Quality hardening: shell safety, injection hardening, functional fixes

.github/workflows/main-version-update.yml

@@ -25,6 +25,11 @@ jobs:
         git config user.name flipp-bot
         git config user.email flipp-bot@flipp.com
     - name: Tag new target
-      run: git tag -f ${{ github.event.inputs.major_version }} ${{ github.event.inputs.target }}
+      env:
+        MAJOR_VERSION: ${{ github.event.inputs.major_version }}
+        TARGET_REF: ${{ github.event.inputs.target }}
+      run: git tag -f "$MAJOR_VERSION" "$TARGET_REF"
     - name: Push new tag
-      run: git push origin ${{ github.event.inputs.major_version }} --force
+      env:
+        MAJOR_VERSION: ${{ github.event.inputs.major_version }}
+      run: git push origin "$MAJOR_VERSION" --force

.github/workflows/test.yml

@@ -28,4 +28,4 @@ jobs:
     - uses: actions/checkout@v6
     - uses: ./
       with:
-        milliseconds: 1000
+        job_status: ${{ job.status }}

common/branch-info/action.yml

@@ -15,11 +15,15 @@ runs:
     - name: Set branch variable
       id: set-branch
       shell: bash
+      env:
+        EVENT_NAME: ${{ github.event_name }}
+        PR_HEAD_REF: ${{ github.event.pull_request.head.ref }}
+        GIT_REF: ${{ github.ref }}
       run: |
-        if [ "${{ github.event_name }}" == "pull_request" ]; then
-          branch="${{ github.event.pull_request.head.ref }}"
+        if [ "$EVENT_NAME" == "pull_request" ]; then
+          branch="$PR_HEAD_REF"
         else
-          branch="${{ github.ref }}"
+          branch="$GIT_REF"
           branch="${branch#refs/heads/}"
         fi
         echo "branch=${branch}" >> $GITHUB_OUTPUT

deploy/eks/action.yml

@@ -45,8 +45,12 @@ runs:
       uses: wishabi/github-actions/common/branch-info@v0
     - name: Validate AWS credentials input
       shell: bash
+      env:
+        AWS_ROLE_ARN_INPUT: ${{ inputs.AWS_ROLE_ARN }}
+        AWS_ACCESS_KEY_ID_INPUT: ${{ inputs.AWS_ACCESS_KEY_ID }}
+        AWS_SECRET_ACCESS_KEY_INPUT: ${{ inputs.AWS_SECRET_ACCESS_KEY }}
       run: |
-        if [ -z "${{ inputs.AWS_ROLE_ARN }}" ] && { [ -z "${{ inputs.AWS_ACCESS_KEY_ID }}" ] || [ -z "${{ inputs.AWS_SECRET_ACCESS_KEY }}" ]; }; then
+        if [ -z "$AWS_ROLE_ARN_INPUT" ] && { [ -z "$AWS_ACCESS_KEY_ID_INPUT" ] || [ -z "$AWS_SECRET_ACCESS_KEY_INPUT" ]; }; then
           echo "::error::Either AWS_ROLE_ARN (IAM auth) or both AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY (static auth) must be provided."
           exit 1
         fi
@@ -67,26 +71,31 @@ runs:
     - name: Cleaning workspace
       if: ${{ inputs.CLEAN_WORKSPACE == 'true' }}
       shell: bash
-      run: shopt -s dotglob && rm -rf "${{ github.workspace }}"/*
+      run: shopt -s dotglob && rm -rf "$GITHUB_WORKSPACE"/*
     - name: Restoring workspace from cache
       uses: wishabi/github-actions/cache@v0
     - name: Deploying to EKS via Helm release
       shell: bash
+      env:
+        DEPLOY_ENV: ${{ inputs.ENV }}
+        DEPLOY_TIMEOUT: ${{ inputs.TIMEOUT }}
+        DEPLOY_ATOMIC: ${{ inputs.ATOMIC }}
       run: |
-        cmd="chmod +x ./deploy/build.sh && ./deploy/build.sh service deploy_eks --env=${{ inputs.ENV }}"
+        chmod +x ./deploy/build.sh
+        cmd=(./deploy/build.sh service deploy_eks --env="$DEPLOY_ENV")
 
         # Check if TIMEOUT is set and provide it as a flag
-        if [ -n "${{ inputs.TIMEOUT }}" ]; then
-          cmd="${cmd} --timeout=${{ inputs.TIMEOUT }}"
+        if [ -n "$DEPLOY_TIMEOUT" ]; then
+          cmd+=(--timeout="$DEPLOY_TIMEOUT")
         fi
 
-         # Check if ATOMIC is set and provide it as a flag
-        if [ -n "${{ inputs.ATOMIC }}" ]; then
-          cmd="${cmd} --atomic=${{ inputs.ATOMIC }}"
+        # Check if ATOMIC is set and provide it as a flag
+        if [ -n "$DEPLOY_ATOMIC" ]; then
+          cmd+=(--atomic="$DEPLOY_ATOMIC")
         fi
 
         # Execute command
-        eval $cmd
+        "${cmd[@]}"
     - name: Notify slack channel on success
       if: success() && inputs.SLACK_SUCCESS_CHANNEL_ID != ''
       uses: slackapi/slack-github-action@v1.27.1

deploy/lambda/go/action.yml

@@ -16,15 +16,18 @@ runs:
     - uses: actions/checkout@v6
     - name: Cleaning workspace
       shell: bash
-      run: shopt -s dotglob && rm -rf "${{ github.workspace }}"/*
+      run: shopt -s dotglob && rm -rf "$GITHUB_WORKSPACE"/*
     - name: Restoring workspace from cache
       uses: wishabi/github-actions/cache@v0
     - name: Building lambda function for deployment
       shell: bash
+      env:
+        LAMBDA_DIR: ${{ inputs.LAMBDA_FUNCTION_DIRECTORY }}
       run: |
-        go build -o ${{ inputs.LAMBDA_FUNCTION_DIRECTORY }}/main ${{ inputs.LAMBDA_FUNCTION_DIRECTORY }}/main.go
+        go build -o "$LAMBDA_DIR/main" "$LAMBDA_DIR/main.go"
     - name: Deploying to Lambda
       shell: bash
+      env:
+        DEPLOY_ENV: ${{ inputs.ENV }}
       run: |
-        export DEPLOY_ENV=${{ inputs.ENV }}
         chmod +x ./deploy/build.sh && ./deploy/build.sh service

go/configure/action.yml

@@ -25,7 +25,9 @@ runs:
         fetch-depth: ${{ inputs.FETCH_DEPTH }}
     - name: Setting up private modules access
       shell: bash
-      run: git config --global url."https://${{ inputs.FLIPPCIRCLECIPULLER_REPO_TOKEN }}:x-oauth-basic@github.com/wishabi".insteadOf "https://github.com/wishabi"
+      env:
+        REPO_TOKEN: ${{ inputs.FLIPPCIRCLECIPULLER_REPO_TOKEN }}
+      run: git config --global url."https://$REPO_TOKEN:x-oauth-basic@github.com/wishabi".insteadOf "https://github.com/wishabi"
     - name: Grab buf version
       if: ${{ hashFiles('.tool-versions') != '' }}
       run: |

go/deps/action.yml

@@ -27,7 +27,7 @@ runs:
       with:
         path: vendor
         key: vendor-cache-${{ hashFiles('go.mod','go.sum') }}
-        restore-keys: vendor-cache-${{ hashFiles('go.mod','go.sum') }}
+        restore-keys: vendor-cache-
     - name: Generating protobuf code
       if: ${{ hashFiles('buf.gen.yaml') != '' }}
       run: buf generate
@@ -47,7 +47,7 @@ runs:
         eval "$CODE_GEN_COMMANDS"
       env:
         CODE_GEN_COMMANDS: ${{ inputs.CODE_GEN_COMMANDS }}
-    - name: Setting up private modules access
+    - name: Tidy and vendor modules
       if: steps.vendor-cache.outputs.cache-hit != 'true'
       shell: bash
       run: |
@@ -60,13 +60,15 @@ runs:
       run: go generate ./...
       shell: bash
     - name: Grab mockery version
+      env:
+        MOCKERY_VERSION: ${{ inputs.MOCKERY_INSTALL_VERSION }}
       run: |
         # Default to empty version and v1 config
         MOCKERY_INSTALL_VERSION=""
 
         # Check for MOCKERY_INSTALL_VERSION input
-        if [ -n "${{ inputs.MOCKERY_INSTALL_VERSION }}" ]; then
-          MOCKERY_INSTALL_VERSION="${{ inputs.MOCKERY_INSTALL_VERSION }}"
+        if [ -n "$MOCKERY_VERSION" ]; then
+          MOCKERY_INSTALL_VERSION="$MOCKERY_VERSION"
           echo "Using MOCKERY_INSTALL_VERSION=${MOCKERY_INSTALL_VERSION} from input"
         fi
 

go/lint/action.yml

@@ -45,16 +45,20 @@ runs:
         FLIPPCIRCLECIPULLER_REPO_TOKEN: ${{ inputs.FLIPPCIRCLECIPULLER_REPO_TOKEN }}
     - name: Setup safe directory
       shell: bash
-      run: git config --global --add safe.directory ${{ inputs.WORKSPACE || github.workspace }}
+      env:
+        LINT_WORKSPACE: ${{ inputs.WORKSPACE || github.workspace }}
+      run: git config --global --add safe.directory "$LINT_WORKSPACE"
     - name: Determine golangci-lint and config version
+      env:
+        LINT_VERSION: ${{ inputs.GOLANG_CI_LINT_VERSION }}
       run: |
         # Default to empty version and v1 config
         GOLANGCI_LINT_VERSION=""
         IS_V2=false
 
         # Check for GOLANG_CI_LINT_VERSION input
-        if [ -n "${{ inputs.GOLANG_CI_LINT_VERSION }}" ]; then
-          GOLANGCI_LINT_VERSION="${{ inputs.GOLANG_CI_LINT_VERSION }}"
+        if [ -n "$LINT_VERSION" ]; then
+          GOLANGCI_LINT_VERSION="$LINT_VERSION"
           echo "Using GOLANG_CI_LINT_VERSION=${GOLANGCI_LINT_VERSION} from input"
         fi
 
@@ -78,7 +82,7 @@ runs:
       run: |
         echo "::group::Tool Versions"
         echo "Go: $(go version)"
-        if [ -n "${{ env.GOLANGCI_LINT_VERSION }}" ]; then echo "golangci-lint: ${{ env.GOLANGCI_LINT_VERSION }}"; fi
+        if [ -n "$GOLANGCI_LINT_VERSION" ]; then echo "golangci-lint: $GOLANGCI_LINT_VERSION"; fi
         echo "::endgroup::"
     - name: Run v1 Go linter
       if: ${{ env.IS_V2 == 'false' }}
@@ -97,16 +101,20 @@ runs:
     - name: Write lint summary
       if: always()
       shell: bash
+      env:
+        JOB_STATUS: ${{ job.status }}
       run: |
         echo "## Go Lint Results" >> $GITHUB_STEP_SUMMARY
         echo "| Setting | Value |" >> $GITHUB_STEP_SUMMARY
         echo "|---------|-------|" >> $GITHUB_STEP_SUMMARY
         echo "| Go | $(go version | awk '{print $3}') |" >> $GITHUB_STEP_SUMMARY
-        if [ -n "${{ env.GOLANGCI_LINT_VERSION }}" ]; then
-          echo "| golangci-lint | ${{ env.GOLANGCI_LINT_VERSION }} |" >> $GITHUB_STEP_SUMMARY
+        if [ -n "$GOLANGCI_LINT_VERSION" ]; then
+          echo "| golangci-lint | $GOLANGCI_LINT_VERSION |" >> $GITHUB_STEP_SUMMARY
         fi
-        echo "| Config version | ${{ env.IS_V2 == 'true' && 'v2' || 'v1' }} |" >> $GITHUB_STEP_SUMMARY
-        if [ "${{ job.status }}" = "success" ]; then
+        CONFIG_VERSION="v1"
+        if [ "$IS_V2" = "true" ]; then CONFIG_VERSION="v2"; fi
+        echo "| Config version | $CONFIG_VERSION |" >> $GITHUB_STEP_SUMMARY
+        if [ "$JOB_STATUS" = "success" ]; then
           echo "" >> $GITHUB_STEP_SUMMARY
           echo "> Lint passed" >> $GITHUB_STEP_SUMMARY
         else

go/smoke-test/action.yml

@@ -52,15 +52,23 @@ runs:
     - name: Write smoke test summary
       if: always()
       shell: bash
+      env:
+        SMOKE_ENV: ${{ inputs.ENV }}
+        GO_SMOKE: ${{ inputs.GO_SMOKE }}
+        DD_SYNTHETIC_IDS: ${{ inputs.DD_SYNTHETIC_IDS }}
+        ROLLBACK_ON_FAIL: ${{ inputs.ROLLBACK_ON_FAIL }}
+        JOB_STATUS: ${{ job.status }}
       run: |
+        DD_ENABLED="no"
+        if [ -n "$DD_SYNTHETIC_IDS" ]; then DD_ENABLED="yes"; fi
         echo "## Smoke Test Results" >> $GITHUB_STEP_SUMMARY
         echo "| Setting | Value |" >> $GITHUB_STEP_SUMMARY
         echo "|---------|-------|" >> $GITHUB_STEP_SUMMARY
-        echo "| Environment | ${{ inputs.ENV }} |" >> $GITHUB_STEP_SUMMARY
-        echo "| Go Smoke | ${{ inputs.GO_SMOKE }} |" >> $GITHUB_STEP_SUMMARY
-        echo "| DataDog Synthetics | ${{ inputs.DD_SYNTHETIC_IDS != '' && 'yes' || 'no' }} |" >> $GITHUB_STEP_SUMMARY
-        echo "| Rollback on Fail | ${{ inputs.ROLLBACK_ON_FAIL }} |" >> $GITHUB_STEP_SUMMARY
-        if [ "${{ job.status }}" = "success" ]; then
+        echo "| Environment | $SMOKE_ENV |" >> $GITHUB_STEP_SUMMARY
+        echo "| Go Smoke | $GO_SMOKE |" >> $GITHUB_STEP_SUMMARY
+        echo "| DataDog Synthetics | $DD_ENABLED |" >> $GITHUB_STEP_SUMMARY
+        echo "| Rollback on Fail | $ROLLBACK_ON_FAIL |" >> $GITHUB_STEP_SUMMARY
+        if [ "$JOB_STATUS" = "success" ]; then
           echo "" >> $GITHUB_STEP_SUMMARY
           echo "> Smoke tests passed" >> $GITHUB_STEP_SUMMARY
         else
@@ -69,9 +77,11 @@ runs:
         fi
     - name: Rollback on failure
       if: failure() && inputs.ROLLBACK_ON_FAIL == 'true'
+      env:
+        DEPLOY_ENV: ${{ inputs.ENV }}
       run: |
         echo "WARNING: Rolling back service"
-        chmod +x ./deploy/build.sh && ./deploy/build.sh service rollback --env=${{ inputs.ENV }}
+        chmod +x ./deploy/build.sh && ./deploy/build.sh service rollback --env="$DEPLOY_ENV"
       shell: bash
     - name: Notify slack channel on failure
       if: failure() && inputs.SLACK_CHANNEL_ID != ''

go/test/action.yml

@@ -23,7 +23,11 @@ runs:
   steps:
     - name: Running go tests
       shell: bash
-      run: ${GITHUB_ACTION_PATH}/test.sh "${{ inputs.TAGS }}" "${{ inputs.TIMEOUT }}" "${{ inputs.PARALLEL }}"
+      env:
+        TEST_TAGS: ${{ inputs.TAGS }}
+        TEST_TIMEOUT: ${{ inputs.TIMEOUT }}
+        TEST_PARALLEL: ${{ inputs.PARALLEL }}
+      run: ${GITHUB_ACTION_PATH}/test.sh
     - name: Write test summary
       if: always()
       shell: bash
@@ -51,12 +55,14 @@ runs:
           echo "> **Warning:** No test report found" >> $GITHUB_STEP_SUMMARY
         fi
     - name: Uploading test report
+      if: always()
       uses: actions/upload-artifact@v6
       with:
         name: "${{ github.sha }}-test-report.out"
         path: "./test-report.out"
         retention-days: ${{ inputs.ARTIFACT_RETENTION_DAYS }}
     - name: Uploading coverage report
+      if: always()
       uses: actions/upload-artifact@v6
       with:
         name: "${{ github.sha }}-coverage.out"

go/test/test.sh

@@ -1,11 +1,11 @@
 #! /bin/bash
 set -eu
 
-TAGS=${1:-}
-TIMEOUT=${2:-}
-PARALLEL=${3:-}
+TAGS=${TEST_TAGS:-}
+TIMEOUT=${TEST_TIMEOUT:-}
+PARALLEL=${TEST_PARALLEL:-true}
 
-cmd="go test -v ./... -coverprofile=coverage.out"
+cmd=(go test -v ./... -coverprofile=coverage.out)
 
 # find non-ignored subdirectories
 file_list=()
@@ -22,21 +22,21 @@ IFS=,
 package_list="${file_list[*]}"
 IFS=$old_ifs # put delimiter back to the original value
 
-cmd="$cmd -coverpkg $package_list"
+cmd+=(-coverpkg "$package_list")
 
 if [ -n "$TAGS" ]; then
-  cmd="$cmd --tags=${TAGS}"
+  cmd+=(--tags="${TAGS}")
 fi
 
 if [ -n "$TIMEOUT" ]; then
-  cmd="$cmd -timeout ${TIMEOUT}s"
+  cmd+=(-timeout "${TIMEOUT}s")
 fi
 
 if [ "$PARALLEL" = "false" ]; then
-  cmd="$cmd -p 1"
+  cmd+=(-p 1)
 fi
 
-echo "$cmd | tee test-report.out"
-bash -c "$cmd" 2>&1 | tee test-report.out
+echo "${cmd[*]} | tee test-report.out"
+"${cmd[@]}" 2>&1 | tee test-report.out
 
 exit ${PIPESTATUS[0]}

ruby/deps/action.yml

@@ -15,7 +15,7 @@ runs:
       with:
         path: vendor/bundle
         key: rails-${{ hashFiles('Gemfile.lock') }}
-        restore-keys: rails-${{ hashFiles('Gemfile.lock') }}
+        restore-keys: rails-
     - name: Bundle install
       if: steps.bundle-cache.outputs.cache-hit != 'true'
       shell: bash

ruby/lint/action.yml

@@ -18,6 +18,7 @@ runs:
       env: 
         BUNDLE_DEPLOYMENT: true
     - name: 'Upload rubocop results'
+      if: always()
       uses: actions/upload-artifact@v6
       with:
         name: "${{ github.sha }}-lint-results.out"

ruby/test/action.yml

@@ -61,14 +61,17 @@ runs:
       working-directory: ./coverage
       shell: bash
       run: |
-        sed -i 's@${{ env.ROOT_PATH }}''@/github/workspace/@g' coverage.json
+        ESCAPED_ROOT=$(printf '%s\n' "$ROOT_PATH" | sed 's/[[\.*^$()+?{|\\]/\\&/g')
+        sed -i "s@${ESCAPED_ROOT}@/github/workspace/@g" coverage.json
     - name: 'Upload coverage'
+      if: always()
       uses: actions/upload-artifact@v6
       with:
         name: ${{ github.sha }}-coverage.out
         path: ./coverage/coverage.json
         retention-days: ${{ inputs.ARTIFACT_RETENTION_DAYS }}
     - name: 'Upload test results'
+      if: always()
       uses: actions/upload-artifact@v6
       with:
         name: ${{ github.sha }}-test-report.out

ruby/validation/schema/action.yml

@@ -22,5 +22,7 @@ runs:
         BUNDLE_DEPLOYMENT: true
     - name: Schema validation 
       shell: bash
+      env:
+        VALIDATION_ENV: ${{ inputs.ENV }}
       run: |
-        chmod +x ./deploy/build.sh && ./deploy/build.sh service schema_validation --env=${{ inputs.ENV }}
+        chmod +x ./deploy/build.sh && ./deploy/build.sh service schema_validation --env="$VALIDATION_ENV"

ruby/validation/topic/action.yml

@@ -19,12 +19,15 @@ runs:
     - name: Topic validation
       shell: bash
       run: |
-        bundle exec rails g flipp_ruby_kafka:topic_config --producer_services=${{ inputs.PRODUCER_SERVICE }} --consumer_services=${{ inputs.CONSUMER_SERVICE }}
+        bundle exec rails g flipp_ruby_kafka:topic_config --producer_services="$PRODUCER_SERVICE" --consumer_services="$CONSUMER_SERVICE"
 
         # check if the circeci user exists and update permission. This is needed for non runner-fleet-v2 jobs
         if id "3434" >/dev/null 2>&1; then
             sudo chown circleci:circleci /var/run/docker.sock
         fi
-        chmod +x ./deploy/build.sh && ./deploy/build.sh service topic_validation --env=${{ inputs.ENV }} --config-file=./platform.yml --config-file=./topic_validation.yaml
+        chmod +x ./deploy/build.sh && ./deploy/build.sh service topic_validation --env="$VALIDATION_ENV" --config-file=./platform.yml --config-file=./topic_validation.yaml
       env: 
         BUNDLE_DEPLOYMENT: true
+        PRODUCER_SERVICE: ${{ inputs.PRODUCER_SERVICE }}
+        CONSUMER_SERVICE: ${{ inputs.CONSUMER_SERVICE }}
+        VALIDATION_ENV: ${{ inputs.ENV }}