Skip to content

Update mimir-prometheus on branch pushes #11518

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
wants to merge 3 commits into
base: main
Choose a base branch
from

Conversation

dimitarvdimitrov
Copy link
Contributor

@dimitarvdimitrov dimitarvdimitrov commented May 23, 2025

This pull request enhances the update-vendored-mimir-prometheus.yml workflow by introducing support for triggering updates via repository_dispatch events triggered by grafana/mimir-prometheus#877

In draft until I know the workflow actually works without the triggering too

This comment has been minimized.

@dimitarvdimitrov dimitarvdimitrov force-pushed the dimitar/build/actions/listen-for-mimir-prometheus-updates branch from d3a57c5 to 6b4b612 Compare May 23, 2025 17:37
@dimitarvdimitrov dimitarvdimitrov changed the base branch from main to dimitar/build/add-workflow-to-update-mimir-prometheus May 23, 2025 17:37
Comment on lines 30 to 41
run: |
if [ "${{ github.event_name }}" = "repository_dispatch" ]; then
# For repository_dispatch, use the branch_name from client_payload for mimir_prometheus_branch.
# The main use case is for weekly branches, so we just use the same branch name here too.
MIMIR_PROMETHEUS_BRANCH="${{ github.event.client_payload.branch_name }}"
MIMIR_BRANCH=$MIMIR_PROMETHEUS_BRANCH
echo "Triggered by repository_dispatch"
echo "Using mimir-prometheus branch from payload: $MIMIR_PROMETHEUS_BRANCH"
else
# For workflow_dispatch, use the input values
MIMIR_BRANCH="${{ inputs.mimir_branch }}"
MIMIR_PROMETHEUS_BRANCH="${{ inputs.mimir_prometheus_branch }}"
echo "Triggered by workflow_dispatch"
echo "Using input values - mimir branch: $MIMIR_BRANCH, mimir-prometheus branch: $MIMIR_PROMETHEUS_BRANCH"
fi

echo "mimir_branch=$MIMIR_BRANCH" >> $GITHUB_OUTPUT
echo "mimir_prometheus_branch=$MIMIR_PROMETHEUS_BRANCH" >> $GITHUB_OUTPUT

Check failure

Code scanning / zizmor

github.event.client_payload.branch_name may expand into attacker-controllable code

github.event.client_payload.branch_name may expand into attacker-controllable code
Comment on lines 30 to 41
run: |
if [ "${{ github.event_name }}" = "repository_dispatch" ]; then
# For repository_dispatch, use the branch_name from client_payload for mimir_prometheus_branch.
# The main use case is for weekly branches, so we just use the same branch name here too.
MIMIR_PROMETHEUS_BRANCH="${{ github.event.client_payload.branch_name }}"
MIMIR_BRANCH=$MIMIR_PROMETHEUS_BRANCH
echo "Triggered by repository_dispatch"
echo "Using mimir-prometheus branch from payload: $MIMIR_PROMETHEUS_BRANCH"
else
# For workflow_dispatch, use the input values
MIMIR_BRANCH="${{ inputs.mimir_branch }}"
MIMIR_PROMETHEUS_BRANCH="${{ inputs.mimir_prometheus_branch }}"
echo "Triggered by workflow_dispatch"
echo "Using input values - mimir branch: $MIMIR_BRANCH, mimir-prometheus branch: $MIMIR_PROMETHEUS_BRANCH"
fi

echo "mimir_branch=$MIMIR_BRANCH" >> $GITHUB_OUTPUT
echo "mimir_prometheus_branch=$MIMIR_PROMETHEUS_BRANCH" >> $GITHUB_OUTPUT

Check failure

Code scanning / zizmor

inputs.mimir_branch may expand into attacker-controllable code

inputs.mimir_branch may expand into attacker-controllable code
Comment on lines 30 to 41
run: |
if [ "${{ github.event_name }}" = "repository_dispatch" ]; then
# For repository_dispatch, use the branch_name from client_payload for mimir_prometheus_branch.
# The main use case is for weekly branches, so we just use the same branch name here too.
MIMIR_PROMETHEUS_BRANCH="${{ github.event.client_payload.branch_name }}"
MIMIR_BRANCH=$MIMIR_PROMETHEUS_BRANCH
echo "Triggered by repository_dispatch"
echo "Using mimir-prometheus branch from payload: $MIMIR_PROMETHEUS_BRANCH"
else
# For workflow_dispatch, use the input values
MIMIR_BRANCH="${{ inputs.mimir_branch }}"
MIMIR_PROMETHEUS_BRANCH="${{ inputs.mimir_prometheus_branch }}"
echo "Triggered by workflow_dispatch"
echo "Using input values - mimir branch: $MIMIR_BRANCH, mimir-prometheus branch: $MIMIR_PROMETHEUS_BRANCH"
fi

echo "mimir_branch=$MIMIR_BRANCH" >> $GITHUB_OUTPUT
echo "mimir_prometheus_branch=$MIMIR_PROMETHEUS_BRANCH" >> $GITHUB_OUTPUT

Check failure

Code scanning / zizmor

inputs.mimir_prometheus_branch may expand into attacker-controllable code

inputs.mimir_prometheus_branch may expand into attacker-controllable code

This comment has been minimized.

@dimitarvdimitrov dimitarvdimitrov force-pushed the dimitar/build/actions/listen-for-mimir-prometheus-updates branch from 6b4b612 to 182e520 Compare May 23, 2025 18:26
Copy link
Contributor

😢 zizmor failed with exit code 14.

Expand for full output
error[template-injection]: code injection via template expansion
  --> ./.github/workflows/update-vendored-mimir-prometheus.yml:29:9
   |
29 |         - name: Determine branch names
   |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ this step
30 |           id: branch-names
31 | /         run: |
32 | |           if [ "${{ github.event_name }}" = "repository_dispatch" ]; then
...  |
47 | |           echo "mimir_branch=$MIMIR_BRANCH" >> $GITHUB_OUTPUT
48 | |           echo "mimir_prometheus_branch=$MIMIR_PROMETHEUS_BRANCH" >> $GITHUB_OUTPUT
   | |___________________________________________________________________________________^ github.event.client_payload.branch_name may expand into attacker-controllable code
   |
   = note: audit confidence → High

error[template-injection]: code injection via template expansion
  --> ./.github/workflows/update-vendored-mimir-prometheus.yml:29:9
   |
29 |         - name: Determine branch names
   |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ this step
30 |           id: branch-names
31 | /         run: |
32 | |           if [ "${{ github.event_name }}" = "repository_dispatch" ]; then
...  |
47 | |           echo "mimir_branch=$MIMIR_BRANCH" >> $GITHUB_OUTPUT
48 | |           echo "mimir_prometheus_branch=$MIMIR_PROMETHEUS_BRANCH" >> $GITHUB_OUTPUT
   | |___________________________________________________________________________________^ inputs.mimir_branch may expand into attacker-controllable code
   |
   = note: audit confidence → Low

error[template-injection]: code injection via template expansion
  --> ./.github/workflows/update-vendored-mimir-prometheus.yml:29:9
   |
29 |         - name: Determine branch names
   |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ this step
30 |           id: branch-names
31 | /         run: |
32 | |           if [ "${{ github.event_name }}" = "repository_dispatch" ]; then
...  |
47 | |           echo "mimir_branch=$MIMIR_BRANCH" >> $GITHUB_OUTPUT
48 | |           echo "mimir_prometheus_branch=$MIMIR_PROMETHEUS_BRANCH" >> $GITHUB_OUTPUT
   | |___________________________________________________________________________________^ inputs.mimir_prometheus_branch may expand into attacker-controllable code
   |
   = note: audit confidence → Low

31 findings (14 ignored, 14 suppressed): 0 unknown, 0 informational, 0 low, 0 medium, 3 high

Base automatically changed from dimitar/build/add-workflow-to-update-mimir-prometheus to main May 23, 2025 18:49
Signed-off-by: Dimitar Dimitrov <[email protected]>
Signed-off-by: Dimitar Dimitrov <[email protected]>
@dimitarvdimitrov dimitarvdimitrov force-pushed the dimitar/build/actions/listen-for-mimir-prometheus-updates branch from 13f7290 to 4e78462 Compare May 26, 2025 09:07
Signed-off-by: Dimitar Dimitrov <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant