pull_request?.head.sha || context.payload.workflow_run?.head_sha;
|
|
|
|
// Define required checks per language
|
|
const requiredChecks = {
|
|
csharp: [
|
|
'C# CI / Build',
|
|
'C# CI / Unit Tests (8.0.x)',
|
|
'C# CI / Unit Tests (9.0.x)',
|
|
'C# CI / Package'
|
|
],
|
|
python: [
|
|
'Python CI / Linting',
|
|
'Python CI / Unit Tests (3.10)',
|
|
'Python CI / Unit Tests (3.11)',
|
|
'Python CI / Unit Tests (3.12)'
|
|
],
|
|
go: [
|
|
'Go CI / Linting',
|
|
'Go CI / Unit Tests (1.25)',
|
|
'Go CI / Unit Tests (1.26)',
|
|
'Go CI / Race Detection'
|
|
],
|
|
typescript: [
|
|
'TypeScript CI / Linting',
|
|
'TypeScript CI / Unit Tests (20)',
|
|
'TypeScript CI / Unit Tests (22)'
|
|
]
|
|
};
|
|
|
|
// Get changed files from previous step
|
|
const changedFiles = {
|
|
csharp: ${{ steps.changed-files.outputs.csharp }} === 'true',
|
|
python: ${{ steps.changed-files.outputs.python }} === 'true',
|
|
go: ${{ steps.changed-files.outputs.go }} === 'true',
|
|
typescript: ${{ steps.changed-files.outputs.typescript }} === 'true'
|
|
};
|
|
|
|
// Collect all required checks based on changes
|
|
let allRequiredChecks = [];
|
|
for (const [lang, changed] of Object.entries(changedFiles)) {
|
|
if (changed) {
|
|
allRequiredChecks = allRequiredChecks.concat(requiredChecks[lang]);
|
|
}
|
|
}
|
|
|
|
if (allRequiredChecks.length === 0) {
|
|
console.log('No language files changed, no checks required');
|
|
return;
|
|
}
|
|
|
|
// Get all check runs for this commit
|
|
const { data: checkRuns } = await github.rest.checks.listForRef({
|
|
owner,
|
|
repo,
|
|
ref
|
|
});
|
|
|
|
// Verify all required checks have passed
|
|
const checkStatuses = {};
|
|
for (const check of checkRuns.check_runs) {
|
|
checkStatuses[check.name] = check.conclusion;
|
|
}
|
|
|
|
let allPassed = true;
|
|
let failureMessage = '';
|
|
|
|
for (const requiredCheck of allRequiredChecks) {
|
|
const status = checkStatuses[requiredCheck];
|
|
if (!status) {
|
|
allPassed = false;
|
|
failureMessage += `❌ ${requiredCheck}: Not started\\n`;
|
|
} else if (status !== 'success') {
|
|
allPassed = false;
|
|
failureMessage += `❌ ${requiredCheck}: ${status}\\n`;
|
|
} else {
|
|
failureMessage += `✅ ${requiredCheck}: ${status}\\n`;
|
|
}
|
|
}
|
|
|
|
if (!allPassed) {
|
|
core.setFailed(`Required checks have not passed:\\n${failureMessage}`);
|
|
} else {
|
|
console.log(`All required checks passed:\\n${failureMessage}`);
|
|
}
|