workflows/release-doxygen: Add some security checks and input validation - #196769
Merged
Conversation
We now ensure the job was started by a release manager before granting the contents: write permissions and we also validate the input to ensure it is a proper release string and not something malicious.
tstellar
marked this pull request as ready for review
May 9, 2026 23:23
|
@llvm/pr-subscribers-github-workflow Author: Tom Stellard (tstellar) ChangesWe now ensure the job was started by a release manager before granting the contents: write permissions and we also validate the input to ensure it is a proper release string and not something malicious. Full diff: https://github.com/llvm/llvm-project/pull/196769.diff 2 Files Affected:
diff --git a/.github/workflows/release-doxygen.yml b/.github/workflows/release-doxygen.yml
index 246d7a6304095..5ce776262799d 100644
--- a/.github/workflows/release-doxygen.yml
+++ b/.github/workflows/release-doxygen.yml
@@ -34,6 +34,36 @@ on:
required: true
jobs:
+ # This job checks permissions and validates inputs to prevent potential
+ # malicious actions. Since the release-doxygen job has contents: write
+ # permissions we need to be extract care about who can run the job and
+ # what inputs can be provided.
+ release-doxygen-validate-input:
+ name: Release Doxygen Validate Input
+ runs-on: ubuntu-24.04
+ environment:
+ name: release
+ deployment: false
+ permissions:
+ contents: read
+ steps:
+ - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ with:
+ persist-credentials: false
+ sparse-checkout: |
+ .github/workflows/
+
+ - name: Check Permissions
+ uses: ./.github/workflows/require-release-manager
+ with:
+ LLVM_TOKEN_GENERATOR_CLIENT_ID: ${{ secrets.LLVM_TOKEN_GENERATOR_CLIENT_ID }}
+ LLVM_TOKEN_GENERATOR_PRIVATE_KEY: ${{ secrets.LLVM_TOKEN_GENERATOR_PRIVATE_KEY }}
+
+ - name: Validate Input
+ ./.github/workflows/validate-release-version
+ with:
+ release-version: ${{ inputs.release-version }}
+
release-doxygen:
name: Build and Upload Release Doxygen
runs-on: ubuntu-24.04
@@ -42,6 +72,8 @@ jobs:
deployment: false
permissions:
contents: write
+ needs:
+ - release-doxygen-validate-input
env:
upload: ${{ inputs.upload && !contains(inputs.release-version, 'rc') }}
steps:
diff --git a/.github/workflows/validate-release-version/action.yml b/.github/workflows/validate-release-version/action.yml
new file mode 100644
index 0000000000000..9ed99d2c18c86
--- /dev/null
+++ b/.github/workflows/validate-release-version/action.yml
@@ -0,0 +1,15 @@
+name: Validate Release String
+description: >-
+ This checks to make sure that the given release-version string is well formed.
+inputs:
+ release-version:
+ required: true
+
+runs:
+ using: "composite"
+ steps:
+ - env:
+ RELEASE_VERSON: ${{ inputs.release-version }}
+
+ run: |
+ echo $RELEASE_VERSION | grep -e '^[0-9]\+\.[0-9]\+\.[0-9]\+\(-rc[0-9]\+\)\?$'
|
boomanaiden154
approved these changes
May 10, 2026
boomanaiden154
left a comment
boomanaiden154
left a comment
Contributor
There was a problem hiding this comment.
One typo, otherwise LGTM.
| jobs: | ||
| # This job checks permissions and validates inputs to prevent potential | ||
| # malicious actions. Since the release-doxygen job has contents: write | ||
| # permissions we need to be extract care about who can run the job and |
Contributor
There was a problem hiding this comment.
s/extract care/extra careful?
c-rhodes
reviewed
May 12, 2026
kwk
added a commit
that referenced
this pull request
May 12, 2026
…low (#197107) Fix the `Validate Input` step in `.github/workflows/release-doxygen.yml` to use a valid local action invocation. Before: ```yaml - name: Validate Input ./.github/workflows/validate-release-version with: release-version: ${{ inputs.release-version }} ``` After: ```yaml - name: Validate Input uses: ./.github/workflows/validate-release-version with: release-version: ${{ inputs.release-version }} ``` GitHub Actions steps must use `uses:` or `run:`. The current form is invalid. This appears to have been introduced in #196769. - Verified the workflow syntax change is minimal and correct. - No functional behavior intended beyond fixing the invalid step declaration.
kwk
reviewed
May 12, 2026
| # permissions we need to be extra careful about who can run the job and | ||
| # what inputs can be provided. | ||
| release-doxygen-validate-input: | ||
| name: Release Doxygen Validate Input |
Contributor
There was a problem hiding this comment.
I suggest to only run this in the LLVM repository.
Suggested change
| name: Release Doxygen Validate Input | |
| name: Release Doxygen Validate Input | |
| if: github.repository == 'llvm/llvm-project' |
kwk
reviewed
May 12, 2026
| release-version: ${{ inputs.release-version }} | ||
|
|
||
| release-doxygen: | ||
| name: Build and Upload Release Doxygen |
Contributor
There was a problem hiding this comment.
Same here, only run this in the LLVM repo.
Suggested change
| name: Build and Upload Release Doxygen | |
| name: Build and Upload Release Doxygen | |
| if: github.repository == 'llvm/llvm-project' |
lialan
pushed a commit
to lialan/llvm-project
that referenced
this pull request
May 13, 2026
…low (llvm#197107) Fix the `Validate Input` step in `.github/workflows/release-doxygen.yml` to use a valid local action invocation. Before: ```yaml - name: Validate Input ./.github/workflows/validate-release-version with: release-version: ${{ inputs.release-version }} ``` After: ```yaml - name: Validate Input uses: ./.github/workflows/validate-release-version with: release-version: ${{ inputs.release-version }} ``` GitHub Actions steps must use `uses:` or `run:`. The current form is invalid. This appears to have been introduced in llvm#196769. - Verified the workflow syntax change is minimal and correct. - No functional behavior intended beyond fixing the invalid step declaration.
EuphoricThinking
pushed a commit
to EuphoricThinking/llvm-project
that referenced
this pull request
May 14, 2026
…ion (llvm#196769) We now ensure the job was started by a release manager before granting the contents: write permissions and we also validate the input to ensure it is a proper release string and not something malicious.
EuphoricThinking
pushed a commit
to EuphoricThinking/llvm-project
that referenced
this pull request
May 14, 2026
…low (llvm#197107) Fix the `Validate Input` step in `.github/workflows/release-doxygen.yml` to use a valid local action invocation. Before: ```yaml - name: Validate Input ./.github/workflows/validate-release-version with: release-version: ${{ inputs.release-version }} ``` After: ```yaml - name: Validate Input uses: ./.github/workflows/validate-release-version with: release-version: ${{ inputs.release-version }} ``` GitHub Actions steps must use `uses:` or `run:`. The current form is invalid. This appears to have been introduced in llvm#196769. - Verified the workflow syntax change is minimal and correct. - No functional behavior intended beyond fixing the invalid step declaration.
pedroMVicente
pushed a commit
to pedroMVicente/llvm-project
that referenced
this pull request
May 19, 2026
…ion (llvm#196769) We now ensure the job was started by a release manager before granting the contents: write permissions and we also validate the input to ensure it is a proper release string and not something malicious.
pedroMVicente
pushed a commit
to pedroMVicente/llvm-project
that referenced
this pull request
May 19, 2026
…low (llvm#197107) Fix the `Validate Input` step in `.github/workflows/release-doxygen.yml` to use a valid local action invocation. Before: ```yaml - name: Validate Input ./.github/workflows/validate-release-version with: release-version: ${{ inputs.release-version }} ``` After: ```yaml - name: Validate Input uses: ./.github/workflows/validate-release-version with: release-version: ${{ inputs.release-version }} ``` GitHub Actions steps must use `uses:` or `run:`. The current form is invalid. This appears to have been introduced in llvm#196769. - Verified the workflow syntax change is minimal and correct. - No functional behavior intended beyond fixing the invalid step declaration.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
We now ensure the job was started by a release manager before granting the contents: write permissions and we also validate the input to ensure it is a proper release string and not something malicious.