From ce5130f39d780cdce87366ee657665f4a5d3051d Mon Sep 17 00:00:00 2001 From: Diogo Teles Sant'Anna Date: Mon, 12 Aug 2024 14:38:00 -0300 Subject: [PATCH] fix: github workflow vulnerable to script injection (#9331) Signed-off-by: Diogo Teles Sant'Anna --- .github/workflows/benchmarks.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/benchmarks.yml b/.github/workflows/benchmarks.yml index 886bcfbd548..72d748ecb74 100644 --- a/.github/workflows/benchmarks.yml +++ b/.github/workflows/benchmarks.yml @@ -5,6 +5,9 @@ on: types: [opened, reopened, synchronize, labeled] workflow_dispatch: +env: + PR_HEAD_LABEL: ${{ github.event.pull_request.head.label }} + jobs: benchmark: if: ${{ contains( github.event.pull_request.labels.*.name, 'run-benchmark') && github.event_name == 'pull_request' || github.event_name == 'workflow_dispatch' }} @@ -49,7 +52,7 @@ jobs: # ID this runner asv machine --yes echo "Baseline: ${{ github.event.pull_request.base.sha }} (${{ github.event.pull_request.base.label }})" - echo "Contender: ${GITHUB_SHA} (${{ github.event.pull_request.head.label }})" + echo "Contender: ${GITHUB_SHA} ($PR_HEAD_LABEL)" # Run benchmarks for current commit against base ASV_OPTIONS="--split --show-stderr --factor $ASV_FACTOR" asv continuous $ASV_OPTIONS ${{ github.event.pull_request.base.sha }} ${GITHUB_SHA} \