Skip to content

Conversation

@tundeaoni
Copy link
Contributor

No description provided.

@tundeaoni tundeaoni requested a review from a team as a code owner November 12, 2025 09:46
BUILD_REPO=${{ github.event.repository.name }}
BUILD_ID=${{ github.run_id }}
tags: ${{ steps.meta.outputs.tags }}
labels: ${{ steps.meta.outputs.labels }}

Check warning

Code scanning / CodeQL

Code injection Medium

Potential code injection in
${ inputs.context }
, which may be controlled by an external user.

Copilot Autofix

AI 2 months ago

To fix this code injection issue, you should avoid passing direct ${{ inputs.context }} expression syntax to the context: field. Instead, assign the user-controlled input to an environment variable within the respective job/step, and then refer to that environment variable using shell or action syntax that avoids possible injection issues. For third-party actions such as docker/build-push-action, the context parameter must either be interpolated safely or referenced via a shell environment variable. The recommended solution is to set CONTEXT: ${{ inputs.context }} as an environment variable at the job level, then refer to it in context: $CONTEXT (shell variable syntax) or whatever syntax is supported by the third-party action for environment variable interpolation. If the action doesn't automatically substitute env vars in its parameters, add a preceding step using run: to safely create and export the context or otherwise sanitize it. This change must be applied to both blocks using docker/build-push-action and the analogous block for useblacksmith/build-push-action.

Required changes:

  • Add an environment variable CONTEXT: ${{ inputs.context }} in the job's env: section.
  • Change the context: field in both relevant with-blocks to use $CONTEXT instead of ${{ inputs.context }}.
Suggested changeset 1
.github/workflows/docker.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -163,6 +163,7 @@
       DEPLOY_USER_SSH_KEY: ${{ secrets.deploy_user_ssh_key }}
       REPOSITORY: ${{ inputs.repository }}
       REPO: ${{ inputs.repo }}
+      CONTEXT: ${{ inputs.context }}
     outputs:
       image: ${{ steps.meta.outputs.tags }}
     steps:
@@ -275,7 +276,7 @@
         name: Build (and push) Docker image for thirparty runner
         uses: useblacksmith/build-push-action@v2
         with:
-          context: ${{ inputs.context }}
+          context: $CONTEXT
           push: ${{ inputs.push }}
           file: ${{ inputs.dockerfile }}
           secrets: ${{ secrets.build-secrets }}
@@ -296,7 +297,7 @@
         name: Build (and push) Docker image
         uses: docker/build-push-action@v5
         with:
-          context: ${{ inputs.context }}
+          context: $CONTEXT
           push: ${{ inputs.push }}
           file: ${{ inputs.dockerfile }}
           secrets: ${{ secrets.build-secrets }}
EOF
@@ -163,6 +163,7 @@
DEPLOY_USER_SSH_KEY: ${{ secrets.deploy_user_ssh_key }}
REPOSITORY: ${{ inputs.repository }}
REPO: ${{ inputs.repo }}
CONTEXT: ${{ inputs.context }}
outputs:
image: ${{ steps.meta.outputs.tags }}
steps:
@@ -275,7 +276,7 @@
name: Build (and push) Docker image for thirparty runner
uses: useblacksmith/build-push-action@v2
with:
context: ${{ inputs.context }}
context: $CONTEXT
push: ${{ inputs.push }}
file: ${{ inputs.dockerfile }}
secrets: ${{ secrets.build-secrets }}
@@ -296,7 +297,7 @@
name: Build (and push) Docker image
uses: docker/build-push-action@v5
with:
context: ${{ inputs.context }}
context: $CONTEXT
push: ${{ inputs.push }}
file: ${{ inputs.dockerfile }}
secrets: ${{ secrets.build-secrets }}
Copilot is powered by AI and may make mistakes. Always verify output.
@tundeaoni tundeaoni merged commit d1815b7 into main Nov 12, 2025
3 checks passed
@tundeaoni tundeaoni deleted the support-thirdparty-runner-input-toggle branch November 12, 2025 10:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

3 participants