patch.yml

name: Packaging
on:
  push:
   branches:
    - 5.51.3-patches

env:
  base_version: 5.51.3

jobs:
  build:
    name: Packaging
    runs-on: ubuntu-latest

    steps:
      - name: Download Civi
        env:
          civi_package: civicrm-${{ env.base_version }}-drupal.tar.gz
        run: |
          cd ..
          pwd
          mkdir to-be-patched
          wget https://storage.googleapis.com/civicrm/civicrm-stable/${base_version}/${civi_package}
          tar xzf ./${civi_package} -C to-be-patched

      - name: Apply SMARTY MATH RCE patch "CIVI-SA-2023-07"
        run: |
          cd ..
          rm -f to-be-patched/civicrm/packages/Smarty/plugins/function.math.php
          wget https://raw.githubusercontent.com/civicrm/civicrm-packages/5.65.1/Smarty/plugins/function.math.php
          mv function.math.php to-be-patched/civicrm/packages/Smarty/plugins/function.math.php

      - name: Apply KCFINDER XSS patch "CIVI-SA-2023-08"
        run: |
          cd ..
          rm -f to-be-patched/civicrm/packages/kcfinder/core/class/uploader.php
          wget https://raw.githubusercontent.com/civicrm/civicrm-packages/5.65.1/kcfinder/core/class/uploader.php
          mv uploader.php to-be-patched/civicrm/packages/kcfinder/core/class/uploader.php

      - name: Checkout the fork
        uses: actions/checkout@v2
        with:
          ref: ${{ env.base_version }}

      - name: Create patched package
        uses: 'compucorp/create-patch-from-fork@1.0.0'
        id: "patch"
        with:
          base_version: ${{ env.base_version }}
          project_dir: '../to-be-patched/civicrm'
          project_name: 'civicrm'
          project_type: 'civicrm-core'

      - name: Create a new release
        id: create_release
        uses: compucorp/create-release@target_commitish
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          tag_name: "${{ steps.patch.outputs.version }}"
          target_commitish: "${{ github.sha }}"
          release_name: "${{ steps.patch.outputs.version }}"
          body: "${{ steps.patch.outputs.version }}"

      - name: Upload Release Asset
        id: upload-release-asset
        uses: actions/upload-release-asset@v1.0.1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          upload_url: ${{ steps.create_release.outputs.upload_url }}
          asset_path: "${{ steps.patch.outputs.package_path }}"
          asset_name: "${{ steps.patch.outputs.package }}"
          asset_content_type: application/gzip