Skip to content

fix: sanitize absolute runner paths in generated schemas#602

Open
CWAbhi wants to merge 2 commits intomeshery:masterfrom
CWAbhi:new_branch
Open

fix: sanitize absolute runner paths in generated schemas#602
CWAbhi wants to merge 2 commits intomeshery:masterfrom
CWAbhi:new_branch

Conversation

@CWAbhi
Copy link
Copy Markdown

@CWAbhi CWAbhi commented Jan 28, 2026

Notes for Reviewers
This PR fixes #526
This PR addresses the issue of absolute environment paths being leaked into the repository during the automated type generation process. Currently, the GitHub Action runner’s local workspace path (e.g., /home/runner/work/...) is being captured by the generation tool and committed directly into the TypeScript schemas, such as SchemasOpenApiSchema.ts.

This causes unnecessary git noise and pollutes the codebase with environment-specific metadata that is irrelevant to other developers and production environments.

Changes

•Workflow Sanitization: Updated the generate-types workflow to include a post-generation cleanup step. This step dynamically identifies the $GITHUB_WORKSPACE and replaces it with a relative ./ path across all generated .ts files.

•Verification Gate: Added a validation check before the commit step. The CI will now scan for any remaining /home/runner strings and fail the build if a path leak is detected.

•Standardized Error Logging: Integrated a descriptive error moniker for the verification failure to align with the project's event-tracking framework.

  • [✅] Yes, I signed my commits.

Signed-off-by: Abhijeet Dey <dey20405@gmail.com>
@gemini-code-assist
Copy link
Copy Markdown
Contributor

Note

Gemini is unable to generate a summary for this pull request due to the file types involved not being currently supported.

@github-actions github-actions bot added the area/ci Continuous integration | Build and release label Jan 28, 2026
@CWAbhi
Copy link
Copy Markdown
Author

CWAbhi commented Feb 6, 2026

@leecalcote can you check this out . if it works i think we should close and merge this into schemas

Copy link
Copy Markdown
Member

@alphaX86 alphaX86 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi @CWAbhi, has this GH action been tested out and working in your forked copy of repo?

@hortison
Copy link
Copy Markdown
Contributor

hortison commented Feb 8, 2026

@CWAbhi did you address the primary concern of this path being included during mesheryctl docs builds in the meshery/meshery repo?

@CWAbhi
Copy link
Copy Markdown
Author

CWAbhi commented Feb 8, 2026

@hortison Yes, this PR directly addresses the root issue by sanitizing generated schema artifacts, preventing absolute paths from propagating into downstream consumers like mesheryctl docs builds in the meshery/meshery repo.

@CWAbhi CWAbhi requested a review from alphaX86 February 8, 2026 05:16
@alphaX86 alphaX86 requested review from a team, Revolyssup, hortison, jerensl and leecalcote and removed request for a team, Revolyssup, jerensl and leecalcote February 9, 2026 02:46
Copy link
Copy Markdown
Member

@alphaX86 alphaX86 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This may cause workflow to fail every time based on global grep cmd usage on checking paths...

@CWAbhi
Copy link
Copy Markdown
Author

CWAbhi commented Feb 9, 2026

@alphaX86 You’re right , a global recursive grep can cause false positives, especially since mesheryctl docs generation may legitimately include /home/runner paths.
We can scope the check to only the schema-generated files (or exclude docs/build directories) to ensure we only fail on unintended path leakage.
I can update the workflow to restrict the grep to specific artifact paths.

Signed-off-by: Abhijeet Dey <dey20405@gmail.com>
@CWAbhi
Copy link
Copy Markdown
Author

CWAbhi commented Feb 9, 2026

@alphaX86 I’ve updated the workflow to scope the /home/runner path check to schema-generated artifacts only.

@alphaX86
Copy link
Copy Markdown
Member

@lekaf974 @hortison would require your review here...

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area/ci Continuous integration | Build and release

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[CI] Stop committing SchemasOpenApiSchema.ts under /home/runner/...

3 participants