Skip to content

fix(ci/security): workflow injection + unpinned action (quality-gate + latency-budget) #186

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
KooshaPari merged 1 commit into from
Jul 2, 2026
Merged

fix(ci/security): workflow injection + unpinned action (quality-gate + latency-budget) #186

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions .github/workflows/latency-budget.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,7 +74,7 @@ jobs:

- name: Annotate PR with budget results
if: always()
uses: actions/github-script@v7
uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
with:
script: |
const fs = require('fs');
Expand Down Expand Up @@ -141,7 +141,7 @@ jobs:

- name: Comment PR with regression report
if: always()
uses: actions/github-script@v7
uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
with:
script: |
const fs = require('fs');
Expand Down
18 changes: 12 additions & 6 deletions .github/workflows/reusable/quality-gate.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,12 +51,14 @@ jobs:
name: Quality Gate
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

- name: Parse not-applicable gates
id: parse-na
# Bind workflow_call input to env var before use in shell — prevents script injection.
env:
NA_GATES: ${{ inputs.not-applicable }}
run: |
NA_GATES="${{ inputs.not-applicable }}"
echo "na_gates=${NA_GATES}" >> $GITHUB_OUTPUT
[[ "$NA_GATES" == *"a11y"* ]] && echo "skip_a11y=true" >> $GITHUB_OUTPUT || echo "skip_a11y=false" >> $GITHUB_OUTPUT
[[ "$NA_GATES" == *"e2e"* ]] && echo "skip_e2e=true" >> $GITHUB_OUTPUT || echo "skip_e2e=false" >> $GITHUB_OUTPUT
Expand All @@ -67,8 +69,10 @@ jobs:

- name: Validate coverage report
if: ${{ !contains(steps.parse-na.outputs.na_gates, 'coverage') }}
# Bind workflow_call input to env var before use in shell — prevents script injection.
env:
REPORT: ${{ inputs.coverage-report }}
run: |
REPORT="${{ inputs.coverage-report }}"
if [ ! -f "$REPORT" ]; then
echo "❌ Coverage report not found: $REPORT"
exit 1
Expand All @@ -78,10 +82,12 @@ jobs:
- name: Parse coverage threshold
if: ${{ !contains(steps.parse-na.outputs.na_gates, 'coverage') }}
id: coverage
# Bind workflow_call inputs to env vars before use in shell — prevents script injection.
env:
THRESHOLD: ${{ inputs.threshold }}
FORMAT: ${{ inputs.coverage-format }}
REPORT: ${{ inputs.coverage-report }}
run: |
THRESHOLD="${{ inputs.threshold }}"
FORMAT="${{ inputs.coverage-format }}"
REPORT="${{ inputs.coverage-report }}"
if [ "$FORMAT" = "lcov" ]; then
LINES_HIT=$(grep '^LH:' "$REPORT" | awk -F: '{sum += $2} END {print sum}')
LINES_FOUND=$(grep '^LF:' "$REPORT" | awk -F: '{sum += $2} END {print sum}')
Expand Down
Loading