{"action":"opened","number":1785,"pull_request":{"url":"https://api.github.com/repos/StackStorm/st2/pulls/1785","id":41467886,"html_url":"https://github.com/StackStorm/st2/pull/1785","diff_url":"https://github.com/StackStorm/st2/pull/1785.diff","patch_url":"https://github.com/StackStorm/st2/pull/1785.patch","issue_url":"https://api.github.com/repos/StackStorm/st2/issues/1785","number":1785,"state":"open","locked":false,"title":"[WIP] Allow user to include arbitrary data files when creating a new action using the API","user":{"login":"Kami","id":125088,"avatar_url":"https://avatars.githubusercontent.com/u/125088?v=3","gravatar_id":"","url":"https://api.github.com/users/Kami","html_url":"https://github.com/Kami","followers_url":"https://api.github.com/users/Kami/followers","following_url":"https://api.github.com/users/Kami/following{/other_user}","gists_url":"https://api.github.com/users/Kami/gists{/gist_id}","starred_url":"https://api.github.com/users/Kami/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Kami/subscriptions","organizations_url":"https://api.github.com/users/Kami/orgs","repos_url":"https://api.github.com/users/Kami/repos","events_url":"https://api.github.com/users/Kami/events{/privacy}","received_events_url":"https://api.github.com/users/Kami/received_events","type":"User","site_admin":false},"body":"This pull request allows user to specify arbitrary action data files when creating an action using the API. Those data files are written on disk inside the \"actions/\" pack sub-directory.\r\n\r\nTo avoid requiring the user to also specify the pack meta-data, this action only allows users to write data files for the packs which already exist on disk.\r\n\r\nAn example use case is allowing st2flow to automatically create and write files such as work-flow definitions and files with graph node coordinates on the server.\r\n\r\nThis functionality builds on the existing API for creating actions and it's fully backward compatible.\r\n\r\nEvery time data file is written on disk we also dispatch an internal trigger. User can then use this trigger + StackStorm rule to automatically add this file to version control or similar. Eventually we will also need to figure out the whole DB and VCS sync issue (something we have talked for a long time), but I avoided this in this PR since that will be a bigger change which needs to be done systematically and needs more through.\r\n\r\nIn addition to that, I have also discovered and fixed a potential security issue inside the ``get_entry_point_abs_path`` function (eb1a4545a47cb0a1d2f051813b2039de7a46e6a0). If st2api was running as a privileged user and action ``entry_point`` attribute would point to an absolute location outside the pack directory, user could read an arbitrary file on disk using \"entry_points\" API endpoint.\r\n\r\nThis change now also implies that the ``entry_points`` needs to point to a file inside a pack directory (previously we didn't enforce that). I personally believe this is the right thing to do (users should include related scripts inside the pack directory), but if you don't agree, please post your arguments here. Entry point pointing to a file outside the pack directory opens us to a whole range of potential security issues.\r\n\r\n### Example API Payload\r\n\r\nThe \"POST actions\" payload is the same as before, only change is that it can now also contain optional ``data_files`` attribute.\r\n\r\n```json\r\n{\r\n...\r\n    \"data_files\": [\r\n        {\r\n            \"file_path\": \"workflows/my_wf_1.py\",\r\n            \"content\": \"aaaa\"\r\n        },\r\n        {\r\n            \"file_path\": \"random_action.py\",\r\n            \"content\": \"bbb\"\r\n        },\r\n        {\r\n            \"file_path\": \"misc/st2flow_coordinates.yaml\",\r\n            \"content\": \"ccc\"\r\n        }\r\n    ]\r\n}\r\n```","created_at":"2015-08-03T13:42:30Z","updated_at":"2015-08-03T13:42:30Z","closed_at":null,"merged_at":null,"merge_commit_sha":null,"assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/StackStorm/st2/pulls/1785/commits","review_comments_url":"https://api.github.com/repos/StackStorm/st2/pulls/1785/comments","review_comment_url":"https://api.github.com/repos/StackStorm/st2/pulls/comments{/number}","comments_url":"https://api.github.com/repos/StackStorm/st2/issues/1785/comments","statuses_url":"https://api.github.com/repos/StackStorm/st2/statuses/eb1a4545a47cb0a1d2f051813b2039de7a46e6a0","head":{"label":"StackStorm:create_action_include_data_files","ref":"create_action_include_data_files","sha":"eb1a4545a47cb0a1d2f051813b2039de7a46e6a0","user":{"login":"StackStorm","id":4969009,"avatar_url":"https://avatars.githubusercontent.com/u/4969009?v=3","gravatar_id":"","url":"https://api.github.com/users/StackStorm","html_url":"https://github.com/StackStorm","followers_url":"https://api.github.com/users/StackStorm/followers","following_url":"https://api.github.com/users/StackStorm/following{/other_user}","gists_url":"https://api.github.com/users/StackStorm/gists{/gist_id}","starred_url":"https://api.github.com/users/StackStorm/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/StackStorm/subscriptions","organizations_url":"https://api.github.com/users/StackStorm/orgs","repos_url":"https://api.github.com/users/StackStorm/repos","events_url":"https://api.github.com/users/StackStorm/events{/privacy}","received_events_url":"https://api.github.com/users/StackStorm/received_events","type":"Organization","site_admin":false},"repo":{"id":19051806,"name":"st2","full_name":"StackStorm/st2","owner":{"login":"StackStorm","id":4969009,"avatar_url":"https://avatars.githubusercontent.com/u/4969009?v=3","gravatar_id":"","url":"https://api.github.com/users/StackStorm","html_url":"https://github.com/StackStorm","followers_url":"https://api.github.com/users/StackStorm/followers","following_url":"https://api.github.com/users/StackStorm/following{/other_user}","gists_url":"https://api.github.com/users/StackStorm/gists{/gist_id}","starred_url":"https://api.github.com/users/StackStorm/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/StackStorm/subscriptions","organizations_url":"https://api.github.com/users/StackStorm/orgs","repos_url":"https://api.github.com/users/StackStorm/repos","events_url":"https://api.github.com/users/StackStorm/events{/privacy}","received_events_url":"https://api.github.com/users/StackStorm/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/StackStorm/st2","description":"StackStorm event driven automation code.  With workflow, rules engine, many to many integration and more.  Aka IFTTT for Ops (uber orchestration).  Zingy installer w/ dependencies included available at http://docs.stackstorm.com/install/index.html.  Ping us on slack - https://stackstorm-community.slack.com/. ","fork":false,"url":"https://api.github.com/repos/StackStorm/st2","forks_url":"https://api.github.com/repos/StackStorm/st2/forks","keys_url":"https://api.github.com/repos/StackStorm/st2/keys{/key_id}","collaborators_url":"https://api.github.com/repos/StackStorm/st2/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/StackStorm/st2/teams","hooks_url":"https://api.github.com/repos/StackStorm/st2/hooks","issue_events_url":"https://api.github.com/repos/StackStorm/st2/issues/events{/number}","events_url":"https://api.github.com/repos/StackStorm/st2/events","assignees_url":"https://api.github.com/repos/StackStorm/st2/assignees{/user}","branches_url":"https://api.github.com/repos/StackStorm/st2/branches{/branch}","tags_url":"https://api.github.com/repos/StackStorm/st2/tags","blobs_url":"https://api.github.com/repos/StackStorm/st2/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/StackStorm/st2/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/StackStorm/st2/git/refs{/sha}","trees_url":"https://api.github.com/repos/StackStorm/st2/git/trees{/sha}","statuses_url":"https://api.github.com/repos/StackStorm/st2/statuses/{sha}","languages_url":"https://api.github.com/repos/StackStorm/st2/languages","stargazers_url":"https://api.github.com/repos/StackStorm/st2/stargazers","contributors_url":"https://api.github.com/repos/StackStorm/st2/contributors","subscribers_url":"https://api.github.com/repos/StackStorm/st2/subscribers","subscription_url":"https://api.github.com/repos/StackStorm/st2/subscription","commits_url":"https://api.github.com/repos/StackStorm/st2/commits{/sha}","git_commits_url":"https://api.github.com/repos/StackStorm/st2/git/commits{/sha}","comments_url":"https://api.github.com/repos/StackStorm/st2/comments{/number}","issue_comment_url":"https://api.github.com/repos/StackStorm/st2/issues/comments{/number}","contents_url":"https://api.github.com/repos/StackStorm/st2/contents/{+path}","compare_url":"https://api.github.com/repos/StackStorm/st2/compare/{base}...{head}","merges_url":"https://api.github.com/repos/StackStorm/st2/merges","archive_url":"https://api.github.com/repos/StackStorm/st2/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/StackStorm/st2/downloads","issues_url":"https://api.github.com/repos/StackStorm/st2/issues{/number}","pulls_url":"https://api.github.com/repos/StackStorm/st2/pulls{/number}","milestones_url":"https://api.github.com/repos/StackStorm/st2/milestones{/number}","notifications_url":"https://api.github.com/repos/StackStorm/st2/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/StackStorm/st2/labels{/name}","releases_url":"https://api.github.com/repos/StackStorm/st2/releases{/id}","created_at":"2014-04-23T00:51:34Z","updated_at":"2015-08-01T16:29:52Z","pushed_at":"2015-08-03T12:51:23Z","git_url":"git://github.com/StackStorm/st2.git","ssh_url":"git@github.com:StackStorm/st2.git","clone_url":"https://github.com/StackStorm/st2.git","svn_url":"https://github.com/StackStorm/st2","homepage":"http://www.stackstorm.com/","size":25973,"stargazers_count":268,"watchers_count":268,"language":"Python","has_issues":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":56,"mirror_url":null,"open_issues_count":46,"forks":56,"open_issues":46,"watchers":268,"default_branch":"master"}},"base":{"label":"StackStorm:master","ref":"master","sha":"e98e9bd768ab2946ca4baf9a1971cd2daa30a7e4","user":{"login":"StackStorm","id":4969009,"avatar_url":"https://avatars.githubusercontent.com/u/4969009?v=3","gravatar_id":"","url":"https://api.github.com/users/StackStorm","html_url":"https://github.com/StackStorm","followers_url":"https://api.github.com/users/StackStorm/followers","following_url":"https://api.github.com/users/StackStorm/following{/other_user}","gists_url":"https://api.github.com/users/StackStorm/gists{/gist_id}","starred_url":"https://api.github.com/users/StackStorm/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/StackStorm/subscriptions","organizations_url":"https://api.github.com/users/StackStorm/orgs","repos_url":"https://api.github.com/users/StackStorm/repos","events_url":"https://api.github.com/users/StackStorm/events{/privacy}","received_events_url":"https://api.github.com/users/StackStorm/received_events","type":"Organization","site_admin":false},"repo":{"id":19051806,"name":"st2","full_name":"StackStorm/st2","owner":{"login":"StackStorm","id":4969009,"avatar_url":"https://avatars.githubusercontent.com/u/4969009?v=3","gravatar_id":"","url":"https://api.github.com/users/StackStorm","html_url":"https://github.com/StackStorm","followers_url":"https://api.github.com/users/StackStorm/followers","following_url":"https://api.github.com/users/StackStorm/following{/other_user}","gists_url":"https://api.github.com/users/StackStorm/gists{/gist_id}","starred_url":"https://api.github.com/users/StackStorm/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/StackStorm/subscriptions","organizations_url":"https://api.github.com/users/StackStorm/orgs","repos_url":"https://api.github.com/users/StackStorm/repos","events_url":"https://api.github.com/users/StackStorm/events{/privacy}","received_events_url":"https://api.github.com/users/StackStorm/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/StackStorm/st2","description":"StackStorm event driven automation code.  With workflow, rules engine, many to many integration and more.  Aka IFTTT for Ops (uber orchestration).  Zingy installer w/ dependencies included available at http://docs.stackstorm.com/install/index.html.  Ping us on slack - https://stackstorm-community.slack.com/. ","fork":false,"url":"https://api.github.com/repos/StackStorm/st2","forks_url":"https://api.github.com/repos/StackStorm/st2/forks","keys_url":"https://api.github.com/repos/StackStorm/st2/keys{/key_id}","collaborators_url":"https://api.github.com/repos/StackStorm/st2/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/StackStorm/st2/teams","hooks_url":"https://api.github.com/repos/StackStorm/st2/hooks","issue_events_url":"https://api.github.com/repos/StackStorm/st2/issues/events{/number}","events_url":"https://api.github.com/repos/StackStorm/st2/events","assignees_url":"https://api.github.com/repos/StackStorm/st2/assignees{/user}","branches_url":"https://api.github.com/repos/StackStorm/st2/branches{/branch}","tags_url":"https://api.github.com/repos/StackStorm/st2/tags","blobs_url":"https://api.github.com/repos/StackStorm/st2/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/StackStorm/st2/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/StackStorm/st2/git/refs{/sha}","trees_url":"https://api.github.com/repos/StackStorm/st2/git/trees{/sha}","statuses_url":"https://api.github.com/repos/StackStorm/st2/statuses/{sha}","languages_url":"https://api.github.com/repos/StackStorm/st2/languages","stargazers_url":"https://api.github.com/repos/StackStorm/st2/stargazers","contributors_url":"https://api.github.com/repos/StackStorm/st2/contributors","subscribers_url":"https://api.github.com/repos/StackStorm/st2/subscribers","subscription_url":"https://api.github.com/repos/StackStorm/st2/subscription","commits_url":"https://api.github.com/repos/StackStorm/st2/commits{/sha}","git_commits_url":"https://api.github.com/repos/StackStorm/st2/git/commits{/sha}","comments_url":"https://api.github.com/repos/StackStorm/st2/comments{/number}","issue_comment_url":"https://api.github.com/repos/StackStorm/st2/issues/comments{/number}","contents_url":"https://api.github.com/repos/StackStorm/st2/contents/{+path}","compare_url":"https://api.github.com/repos/StackStorm/st2/compare/{base}...{head}","merges_url":"https://api.github.com/repos/StackStorm/st2/merges","archive_url":"https://api.github.com/repos/StackStorm/st2/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/StackStorm/st2/downloads","issues_url":"https://api.github.com/repos/StackStorm/st2/issues{/number}","pulls_url":"https://api.github.com/repos/StackStorm/st2/pulls{/number}","milestones_url":"https://api.github.com/repos/StackStorm/st2/milestones{/number}","notifications_url":"https://api.github.com/repos/StackStorm/st2/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/StackStorm/st2/labels{/name}","releases_url":"https://api.github.com/repos/StackStorm/st2/releases{/id}","created_at":"2014-04-23T00:51:34Z","updated_at":"2015-08-01T16:29:52Z","pushed_at":"2015-08-03T12:51:23Z","git_url":"git://github.com/StackStorm/st2.git","ssh_url":"git@github.com:StackStorm/st2.git","clone_url":"https://github.com/StackStorm/st2.git","svn_url":"https://github.com/StackStorm/st2","homepage":"http://www.stackstorm.com/","size":25973,"stargazers_count":268,"watchers_count":268,"language":"Python","has_issues":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":56,"mirror_url":null,"open_issues_count":46,"forks":56,"open_issues":46,"watchers":268,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/StackStorm/st2/pulls/1785"},"html":{"href":"https://github.com/StackStorm/st2/pull/1785"},"issue":{"href":"https://api.github.com/repos/StackStorm/st2/issues/1785"},"comments":{"href":"https://api.github.com/repos/StackStorm/st2/issues/1785/comments"},"review_comments":{"href":"https://api.github.com/repos/StackStorm/st2/pulls/1785/comments"},"review_comment":{"href":"https://api.github.com/repos/StackStorm/st2/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/StackStorm/st2/pulls/1785/commits"},"statuses":{"href":"https://api.github.com/repos/StackStorm/st2/statuses/eb1a4545a47cb0a1d2f051813b2039de7a46e6a0"}},"merged":false,"mergeable":null,"mergeable_state":"unknown","merged_by":null,"comments":0,"review_comments":0,"commits":9,"additions":255,"deletions":29,"changed_files":6}}