diff options
| author | Yuriy Andamasov <yuriy@vyos.io> | 2026-05-11 01:02:47 +0300 |
|---|---|---|
| committer | Yuriy Andamasov <yuriy@vyos.io> | 2026-05-11 01:02:47 +0300 |
| commit | ac0b1e8d8ea866c0314d693443bf29b76f093822 (patch) | |
| tree | 04fbaed99011b52626bcbc8ed02659f00b0aed76 /.github | |
| parent | 1354267a5bf571fb61d8ddbeee1992fb0f430790 (diff) | |
| download | vyos-documentation-ac0b1e8d8ea866c0314d693443bf29b76f093822.tar.gz vyos-documentation-ac0b1e8d8ea866c0314d693443bf29b76f093822.zip | |
ci: validate workflow_dispatch variant input against allowlist
Copilot review on #1962 flagged that the type:choice UI constraint on
workflow_dispatch.inputs.variant is bypassable when invoked via API
(gh workflow run -f variant=…). An empty or arbitrary value would:
- Generate a malformed concurrency key (context7-refresh- with empty
suffix, since inputs.variant || head_branch || '' both go falsy)
- Pass garbage to Context7's API (404s gracefully, but still a wasted
runner minute and noisy)
Add an explicit allowlist case after VARIANT is computed. Fails loud
with a clear message before any downstream call.
🤖 Generated by [robots](https://vyos.io)
Diffstat (limited to '.github')
| -rw-r--r-- | .github/workflows/context7-refresh.yml | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/.github/workflows/context7-refresh.yml b/.github/workflows/context7-refresh.yml index 67a51cca..67ed7bd4 100644 --- a/.github/workflows/context7-refresh.yml +++ b/.github/workflows/context7-refresh.yml @@ -72,6 +72,12 @@ jobs: *) echo "Unexpected head_branch: $HEAD_BRANCH" >&2; exit 1 ;; esac fi + # Defense-in-depth: type:choice UI constraint is bypassable when + # workflow_dispatch is invoked via API (`gh workflow run -f variant=…`). + case "$VARIANT" in + rolling|1.5|1.4) ;; + *) echo "Invalid variant: '${VARIANT}'. Expected one of: rolling, 1.5, 1.4." >&2; exit 1 ;; + esac echo "Refreshing Context7 variant: $VARIANT" # rolling = default variant (no field). 1.5/1.4 = tag-backed. if [[ "$VARIANT" == "rolling" ]]; then |