Skip to content

ci: prevent command injection in prevent-deletion workflow#3138

Merged
ti-chi-bot[bot] merged 2 commits into
pingcap:mainfrom
Oreoxmt:fix-prevent-deletion
May 26, 2026
Merged

ci: prevent command injection in prevent-deletion workflow#3138
ti-chi-bot[bot] merged 2 commits into
pingcap:mainfrom
Oreoxmt:fix-prevent-deletion

Conversation

@Oreoxmt
Copy link
Copy Markdown
Collaborator

@Oreoxmt Oreoxmt commented May 26, 2026

First-time contributors' checklist

What is changed, added, or deleted? (Required)

Which TiDB Operator version(s) do your changes apply to? (Required)

  • main (the latest development version for v2.x)
  • v2.0 (TiDB Operator 2.0 versions)
  • release-1.x (the latest development version for v1.x)
  • v1.6 (TiDB Operator 1.6 versions)
  • v1.5 (TiDB Operator 1.5 versions)
  • v1.4 (TiDB Operator 1.4 versions)
  • v1.3 (TiDB Operator 1.3 versions)

What is the related PR or file link(s)?

  • This PR is translated from:
  • Other reference link(s):

@Oreoxmt Oreoxmt self-assigned this May 26, 2026
@Oreoxmt Oreoxmt added translation/no-need The changes in this PR don't need to be translated. needs-cherry-pick-release-1.3 Should cherry pick this PR to release-1.3 branch. needs-cherry-pick-release-1.4 Should cherry pick this PR to release-1.4 branch. needs-cherry-pick-release-1.5 Should cherry pick this PR to release-1.5 branch. needs-cherry-pick-release-1.6 Should cherry pick this PR to release-1.6 branch. needs-cherry-pick-release-2.0 Should cherry pick this PR to release-2.0 branch. needs-cherry-pick-release-1.x Should cherry pick this PR to release-1.x branch. labels May 26, 2026
@ti-chi-bot ti-chi-bot Bot added the size/S Denotes a PR that changes 10-29 lines, ignoring generated files. label May 26, 2026
@Oreoxmt Oreoxmt force-pushed the fix-prevent-deletion branch from 9f9a958 to 60fca86 Compare May 26, 2026 03:55
@lilin90 lilin90 requested a review from Copilot May 26, 2026 04:04
Copilot AI reviewed May 26, 2026
View reviewed changes
Copy link
Copy Markdown

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR hardens the prevent-deletion GitHub Actions workflow by avoiding direct interpolation of PR-controlled values into shell commands, reducing command injection risk in a pull_request_target workflow.

Changes:

  • Moves PR head metadata, token, and repository values into step-level environment variables.
  • Quotes shell variable usage in Git, jq, and curl commands.
  • Fetches full history so git diff --merge-base can resolve the correct merge base.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Oreoxmt
Oreoxmt commented May 26, 2026
View reviewed changes
Comment thread .github/workflows/prevent-deletion.yaml Outdated
@Oreoxmt
Apply suggestions from code review
1ec4b21 
Co-authored-by: Aolin <aolinz@outlook.com>
@ti-chi-bot ti-chi-bot Bot added the needs-1-more-lgtm Indicates a PR needs 1 more LGTM. label May 26, 2026
@ti-chi-bot
Copy link
Copy Markdown

ti-chi-bot Bot commented May 26, 2026

[LGTM Timeline notifier]

Timeline:

  • 2026-05-26 05:55:11.409288415 +0000 UTC m=+331581.379453472: ☑️ agreed by qiancai.

@Oreoxmt Oreoxmt added the lgtm label May 26, 2026
@Oreoxmt
Copy link
Copy Markdown
Collaborator Author

Oreoxmt commented May 26, 2026

/approve

@ti-chi-bot
Copy link
Copy Markdown

ti-chi-bot Bot commented May 26, 2026

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Oreoxmt

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@ti-chi-bot ti-chi-bot Bot added the approved label May 26, 2026
@ti-chi-bot ti-chi-bot Bot merged commit 484d323 into pingcap:main May 26, 2026
14 checks passed
@ti-chi-bot ti-chi-bot mentioned this pull request May 26, 2026
Merged
8 tasks
@ti-chi-bot
Copy link
Copy Markdown
Member

ti-chi-bot commented May 26, 2026

In response to a cherrypick label: new pull request created to branch release-1.6: #3139.

@ti-chi-bot ti-chi-bot mentioned this pull request May 26, 2026
Merged
8 tasks
@ti-chi-bot
Copy link
Copy Markdown
Member

ti-chi-bot commented May 26, 2026

In response to a cherrypick label: new pull request created to branch release-2.0: #3140.

@ti-chi-bot
Copy link
Copy Markdown
Member

ti-chi-bot commented May 26, 2026

In response to a cherrypick label: new pull request created to branch release-1.x: #3141.

@ti-chi-bot ti-chi-bot mentioned this pull request May 26, 2026
Merged
8 tasks
@ti-chi-bot
Copy link
Copy Markdown
Member

ti-chi-bot commented May 26, 2026

In response to a cherrypick label: new pull request created to branch release-1.3: #3142.
But this PR has conflicts, please resolve them!

@ti-chi-bot ti-chi-bot mentioned this pull request May 26, 2026
Merged
8 tasks
@ti-chi-bot
Copy link
Copy Markdown
Member

ti-chi-bot commented May 26, 2026

In response to a cherrypick label: new pull request created to branch release-1.4: #3143.
But this PR has conflicts, please resolve them!

@ti-chi-bot ti-chi-bot mentioned this pull request May 26, 2026
Merged
8 tasks
@ti-chi-bot
Copy link
Copy Markdown
Member

ti-chi-bot commented May 26, 2026

In response to a cherrypick label: new pull request created to branch release-1.5: #3144.
But this PR has conflicts, please resolve them!

@ti-chi-bot ti-chi-bot mentioned this pull request May 26, 2026
Merged
8 tasks
Oreoxmt added a commit to ti-chi-bot/docs-tidb-operator that referenced this pull request May 26, 2026
@Oreoxmt
ci: prevent command injection in prevent-deletion workflow (pingcap#3138
998fdac 
)
Oreoxmt added a commit to ti-chi-bot/docs-tidb-operator that referenced this pull request May 26, 2026
@Oreoxmt
ci: prevent command injection in prevent-deletion workflow (pingcap#3138
41898fc 
)
Oreoxmt added a commit to ti-chi-bot/docs-tidb-operator that referenced this pull request May 26, 2026
@Oreoxmt
ci: prevent command injection in prevent-deletion workflow (pingcap#3138
ab3b94f 
)
ti-chi-bot Bot pushed a commit that referenced this pull request May 26, 2026
@ti-chi-bot
ci: prevent command injection in prevent-deletion workflow (#3138) (#…
9d07a6f 
…3140)
ti-chi-bot Bot pushed a commit that referenced this pull request May 26, 2026
@ti-chi-bot
ci: prevent command injection in prevent-deletion workflow (#3138) (#…
38e4355 
…3143)
ti-chi-bot Bot pushed a commit that referenced this pull request May 26, 2026
@ti-chi-bot
ci: prevent command injection in prevent-deletion workflow (#3138) (#…
ba0582f 
…3142)
ti-chi-bot Bot pushed a commit that referenced this pull request May 26, 2026
@ti-chi-bot
ci: prevent command injection in prevent-deletion workflow (#3138) (#…
343c684 
…3144)
ti-chi-bot Bot pushed a commit that referenced this pull request May 26, 2026
@ti-chi-bot
ci: prevent command injection in prevent-deletion workflow (#3138) (#…
552d3ac 
…3139)
ti-chi-bot Bot pushed a commit that referenced this pull request May 26, 2026
@ti-chi-bot
ci: prevent command injection in prevent-deletion workflow (#3138) (#…
cc6cab1 
…3141)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments

@qiancai qiancai qiancai approved these changes

Assignees

@Oreoxmt Oreoxmt

Labels

approved lgtm needs-1-more-lgtm Indicates a PR needs 1 more LGTM. needs-cherry-pick-release-1.x Should cherry pick this PR to release-1.x branch. needs-cherry-pick-release-1.3 Should cherry pick this PR to release-1.3 branch. needs-cherry-pick-release-1.4 Should cherry pick this PR to release-1.4 branch. needs-cherry-pick-release-1.5 Should cherry pick this PR to release-1.5 branch. needs-cherry-pick-release-1.6 Should cherry pick this PR to release-1.6 branch. needs-cherry-pick-release-2.0 Should cherry pick this PR to release-2.0 branch. size/S Denotes a PR that changes 10-29 lines, ignoring generated files. translation/no-need The changes in this PR don't need to be translated.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@Oreoxmt @ti-chi-bot @qiancai