Add cohort_streamed_diff_enabled input to perf test workflow - #42
Conversation
Adds a workflow_dispatch input that is forwarded to the sdk-tests repository_dispatch payload so a manual perf test run can enable AMPLITUDE_COHORT_STREAMED_DIFF_ENABLED (default false, added in #40) on the perf-test deployment. Push-triggered runs always send false. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
![semgrep-amplitude[bot]](https://avatars.githubusercontent.com/u/2291562?s=60&v=4){kind=small}
| run: | | ||
| if [ "${{ github.event.inputs.cohort_streamed_diff_enabled }}" = "true" ]; then | ||
| echo "cohort_streamed_diff_enabled=true" >> $GITHUB_OUTPUT | ||
| else | ||
| echo "cohort_streamed_diff_enabled=false" >> $GITHUB_OUTPUT | ||
| fi | ||
|
|
There was a problem hiding this comment.
Using variable interpolation ${{...}} with github context data in a run: step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. github context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with env: to store the data and use the environment variable in the run: script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".
🎉 Fixed in commit 86010d6 🎉
|
Semgrep found 2 Using variable interpolation |
…ction findings Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
3 participants
Summary
Adds a
cohort_streamed_diff_enabledboolean input (default false) to the manual perf test workflow, forwarded in therepository_dispatchpayload to amplitude/sdk-tests, which passes it to the deploy repo soAMPLITUDE_COHORT_STREAMED_DIFF_ENABLED(added in #40, default false) is set on the stage2 perf-test deployment in the same commit as the image tag.AMPLITUDE_COHORT_STREAMED_DIFF_ENABLED=truefor that perf run.false.Merge order: amplitude/deploy#23810 → amplitude/sdk-tests#6 → this PR.
Note: the flag is a runtime no-op until #40 merges; to perf-test #40 now, run this workflow from this branch and pass the #40 commit as the
shainput.Testing
🤖 Generated with Claude Code
Note
Low Risk
CI-only workflow changes with no application runtime impact; risk is limited to incorrect dispatch payload wiring for perf-test deployments.
Overview
Adds a
workflow_dispatchboolean inputcohort_streamed_diff_enabled(default false) so manual perf runs can turn onAMPLITUDE_COHORT_STREAMED_DIFF_ENABLEDon the stage2 perf-test deployment via the downstream chain.A new step normalizes that input to
true/false(including push-to-main and unchecked manual runs as false) and includescohort_streamed_diff_enabledin therepository_dispatchclient_payloadto amplitude/sdk-tests. The job summary now prints the flag value.Shell steps were tightened to pass values through
envinstead of inline${{ }}in scripts, and the dispatch body is built withjqpiped tocurlinstead of an inline JSON string.Reviewed by Cursor Bugbot for commit 86010d6. Bugbot is set up for automated code reviews on this repo. Configure here.