ci: trigger Python client model regeneration on OpenAPI spec changes#2305
ci: trigger Python client model regeneration on OpenAPI spec changes#2305
Conversation
vdusek
added
adhoc
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
Bugbot Free Tier Details
Your team is on the Bugbot Free tier. On this plan, Bugbot will review limited PRs each billing cycle for each member of your team.
To receive Bugbot reviews on all of your PRs, visit the Cursor dashboard to activate Pro and start your 14-day free trial.
Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Comment @cursor review or bugbot run to trigger another review on this PR
| gh workflow run regenerate_models.yaml \ | ||
| --repo apify/apify-client-python \ | ||
| --field docs_pr_number=${{ github.event.pull_request.number }} \ | ||
| --field docs_pr_branch=${{ github.head_ref }} |
There was a problem hiding this comment.
Script injection via unsanitized github.head_ref in shell
High Severity
${{ github.head_ref }} is directly interpolated into a run shell script, creating a script injection vulnerability. An attacker can craft a malicious branch name containing shell metacharacters (e.g., embedding $(curl ...)) that will execute arbitrary commands. This is especially dangerous here because the APIFY_SERVICE_ACCOUNT_GITHUB_TOKEN cross-repo secret is exposed in the environment and could be exfiltrated. The value needs to be passed via an environment variable instead of inline ${{ }} interpolation.
|
Preview for this PR was built for commit |
Add a job to openapi-ci.yaml that detects OpenAPI file changes in PRs using dorny/paths-filter and triggers the regenerate_models workflow in apify-client-python via gh workflow run. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
vdusek
force-pushed
the
fix/openapi-specs-pydantic-models
branch
from
9dac315 to
91cbdd6
Compare
|
Preview for this PR was built for commit |
2 participants
Summary
trigger-client-model-regenerationjob toopenapi-ci.yamldorny/paths-filter(path:apify-api/openapi/**)regenerate_models.yamlworkflow inapify/apify-client-pythonviagh workflow runAPIFY_SERVICE_ACCOUNT_GITHUB_TOKENfor cross-repo trigger (existing pattern)How it works
Related
Test plan
apify-api/openapi/🤖 Generated with Claude Code
Note
Cursor Bugbot is generating a summary for commit 9dac315. Configure here.