github-advanced-security[bot] commented on code in PR #3588:
URL: https://github.com/apache/thrift/pull/3588#discussion_r3376402907
##########
.github/workflows/release_rust.yml:
##########
@@ -31,30 +30,59 @@
workflow_dispatch:
jobs:
- publish:
+ dry-run:
runs-on: ubuntu-latest
- if: false # currently broken and no maintainers around -> see
THRIFT-5917
permissions:
contents: read
- id-token: write
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #
v6.0.2
with:
persist-credentials: false
- - name: Dryrun
+
+ - name: Install Rust 1.85
+ # The repo-pinned toolchain (rust-toolchain: 1.83) predates
edition2024 support
+ # required by transitive dependencies (getrandom >= 0.4); 1.85 is the
minimum
+ # that passes. Pin explicitly for reproducibility.
+ run: rustup toolchain install 1.85 --profile minimal
+
+ - name: Dry run
working-directory: lib/rs
run: cargo publish --dry-run
+ env:
+ RUSTUP_TOOLCHAIN: "1.85"
+
+ publish:
+ runs-on: ubuntu-latest
+ if: ${{ github.event_name == 'release' && !github.event.release.prerelease
}}
+ environment: release
+ permissions:
+ contents: read
+ id-token: write
+ steps:
+ - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #
v6.0.2
+ with:
+ persist-credentials: false
+
+ - name: Verify crate version matches release tag
+ run: |
+ CRATE_VERSION=$(awk -F'"' '/^version/{print $2; exit}'
lib/rs/Cargo.toml)
+ TAG_VERSION=$(echo "${{ github.event.release.tag_name }}" | sed
's/^v//')
Review Comment:
## zizmor /
code injection via template expansion: may expand into attacker-controllable
code
[Show more
details](https://github.com/apache/thrift/security/code-scanning/8)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
