Refactor CI for forked repositories - Replace reportPaths by reports

.github/actions/reports-group/codacy-uploader-action/action.yml

@@ -67,7 +67,7 @@ runs:
           const {METADATA} = process.env;
 
           const metadata = JSON.parse(METADATA);
-          core.setOutput('coverage-reports', metadata.reportPaths); // Trusted path as it comes from trusted metadata (=from `reports-group/load-metadata`)
+          core.setOutput('coverage-reports', metadata.reports); // Trusted path as it comes from trusted metadata (=from `reports-group/load-metadata`)
 
     - name: Ensure at least one report to upload
       if: ${{ '' == steps.build-uploader-options.outputs.coverage-reports }}

.github/actions/reports-group/codecov-uploader-action/action.yml

@@ -106,7 +106,7 @@ runs:
 
           const metadata = JSON.parse(METADATA);
           core.setOutput('name', metadata.name);
-          core.setOutput('files', metadata.reportPaths); // Trusted path as it comes from trusted metadata (=from `reports-group/load-metadata`)
+          core.setOutput('files', metadata.reports); // Trusted path as it comes from trusted metadata (=from `reports-group/load-metadata`)
           if (metadata.flags.length > 0) {
             core.setOutput('flags', metadata.flags);
           }

.github/actions/reports-group/load-metadata-action/index.js

@@ -53,7 +53,6 @@ async function run() {
                     reports: formatList('reports'),
                     flags: formatList('flags'),
                     path: formatScalar('path'),
-                    reportPaths: formatList('reportPaths')
                 };
             }
 

.github/actions/reports-group/node-sdk/src/path.js

@@ -63,7 +63,7 @@ function trustFrom(workspacePath) {
         },
         /**
          * @param {string} untrustedGroupPath
-         * @returns {{name: string, format: string, reports: string[], flags: string[], path: string, reportPaths: string[]}}
+         * @returns {{name: string, format: string, reports: string[], flags: string[], path: string}}
          */
         trustedMetadataUnder: (untrustedGroupPath) => {
             const trustedPath = helpers.trust(path.join(untrustedGroupPath, METADATA_FILENAME));
@@ -72,15 +72,15 @@ function trustFrom(workspacePath) {
 
             const untrustedMetadata = JSON.parse(content);
             const trustedGroupPath = path.dirname(trustedPath);
-            const trustedReportPaths = untrustedMetadata.reports.map(r => helpers.trust(r));
+            // Ensure `reports` hasn't been tampered with ! (may lead to files outside the directory)
+            const trustedReportPathsConverter = trustFrom(trustedGroupPath);
 
             return {
                 name: untrustedMetadata.name,
                 format: untrustedMetadata.format,
-                reports: trustedReportPaths,
+                reports: untrustedMetadata.reports.map(r => trustedReportPathsConverter.trust(path.join(trustedGroupPath, r))),
                 flags: untrustedMetadata.flags,
                 path: withTrailingSeparator(trustedGroupPath),
-                reportPaths: trustedReportPaths.map(trustedFp => path.join(trustedGroupPath, trustedFp)),
             };
         }
     };