Open
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| - name: Create and push tag | ||
| run: | | ||
| # Use the tag name from the dispatch payload, or generate one | ||
| TAG_NAME="${{ github.event.client_payload.tag_name }}" |
Check failure
Code scanning / zizmor
code injection via template expansion Error
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
Contributor
Greptile SummaryThis PR adds a new GitHub Actions workflow ( Key changes:
Issues found:
Confidence Score: 4/5
Important Files Changed
Sequence DiagramsequenceDiagram
participant Caller as External Caller
participant GH as GitHub API
participant WF as build-edge-on-demand.yml
participant Repo as Git Repository
participant Deploy as deployment.yml
Caller->>GH: POST /repos/.../dispatches<br/>{event_type: "build-edge-on-demand",<br/>client_payload: {tag_name: "..."}}
GH->>WF: Trigger repository_dispatch
WF->>Repo: checkout main (via SSH deploy key)
WF->>WF: Resolve TAG_NAME<br/>(payload or nightly-latest-timestamp)
WF->>Repo: git tag TAG_NAME
WF->>Repo: git push origin TAG_NAME
Repo-->>Deploy: Tag push event triggers deployment workflow
Deploy->>Deploy: Build & push Docker images<br/>(EDGE_TAG=true if nightly-latest*)
WF-->>Caller: Slack alert on failure
Prompt To Fix All With AIThis is a comment left during a code review.
Path: .github/workflows/build-edge-on-demand.yml
Line: 36
Comment:
**Script injection via `client_payload.tag_name`**
`${{ github.event.client_payload.tag_name }}` is interpolated directly into the shell script. This is a classic GitHub Actions script-injection vector: any user who can trigger `repository_dispatch` (i.e., anyone with repo write access) can supply a crafted `tag_name` such as `foo"; malicious_command; echo "` and have it executed in the runner's shell.
The fix is to pass the payload value through an `env:` block so it is treated as a data variable and never interpolated into the script text:
```suggestion
TAG_NAME="${TAG_NAME_INPUT}"
```
Add a corresponding `env:` block to the step:
```yaml
env:
TAG_NAME_INPUT: ${{ github.event.client_payload.tag_name }}
```
This is the pattern recommended by GitHub's [security hardening guide](https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#understanding-the-risk-of-script-injections).
How can I resolve this? If you propose a fix, please make it concise.
---
This is a comment left during a code review.
Path: .github/workflows/build-edge-on-demand.yml
Line: 33-44
Comment:
**No duplicate tag guard**
Unlike `tag-nightly.yml`, this workflow has no check for an existing tag before calling `git tag "$TAG_NAME"`. If the same `tag_name` is dispatched twice (or if the auto-generated timestamp collides), `git tag` will exit non-zero and the push will never happen — the Slack alert will fire and the workflow will fail with a somewhat opaque error.
Consider adding a guard similar to the one in `tag-nightly.yml`:
```yaml
- name: Check for existing tag
id: check_tag
run: |
if git tag --list "$TAG_NAME" | grep -q .; then
echo "Tag $TAG_NAME already exists — skipping."
echo "tag_exists=true" >> "$GITHUB_OUTPUT"
else
echo "tag_exists=false" >> "$GITHUB_OUTPUT"
fi
```
Then gate the create/push steps on `steps.check_tag.outputs.tag_exists == 'false'`.
How can I resolve this? If you propose a fix, please make it concise.Reviews (1): Last reviewed commit: "chore(deploy): Build Edge on demand" | Re-trigger Greptile |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
| run: | | ||
| # Use the tag name from the dispatch payload, or generate one | ||
| TAG_NAME="${{ github.event.client_payload.tag_name }}" | ||
| if [ -z "$TAG_NAME" ]; then |
Contributor
There was a problem hiding this comment.
client_payload.tag_name
${{ github.event.client_payload.tag_name }} is interpolated directly into the shell script. This is a classic GitHub Actions script-injection vector: any user who can trigger repository_dispatch (i.e., anyone with repo write access) can supply a crafted tag_name such as foo"; malicious_command; echo " and have it executed in the runner's shell.
The fix is to pass the payload value through an env: block so it is treated as a data variable and never interpolated into the script text:
Suggested change
| if [ -z "$TAG_NAME" ]; then | |
| TAG_NAME="${TAG_NAME_INPUT}" |
Add a corresponding env: block to the step:
env:
TAG_NAME_INPUT: ${{ github.event.client_payload.tag_name }}This is the pattern recommended by GitHub's security hardening guide.
Prompt To Fix With AI
This is a comment left during a code review.
Path: .github/workflows/build-edge-on-demand.yml
Line: 36
Comment:
**Script injection via `client_payload.tag_name`**
`${{ github.event.client_payload.tag_name }}` is interpolated directly into the shell script. This is a classic GitHub Actions script-injection vector: any user who can trigger `repository_dispatch` (i.e., anyone with repo write access) can supply a crafted `tag_name` such as `foo"; malicious_command; echo "` and have it executed in the runner's shell.
The fix is to pass the payload value through an `env:` block so it is treated as a data variable and never interpolated into the script text:
```suggestion
TAG_NAME="${TAG_NAME_INPUT}"
```
Add a corresponding `env:` block to the step:
```yaml
env:
TAG_NAME_INPUT: ${{ github.event.client_payload.tag_name }}
```
This is the pattern recommended by GitHub's [security hardening guide](https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#understanding-the-risk-of-script-injections).
How can I resolve this? If you propose a fix, please make it concise.
Comment on lines
+33
to
+44
| run: | | ||
| # Use the tag name from the dispatch payload, or generate one | ||
| TAG_NAME="${{ github.event.client_payload.tag_name }}" | ||
| if [ -z "$TAG_NAME" ]; then | ||
| TAG_NAME="nightly-latest-$(date -u +'%Y%m%d-%H%M%S')" | ||
| fi | ||
| echo "Creating tag: $TAG_NAME" | ||
| git tag "$TAG_NAME" | ||
| git push origin "$TAG_NAME" | ||
| - name: Send Slack notification |
Contributor
There was a problem hiding this comment.
Unlike tag-nightly.yml, this workflow has no check for an existing tag before calling git tag "$TAG_NAME". If the same tag_name is dispatched twice (or if the auto-generated timestamp collides), git tag will exit non-zero and the push will never happen — the Slack alert will fire and the workflow will fail with a somewhat opaque error.
Consider adding a guard similar to the one in tag-nightly.yml:
- name: Check for existing tag
id: check_tag
run: |
if git tag --list "$TAG_NAME" | grep -q .; then
echo "Tag $TAG_NAME already exists — skipping."
echo "tag_exists=true" >> "$GITHUB_OUTPUT"
else
echo "tag_exists=false" >> "$GITHUB_OUTPUT"
fiThen gate the create/push steps on steps.check_tag.outputs.tag_exists == 'false'.
Prompt To Fix With AI
This is a comment left during a code review.
Path: .github/workflows/build-edge-on-demand.yml
Line: 33-44
Comment:
**No duplicate tag guard**
Unlike `tag-nightly.yml`, this workflow has no check for an existing tag before calling `git tag "$TAG_NAME"`. If the same `tag_name` is dispatched twice (or if the auto-generated timestamp collides), `git tag` will exit non-zero and the push will never happen — the Slack alert will fire and the workflow will fail with a somewhat opaque error.
Consider adding a guard similar to the one in `tag-nightly.yml`:
```yaml
- name: Check for existing tag
id: check_tag
run: |
if git tag --list "$TAG_NAME" | grep -q .; then
echo "Tag $TAG_NAME already exists — skipping."
echo "tag_exists=true" >> "$GITHUB_OUTPUT"
else
echo "tag_exists=false" >> "$GITHUB_OUTPUT"
fi
```
Then gate the create/push steps on `steps.check_tag.outputs.tag_exists == 'false'`.
How can I resolve this? If you propose a fix, please make it concise.
Contributor
🖼️ Visual Regression Report
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Building Edge Images on demand
How Has This Been Tested?
Additional Options
Summary by cubic
Adds a GitHub Actions workflow to trigger on-demand Edge image builds by pushing a tag to
main. This enables ad-hoc builds viarepository_dispatchwithout needing a PR or merge..github/workflows/build-edge-on-demand.ymllistens forrepository_dispatchtypebuild-edge-on-demand.client_payload.tag_nameor auto-generated asnightly-latest-YYYYMMDD-HHMMSS(UTC)../.github/actions/slack-notifyusingMONITOR_DEPLOYMENTS_WEBHOOK.Written for commit b8a5caf. Summary will update on new commits.