ci(build_template): validate dump outputs are regular files before upload#39887
Open
adomani wants to merge 3 commits into
Open
ci(build_template): validate dump outputs are regular files before upload#39887adomani wants to merge 3 commits into
adomani wants to merge 3 commits into
Conversation
…load Defence in depth: if a future change to the dumper (or to any other step that touches the post-build cwd) lets PR-controlled code substitute one of the artifact files with a symlink to something sensitive on the runner, the existing `actions/upload-artifact` would follow it and pack the target's contents into the artifact. `actions/upload-artifact@v7` has no input to disable symlink following, so add an explicit guard that aborts the step if either expected output is a symlink or not a regular file. Today the attack vector isn't directly reachable — the dumper opens each output via `IO.FS.withFile … .write`, which truncate-writes through any pre-positioned symlink and so leaves the target with the real declaration data — but this guard documents the invariant and catches regressions if the dumper's I/O semantics ever change.
PR summary b8420f3544Import changes for modified filesNo significant changes to the import graph Import changes for all files
|
github-actions
Bot
added
the
CI
joneugster
reviewed
May 29, 2026
joneugster
added
the
awaiting-author
Co-authored-by: Jon Eugster <eugster.jon@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #39880, adding a check that artifacts produced in CI exist.