Skip to content

Commit dfa4312

Browse files
authored
workflows/release-binaries: Replace some workflow interpolations with env vars (#120860)
This is recommended by the GitHub Actions security hardening guide: https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable
1 parent 06cf4f9 commit dfa4312

File tree

1 file changed

+8
-8
lines changed

1 file changed

+8
-8
lines changed

.github/workflows/release-binaries.yml

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -83,7 +83,7 @@ jobs:
8383
USER_TOKEN: ${{ secrets.RELEASE_TASKS_USER_TOKEN }}
8484
shell: bash
8585
run: |
86-
./llvm/utils/release/./github-upload-release.py --token "$GITHUB_TOKEN" --user ${{ github.actor }} --user-token "$USER_TOKEN" check-permissions
86+
./llvm/utils/release/./github-upload-release.py --token "$GITHUB_TOKEN" --user "$GITHUB_ACTOR" --user-token "$USER_TOKEN" check-permissions
8787
8888
- name: Collect Variables
8989
id: vars
@@ -102,8 +102,8 @@ jobs:
102102
release_version="$trimmed"
103103
ref="llvmorg-$release_version"
104104
else
105-
release_version="${{ (github.event_name == 'pull_request' && format('PR{0}', github.event.pull_request.number)) || 'CI'}}-${{ github.sha }}"
106-
ref=${{ github.sha }}
105+
release_version="${{ (github.event_name == 'pull_request' && format('PR{0}', github.event.pull_request.number)) || 'CI'}}-$GITHUB_SHA"
106+
ref="$GITHUB_SHA"
107107
fi
108108
if [ -n "${{ inputs.upload }}" ]; then
109109
upload="${{ inputs.upload }}"
@@ -114,20 +114,20 @@ jobs:
114114
echo "ref=$ref" >> $GITHUB_OUTPUT
115115
echo "upload=$upload" >> $GITHUB_OUTPUT
116116
117-
release_binary_basename="LLVM-$release_version-${{ runner.os }}-${{ runner.arch }}"
117+
release_binary_basename="LLVM-$release_version-$RUNNER_OS-$RUNNER_ARCH"
118118
echo "release-binary-basename=$release_binary_basename" >> $GITHUB_OUTPUT
119119
echo "release-binary-filename=$release_binary_basename.tar.xz" >> $GITHUB_OUTPUT
120120
121121
# Detect necessary CMake flags
122-
target="${{ runner.os }}-${{ runner.arch }}"
122+
target="$RUNNER_OS-$RUNNER_ARCH"
123123
echo "enable-pgo=false" >> $GITHUB_OUTPUT
124124
target_cmake_flags="-DLLVM_RELEASE_ENABLE_PGO=OFF"
125125
# The macOS builds try to cross compile some libraries so we need to
126126
# add extra CMake args to disable them.
127127
# See https://github.com/llvm/llvm-project/issues/99767
128-
if [ "${{ runner.os }}" = "macOS" ]; then
128+
if [ "$RUNNER_OS" = "macOS" ]; then
129129
target_cmake_flags="$target_cmake_flags -DBOOTSTRAP_COMPILER_RT_ENABLE_IOS=OFF"
130-
if [ "${{ runner.arch }}" = "ARM64" ]; then
130+
if [ "$RUNNER_ARCH" = "ARM64" ]; then
131131
arches=arm64
132132
else
133133
arches=x86_64
@@ -137,7 +137,7 @@ jobs:
137137
138138
build_flang="true"
139139
140-
if [ "${{ runner.os }}" = "Windows" ]; then
140+
if [ "$RUNNER_OS" = "Windows" ]; then
141141
# The build times out on Windows, so we need to disable LTO.
142142
target_cmake_flags="$target_cmake_flags -DLLVM_RELEASE_ENABLE_LTO=OFF"
143143
fi

0 commit comments

Comments
 (0)