Potential fix for code scanning alert no. 4: Uncontrolled command line #108
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # For most projects, this workflow file will not need changing; you simply need | |
| # to commit it to your repository. | |
| # | |
| # You may wish to alter this file to override the set of languages analyzed, | |
| # or to provide custom queries or build logic. | |
| # | |
| name: "GHA-04: Maven NIT" | |
| on: | |
| push: | |
| branches: [ "master" ] | |
| pull_request: | |
| # The branches below must be a subset of the branches above | |
| branches: [ "master" ] | |
| schedule: | |
| - cron: '22 12 * * 0' | |
| workflow_dispatch: | |
| # Allow manually running the action, e.g. if disabled after some quietness in the source | |
| jobs: | |
| maven-NIT: | |
| name: "Compile the project, test against NUT data server" | |
| runs-on: ${{ matrix.os }} | |
| permissions: | |
| actions: read | |
| contents: read | |
| security-events: write | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| compilerpkg: [ 'openjdk-21-jdk' ] | |
| # TOTHINK: various JDK versions? | |
| os: [ 'ubuntu-latest' ] | |
| # TOTHINK: windows-latest, macos-latest? | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v7 | |
| # Using hints from https://askubuntu.com/questions/272248/processing-triggers-for-man-db | |
| - if: matrix.os == 'ubuntu-latest' | |
| name: NUT CI Prerequisite packages (Ubuntu) | |
| run: | | |
| echo "set man-db/auto-update false" | sudo debconf-communicate | |
| sudo dpkg-reconfigure man-db | |
| sudo apt update | |
| sudo apt install ${{ matrix.compilerpkg }} maven nut | |
| date > .timestamp-init | |
| - name: Prepare maven cache | |
| # Based on https://docs.github.com/en/actions/reference/workflows-and-actions/dependency-caching#example-using-the-cache-action example | |
| id: cache-m2cache | |
| uses: actions/cache@v6 | |
| env: | |
| cache-name: cache-m2cache- | |
| with: | |
| path: | | |
| ~/.m2 | |
| key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ hashFiles('**/.timestamp-init') }} | |
| restore-keys: | | |
| ${{ runner.os }}-build-${{ env.cache-name }}- | |
| ${{ runner.os }}-build- | |
| ${{ runner.os }}- | |
| # ℹ️ Command-line programs to run using the OS shell. | |
| # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun | |
| - name: Maven build and test | |
| run: mvn package | |
| # Setup NUT, run client (add in-tree script for that and call it) | |
| # NOTE: We use binaries from the package for speedier turnaround | |
| # TOTHINK: No SSL self-reporting before NUT v2.8.5 ... | |
| #- name: Checkout NUT sources (for NIT script) | |
| # run: | | |
| # git clone --depth=1 https://github.com/networkupstools/nut | |
| - name: Fetch NIT script from NUT sources | |
| run: | | |
| curl -L https://raw.githubusercontent.com/networkupstools/nut/refs/heads/master/tests/NIT/nit.sh > ~/nit.sh \ | |
| || cp -pf ~/nit.sh.bak ~/nit.sh \ | |
| || { git clone --depth=1 https://github.com/networkupstools/nut && cp -pf nut/tests/NIT/nit.sh ~/nit.sh ; } \ | |
| || exit | |
| [ -s ~/nit.sh ] || exit | |
| chmod +x ~/nit.sh | |
| cp -pf ~/nit.sh ~/nit.sh.bak | |
| - name: Prepare nit.sh.bak cache | |
| # Based on https://docs.github.com/en/actions/reference/workflows-and-actions/dependency-caching#example-using-the-cache-action example | |
| id: cache-nitcache | |
| uses: actions/cache@v6 | |
| env: | |
| cache-name: cache-nitcache- | |
| with: | |
| path: | | |
| ~/nit.sh.bak | |
| ~/.cache/nut-ci | |
| key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ hashFiles('**/.timestamp-init') }} | |
| restore-keys: | | |
| ${{ runner.os }}-build-${{ env.cache-name }}- | |
| ${{ runner.os }}-build- | |
| ${{ runner.os }}- | |
| - if: matrix.os == 'ubuntu-latest' | |
| name: Test jNut with NIT | |
| run: | | |
| DO_USE_NUTCI_CACHE=yes PATH="${HOME}:${PATH}" ./test-NIT.sh |