pipeline to build tutorial agents #163
Conversation
![semgrep-app[bot]](https://avatars.githubusercontent.com/in/60555?s=60&v=4){kind=small}
| run: | | ||
| IMAGE_NAME="${{ steps.image-name.outputs.image_name }}" | ||
| agentex agents build \ | ||
| --manifest "${{ inputs.agent_path }}/manifest.yaml" \ | ||
| --registry "${REGISTRY}" \ | ||
| --tag "${{ IMAGE_NAME }}" \ | ||
| --platforms "linux/amd64" \ | ||
| --repository-name "${REPOSITORY}" \ | ||
| --push | ||
| echo "Successfully built and pushed: ${REGISTRY}/${REPOSITORY}:$IMAGE_NAME" | ||
| echo "### Build Complete" >> $GITHUB_STEP_SUMMARY |
There was a problem hiding this comment.
Using variable interpolation ${{...}} with github context data in a run: step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. github context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with env: to store the data and use the environment variable in the run: script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".
🍰 Fixed in commit a3bb2ff 🍰
| run: | | ||
| # Remove examples/tutorials/ prefix and replace / with - | ||
| AGENT_NAME=$(echo "${{ inputs.agent_path }}" | sed 's|^examples/tutorials/||' | sed 's|/|-|g') | ||
| IMAGE_NAME="${AGENT_NAME}-${{ inputs.version_tag }}" | ||
| echo "IMAGE_NAME=$IMAGE_NAME" >> $GITHUB_ENV | ||
| echo "image_name=$IMAGE_NAME" >> $GITHUB_OUTPUT | ||
| echo "Image name set to $IMAGE_NAME" | ||
There was a problem hiding this comment.
Using variable interpolation ${{...}} with github context data in a run: step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. github context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with env: to store the data and use the environment variable in the run: script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".
⭐ Fixed in commit 4cdea1a ⭐
| run: | | ||
| if [ ! -f "${{ inputs.agent_path }}/manifest.yaml" ]; then | ||
| echo "❌ Error: manifest.yaml not found in '${{ inputs.agent_path }}'" | ||
| exit 1 | ||
| fi | ||
| echo "✅ manifest.yaml found" | ||
| echo "### Validation Summary" >> $GITHUB_STEP_SUMMARY | ||
| echo "- **Agent Path**: ${{ inputs.agent_path }}" >> $GITHUB_STEP_SUMMARY | ||
| echo "- **Version Tag**: ${{ inputs.version_tag }}" >> $GITHUB_STEP_SUMMARY | ||
| echo "- **Status**: ✅ Validation passed" >> $GITHUB_STEP_SUMMARY | ||
There was a problem hiding this comment.
Semgrep identified an issue in your code:
Using variable interpolation ${{...}} with github context data in a run: step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. github context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with env: to store the data and use the environment variable in the run: script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".
To resolve this comment:
🔧 No guidance has been designated for this issue. Fix according to your organization's approved methods.
💬 Ignore this finding
Reply with Semgrep commands to ignore this finding.
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by run-shell-injection.
You can view more details about this finding in the Semgrep AppSec Platform.
| run: | | ||
| if [ ! -d "${{ inputs.agent_path }}" ]; then | ||
| echo "❌ Error: Agent path '${{ inputs.agent_path }}' does not exist" | ||
| exit 1 | ||
| fi | ||
| echo "✅ Agent path verified: ${{ inputs.agent_path }}" | ||
There was a problem hiding this comment.
Semgrep identified an issue in your code:
Using variable interpolation ${{...}} with github context data in a run: step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. github context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with env: to store the data and use the environment variable in the run: script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".
To resolve this comment:
🔧 No guidance has been designated for this issue. Fix according to your organization's approved methods.
💬 Ignore this finding
Reply with Semgrep commands to ignore this finding.
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by run-shell-injection.
You can view more details about this finding in the Semgrep AppSec Platform.
RoxyFarhad
force-pushed
the
add-workflow-to-build-tutorial-agents
branch
from
686e19a to
a3bb2ff
Compare
| run: | | ||
| IMAGE_NAME="${{ steps.image-name.outputs.image_name }}" | ||
| agentex agents build \ | ||
| --manifest "${{ inputs.agent_path }}/manifest.yaml" \ | ||
| --registry "${REGISTRY}" \ | ||
| --tag "${IMAGE_NAME}" \ | ||
| --platforms "linux/amd64" \ | ||
| --repository-name "${REPOSITORY}" \ | ||
| --push | ||
| echo "Successfully built and pushed: ${REGISTRY}/${REPOSITORY}:$IMAGE_NAME" | ||
| echo "### Build Complete" >> $GITHUB_STEP_SUMMARY |
There was a problem hiding this comment.
Using variable interpolation ${{...}} with github context data in a run: step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. github context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with env: to store the data and use the environment variable in the run: script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".
🥳 Fixed in commit 4cdea1a 🥳
RoxyFarhad
force-pushed
the
add-workflow-to-build-tutorial-agents
branch
from
a3bb2ff to
5772cc5
Compare
RoxyFarhad
force-pushed
the
add-workflow-to-build-tutorial-agents
branch
from
5772cc5 to
4cdea1a
Compare
| run: | | ||
| AGENT_NAME="${{ steps.image-name.outputs.agent_name }}" | ||
| VERSION_TAG="${{ inputs.version_tag }}" | ||
| REPOSITORY_NAME="${REPOSITORY_PREFIX}/${AGENT_NAME}" | ||
| FULL_IMAGE="${REGISTRY}/${REPOSITORY_NAME}:${VERSION_TAG}" | ||
| agentex agents build \ | ||
| --manifest "${{ inputs.agent_path }}/manifest.yaml" \ | ||
| --registry "${REGISTRY}" \ | ||
| --tag "${VERSION_TAG}" \ | ||
| --platforms "linux/amd64" \ | ||
| --repository-name "${REPOSITORY_NAME}" \ | ||
| --push | ||
| echo "Successfully built and pushed: ${FULL_IMAGE}" | ||
| echo "### Build Complete" >> $GITHUB_STEP_SUMMARY | ||
| echo "- **Image**: \`${FULL_IMAGE}\`" >> $GITHUB_STEP_SUMMARY |
There was a problem hiding this comment.
Using variable interpolation ${{...}} with github context data in a run: step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. github context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with env: to store the data and use the environment variable in the run: script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".
🥳 Fixed in commit 0f38f51 🥳
| run: | | ||
| # Remove examples/tutorials/ prefix and replace / with - | ||
| AGENT_NAME=$(echo "${{ inputs.agent_path }}" | sed 's|^examples/tutorials/||' | sed 's|/|-|g') | ||
| echo "AGENT_NAME=$AGENT_NAME" >> $GITHUB_ENV | ||
| echo "agent_name=$AGENT_NAME" >> $GITHUB_OUTPUT | ||
| echo "Agent name set to $AGENT_NAME" | ||
There was a problem hiding this comment.
Semgrep identified an issue in your code:
Using variable interpolation ${{...}} with github context data in a run: step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. github context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with env: to store the data and use the environment variable in the run: script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".
To resolve this comment:
🔧 No guidance has been designated for this issue. Fix according to your organization's approved methods.
💬 Ignore this finding
Reply with Semgrep commands to ignore this finding.
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by run-shell-injection.
You can view more details about this finding in the Semgrep AppSec Platform.
| run: | | ||
| AGENT_NAME="${{ steps.image-name.outputs.agent_name }}" | ||
| VERSION_TAG="${{ inputs.version_tag }}" | ||
| REPOSITORY_NAME="${{ github.repository }}/tutorial-agents/${AGENT_NAME}" | ||
| FULL_IMAGE="${REGISTRY}/${REPOSITORY_NAME}:${VERSION_TAG}" | ||
| agentex agents build \ | ||
| --manifest "${{ inputs.agent_path }}/manifest.yaml" \ | ||
| --registry "${REGISTRY}" \ | ||
| --tag "${VERSION_TAG}" \ | ||
| --platforms "linux/amd64" \ | ||
| --repository-name "${REPOSITORY_NAME}" \ | ||
| --push | ||
| echo "Successfully built and pushed: ${FULL_IMAGE}" | ||
| echo "### Build Complete" >> $GITHUB_STEP_SUMMARY | ||
| echo "- **Image**: \`${FULL_IMAGE}\`" >> $GITHUB_STEP_SUMMARY |
There was a problem hiding this comment.
Semgrep identified an issue in your code:
Using variable interpolation ${{...}} with github context data in a run: step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. github context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with env: to store the data and use the environment variable in the run: script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".
To resolve this comment:
🔧 No guidance has been designated for this issue. Fix according to your organization's approved methods.
💬 Ignore this finding
Reply with Semgrep commands to ignore this finding.
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by run-shell-injection.
You can view more details about this finding in the Semgrep AppSec Platform.
RoxyFarhad
force-pushed
the
add-workflow-to-build-tutorial-agents
branch
2 times, most recently
from
5c57f80 to
50bdc71
Compare
RoxyFarhad
force-pushed
the
add-workflow-to-build-tutorial-agents
branch
from
50bdc71 to
b0eb068
Compare
This is part of a larger workflow build and push a new agent image