eu07/maszyna
16
0
Fork 0
mirror of https://github.com/MaSzyna-EU07/maszyna.git synced 2026-07-22 16:19:19 +02:00
Code Issues 123 Wiki Activity

ci: remove potential script injection

Browse Source
This commit is contained in:
jerrrrycho
2026-07-19 14:20:30 +02:00
parent f3881a2432
commit ad88bf76d3
1 changed files with 12 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
.github/workflows/build.yml vendored
View File

@@ -12,13 +12,14 @@ on:
pull_request: pull_request:
types: [ opened, reopened, synchronize ] types: [ opened, reopened, synchronize ]
permissions: permissions: {}
contents: read
jobs: jobs:
build: build:
name: Build under Build Wrapper name: Build under Build Wrapper
runs-on: ubuntu-24.04 runs-on: ubuntu-24.04
permissions:
contents: read
env: env:
BUILD_WRAPPER_OUT_DIR: bw-output BUILD_WRAPPER_OUT_DIR: bw-output
steps: steps:
@@ -80,14 +81,17 @@ jobs:
# Metadata the trusted workflow needs to identify the PR. # Metadata the trusted workflow needs to identify the PR.
# Treated as UNVERIFIED input there and re-checked against the API. # Treated as UNVERIFIED input there and re-checked against the API.
- name: Record event metadata - name: Record event metadata
env:
EVENT_NAME: ${{ github.event_name }}
PR_NUMBER: ${{ github.event.pull_request.number }}
PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
COMMIT_SHA: ${{ github.sha }}
run: | run: |
mkdir -p .sonar-meta mkdir -p .sonar-meta
echo "${{ github.event_name }}" > .sonar-meta/event printf '%s\n' "$EVENT_NAME" > .sonar-meta/event
echo "${{ github.event.pull_request.number }}" > .sonar-meta/pr_number printf '%s\n' "$PR_NUMBER" > .sonar-meta/pr_number
echo "${{ github.event.pull_request.head.sha }}" > .sonar-meta/head_sha printf '%s\n' "$PR_HEAD_SHA" > .sonar-meta/head_sha
echo "${{ github.event.pull_request.base.ref }}" > .sonar-meta/base_ref printf '%s\n' "$COMMIT_SHA" > .sonar-meta/sha
echo "${{ github.event.pull_request.head.ref }}" > .sonar-meta/head_ref
echo "${{ github.sha }}" > .sonar-meta/sha
# The C/C++ analyzer needs the sources AND the build-wrapper output. # The C/C++ analyzer needs the sources AND the build-wrapper output.
# compile_commands.json holds absolute paths, so the trusted workflow must # compile_commands.json holds absolute paths, so the trusted workflow must