Fix three code bugs #1
Draft
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
- Use docker login --password-stdin to avoid leaking credentials - Quote variables; add set -eu for safety; add shebangs - Make uploadtoazure.sh POSIX-compliant; create container idempotently; unique blob names - Make preserveimage.sh resilient with mkdir -p; quote paths - Make buildsamples.sh robust: locate buildtarget.txt and handle spaces - Clean builder container before reuse; fix paths inside container
|
Cursor Agent can help with this pull request. Just |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes for CI Script Security, Robustness, and Portability
Summary
This PR addresses three bugs in CI scripts: an insecure Docker login, fragile build script logic, and an unportable/incorrect Azure upload process, along with general script hardening.
Details
This PR implements several fixes across the CI shell scripts to improve security, robustness, and portability:
Docker Login Security (
ci-scripts/dockerprovision.sh):docker login -pcommand exposes the password in process arguments.echo "$DOCKER_PW" | docker login --password-stdin, preventing password exposure inpsoutput and logs.docker createuses a clean name anddocker pullanddocker commituse quoted variables.buildtarget.txtis now overwritten withprintfinstead of appended.Build Script Robustness (
ci-scripts/buildsamples.sh):buildtarget.txtand used unquoted command substitution for file iteration, failing on paths with spaces.buildtarget.txtlocation logic and refactored the project iteration to usefind ... -exec sh -c 'for f do ... "$f" ...' sh {} +, safely handling spaces in file paths.dockerprovision.shscript now copiesbuildsamples.shandbuildtarget.txtto absolute paths within the container and invokesbuildsamples.shusing its absolute path for reliability.Azure Upload Portability and Correctness (
ci-scripts/uploadtoazure.sh):[[ ... ]]syntax, causing errors in strict/bin/shenvironments, and uploaded all files with a single blob name, risking overwrites.[[ ... ]]with POSIX-compliant[ ... ], made container creation idempotent (azure storage container create ... || true), and ensured each uploaded artifact gets a unique blob name ($BUILD_BUILDNUMBER-$(basename "$file")).General Hardening:
#!/usr/bin/env shshebangs andset -eutoinstallazcli.sh,preserveimage.sh,dockerprovision.sh,buildsamples.sh, anduploadtoazure.shfor better script robustness and error handling.mkdir -pand quoted paths are used inpreserveimage.sh.