github-advanced-security[bot] commented on code in PR #39811:
URL: https://github.com/apache/beam/pull/39811#discussion_r3809732498
##########
.github/workflows/beam_Infrastructure_UsersPermissions.yml:
##########
@@ -44,11 +44,29 @@
runs-on: [self-hosted, ubuntu-24.04, main]
timeout-minutes: 30
steps:
- - name: Checkout code
+ - name: Checkout secure master code
uses: actions/checkout@v7
with:
- ref: ${{ github.event.pull_request.merged == true && github.base_ref
|| github.event.pull_request.head.sha }}
+ ref: ${{ github.base_ref || github.ref }}
persist-credentials: false
+ - name : Checkout only users.yml from the Pull Request
+ uses: actions/checkout@v7
+ with:
+ sparse-checkout: 'infra/iam/users.yml'
+ sparse-checkout-cone-mode: false
+ ref: ${{ github.event.pull_request.head.sha }}
+ path : './pr_users'
+ persist-credentials: false
+ - name: Overwrite users.yml with PR changes
+ run: |
+ echo "[DevSecOps] Safely overwriting users.yml with data from the
Pull Request..."
+ cp ./pr_users/infra/iam/users.yml ./infra/iam/users.yml
+ - name: Download users.yml directly from PR fork
+ run: |
+ echo "[DevSecOps] Descargando de forma segura users.yml desde el
Pull Request..."
+ curl -s -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
+ "https://api.github.com/repos/${{ github.repository
}}/contents/infra/iam/users.yml?ref=${{ github.event.pull_request.head.ref }}" \
Review Comment:
## CodeQL / Code injection
Potential code injection in [${{ github.event.pull_request.head.ref }}](1),
which may be controlled by an external user ([pull_request_target](2)).
[Show more
details](https://github.com/apache/beam/security/code-scanning/1914)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
