Skip to content

Remove bundled workflow files from leading app templates - #306

Merged
PujaDeshmukh17 merged 5 commits into
developfrom
RBSDMS-LeadAppWorkflowRemoval-feature
Aug 14, 2026
Merged

Remove bundled workflow files from leading app templates#306
PujaDeshmukh17 merged 5 commits into
developfrom
RBSDMS-LeadAppWorkflowRemoval-feature

Conversation

@PujaDeshmukh17

@PujaDeshmukh17 PujaDeshmukh17 commented Aug 14, 2026

Copy link
Copy Markdown
Contributor

Removes example GitHub Actions workflow files (node.js.yml, create-test-branch.yml, and the checkout script) that were bundled inside the demo app directories for all four app variants:

Multi-tenant central space
Multi-tenant personal space
Single-tenant central space
Single-tenant personal space

These files were flagged by OrbisAI Security (cap-js/sdm#301) for a HIGH severity shell injection vulnerability — GitHub context variables (${{ github.* }}) were being interpolated directly in run: shell steps, allowing potential code execution via malicious PR titles or branch names.

Rather than patching each variant individually, the workflow files are removed entirely since they are not core to the library's functionality and shipping GitHub Actions templates inside a package creates an ongoing security maintenance burden for downstream consumers.

Single tenant integration Test: https://github.com/cap-js/sdm/actions/runs/31791434655
Multi tenant integration Test:

Type of change

Please delete options that are not relevant.

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • This change requires a documentation update

Checklist before requesting a review

  • I have tested the functionality on my cloud environment.
  • I have provided sufficient automated/ unit tests for the code.
  • I have increased or maintained the test coverage.
  • I have ran integration tests on my cloud environment.
  • I have validated blackduck portal for any vulnerability after my commit.

Upload Screenshots/lists of the scenarios tested

  • I have Uploaded Screenshots or added lists of the scenarios tested in description

@akgarg06
akgarg06 deployed to pr-analysis August 14, 2026 09:57 — with GitHub Actions Active
@akgarg06
akgarg06 deployed to pr-analysis August 14, 2026 09:57 — with GitHub Actions Active
@PujaDeshmukh17
PujaDeshmukh17 merged commit 28183c4 into develop Aug 14, 2026
8 checks passed
@PujaDeshmukh17
PujaDeshmukh17 deleted the RBSDMS-LeadAppWorkflowRemoval-feature branch August 14, 2026 11:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants