ewilliams28/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-08-27 21:07:01 -06:00
Code Issues Packages Projects Releases Wiki Activity

fix(ci): bound opengrep installer downloads (#109089)

Browse Source 
* fix(ci): bound opengrep installer downloads

* test(ci): tighten opengrep installer guard

---------

Co-authored-by: Peter Steinberger <steipete@gmail.com>
This commit is contained in:
thomas.szbay
2026-07-17 14:17:45 +08:00
committed by GitHub
parent ea6ed38e20
commit 44ab167200
3 changed files with 37 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/opengrep-precise-full.yml
+7 -3
View File
@@ -38,9 +38,13 @@ jobs:
OPENGREP_VERSION: v1.22.0
OPENGREP_INSTALL_SHA: f458d7f0d52cc58eae1ca3cf3d5caf101e637519
run: |
curl -fsSL --connect-timeout 30 --max-time 120 \
"https://raw.githubusercontent.com/opengrep/opengrep/${OPENGREP_INSTALL_SHA}/install.sh" \
| bash -s -- -v "$OPENGREP_VERSION"
# Download first so a timed-out transfer cannot execute a partial installer.
installer="$(mktemp "${RUNNER_TEMP}/opengrep-install.XXXXXX")"
trap 'rm -f "$installer"' EXIT
curl -fsSL --connect-timeout 10 --max-time 120 \
-o "$installer" \
"https://raw.githubusercontent.com/opengrep/opengrep/${OPENGREP_INSTALL_SHA}/install.sh"
bash "$installer" -v "$OPENGREP_VERSION"
echo "$HOME/.opengrep/cli/latest" >> "$GITHUB_PATH"
- name: Verify opengrep
.github/workflows/opengrep-precise.yml
+7 -3
View File
@@ -64,9 +64,13 @@ jobs:
OPENGREP_VERSION: v1.22.0
OPENGREP_INSTALL_SHA: f458d7f0d52cc58eae1ca3cf3d5caf101e637519
run: |
curl -fsSL --connect-timeout 30 --max-time 120 \
"https://raw.githubusercontent.com/opengrep/opengrep/${OPENGREP_INSTALL_SHA}/install.sh" \
| bash -s -- -v "$OPENGREP_VERSION"
# Download first so a timed-out transfer cannot execute a partial installer.
installer="$(mktemp "${RUNNER_TEMP}/opengrep-install.XXXXXX")"
trap 'rm -f "$installer"' EXIT
curl -fsSL --connect-timeout 10 --max-time 120 \
-o "$installer" \
"https://raw.githubusercontent.com/opengrep/opengrep/${OPENGREP_INSTALL_SHA}/install.sh"
bash "$installer" -v "$OPENGREP_VERSION"
echo "$HOME/.opengrep/cli/latest" >> "$GITHUB_PATH"
- name: Verify opengrep
test/scripts/ci-workflow-guards.test.ts
+23 -7
View File
@@ -1670,6 +1670,29 @@ describe("ci workflow guards", () => {
}
});
it("downloads the opengrep installer completely before execution", () => {
for (const workflowPath of [OPENGREP_PR_DIFF_WORKFLOW, OPENGREP_FULL_WORKFLOW]) {
const workflow = parse(readFileSync(workflowPath, "utf8"));
const run = expectDefined(
workflow.jobs.scan.steps.find((step: WorkflowStep) => step.name === "Install opengrep")
?.run,
`Install opengrep step in ${workflowPath}`,
);
expect(run, workflowPath).toContain(
'installer="$(mktemp "${RUNNER_TEMP}/opengrep-install.XXXXXX")"',
);
expect(run, workflowPath).toContain("curl -fsSL --connect-timeout 10 --max-time 120 \\");
expect(run, workflowPath).toContain('-o "$installer"');
expect(run, workflowPath).toContain('bash "$installer" -v "$OPENGREP_VERSION"');
expect(run, workflowPath).toContain("trap 'rm -f \"$installer\"' EXIT");
expect(run.indexOf('-o "$installer"'), workflowPath).toBeLessThan(
run.indexOf('bash "$installer"'),
);
expect(run, workflowPath).not.toMatch(/\|\s*bash/u);
}
});
it("runs real behavior proof from the trusted workflow revision", () => {
const workflow = readRealBehaviorProofWorkflow();
const source = readFileSync(".github/workflows/real-behavior-proof.yml", "utf8");
@@ -4279,11 +4302,4 @@ printf '%s\n' "\${CURL_SUCCESS_IP:-203.0.113.7}"
'call.getFile().getRelativePath() = "extensions/codex/src/app-server/transport-websocket.ts"',
);
});
it("bounds Opengrep installer downloads with connect timeout", () => {
for (const path of [OPENGREP_PR_DIFF_WORKFLOW, OPENGREP_FULL_WORKFLOW]) {
const workflow = readFileSync(path, "utf8");
expect(workflow).toContain("curl -fsSL --connect-timeout 30 --max-time 120");
}
});
});