github-advanced-security[bot] commented on code in PR #39436:
URL: https://github.com/apache/beam/pull/39436#discussion_r3631632227
##########
.github/workflows/beam_Publish_Beam_SDK_Snapshots.yml:
##########
@@ -127,3 +125,67 @@
-Pcontainer-architecture-list=arm64,amd64 \
-Ppush-containers \
-Pdocker-pull-licenses
+
+ beam_Publish_Beam_SDK_Snapshots_py314:
+ needs: beam_Publish_Beam_SDK_Snapshots
+ if: |
+ always() &&
+ !cancelled() &&
+ (github.event_name == 'workflow_dispatch' ||
+ (github.event_name == 'schedule' && github.repository == 'apache/beam'))
+ runs-on: [self-hosted, ubuntu-24.04, main]
+ timeout-minutes: 300
+ name: ${{ matrix.job_name }} (${{ matrix.container_task }})
+ strategy:
+ fail-fast: false
+ matrix:
+ job_name: ["beam_Publish_Beam_SDK_Snapshots"]
+ job_phrase: ["N/A"]
+ container_task:
+ - "python:container:py314:docker"
+ - "python:container:distroless:py314:docker"
+ steps:
+ - uses: actions/checkout@v7
+ with:
+ persist-credentials: false
+ - name: Free Disk Space (Ubuntu)
+ uses: jlumbroso/[email protected]
+ - name: Setup repository
+ uses: ./.github/actions/setup-action
+ with:
+ comment_phrase: ${{ matrix.job_phrase }}
+ github_token: ${{ secrets.GITHUB_TOKEN }}
+ github_job: ${{ matrix.job_name }} (${{ matrix.container_task }})
+ - name: Find Beam Version
+ run: |
+ BEAM_VERSION_LINE=$(cat gradle.properties | grep "sdk_version")
+ echo "BEAM_VERSION=${BEAM_VERSION_LINE#*sdk_version=}" >> $GITHUB_ENV
Review Comment:
## CodeQL / Environment variable built from user-controlled sources
Potential environment variable injection in [BEAM_VERSION_LINE=$(cat
gradle.properties | grep "sdk_version")
echo "BEAM_VERSION=${BEAM_VERSION_LINE#*sdk_version=}" >> $GITHUB_ENV](1),
which may be controlled by an external user ([workflow_dispatch](2)).
Potential environment variable injection in [BEAM_VERSION_LINE=$(cat
gradle.properties | grep "sdk_version")
echo "BEAM_VERSION=${BEAM_VERSION_LINE#*sdk_version=}" >> $GITHUB_ENV](1),
which may be controlled by an external user ([workflow_dispatch](2)).
[Show more
details](https://github.com/apache/beam/security/code-scanning/1897)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
