experimental-ext-interceptors/.github/workflows/status-check.yml
Ola Hungerford 2f66b9b4af
ci: prevent shell injection in status-check workflow (#39)
## Summary

Fixes the open **critical** code scanning alert
(`actions/code-injection/critical`) in
`.github/workflows/status-check.yml`.

The "Get PR number" step interpolated `${{
github.event.workflow_run.head_branch }}` directly into a `run:` shell
script. A PR author controls their own branch name, so a branch named
`rce$(...)` executes arbitrary commands on the runner — which holds a
`GITHUB_TOKEN` with `statuses: write` and `checks: write`. This is a
live target: PR #32's branch name is a working injection payload against
this exact line.

## Fix

Move the branch name (and the other two templated values in the step)
into `env:` and reference them as quoted shell variables. GitHub Actions
template expansion no longer touches the script body, so
attacker-controlled input can't break out of the string.

No behavior change for legitimate runs.

## Not addressed here

The other open alert — critical vitest advisory (Dependabot #4) — is
already covered by open PR #14, so it's intentionally left out of this
PR.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
2026-08-21 16:06:34 +01:00

135 lines
4.5 KiB
YAML

name: Status Check
# This workflow enforces that all relevant CI checks pass based on which files changed.
# It's the only required status check in branch protection settings.
on:
pull_request:
types: [opened, synchronize, reopened]
workflow_run:
workflows: ["C# CI", "Python CI", "Go CI", "TypeScript CI"]
types: [completed]
permissions:
contents: read
statuses: write
checks: write
pull-requests: read
jobs:
verify-required-checks:
name: Verify Required Checks
runs-on: ubuntu-latest
if: github.event_name == 'pull_request' || github.event.workflow_run.conclusion != 'cancelled'
steps:
- name: Check out code
uses: actions/checkout@v4
- name: Get changed files
id: changed-files
uses: dorny/paths-filter@v3
with:
filters: |
csharp:
- 'csharp/**'
- '.github/workflows/csharp.yml'
python:
- 'python/**'
- '.github/workflows/python.yml'
go:
- 'go/**'
- '.github/workflows/go.yml'
typescript:
- 'typescript/**'
- '.github/workflows/typescript.yml'
- name: Check required statuses
uses: actions/github-script@v7
with:
script: |
const owner = context.repo.owner;
const repo = context.repo.repo;
const ref = context.payload.pull_request?.head.sha || context.payload.workflow_run?.head_sha;
// Define required checks per language
const requiredChecks = {
csharp: [
'C# CI / Build',
'C# CI / Unit Tests (8.0.x)',
'C# CI / Unit Tests (9.0.x)',
'C# CI / Package'
],
python: [
'Python CI / Linting',
'Python CI / Unit Tests (3.10)',
'Python CI / Unit Tests (3.11)',
'Python CI / Unit Tests (3.12)'
],
go: [
'Go CI / Linting',
'Go CI / Unit Tests (1.25)',
'Go CI / Unit Tests (1.26)',
'Go CI / Race Detection'
],
typescript: [
'TypeScript CI / Linting',
'TypeScript CI / Unit Tests (20)',
'TypeScript CI / Unit Tests (22)'
]
};
// Get changed files from previous step
const changedFiles = {
csharp: ${{ steps.changed-files.outputs.csharp }} === 'true',
python: ${{ steps.changed-files.outputs.python }} === 'true',
go: ${{ steps.changed-files.outputs.go }} === 'true',
typescript: ${{ steps.changed-files.outputs.typescript }} === 'true'
};
// Collect all required checks based on changes
let allRequiredChecks = [];
for (const [lang, changed] of Object.entries(changedFiles)) {
if (changed) {
allRequiredChecks = allRequiredChecks.concat(requiredChecks[lang]);
}
}
if (allRequiredChecks.length === 0) {
console.log('No language files changed, no checks required');
return;
}
// Get all check runs for this commit
const { data: checkRuns } = await github.rest.checks.listForRef({
owner,
repo,
ref
});
// Verify all required checks have passed
const checkStatuses = {};
for (const check of checkRuns.check_runs) {
checkStatuses[check.name] = check.conclusion;
}
let allPassed = true;
let failureMessage = '';
for (const requiredCheck of allRequiredChecks) {
const status = checkStatuses[requiredCheck];
if (!status) {
allPassed = false;
failureMessage += `❌ ${requiredCheck}: Not started\\n`;
} else if (status !== 'success') {
allPassed = false;
failureMessage += `❌ ${requiredCheck}: ${status}\\n`;
} else {
failureMessage += `✅ ${requiredCheck}: ${status}\\n`;
}
}
if (!allPassed) {
core.setFailed(`Required checks have not passed:\\n${failureMessage}`);
} else {
console.log(`All required checks passed:\\n${failureMessage}`);
}