mirror of
https://github.com/PlaneQuery/OpenAirframes.git
synced 2026-09-08 23:18:57 +02:00
Ashley Childress
f228d16c60
- prevent command injection from a crafted issue body closing the heredoc early - drop the debug step that echoed untrusted input for no operational value - read body and issue number from env in the community validation workflow Generated-by: Claude Opus 5 <noreply@anthropic.com>
40 lines
1.0 KiB
YAML
40 lines
1.0 KiB
YAML
name: Validate Community Submission
|
|
|
|
on:
|
|
issues:
|
|
types: [opened, edited]
|
|
|
|
permissions:
|
|
issues: write
|
|
|
|
jobs:
|
|
validate:
|
|
if: contains(github.event.issue.labels.*.name, 'submission')
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Setup Python
|
|
uses: actions/setup-python@v5
|
|
with:
|
|
python-version: "3.12"
|
|
|
|
- name: Install dependencies
|
|
run: pip install jsonschema
|
|
|
|
- name: Save issue body to file
|
|
env:
|
|
ISSUE_BODY: ${{ github.event.issue.body }}
|
|
run: printf '%s' "$ISSUE_BODY" > "$RUNNER_TEMP/issue_body.txt"
|
|
|
|
- name: Validate submission
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
GITHUB_REPOSITORY: ${{ github.repository }}
|
|
ISSUE_NUMBER: ${{ github.event.issue.number }}
|
|
run: |
|
|
python -m src.contributions.validate_submission \
|
|
--issue-body-file "$RUNNER_TEMP/issue_body.txt" \
|
|
--issue-number "$ISSUE_NUMBER"
|