diff options
| author | Yuriy Andamasov <yuriy@vyos.io> | 2026-05-11 01:58:23 +0300 |
|---|---|---|
| committer | Yuriy Andamasov <yuriy@vyos.io> | 2026-05-11 01:58:23 +0300 |
| commit | 0685e742b125d49271de9a96f45042c79e963458 (patch) | |
| tree | 21d37deff0001fe48388620f6aa850e963aaac48 /.github/workflows | |
| parent | ac0b1e8d8ea866c0314d693443bf29b76f093822 (diff) | |
| download | vyos-documentation-0685e742b125d49271de9a96f45042c79e963458.tar.gz vyos-documentation-0685e742b125d49271de9a96f45042c79e963458.zip | |
ci: sanitize concurrency.group against arbitrary variant input
CodeRabbit review on #1962 flagged that concurrency.group is evaluated
at workflow scheduling time, BEFORE the shell-level allowlist case in
the job runs. An API-triggered workflow_dispatch with arbitrary variant
value (e.g. 'gh workflow run -f variant=foobar') would produce
concurrency key 'context7-refresh-foobar' and bypass dedupe with
legitimate runs.
Gate inputs.variant in the expression against the same allowlist
('rolling'/'1.5'/'1.4'). Map head_branch values to their canonical
variant names so the workflow_run path also resolves cleanly. Fall
through to 'invalid' if neither path matches — the shell allowlist
then fails the run loud.
🤖 Generated by [robots](https://vyos.io)
Diffstat (limited to '.github/workflows')
| -rw-r--r-- | .github/workflows/context7-refresh.yml | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/.github/workflows/context7-refresh.yml b/.github/workflows/context7-refresh.yml index 67ed7bd4..b21124d8 100644 --- a/.github/workflows/context7-refresh.yml +++ b/.github/workflows/context7-refresh.yml @@ -35,10 +35,11 @@ permissions: {} concurrency: group: >- context7-refresh-${{ - inputs.variant + (contains(fromJSON('["rolling","1.5","1.4"]'), inputs.variant) && inputs.variant) || (github.event.workflow_run.head_branch == 'circinus' && '1.5') || (github.event.workflow_run.head_branch == 'sagitta' && '1.4') - || github.event.workflow_run.head_branch + || (github.event.workflow_run.head_branch == 'rolling' && 'rolling') + || 'invalid' }} cancel-in-progress: true |