actions/azure-setup-helm
2
0
Fork 0
mirror of https://github.com/Azure/setup-helm.git synced 2026-06-05 17:04:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

fix: use chmod 755 instead of 777 for downloaded helm binary and folder (#278)
Some checks are pending
Run prettify / Prettier Check (push) Waiting to run
Details
Run unit tests. / build (macos-latest) (push) Waiting to run
Details
Run unit tests. / build (ubuntu-24.04-arm) (push) Waiting to run
Details
Run unit tests. / build (ubuntu-latest) (push) Waiting to run
Details
Run unit tests. / build (windows-11-arm) (push) Waiting to run
Details
Run unit tests. / build (windows-latest) (push) Waiting to run
Details

Browse source 
World-writable permissions allow other processes on shared runners to replace the helm binary or inject files between download and execution.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
This commit is contained in:
David Gamero 2026-06-04 19:25:36 -04:00 • committed by GitHub
parent 9dad99fe3c
commit 69214f9d74
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 7 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

8
src/run.test.ts
View file

@ -288,11 +288,11 @@ describe('run.ts', () => {
expect(toolCache.downloadTool).toHaveBeenCalledWith(
'https://test.tld/helm-v4.0.0-windows-amd64.zip'
)
expect(fs.chmodSync).toHaveBeenCalledWith('pathToTool', '777')
expect(fs.chmodSync).toHaveBeenCalledWith('pathToTool', '755')
expect(toolCache.extractZip).toHaveBeenCalledWith('pathToTool')
expect(fs.chmodSync).toHaveBeenCalledWith(
path.join('pathToCachedDir', 'helm.exe'),
'777'
'755'
)
})
@ -335,7 +335,7 @@ describe('run.ts', () => {
expect(toolCache.find).toHaveBeenCalledWith('helm', 'v3.2.1')
expect(fs.chmodSync).toHaveBeenCalledWith(
path.join('pathToCachedDir', 'helm.exe'),
'777'
'755'
)
})
@ -362,7 +362,7 @@ describe('run.ts', () => {
expect(toolCache.downloadTool).toHaveBeenCalledWith(
'https://test.tld/helm-v3.2.1-windows-amd64.zip'
)
expect(fs.chmodSync).toHaveBeenCalledWith('pathToTool', '777')
expect(fs.chmodSync).toHaveBeenCalledWith('pathToTool', '755')
expect(toolCache.extractZip).toHaveBeenCalledWith('pathToTool')
})
})

6
src/run.ts
View file

@ -105,7 +105,7 @@ export async function downloadHelm(
)
}
fs.chmodSync(helmDownloadPath, '777')
fs.chmodSync(helmDownloadPath, '755')
const extractedPath =
getPlatform() === 'windows'
? await toolCache.extractZip(helmDownloadPath)
@ -125,12 +125,12 @@ export async function downloadHelm(
)
}
fs.chmodSync(helmpath, '777')
fs.chmodSync(helmpath, '755')
return helmpath
}
export function findHelm(rootFolder: string): string {
fs.chmodSync(rootFolder, '777')
fs.chmodSync(rootFolder, '755')
let filelist: string[] = []
walkSync(rootFolder, filelist, helmToolName + getExecutableExtension())
if (!filelist || filelist.length == 0) {