allow just recipes to be run directly from PR comments #7463
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Check if the comment contains the run command | ||
| id: check_comment | ||
| run: | | ||
| commands=echo '${{ github.event.comment.body }}' | grep -oPz '```run_this\n(just .*\n)*```\n' | | ||
| - uses: actions/checkout@v3 | ||
| if: steps.check_comment.outputs.commands != '' | ||
| - name: Install toolchain | ||
| if: steps.check_comment.outputs.commands != '' | ||
| uses: dtolnay/rust-toolchain@master | ||
| with: | ||
| toolchain: ${{ env.RUST_VERSION }} | ||
| - uses: Swatinem/rust-cache@v2 | ||
| if: steps.check_comment.outputs.commands != '' | ||
| with: | ||
| cache-provider: "warpbuild" | ||
| - name: Install just | ||
| if: steps.check_comment.outputs.commands != '' | ||
| run: cargo install just | ||
| - name: Execute the commands | ||
| if: steps.check_comment.outputs.commands != '' | ||
| id: execute_commands | ||
| run: | | ||
| echo "${{ steps.check_comment.outputs.commands }}" | while read line; do | ||
| echo "[$line]" | ||
| if [ "$line" = "\`\`\`run_this" ]; then | ||
| OUTPUT="" | ||
| elif [[ "$line" = "\`\`\`" ]]; then | ||
| echo "Results:" | ||
| echo "\`\`\`" | ||
| echo "$OUTPUT" | ||
| echo "\`\`\`" | ||
| else | ||
| NEWOUTPUT=$(bash -c "$line" 2>&1) | ||
| OUTPUT="$OUTPUT $NEWOUTPUT" | ||
| fi | ||
| done | ||
| - name: Create commit comment | ||
| if: steps.check_comment.outputs.commands != '' | ||
| uses: peter-evans/commit-comment@v4 | ||
| with: | ||
| body: | | ||
| Running: | ||
| ${{ steps.check_comment.outputs.commands }} | ||
|
|
||
| Results: | ||
| ``` | ||
| ${{ steps.execute_commands.outputs.OUTPUT }} | ||
| ``` |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 21 days ago
The best way to fix this issue is to explicitly set a permissions block within the workflow (either globally or just for this job) that grants only the required privileges. For this workflow, the main requirements are:
- Read access to repository contents for checkout.
- Ability to write commit comments (for
peter-evans/commit-comment@v4action), which requirescontents: write(since commit comments are part of code, not issue comments). - All other scopes should remain unset for least privilege.
The most conservative recommendation is to add the following block at the same level as jobs:, above jobs::
permissions:
contents: writeAlternatively, if you wish to restrict permissions further and only give write at the job level (not globally), you can add the permissions: block under jobs.process_comment:, but the global fix is typical.
Action: Insert the following block between line 2 and line 3 in the .github/workflows/pr-automation.yml file:
permissions:
contents: writeNo additional imports or definitions are required for YAML workflows.
| @@ -1,5 +1,7 @@ | ||
| name: Run Command on Comment | ||
|
|
||
| permissions: | ||
| contents: write | ||
| on: | ||
| issue_comment: | ||
| types: |
| - name: Check if the comment contains the run command | ||
| id: check_comment | ||
| run: | | ||
| commands=echo '${{ github.event.comment.body }}' | grep -oPz '```run_this\n(just .*\n)*```\n' | |
Check failure
Code scanning / CodeQL
Code injection Critical
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 21 days ago
How to fix:
Replace the direct interpolation of ${{ github.event.comment.body }} into the shell command with safe usage via environment variables.
Detailed fix:
At the start of the step where we use ${{ github.event.comment.body }}, add an env: block to assign its value to an environment variable, e.g., COMMENT_BODY. Then, in the run: command, reference the value with proper shell variable syntax ("$COMMENT_BODY"). This allows the shell to safely parse the value regardless of its content and prevents opportunity for code injection or unintended expansion.
Concrete changes:
- On step 13-15, add an
env:field to assignCOMMENT_BODY: ${{ github.event.comment.body }}. - In the script on line 15, replace
echo '${{ github.event.comment.body }}'withecho "$COMMENT_BODY". - No new imports or actions are needed.
| @@ -11,8 +11,10 @@ | ||
| steps: | ||
| - name: Check if the comment contains the run command | ||
| id: check_comment | ||
| env: | ||
| COMMENT_BODY: ${{ github.event.comment.body }} | ||
| run: | | ||
| commands=echo '${{ github.event.comment.body }}' | grep -oPz '```run_this\n(just .*\n)*```\n' | | ||
| commands=$(echo "$COMMENT_BODY" | grep -oPz '```run_this\n(just .*\n)*```\n') | ||
| - uses: actions/checkout@v3 | ||
| if: steps.check_comment.outputs.commands != '' | ||
| - name: Install toolchain |
|
Description
Checklist
Breaking*orNew Featurelabels where relevant.