Skip to content

Fix CI workflow deprecations and streamline build process #543

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
eopo wants to merge 4 commits into
base: main
Choose a base branch
from
Open

Fix CI workflow deprecations and streamline build process #543

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
00ba1a2
fix: update deprecated set-output and macos-13 runner in CI workflow
Copilot Jul 21, 2026
10db9bd
refactor: split build matrix so formula only waits on macos and ubunt…
Copilot Jul 21, 2026
06e94a8
refactor: compute hashes in build jobs, remove mac-hash/linux-hash jobs
Copilot Jul 21, 2026
da67e83
Merge pull request #1 from eopo/copilot/fix-deprecated-build-commands
eopo Jul 21, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
304 changes: 221 additions & 83 deletions .github/workflows/build-on-release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,13 +5,10 @@ on:
types: [created]

jobs:
build:
strategy:
matrix:
# we build on macos-13 for x86 builds
os: [ubuntu-latest, windows-latest, macos-latest, macos-13]

runs-on: ${{ matrix.os }}
build-ubuntu:
runs-on: ubuntu-latest
outputs:
LINUX_BUILD_HASH: ${{ steps.calc-hash.outputs.LINUX_BUILD_HASH }}

steps:
- uses: actions/checkout@v2
Expand All @@ -20,20 +17,135 @@ jobs:
uses: actions/setup-python@v2
with:
python-version: '3.11'

- name: Install dependencies
run: |
python -m pip install --upgrade pip
pip install -r requirements.txt
pip install pyinstaller

- name: Install dependancies (Linux)
if: matrix.os == 'ubuntu-latest'
run: |
sudo apt-get install -y binutils
Comment on lines 27 to 29

- name: Set version in code
run: |
awk 'NR==3{$0="__version__ = \"'${{ github.ref_name }}'\""}1' ./robusta_krr/__init__.py > temp && mv temp ./robusta_krr/__init__.py
cat ./robusta_krr/__init__.py

- name: Build with PyInstaller
shell: bash
run: |
pyinstaller krr.py
mkdir -p ./dist/krr/grapheme/data
cp $(python -c "import grapheme; print(grapheme.__path__[0] + '/data/grapheme_break_property.json')") ./dist/krr/grapheme/data/grapheme_break_property.json
cp ./intro.txt ./dist/krr/intro.txt

- name: Zip the application
run: |
cd dist
zip -r krr-ubuntu-latest-${{ github.ref_name }}.zip krr
mv krr-ubuntu-latest-${{ github.ref_name }}.zip ../
cd ..

- name: Upload Release Asset
uses: actions/upload-release-asset@v1.0.2
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
with:
upload_url: ${{ github.event.release.upload_url }}
asset_path: ./krr-ubuntu-latest-${{ github.ref_name }}.zip
asset_name: krr-ubuntu-latest-${{ github.ref_name }}.zip
asset_content_type: application/octet-stream
Comment on lines +51 to +59

- name: Upload build as artifact
uses: actions/upload-artifact@v4
with:
name: krr-ubuntu-latest-${{ github.ref_name }}
path: ./krr-ubuntu-latest-${{ github.ref_name }}.zip

- name: Calculate hash
id: calc-hash
run: echo "LINUX_BUILD_HASH=$(sha256sum krr-ubuntu-latest-${{ github.ref_name }}.zip | awk '{print $1}')" >> $GITHUB_OUTPUT
Comment on lines +31 to +69

@coderabbitai coderabbitai Bot Jul 21, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

github.ref_name interpolated directly into shell scripts.

The version-stamp awk command (Line 33), zip/mv commands (Lines 47-48), and hash calculation (Line 69) all expand ${{ github.ref_name }} directly inside run: blocks. Since ref_name comes from the triggering ref/tag, this is a template/command-injection vector flagged by zizmor. The safer pattern (used later in build-windows's version-stamp step) is to pass the value via env: and reference the shell variable instead.

🔒 Example fix pattern 
     - name: Set version in code
+      env:
+        REF_NAME: ${{ github.ref_name }}
       run: |
-        awk 'NR==3{$0="__version__ = \"'${{ github.ref_name }}'\""}1' ./robusta_krr/__init__.py > temp && mv temp ./robusta_krr/__init__.py
+        awk 'NR==3{$0="__version__ = \"'"$REF_NAME"'\""}1' ./robusta_krr/__init__.py > temp && mv temp ./robusta_krr/__init__.py
         cat ./robusta_krr/__init__.py

Apply the same env:-based pattern to the zip and hash-calc steps.

🧰 Tools
🪛 zizmor (1.26.1)

[warning] 8-69: overly broad permissions (excessive-permissions): default permissions used due to no permissions: block

(excessive-permissions)

[error] 33-33: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)

[error] 47-47: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)

[error] 48-48: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)

[error] 69-69: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)

[warning] 52-52: action or reusable workflow from archived repository (archived-uses): repository is archived

(archived-uses)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/build-on-release.yml around lines 31 - 69, Replace direct
`${{ github.ref_name }}` interpolation in the version-stamp, Zip the
application, Upload Release Asset, Upload build as artifact, and Calculate hash
steps with an env-provided shell variable, following the existing build-windows
version-stamp pattern. Use that variable consistently in the awk command,
archive names, asset metadata, artifact path, and sha256sum command.

Source: Linters/SAST tools


build-windows:
runs-on: windows-latest

steps:
- uses: actions/checkout@v2

- name: Set up Python
uses: actions/setup-python@v2
with:
python-version: '3.11'

- name: Install dependencies
run: |
python -m pip install --upgrade pip
pip install -r requirements.txt
pip install pyinstaller

- name: Set version in code
run: |
$content = Get-Content -Path .\robusta_krr\__init__.py
$content[2] = "__version__=`"$($env:GITHUB_REF_NAME)`""
$content | Out-File -FilePath .\robusta_krr\__init__.py -Encoding ascii
Get-Content .\robusta_krr\__init__.py
shell: pwsh
env:
GITHUB_REF_NAME: ${{ github.ref_name }}

Comment on lines +71 to +97

@coderabbitai coderabbitai Bot Jul 21, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🩺 Stability & Availability | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

sed -n '1,140p' .github/workflows/build-on-release.yml

Repository: robusta-dev/krr

Length of output: 4568

🏁 Script executed:

rg -n "actions/checkout@v2|actions/setup-python@v2|GITHUB_REF_NAME|persist-credentials" .github/workflows/build-on-release.yml

Repository: robusta-dev/krr

Length of output: 609

🌐 Web query:

actions/checkout v2 node12 deprecation setup-python v2 node12 actionlint

💡 Result:

The use of Node.js 12 in GitHub Actions has been fully deprecated and removed from GitHub-hosted runners [1]. GitHub officially removed Node.js 12 from the Actions runner on August 14, 2023 [1]. Before this removal, GitHub migrated actions to Node.js 16 to ensure compatibility, and warned users to update their workflows [1]. Consequently, actions like actions/checkout@v2 and actions/setup-python@v2, which were originally built on Node.js 12, are considered outdated and should be updated to their newer versions (e.g., v4 or later) to avoid runtime issues and deprecation warnings [2][3][4]. To manage these dependencies, the static analysis tool actionlint includes a specific check for outdated actions [5][6]. It flags the use of popular actions that still rely on unsupported runtimes like Node.js 12 [5][6]. Specifically, actionlint reports an error if it detects usage such as actions/checkout@v2 because of its outdated runtime [5][6]. To resolve these issues, you should: 1. Update your GitHub Actions workflow files to use the latest major versions of all actions [3][4]. 2. Run actionlint in your local development environment or CI pipeline to identify and catch other instances of outdated actions or syntax errors [5][6].

Citations:

🏁 Script executed:

sed -n '140,420p' .github/workflows/build-on-release.yml

Repository: robusta-dev/krr

Length of output: 8901

Upgrade the Windows job off the deprecated v2 actions. actions/checkout@v2 and actions/setup-python@v2 are still pinned here; move them to current majors so this job doesn’t depend on the removed node12 runtime. If this job never pushes back to the repo, set persist-credentials: false on checkout too.

🧰 Tools
🪛 actionlint (1.7.12)

[error] 75-75: the runner of "actions/checkout@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

[error] 78-78: the runner of "actions/setup-python@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

🪛 zizmor (1.26.1)

[warning] 75-75: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

[warning] 71-127: overly broad permissions (excessive-permissions): default permissions used due to no permissions: block

(excessive-permissions)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/build-on-release.yml around lines 71 - 97, Update the
build-windows job’s actions/checkout and actions/setup-python steps from
deprecated v2 to current major versions, and configure checkout with
persist-credentials set to false since the job does not push changes back to the
repository.

Source: Linters/SAST tools

- name: Build with PyInstaller
shell: bash
run: |
pyinstaller krr.py
mkdir -p ./dist/krr/grapheme/data
cp $(python -c "import grapheme; print(grapheme.__path__[0] + '/data/grapheme_break_property.json')") ./dist/krr/grapheme/data/grapheme_break_property.json
cp ./intro.txt ./dist/krr/intro.txt

- name: Zip the application
run: |
Set-Location -Path dist
Compress-Archive -Path krr -DestinationPath krr-windows-latest-${{ github.ref_name }}.zip -Force
Move-Item -Path krr-windows-latest-${{ github.ref_name }}.zip -Destination ..\
Set-Location -Path ..

- name: Upload Release Asset
uses: actions/upload-release-asset@v1.0.2
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
with:
upload_url: ${{ github.event.release.upload_url }}
asset_path: ./krr-windows-latest-${{ github.ref_name }}.zip
asset_name: krr-windows-latest-${{ github.ref_name }}.zip
asset_content_type: application/octet-stream
Comment on lines +113 to +121
Comment on lines +106 to +121

@coderabbitai coderabbitai Bot Jul 21, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Same template-injection and archived-action findings apply here.

Lines 109-110 expand ${{ github.ref_name }} directly in the Compress-Archive/Move-Item run block (same class of issue as the Ubuntu job); Line 114 uses the archived actions/upload-release-asset@v1.0.2.

🧰 Tools
🪛 zizmor (1.26.1)

[error] 109-109: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)

[error] 110-110: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)

[warning] 114-114: action or reusable workflow from archived repository (archived-uses): repository is archived

(archived-uses)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/build-on-release.yml around lines 106 - 121, Update the
Windows release packaging step around “Zip the application” to avoid
interpolating github.ref_name directly inside the PowerShell run block; pass the
ref name through the environment and use that value for both Compress-Archive
and Move-Item. Replace the archived “Upload Release Asset” action with the
repository’s supported release-upload mechanism while preserving the existing
asset path, name, and content type.

Source: Linters/SAST tools


- name: Upload build as artifact
uses: actions/upload-artifact@v4
with:
name: krr-windows-latest-${{ github.ref_name }}
path: ./krr-windows-latest-${{ github.ref_name }}.zip

build-macos:
runs-on: macos-latest
outputs:
MAC_BUILD_HASH: ${{ steps.calc-hash.outputs.MAC_BUILD_HASH }}

steps:
- uses: actions/checkout@v2

- name: Set up Python
uses: actions/setup-python@v2
with:
python-version: '3.11'

- name: Install dependencies
run: |
python -m pip install --upgrade pip
pip install -r requirements.txt
pip install pyinstaller

- name: Install the Apple certificate and provisioning profile
if: matrix.os == 'macos-latest' || matrix.os == 'macos-13'
env:
BUILD_CERTIFICATE_BASE64: ${{ secrets.BUILD_CERTIFICATE_BASE64 }}
P12_PASSWORD: ${{ secrets.P12_PASSWORD }}
Expand Down Expand Up @@ -62,81 +174,142 @@ jobs:
mkdir -p ~/Library/MobileDevice/Provisioning\ Profiles
cp $PP_PATH ~/Library/MobileDevice/Provisioning\ Profiles

- name: Set version in code (Unix)
if: matrix.os == 'macos-latest' || matrix.os == 'ubuntu-latest' || matrix.os == 'macos-13'
- name: Set version in code
run: |
awk 'NR==3{$0="__version__ = \"'${{ github.ref_name }}'\""}1' ./robusta_krr/__init__.py > temp && mv temp ./robusta_krr/__init__.py
cat ./robusta_krr/__init__.py

- name: Set version in code (Windows)
if: matrix.os == 'windows-latest'
run: |
$content = Get-Content -Path .\robusta_krr\__init__.py
$content[2] = "__version__=`"$($env:GITHUB_REF_NAME)`""
$content | Out-File -FilePath .\robusta_krr\__init__.py -Encoding ascii
Get-Content .\robusta_krr\__init__.py
shell: pwsh
env:
GITHUB_REF_NAME: ${{ github.ref_name }}

- name: Build with PyInstaller
if: matrix.os == 'macos-latest'
shell: bash
run: |
pyinstaller --target-architecture arm64 krr.py
mkdir -p ./dist/krr/grapheme/data
cp $(python -c "import grapheme; print(grapheme.__path__[0] + '/data/grapheme_break_property.json')") ./dist/krr/grapheme/data/grapheme_break_property.json
cp ./intro.txt ./dist/krr/intro.txt

- name: Zip the application
run: |
cd dist
zip -r krr-macos-latest-${{ github.ref_name }}.zip krr
mv krr-macos-latest-${{ github.ref_name }}.zip ../
cd ..

- name: Upload Release Asset
uses: actions/upload-release-asset@v1.0.2
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
with:
upload_url: ${{ github.event.release.upload_url }}
asset_path: ./krr-macos-latest-${{ github.ref_name }}.zip
asset_name: krr-macos-latest-${{ github.ref_name }}.zip
asset_content_type: application/octet-stream
Comment on lines +197 to +205

- name: Upload build as artifact
uses: actions/upload-artifact@v4
with:
name: krr-macos-latest-${{ github.ref_name }}
path: ./krr-macos-latest-${{ github.ref_name }}.zip

- name: Calculate hash
id: calc-hash
run: echo "MAC_BUILD_HASH=$(shasum -a 256 krr-macos-latest-${{ github.ref_name }}.zip | awk '{print $1}')" >> $GITHUB_OUTPUT
Comment on lines +177 to +215

@coderabbitai coderabbitai Bot Jul 21, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Template injection repeats in the macOS build/zip/hash steps.

Lines 179, 193-194, and 215 expand ${{ github.ref_name }} directly inside run: blocks, the same anti-pattern flagged in the Ubuntu and Windows jobs.

🧰 Tools
🪛 zizmor (1.26.1)

[error] 179-179: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)

[error] 193-193: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)

[error] 194-194: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)

[error] 215-215: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)

[warning] 198-198: action or reusable workflow from archived repository (archived-uses): repository is archived

(archived-uses)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/build-on-release.yml around lines 177 - 215, Replace
direct `${{ github.ref_name }}` interpolation in the macOS steps “Set version in
code,” “Zip the application,” “Upload Release Asset,” “Upload build as
artifact,” and “Calculate hash” with a safely initialized environment variable,
then reference that variable in all shell commands and action inputs.

Source: Linters/SAST tools


- name: Clean up keychain and provisioning profile
if: always()
run: |
security delete-keychain $RUNNER_TEMP/app-signing.keychain-db
rm ~/Library/MobileDevice/Provisioning\ Profiles/build_pp.mobileprovision
Comment on lines +219 to +221

build-macos-intel:
runs-on: macos-15-intel

steps:
- uses: actions/checkout@v2

- name: Set up Python
uses: actions/setup-python@v2
with:
python-version: '3.11'

- name: Install dependencies
run: |
python -m pip install --upgrade pip
pip install -r requirements.txt
pip install pyinstaller

- name: Install the Apple certificate and provisioning profile
env:
BUILD_CERTIFICATE_BASE64: ${{ secrets.BUILD_CERTIFICATE_BASE64 }}
P12_PASSWORD: ${{ secrets.P12_PASSWORD }}
BUILD_PROVISION_PROFILE_BASE64: ${{ secrets.BUILD_PROVISION_PROFILE_BASE64 }}
KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
run: |
# create variables
CERTIFICATE_PATH=$RUNNER_TEMP/build_certificate.p12
PP_PATH=$RUNNER_TEMP/build_pp.mobileprovision
KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db

# import certificate and provisioning profile from secrets
echo -n "$BUILD_CERTIFICATE_BASE64" | base64 --decode -o $CERTIFICATE_PATH
echo -n "$BUILD_PROVISION_PROFILE_BASE64" | base64 --decode -o $PP_PATH

# create temporary keychain
security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH

# import certificate to keychain
security import $CERTIFICATE_PATH -P "$P12_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
security list-keychain -d user -s $KEYCHAIN_PATH

# apply provisioning profile
mkdir -p ~/Library/MobileDevice/Provisioning\ Profiles
cp $PP_PATH ~/Library/MobileDevice/Provisioning\ Profiles

Comment on lines +223 to +268

@coderabbitai coderabbitai Bot Jul 21, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🩺 Stability & Availability | 🟠 Major | ⚡ Quick win

Outdated GitHub Actions and checkout credential persistence

actions/checkout@v2 and actions/setup-python@v2 are still pinned here, and checkout should disable credential persistence if the job doesn’t need repo write access.

🧰 Tools
🪛 actionlint (1.7.12)

[error] 227-227: the runner of "actions/checkout@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

[error] 230-230: the runner of "actions/setup-python@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

🪛 zizmor (1.26.1)

[warning] 227-227: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

[warning] 223-309: overly broad permissions (excessive-permissions): default permissions used due to no permissions: block

(excessive-permissions)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/build-on-release.yml around lines 223 - 268, Update the
build-macos-intel job’s checkout and Python setup steps to use current supported
action versions, and configure actions/checkout to disable persisted credentials
since this job does not require repository write access.

- name: Set version in code
run: |
awk 'NR==3{$0="__version__ = \"'${{ github.ref_name }}'\""}1' ./robusta_krr/__init__.py > temp && mv temp ./robusta_krr/__init__.py
cat ./robusta_krr/__init__.py

- name: Build with PyInstaller
if: matrix.os != 'macos-latest'
shell: bash
run: |
pyinstaller krr.py
mkdir -p ./dist/krr/grapheme/data
cp $(python -c "import grapheme; print(grapheme.__path__[0] + '/data/grapheme_break_property.json')") ./dist/krr/grapheme/data/grapheme_break_property.json
cp ./intro.txt ./dist/krr/intro.txt

- name: Zip the application (Unix)
if: matrix.os == 'macos-latest' || matrix.os == 'ubuntu-latest' || matrix.os == 'macos-13'
- name: Zip the application
run: |
cd dist
zip -r krr-${{ matrix.os }}-${{ github.ref_name }}.zip krr
mv krr-${{ matrix.os }}-${{ github.ref_name }}.zip ../
zip -r krr-macos-15-intel-${{ github.ref_name }}.zip krr
mv krr-macos-15-intel-${{ github.ref_name }}.zip ../
cd ..

- name: Zip the application (Windows)
if: matrix.os == 'windows-latest'
run: |
Set-Location -Path dist
Compress-Archive -Path krr -DestinationPath krr-${{ matrix.os }}-${{ github.ref_name }}.zip -Force
Move-Item -Path krr-${{ matrix.os }}-${{ github.ref_name }}.zip -Destination ..\
Set-Location -Path ..

- name: Upload Release Asset
uses: actions/upload-release-asset@v1.0.2
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
with:
Comment on lines 289 to 293
upload_url: ${{ github.event.release.upload_url }}
asset_path: ./krr-${{ matrix.os }}-${{ github.ref_name }}.zip
asset_name: krr-${{ matrix.os }}-${{ github.ref_name }}.zip
upload_url: ${{ github.event.release.upload_url }}
asset_path: ./krr-macos-15-intel-${{ github.ref_name }}.zip
asset_name: krr-macos-15-intel-${{ github.ref_name }}.zip
asset_content_type: application/octet-stream
Comment on lines +269 to 297

@coderabbitai coderabbitai Bot Jul 21, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Same template-injection and archived-action findings in build-macos-intel.

Lines 271, 285-286 expand ${{ github.ref_name }} directly in run: blocks; Line 290 uses the archived actions/upload-release-asset@v1.0.2.

🧰 Tools
🪛 zizmor (1.26.1)

[error] 271-271: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)

[error] 285-285: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)

[error] 286-286: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)

[warning] 290-290: action or reusable workflow from archived repository (archived-uses): repository is archived

(archived-uses)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/build-on-release.yml around lines 269 - 297, Update the
macOS Intel workflow to pass github.ref_name through an environment variable and
reference that variable in the version-setting, zip filename, and release asset
fields instead of interpolating it directly in run blocks. Replace the archived
actions/upload-release-asset@v1.0.2 step with the repository’s supported
release-upload action while preserving the existing asset path, name, and
content type.

Source: Linters/SAST tools


- name: Upload build as artifact
uses: actions/upload-artifact@v4
with:
name: krr-${{ matrix.os }}-${{ github.ref_name }}
path: ./krr-${{ matrix.os }}-${{ github.ref_name }}.zip
name: krr-macos-15-intel-${{ github.ref_name }}
path: ./krr-macos-15-intel-${{ github.ref_name }}.zip

- name: Clean up keychain and provisioning profile
if: (matrix.os == 'macos-latest' || matrix.os == 'macos-13') && always()
if: always()
run: |
security delete-keychain $RUNNER_TEMP/app-signing.keychain-db
rm ~/Library/MobileDevice/Provisioning\ Profiles/build_pp.mobileprovision
Comment on lines 307 to 309

check-latest:
needs: build
needs: [build-macos, build-ubuntu]
runs-on: ubuntu-latest
outputs:
IS_LATEST: ${{ steps.check-latest.outputs.release == github.ref_name }}
Expand All @@ -148,46 +321,11 @@ jobs:
repository: ${{ github.repository }}
excludes: prerelease, draft

# Define MacOS hash job
mac-hash:
needs: check-latest
runs-on: ubuntu-latest
if: needs.check-latest.outputs.IS_LATEST
outputs:
MAC_BUILD_HASH: ${{ steps.calc-hash.outputs.MAC_BUILD_HASH }}
steps:
- name: Checkout Repository
uses: actions/checkout@v2
- name: Download MacOS artifact
uses: actions/download-artifact@v4
with:
name: krr-macos-latest-${{ github.ref_name }}
- name: Calculate hash
id: calc-hash
run: echo "::set-output name=MAC_BUILD_HASH::$(sha256sum krr-macos-latest-${{ github.ref_name }}.zip | awk '{print $1}')"

# Define Linux hash job
linux-hash:
needs: check-latest
runs-on: ubuntu-latest
if: needs.check-latest.outputs.IS_LATEST
outputs:
LINUX_BUILD_HASH: ${{ steps.calc-hash.outputs.LINUX_BUILD_HASH }}
steps:
- name: Checkout Repository
uses: actions/checkout@v2
- name: Download Linux artifact
uses: actions/download-artifact@v4
with:
name: krr-ubuntu-latest-${{ github.ref_name }}
- name: Calculate hash
id: calc-hash
run: echo "::set-output name=LINUX_BUILD_HASH::$(sha256sum krr-ubuntu-latest-${{ github.ref_name }}.zip | awk '{print $1}')"

# Define job to update homebrew formula
update-formula:
needs: [mac-hash, linux-hash]
needs: [check-latest, build-macos, build-ubuntu]
runs-on: ubuntu-latest
if: needs.check-latest.outputs.IS_LATEST
Comment on lines +326 to +328

@coderabbitai coderabbitai Bot Jul 21, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🗄️ Data Integrity & Integration | 🔴 Critical | ⚡ Quick win

🧩 Analysis chain

🌐 Web query:

Are GitHub Actions job outputs always strings, and how does if: evaluate a bare string like "false"?

💡 Result:

In GitHub Actions, job outputs are always stored and retrieved as strings [1][2]. Even if you set an output to a boolean or numeric value, it is serialized into its string representation (e.g., the boolean false becomes the string "false") when written to the GITHUB_OUTPUT environment file or accessed via the job outputs context [1]. Regarding your second question, how an if conditional evaluates a bare string like "false": In GitHub Actions, the if conditional is a special context where values are evaluated as expressions. When the runtime evaluates an if condition, it applies specific coercion rules to determine truthiness: 1. Truthy/Falsy Evaluation: Within an if conditional, GitHub Actions coerces values to booleans [3][4]. Falsy values are defined as false, 0, -0, "" (empty string), '', and null [3][4]. 2. String Interpretation: Because the string "false" is a non-empty string, it is considered truthy [3][4][5]. Therefore, if: false (as a boolean literal) evaluates to false, but if: "false" (as a string literal) evaluates to true [3][4][5]. To safely handle boolean outputs from previous jobs, you should convert the string back into a boolean within the expression using the fromJSON function [3][4]. For example, instead of using if: ${{ needs.job1.outputs.my_output }}, which would evaluate the string "false" as true, you should use: if: ${{ fromJSON(needs.job1.outputs.my_output) }} This converts the string "false" into the boolean false, allowing the condition to be evaluated as expected [3][4].

Citations:

🏁 Script executed:

git ls-files .github/workflows/build-on-release.yml && wc -l .github/workflows/build-on-release.yml && sed -n '300,340p' .github/workflows/build-on-release.yml

Repository: robusta-dev/krr

Length of output: 1902

Gate update-formula on an explicit boolean check

needs.check-latest.outputs.IS_LATEST is a string, so this bare if: treats "false" as truthy and still runs update-formula on non-latest releases. That can overwrite the Homebrew formula with stale hashes/URLs.

Suggested fix 
   update-formula:
     needs: [check-latest, build-macos, build-ubuntu]
     runs-on: ubuntu-latest
-    if: needs.check-latest.outputs.IS_LATEST
+    if: needs.check-latest.outputs.IS_LATEST == 'true'
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
needs: [check-latest, build-macos, build-ubuntu]
runs-on: ubuntu-latest
if: needs.check-latest.outputs.IS_LATEST
needs: [check-latest, build-macos, build-ubuntu]
runs-on: ubuntu-latest
if: needs.check-latest.outputs.IS_LATEST == 'true'
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/build-on-release.yml around lines 326 - 328, Update the
update-formula job’s if condition to explicitly compare
needs.check-latest.outputs.IS_LATEST with the expected true value, ensuring the
job runs only when the output is actually true and remains skipped for "false".

steps:
- name: Checkout homebrew-krr repository
uses: actions/checkout@v2
Expand All @@ -196,8 +334,8 @@ jobs:
token: ${{ secrets.MULTIREPO_GITHUB_TOKEN }}
- name: Update krr.rb formula
run: |
MAC_BUILD_HASH=${{ needs.mac-hash.outputs.MAC_BUILD_HASH }}
LINUX_BUILD_HASH=${{ needs.linux-hash.outputs.LINUX_BUILD_HASH }}
MAC_BUILD_HASH=${{ needs.build-macos.outputs.MAC_BUILD_HASH }}
LINUX_BUILD_HASH=${{ needs.build-ubuntu.outputs.LINUX_BUILD_HASH }}
TAG_NAME=${{ github.ref_name }}
awk 'NR==6{$0=" url \"https://github.com/robusta-dev/krr/releases/download/'"$TAG_NAME"'/krr-macos-latest-'"$TAG_NAME"'.zip\""}1' ./Formula/krr.rb > temp && mv temp ./Formula/krr.rb
awk 'NR==7{$0=" sha256 \"'$MAC_BUILD_HASH'\""}1' ./Formula/krr.rb > temp && mv temp ./Formula/krr.rb
Expand Down