Merge pull request #37 from tony-josi-aws/main_app_sec_fix

main: Follow security guidelines with github actions
FreeRTOS · Nov 14, 2024 · 6b30104 · 6b30104
2 parents 8d95796 + 32cb580
commit 6b30104
Showing 1 changed file with 22 additions and 10 deletions.
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -24,17 +24,25 @@ jobs:
             git config --global user.name ${{ github.actor }}
             git config --global user.email ${{ github.actor }}@users.noreply.github.com
       - name: create a new branch that references commit id
-        run: git checkout -b ${{ github.event.inputs.version_number }} ${{ github.event.inputs.commit_id }}
+        env:
+          VERSION_NUMBER: ${{ github.event.inputs.version_number }}
+          COMMIT_ID: ${{ github.event.inputs.commit_id }}
+        run: git checkout -b "$VERSION_NUMBER" "$COMMIT_ID"
       - name: Tag Commit and Push to remote
+        env:
+          VERSION_NUMBER: ${{ github.event.inputs.version_number }}
         run: |
-          git tag ${{ github.event.inputs.version_number }} -a -m "Release ${{ github.event.inputs.version_number }}"
+          git tag "$VERSION_NUMBER" -a -m "Release "$VERSION_NUMBER""
           git push origin --tags
       - name: Verify tag on remote
+        env:
+          VERSION_NUMBER: ${{ github.event.inputs.version_number }}
+          COMMIT_ID: ${{ github.event.inputs.commit_id }}
         run: |
-          git tag -d ${{ github.event.inputs.version_number }}
+          git tag -d "$VERSION_NUMBER"
           git remote update
-          git checkout tags/${{ github.event.inputs.version_number }}
-          git diff ${{ github.event.inputs.commit_id }} tags/${{ github.event.inputs.version_number }}
+          git checkout tags/"$VERSION_NUMBER"
+          git diff "$COMMIT_ID" tags/"$VERSION_NUMBER"
   create-zip:
     needs: tag-commit
     name: Create ZIP and verify package for release asset.
@@ -53,17 +61,21 @@ jobs:
           cd FreeRTOS-LTS
           git submodule update --init --checkout --recursive
       - name: Create ZIP
+        env:
+          VERSION_NUMBER: ${{ github.event.inputs.version_number }}
         run: |
-          zip -r FreeRTOSv${{ github.event.inputs.version_number }}.zip FreeRTOS-LTS -x "*.git*"
+          zip -r FreeRTOSv"$VERSION_NUMBER".zip FreeRTOS-LTS -x "*.git*"
           ls ./
       - name: Validate created ZIP
+        env:
+          VERSION_NUMBER: ${{ github.event.inputs.version_number }}
         run: |
           mkdir zip-check
-          mv FreeRTOSv${{ github.event.inputs.version_number }}.zip zip-check
+          mv FreeRTOSv"$VERSION_NUMBER".zip zip-check
           cd zip-check
-          unzip FreeRTOSv${{ github.event.inputs.version_number }}.zip -d FreeRTOSv${{ github.event.inputs.version_number }}
-          ls FreeRTOSv${{ github.event.inputs.version_number }}
-          diff -r -x "*.git*" FreeRTOSv${{ github.event.inputs.version_number }}/FreeRTOS-LTS/ ../FreeRTOS-LTS/
+          unzip FreeRTOSv"$VERSION_NUMBER".zip -d FreeRTOSv"$VERSION_NUMBER"
+          ls FreeRTOSv"$VERSION_NUMBER"
+          diff -r -x "*.git*" FreeRTOSv"$VERSION_NUMBER"/FreeRTOS-LTS/ ../FreeRTOS-LTS/
       - name: Create artifact of ZIP
         uses: actions/upload-artifact@v2
         with: