Visitar URL original
verify-action-build: detect shell-variable binary downloads by potiuk · Pull Request #1368 · apache/infrastructure-actions · GitHub
Skip to content

verify-action-build: detect shell-variable binary downloads - #1368

Closed
potiuk wants to merge 2 commits into
apache:mainfrom
potiuk:agents/verify-action-build-shell-variable-downloads
Closed

potiuk wants to merge 2 commits into
apache:mainfrom
potiuk:agents/verify-action-build-shell-variable-downloads

Conversation

@potiuk

@potiuk potiuk commented Oct 7, 2026

Copy link
Copy Markdown
Member

Code change

Summary

  • Track shell URL variables that target known binary or release paths, so downloader uses cannot bypass verification.
  • Add regression coverage for a dynamically composed release URL.
  • Addresses the verifier gap found while investigating Approve GitHub Actions for endersonmenezes/free-disk-space@v4 #1272; it does not add the requested action to the allowlist.

Type of change

  • New utility or action
  • Bug fix
  • Enhancement to existing code
  • Workflow or CI change
  • Documentation update
  • Other

Testing

  • uv run --project utils python -m compileall -q utils/verify_action_build — passed.
  • uv run --project utils --with pytest pytest utils/tests/verify_action_build -q — 360 passed.
  • prek run --all-files — passed.
  • git diff --check — passed.

Drafted-by: Copilot SDK in VS Code (no human review before posting)

Follow release URLs assigned to shell variables so runtime downloads cannot bypass checksum detection.

Generated-by: Copilot SDK in VS Code
@potiuk

potiuk commented Oct 8, 2026

Copy link
Copy Markdown
Member Author

Closing: #1312 already covers the shell-variable download case, and the stash/save version-comment fix is already on main.


Drafted-by: GitHub Copilot (AI assistant in VS Code); reviewed by @potiuk before posting

@potiuk potiuk closed this Oct 8, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant