From 65066e38a0eca26c26af34acda3e3b538af47a74 Mon Sep 17 00:00:00 2001 From: "Paulo F. Oliveira" Date: Fri, 30 May 2025 01:57:00 +0100 Subject: [PATCH] Act on CodeQL's suggestions for tightening security / improving performance (#338) * Act on CodeQL's actions/missing-workflow-permissions https://codeql.github.com/codeql-query-help/actions/actions-missing-workflow-permissions/ * Be more specific in the matched regex And don't match a group if we don't need to match one * Make it slightly faster since we know what after -otp- I create a const because both expressions are looking for the same thing --- .github/workflows/action.yml | 9 +++------ .github/workflows/hexpm-mirrors.yml | 3 +++ .github/workflows/macos.yml | 1 + .github/workflows/ubuntu.yml | 3 +++ .github/workflows/update_3rd_party_licenses.yml | 3 +++ .github/workflows/windows.yml | 3 +++ dist/index.js | 7 ++++--- src/setup-beam.js | 7 ++++--- 8 files changed, 24 insertions(+), 12 deletions(-) diff --git a/.github/workflows/action.yml b/.github/workflows/action.yml index d00e4e9..f89f31c 100644 --- a/.github/workflows/action.yml +++ b/.github/workflows/action.yml @@ -1,6 +1,9 @@ --- name: action +permissions: + contents: read + on: push: branches: @@ -41,8 +44,6 @@ jobs: name: Expected local npm actions runs-on: ubuntu-latest if: github.ref != 'refs/heads/main' - permissions: - contents: read steps: - uses: actions/checkout@v4 - uses: actions/setup-node@v4 @@ -56,8 +57,6 @@ jobs: name: Action runs-on: ubuntu-latest if: github.ref != 'refs/heads/main' - permissions: - contents: read steps: - uses: actions/checkout@v4 - uses: raven-actions/actionlint@v2 @@ -94,8 +93,6 @@ jobs: unit_tests_macos: name: Unit tests (macOS) runs-on: macos-latest - permissions: - contents: read steps: - uses: actions/checkout@v4 - uses: actions/setup-node@v4 diff --git a/.github/workflows/hexpm-mirrors.yml b/.github/workflows/hexpm-mirrors.yml index 211a5c7..da65c0d 100644 --- a/.github/workflows/hexpm-mirrors.yml +++ b/.github/workflows/hexpm-mirrors.yml @@ -1,6 +1,9 @@ --- name: hexpm-mirrors +permissions: + contents: read + on: push: branches: diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml index b2d0477..44823a0 100644 --- a/.github/workflows/macos.yml +++ b/.github/workflows/macos.yml @@ -1,5 +1,6 @@ --- name: macos + permissions: contents: read diff --git a/.github/workflows/ubuntu.yml b/.github/workflows/ubuntu.yml index 950da5e..a01d72e 100644 --- a/.github/workflows/ubuntu.yml +++ b/.github/workflows/ubuntu.yml @@ -1,6 +1,9 @@ --- name: ubuntu +permissions: + contents: read + on: push: branches: diff --git a/.github/workflows/update_3rd_party_licenses.yml b/.github/workflows/update_3rd_party_licenses.yml index 318fa19..627df10 100644 --- a/.github/workflows/update_3rd_party_licenses.yml +++ b/.github/workflows/update_3rd_party_licenses.yml @@ -1,6 +1,9 @@ --- name: Update 3rd party licenses (automation) +permissions: + contents: write + on: schedule: - cron: '0 12 * * *' diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml index d7a4dca..ebfcbd8 100644 --- a/.github/workflows/windows.yml +++ b/.github/workflows/windows.yml @@ -1,6 +1,9 @@ --- name: windows +permissions: + contents: read + on: push: branches: diff --git a/dist/index.js b/dist/index.js index 297f37b..b6c341c 100644 --- a/dist/index.js +++ b/dist/index.js @@ -26068,10 +26068,11 @@ function requestedVersionFor(tool, version, originListing, mirrors) { } async function getElixirVersion(exSpec0, otpVersion0) { - const otpVersion = otpVersion0.match(/^([^-]+-)?(.+)$/)[2] + const otpVersion = otpVersion0.match(/^(?:OTP-)?(.+)$/)[1] let otpVersionMajor = otpVersion.match(/^([^.]+).*$/)[1] - const userSuppliedOtp = exSpec0.match(/-otp-(\d+)/)?.[1] ?? null + const otpSuffix = /-otp-(\d+)/ + const userSuppliedOtp = exSpec0.match(otpSuffix)?.[1] ?? null if (userSuppliedOtp && isVersion(userSuppliedOtp)) { otpVersionMajor = userSuppliedOtp @@ -26079,7 +26080,7 @@ async function getElixirVersion(exSpec0, otpVersion0) { const [otpVersionsForElixirMap, elixirVersions, originListing, hexMirrors] = await getElixirVersions() - const spec = exSpec0.replace(/-otp-.*$/, '') + const spec = exSpec0.replace(otpSuffix, '') const versions = elixirVersions const elixirVersionFromSpec = getVersionFromSpec(spec, versions) diff --git a/src/setup-beam.js b/src/setup-beam.js index 7be1178..87319fb 100644 --- a/src/setup-beam.js +++ b/src/setup-beam.js @@ -193,10 +193,11 @@ function requestedVersionFor(tool, version, originListing, mirrors) { } async function getElixirVersion(exSpec0, otpVersion0) { - const otpVersion = otpVersion0.match(/^([^-]+-)?(.+)$/)[2] + const otpVersion = otpVersion0.match(/^(?:OTP-)?(.+)$/)[1] let otpVersionMajor = otpVersion.match(/^([^.]+).*$/)[1] - const userSuppliedOtp = exSpec0.match(/-otp-(\d+)/)?.[1] ?? null + const otpSuffix = /-otp-(\d+)/ + const userSuppliedOtp = exSpec0.match(otpSuffix)?.[1] ?? null if (userSuppliedOtp && isVersion(userSuppliedOtp)) { otpVersionMajor = userSuppliedOtp @@ -204,7 +205,7 @@ async function getElixirVersion(exSpec0, otpVersion0) { const [otpVersionsForElixirMap, elixirVersions, originListing, hexMirrors] = await getElixirVersions() - const spec = exSpec0.replace(/-otp-.*$/, '') + const spec = exSpec0.replace(otpSuffix, '') const versions = elixirVersions const elixirVersionFromSpec = getVersionFromSpec(spec, versions)