mirror of
https://github.com/hanzoai/sentinel.git
synced 2026-09-29 22:34:33 +00:00
fix-it-felix-sentry[bot]GitHubfix-it-felix-sentry[bot] <260785270+fix-it-felix-sentry[bot]@users.noreply.github.com>fix: Prevent script injection in get-compose-action Use environment variable to pass inputs.version instead of direct interpolation in run script to prevent potential script injection. Refs: DI-967, VULN-761 Co-authored-by: fix-it-felix-sentry[bot] <260785270+fix-it-felix-sentry[bot]@users.noreply.github.com>
22 lines
771 B
YAML
22 lines
771 B
YAML
name: "Get Docker Compose"
|
|
inputs:
|
|
version:
|
|
required: false
|
|
default: 2.33.1
|
|
description: "Docker Compose version"
|
|
|
|
runs:
|
|
using: "composite"
|
|
steps:
|
|
- name: Get Compose
|
|
shell: bash
|
|
env:
|
|
COMPOSE_VERSION: ${{ inputs.version }}
|
|
run: |
|
|
# Docker Compose v1 is installed here, remove it
|
|
sudo rm -f "/usr/local/bin/docker-compose"
|
|
sudo rm -f "/usr/local/lib/docker/cli-plugins/docker-compose"
|
|
sudo mkdir -p "/usr/local/lib/docker/cli-plugins"
|
|
sudo curl -L https://github.com/docker/compose/releases/download/v"$COMPOSE_VERSION"/docker-compose-`uname -s`-`uname -m` -o "/usr/local/lib/docker/cli-plugins/docker-compose"
|
|
sudo chmod +x "/usr/local/lib/docker/cli-plugins/docker-compose"
|