Follow Security Guide to update release.yml (#205)

* Follow Security Guide to update release.yml
FreeRTOS · Nov 4, 2024 · 1f86d12 · 1f86d12
1 parent 664d22a
commit 1f86d12
Show file tree

Hide file tree

Showing 2 changed files with 36 additions and 16 deletions.
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -20,31 +20,43 @@ jobs:
         with:
           ref: ${{ github.event.inputs.commit_id }}
       - name: Configure git identity
+        env:
+          ACTOR: ${{ github.actor }}
         run: |
-          git config --global user.name ${{ github.actor }}
-          git config --global user.email ${{ github.actor }}@users.noreply.github.com
+          git config --global user.name "$ACTOR"
+          git config --global user.email "$ACTOR"@users.noreply.github.com
       - name: create a new branch that references commit id
-        run: git checkout -b ${{ github.event.inputs.version_number }} ${{ github.event.inputs.commit_id }}
+        env:
+          VERSION_NUMBER: ${{ github.event.inputs.version_number }}
+          COMMIT_ID: ${{ github.event.inputs.commit_id }}
+        run: git checkout -b "$VERSION_NUMBER" "$COMMIT_ID"
       - name: Generate SBOM
         uses: FreeRTOS/CI-CD-Github-Actions/sbom-generator@main
         with:
           repo_path: ./
           source_path: ./source
       - name: commit SBOM file
+        env:
+          VERSION_NUMBER: ${{ github.event.inputs.version_number }}
         run: |
           git add .
           git commit -m 'Update SBOM'
-          git push -u origin ${{ github.event.inputs.version_number }}
+          git push -u origin "$VERSION_NUMBER"
       - name: Tag Commit and Push to remote
+        env:
+          VERSION_NUMBER: ${{ github.event.inputs.version_number }}
         run: |
-          git tag ${{ github.event.inputs.version_number }} -a -m "corePKCS11 Library ${{ github.event.inputs.version_number }}"
+          git tag "$VERSION_NUMBER" -a -m "corePKCS11 Library $VERSION_NUMBER"
           git push origin --tags
       - name: Verify tag on remote
+        env:
+          VERSION_NUMBER: ${{ github.event.inputs.version_number }}
+          COMMIT_ID: ${{ github.event.inputs.commit_id }}
         run: |
-          git tag -d ${{ github.event.inputs.version_number }}
+          git tag -d "$VERSION_NUMBER"
           git remote update
-          git checkout tags/${{ github.event.inputs.version_number }}
-          git diff ${{ github.event.inputs.commit_id }} tags/${{ github.event.inputs.version_number }}
+          git checkout tags/"$VERSION_NUMBER"
+          git diff "$COMMIT_ID" tags/"$VERSION_NUMBER"
   create-zip:
     needs: tag-commit
     name: Create ZIP and verify package for release asset.
@@ -63,21 +75,27 @@ jobs:
           cd corePKCS11
           git submodule update --init --checkout --recursive
       - name: Create ZIP
+        env:
+          VERSION_NUMBER: ${{ github.event.inputs.version_number }}
         run: |
-          zip -r corePKCS11-${{ github.event.inputs.version_number }}.zip corePKCS11 -x "*.git*"
+          zip -r corePKCS11-"$VERSION_NUMBER".zip corePKCS11 -x "*.git*"
           ls ./
       - name: Validate created ZIP
+        env:
+          VERSION_NUMBER: ${{ github.event.inputs.version_number }}
         run: |
           mkdir zip-check
-          mv corePKCS11-${{ github.event.inputs.version_number }}.zip zip-check
+          mv corePKCS11-"$VERSION_NUMBER".zip zip-check
           cd zip-check
-          unzip corePKCS11-${{ github.event.inputs.version_number }}.zip -d corePKCS11-${{ github.event.inputs.version_number }}
-          ls corePKCS11-${{ github.event.inputs.version_number }}
-          diff -r -x "*.git*" corePKCS11-${{ github.event.inputs.version_number }}/corePKCS11/ ../corePKCS11/
+          unzip corePKCS11-"$VERSION_NUMBER".zip -d corePKCS11-"$VERSION_NUMBER"
+          ls corePKCS11-"$VERSION_NUMBER"
+          diff -r -x "*.git*" corePKCS11-"$VERSION_NUMBER"/corePKCS11/ ../corePKCS11/
           cd ../
       - name: Build
+        env:
+          VERSION_NUMBER: ${{ github.event.inputs.version_number }}
         run: |
-          cd zip-check/corePKCS11-${{ github.event.inputs.version_number }}/corePKCS11
+          cd zip-check/corePKCS11-"$VERSION_NUMBER"/corePKCS11
           sudo apt-get install -y lcov
           cmake -S test -B build/ \
           -G "Unix Makefiles" \
@@ -86,8 +104,10 @@ jobs:
           -DCMAKE_C_FLAGS='--coverage -Wall -Wextra -DNDEBUG'
           make -C build/ all
       - name: Test
+        env:
+          VERSION_NUMBER: ${{ github.event.inputs.version_number }}
         run: |
-          cd zip-check/corePKCS11-${{ github.event.inputs.version_number }}/corePKCS11/build/
+          cd zip-check/corePKCS11-"$VERSION_NUMBER"/corePKCS11/build/
           ctest -E system --output-on-failure
           cd ..
       - name: Create artifact of ZIP

diff --git a/tools/coverity/README.md b/tools/coverity/README.md
@@ -12,7 +12,7 @@ see the [MISRA.md](https://github.com/FreeRTOS/corePKCS11/blob/main/MISRA.md) fi
 
 ## Getting Started
 ### Prerequisites
-You can run this on a platform supported by Coverity. The list and other details can be found [here](https://sig-docs.synopsys.com/polaris/topics/c_coverity-compatible-platforms.html).
+You can run this on a platform supported by Coverity. The list and other details can be found [here](https://documentation.blackduck.com/bundle/coverity-docs/page/deploy-install-guide/topics/supported_platforms_for_coverity_analysis).
 To compile and run the Coverity target successfully, you must have the following:
 
 1. CMake version > 3.13.0 (You can check whether you have this by typing `cmake --version`)