Templating 8.2

[Peter-Sh]

This includes all workflow changes from unstable, fixes and templating from #503 for release/8.2

[jit-ci]

🛡️ Jit Security Scan Results

🚨 Summary

• Multiple shell injection vulnerabilities detected in GitHub Actions workflows

• High severity issues found in critical CI/CD pipeline components

• Potential for unauthorized code execution and secret exposure

🔍 Findings

HIGH - 4 findings

1. Shell Injection in GitHub Actions Workflow

ID	Type	Finding	File	Severity
9307e98b71	yaml.github-actions.security.run-shell-injection.run-shell-injection	Shell Injection in GitHub Actions Workflow - Variable interpolation with github context data in a run step could allow code injection. This may lead to unauthorized access to secrets and code.	.github/actions/create-image-labels/action.yml (lines 39-57)	HIGH

🔍 AI Analysis: This vulnerability is in a GitHub Actions workflow, which is a critical part of the CI/CD pipeline and could lead to unauthorized code execution.

Remediation:

- run: |
-   get_module_version() {
-     local module="$1"
-     grep MODULE_VERSIO
+ env:
+   MODULE_NAME: ${{ inputs.module_name }}
+ run: |
+   get_module_version() {
+     local module="$MODULE_NAME"
+     grep MODULE_VERSIO

2. Shell Injection in Build and Tag Action

ID	Type	Finding	File	Severity
6b680ea40c	yaml.github-actions.security.run-shell-injection.run-shell-injection	Shell Injection in Build and Tag Action - Unsafe use of github context data in a run step could allow code injection. This may compromise the build process and expose sensitive information.	.github/actions/build-and-tag-locally/action.yml (lines 158-196)	HIGH

🔍 AI Analysis: This vulnerability is in a critical build and tag action, which could lead to compromised builds and potential exposure of sensitive build information.

Remediation:

- run: |
-   mkdir -p /tmp/build-logs
-   echo "Build failed for ${{ inputs.distributio
+ env:
+   DISTRIBUTION: ${{ inputs.distribution }}
+   PLATFORM: ${{ inputs.platform }}
+ run: |
+   mkdir -p /tmp/build-logs
+   echo "Build failed for $DISTRIBUTION on $PLATFORM"

3. Shell Injection in Release Publish Workflow

ID	Type	Finding	File	Severity
ea580111cb	yaml.github-actions.security.run-shell-injection.run-shell-injection	Shell Injection in Release Publish Workflow - Unsafe use of github context data in a run step could allow code injection. This may compromise the release process and expose sensitive release information.	.github/workflows/release_publish.yml (lines 209-231)	HIGH

🔍 AI Analysis: This vulnerability is in the release publish workflow, which is a critical part of the software delivery process and could lead to compromised releases.

Remediation:

- run: |
-   # Create release_info.json with all fields, then filter out empty ones
+ env:
+   GITHUB_REF: ${{ github.ref }}
+   GITHUB_SHA: ${{ github.sha }}
+ run: |
+   # Create release_info.json with all fields, then filter out empty ones
+   # Use $GITHUB_REF and $GITHUB_SHA instead of direct github context

4. Shell Injection in Build and Tag Action (Format Registry Tag)

ID	Type	Finding	File	Severity
53fe71bffb	yaml.github-actions.security.run-shell-injection.run-shell-injection	Shell Injection in Build and Tag Action (Format Registry Tag) - Unsafe use of github context data in a run step could allow code injection. This may compromise the image tagging process and lead to incorrectly tagged images.	.github/actions/build-and-tag-locally/action.yml (lines 339-358)	HIGH

🔍 AI Analysis: This vulnerability is in the image tagging process, which is crucial for proper image identification and could lead to misidentified or compromised images if exploited.

Remediation:

- run: |
-   if [[ "${{ inputs.run_type }}" == "release" ]]; then
-     tag_prefix="${{ 
+ env:
+   RUN_TYPE: ${{ inputs.run_type }}
+   RELEASE_TAG: ${{ inputs.release_tag }}
+ run: |
+   if [[ "$RUN_TYPE" == "release" ]]; then
+     tag_prefix="$RELEASE_TAG"

▶️ Advanced Options

Help section with supported ignore actions and syntax.

Need to ignore a finding? Use commands like:

@sera ignore <finding_id> reason:accepted (reason is optional)

@sera ignore all reason:other - this is a test PR (reason is optional)

@sera ignore type:run-shell-injection

---

^{Security scan by Jit}