mirror of
https://github.com/cline/cline.git
synced 2026-09-19 02:05:44 +08:00
AraandClaude Opus 4.6
e92c7de8c0
Add author_association check so only MEMBER, OWNER, and COLLABORATOR users can trigger the JetBrains test workflow via issue comments. Previously any GitHub user could trigger it, allowing unauthorized use of the GitHub App token and Actions minutes. Fixes GHSA-5fq9-fh5x-w83r (SEC-29) Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
99 lines
4.2 KiB
YAML
99 lines
4.2 KiB
YAML
name: Trigger Jetbrains Plugin <-> Cline Tests
|
|
on:
|
|
pull_request_target:
|
|
types: [opened, reopened]
|
|
issue_comment:
|
|
types: [created]
|
|
permissions:
|
|
contents: read
|
|
pull-requests: read
|
|
concurrency:
|
|
group: jetbrains-trigger-${{ github.event.pull_request.number || github.event.issue.number }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
trigger-integration-test:
|
|
name: Run Tests
|
|
runs-on: ubuntu-latest
|
|
# Run on PR open/reopen, or when someone comments /test-jetbrains on a PR
|
|
if: |
|
|
github.event_name == 'pull_request_target' ||
|
|
(github.event_name == 'issue_comment' &&
|
|
github.event.issue.pull_request &&
|
|
contains(github.event.comment.body, '/test-jetbrains') &&
|
|
contains(fromJSON('["MEMBER","OWNER","COLLABORATOR"]'), github.event.comment.author_association))
|
|
steps:
|
|
- name: Generate GitHub App Token
|
|
id: app-token
|
|
uses: actions/create-github-app-token@v1
|
|
with:
|
|
app-id: 1998650
|
|
private-key: ${{ secrets.CLINE_JETBRAINS_WORKFLOW_KEY }}
|
|
owner: cline
|
|
repositories: intellij-plugin
|
|
|
|
- name: Get PR details (for issue_comment trigger)
|
|
id: pr-details
|
|
if: github.event_name == 'issue_comment'
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
run: |
|
|
PR_DATA=$(gh api repos/${{ github.repository }}/pulls/${{ github.event.issue.number }})
|
|
echo "head_ref=$(echo "$PR_DATA" | jq -r '.head.ref')" >> $GITHUB_OUTPUT
|
|
echo "head_sha=$(echo "$PR_DATA" | jq -r '.head.sha')" >> $GITHUB_OUTPUT
|
|
echo "title=$(echo "$PR_DATA" | jq -r '.title')" >> $GITHUB_OUTPUT
|
|
echo "html_url=$(echo "$PR_DATA" | jq -r '.html_url')" >> $GITHUB_OUTPUT
|
|
|
|
- name: Sanitize untrusted inputs
|
|
id: sanitize
|
|
env:
|
|
RAW_BRANCH_NAME: ${{ github.event_name == 'pull_request_target' && github.head_ref || steps.pr-details.outputs.head_ref }}
|
|
RAW_PR_TITLE: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.title || steps.pr-details.outputs.title }}
|
|
run: |
|
|
# Sanitize branch name for JSON
|
|
BRANCH_NAME_JSON=$(jq -n --arg b "$RAW_BRANCH_NAME" '$b')
|
|
echo "branch_name=$BRANCH_NAME_JSON" >> $GITHUB_OUTPUT
|
|
|
|
# Sanitize PR title for JSON
|
|
PR_TITLE_JSON=$(jq -n --arg t "$RAW_PR_TITLE" '$t')
|
|
echo "pr_title=$PR_TITLE_JSON" >> $GITHUB_OUTPUT
|
|
|
|
- name: Trigger IntelliJ Plugin Integration Test
|
|
env:
|
|
BRANCH_NAME: ${{ steps.sanitize.outputs.branch_name }}
|
|
PR_TITLE: ${{ steps.sanitize.outputs.pr_title }}
|
|
PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
|
|
PR_SHA: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.head.sha || steps.pr-details.outputs.head_sha }}
|
|
PR_URL: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.html_url || steps.pr-details.outputs.html_url }}
|
|
run: |
|
|
curl -X POST \
|
|
-H "Authorization: Bearer ${{ steps.app-token.outputs.token }}" \
|
|
-H "Accept: application/vnd.github.v3+json" \
|
|
-H "User-Agent: cline-pr-trigger" \
|
|
-H "Content-Type: application/json" \
|
|
https://api.github.com/repos/cline/intellij-plugin/dispatches \
|
|
-d @- <<EOF
|
|
{
|
|
"event_type": "cline-pr-check",
|
|
"client_payload": {
|
|
"pr_number": "$PR_NUMBER",
|
|
"branch_name": $BRANCH_NAME,
|
|
"action": "${{ github.event.action }}",
|
|
"sha": "$PR_SHA",
|
|
"pr_title": $PR_TITLE,
|
|
"pr_url": "$PR_URL"
|
|
}
|
|
}
|
|
EOF
|
|
|
|
- name: Log trigger details
|
|
env:
|
|
PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
|
|
PR_SHA: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.head.sha || steps.pr-details.outputs.head_sha }}
|
|
run: |
|
|
echo "Triggered IntelliJ Plugin integration test for:"
|
|
echo " PR #$PR_NUMBER"
|
|
echo " Trigger: ${{ github.event_name }}"
|
|
echo " Action: ${{ github.event.action }}"
|
|
echo " SHA: $PR_SHA"
|