-
Notifications
You must be signed in to change notification settings - Fork 0
Initial implementation #1
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from all commits
4be539b
98b0006
ece8372
d77f9f9
aeead5b
30c1c85
a51c7a3
0bac956
5dfcd79
94392c0
62be29d
4249a09
e26e359
82fb5f2
d43fded
85a5d92
1fc29fa
12b7942
43c5009
1471730
629e6c4
b07b8f6
6d951b3
e53922c
7cd7d04
dfdb0a1
03cbac1
dad9a19
842991d
c8e2b1a
52076b1
21b3003
8ca43b5
6f80d6d
8f15483
85a9903
4892e52
a3a37f3
475c22f
ad4ac83
8dd8acd
61ec3ef
43fb859
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,46 @@ | ||
| name: Install flatc | ||
| description: Download and install a flatc binary for CI | ||
|
|
||
| inputs: | ||
| version: | ||
| description: FlatBuffers release version to install | ||
| required: true | ||
| sha256: | ||
| description: SHA-256 of the expected flatc archive | ||
| required: true | ||
|
|
||
| runs: | ||
| using: composite | ||
| steps: | ||
| - name: Download flatc | ||
| shell: bash | ||
| run: | | ||
| set -euo pipefail | ||
|
|
||
| mkdir -p flatbuffers-bin | ||
| asset="" | ||
| candidates=( | ||
| "Linux.flatc.binary.g++-13.zip" | ||
| "Linux.flatc.binary.clang++-18.zip" | ||
| ) | ||
|
|
||
| for candidate in "${candidates[@]}"; do | ||
| if curl --retry 5 --retry-delay 2 --retry-connrefused --connect-timeout 10 --max-time 120 -fsSL -o flatbuffers-bin/flatc.zip "https://github.com/google/flatbuffers/releases/download/v${{ inputs.version }}/${candidate}"; then | ||
| actual_sha256="$(sha256sum flatbuffers-bin/flatc.zip | awk '{print $1}')" | ||
| if [[ "${actual_sha256}" == "${{ inputs.sha256 }}" ]]; then | ||
| asset="${candidate}" | ||
| break | ||
| fi | ||
| rm -f flatbuffers-bin/flatc.zip | ||
| fi | ||
| done | ||
|
|
||
| if [[ -z "${asset}" ]]; then | ||
| echo "::error::failed to download flatc v${{ inputs.version }}; attempted assets: ${candidates[*]}" | ||
| exit 1 | ||
| fi | ||
|
|
||
| unzip -q flatbuffers-bin/flatc.zip -d flatbuffers-bin | ||
| chmod +x flatbuffers-bin/flatc | ||
| sudo install flatbuffers-bin/flatc /usr/local/bin/flatc | ||
|
Comment on lines
+27
to
+45
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
# Verify all call sites of this action provide version + sha256 once hardening is added.
rg -n -C3 'uses:\s*\./\.github/actions/install-flatc|version:|sha256:' .github/workflowsRepository: Pajn/Embers Length of output: 1706 🏁 Script executed: cat -n .github/actions/install-flatc/action.ymlRepository: Pajn/Embers Length of output: 1439 Add SHA-256 verification before installing The action downloads an executable archive (line 25) and installs it system-wide (line 38) without verifying integrity. This is a supply-chain risk in CI. Currently, no checksum or signature validation occurs before Add a required Proposed hardening inputs:
version:
description: FlatBuffers release version to install
required: true
+ sha256:
+ description: SHA-256 for the selected flatc zip asset
+ required: true
runs:
using: composite
steps:
- name: Download flatc
shell: bash
run: |
set -euo pipefail
mkdir -p flatbuffers-bin
asset=""
candidates=(
"Linux.flatc.binary.g++-13.zip"
"Linux.flatc.binary.clang++-18.zip"
)
for candidate in "${candidates[@]}"; do
if curl -fsSL -o flatbuffers-bin/flatc.zip "https://github.com/google/flatbuffers/releases/download/v${{ inputs.version }}/${candidate}"; then
asset="${candidate}"
break
fi
done
if [[ -z "${asset}" ]]; then
echo "::error::failed to download flatc v${{ inputs.version }}; attempted assets: ${candidates[*]}"
exit 1
fi
+ echo "${{ inputs.sha256 }} flatbuffers-bin/flatc.zip" | sha256sum -c -
+
unzip -q flatbuffers-bin/flatc.zip -d flatbuffers-binUpdate all three call sites in 🤖 Prompt for AI Agents |
||
| rm -rf flatbuffers-bin | ||
Uh oh!
There was an error while loading. Please reload this page.