Skip to content

Conversation

Sushisource
Copy link
Member

What was changed

Add worker deployment options to eager workflow start requests

Why?

Needed so server has versioning info available to it when processing eager start requests

Checklist

  1. Closes

  2. How was this tested:
    Unit tests

  3. Any docs updates needed?

@Sushisource Sushisource requested a review from a team as a code owner October 10, 2025 01:14
runs-on: ubuntu-latest
steps:
- name: Dispatch ${{ inputs.dispatch_id }}
run: echo "Dispatch ${{ inputs.dispatch_id }}"

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Semgrep identified a blocking 🔴 issue in your code:
Using variable interpolation ${{...}} with github context data in a run: step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. github context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with env: to store the data and use the environment variable in the run: script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".

To resolve this comment:

🔧 No guidance has been designated for this issue. Fix according to your organization's approved methods.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

  • /fp <comment> for false positive
  • /ar <comment> for acceptable risk
  • /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by run-shell-injection.

You can view more details about this finding in the Semgrep AppSec Platform.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/other this is from an upstream repo and doesn't run here

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Status updated to ignored by @Sushisource. Re-run the pipeline to make this finding non-blocking.

Reply with /open to re-open this finding

@Sushisource Sushisource force-pushed the deploymet-eager-wf-start branch from 568a804 to bae7ff3 Compare October 10, 2025 17:03
@Sushisource Sushisource merged commit 561ca79 into master Oct 17, 2025
18 checks passed
@Sushisource Sushisource deleted the deploymet-eager-wf-start branch October 17, 2025 22:28
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants