From dbb73b92393e351b43e5e90e540081a975f4a233 Mon Sep 17 00:00:00 2001
From: Antonis Stamatiou <stamatiou.antonis@gmail.com>
Date: Wed, 26 Apr 2023 12:45:32 +0300
Subject: [PATCH 1/2] fix: Disable branch name manipulation to remove attack
 vector

---
 .github/workflows/artifacts.yml | 131 +++++++++++++++-----------------
 1 file changed, 61 insertions(+), 70 deletions(-)

diff --git a/.github/workflows/artifacts.yml b/.github/workflows/artifacts.yml
index 44b59b7548..35829f9f04 100644
--- a/.github/workflows/artifacts.yml
+++ b/.github/workflows/artifacts.yml
@@ -4,15 +4,12 @@ on:
     workflows: ["Mattermost Build"]
     types:
       - completed
+
 jobs:
   upload-s3:
     name: cd/Upload artifacts to S3
     runs-on: ubuntu-22.04
-    env:
-      REPO_NAME: ${{ github.event.repository.name }}
-    if: >
-      github.event.workflow_run.event == 'pull_request' &&
-      github.event.workflow_run.conclusion == 'success'
+    if: github.event.workflow_run.event == 'pull_request' && github.event.workflow_run.conclusion == 'success'
     steps:
       - name: cd/Configure AWS
         uses: aws-actions/configure-aws-credentials@07c2f971bac433df982ccc261983ae443861db49 # v1-node16
@@ -28,89 +25,83 @@ jobs:
           workflow_conclusion: success
           name: server-dist-artifact
           path: server/dist
+      # DISABLING THIS UNTIL WE FIGURE OUT IF WE NEED IT
       # Get Branch name from calling workflow
       # Search for the string "pull" and replace it with "PR" in branch-name
-      - name: cd/Get branch name
-        run: echo "BRANCH_NAME=$(echo ${{ github.event.workflow_run.head_branch }} | sed 's/^pull\//PR-/g')" >> $GITHUB_ENV
+      # - name: cd/Get branch name
+      #   run: echo "BRANCH_NAME=$(echo ${{ github.event.workflow_run.head_branch }} | sed 's/^pull\//PR-/g')" >> $GITHUB_ENV
       - name: cd/Upload artifacts to S3
         run: |
-          aws s3 cp server/dist/ s3://pr-builds.mattermost.com/$REPO_NAME/$BRANCH_NAME/ --acl public-read --cache-control "no-cache" --recursive --no-progress
-          aws s3 cp server/dist/ s3://pr-builds.mattermost.com/$REPO_NAME/commit/${{ github.sha }}/ --acl public-read --cache-control "no-cache" --recursive --no-progress
+          aws s3 cp server/dist/ s3://pr-builds.mattermost.com/${{ github.event.repository.name }}/${{ github.event.workflow_run.head_branch }}/ --acl public-read --cache-control "no-cache" --recursive --no-progress
+          aws s3 cp server/dist/ s3://pr-builds.mattermost.com/${{ github.event.repository.name }}/commit/${{ github.sha }}/ --acl public-read --cache-control "no-cache" --recursive --no-progress
+
   build-docker:
     name: cd/Build and push docker image
     needs: upload-s3
-    env:
-      REPO_NAME: ${{ github.event.repository.name }}
     runs-on: ubuntu-22.04
-    if: >
-      github.event.workflow_run.event == 'pull_request' &&
-      github.event.workflow_run.conclusion == 'success'
+    if: github.event.workflow_run.event == 'pull_request' && github.event.workflow_run.conclusion == 'success'
     steps:
-    - name: cd/Login to Docker Hub
-      uses: docker/login-action@3da7dc6e2b31f99ef2cb9fb4c50fb0971e0d0139 # v2.1.0
-      with:
-        username: ${{ secrets.DOCKERHUB_DEV_USERNAME }}
-        password: ${{ secrets.DOCKERHUB_DEV_TOKEN }}
-    - name: cd/Download artifacts
-      uses: dawidd6/action-download-artifact@0c49384d39ceb023b8040f480a25596fd6cf441b # v2.26.0
-      with:
-        workflow: ${{ github.event.workflow_run.workflow_id }}
-        run_id: ${{ github.event.workflow_run.id }}
-        workflow_conclusion: success
-        name: server-build-artifact
-        path: server/build/
-    - name: cd/Setup Docker Buildx
-      uses: docker/setup-buildx-action@11e8a2e2910826a92412015c515187a2d6750279 # v2.4
-    - name: cd/Docker build and push
-      env:
-        DOCKER_CLI_EXPERIMENTAL: enabled
-      run: |
-        export TAG=$(echo "${{ github.event.pull_request.head.sha || github.sha }}" | cut -c1-7)
-        cd server/build
-        export DOCKER_CLI_EXPERIMENTAL=enabled
-        export MM_PACKAGE=https://pr-builds.mattermost.com/$REPO_NAME/commit/${{ github.sha }}/mattermost-team-linux-amd64.tar.gz
-        docker buildx build --push --build-arg MM_PACKAGE=$MM_PACKAGE -t mattermostdevelopment/mm-te-test:${TAG} .
+      - name: cd/Login to Docker Hub
+        uses: docker/login-action@3da7dc6e2b31f99ef2cb9fb4c50fb0971e0d0139 # v2.1.0
+        with:
+          username: ${{ secrets.DOCKERHUB_DEV_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_DEV_TOKEN }}
+      - name: cd/Download artifacts
+        uses: dawidd6/action-download-artifact@0c49384d39ceb023b8040f480a25596fd6cf441b # v2.26.0
+        with:
+          workflow: ${{ github.event.workflow_run.workflow_id }}
+          run_id: ${{ github.event.workflow_run.id }}
+          workflow_conclusion: success
+          name: server-build-artifact
+          path: server/build/
+      - name: cd/Setup Docker Buildx
+        uses: docker/setup-buildx-action@11e8a2e2910826a92412015c515187a2d6750279 # v2.4
+      - name: cd/Docker build and push
+        env:
+          DOCKER_CLI_EXPERIMENTAL: enabled
+        run: |
+          export TAG=$(echo "${{ github.event.pull_request.head.sha || github.sha }}" | cut -c1-7)
+          cd server/build
+          export DOCKER_CLI_EXPERIMENTAL=enabled
+          export MM_PACKAGE=https://pr-builds.mattermost.com/${{ github.event.repository.name }}/commit/${{ github.sha }}/mattermost-team-linux-amd64.tar.gz
+          docker buildx build --push --build-arg MM_PACKAGE=$MM_PACKAGE -t mattermostdevelopment/mm-te-test:${TAG} .
+
   # Temporary uploading also to mattermost/mm-te-test:${TAG} except mattermostdevelopment/mm-te-test:${TAG}
   # Context: https://community.mattermost.com/private-core/pl/3jzzxzfiji8hx833ewyuthzkjh
   build-docker-temp:
     name: cd/Build and push docker image
     needs: upload-s3
-    env:
-      REPO_NAME: ${{ github.event.repository.name }}
     runs-on: ubuntu-22.04
-    if: >
-      github.event.workflow_run.event == 'pull_request' &&
-      github.event.workflow_run.conclusion == 'success'
+    if: github.event.workflow_run.event == 'pull_request' && github.event.workflow_run.conclusion == 'success'
     steps:
-    - name: cd/Login to Docker Hub
-      uses: docker/login-action@3da7dc6e2b31f99ef2cb9fb4c50fb0971e0d0139 # v2.1.0
-      with:
-        username: ${{ secrets.DOCKERHUB_USERNAME }}
-        password: ${{ secrets.DOCKERHUB_TOKEN }}
-    - name: cd/Download artifacts
-      uses: dawidd6/action-download-artifact@0c49384d39ceb023b8040f480a25596fd6cf441b # v2.26.0
-      with:
-        workflow: ${{ github.event.workflow_run.workflow_id }}
-        run_id: ${{ github.event.workflow_run.id }}
-        workflow_conclusion: success
-        name: server-build-artifact
-        path: server/build/
-    - name: cd/Setup Docker Buildx
-      uses: docker/setup-buildx-action@11e8a2e2910826a92412015c515187a2d6750279 # v2.4
-    - name: cd/Docker build and push
-      env:
-        DOCKER_CLI_EXPERIMENTAL: enabled
-      run: |
-        export TAG=$(echo "${{ github.event.pull_request.head.sha || github.sha }}" | cut -c1-7)
-        cd server/build
-        export DOCKER_CLI_EXPERIMENTAL=enabled
-        export MM_PACKAGE=https://pr-builds.mattermost.com/$REPO_NAME/commit/${{ github.sha }}/mattermost-team-linux-amd64.tar.gz
-        docker buildx build --push --build-arg MM_PACKAGE=$MM_PACKAGE -t mattermost/mm-te-test:${TAG} .
+      - name: cd/Login to Docker Hub
+        uses: docker/login-action@3da7dc6e2b31f99ef2cb9fb4c50fb0971e0d0139 # v2.1.0
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      - name: cd/Download artifacts
+        uses: dawidd6/action-download-artifact@0c49384d39ceb023b8040f480a25596fd6cf441b # v2.26.0
+        with:
+          workflow: ${{ github.event.workflow_run.workflow_id }}
+          run_id: ${{ github.event.workflow_run.id }}
+          workflow_conclusion: success
+          name: server-build-artifact
+          path: server/build/
+      - name: cd/Setup Docker Buildx
+        uses: docker/setup-buildx-action@11e8a2e2910826a92412015c515187a2d6750279 # v2.4
+      - name: cd/Docker build and push
+        env:
+          DOCKER_CLI_EXPERIMENTAL: enabled
+        run: |
+          export TAG=$(echo "${{ github.event.pull_request.head.sha || github.sha }}" | cut -c1-7)
+          cd server/build
+          export DOCKER_CLI_EXPERIMENTAL=enabled
+          export MM_PACKAGE=https://pr-builds.mattermost.com/${{ github.event.repository.name }}/commit/${{ github.sha }}/mattermost-team-linux-amd64.tar.gz
+          docker buildx build --push --build-arg MM_PACKAGE=$MM_PACKAGE -t mattermost/mm-te-test:${TAG} .
+
   sentry:
     name: Send build info to sentry
-    if: >
-      github.event.workflow_run.event == 'pull_request' &&
-      github.event.workflow_run.conclusion == 'success'
+    if: github.event.workflow_run.event == 'pull_request' && github.event.workflow_run.conclusion == 'success'
     runs-on: ubuntu-22.04
     env:
       SENTRY_AUTH_TOKEN: ${{ secrets.MM_SERVER_SENTRY_AUTH_TOKEN }}

From ee23f6dc6b864bf9ea4c51de799048b6c9927f5d Mon Sep 17 00:00:00 2001
From: Antonis Stamatiou <stamatiou.antonis@gmail.com>
Date: Wed, 26 Apr 2023 13:15:04 +0300
Subject: [PATCH 2/2] fix: Fixed wrong commit sha reference from incoming
 webhook

---
 .github/workflows/artifacts.yml | 28 +++++++++++++++++-----------
 1 file changed, 17 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/artifacts.yml b/.github/workflows/artifacts.yml
index 35829f9f04..1886775a8e 100644
--- a/.github/workflows/artifacts.yml
+++ b/.github/workflows/artifacts.yml
@@ -25,15 +25,14 @@ jobs:
           workflow_conclusion: success
           name: server-dist-artifact
           path: server/dist
-      # DISABLING THIS UNTIL WE FIGURE OUT IF WE NEED IT
-      # Get Branch name from calling workflow
-      # Search for the string "pull" and replace it with "PR" in branch-name
-      # - name: cd/Get branch name
-      #   run: echo "BRANCH_NAME=$(echo ${{ github.event.workflow_run.head_branch }} | sed 's/^pull\//PR-/g')" >> $GITHUB_ENV
       - name: cd/Upload artifacts to S3
+        env:
+          BRANCH_NAME: ${{ github.event.workflow_run.head_branch }}
+          REPO_NAME: ${{ github.event.repository.name }}
+          COMMIT_SHA: ${{ github.event.workflow_run.head_sha }}
         run: |
-          aws s3 cp server/dist/ s3://pr-builds.mattermost.com/${{ github.event.repository.name }}/${{ github.event.workflow_run.head_branch }}/ --acl public-read --cache-control "no-cache" --recursive --no-progress
-          aws s3 cp server/dist/ s3://pr-builds.mattermost.com/${{ github.event.repository.name }}/commit/${{ github.sha }}/ --acl public-read --cache-control "no-cache" --recursive --no-progress
+          aws s3 cp server/dist/ s3://pr-builds.mattermost.com/$REPO_NAME/$BRANCH_NAME/ --acl public-read --cache-control "no-cache" --recursive --no-progress
+          aws s3 cp server/dist/ s3://pr-builds.mattermost.com/$REPO_NAME/commit/$COMMIT_SHA/ --acl public-read --cache-control "no-cache" --recursive --no-progress
 
   build-docker:
     name: cd/Build and push docker image
@@ -59,11 +58,13 @@ jobs:
       - name: cd/Docker build and push
         env:
           DOCKER_CLI_EXPERIMENTAL: enabled
+          REPO_NAME: ${{ github.event.repository.name }}
+          COMMIT_SHA: ${{ github.event.workflow_run.head_sha }}
         run: |
-          export TAG=$(echo "${{ github.event.pull_request.head.sha || github.sha }}" | cut -c1-7)
+          export TAG=$(echo "${{ github.event.pull_request.head.sha || github.event.workflow_run.head_sha }}" | cut -c1-7)
           cd server/build
           export DOCKER_CLI_EXPERIMENTAL=enabled
-          export MM_PACKAGE=https://pr-builds.mattermost.com/${{ github.event.repository.name }}/commit/${{ github.sha }}/mattermost-team-linux-amd64.tar.gz
+          export MM_PACKAGE=https://pr-builds.mattermost.com/$REPO_NAME/commit/$COMMIT_SHA/mattermost-team-linux-amd64.tar.gz
           docker buildx build --push --build-arg MM_PACKAGE=$MM_PACKAGE -t mattermostdevelopment/mm-te-test:${TAG} .
 
   # Temporary uploading also to mattermost/mm-te-test:${TAG} except mattermostdevelopment/mm-te-test:${TAG}
@@ -71,6 +72,9 @@ jobs:
   build-docker-temp:
     name: cd/Build and push docker image
     needs: upload-s3
+    env:
+      REPO_NAME: ${{ github.event.repository.name }}
+
     runs-on: ubuntu-22.04
     if: github.event.workflow_run.event == 'pull_request' && github.event.workflow_run.conclusion == 'success'
     steps:
@@ -92,11 +96,13 @@ jobs:
       - name: cd/Docker build and push
         env:
           DOCKER_CLI_EXPERIMENTAL: enabled
+          REPO_NAME: ${{ github.event.repository.name }}
+          COMMIT_SHA: ${{ github.event.workflow_run.head_sha }}
         run: |
-          export TAG=$(echo "${{ github.event.pull_request.head.sha || github.sha }}" | cut -c1-7)
+          export TAG=$(echo "${{ github.event.pull_request.head.sha || github.event.workflow_run.head_sha }}" | cut -c1-7)
           cd server/build
           export DOCKER_CLI_EXPERIMENTAL=enabled
-          export MM_PACKAGE=https://pr-builds.mattermost.com/${{ github.event.repository.name }}/commit/${{ github.sha }}/mattermost-team-linux-amd64.tar.gz
+          export MM_PACKAGE=https://pr-builds.mattermost.com/$REPO_NAME/commit/$COMMIT_SHA/mattermost-team-linux-amd64.tar.gz
           docker buildx build --push --build-arg MM_PACKAGE=$MM_PACKAGE -t mattermost/mm-te-test:${TAG} .
 
   sentry: