James M. Greene b2c8af9d31 Secure early access staging deployment (#21450) ...

* Explicitly ensure the early access parent directories are created when cloning

* Use explicit --file flag with tar

* Remove security hole for Staging deployment by concatenating archives

* Fail the staging builds if *.js, .npmrc, or Procfile is changed in the open source repo

* docker build: extract user-code in separate directory

* Checkout PR base branch and install dependencies

* Remove one-off package installs

* Remove selective file checkout

* Don't persist git cloning credentials

It usually makes the clone of early access content fail in the later steps

* Update .github/workflows/staging-deploy-pr-docker.yml

Co-authored-by: James M. Greene <JamesMGreene@github.com>

* Update .github/workflows/staging-deploy-pr-docker.yml

Co-authored-by: James M. Greene <JamesMGreene@github.com>

* Remove debugging step

* Best practice: Use environment variables to avoid potential injection attacks if the data was user-controlled

Co-authored-by: Mike Surowiec <mikesurowiec@users.noreply.github.com>
Co-authored-by: Robert Sese <sese@github.com>
Co-authored-by: Robert Sese <robert.sese@gmail.com>

2021-09-17 22:41:13 +00:00

4.6 KiB

Executable File

Raw Blame History

View Raw