feat: update to recent v2 support + simplify #14
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| @@ -0,0 +1,37 @@ | ||||||||||||
| # The help target prints out all targets with their descriptions organized | ||||||||||||
| # beneath their categories. The categories are represented by '##@' and the | ||||||||||||
| # target descriptions by '##'. The awk commands is responsible for reading the | ||||||||||||
| # entire set of makefiles included in this invocation, looking for lines of the | ||||||||||||
| # file as xyz: ## something, and then pretty-format the target and help. Then, | ||||||||||||
| # if there's a line with ##@ something, that gets pretty-printed as a category. | ||||||||||||
| # More info on the usage of ANSI catalog characters for terminal formatting: | ||||||||||||
| # https://en.wikipedia.org/wiki/ANSI_escape_code#SGR_parameters | ||||||||||||
| # More info on the awk command: | ||||||||||||
| # http://linuxcommand.org/lc3_adv_awk.php | ||||||||||||
|
|
||||||||||||
| # Check if OPA CLI is installed | ||||||||||||
| OPA := $(shell command -v opa 2> /dev/null) | ||||||||||||
| ifeq ($(OPA),) | ||||||||||||
| $(error "opa CLI not found. Please install it: https://www.openpolicyagent.org/docs/latest/cli/") | ||||||||||||
| endif | ||||||||||||
|
|
||||||||||||
| ##@ Help | ||||||||||||
| help: ## Display this concise help, ie only the porcelain target | ||||||||||||
| @awk 'BEGIN {FS = ":.*##"; printf "\033[1mUsage\033[0m\n make \033[36m<target>\033[0m\n"} /^[a-zA-Z_0-9-]+:.*?##/ { printf " \033[36m%-30s\033[0m %s\n", $$1, $$2 } /^##@/ { printf "\n\033[1m%s\033[0m\n", substr($$0, 5) } ' $(MAKEFILE_LIST) | ||||||||||||
|
|
||||||||||||
| help-all: ## Display all help items, ie including plumbing targets | ||||||||||||
| @awk 'BEGIN {FS = ":.*#"; printf "\nUsage:\n make \033[36m<target>\033[0m\n"} /^[a-zA-Z_0-9-]+:.*?#/ { printf " \033[36m%-25s\033[0m %s\n", $$1, $$2 } /^#@/ { printf "\n\033[1m%s\033[0m\n", substr($$0, 5) } ' $(MAKEFILE_LIST) | ||||||||||||
|
|
||||||||||||
|
|
||||||||||||
| test: | ||||||||||||
| @go test ./... | ||||||||||||
|
|
||||||||||||
| clean: # Cleanup build artifacts | ||||||||||||
| @rm -rf dist/* | ||||||||||||
|
|
||||||||||||
| build: clean ## Build the plugin package | ||||||||||||
| @mkdir -p dist/ | ||||||||||||
| @go build -o dist/plugin main.go | ||||||||||||
|
Comment on lines
+26
to
+34
There was a problem hiding this comment. 🧹 Nitpick | 🔵 Trivial | ⚡ Quick win Declare non-file targets as Targets that don't produce files ( ♻️ Proposed fixAdd this line near the top of the Makefile, after the OPA check: endif
+.PHONY: help help-all test clean build run
+
##@ Help
help: ## Display this concise help, ie only the porcelain target🤖 Prompt for AI Agents |
||||||||||||
|
|
||||||||||||
| run: build ## Execute the Concom agent with the built plugin | ||||||||||||
| @../agent/dist/./concom agent --config ./.config/config.yaml | ||||||||||||
|
Comment on lines
+36
to
+37
There was a problem hiding this comment. 🧹 Nitpick | 🔵 Trivial | ⚡ Quick win Consider making the agent path configurable. The hardcoded relative path ♻️ Proposed improvementsOption 1: Add a configurable variable +# Path to the Concom agent binary (override with: make run AGENT_PATH=/custom/path)
+AGENT_PATH ?= ../agent/dist/concom
+
##@ Help run: build ## Execute the Concom agent with the built plugin
- @../agent/dist/./concom agent --config ./.config/config.yaml
+ @$(AGENT_PATH) agent --config ./.config/config.yamlOption 2: Add an existence check run: build ## Execute the Concom agent with the built plugin
+ `@test` -f ../agent/dist/concom || (echo "Error: agent not found at ../agent/dist/concom" && exit 1)
@../agent/dist/./concom agent --config ./.config/config.yaml📝 Committable suggestion
Suggested change
🧰 Tools🪛 checkmake (0.3.2)[warning] 36-36: Required target "all" is missing from the Makefile. (minphony) [warning] 36-36: Required target "clean" must be declared PHONY. (minphony) [warning] 36-36: Required target "test" must be declared PHONY. (minphony) 🤖 Prompt for AI Agents |
||||||||||||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,57 +1,61 @@ | ||
| module github.com/compliance-framework/plugin-template | ||
|
|
||
| go 1.26.1 | ||
|
|
||
| require ( | ||
| github.com/compliance-framework/agent v0.7.0 | ||
| github.com/hashicorp/go-hclog v1.6.3 | ||
| github.com/hashicorp/go-plugin v1.7.0 | ||
| ) | ||
|
|
||
| require ( | ||
| github.com/agnivade/levenshtein v1.2.1 // indirect | ||
| github.com/cespare/xxhash/v2 v2.3.0 // indirect | ||
| github.com/compliance-framework/api v0.16.0 // indirect | ||
| github.com/containerd/errdefs/pkg v0.3.0 // indirect | ||
| github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.1 // indirect | ||
| github.com/defenseunicorns/go-oscal v0.7.0 // indirect | ||
| github.com/docker/docker v28.5.2+incompatible // indirect | ||
|
There was a problem hiding this comment. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
# Description: Check if docker package is actually imported/used in the codebase
echo "=== Checking for direct docker imports ==="
rg -n --type=go 'github\.com/docker/docker' -g '!go.mod' -g '!go.sum'
echo ""
echo "=== Checking which dependency brings in docker ==="
go mod why github.com/docker/docker
echo ""
echo "=== Checking for latest docker version and patches ==="
curl -s https://proxy.golang.org/github.com/docker/docker/@latest | jq -r '.Version'Repository: compliance-framework/plugin-template Length of output: 9640 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "=== rg for docker/docker imports (code only) ==="
rg -n --type=go 'github\.com/docker/docker' -g '!go.mod' -g '!go.sum' || true
echo
echo "=== go mod why (module-level) ==="
go mod why -m github.com/docker/docker || true
echo
echo "=== go list deps (including tests) that reference docker/docker ==="
go list -deps -test ./... 2>/dev/null | rg -n 'github\.com/docker/docker' || true
echo
echo "=== go mod graph edges that mention docker/docker (filtered) ==="
go mod graph | rg 'github\.com/docker/docker' || trueRepository: compliance-framework/plugin-template Length of output: 863 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "=== Find any packages in this module that import docker/docker subpackages ==="
rg -n --type=go 'github\.com/docker/docker/(.+)?' -g '!go.mod' -g '!go.sum' || true
echo
echo "=== Identify packages whose resolved module is github.com/docker/docker (deps including tests) ==="
# Uses -json to map packages -> module path, then filters for github.com/docker/docker
go list -deps -test -json ./... 2>/dev/null \
| jq -r 'select(.Module != null and .Module.Path=="github.com/docker/docker") | .ImportPath' \
| sort -u | sed '/^$/d' || true
echo
echo "=== Does testcontainers-go appear in non-test packages? ==="
rg -n --type=go 'github\.com/testcontainers/testcontainers-go' -g '!go.mod' -g '!go.sum' . || trueRepository: compliance-framework/plugin-template Length of output: 320 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "=== Inspect go list -deps -test -json for packages belonging to github.com/docker/docker ==="
go list -deps -test -json ./... 2>/dev/null \
| rg -n '"Module":\s*{' -n || true
# More direct: print ImportPath values where the JSON shows Module.Path == github.com/docker/docker
go list -deps -test -json ./... 2>/dev/null \
| python3 - <<'PY'
import sys, json, re
buf=[]
for line in sys.stdin:
buf.append(line)
if line.strip() == '}':
pass
PYRepository: compliance-framework/plugin-template Length of output: 283 🏁 Script executed: #!/bin/bash
set -euo pipefail
pkgs=(
"github.com/compliance-framework/agent/runner"
"github.com/compliance-framework/api/sdk"
"github.com/compliance-framework/api/sdk.test"
)
for p in "${pkgs[@]}"; do
echo "===== $p ====="
dir="$(go list -f '{{.Dir}}' "$p" 2>/dev/null || true)"
echo "Dir: ${dir:-<unknown>}"
if [ -n "$dir" ] && [ "$dir" != "<unknown>" ]; then
rg -n --hidden --no-ignore -S 'github\.com/docker/docker' "$dir" || true
rg -n --hidden --no-ignore -S 'docker\.go' "$dir" || true
fi
echo
done
echo "===== Any docker/docker imports across this module (all .go files) ====="
rg -n --type=go 'github\.com/docker/docker' . -g '!go.mod' -g '!go.sum' || trueRepository: compliance-framework/plugin-template Length of output: 499 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "=== docker/docker packages in NON-TEST deps (import graph) ==="
go list -deps -json ./... 2>/dev/null \
| jq -r 'select(.Module != null and .Module.Path=="github.com/docker/docker") | .ImportPath' \
| sort -u || true
echo
echo "=== docker/docker packages in TEST deps (import graph) ==="
go list -deps -test -json ./... 2>/dev/null \
| jq -r 'select(.Module != null and .Module.Path=="github.com/docker/docker") | .ImportPath' \
| sort -u || true
echo
echo "=== modules requiring docker/docker in NON-TEST build ==="
go mod why -m github.com/docker/docker 2>/dev/null || trueRepository: compliance-framework/plugin-template Length of output: 546 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "=== rg for testcontainers-go usage (excluding vendor) ==="
rg -n --hidden --no-ignore -S 'testcontainers[-.]go' . -g '!go.mod' -g '!go.sum' || true
echo
echo "=== rg for docker client imports in repo (excluding go.mod/sum) ==="
rg -n --hidden --no-ignore -S 'github\.com/docker/docker' . -g '!go.mod' -g '!go.sum' || true
echo
echo "=== List any _test.go files that reference testcontainers ==="
rg -n --hidden --no-ignore -S 'testcontainers[-.]go' . -g '*_test.go' || trueRepository: compliance-framework/plugin-template Length of output: 270 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "=== Importers of github.com/docker/docker (test vs non-test) ==="
for mode in "" "-test"; do
echo "--- mode: ${mode:-non-test} ---"
go list $mode -deps -json ./... 2>/dev/null \
| jq -r '
select(.Module and (.Module.Path=="github.com/docker/docker"))
| .ImportPath
' | sort -u | head -n 200
done
echo
echo "=== Importers that pull in github.com/testcontainers/testcontainers-go (test vs non-test) ==="
for mode in "" "-test"; do
echo "--- mode: ${mode:-non-test} ---"
go list $mode -deps -json ./... 2>/dev/null \
| jq -r '
select(.Module and (.Module.Path=="github.com/testcontainers/testcontainers-go"))
| .ImportPath
' | sort -u | head -n 200
done
echo
echo "=== Raw module paths present for deps mentioning docker/docker (sanity) ==="
go list -deps -test -json ./... 2>/dev/null | jq -r '
select(.Module and (.Module.Path|contains("docker/docker")))
| (.Module.Path + " " + (.Version // ""))
' | sort -u | head -n 50Repository: compliance-framework/plugin-template Length of output: 403 🏁 Script executed: #!/bin/bash
set -euo pipefail
# Inspect dependency module sources (not this repo) for docker/testcontainers usage
mods=(
"/home/jailuser/go/pkg/mod/github.com/compliance-framework/agent@v0.7.0"
"/home/jailuser/go/pkg/mod/github.com/compliance-framework/api@v0.16.0"
)
for d in "${mods[@]}"; do
echo "===== Searching in $d for docker/docker ====="
test -d "$d" && rg -n --hidden --no-ignore -S 'github\.com/docker/docker' "$d" || echo "missing"
echo
echo "===== Searching in $d for testcontainers-go ====="
test -d "$d" && rg -n --hidden --no-ignore -S 'github\.com/testcontainers/testcontainers-go' "$d" || echo "missing"
echo
echo "===== Searching in $d for docker client usage indicators ====="
test -d "$d" && rg -n --hidden --no-ignore -S 'docker\.NewClient|client\.NewClient|dockertest|testcontainers' "$d" || echo "missing"
echo "----------------------------------------"
doneRepository: compliance-framework/plugin-template Length of output: 7955 🌐 Web query:
💡 Result: GO-2026-4883 refers to an off-by-one error in plugin privilege validation within the Moby project (the core component of Docker), tracked as CVE-2026-33997 and GHSA-pxq6-2prw-chj9 [1][2]. The vulnerability arises from an error in the daemon's privilege comparison logic, specifically within the Citations:
🌐 Web query:
💡 Result: GHSA-x86f-5xw2-fm2r (also tracked as CVE-2026-41567) is a security vulnerability in Docker Engine that allows for arbitrary code execution on the host with daemon (root) privileges [1][2][3]. The vulnerability occurs when handling PUT /containers/{id}/archive requests that contain compressed archives (specifically xz or gzip) [1][2]. The Docker daemon incorrectly resolves external system binaries required for decompression from the container's filesystem instead of the host's filesystem [1][3]. A malicious container image containing a trojanized decompression binary can exploit this behavior, allowing the binary to execute with the full privileges of the host daemon when an archive is uploaded to the container [1][2][4]. Key points regarding this vulnerability: - Affected Component: github.com/docker/docker (and related moby/moby components) [1][5][2]. - Attack Vector: Requires a user to run a container from a malicious image and subsequently upload a compressed archive (xz or gzip) into that container [1][2]. - Exploitation Examples: This can be triggered by calling the PUT /containers/{id}/archive API directly or by piping a compressed archive through commands like docker cp - [1][2][4]. - Limitations: Standard docker cp usage is not affected because the CLI sends uncompressed tar by default [4]. Decompression formats using pure Go implementations (such as bzip2, zstd, and gzip when an unpigz binary is absent) are also not affected [1][2]. Recommended mitigations include: - Only running containers from trusted images [1][2]. - Using authorization plugins to limit access to the PUT /containers/{id}/archive endpoint [1][2]. - Avoiding the piping of compressed archives into containers created from untrusted sources [1][2]. As of May 28, 2026, advisories indicate that a fix may still be pending for the primary github.com/docker/docker module path [5]. Citations:
🌐 Web query:
💡 Result: GHSA-vp62-88p7-qqf5 (also tracked as CVE-2026-41568) is a security vulnerability in the Docker Engine related to a race condition in the docker cp command [1][2][3][4]. Vulnerability Details The vulnerability exists because of a race condition that occurs when the Docker daemon sets up a temporary filesystem view by bind-mounting volumes while executing a docker cp command (or equivalent API calls like PUT/HEAD /containers/{id}/archive) [1][3]. During this setup process: 1. The daemon resolves the target mount path within the container's root filesystem [1][4]. 2. It then creates the mountpoint (file or directory) if it does not already exist [1][4]. An attacker with a running malicious container can exploit the timing window between these two steps [1][3]. By rapidly creating and swapping path components for symlinks pointing to arbitrary locations on the host, the attacker can cause the daemon to follow these symlinks when it creates the mountpoint [1][4]. Consequently, the daemon creates empty files or directories at arbitrary absolute paths on the host filesystem with root privileges [1][4]. Distinction from Related Vulnerabilities This advisory (GHSA-vp62-88p7-qqf5) specifically addresses the race condition during mountpoint creation [3]. A separate, related vulnerability, tracked as GHSA-rg2x-37c3-w2rh (CVE-2026-42306), involves a different race condition that occurs during the subsequent mount syscall, which allows for bind mount redirection [3][5][6]. Mitigation and Recommendations - Avoid using docker cp with untrusted running containers [1][6]. - Only run containers from trusted images [1][6]. - Utilize authorization plugins to restrict access to the affected archive API endpoints (PUT /containers/{id}/archive and HEAD /containers/{id}/archive) [1][6]. - Ensure your Docker environment is updated to a patched version, as fixes have been implemented to scope mountpoint creation to the container root, preventing escapes even if symlinks are swapped [1]. Citations:
🌐 Web query:
💡 Result: GHSA-rg2x-37c3-w2rh is a security advisory describing a race condition in the docker cp command that allows a malicious container to perform bind mount redirection to an arbitrary path on the host filesystem [1][2]. When a user initiates a docker cp operation, the Docker daemon sets up a temporary filesystem view by bind-mounting volumes into a private mount namespace [1]. During this setup process, a mount destination is created inside the container root, and a bind mount is subsequently attached to the container-relative path [1]. The vulnerability arises because there is a race condition between the creation of this mountpoint and the execution of the mount syscall [1]. A process running inside a malicious container can exploit this window by replacing the mount destination (or one of its parent path components) with a symbolic link pointing to an arbitrary location on the host [1]. When the mount syscall is executed, it follows the symlink, resulting in the volume being bind-mounted onto the host path rather than the intended location inside the container [1]. The impact of this exploit depends on the nature of the mount: - If the volume is writable, an attacker could potentially overwrite arbitrary host files at the redirected path with the volume's contents [1]. - If the volume is read-only, the host path is masked by the mount for the duration of the copy operation, which can cause a denial of service on the host [1]. Requirements for exploitation include [1]: - The container must have at least one volume mount. - A process inside the container must be capable of rapidly creating and swapping symlinks at the target mount destination. - An operator must trigger a docker cp command into the affected container (or call the corresponding PUT/HEAD /containers/{id}/archive API endpoints) [1]. Mitigation strategies recommended by the advisory include [1]: - Running only containers from trusted images. - Avoiding the use of docker cp with untrusted or running containers. - Utilizing authorization plugins to restrict access to the archive API endpoints [1]. This vulnerability is distinct from a related issue, tracked as GHSA-vp62-88p7-qqf5, which involves a race condition during mountpoint creation that allows for the creation of arbitrary empty files or directories on the host [3][4]. Citations:
🌐 Web query:
💡 Result: GHSA-x744-4wpc-v9h2 (also tracked as CVE-2026-34040) is a security vulnerability in Moby (the engine powering Docker) that allows an attacker to bypass authorization (AuthZ) plugins [1][2][3]. Under specific circumstances, a specially-crafted API request can cause the Docker daemon to forward the request to an AuthZ plugin without including the request body [1][3]. If an AuthZ plugin relies on introspecting this body to make access control decisions, it may incorrectly allow a request that it otherwise would have denied [1][3]. Key details include: - Impact: Users are only affected if they utilize AuthZ plugins that rely on request body inspection for security decisions [1][3]. - Status: This issue is identified as an incomplete fix for a previous, related vulnerability, CVE-2024-41110 [1][3]. - Affected Versions: Versions of Moby prior to 29.3.1 [4][2][3]. - Resolution: The issue was patched in version 29.3.1 [4][2][3]. - Mitigations: If updating immediately is not possible, users are advised to restrict access to the Docker API to trusted parties following the principle of least privilege and avoid using AuthZ plugins that rely on request body inspection [1][3]. Citations:
🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "=== Direct imports of github.com/docker/docker (excluding go.mod/go.sum) ==="
rg -n --type=go 'github\.com/docker/docker' -g '!go.mod' -g '!go.sum' . || true
echo
echo "=== docker/docker required for non-test builds? ==="
go list -deps ./... 2>/dev/null | rg -n 'github\.com/docker/docker' || true
echo
echo "=== docker/docker required only for test builds? ==="
go list -deps -test ./... 2>/dev/null | rg -n 'github\.com/docker/docker' || true
echo
echo "=== go mod why ==="
go mod why -m github.com/docker/docker || trueRepository: compliance-framework/plugin-template Length of output: 568 Transitive
Mapped HIGH advisories for this dependency:
Action: bump 🧰 Tools🪛 OSV Scanner (2.3.8)[HIGH] 18-18: github.com/docker/docker 28.5.2+incompatible: Moby has an Off-by-one error in its plugin privilege validation in github.com/docker/docker (GO-2026-4883) [HIGH] 18-18: github.com/docker/docker 28.5.2+incompatible: Moby has AuthZ plugin bypass when provided oversized request bodies in github.com/docker/docker (GO-2026-4887) [HIGH] 18-18: github.com/docker/docker 28.5.2+incompatible: Moby has an Off-by-one error in its plugin privilege validation [HIGH] 18-18: github.com/docker/docker 28.5.2+incompatible: Docker: Race condition in docker cp allows bind mount redirection to host path [HIGH] 18-18: github.com/docker/docker 28.5.2+incompatible: Docker: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swap [HIGH] 18-18: github.com/docker/docker 28.5.2+incompatible: Moby has AuthZ plugin bypass when provided oversized request bodies [HIGH] 18-18: github.com/docker/docker 28.5.2+incompatible: Docker: 🤖 Prompt for AI Agents |
||
| github.com/fatih/color v1.18.0 // indirect | ||
| github.com/go-viper/mapstructure/v2 v2.5.0 // indirect | ||
| github.com/gobwas/glob v0.2.3 // indirect | ||
| github.com/goccy/go-json v0.10.5 // indirect | ||
| github.com/golang/protobuf v1.5.4 // indirect | ||
| github.com/google/uuid v1.6.0 // indirect | ||
| github.com/hashicorp/yamux v0.1.2 // indirect | ||
| github.com/lestrrat-go/blackmagic v1.0.4 // indirect | ||
| github.com/lestrrat-go/dsig v1.0.0 // indirect | ||
| github.com/lestrrat-go/dsig-secp256k1 v1.0.0 // indirect | ||
| github.com/lestrrat-go/httpcc v1.0.1 // indirect | ||
| github.com/lestrrat-go/httprc/v3 v3.0.4 // indirect | ||
| github.com/lestrrat-go/jwx/v3 v3.0.13 // indirect | ||
| github.com/lestrrat-go/option/v2 v2.0.0 // indirect | ||
| github.com/mattn/go-colorable v0.1.14 // indirect | ||
| github.com/mattn/go-isatty v0.0.20 // indirect | ||
| github.com/oklog/run v1.2.0 // indirect | ||
| github.com/open-policy-agent/opa v1.14.1 // indirect | ||
| github.com/rcrowley/go-metrics v0.0.0-20250401214520-65e299d6c5c9 // indirect | ||
| github.com/segmentio/asm v1.2.1 // indirect | ||
| github.com/sirupsen/logrus v1.9.4 // indirect | ||
| github.com/tchap/go-patricia/v2 v2.3.3 // indirect | ||
| github.com/valyala/fastjson v1.6.10 // indirect | ||
| github.com/vektah/gqlparser/v2 v2.5.32 // indirect | ||
| github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect | ||
| github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect | ||
| github.com/yashtewari/glob-intersection v0.2.0 // indirect | ||
| go.opentelemetry.io/otel/metric v1.42.0 // indirect | ||
| go.opentelemetry.io/otel/trace v1.42.0 // indirect | ||
| go.uber.org/multierr v1.11.0 // indirect | ||
| go.uber.org/zap v1.27.1 // indirect | ||
| go.yaml.in/yaml/v2 v2.4.4 // indirect | ||
| go.yaml.in/yaml/v3 v3.0.4 // indirect | ||
| golang.org/x/crypto v0.49.0 // indirect | ||
| golang.org/x/net v0.52.0 // indirect | ||
| golang.org/x/sync v0.20.0 // indirect | ||
| golang.org/x/sys v0.42.0 // indirect | ||
| golang.org/x/text v0.35.0 // indirect | ||
| google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171 // indirect | ||
| google.golang.org/grpc v1.79.3 // indirect | ||
| google.golang.org/protobuf v1.36.11 // indirect | ||
| sigs.k8s.io/yaml v1.6.0 // indirect | ||
| ) | ||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🧹 Nitpick | 🔵 Trivial | ⚖️ Poor tradeoff
Potential template injection via GitHub context variables.
The workflow uses unsanitized GitHub context variables (
github.repository_owner,github.event.repository.name,github.ref_name) in shell commands. In certain scenarios (e.g., workflow running from a fork or with crafted repository names), these could inject arbitrary commands.For a plugin template used in a trusted context, this risk may be acceptable. However, if this workflow will run on pull requests from forks or in untrusted environments, consider sanitizing the inputs or using environment variables instead.
🛡️ Defensive alternatives
Option 1: Use environment variables
Option 2: Add input validation
Also applies to: 28-28
🧰 Tools
🪛 zizmor (1.25.2)
[warning] 25-25: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
[error] 25-25: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
[error] 25-25: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
🤖 Prompt for AI Agents
Missing closing quote in annotation argument.
Both
gooci uploadcommands have unterminated strings in the--annotateparameter. The opening quote for the annotation value is never closed, which will cause shell syntax errors.🐛 Proposed fix
Also applies to: 28-28
🧰 Tools
🪛 zizmor (1.25.2)
[warning] 25-25: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
[error] 25-25: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
[error] 25-25: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
🤖 Prompt for AI Agents