You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Right now this action provides an attack vector that could leak API Credentials to the Dynatrace API.
Unfortunately, this is by design of GH Actions when you use composite actions with Bash Scripts.
We can still download can execute install.sh from the dynatrace-operator. We just need to make sure (e.g., by calling env within that script) that no environment variables with the Token or the API URl are available.
Definition of Done
Security relevant environment variables can no longer be accessed by bash scripts via env
Right now this action provides an attack vector that could leak API Credentials to the Dynatrace API.
Unfortunately, this is by design of GH Actions when you use composite actions with Bash Scripts.
The only way to work around this would be to rewrite parts of this action in NodeJS, and access the secrets from
input
rather than from an environment variable, same as we do in gh-action-send-event:https://github.com/keptn/gh-action-send-event/blob/main/index.js#L5-L7
We can still download can execute
install.sh
from the dynatrace-operator. We just need to make sure (e.g., by callingenv
within that script) that no environment variables with the Token or the API URl are available.Definition of Done
env
The text was updated successfully, but these errors were encountered: