Skip to content

ci(Windows): Bump microsoft/setup-msbuild to address security vulnerability#247

Merged
tido64 merged 1 commit into
masterfrom
tido/ci-windows
Nov 19, 2020
Merged

ci(Windows): Bump microsoft/setup-msbuild to address security vulnerability#247
tido64 merged 1 commit into
masterfrom
tido/ci-windows

Conversation

@tido64
Copy link
Copy Markdown
Member

@tido64 tido64 commented Nov 18, 2020

Description

Windows CI is failing due to a security vulnerability in the add-path command used by microsoft/setup-msbuild. This is addressed in the latest version.

Run microsoft/setup-msbuild@v1.0.1
  with:
C:\ProgramData\Chocolatey\bin\vswhere.exe -products * -requires Microsoft.Component.MSBuild -property installationPath -latest
C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise
Error: Unable to process command '::add-path::C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\MSBuild\Current\Bin' successfully.
Error: The `add-path` command is disabled. Please upgrade to using Environment Files or opt into unsecure command execution by setting the `ACTIONS_ALLOW_UNSECURE_COMMANDS` environment variable to `true`. For more information see: https://github.blog/changelog/2020-10-01-github-actions-deprecating-set-env-and-add-path-commands/

This is currently blocking #246 from getting merged.

Platforms affected

  • Android
  • iOS
  • macOS
  • Windows

Test plan

Windows CI should succeed.

@tido64 tido64 merged commit 130f10f into master Nov 19, 2020
@tido64 tido64 deleted the tido/ci-windows branch November 19, 2020 09:46
@tido64
Copy link
Copy Markdown
Member Author

tido64 commented Nov 23, 2020

🎉 This PR is included in version 0.3.0 🎉

The release is available on:

Your semantic-release bot 📦🚀

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants