Skip to content

initialize CI #4

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
MatthiasBSchaefer wants to merge 2 commits into
base: master
Choose a base branch
from
Open

initialize CI #4

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
419f6f4
initialize CI
MatthiasBSchaefer Jun 29, 2026
3e48417
adapt workflow yml according to coderabbit
MatthiasBSchaefer Jun 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
121 changes: 121 additions & 0 deletions .github/workflows/external_triggered_CI.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,121 @@
on:
repository_dispatch:
types: [CI_trigger_type]

env:
EVENT_NUMBER: ${{ github.event.client_payload.number }}
BASE_SHA: ${{ github.event.client_payload.base_sha }}
PR_SHA: ${{ github.event.client_payload.head_sha }}
REPO_NAME: ${{ github.event.client_payload.github_repo }}
#WORKSPACE: ${{ github.workspace }}
PR_SERVER: ${{ vars.LTX_PR_SERVER }}
# WORKSPACE: $GITHUB_WORKSPACE

permissions:
contents: read

jobs:
Comment thread
coderabbitai[bot] marked this conversation as resolved.
run_dymola:
runs-on: ubuntu-latest
permissions: {}
container:
image: ghcr.io/matthiasbschaefer/dymola_image:latest

@coderabbitai coderabbitai Bot Jun 29, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Pin CI containers by digest instead of latest.

These images contain the CI tools/scripts that decide and publish PR results. A mutable tag can change outcomes without a reviewed workflow change.

📌 Proposed pinning pattern 
-      image: ghcr.io/matthiasbschaefer/dymola_image:latest
+      image: ghcr.io/matthiasbschaefer/dymola_image@sha256:<vetted-digest>
@@
-      image: ghcr.io/matthiasbschaefer/om_image:latest
+      image: ghcr.io/matthiasbschaefer/om_image@sha256:<vetted-digest>
@@
-      image: ghcr.io/matthiasbschaefer/om_image:latest
+      image: ghcr.io/matthiasbschaefer/om_image@sha256:<vetted-digest>

Also applies to: 45-45, 71-71

🧰 Tools
🪛 zizmor (1.26.1)

[error] 20-20: unpinned image references (unpinned-images): container image is pinned to latest

(unpinned-images)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/external_triggered_CI.yml at line 20, The CI workflow is
using a mutable container tag, so update the image references in the workflow to
use immutable digests instead of latest. Replace the
ghcr.io/matthiasbschaefer/dymola_image:latest reference (and the other image
entries noted in the comment) with pinned digest-based values in the relevant
job definitions so the workflow always runs against the reviewed image versions.

Source: Linters/SAST tools

options: --user=resimuser --rm
credentials:
username: ${{ secrets.GHCR_USER }}
password: ${{ secrets.GHCR_TOKEN }}

steps:
- uses: actions/checkout@v6
with:
persist-credentials: false
fetch-depth: 0
repository: ${{ env.REPO_NAME }}

- name: prepare
run: /work/run_scripts/prepare_tool.sh $GITHUB_WORKSPACE $EVENT_NUMBER $BASE_SHA $PR_SHA dymola

- name: run
run: /work/run_scripts/run_tool.sh $GITHUB_WORKSPACE $EVENT_NUMBER $BASE_SHA dymola



run_openmodelica:
runs-on: ubuntu-latest
permissions: {}
container:
image: ghcr.io/matthiasbschaefer/om_image:latest
options: --user=resimuser --rm
credentials:
username: ${{ secrets.GHCR_USER }}
password: ${{ secrets.GHCR_TOKEN }}

steps:
- uses: actions/checkout@v6
with:
persist-credentials: false
fetch-depth: 0
repository: ${{ env.REPO_NAME }}

- name: prepare
run: /work/run_scripts/prepare_tool.sh $GITHUB_WORKSPACE $EVENT_NUMBER $BASE_SHA $PR_SHA om

- name: run
run: /work/run_scripts/run_tool.sh $GITHUB_WORKSPACE $EVENT_NUMBER $BASE_SHA om



overview:
runs-on: ubuntu-latest
permissions: {}
needs: [run_openmodelica, run_dymola]
if: always()
container:
image: ghcr.io/matthiasbschaefer/om_image:latest
options: --user=resimuser --rm
credentials:
username: ${{ secrets.GHCR_USER }}
password: ${{ secrets.GHCR_TOKEN }}


steps:
- name: create_overview
run: /work/run_scripts/create_overview.sh $EVENT_NUMBER
- name: publish
run: /work/run_scripts/publish_reports.sh $EVENT_NUMBER



review:
runs-on: ubuntu-latest
needs: [run_openmodelica, run_dymola, overview]
if: always()
permissions: {}
# pull-requests: write
steps:
- name: Decide review event
id: decide
run: |
if [ "${{ needs.run_openmodelica.result }}" = "success" ] && [ "${{ needs.run_dymola.result }}" = "success" ]; then
echo "event=APPROVE" >> "$GITHUB_OUTPUT"
else
echo "event=REQUEST_CHANGES" >> "$GITHUB_OUTPUT"
fi
Comment thread
coderabbitai[bot] marked this conversation as resolved.
- name: Create review in other repo
env:
GH_TOKEN: ${{ secrets.MODELICA_TOKEN }}
TARGET_REPO: ${{ env.REPO_NAME }}
TARGET_PR: ${{ env.EVENT_NUMBER }}
EVENT: ${{ steps.decide.outputs.event }}
BODY: "Please look here for details:${{ env.PR_SERVER }}/${{ env.EVENT_NUMBER }}/Modelica/PR_comparison_report.html and ${{ env.PR_SERVER }}/${{ env.EVENT_NUMBER }}/ModelicaTest/PR_comparison_report.html"

run: |
set -euo pipefail
API="https://api.github.com/repos/${TARGET_REPO}/pulls/${TARGET_PR}/reviews"
payload="$(jq -n --arg event "$EVENT" --arg body "$BODY" '{event: $event, body: $body}')"
Comment on lines +107 to +115

@coderabbitai coderabbitai Bot Jun 29, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Validate the dispatched review target before using MODELICA_TOKEN.

TARGET_REPO and TARGET_PR come from repository_dispatch payload and are used with a privileged secret. Add an allowlist/pattern check before building the API URL so this workflow cannot be used to post reviews to an unintended repository/PR if dispatch access or token scope is broader than expected.

🔒 Proposed validation guard 
         run: |
            set -euo pipefail
+           case "$TARGET_REPO" in
+             ltx-simulation/ModelicaStandardLibrary) ;;
+             *) echo "Unexpected TARGET_REPO: $TARGET_REPO" >&2; exit 1 ;;
+           esac
+           [[ "$TARGET_PR" =~ ^[0-9]+$ ]] || { echo "Invalid TARGET_PR: $TARGET_PR" >&2; exit 1; }
            API="https://api.github.com/repos/${TARGET_REPO}/pulls/${TARGET_PR}/reviews"
            payload="$(jq -n --arg event "$EVENT" --arg body "$BODY" '{event: $event, body: $body}')"
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
TARGET_REPO: ${{ env.REPO_NAME }}
TARGET_PR: ${{ env.EVENT_NUMBER }}
EVENT: ${{ steps.decide.outputs.event }}
BODY: "Please look here for details:${{ env.PR_SERVER }}/${{ env.EVENT_NUMBER }}/Modelica/PR_comparison_report.html and ${{ env.PR_SERVER }}/${{ env.EVENT_NUMBER }}/ModelicaTest/PR_comparison_report.html"
run: |
set -euo pipefail
API="https://api.github.com/repos/${TARGET_REPO}/pulls/${TARGET_PR}/reviews"
payload="$(jq -n --arg event "$EVENT" --arg body "$BODY" '{event: $event, body: $body}')"
TARGET_REPO: ${{ env.REPO_NAME }}
TARGET_PR: ${{ env.EVENT_NUMBER }}
EVENT: ${{ steps.decide.outputs.event }}
BODY: "Please look here for details:${{ env.PR_SERVER }}/${{ env.EVENT_NUMBER }}/Modelica/PR_comparison_report.html and ${{ env.PR_SERVER }}/${{ env.EVENT_NUMBER }}/ModelicaTest/PR_comparison_report.html"
run: |
set -euo pipefail
case "$TARGET_REPO" in
ltx-simulation/ModelicaStandardLibrary) ;;
*) echo "Unexpected TARGET_REPO: $TARGET_REPO" >&2; exit 1 ;;
esac
[[ "$TARGET_PR" =~ ^[0-9]+$ ]] || { echo "Invalid TARGET_PR: $TARGET_PR" >&2; exit 1; }
API="https://api.github.com/repos/${TARGET_REPO}/pulls/${TARGET_PR}/reviews"
payload="$(jq -n --arg event "$EVENT" --arg body "$BODY" '{event: $event, body: $body}')"
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/external_triggered_CI.yml around lines 107 - 115, The
review dispatch flow in the workflow step that builds the GitHub API request
should validate TARGET_REPO and TARGET_PR before MODELICA_TOKEN is used. Add an
allowlist or strict pattern check in the same run block (before constructing API
and payload) so only the expected repository and a valid PR number are accepted,
and fail fast if the repository_dispatch payload is unexpected. Refer to the
TARGET_REPO, TARGET_PR, and API/payload setup in the external_triggered_CI job
when applying the guard.

curl --fail-with-body -sS -X POST "$API" \
-H "Authorization: Bearer $GH_TOKEN" \
-H "Accept: application/vnd.github+json" \
-H "Content-Type: application/json" \
-H "X-GitHub-Api-Version: 2022-11-28" \
--data "$payload"
Loading