Skip to content

feat(upload-cdk-source): run on the node24 runtime, implemented in TypeScript #270

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
joakimen merged 1 commit into from
Sep 15, 2026
Merged

feat(upload-cdk-source): run on the node24 runtime, implemented in TypeScript #270

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
33 changes: 33 additions & 0 deletions .github/workflows/tests.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -532,3 +532,36 @@ jobs:
ASSERT_EXPECTED: "failure"
ASSERT_GOT: ${{ steps.act-aikido-scan-missing-required-input-should-fail.outcome }}
run: test "$ASSERT_GOT" = "$ASSERT_EXPECTED"
######################################################
#
# test: upload-cdk-source
#
######################################################
- name: arrange-upload-cdk-source
id: arrange-upload-cdk-source
run: ./upload-cdk-source/test.sh arrange
- uses: ./upload-cdk-source
name: act-upload-cdk-source
id: act-upload-cdk-source
with:
aws-s3-bucket-name: ${{ steps.act-parse-config.outputs.artifactBucket }}
cdk-app-dir: ${{ steps.arrange-upload-cdk-source.outputs.dir }}
- name: assert-upload-cdk-source
id: assert-upload-cdk-source
env:
ARTIFACT_BUCKET: ${{ steps.act-parse-config.outputs.artifactBucket }}
METADATA_FILE: ${{ steps.act-upload-cdk-source.outputs.cdk-source-metadata-file }}
run: ./upload-cdk-source/test.sh assert
- uses: ./upload-cdk-source
name: act-upload-cdk-source-without-cdk-json-should-fail
id: act-upload-cdk-source-without-cdk-json-should-fail
continue-on-error: true
with:
aws-s3-bucket-name: ${{ steps.act-parse-config.outputs.artifactBucket }}
cdk-app-dir: ${{ runner.temp }}
- name: assert-upload-cdk-source-without-cdk-json-should-fail
id: assert-upload-cdk-source-without-cdk-json-should-fail
env:
ASSERT_EXPECTED: "failure"
ASSERT_GOT: ${{ steps.act-upload-cdk-source-without-cdk-json-should-fail.outcome }}
run: test "$ASSERT_GOT" = "$ASSERT_EXPECTED"
2 changes: 1 addition & 1 deletion README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ Below is a summary of the actions in the library and a short description of what
| [`parse-config`](parse-config/action.yml) | Parse and validate a JSON configuration and expose the configuration as separate outputs | `node24` | ✅ |
| [`slack-notify`](slack-notify/action.yml) | Send notifications to Slack | `node24` | ❌ |
| [`trigger-deployment-pipeline`](trigger-deployment-pipeline/action.yml) | Trigger Liflig CDK Pipelines in AWS | `composite` | ✅ |
| [`upload-cdk-source`](upload-cdk-source/action.yml) | Create and upload an archive of the CDK source to use during deployment of a Liflig CDK Pipeline | `composite` | ✅ |
| [`upload-cdk-source`](upload-cdk-source/action.yml) | Create and upload an archive of the CDK source to use during deployment of a Liflig CDK Pipeline | `node24` | ✅ |
| [`upload-cloud-assembly`](upload-cloud-assembly/action.yml) | Create and upload an archive of the CDK source to use during deployment of a Liflig CDK Pipeline | `composite` | ✅ |
| [`upload-s3-artifact`](upload-s3-artifact/action.yml) | Upload a file or directory to S3 | `node24` | ✅ |
<!-- ACTION_TABLE_END -->
16 changes: 15 additions & 1 deletion lib/archive.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -87,9 +87,23 @@ function collect(root: string, starts: readonly string[]): Entry[] {
* matters for anything that is run rather than read after deployment.
*/
export function zipDirectory(directory: string): Result<Uint8Array> {
return archive(directory, [directory])
}

/**
* Archives `names`, which are relative to `root`, recursing into any that are
* directories. Entry names stay relative to `root`.
*/
export const zipPaths = (
root: string,
names: readonly string[],
): Result<Uint8Array> => archive(root, names.map((name) => join(root, name)))

@aikido-pr-checks aikido-pr-checks Bot Sep 11, 2026 •
edited
Loading

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Potential file inclusion attack via reading file - high severity
If an attacker can control the input leading into the ReadFile function, they might be able to read sensitive files and launch further attacks with that information.

Show fix
Suggested change
): Result<Uint8Array> => archive(root, names.map((name) => join(root, name)))
): Result<Uint8Array> => {
const resolvedRoot = path.resolve(root);
const validatedPaths = names.map((name) => {
const target = path.resolve(resolvedRoot, name);
const relative = path.relative(resolvedRoot, target);
if (relative.startsWith('..') || path.isAbsolute(relative)) {
throw new Error('Invalid path');
}
return target;
});
return archive(root, validatedPaths);
}

Reply @AikidoSec ignore: [REASON] to ignore this issue.
More info

@joakimen joakimen Sep 11, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@AikidoSec ignore: reads a path the workflow author supplies, who already has code execution in the job;

@aikido-pr-checks aikido-pr-checks Bot Sep 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ Based on your feedback, we ignored this issue because of the following reason:

reads a path the workflow author supplies, who already has code execution in the job;


function archive(root: string, starts: readonly string[]): Result<Uint8Array> {
const directory = root
let entries: Entry[]
try {
entries = collect(directory, [directory])
entries = collect(root, starts)
} catch (cause) {
return err(
`Failed to read '${directory}': ${cause instanceof Error ? cause.message : String(cause)}`,
Expand Down
61 changes: 0 additions & 61 deletions upload-cdk-source/action.sh
View file
Open in desktop

This file was deleted.

27 changes: 2 additions & 25 deletions upload-cdk-source/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,29 +18,6 @@ inputs:
outputs:
cdk-source-metadata-file:
description: "The path to a file describing the S3 bucket and S3 key of the uploaded CDK source"
value: ${{ steps.upload.outputs.cdk-source-metadata-file }}
runs:
using: "composite"
steps:
- name: create and upload cdk source
id: upload
shell: bash --noprofile --norc -euo pipefail {0}
env:
INPUT_AWS_S3_BUCKET_NAME: ${{ inputs.aws-s3-bucket-name }}
INPUT_INCLUDE_FILES: ${{ inputs.include-files }}
INPUT_CDK_APP_DIR: ${{ inputs.cdk-app-dir }}
run: |
cdk_source_dir="${INPUT_CDK_APP_DIR:-$GITHUB_WORKSPACE}"
cd "$cdk_source_dir"
tmp_dir="/tmp/${GITHUB_ACTION:-$(date -u +%s)}"
mkdir -p "$tmp_dir"
cdk_source_archive="$tmp_dir/cdk-source.zip"
if [ ! -f "cdk.json" ]; then
echo "No cdk.json file found in '$cdk_source_dir'. You may need to set the 'cdk-app-dir' input."
exit 1
fi

bash "$GITHUB_ACTION_PATH/action.sh" \
--aws-s3-bucket-name "$INPUT_AWS_S3_BUCKET_NAME" \
--cdk-source-archive "$cdk_source_archive" \
--include-files "$INPUT_INCLUDE_FILES"
using: "node24"
main: "dist/index.mjs"
Loading
Loading