[llvm] workflows/issue-release-workflow: Validate user input in /cherry-pick commands (PR #199249)

[via llvm-commits]

llvmbot wrote:

<!--IGNORE-->
>> > @llvm/pr-subscribers-github-workflow
>> > Author: Tom Stellard (tstellar)
>> > 
>> > Changes
>> > … commands
>> > This protects against mailicious inputs embedded in comments with /cherry-pick commands.
>> > 
>> > Full diff: https://github.com/llvm/llvm-project/pull/199249.diff
>> > 1 Files Affected:
>> > 
>> > * (modified) .github/workflows/issue-release-workflow.yml (+30-6)
>> > 
>> > ```diff
>> > diff --git a/.github/workflows/issue-release-workflow.yml b/.github/workflows/issue-release-workflow.yml
>> > index f1d2c1a29971b..48514f2d56786 100644
>> > --- a/.github/workflows/issue-release-workflow.yml
>> > +++ b/.github/workflows/issue-release-workflow.yml
>> > @@ -26,21 +26,43 @@ on:
>> >     types:
>> >       - opened
>> > 
>> > -env:
>> > -  COMMENT_BODY: ${{ github.event.action == 'opened' && github.event.issue.body || github.event.comment.body  }}
>> > 
>> > jobs:
>> > +  backport-commits-validate-input:
>> > +    runs-on: ubuntu-24.04
>> > +    environment: main-branch-only
>> > +    if: >-
>> > +      (github.repository == 'llvm/llvm-project') &&
>> > +      !startswith(github.event.comment.body, '<!--IGNORE-->') &&
>> > +      contains(github.event.action == 'opened' && github.event.issue.body || github.event.comment.body, '/cherry-pick')
>> > +    outputs:
>> > +      comment-body: ${{ steps.validate.outputs.comment-body }}
>> > +    steps:
>> > +      - name: Validate Input Comment
>> > +        id: validate
>> > +        env:
>> > +          COMMENT_BODY: ${{ github.event.action == 'opened' && github.event.issue.body || github.event.comment.body  }}
>> > +        run: |
>> > +          # This will strip out everything from the comment except for the /cherry-pick commands.
>> > +          # If there are multiple /cherry-pick commands they will all be included in the output.
>> > +          # This is fine since the github-automation.py script can handle multiple cherry-pick commands.
>> > +          validated_comment=$(\
>> > +            grep -o -e '/cherry-pick \(https://github.com/llvm/llvm-project/commit/\)\?[a-f0-9]\+' <<< $COMMENT_BODY \
>> > +          )
>> > +          echo "Validated Comment is:"
>> > +          echo ${validated_comment}
>> > +
>> > +          echo comment-body=${validated_comment} >> $GITHUB_OUTPUT
>> > +
>> >   backport-commits:
>> >     name: Backport Commits
>> >     runs-on: ubuntu-24.04
>> >     environment: main-branch-only
>> > +    needs:
>> > +      - backport-commits-validate-input
>> >     permissions:
>> >       issues: write
>> >       pull-requests: write
>> > -    if: >-
>> > -      (github.repository == 'llvm/llvm-project') &&
>> > -      !startswith(github.event.comment.body, '<!--IGNORE-->') &&
>> > -      contains(github.event.action == 'opened' && github.event.issue.body || github.event.comment.body, '/cherry-pick')
>> >     steps:
>> >       - name: Fetch LLVM sources
>> >         uses: actions/checkout at de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
>> > @@ -58,6 +80,8 @@ jobs:
>> >           ./llvm/utils/git/github-automation.py --token ${{ github.token }} setup-llvmbot-git
>> > 
>> >       - name: Backport Commits
>> > +        env:
>> > +          COMMENT_BODY: ${{ needs.backport-commits-validate-input.outputs.comment-body }}
>> >         run: |
>> >           printf "%s" "$COMMENT_BODY" |
>> >           ./llvm/utils/git/github-automation.py \
>> > ```
>> 
>> Error: Command failed due to missing milestone.
>
>Another benefit of this change is that the job would not have triggered for this PR if the input was being validated.

Error: Command failed due to missing milestone.

https://github.com/llvm/llvm-project/pull/199249