Changeset 59679 for trunk/.github/workflows/slack-notifications.yml

Timestamp:

01/22/2025 03:13:21 PM (21 months ago)

Author:

johnbillion

Message:

Build/Test Tools: Improve the security and correctness of the GitHub Actions workflows files.

This includes removing use of dangerous inline GitHub Actions expressions, preventing word splitting, further tightening permissions, and generally improving many aspects of the workflows.

This also introduces a new workflow that runs Actionlint to detect incorrect and insecure code and configuration in workflow files.

Props johnbillion, swissspidy, flixos90, desrosj.

See #62221

File:

• trunk/.github/workflows/slack-notifications.yml (modified) (10 diffs)

trunk/.github/workflows/slack-notifications.yml

@@ -55 +55 @@
     if: ${{ github.repository == 'WordPress/wordpress-develop' && github.event.workflow_run.event != 'pull_request' }}
     outputs:
-      previous_conclusion: ${{ steps.previous-conclusion.outputs.previous_conclusion }}
+      previous_conclusion: ${{ steps.previous-attempt-result.outputs.result }}
       payload: ${{ steps.create-payload.outputs.payload }}
 
@@ -69 +69 @@
               owner: context.repo.owner,
               repo: context.repo.repo,
-              run_id: ${{ github.run_id }},
+              run_id: context.runId,
             });
 
-            if ( '${{ inputs.calling_status }}' == 'failure' && workflow_run.data.run_attempt == 1 ) {
+            if ( process.env.CALLING_STATUS == 'failure' && workflow_run.data.run_attempt == 1 ) {
               return 'first-failure';
             }
@@ -83 +83 @@
                 owner: context.repo.owner,
                 repo: context.repo.repo,
-                run_id: ${{ github.run_id }},
+                run_id: context.runId,
                 attempt_number: workflow_run.data.run_attempt - 1
               });
@@ -95 +95 @@
               repo: context.repo.repo,
               workflow_id: workflow_run.data.workflow_id,
-              branch: '${{ env.CURRENT_BRANCH }}',
+              branch: process.env.CURRENT_BRANCH,
               exclude_pull_requests: true,
             });
@@ -125 +125 @@
             // Can't determine previous workflow conclusion.
             return 'unknown';
-
-      - name: Store previous conclusion as an output
-        id: previous-conclusion
-        run: echo "previous_conclusion=${{ steps.previous-attempt-result.outputs.result }}" >> $GITHUB_OUTPUT
+        env:
+          CALLING_STATUS: ${{ inputs.calling_status }}
 
       - name: Get the commit message
@@ -141 +139 @@
               owner: context.repo.owner,
               repo: context.repo.repo,
-              ref: '${{ github.sha }}'
+              ref: context.sha,
             });
             return commit_details.data.commit.message;
@@ -148 +146 @@
         id: commit-message
         run: |
-          COMMIT_MESSAGE=$(cat <<'EOF' | awk 'NR==1' | sed 's/`/\\`/g' | sed 's/\"/\\\\\\"/g' | sed 's/\$/\\$/g'
-          ${{ ( github.event_name == 'workflow_dispatch' || github.event_name == 'schedule' ) && fromJson( steps.current-commit-message.outputs.result ) || github.event.head_commit.message }}
-          EOF
-          )
-          echo "commit_message_escaped=${COMMIT_MESSAGE}" >> $GITHUB_OUTPUT
+          # shellcheck disable=SC2016
+          COMMIT_MESSAGE="$(echo "${COMMIT_MSG_RAW}" | awk 'NR==1' | sed 's/`/\\`/g' | sed 's/\"/\\\\\\"/g' | sed 's/\$/\\$/g')"
+          echo "commit_message_escaped=${COMMIT_MESSAGE}" >> "$GITHUB_OUTPUT"
+        env:
+          COMMIT_MSG_RAW: ${{ ( github.event_name == 'workflow_dispatch' || github.event_name == 'schedule' ) && fromJson( steps.current-commit-message.outputs.result ) || github.event.head_commit.message }}
 
       - name: Construct payload and store as an output
         id: create-payload
-        run: echo "payload={\"workflow_name\":\"${{ github.workflow }}\",\"ref_name\":\"${{ env.CURRENT_BRANCH }}\",\"run_url\":\"https://github.com/WordPress/wordpress-develop/actions/runs/${{ github.run_id }}/attempts/${{ github.run_attempt }}\",\"commit_message\":\"${{ steps.commit-message.outputs.commit_message_escaped }}\"}" >> $GITHUB_OUTPUT
+        run: |
+          PAYLOAD="$( jq \
+            -n \
+            --arg workflow_name "${GITHUB_WORKFLOW}" \
+            --arg ref_name "${CURRENT_BRANCH}" \
+            --arg run_url "https://github.com/WordPress/wordpress-develop/actions/runs/${GITHUB_RUN_ID}/attempts/${GITHUB_RUN_ATTEMPT}" \
+            --arg commit_message "${COMMIT_MSG}" \
+            '{workflow_name: $workflow_name, ref_name: $ref_name, run_url: $run_url, commit_message: $commit_message}'
+          )"
+          echo "payload=$PAYLOAD" >> "$GITHUB_OUTPUT"
+        env:
+          COMMIT_MSG: ${{ steps.commit-message.outputs.commit_message_escaped }}
 
   # Posts notifications when a workflow fails.
   failure:
     name: Failure notifications
+    permissions: {}
     runs-on: ubuntu-latest
     timeout-minutes: 10
@@ -177 +187 @@
   fixed:
     name: Fixed notifications
+    permissions: {}
     runs-on: ubuntu-latest
     timeout-minutes: 10
@@ -193 +204 @@
   success:
     name: Success notifications
+    permissions: {}
     runs-on: ubuntu-latest
     timeout-minutes: 10
@@ -209 +221 @@
   cancelled:
     name: Cancelled notifications
+    permissions: {}
     runs-on: ubuntu-latest
     timeout-minutes: 10