Address semgrep security issue in create_release_branch.yml workflow #416
Conversation
Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. Instead, we should use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script.
Bump `actions/upload-artifact` to version v4
Bump version of `download-artifact` to v4
Bump `download-artifact` and `upload-artifact` actions to v4.
|
@ValentinS4t1qbit, you may want to have a look why psi4 tests are failing. Quick look shows the computed and expected values are not the same. |
alexfleury-sb
left a comment
alexfleury-sb
left a comment
There was a problem hiding this comment.
Hello @k0walik, thanks for overlooking the security aspect of the repo.
The tests that are failing are related to H4, which we had problems in the past because of symmetry reasons (similar orbitals get ordered differently sometimes, which caused different energy output).
The fact that the python 3.9 test is passing, and the other ones don't tells me that maybe there were updates in the psi4 repo that changes the stochastic behaviour of the orbital ordering, and this update might not be available for older pythons. Since we haven't maintained this repo actively, I can't tell for sure if this is the problem.
The best course of actions for now would be to ignore these tests, as it requires some work to point the root cause.
2 participants
This pull request introduces two changes:
download-artefactandupload-artefactactions to version v4. This change is necessary because Github Actions workflows (Continuous Integrationandpsi4) are failing due to the use of a deprecated version.create_release_workflow.yml. Previously, using variable interpolation${{…}}withgithubcontext data in arun:step could have allowed an attacker to inject their own code into the runner. To prevent this, we should use an intermediate environment variable withenv:to store the data, and then use the environment variable in therun:script.