Skip to content

ci: Replace curl-pipe-bash with action-setup-cli for Sentry CLI setup - #5899

Merged
runningcode merged 1 commit into
mainfrom
alextarasov/vuln-2261-command-injection-vulnerabilities-in-getsentrysentry-java-in
Aug 6, 2026
Merged

ci: Replace curl-pipe-bash with action-setup-cli for Sentry CLI setup#5899
runningcode merged 1 commit into
mainfrom
alextarasov/vuln-2261-command-injection-vulnerabilities-in-getsentrysentry-java-in

Conversation

@oioki

@oioki oioki commented Aug 6, 2026

Copy link
Copy Markdown
Member

Summary

  • Two "Install Sentry CLI" steps (build.yml, integration-tests-ui.yml) used curl -sL https://sentry.io/get-cli/ | bash, piping a remote install script directly into a shell.
  • Replaced both with getsentry/action-setup-cli, which downloads the sentry-cli release asset for the runner's OS/arch and verifies its sha256 against the digest GitHub recorded for that asset via the Releases API, before adding it to PATH. Uses gh only, no curl.
  • Preserved the existing if: condition on the integration-tests-ui.yml step.

Test plan

  • Validated both workflow files parse correctly
  • Verify both jobs still install sentry-cli and upload snapshots correctly on this PR

Fixes VULN-2261

🤖 Generated with Claude Code

Refs VULN-2261
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
@linear-code

linear-code Bot commented Aug 6, 2026

Copy link
Copy Markdown

VULN-2261

@sentry

sentry Bot commented Aug 6, 2026

Copy link
Copy Markdown

📲 Install Builds

Android

🔗 App Name App ID Version Configuration
SDK Size io.sentry.tests.size 8.52.0 (1) release

⚙️ sentry-android Build Distribution Settings

@github-actions

github-actions Bot commented Aug 6, 2026

Copy link
Copy Markdown
Contributor

Performance metrics 🚀

  Plain With Sentry Diff
Startup time 462.14 ms 471.67 ms 9.53 ms
Size 0 B 0 B 0 B

Baseline results on branch: main

Startup times

Revision Plain With Sentry Diff
d15471f 303.49 ms 439.08 ms 135.59 ms
b750b96 408.98 ms 480.32 ms 71.34 ms
17a0955 372.53 ms 446.70 ms 74.17 ms
d217708 355.34 ms 381.39 ms 26.05 ms
5b1a06b 310.56 ms 362.79 ms 52.22 ms
fcec2f2 311.35 ms 384.94 ms 73.59 ms
62b579c 349.26 ms 426.26 ms 77.00 ms
5f14e5d 325.76 ms 368.32 ms 42.56 ms
48277cd 320.38 ms 379.90 ms 59.52 ms
a416a65 295.53 ms 373.74 ms 78.21 ms

App size

Revision Plain With Sentry Diff
d15471f 1.58 MiB 2.13 MiB 559.54 KiB
b750b96 1.58 MiB 2.10 MiB 533.19 KiB
17a0955 1.58 MiB 2.10 MiB 533.20 KiB
d217708 1.58 MiB 2.10 MiB 532.97 KiB
5b1a06b 0 B 0 B 0 B
fcec2f2 1.58 MiB 2.12 MiB 551.51 KiB
62b579c 0 B 0 B 0 B
5f14e5d 1.58 MiB 2.19 MiB 620.00 KiB
48277cd 0 B 0 B 0 B
a416a65 1.58 MiB 2.12 MiB 555.26 KiB

@runningcode
runningcode merged commit 7d649bd into main Aug 6, 2026
78 of 80 checks passed
@runningcode
runningcode deleted the alextarasov/vuln-2261-command-injection-vulnerabilities-in-getsentrysentry-java-in branch August 6, 2026 10:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants