[Fixes: mosip/mosip-infra#1874] Added WireGuard onboarding workflow#249
Open
Ivanmeneges wants to merge 3 commits into
Open
[Fixes: mosip/mosip-infra#1874] Added WireGuard onboarding workflow#249Ivanmeneges wants to merge 3 commits into
Ivanmeneges wants to merge 3 commits into
Conversation
This workflow automates the onboarding of WireGuard environments by allocating peers and managing GitHub secrets. Signed-off-by: Ivanmeneges <ivan.anil016@gmail.com>
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
WalkthroughAdds a new GitHub Actions workflow ChangesWireGuard Onboarding Workflow
Sequence DiagramsequenceDiagram
participant Dispatcher as workflow_dispatch
participant Runner as Self-hosted Runner
participant SSHKey as ~/.ssh/jumpserver_key
participant Script as scripts/wg-onboard.sh
participant Repo as Remote Repository
Dispatcher->>Runner: trigger with inputs
Runner->>SSHKey: write secret, strip CR, chmod 600
Runner->>SSHKey: ssh-keygen validate
Runner->>Script: execute with env/host/path/ticket/dry-run flags
Script-->>Runner: exit
Runner->>Repo: commit & push wg-peer-allocation.tsv (if not DRY_RUN)
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
Author
|
@coderabbitai review. |
Contributor
✅ Action performedReview finished.
|
Contributor
|
✅ Action performedReview finished.
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/wg-onboard.yml:
- Around line 66-80: The workflow directly expands workflow dispatch inputs
using `${{ inputs.* }}` syntax within shell commands, creating a command
injection vulnerability if any input contains shell metacharacters. Fix this
across three locations in `.github/workflows/wg-onboard.yml`: (1) At lines 66-80
in the "Run WireGuard onboarding" step, move ENV_NAME, JUMPSERVER_HOST, WG_DIR,
ALLOWED_IPS, TICKET, and DRY_RUN from the script arguments into the env: block,
then reference them as shell variables ($VAR_NAME) in the run: block, and build
the conditional flags (--ticket and --dry-run) using shell logic instead of
GitHub expressions. (2) At lines 53-64, pass the SSH_PRIVATE_KEY secret name via
env: so it can be safely referenced in the error message without direct input
expansion. (3) At lines 82-93, pass ENV_NAME and github.actor via env: for use
in git config and commit message instead of expanding them directly in the run:
block.
- Around line 53-64: The error message on line 62 directly expands the GitHub
Actions template ${{ inputs.SSH_PRIVATE_KEY }} into the shell, creating a
command injection risk if the secret name contains shell metacharacters. Add
`SSH_KEY_NAME: ${{ inputs.SSH_PRIVATE_KEY }}` to the env section at the top of
the step, then in the error message replace the direct template expansion with
the environment variable reference using `$SSH_KEY_NAME` instead of `${{
inputs.SSH_PRIVATE_KEY }}`.
- Around line 82-93: The commit message on line 91 directly expands the
inputs.ENV_NAME template variable without proper quoting, creating a template
injection risk if the input contains special characters or quotes. Additionally,
the git push command on line 92 lacks safeguards for concurrent workflow
execution and may fail if multiple workflows push simultaneously. To fix this,
properly escape or quote the inputs.ENV_NAME variable in the commit message
string to prevent injection attacks, and add error handling or retry logic
around the git push command to gracefully handle potential race conditions when
concurrent workflows attempt to push to the same branch.
- Around line 48-51: The checkout action step in the wg-onboard.yml workflow has
two security vulnerabilities. First, replace the `actions/checkout@v4` tag with
a pinned commit SHA to prevent supply-chain attacks. Second, add
`persist-credentials: false` to the with section to prevent the PAT_TOKEN from
being persisted in git config and potentially leaked by subsequent workflow
steps or artifacts. Both changes should be made to the same Checkout repository
step that currently uses the version tag and accepts the token parameter.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI
Review profile: CHILL
Plan: Pro
Run ID: 0a53931d-a1c1-4ad8-918e-2e937ab5a4f8
📒 Files selected for processing (1)
.github/workflows/wg-onboard.yml
Signed-off-by: Ivanmeneges <ivan.anil016@gmail.com>
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/wg-onboard.yml:
- Line 81: The workflow in .github/workflows/wg-onboard.yml references script
files that do not exist in the repository. At line 81, the chmod command
references `.github/workflows/scripts/wg-onboard.sh`, but there is no scripts/
subdirectory under workflows/. Additionally, the workflow references
wg-peer-allocation.tsv which does not exist. The documentation at line 8
indicates the correct location should be `.github/scripts/wg-onboard.sh`. To fix
this, either create the missing wg-onboard.sh and wg-peer-allocation.tsv files
in the correct location (.github/scripts/), or update all workflow references
(including the chmod command at line 81) to use the correct path consistently
with the documented location. Ensure all file paths referenced in the workflow
match actual locations in the repository.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI
Review profile: CHILL
Plan: Pro
Run ID: ad0511c4-f465-4bab-bd70-c670c06fb047
📒 Files selected for processing (1)
.github/workflows/wg-onboard.yml
Signed-off-by: Ivanmeneges <ivan.anil016@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This workflow automates the onboarding of WireGuard environments by allocating peers and managing GitHub secrets.
Summary by CodeRabbit