sisakulint/script/actions/cache-bloat-vulnerable.yaml at main · sisaku-security/sisakulint · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
name: Cache Bloat Vulnerable
on:
  push:
    branches:
      - master
  pull_request:
    branches:
      - master

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version-file: 'go.mod'
          cache: false
        id: go
      # Vulnerable: cache/restore without if condition
      - name: go cache restore
        uses: actions/cache/restore@v4
        with:
          path: |
            ~/go/pkg/mod
            ~/.cache/go-build
          key: go-cache-${{ runner.os }}-${{ hashFiles('**/go.sum') }}
          restore-keys: |
            go-cache-${{ runner.os }}-
      - name: Build
        run: go build ./...
      # Vulnerable: cache/save without if condition
      - name: go cache save
        uses: actions/cache/save@v4
        with:
          path: |
            ~/go/pkg/mod
            ~/.cache/go-build
          key: go-cache-${{ runner.os }}-${{ hashFiles('**/go.sum') }}

  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version-file: 'go.mod'
          cache: false
        id: go
      # Vulnerable: restore has condition but save doesn't
      - name: go cache restore
        if: github.event_name != 'push'
        uses: actions/cache/restore@v4
        with:
          path: |
            ~/go/pkg/mod
            ~/.cache/go-build
          key: go-cache-test-${{ runner.os }}-${{ hashFiles('**/go.sum') }}
      - name: Test
        run: go test ./...
      # Vulnerable: save without proper condition
      - name: go cache save
        uses: actions/cache/save@v4
        with:
          path: |
            ~/go/pkg/mod
            ~/.cache/go-build
          key: go-cache-test-${{ runner.os }}-${{ hashFiles('**/go.sum') }}