-
Notifications
You must be signed in to change notification settings - Fork 1
[Fix] preview.yml 수정 #204
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
The head ref may contain hidden characters: "193-fix-previewyml-\uC218\uC815"
[Fix] preview.yml 수정 #204
Changes from 15 commits
8ca9236
0fca04b
92b2804
aa4c967
f4ea8be
b0796aa
5b10ac4
0a83fd6
f439c73
ca3beba
d435300
d45510e
43ad171
6e318b4
6e350e4
6d2e1fb
d73435d
b2ba199
c837759
c2efbcc
e66b216
ff0c850
72c08c6
bfec3f3
c75f041
32924bd
f59e72d
b6cf743
6b70eed
6d428e0
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change | ||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|
@@ -7,6 +7,7 @@ permissions: | |||||||||||||||||||||||||||||||||||
| on: | ||||||||||||||||||||||||||||||||||||
| pull_request: | ||||||||||||||||||||||||||||||||||||
| branches: [develop] | ||||||||||||||||||||||||||||||||||||
| types: [opened, synchronize, reopened] | ||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||
| jobs: | ||||||||||||||||||||||||||||||||||||
| preview: | ||||||||||||||||||||||||||||||||||||
|
|
@@ -35,8 +36,25 @@ jobs: | |||||||||||||||||||||||||||||||||||
| env: | ||||||||||||||||||||||||||||||||||||
| NEXT_PUBLIC_API_URL: ${{ secrets.NEXT_PUBLIC_API_URL }} | ||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||
| - name: Check AuthGuard content | ||||||||||||||||||||||||||||||||||||
| run: | | ||||||||||||||||||||||||||||||||||||
| echo "AuthGuard content:" | ||||||||||||||||||||||||||||||||||||
| cat apps/web/app/components/auth/AuthGuard.tsx | ||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||
| - name: Build | ||||||||||||||||||||||||||||||||||||
| run: pnpm -filter=web build | ||||||||||||||||||||||||||||||||||||
| run: | | ||||||||||||||||||||||||||||||||||||
| echo "Current branch: ${{ github.head_ref }}" | ||||||||||||||||||||||||||||||||||||
| echo "PR number: ${{ github.event.pull_request.number }}" | ||||||||||||||||||||||||||||||||||||
| echo "Event name: ${{ github.event_name }}" | ||||||||||||||||||||||||||||||||||||
| pnpm -filter=web build | ||||||||||||||||||||||||||||||||||||
| env: | ||||||||||||||||||||||||||||||||||||
| GITHUB_EVENT_NAME: ${{ github.event_name }} | ||||||||||||||||||||||||||||||||||||
| GITHUB_EVENT_NUMBER: ${{ github.event.pull_request.number }} | ||||||||||||||||||||||||||||||||||||
|
Comment on lines
+43
to
+49
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 환경 변수 처리 방식의 보안 강화가 필요합니다. GitHub Actions의 컨텍스트 변수를 직접 사용하는 것은 보안상 위험할 수 있습니다. 다음과 같이 수정하는 것을 권장합니다: run: |
- echo "GITHUB_EVENT_NAME=${{ github.event_name }}" >> apps/web/.env.production.local
- echo "GITHUB_EVENT_NUMBER=${{ github.event.pull_request.number }}" >> apps/web/.env.production.local
+ echo "GITHUB_EVENT_NAME=$GITHUB_EVENT_NAME" >> apps/web/.env.production.local
+ echo "GITHUB_EVENT_NUMBER=$GITHUB_EVENT_NUMBER" >> apps/web/.env.production.local
pnpm -filter=web build
env:
GITHUB_EVENT_NAME: ${{ github.event_name }}
GITHUB_EVENT_NUMBER: ${{ github.event.pull_request.number }}📝 Committable suggestion
Suggested change
|
||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||
|
Comment on lines
+45
to
+50
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 보안: github.head_ref 사용 방식을 개선해야 합니다. GitHub Actions 보안 가이드라인에 따르면, 다음과 같이 환경 변수를 통해 전달하도록 수정하는 것을 제안합니다: - name: Build
run: |
- echo "Current branch: ${{ github.head_ref }}"
+ echo "Current branch: $GITHUB_HEAD_REF"
echo "PR number: ${{ github.event.pull_request.number }}"
echo "Event name: ${{ github.event_name }}"
pnpm -filter=web build
env:
+ GITHUB_HEAD_REF: ${{ github.head_ref }}
GITHUB_EVENT_NAME: ${{ github.event_name }}
GITHUB_EVENT_NUMBER: ${{ github.event.pull_request.number }}📝 Committable suggestion
Suggested change
🧰 Tools🪛 actionlint (1.7.4)45-45: "github.head_ref" is potentially untrusted. avoid using it directly in inline scripts. instead, pass it through an environment variable. see https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions for more details (expression) |
||||||||||||||||||||||||||||||||||||
| - name: Check build output | ||||||||||||||||||||||||||||||||||||
| run: | | ||||||||||||||||||||||||||||||||||||
| echo "Checking index.html content:" | ||||||||||||||||||||||||||||||||||||
| cat out/index.html | ||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||
| - name: Check build output | |
| run: | | |
| echo "Checking index.html content:" | |
| cat out/index.html | |
| - name: Check build output | |
| run: | | |
| echo "Verifying build output..." | |
| test -f out/index.html && echo "✓ index.html exists" | |
| echo "File size: $(stat -f%z out/index.html) bytes" |
Outdated
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🛠️ Refactor suggestion
보안: S3 파일 목록 노출 제한이 필요합니다.
S3에 업로드된 모든 파일 목록을 로그에 출력하는 것은 민감한 정보가 노출될 수 있습니다.
다음과 같이 수정하는 것을 제안합니다:
- name: Deploy to S3 with PR-specific prefix
run: |
echo "Syncing files to S3..."
aws s3 sync ${{ secrets.BUILD_DIRECTORY }} s3://${{ secrets.AWS_S3_BUCKET_NAME }}/pr-${{ github.event.pull_request.number }} --delete
- echo "Files uploaded to S3:"
- aws s3 ls s3://${{ secrets.AWS_S3_BUCKET_NAME }}/pr-${{ github.event.pull_request.number }} --recursive
+ echo "Deployment summary:"
+ aws s3 ls s3://${{ secrets.AWS_S3_BUCKET_NAME }}/pr-${{ github.event.pull_request.number }} --recursive --summarize | grep "Total Objects:"📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| run: | | |
| echo "Syncing files to S3..." | |
| aws s3 sync ${{ secrets.BUILD_DIRECTORY }} s3://${{ secrets.AWS_S3_BUCKET_NAME }}/pr-${{ github.event.pull_request.number }} --delete | |
| echo "Files uploaded to S3:" | |
| aws s3 ls s3://${{ secrets.AWS_S3_BUCKET_NAME }}/pr-${{ github.event.pull_request.number }} --recursive | |
| run: | | |
| echo "Syncing files to S3..." | |
| aws s3 sync ${{ secrets.BUILD_DIRECTORY }} s3://${{ secrets.AWS_S3_BUCKET_NAME }}/pr-${{ github.event.pull_request.number }} --delete | |
| echo "Deployment summary:" | |
| aws s3 ls s3://${{ secrets.AWS_S3_BUCKET_NAME }}/pr-${{ github.event.pull_request.number }} --recursive --summarize | grep "Total Objects:" |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
보안: AuthGuard 내용 노출 위험이 있습니다.
AuthGuard.tsx 파일의 내용을 로그에 출력하는 것은 인증 로직이 노출될 수 있어 보안상 위험합니다. 디버깅이 필요한 경우 파일 존재 여부만 확인하거나, 민감하지 않은 정보만 선택적으로 출력하는 것이 좋습니다.
다음과 같이 수정하는 것을 제안합니다:
📝 Committable suggestion