Stagging - #232
Conversation
Create main.yml
create main
Add GitHub Actions workflow for data environment deployment
![arcticowl-ai-review-labs[bot]](https://avatars.githubusercontent.com/u/58992620?s=60&v=4){kind=small}
| echo "Using branch: ${GITHUB_REF_NAME}" | ||
| snow git execute @advanced_data_engineering_snowflake/branches/${GITHUB_REF_NAME}/module-1/hamburg_weather/pipeline/data/ \ |
There was a problem hiding this comment.
🟠 MEDIUM · GITHUB_REF_NAME interpolated into shell/snow command enabling command injection via branch name · CWE-78
| env: | ||
| # Read connection secret | ||
| SNOWFLAKE_CONNECTIONS_ADVANCED_DATA_ENGINEERING_SNOWFLAKE_ACCOUNT: ${{ secrets.SNOWFLAKE_ACCOUNT }} | ||
| SNOWFLAKE_CONNECTIONS_ADVANCED_DATA_ENGINEERING_SNOWFLAKE_USER: ${{ secrets.SNOWFLAKE_USER }} | ||
| SNOWFLAKE_CONNECTIONS_ADVANCED_DATA_ENGINEERING_SNOWFLAKE_PASSWORD: ${{ secrets.SNOWFLAKE_PASSWORD }} |
There was a problem hiding this comment.
🟠 MEDIUM · Deployment to production Snowflake triggered by push/PR-merge without environment protection or approval gate · CWE-269
| - name: Install SnowflakeCLI | ||
| uses: snowflakedb/snowflake-cli-action@v1.5 | ||
| with: | ||
| cli-version: "latest" | ||
| default-config-file-path: "config.toml" |
There was a problem hiding this comment.
🟠 MEDIUM · Workflow pin snowflake-cli-action and CLI to floating 'latest' version enabling supply-chain drift [NEW] · CWE-1104
| pull_request: | ||
| types: [closed] | ||
| branches: | ||
| - staging | ||
| - main | ||
| push: | ||
| branches: | ||
| - staging | ||
| - main | ||
|
|
||
| jobs: | ||
| deploy_data_environment: | ||
| # Only run when PR is merged or on direct push to environment branches | ||
| if: github.event_name == 'push' || (github.event_name == 'pull_request' && github.event.pull_request.merged == true) |
There was a problem hiding this comment.
🚨 Critical blocker
🔴 HIGH · Deploy workflow triggers on pull_request:closed from any merged PR, enabling untrusted branch code to run with prod secr · CWE-94
How to override this blocker
Resolve the finding and push, or override it:
- On this comment: add a 👎 reaction and post an inline reply disputing it.
- Add the
critical_blocker_force_overridelabel to the PR to trigger re-evaluation.
Every Critical blocker on the PR must be disputed this way — the label on its own does not override a blocker that has no 👎 and reply.
1 participant
No description provided.