mcp-server-semgrep/semgrep-rules/yaml/github-actions/security/run-shell-injection.test.yaml

MCP Server for Semgrep Integration - static code analysis with AI

# Push Semgrep Docker Image
name: docker

on:
  workflow_dispatch:
    inputs:
      message_to_print:
        type: string
        required: false
  push:
    branches:
      - develop
  pull_request:
    paths-ignore:
      - "**.md"

jobs:
  docker-build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2

      - name: Pull previous image for caching purposes
        run: |
          docker pull returntocorp/semgrep:develop || :

      - name: Build semgrep image with default Dockerfile
        run: docker build -t returntocorp/semgrep:develop .

      - name: Check the semgrep Docker image
        run: ./scripts/validate-docker-build.sh returntocorp/semgrep:develop

      - name: Login to DockerHub
        env:
          DOCKERHUB_USER: ${{ secrets.DOCKER_USERNAME }}
          DOCKERHUB_PASS: ${{ secrets.DOCKER_PASSWORD }}
        run: ./.github/docker-login

      - name: Push semgrep image if on develop branch
        if: github.event_name == 'push' && github.ref == 'refs/heads/develop'
        run: docker push returntocorp/semgrep:develop

      - name:
          Push commit hash if PR
          # Don't run when PR is from a fork
          # For security, we do not autopush to docker when from PRs
          # said PRs do not have access to secrets so will fail anyway but
          # nicer to not have a "failing" CI job in the PR so don't even
          # try if we can detect is coming from a fork
        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository
        # ok: run-shell-injection
        run: |
          tag=returntocorp/semgrep:${{ github.sha }}
          docker build -t "$tag" .
          docker push "$tag"

        # Extend the semgrep image, changing the entry point to bash and
        # adding some utilities. This image is meant for internal uses
        # such as benchmarks.
      - name: Build and push semgrep-dev image if on develop branch
        if: github.event_name == 'push' && github.ref == 'refs/heads/develop'
        run: |
          docker build \
            -f dockerfiles/semgrep-dev.Dockerfile \
            -t returntocorp/semgrep-dev:develop .
          docker push returntocorp/semgrep-dev:develop

      - name: Check PR title
        # ruleid: run-shell-injection
        run: |
          title="${{ github.event.pull_request.title }}"
          if [[ $title =~ ^octocat ]]; then
          echo "PR title starts with 'octocat'"
          exit 0
          else
          echo "PR title did not start with 'octocat'"
          exit 1
          fi
      - if: github.event_name == 'push'
        # ruleid: run-shell-injection
        run: |
          title="${{ github.event.pull_request.title }}"
          if [[ $title =~ ^octocat ]]; then
          echo "PR title starts with 'octocat'"
          exit 0
          else
          echo "PR title did not start with 'octocat'"
          exit 1
          fi
      - name: Print a message
        # ruleid: run-shell-injection
        run: |
          echo "${{github.event.inputs.message_to_print}}"
      - name: Show author email
        # ruleid: run-shell-injection
        run: |
          echo "${{ github.event.commits.fix-bug.author.email }}"

      - name: Show issue title
        # ruleid: run-shell-injection
        run: |
          echo "${{ github.event.issue.title }}"

      - name: benign
        # ok: run-shell-injection
        run: |
          AUTH_HEADER="Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}";
          HEADER="Accept: application/vnd.github.v3+json";

      # cf. https://github.com/magma/magma/blob/5caf0cb5151a9b0dce05985e6cb2cdcf70b94af5/.github/workflows/unit-test-workflow.yml
      - name: Download and Extract Artifacts
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        # ok: run-shell-injection
        run: |
          mkdir -p artifacts && cd artifacts
          artifacts_url=${{ github.event.workflow_run.artifacts_url }}
          gh api "$artifacts_url" -q '.artifacts[] | [.name, .archive_download_url] | @tsv' | while read artifact
          do
            IFS=$'\t' read name url <<< "$artifact"
            gh api $url > "$name.zip"
            unzip -d "$name" "$name.zip"
          done
      - name: Show discussion title
        # ruleid: run-shell-injection
        run: |
          echo "${{ github.event.discussion.title }}"
      - name: Show discussion body
        # ruleid: run-shell-injection
        run: |
          echo "${{ github.event.discussion.body }}"
      - name: print input message
        # ruleid: run-shell-injection
        run: |
          echo "${{ inputs.message_to_print }}"
      - name: Use steps output
        # ruleid: run-shell-injection
        run: |
          echo "${{ steps.shell_command.outputs.some_value }}"