Skip to content

ci: prevent script injection in workflow run steps #136

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
devin-ai-integration wants to merge 1 commit into
base: main
Choose a base branch
from
Open

ci: prevent script injection in workflow run steps #136

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 6 additions & 2 deletions .github/workflows/eval-skills.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -80,8 +80,10 @@ jobs:

- name: Compute changed suites
id: compute
env:
RUN_ALL: ${{ inputs.run_all }}
run: |
if [[ "${{ inputs.run_all }}" == "true" ]]; then
if [[ "$RUN_ALL" == "true" ]]; then
# run_all overrides: list every suite
slugs="$(node -e 'const m=require("./evals/scripts/_manifest");process.stdout.write(JSON.stringify(m.SUITES.map(s=>s.suite)))')"
else
Expand Down Expand Up @@ -267,6 +269,8 @@ jobs:

- name: Commit refreshed scores and badges
if: always() && (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch')
env:
BRANCH_NAME: ${{ github.ref_name }}
run: |
if git diff --quiet eval-scores.json skills/; then
echo "No score or badge changes to commit"
Expand All @@ -277,7 +281,7 @@ jobs:
git add eval-scores.json
git add skills/**/README.md
git commit -m "chore(evals): refresh eval-scores.json and README badges"
git push origin HEAD:${{ github.ref_name }}
git push origin "HEAD:$BRANCH_NAME"

eval-gate:
name: "Evaluate gate"
Expand Down
7 changes: 5 additions & 2 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,9 +22,12 @@ jobs:

- name: Set version
id: version
env:
EVENT_NAME: ${{ github.event_name }}
INPUT_VERSION: ${{ github.event.inputs.version }}
run: |
if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
echo "version=${{ github.event.inputs.version }}" >> $GITHUB_OUTPUT
if [ "$EVENT_NAME" = "workflow_dispatch" ]; then
echo "version=$INPUT_VERSION" >> $GITHUB_OUTPUT
else
echo "version=${GITHUB_REF#refs/tags/}" >> $GITHUB_OUTPUT
fi
Expand Down
Loading