Skip to content

Commit a8db10f

Browse files
filipchristiansenfilipchristiansen
authored
Merge branch 'main' into chore/GHA-152134-stepsecurity-remediation
2 parents 0eac804 + b85cb18 commit a8db10f

File tree

3 files changed

+184
-3
lines changed

3 files changed

+184
-3
lines changed

‎.github/workflows/deploy-pr.yml‎

Lines changed: 171 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,171 @@
1+
name: Manage PR Temp Envs
2+
'on':
3+
pull_request:
4+
types:
5+
- labeled
6+
- unlabeled
7+
- closed
8+
9+
permissions:
10+
contents: read
11+
pull-requests: write
12+
13+
env:
14+
APP_NAME: gitingest
15+
FLUX_OWNER: '${{ github.repository_owner }}'
16+
FLUX_REPO: '${{ secrets.CR_FLUX_REPO }}'
17+
18+
jobs:
19+
deploy-pr-env:
20+
if: >-
21+
${{ github.event.action == 'labeled' && github.event.label.name ==
22+
'deploy-pr-temp-env' }}
23+
runs-on: ubuntu-latest
24+
steps:
25+
- name: Create GitHub App token
26+
uses: actions/create-github-app-token@v2
27+
id: app-token
28+
with:
29+
app-id: '${{ secrets.CR_APP_CI_APP_ID }}'
30+
private-key: '${{ secrets.CR_APP_CI_PRIVATE_KEY }}'
31+
owner: '${{ env.FLUX_OWNER }}'
32+
repositories: '${{ env.FLUX_REPO }}'
33+
34+
- name: Checkout Flux repo
35+
uses: actions/checkout@v4
36+
with:
37+
repository: '${{ env.FLUX_OWNER }}/${{ env.FLUX_REPO }}'
38+
token: '${{ steps.app-token.outputs.token }}'
39+
path: flux-repo
40+
persist-credentials: false
41+
42+
- name: Export PR ID
43+
shell: bash
44+
run: 'echo "PR_ID=${{ github.event.pull_request.number }}" >> $GITHUB_ENV'
45+
46+
- name: Ensure template exists
47+
shell: bash
48+
run: >
49+
T="flux-repo/pr-template/${APP_NAME}"
50+
51+
[[ -d "$T" ]] || { echo "Missing $T"; exit 1; }
52+
53+
[[ $(find "$T" -type f | wc -l) -gt 0 ]] || { echo "No files in $T";
54+
exit 1; }
55+
56+
- name: Render & copy template
57+
shell: bash
58+
run: |
59+
SRC="flux-repo/pr-template/${APP_NAME}"
60+
DST="flux-repo/deployments/prs-${APP_NAME}/${PR_ID}"
61+
mkdir -p "$DST"
62+
cp -r "$SRC/." "$DST/"
63+
find "$DST" -type f -print0 \
64+
| xargs -0 -n1 sed -i "s|@PR-ID@|${PR_ID}|g"
65+
66+
- name: Sanity‑check rendered output
67+
shell: bash
68+
run: >
69+
E=$(find "flux-repo/pr-template/${APP_NAME}" -type f | wc -l)
70+
71+
G=$(find "flux-repo/deployments/prs-${APP_NAME}/${PR_ID}" -type f | wc
72+
-l)
73+
74+
(( G == E )) || { echo "Expected $E files, got $G"; exit 1; }
75+
76+
- name: Commit & push creation
77+
shell: bash
78+
run: >
79+
cd flux-repo
80+
81+
git config user.name "${{ steps.app-token.outputs.app-slug }}[bot]"
82+
83+
git config user.email "${{ steps.app-token.outputs.app-slug
84+
}}[bot]@users.noreply.github.com"
85+
86+
git add .
87+
88+
git commit -m "chore(prs-${APP_NAME}): create temp env for PR #${{
89+
env.PR_ID }} [skip ci]" || echo "Nothing to commit"
90+
91+
git remote set-url origin \
92+
https://x-access-token:${{ steps.app-token.outputs.token }}@github.com/${{ env.FLUX_OWNER }}/${{ env.FLUX_REPO }}.git
93+
git push origin HEAD:main
94+
95+
- name: Comment preview URL on PR
96+
uses: thollander/actions-comment-pull-request@v3
97+
with:
98+
github-token: '${{ secrets.GITHUB_TOKEN }}'
99+
pr-number: '${{ github.event.pull_request.number }}'
100+
comment-tag: 'pr-preview'
101+
create-if-not-exists: 'true'
102+
message: |
103+
⚙️ Preview environment for PR #${{ env.PR_ID }} is available at:
104+
https://pr-${{ env.PR_ID }}.${{ env.APP_NAME }}.coderamp.dev/
105+
106+
remove-pr-env:
107+
if: >-
108+
(github.event.action == 'unlabeled' && github.event.label.name ==
109+
'deploy-pr-temp-env') || (github.event.action == 'closed')
110+
runs-on: ubuntu-latest
111+
steps:
112+
- name: Create GitHub App token
113+
uses: actions/create-github-app-token@v2
114+
id: app-token
115+
with:
116+
app-id: '${{ secrets.CR_APP_CI_APP_ID }}'
117+
private-key: '${{ secrets.CR_APP_CI_PRIVATE_KEY }}'
118+
owner: '${{ env.FLUX_OWNER }}'
119+
repositories: '${{ env.FLUX_REPO }}'
120+
121+
- name: Checkout Flux repo
122+
uses: actions/checkout@v4
123+
with:
124+
repository: '${{ env.FLUX_OWNER }}/${{ env.FLUX_REPO }}'
125+
token: '${{ steps.app-token.outputs.token }}'
126+
path: flux-repo
127+
persist-credentials: false
128+
129+
- name: Export PR ID
130+
shell: bash
131+
run: 'echo "PR_ID=${{ github.event.pull_request.number }}" >> $GITHUB_ENV'
132+
133+
- name: Remove deployed directory
134+
shell: bash
135+
run: |
136+
DST="flux-repo/deployments/prs-${APP_NAME}/${PR_ID}"
137+
if [[ -d "$DST" ]]; then
138+
rm -rf "$DST"
139+
echo "✅ Deleted $DST"
140+
else
141+
echo "⏭️ Nothing to delete at $DST"
142+
fi
143+
144+
- name: Commit & push deletion
145+
shell: bash
146+
run: >
147+
cd flux-repo
148+
149+
git config user.name "${{ steps.app-token.outputs.app-slug }}[bot]"
150+
151+
git config user.email "${{ steps.app-token.outputs.app-slug
152+
}}[bot]@users.noreply.github.com"
153+
154+
git add -A
155+
156+
git commit -m "chore(prs-${APP_NAME}): remove temp env for PR #${{
157+
env.PR_ID }} [skip ci]" || echo "Nothing to commit"
158+
159+
git remote set-url origin \
160+
https://x-access-token:${{ steps.app-token.outputs.token }}@github.com/${{ env.FLUX_OWNER }}/${{ env.FLUX_REPO }}.git
161+
git push origin HEAD:main
162+
163+
- name: Comment preview URL on PR
164+
uses: thollander/actions-comment-pull-request@v3
165+
with:
166+
github-token: '${{ secrets.GITHUB_TOKEN }}'
167+
pr-number: '${{ github.event.pull_request.number }}'
168+
comment-tag: 'pr-preview'
169+
create-if-not-exists: 'true'
170+
message: |
171+
⚙️ Preview environment was undeployed.

‎.github/workflows/docker_image.yml‎

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
name: Build & Push Container
2+
23
on:
34
push:
45
branches:
@@ -16,8 +17,14 @@ concurrency:
1617
env:
1718
REGISTRY: ghcr.io
1819
IMAGE_NAME: ${{ github.repository }}
19-
# Set to 'true' to allow pushing container from pull requests with the label 'push-container'
20-
PUSH_FROM_PR: ${{ github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'push-container') }}
20+
# Now allow pushing from PRs when either 'push-container' OR 'deploy-pr-temp-env' is present:
21+
PUSH_FROM_PR: >-
22+
${{ github.event_name == 'pull_request' &&
23+
(
24+
contains(github.event.pull_request.labels.*.name, 'push-container') ||
25+
contains(github.event.pull_request.labels.*.name, 'deploy-pr-temp-env')
26+
)
27+
}}
2128
2229
permissions:
2330
contents: read

‎src/server/routers/ingest.py‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -112,7 +112,10 @@ async def download_ingest(ingest_id: str) -> FileResponse:
112112
- **HTTPException**: **403** - the process lacks permission to read the directory or file
113113
114114
"""
115-
directory = TMP_BASE_PATH / ingest_id
115+
# Normalize and validate the directory path
116+
directory = (TMP_BASE_PATH / ingest_id).resolve()
117+
if not str(directory).startswith(str(TMP_BASE_PATH.resolve())):
118+
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail=f"Invalid ingest ID: {ingest_id!r}")
116119

117120
if not directory.is_dir():
118121
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail=f"Digest {ingest_id!r} not found")

0 commit comments

Comments
 (0)