Unstable alignment #495

dariaguy · 2025-12-17T09:20:40Z

Aligning unstable with release automation

Added release-automation src directory
Aligned test directory with release/8.4 branch
Added release automation workflows support for custom and unstable builds
Added build args for Dockerfile

- Update REDIS_DOWNLOAD_URL to use official Redis 8.2.1 release - Update REDIS_DOWNLOAD_SHA to e2c1cb9dd4180a35b943b85dfc7dcdd42566cdbceca37d0d0b14c21731582d3e

Update to recent RedisVersion with fixes in sorting and comparison Add mixed format tests for mixed use-case, e.g. when 8.4.0 is ga and 8.4-rc1 is rc.

Fix stackbrew generation when 8.X and 8.X.Y formats are mixed toghether

…ment Add release automation to unstable branch

- Added build args in dockerfile for moduels and redis version - Added custom_build input to use in dockerfile and build-and-tag-locally - Created test workflow to run unsable build

- Support custom, unstable, nightly and release - Added changes to release_build_and_test

- pull-request.yml workflow for PR for unstable and release branches - renamed custom_build to custom_ref_type - renamed pre-merge to build-n-test - removed nightly test workflow

jit-ci

❌ Jit has detected 15 important findings in this PR that you should review.

The first 10 findings are detailed below as separate comments.
Click here to view all the findings on Jit.

It’s highly recommended that you fix these security issues before merging.
Alternatively, comment #jit_ignore_all in this PR to ignore all findings. Admin privileges required.

Repository Risks:

Database Integration: Connects to a database, often involving sensitive data that must be securely managed.
Internally Accessible: Accessible only within the internal network, reducing exposure to external threats but still requiring proper controls.
High Severity Findings: Indicates that the resource has high severity security findings that need attention.

Repository Context:

graph LR
    GitHub$Repository_U23_redis/docker_U2D_library_U2D_redis["GitHub Repository<br/>redis/docker-library-redis"]:::GitHub$Repository
    Team_U23_client_U2D_developers["Team<br/>client-developers"]:::Team
    Team_U23_core_U2D_team["Team<br/>core-team"]:::Team
    Team_U23_redis_U2D_packaging_U2D_admins["Team<br/>redis-packaging-admins"]:::Team
    DBIntegration_U23_redis["DBIntegration<br/>redis"]:::DBIntegration
    Docker$Image_U23_redis["Docker Image<br/>redis"]:::Docker$Image
    Team_U23_client_U2D_developers -- "Owns" --> GitHub$Repository_U23_redis/docker_U2D_library_U2D_redis
    Team_U23_core_U2D_team -- "Owns" --> GitHub$Repository_U23_redis/docker_U2D_library_U2D_redis
    Team_U23_redis_U2D_packaging_U2D_admins -- "Owns" --> GitHub$Repository_U23_redis/docker_U2D_library_U2D_redis
    GitHub$Repository_U23_redis/docker_U2D_library_U2D_redis -- "Is accessible to" --> DBIntegration_U23_redis
    GitHub$Repository_U23_redis/docker_U2D_library_U2D_redis -- "Builds" --> Docker$Image_U23_redis

jit-ci · 2025-12-17T09:23:57Z

.github/workflows/release_publish.yml

+          # Set outputs for next steps
+          echo "release_commit_sha=$RELEASE_COMMIT_SHA" >> $GITHUB_OUTPUT
+          echo "release_version=$RELEASE_VERSION" >> $GITHUB_OUTPUT
+


Security control: Static Code Analysis Semgrep Pro

Yaml.Github-Actions.Security.Run-Shell-Injection.Run-Shell-Injection

Using variable interpolation ${{...}} with github context data in a run: step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. github context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with env: to store the data and use the environment variable in the run: script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".

Severity: HIGH

Learn more about this issue

Jit Bot commands and options (e.g., ignore issue)

You can trigger Jit actions by commenting on this PR review:

#jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”

#jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”

#jit_ignore_type_in_file Ignore any finding of type "yaml.github-actions.security.run-shell-injection.run-shell-injection" in .github/workflows/release_publish.yml; future occurrences will also be ignored.

#jit_undo_ignore Undo ignore command

jit-ci · 2025-12-17T09:23:58Z

.github/actions/build-and-tag-locally/action.yml

+          "${{ inputs.distribution }}" \
+          "${{ steps.platform.outputs.display_name }}" \
+          | tr '[:upper:]' '[:lower:]' >> "$GITHUB_OUTPUT"
+


Security control: Static Code Analysis Semgrep Pro

Yaml.Github-Actions.Security.Run-Shell-Injection.Run-Shell-Injection

Using variable interpolation ${{...}} with github context data in a run: step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. github context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with env: to store the data and use the environment variable in the run: script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".

Severity: HIGH

Learn more about this issue

Jit Bot commands and options (e.g., ignore issue)

You can trigger Jit actions by commenting on this PR review:

#jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”

#jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”

#jit_ignore_type_in_file Ignore any finding of type "yaml.github-actions.security.run-shell-injection.run-shell-injection" in .github/actions/build-and-tag-locally/action.yml; future occurrences will also be ignored.

#jit_undo_ignore Undo ignore command

jit-ci · 2025-12-17T09:23:58Z

.github/workflows/build_release_automation.yml

+            echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
+          else
+            echo "ℹ️ **Image built locally only (not pushed)**" >> $GITHUB_STEP_SUMMARY
+          fi


Security control: Static Code Analysis Semgrep Pro

Yaml.Github-Actions.Security.Run-Shell-Injection.Run-Shell-Injection

Using variable interpolation ${{...}} with github context data in a run: step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. github context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with env: to store the data and use the environment variable in the run: script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".

Severity: HIGH

Learn more about this issue

Jit Bot commands and options (e.g., ignore issue)

You can trigger Jit actions by commenting on this PR review:

#jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”

#jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”

#jit_ignore_type_in_file Ignore any finding of type "yaml.github-actions.security.run-shell-injection.run-shell-injection" in .github/workflows/build_release_automation.yml; future occurrences will also be ignored.

#jit_undo_ignore Undo ignore command

jit-ci · 2025-12-17T09:23:58Z

.github/actions/create-image-labels/action.yml

+        if [ -z "${{ inputs.redistimeseries_version }}" ]; then
+          echo redistimeseries_version=$(get_module_version redistimeseries) >> $GITHUB_ENV
+        fi
+


Security control: Static Code Analysis Semgrep Pro

Yaml.Github-Actions.Security.Run-Shell-Injection.Run-Shell-Injection

Using variable interpolation ${{...}} with github context data in a run: step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. github context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with env: to store the data and use the environment variable in the run: script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".

Severity: HIGH

Learn more about this issue

Jit Bot commands and options (e.g., ignore issue)

You can trigger Jit actions by commenting on this PR review:

#jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”

#jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”

#jit_ignore_type_in_file Ignore any finding of type "yaml.github-actions.security.run-shell-injection.run-shell-injection" in .github/actions/create-image-labels/action.yml; future occurrences will also be ignored.

#jit_undo_ignore Undo ignore command

jit-ci · 2025-12-17T09:23:58Z

.github/workflows/build-n-test.yml

+          . ${GITHUB_WORKSPACE}/.github/actions/common/func.sh
+
+          slack_format_failure_message "Docker Build failed for Redis: ${{ inputs.release_tag  || 'unknown'}}" "$workflow_url" "$footer" \
+          | curl -s --fail-with-body -d@- "${{ secrets.SLACK_WEB_HOOK_URL }}"


Security control: Static Code Analysis Semgrep Pro

Yaml.Github-Actions.Security.Run-Shell-Injection.Run-Shell-Injection

Using variable interpolation ${{...}} with github context data in a run: step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. github context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with env: to store the data and use the environment variable in the run: script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".

Severity: HIGH

Learn more about this issue

Jit Bot commands and options (e.g., ignore issue)

You can trigger Jit actions by commenting on this PR review:

#jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”

#jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”

#jit_ignore_type_in_file Ignore any finding of type "yaml.github-actions.security.run-shell-injection.run-shell-injection" in .github/workflows/build-n-test.yml; future occurrences will also be ignored.

#jit_undo_ignore Undo ignore command

jit-ci · 2025-12-17T09:23:58Z

.github/actions/build-and-tag-locally/action.yml

+            echo "Wrong custom_build type, available options are tag, branch and commit"
+            exit 1
+        fi
+


Security control: Static Code Analysis Semgrep Pro

Yaml.Github-Actions.Security.Run-Shell-Injection.Run-Shell-Injection

Using variable interpolation ${{...}} with github context data in a run: step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. github context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with env: to store the data and use the environment variable in the run: script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".

Severity: HIGH

Learn more about this issue

Jit Bot commands and options (e.g., ignore issue)

You can trigger Jit actions by commenting on this PR review:

#jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”

#jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”

#jit_ignore_type_in_file Ignore any finding of type "yaml.github-actions.security.run-shell-injection.run-shell-injection" in .github/actions/build-and-tag-locally/action.yml; future occurrences will also be ignored.

#jit_undo_ignore Undo ignore command

jit-ci · 2025-12-17T09:23:58Z

release-automation/docker/Dockerfile

+ENV PATH="/release-automation/.venv/bin:${PATH}"
+
+ENTRYPOINT ["release-automation"]
+CMD ["--help"]


Security control: Static Code Analysis Semgrep Pro

Dockerfile.Security.Missing-User.Missing-User

By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'.

Severity: HIGH

Learn more about this issue

Jit Bot commands and options (e.g., ignore issue)

You can trigger Jit actions by commenting on this PR review:

#jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”

#jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”

#jit_ignore_type_in_file Ignore any finding of type "dockerfile.security.missing-user.missing-user" in release-automation/docker/Dockerfile; future occurrences will also be ignored.

#jit_undo_ignore Undo ignore command

jit-ci · 2025-12-17T09:23:58Z

.github/actions/build-and-tag-locally/action.yml

+        else
+          echo "Image not published for this platform/distribution combination"
+        fi
+


Security control: Static Code Analysis Semgrep Pro

Yaml.Github-Actions.Security.Run-Shell-Injection.Run-Shell-Injection

Using variable interpolation ${{...}} with github context data in a run: step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. github context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with env: to store the data and use the environment variable in the run: script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".

Severity: HIGH

Learn more about this issue

Jit Bot commands and options (e.g., ignore issue)

You can trigger Jit actions by commenting on this PR review:

#jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”

#jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”

#jit_ignore_type_in_file Ignore any finding of type "yaml.github-actions.security.run-shell-injection.run-shell-injection" in .github/actions/build-and-tag-locally/action.yml; future occurrences will also be ignored.

#jit_undo_ignore Undo ignore command

jit-ci · 2025-12-17T09:23:58Z

.github/actions/apply-docker-version/action.yml

+      shell: bash
+      run: |
+        ${{ github.action_path }}/apply-docker-version.sh ${{ inputs.release_tag }}
+


Security control: Static Code Analysis Semgrep Pro

Yaml.Github-Actions.Security.Run-Shell-Injection.Run-Shell-Injection

Using variable interpolation ${{...}} with github context data in a run: step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. github context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with env: to store the data and use the environment variable in the run: script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".

Severity: HIGH

Learn more about this issue

Jit Bot commands and options (e.g., ignore issue)

You can trigger Jit actions by commenting on this PR review:

#jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”

#jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”

#jit_ignore_type_in_file Ignore any finding of type "yaml.github-actions.security.run-shell-injection.run-shell-injection" in .github/actions/apply-docker-version/action.yml; future occurrences will also be ignored.

#jit_undo_ignore Undo ignore command

jit-ci · 2025-12-17T09:23:58Z

.github/workflows/release_build_and_test.yml

+
+          echo "Created result.json for release_handle:"
+          cat result.json
+


Security control: Static Code Analysis Semgrep Pro

Yaml.Github-Actions.Security.Run-Shell-Injection.Run-Shell-Injection

Using variable interpolation ${{...}} with github context data in a run: step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. github context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with env: to store the data and use the environment variable in the run: script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".

Severity: HIGH

Learn more about this issue

Jit Bot commands and options (e.g., ignore issue)

You can trigger Jit actions by commenting on this PR review:

#jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”

#jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”

#jit_ignore_type_in_file Ignore any finding of type "yaml.github-actions.security.run-shell-injection.run-shell-injection" in .github/workflows/release_build_and_test.yml; future occurrences will also be ignored.

#jit_undo_ignore Undo ignore command

Peter-Sh and others added 30 commits August 4, 2025 14:45

Release 8.2.0

5459e30

Merge remote-tracking branch 'origin/release/8.2' into release/8.2

e19e964

Bump Redis version to 8.2.1 (#469)

a13b788

- Update REDIS_DOWNLOAD_URL to use official Redis 8.2.1 release - Update REDIS_DOWNLOAD_SHA to e2c1cb9dd4180a35b943b85dfc7dcdd42566cdbceca37d0d0b14c21731582d3e

First branch manipulation implementation

bb9ce95

Fix workflow

bced1da

Fix yaml

36d63fc

Fix path to actions

6d12d22

Fix push empty branches

d067295

Use different runner

b82ea9d

Pretty output

32823d7

Fix execut command

efe9b17

Use common base

68817c7

Add validate archive action

3041ccd

Make executable

5637a31

Make curl return error

c17467a

Make curl silent

1d00759

Try to use pre-merge.yml

a86989c

allow-modify flag

5f6fccc

Fix workflow

8e1e9ad

Fix worflow reuse

b981b62

Fixed required property type

0786970

Remove runs-on

d7507d3

Add apply-docker-version

d3d5043

Use explicit branch name

21faa0e

Branches doesn't work with local versions

8805777

Add bot name

3a85e67

Try locl config

2262399

Use --author

cc1dd2a

debug output

0a7159a

Auto merge from release branch

d158d12

github-actions bot and others added 28 commits November 12, 2025 12:21

Merge 8.4-int into release/8.4 (bot)

e4bcc76

8.4-int2

c9a48e2

Merge 8.4-int2 into release/8.4 (bot)

debf3da

8.4-int3

fb3a390

Merge 8.4-int3 into release/8.4 (bot)

4ba3e19

8.4.0

e6740a2

Merge 8.4.0 into release/8.4 (bot)

de8bb5f

Use uv and lock versions

083c9af

Fix stackbrew generation when 8.X and 8.X.Y formats are mixed toghether

e2ead16

Update to recent RedisVersion with fixes in sorting and comparison Add mixed format tests for mixed use-case, e.g. when 8.4.0 is ga and 8.4-rc1 is rc.

Update test run to use uv

f956eda

Fix tests

96ac2d9

Merge pull request #491 from redis/fix_stackbrew_generation

825351f

Fix stackbrew generation when 8.X and 8.X.Y formats are mixed toghether

Updates Debian base image to Trixie (#494)

ec9d20f

Merge remote-tracking branch 'origin/release/8.4' into unstable-align…

fe29f68

…ment Add release automation to unstable branch

Add build args, custom_build and test workflows

dcc3de4

- Added build args in dockerfile for moduels and redis version - Added custom_build input to use in dockerfile and build-and-tag-locally - Created test workflow to run unsable build

Added branch reference in test-nightly-unstable

1f83bee

Use pre-merge workflow in unstable-alignment

559f9fd

Fixed Redis archive script for custom_build

f6d45b9

Fixed build-push-action build-args

1563821

Fix CUSTOM_BUILD if syntax in Dockerfile

db04639

Use double quotes in modules version sed

cc197f0

Change tag prefix and enable pushing images

e27f3af

Fix create-image-labels action

68f564e

Added run_type input

948927c

- Support custom, unstable, nightly and release - Added changes to release_build_and_test

Synced test and release-automation with release/8.4

3b08b3b

Remove cache in docker build for non-release

e612b21

Added pull-request workflows

178d8f6

- pull-request.yml workflow for PR for unstable and release branches - renamed custom_build to custom_ref_type - renamed pre-merge to build-n-test - removed nightly test workflow

Run format-registry-tag step if required

de587d7

jit-ci bot reviewed Dec 17, 2025

View reviewed changes

kalinstaykov approved these changes Dec 17, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Unstable alignment #495

Unstable alignment #495

Uh oh!

dariaguy commented Dec 17, 2025

Uh oh!

jit-ci bot left a comment

Uh oh!

jit-ci bot Dec 17, 2025

Uh oh!

jit-ci bot Dec 17, 2025

Uh oh!

jit-ci bot Dec 17, 2025

Uh oh!

jit-ci bot Dec 17, 2025

Uh oh!

jit-ci bot Dec 17, 2025

Uh oh!

jit-ci bot Dec 17, 2025

Uh oh!

jit-ci bot Dec 17, 2025

Uh oh!

jit-ci bot Dec 17, 2025

Uh oh!

jit-ci bot Dec 17, 2025

Uh oh!

jit-ci bot Dec 17, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants


		echo "Created result.json for release_handle:"
		cat result.json

Unstable alignment #495

Are you sure you want to change the base?

Unstable alignment #495

Uh oh!

Conversation

dariaguy commented Dec 17, 2025

Uh oh!

jit-ci bot left a comment

Choose a reason for hiding this comment

Uh oh!

jit-ci bot Dec 17, 2025

Choose a reason for hiding this comment

Uh oh!

jit-ci bot Dec 17, 2025

Choose a reason for hiding this comment

Uh oh!

jit-ci bot Dec 17, 2025

Choose a reason for hiding this comment

Uh oh!

jit-ci bot Dec 17, 2025

Choose a reason for hiding this comment

Uh oh!

jit-ci bot Dec 17, 2025

Choose a reason for hiding this comment

Uh oh!

jit-ci bot Dec 17, 2025

Choose a reason for hiding this comment

Uh oh!

jit-ci bot Dec 17, 2025

Choose a reason for hiding this comment

Uh oh!

jit-ci bot Dec 17, 2025

Choose a reason for hiding this comment

Uh oh!

jit-ci bot Dec 17, 2025

Choose a reason for hiding this comment

Uh oh!

jit-ci bot Dec 17, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants