Skip to content

ci: hash all depends recipe inputs #7543

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
PastaPastaPasta merged 1 commit into from
Aug 4, 2026
Merged

ci: hash all depends recipe inputs #7543

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 3 additions & 5 deletions .github/workflows/build-depends.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,9 +57,7 @@ jobs:
sparse-checkout: |
ci/dash
ci/test
depends/Makefile
depends/packages
depends/hosts
depends
contrib/containers/ci/ci.Dockerfile
contrib/containers/ci/ci-slim.Dockerfile
contrib/containers/guix/scripts/setup-sdk
Expand All @@ -75,9 +73,9 @@ jobs:
DEP_HASH="$(echo -n "${BUILD_TARGET}" "${DEP_OPTS}" "${HOST}" | sha256sum | head -c 64)"
echo "DEP_HASH=${DEP_HASH}" >> "${GITHUB_OUTPUT}"
DOCKERFILE_HASH="${{ hashFiles('contrib/containers/ci/ci.Dockerfile', 'contrib/containers/ci/ci-slim.Dockerfile') }}"
PACKAGES_HASH="${{ hashFiles('depends/packages/*', 'depends/Makefile') }}"
DEPENDS_INPUTS_HASH="${{ hashFiles('depends/Makefile', 'depends/funcs.mk', 'depends/gen_id', 'depends/config.guess', 'depends/config.sub', 'depends/config.site.in', 'depends/builders/**', 'depends/hosts/**', 'depends/packages/**', 'depends/patches/**') }}"
CACHE_KEY_PREFIX="depends-${DOCKERFILE_HASH}-${{ inputs.base-image-digest }}-${{ inputs.runs-on }}-${{ inputs.build-target }}"

@coderabbitai coderabbitai Bot Aug 4, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

workflow=".github/workflows/build-depends.yml"

echo "Workflow inputs and declarations:"
sed -n '1,45p' "$workflow"

echo
echo "Direct input interpolation:"
rg -n -C 3 '\$\{\{[[:space:]]*inputs\.(base-image-digest|runs-on|build-target)' "$workflow"

echo
echo "Callers and input sources:"
rg -n -C 6 'build-depends\.yml|base-image-digest|build-target|runs-on:' .github/workflows || true

Repository: dashpay/dash

Length of output: 50368

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

echo "build.yml inputs and caller snippet:"
sed -n '1,120p' .github/workflows/build.yml

echo
echo "All build-depends usages:"
rg -n -C 4 'uses: ./.github/workflows/build-depands\.yml|uses: \./\.github/workflows/build-depends\.yml|build-depends\.yml|base-image-digest:|runs-on:|build-target:' .github/workflows/build.yml .github/workflows/cache-depends-sources.yml .github/workflows/build-container.yml || true

Repository: dashpay/dash

Length of output: 30887

🌐 Web query:

GitHub Actions template injection inputs context in shell environment variable source documentation

💡 Result:

Template injection in GitHub Actions occurs when untrusted data—such as issue titles, pull request bodies, or branch names—is directly interpolated into a workflow's run command using the ${{ }} expression syntax [1][2][3]. Because the GitHub Actions runner evaluates these expressions and substitutes them with raw text before executing the shell script, an attacker can supply malicious input containing shell control characters (e.g., quotes, semicolons, or backticks) to break out of the intended command and execute arbitrary code on the runner [1][4][3]. The authoritative mitigation for this vulnerability is to never place untrusted input directly within a run script [5][6]. Instead, you should pass the input into the step's environment variables and then reference that variable within your script [5][2][7]. Recommended pattern: - name: Securely handle untrusted input env: # Set the untrusted input to an environment variable UNTRUSTED_INPUT: ${{ github.event.issue.title }} run: | # Reference the variable using standard shell syntax echo "The input is: $UNTRUSTED_INPUT" By storing the input in an environment variable, the value is treated as data rather than as part of the script's template, which prevents the shell from interpreting the content as executable commands [2][4][7]. Additionally, always use double quotes when referencing environment variables in shell scripts to prevent word splitting and other unexpected shell behaviors [2][6][7]. Other security best practices include: - Applying the principle of least privilege by restricting GITHUB_TOKEN permissions [6][8][3]. - Using static analysis tools like CodeQL to detect potential injection sinks in your workflow files [3]. - Treating all contexts that accept external input (e.g., github.event, inputs) as potentially malicious [1][5].

Citations:

Use output values instead of caller inputs in the shell script.

This reusable workflow receives inputs.* from the caller via workflow_call; passing them directly lets the caller supply shell metacharacters such as quotes, command substitution, or newlines in the generated Bash script. .github/workflows/build.yml already passes internal needs.check-skip.outputs.base-image-digest and needs.check-skip.outputs['runner-amd64'] values, so use those instead of .github/workflows/build.yml inputs in the shell source.

🧰 Tools
🪛 zizmor (1.28.0)

[error] 77-77: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)

[error] 77-77: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)

[error] 77-77: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/build-depends.yml at line 77, Update the CACHE_KEY_PREFIX
assignment in the build-depends workflow to use trusted internal output values
for the base-image digest and runner selection rather than interpolating
caller-provided workflow inputs into the Bash script; preserve the existing
build-target component and cache-key format.

Source: Linters/SAST tools

CACHE_KEY="${CACHE_KEY_PREFIX}-${DEP_HASH}-${PACKAGES_HASH}"
CACHE_KEY="${CACHE_KEY_PREFIX}-${DEP_HASH}-${DEPENDS_INPUTS_HASH}"
echo "cache-key-prefix=${CACHE_KEY_PREFIX}" >> "${GITHUB_OUTPUT}"
echo "cache-key=${CACHE_KEY}" >> "${GITHUB_OUTPUT}"
echo "Cache key: ${CACHE_KEY}"
Expand Down
Loading