adalal/gotenberg
1
0
Fork 0
mirror of https://github.com/gotenberg/gotenberg.git synced 2026-08-16 04:12:16 +01:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): avoid shell interpolation

Browse Source
This commit is contained in:
Romain Prévost
2026-03-12 14:02:54 +01:00
committed by Julien Neuhart
parent 59f96358c4
commit 230cb8da2c
3 changed files with 36 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

33
.github/actions/build-test-push/action.yml vendored
View File

@@ -60,30 +60,43 @@ runs:
- name: Build ${{ inputs.platform }} - name: Build ${{ inputs.platform }}
id: build id: build
shell: bash shell: bash
env:
INPUT_VERSION: ${{ inputs.version }}
INPUT_PLATFORM: ${{ inputs.platform }}
INPUT_ALTERNATE_REPOSITORY: ${{ inputs.alternate_repository }}
INPUT_DRY_RUN: ${{ inputs.dry_run }}
run: | run: |
.github/actions/build-test-push/build.sh \ .github/actions/build-test-push/build.sh \
--version "${{ inputs.version }}" \ --version "$INPUT_VERSION" \
--platform "${{ inputs.platform }}" \ --platform "$INPUT_PLATFORM" \
--alternate-repository "${{ inputs.alternate_repository }}" \ --alternate-repository "$INPUT_ALTERNATE_REPOSITORY" \
--dry-run "${{ inputs.dry_run }}" --dry-run "$INPUT_DRY_RUN"
- name: Run integration tests - name: Run integration tests
if: inputs.skip_integrations_tests != 'true' if: inputs.skip_integrations_tests != 'true'
shell: bash shell: bash
env:
INPUT_VERSION: ${{ inputs.version }}
INPUT_PLATFORM: ${{ inputs.platform }}
INPUT_ALTERNATE_REPOSITORY: ${{ inputs.alternate_repository }}
INPUT_DRY_RUN: ${{ inputs.dry_run }}
run: | run: |
.github/actions/build-test-push/test.sh \ .github/actions/build-test-push/test.sh \
--version "${{ inputs.version }}" \ --version "$INPUT_VERSION" \
--platform "${{ inputs.platform }}" \ --platform "$INPUT_PLATFORM" \
--alternate-repository "${{ inputs.alternate_repository }}" \ --alternate-repository "$INPUT_ALTERNATE_REPOSITORY" \
--dry-run "${{ inputs.dry_run }}" --dry-run "$INPUT_DRY_RUN"
- name: Push - name: Push
if: inputs.docker_hub_username != '' if: inputs.docker_hub_username != ''
shell: bash shell: bash
env:
INPUT_TAGS: ${{ steps.build.outputs.tags }},${{ steps.build.outputs.tags_cloud_run }},${{ steps.build.outputs.tags_aws_lambda }}
INPUT_DRY_RUN: ${{ inputs.dry_run }}
run: | run: |
.github/actions/build-test-push/push.sh \ .github/actions/build-test-push/push.sh \
--tags "${{ steps.build.outputs.tags }},${{ steps.build.outputs.tags_cloud_run }},${{ steps.build.outputs.tags_aws_lambda }}" \ --tags "$INPUT_TAGS" \
--dry-run "${{ inputs.dry_run }}" --dry-run "$INPUT_DRY_RUN"
- name: Outputs - name: Outputs
shell: bash shell: bash

9
.github/actions/clean/action.yml vendored
View File

@@ -23,9 +23,12 @@ runs:
env: env:
DOCKERHUB_USERNAME: ${{ inputs.docker_hub_username }} DOCKERHUB_USERNAME: ${{ inputs.docker_hub_username }}
DOCKERHUB_TOKEN: ${{ inputs.docker_hub_password }} DOCKERHUB_TOKEN: ${{ inputs.docker_hub_password }}
INPUT_TAGS: ${{ inputs.tags }}
INPUT_SNAPSHOT_VERSION: ${{ inputs.snapshot_version }}
INPUT_DRY_RUN: ${{ inputs.dry_run }}
shell: bash shell: bash
run: | run: |
.github/actions/clean/clean.sh \ .github/actions/clean/clean.sh \
--tags "${{ inputs.tags }}" \ --tags "$INPUT_TAGS" \
--snapshot-version "${{ inputs.snapshot_version }}" \ --snapshot-version "$INPUT_SNAPSHOT_VERSION" \
--dry-run "${{ inputs.dry_run }}" --dry-run "$INPUT_DRY_RUN"

10
.github/actions/merge/action.yml vendored
View File

@@ -41,8 +41,12 @@ runs:
- name: Merge - name: Merge
shell: bash shell: bash
env:
INPUT_TAGS: ${{ inputs.tags }}
INPUT_ALTERNATE_REGISTRY: ${{ inputs.alternate_registry }}
INPUT_DRY_RUN: ${{ inputs.dry_run }}
run: | run: |
.github/actions/merge/merge.sh \ .github/actions/merge/merge.sh \
--tags "${{ inputs.tags }}" \ --tags "$INPUT_TAGS" \
--alternate-registry "${{ inputs.alternate_registry }}" \ --alternate-registry "$INPUT_ALTERNATE_REGISTRY" \
--dry-run "${{ inputs.dry_run }}" --dry-run "$INPUT_DRY_RUN"