feat(scan): command injection, SSRF and traversal for Java; traversal… #32
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Mobile Release | |
| on: | |
| push: | |
| tags: | |
| - 'v*' | |
| workflow_dispatch: | |
| inputs: | |
| profile: | |
| description: 'EAS build profile (preview or production)' | |
| required: true | |
| type: choice | |
| default: preview | |
| options: | |
| - preview | |
| - production | |
| platform: | |
| description: 'Platform to build' | |
| required: true | |
| type: choice | |
| default: all | |
| options: | |
| - all | |
| - android | |
| - ios | |
| auto_submit: | |
| description: 'Submit to stores after build (production only)' | |
| required: false | |
| type: boolean | |
| default: false | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| build-mobile: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v7 | |
| - name: Setup pnpm | |
| uses: pnpm/action-setup@v6 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v7 | |
| with: | |
| node-version: 22 | |
| cache: 'pnpm' | |
| - name: Install dependencies | |
| run: pnpm install --frozen-lockfile | |
| - name: Write production env file | |
| shell: bash | |
| run: | | |
| printf '%s\n' '${{ secrets.ENV_FILE }}' > .env | |
| - name: Setup Expo and EAS | |
| uses: expo/expo-github-action@v9 | |
| with: | |
| expo-version: latest | |
| eas-version: latest | |
| token: ${{ secrets.EXPO_TOKEN }} | |
| - name: Determine build parameters | |
| id: params | |
| shell: bash | |
| env: | |
| INPUT_PROFILE: ${{ github.event.inputs.profile }} | |
| INPUT_PLATFORM: ${{ github.event.inputs.platform }} | |
| INPUT_AUTO_SUBMIT: ${{ github.event.inputs.auto_submit }} | |
| run: | | |
| if [ -n "$INPUT_PROFILE" ]; then | |
| PROFILE="$INPUT_PROFILE" | |
| else | |
| PROFILE="production" | |
| fi | |
| # Default to Android on tag pushes so releases don't stall on | |
| # iOS credentials setup. Override with workflow_dispatch. | |
| if [ -n "$INPUT_PLATFORM" ]; then | |
| PLATFORM="$INPUT_PLATFORM" | |
| else | |
| PLATFORM="android" | |
| fi | |
| if [ "$INPUT_AUTO_SUBMIT" = "true" ] && [ "$PROFILE" = "production" ]; then | |
| AUTO_SUBMIT="--auto-submit" | |
| else | |
| AUTO_SUBMIT="" | |
| fi | |
| echo "profile=$PROFILE" >> "$GITHUB_OUTPUT" | |
| echo "platform=$PLATFORM" >> "$GITHUB_OUTPUT" | |
| echo "auto_submit=$AUTO_SUBMIT" >> "$GITHUB_OUTPUT" | |
| - name: Run EAS build | |
| working-directory: apps/mobile | |
| env: | |
| THREATCRUSH_API_URL: https://threatcrush.com | |
| run: | | |
| eas build \ | |
| --non-interactive \ | |
| --platform ${{ steps.params.outputs.platform }} \ | |
| --profile ${{ steps.params.outputs.profile }} \ | |
| ${{ steps.params.outputs.auto_submit }} \ | |
| --wait | |
| - name: Summary | |
| if: always() | |
| env: | |
| PROFILE: ${{ steps.params.outputs.profile }} | |
| PLATFORM: ${{ steps.params.outputs.platform }} | |
| AUTO_SUBMIT: ${{ github.event.inputs.auto_submit || 'false' }} | |
| run: | | |
| echo "## Mobile Release Summary" >> "$GITHUB_STEP_SUMMARY" | |
| echo "" >> "$GITHUB_STEP_SUMMARY" | |
| echo "- **Profile**: $PROFILE" >> "$GITHUB_STEP_SUMMARY" | |
| echo "- **Platform**: $PLATFORM" >> "$GITHUB_STEP_SUMMARY" | |
| echo "- **Auto Submit**: $AUTO_SUBMIT" >> "$GITHUB_STEP_SUMMARY" | |
| echo "- **Requires**: EXPO_TOKEN + configured EAS project credentials" >> "$GITHUB_STEP_SUMMARY" |