Kobi Hikri
8c85809a12
Hi, and thanks for CVAT. In `.github/workflows/update-python-requirements.yml`, the final push interpolates the PR's source branch name straight into the command: ```yaml git remote set-url origin "https://x-access-token:${GH_TOKEN}@github.com/${{ github.repository }}.git" git push origin HEAD:${{ github.event.pull_request.head.ref }} ``` Actions substitutes `${{ ... }}` into the script text before bash runs, so the branch name lands as script rather than as an argument, and it is unquoted. Git permits `$`, `(`, `)`, backticks and spaces in branch names, so a branch named something like `x$(id)` would execute on the runner — in a step that has just put an app token into the origin remote URL. The step is already doing the right thing for its other sensitive value: `GH_TOKEN` comes in through `env:` and is used as `${GH_TOKEN}`. This change applies the same treatment to the branch name: ```yaml env: GH_TOKEN: "${{ steps.gen-token.outputs.token }}" HEAD_REF: ${{ github.event.pull_request.head.ref }} run: | ... git push origin "HEAD:$HEAD_REF" ``` I also quoted the refspec, so branch names with spaces push correctly instead of being split into two arguments. One thing I could not check from outside, and would rather flag than assume: how this workflow is invoked for fork PRs. On a plain `pull_request` event a fork gets a read-only token, which would limit this considerably; if it is reachable another way, the token in that remote URL makes it more serious. You will know that better than I do. Disclosure: I used AI assistance to help spot this and prepare the change, and I read the workflow myself.
93 lines
3.3 KiB
YAML
93 lines
3.3 KiB
YAML
name: Update Python requirements
|
|
|
|
on:
|
|
pull_request:
|
|
types: [opened, synchronize, reopened]
|
|
paths:
|
|
- "cvat/requirements/*.in"
|
|
- "utils/dataset_manifest/requirements.in"
|
|
|
|
permissions:
|
|
contents: read
|
|
pull-requests: read
|
|
|
|
jobs:
|
|
update:
|
|
# Only run on Dependabot branches from this repository. Regenerating
|
|
# requirements can execute package build code, so fork PRs must not run this
|
|
# workflow with access to the CVAT bot token.
|
|
if: >
|
|
github.event.pull_request.user.login == 'dependabot[bot]' &&
|
|
github.event.pull_request.head.repo.full_name == github.repository &&
|
|
startsWith(github.event.pull_request.head.ref, 'dependabot/pip/')
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
ref: ${{ github.event.pull_request.head.ref }}
|
|
repository: ${{ github.event.pull_request.head.repo.full_name }}
|
|
persist-credentials: false
|
|
|
|
- uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
|
|
with:
|
|
python-version: "3.12"
|
|
|
|
- name: Install system dependencies
|
|
run: |
|
|
sudo apt-get update
|
|
sudo apt-get install --no-install-recommends -y \
|
|
cargo \
|
|
g++ \
|
|
gcc \
|
|
libhdf5-dev \
|
|
libldap2-dev \
|
|
libmp3lame-dev \
|
|
libsasl2-dev \
|
|
libxml2-dev \
|
|
libxmlsec1-dev \
|
|
libxmlsec1-openssl \
|
|
make \
|
|
nasm \
|
|
pkg-config \
|
|
python3-dev
|
|
|
|
- name: Install pip-compile-multi
|
|
run: python -m pip install pip-compile-multi
|
|
|
|
- name: Regenerate Python requirements
|
|
run: cvat/requirements/regenerate.sh --no-upgrade
|
|
|
|
- name: Check generated requirements changes
|
|
id: changes
|
|
run: |
|
|
if git diff --quiet -- cvat/requirements/*.txt utils/dataset_manifest/requirements.txt; then
|
|
echo "No generated requirements changes"
|
|
echo "changed=false" >> "$GITHUB_OUTPUT"
|
|
else
|
|
echo "changed=true" >> "$GITHUB_OUTPUT"
|
|
fi
|
|
|
|
# The default github.token does not trigger follow-up CI on push. Use the
|
|
# same app token as the release workflow so the updated Dependabot PR runs
|
|
# the normal validation pipeline.
|
|
- name: Generate authentication token
|
|
if: steps.changes.outputs.changed == 'true'
|
|
id: gen-token
|
|
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
|
|
with:
|
|
client-id: "${{ secrets.CVAT_BOT_CLIENT_ID }}"
|
|
private-key: "${{ secrets.CVAT_BOT_PRIVATE_KEY }}"
|
|
|
|
- name: Commit regenerated requirements
|
|
if: steps.changes.outputs.changed == 'true'
|
|
env:
|
|
GH_TOKEN: "${{ steps.gen-token.outputs.token }}"
|
|
HEAD_REF: ${{ github.event.pull_request.head.ref }}
|
|
run: |
|
|
git config user.name "cvat-bot[bot]"
|
|
git config user.email "147643061+cvat-bot[bot]@users.noreply.github.com"
|
|
git add cvat/requirements/*.txt utils/dataset_manifest/requirements.txt
|
|
git commit -m "Regenerate Python requirements"
|
|
git remote set-url origin "https://x-access-token:${GH_TOKEN}@github.com/${{ github.repository }}.git"
|
|
git push origin "HEAD:$HEAD_REF"
|