[ STRATCONN-6907 : Algolia-insights ] : Fixed the appId accepts URL path injection and forwards masked API keys to attacker hosts #15971
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: | |
| - main | |
| pull_request: | |
| # Curated Artifactory dependency resolution via OIDC. | |
| # The artifactory-oidc composite action reads this to build the registry URL. | |
| env: | |
| ARTIFACTORY_URL: ${{ vars.ARTIFACTORY_URL }} | |
| jobs: | |
| test: | |
| name: Unit tests | |
| runs-on: ubuntu-latest-large | |
| timeout-minutes: 30 | |
| # id-token: write is required so the artifactory-oidc action can mint a token. | |
| # actions: read is required to look up the last successful run's SHA for NX_BASE below. | |
| permissions: | |
| contents: read | |
| id-token: write | |
| actions: read | |
| strategy: | |
| matrix: | |
| node-version: [22.x] | |
| steps: | |
| # See nx recipe: https://nx.dev/recipes/ci/monorepo-ci-github-actions | |
| - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| with: | |
| persist-credentials: false | |
| fetch-depth: 0 # nx recipe | |
| - name: Use Node.js ${{ matrix.node-version }} | |
| uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 | |
| with: | |
| node-version: ${{ matrix.node-version }} | |
| registry-url: 'https://registry.npmjs.org' | |
| cache: yarn | |
| # Must run AFTER setup-node: setup-node writes its own ~/.npmrc | |
| # (registry-url above), which would otherwise clobber the Artifactory | |
| # registry this step configures. Skips automatically until ARTIFACTORY_URL | |
| # is set as a repo variable. | |
| - name: Artifactory OIDC Auth | |
| if: ${{ env.ARTIFACTORY_URL != '' }} | |
| uses: ./.github/actions/artifactory-oidc | |
| - name: Use GitHub Personal Access Token | |
| run: git config --global url."https://${{ secrets.GH_PAT }}@github.com/".insteadOf ssh://git@github.com/ | |
| - name: Derive Nx base/head SHAs | |
| # Replaces nrwl/nx-set-shas (blocked by org policy: only GitHub-owned | |
| # actions are allowed). Mirrors its non-Cloud behavior: for PRs, diff | |
| # against the true merge-base of the PR; for pushes, diff against the | |
| # last successful run on this branch (falling back to HEAD~1). | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| EVENT_NAME: ${{ github.event_name }} | |
| PR_BASE_SHA: ${{ github.event.pull_request.base.sha }} | |
| PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }} | |
| CURRENT_SHA: ${{ github.sha }} | |
| REPOSITORY: ${{ github.repository }} | |
| REF_NAME: ${{ github.ref_name }} | |
| run: | | |
| set -euo pipefail | |
| if [ "$EVENT_NAME" = "pull_request" ]; then | |
| BASE_SHA=$(git merge-base "$PR_BASE_SHA" "$PR_HEAD_SHA") | |
| HEAD_SHA="$PR_HEAD_SHA" | |
| else | |
| HEAD_SHA="$CURRENT_SHA" | |
| LAST_SUCCESS_SHA=$(gh api "repos/$REPOSITORY/actions/workflows/ci.yml/runs?branch=$REF_NAME&status=success&per_page=1" --jq '.workflow_runs[0].head_sha // empty' || true) | |
| BASE_SHA="${LAST_SUCCESS_SHA:-$(git rev-parse HEAD~1 2>/dev/null || git rev-parse HEAD)}" | |
| fi | |
| echo "NX_BASE=$BASE_SHA" >> "$GITHUB_ENV" | |
| echo "NX_HEAD=$HEAD_SHA" >> "$GITHUB_ENV" | |
| echo "Nx base: $BASE_SHA" | |
| echo "Nx head: $HEAD_SHA" | |
| - name: Install Dependencies | |
| run: yarn install --frozen-lockfile | |
| env: | |
| NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} | |
| - name: Build (Affected) | |
| run: NODE_ENV=production yarn nx affected -t build --parallel=3 # nx recipe | |
| - name: Test (Affected) | |
| run: yarn nx affected -t test --parallel=3 # nx recipe | |
| lint: | |
| name: Lint | |
| runs-on: ubuntu-latest-large | |
| timeout-minutes: 20 | |
| permissions: | |
| contents: read | |
| id-token: write | |
| strategy: | |
| matrix: | |
| node-version: [22.x] | |
| steps: | |
| - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| with: | |
| persist-credentials: false | |
| fetch-depth: 0 # nx recipe | |
| - name: Use Node.js ${{ matrix.node-version }} | |
| uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 | |
| with: | |
| node-version: ${{ matrix.node-version }} | |
| registry-url: 'https://registry.npmjs.org' | |
| cache: yarn | |
| - name: Artifactory OIDC Auth | |
| if: ${{ env.ARTIFACTORY_URL != '' }} | |
| uses: ./.github/actions/artifactory-oidc | |
| - name: Install Dependencies | |
| run: yarn install --frozen-lockfile | |
| - name: Build | |
| run: NODE_ENV=production yarn build | |
| - name: Lint | |
| env: | |
| NODE_OPTIONS: '--max-old-space-size=4096' | |
| run: yarn lint | |
| validate: | |
| name: Validate | |
| runs-on: ubuntu-latest-large | |
| timeout-minutes: 20 | |
| permissions: | |
| contents: read | |
| id-token: write | |
| strategy: | |
| matrix: | |
| node-version: [22.x] | |
| steps: | |
| - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| with: | |
| persist-credentials: false | |
| fetch-depth: 0 # nx recipe | |
| - name: Use Node.js ${{ matrix.node-version }} | |
| uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 | |
| with: | |
| node-version: ${{ matrix.node-version }} | |
| registry-url: 'https://registry.npmjs.org' | |
| cache: yarn | |
| - name: Artifactory OIDC Auth | |
| if: ${{ env.ARTIFACTORY_URL != '' }} | |
| uses: ./.github/actions/artifactory-oidc | |
| - name: Install Dependencies | |
| run: yarn install --frozen-lockfile | |
| - name: Assert yarn.lock is up-to-date | |
| run: bash scripts/assert-lockfile-updated.sh | |
| - name: Build | |
| run: NODE_ENV=production yarn build | |
| - name: Validate Definitions | |
| run: yarn validate | |
| - name: Destination Subscription Size | |
| run: | | |
| if $(lerna changed | grep -q destination-subscriptions); then | |
| yarn subscriptions size | |
| fi | |
| - name: Assert generated types are up-to-date | |
| run: bash scripts/assert-types-updated.sh | |
| - name: Assert metadata payloads are up-to-date | |
| run: bash scripts/assert-metadata-payload.sh | |
| browser-destination-bundle-qa: | |
| name: Browser Destination Bundle QA | |
| # env: # Disable saucelabs - we blew through our quota. | |
| # SAUCE_USERNAME: ${{secrets.SAUCE_USERNAME}} | |
| # SAUCE_ACCESS_KEY: ${{secrets.SAUCE_ACCESS_KEY}} | |
| runs-on: ubuntu-latest-large | |
| timeout-minutes: 20 | |
| permissions: | |
| contents: read | |
| id-token: write | |
| strategy: | |
| matrix: | |
| node-version: [22.x] | |
| steps: | |
| - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| with: | |
| persist-credentials: false | |
| - name: Use Node.js ${{ matrix.node-version }} | |
| uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 | |
| with: | |
| node-version: ${{ matrix.node-version }} | |
| registry-url: 'https://registry.npmjs.org' | |
| cache: yarn | |
| - name: Artifactory OIDC Auth | |
| if: ${{ env.ARTIFACTORY_URL != '' }} | |
| uses: ./.github/actions/artifactory-oidc | |
| - name: Install Dependencies | |
| run: yarn install --frozen-lockfile | |
| - name: Build | |
| run: NODE_ENV=production yarn build:browser-bundles | |
| - name: Size Limit | |
| run: yarn browser size | |
| # - name: Run Saucelabs Tests | |
| # working-directory: packages/browser-destinations-integration-tests | |
| # shell: bash | |
| # run: | | |
| # yarn start-destination-server & | |
| # yarn test:sauce | |
| browser-tests-core: | |
| name: 'Browser tests: actions-core' | |
| runs-on: ubuntu-latest-large | |
| timeout-minutes: 10 | |
| permissions: | |
| contents: read | |
| id-token: write | |
| strategy: | |
| matrix: | |
| node-version: [22.x] | |
| steps: | |
| - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2 | |
| - name: Use Node.js ${{ matrix.node-version }} | |
| uses: actions/setup-node@7c12f8017d5436eb855f1ed4399f037a36fbd9e8 # v2 | |
| with: | |
| node-version: ${{ matrix.node-version }} | |
| registry-url: 'https://registry.npmjs.org' | |
| - name: Artifactory OIDC Auth | |
| if: ${{ env.ARTIFACTORY_URL != '' }} | |
| uses: ./.github/actions/artifactory-oidc | |
| - name: Get yarn cache directory path | |
| id: yarn-cache-dir-path | |
| run: echo "::set-output name=dir::$(yarn cache dir)" | |
| - uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3 | |
| id: yarn-cache # use this to check for `cache-hit` (`steps.yarn-cache.outputs.cache-hit != 'true'`) | |
| with: | |
| path: ${{ steps.yarn-cache-dir-path.outputs.dir }} | |
| key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }} | |
| restore-keys: | | |
| ${{ runner.os }}-yarn- | |
| - name: Install Dependencies | |
| run: yarn install --frozen-lockfile | |
| - name: Install Browser Dependencies | |
| run: npx playwright install-deps | |
| - name: Build | |
| run: NODE_ENV=production yarn lerna run build --scope=@segment/actions-core --include-dependencies --stream | |
| - name: Browser Test | |
| run: yarn test-browser |