Skip to content

Add some debug output around version selection #40

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
wants to merge 3 commits into
base: main
Choose a base branch
from
Draft

Add some debug output around version selection #40

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
5b91740
Add more debug output
namespacebrian Jul 25, 2025
16415c7
Potential fix for code scanning alert no. 31: Code injection
namespacebrian Jul 25, 2025
346b5a2
Placate CodeQL
namespacebrian Jul 25, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
54 changes: 51 additions & 3 deletions action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,34 +15,82 @@
description: Disable session cache and force a new session to be initiated.
required: false
default: false
debug:
description: Enable debug output for version detection and download stages.
required: false
default: false

runs:
using: composite
steps:
- name: Set Terminus version
if: ${{ ! inputs.terminus-version }}
shell: bash
env:
DEBUG: ${{ inputs.debug }}
run: |
if [[ "$DEBUG" == "true" ]]; then
echo "::debug::Debug mode enabled for version detection"
echo "::debug::No terminus-version input provided, fetching latest release"
echo "::debug::Making API call to GitHub releases endpoint"
fi
TERMINUS_RELEASE=$(
curl --silent \
--header 'authorization: Bearer ${{ github.token }}' \
"https://api.github.com/repos/pantheon-systems/terminus/releases/latest" \
| perl -nle'print $& while m#"tag_name": "\K[^"]*#g'
)
if [[ "$DEBUG" == "true" ]]; then
echo "::debug::API response processed, extracted version: $TERMINUS_RELEASE"
echo "::debug::Setting TERMINUS_RELEASE environment variable to: $TERMINUS_RELEASE"
fi
echo "TERMINUS_RELEASE=$TERMINUS_RELEASE" >> $GITHUB_ENV
- name: Install Terminus
shell: bash
run: |
FINAL_VERSION="${{ inputs.terminus-version || env.TERMINUS_RELEASE }}"

Check warning

Code scanning / CodeQL

Code injection Medium

Potential code injection in
${ inputs.terminus-version || env.TERMINUS_RELEASE }
Loading
, which may be controlled by an external user.
Potential code injection in
${ inputs.terminus-version || env.TERMINUS_RELEASE }
Loading
, which may be controlled by an external user.

Copilot Autofix

AI 3 months ago

To fix the issue, we will:

  1. Assign the untrusted input (inputs.terminus-version || env.TERMINUS_RELEASE) to an intermediate environment variable.
  2. Use the shell's native syntax ($VARIABLE) to reference the environment variable in the script, instead of directly interpolating it with ${{ ... }}.
  3. Ensure that the input is sanitized or validated before use, if necessary.

This approach prevents direct interpolation of untrusted input into the shell script, mitigating the risk of code injection.

Suggested changeset 1
action.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/action.yml b/action.yml
--- a/action.yml
+++ b/action.yml
@@ -54,3 +54,3 @@
       run: |
-        FINAL_VERSION="${{ inputs.terminus-version || env.TERMINUS_RELEASE }}"
+        FINAL_VERSION="$TERMINUS_VERSION"
 
@@ -91,3 +91,3 @@
       env:
-        TERMINUS_RELEASE: ${{ inputs.terminus-version || env.TERMINUS_RELEASE }}
+        TERMINUS_VERSION: ${{ inputs.terminus-version || env.TERMINUS_RELEASE }}
         DEBUG: ${{ inputs.debug }}
EOF
@@ -54,3 +54,3 @@
run: |
FINAL_VERSION="${{ inputs.terminus-version || env.TERMINUS_RELEASE }}"
FINAL_VERSION="$TERMINUS_VERSION"

@@ -91,3 +91,3 @@
env:
TERMINUS_RELEASE: ${{ inputs.terminus-version || env.TERMINUS_RELEASE }}
TERMINUS_VERSION: ${{ inputs.terminus-version || env.TERMINUS_RELEASE }}
DEBUG: ${{ inputs.debug }}
Copilot is powered by AI and may make mistakes. Always verify output.
if [[ "$DEBUG" == "true" ]]; then
echo "::debug::Debug mode enabled for download stage"
if [[ -n "${{ inputs.terminus-version }}" ]]; then
echo "::debug::Using user-specified version: ${{ inputs.terminus-version }}"
else
echo "::debug::Using version from previous step: $TERMINUS_RELEASE"
fi
echo "::debug::Final version to install: $FINAL_VERSION"
echo "::debug::Creating installation directory: $HOME/terminus"
fi
mkdir $HOME/terminus && cd $HOME/terminus
echo "Installing Terminus v$TERMINUS_RELEASE"
curl -L https://github.com/pantheon-systems/terminus/releases/download/$TERMINUS_RELEASE/terminus.phar --output terminus
echo "Installing Terminus v$FINAL_VERSION"
if [[ "$DEBUG" == "true" ]]; then
echo "::debug::Download URL: https://github.com/pantheon-systems/terminus/releases/download/$FINAL_VERSION/terminus.phar"
echo "::debug::Starting download..."
fi
curl -L https://github.com/pantheon-systems/terminus/releases/download/$FINAL_VERSION/terminus.phar --output terminus
if [[ "$DEBUG" == "true" ]]; then
echo "::debug::Download completed, file size: $(ls -lh terminus | awk '{print $5}')"
echo "::debug::Making terminus executable..."
fi
chmod +x terminus
sudo ln -s $HOME/terminus/terminus /usr/local/bin/terminus
mkdir -p $HOME/.terminus/{cache,plugins}
if [[ "$DEBUG" == "true" ]]; then
echo "::debug::Installation complete, verifying..."
terminus --version || echo "::debug::Version check failed"
fi
env:
TERMINUS_RELEASE: ${{ inputs.terminus-version || env.TERMINUS_RELEASE }}

DEBUG: ${{ inputs.debug }}
- name: Set cache path, key, and restore-key
id: configure-cache
shell: bash
Expand Down