From 45555615611e82a2f3044b771a98d3c127770628 Mon Sep 17 00:00:00 2001 From: Cameron G Date: Thu, 2 Jul 2026 15:10:00 -0400 Subject: [PATCH] ci: route release version input through env, not shell interpolation The parse-validate-version step in release.yml passes the workflow_dispatch version input to a bash script by interpolating the expression directly into the shell command: run: .github/utils/parse_validate_version.sh "${{ inputs.version }}" At runtime the runner expands the expression before /bin/bash parses the line, so the raw contents of the input become part of the shell source of the step. If a triggering actor supplies a version string containing a backtick, dollar-parenthesis, or quote-escape sequence, that content is evaluated by the shell before it ever reaches the script. The release workflow is guarded by an authorize job that requires the triggering actor to hold the maintain or admin role, so the practical risk today is limited: only trusted maintainers can reach this step. This change is defence in depth. It brings the step in line with the pattern used in the later bump-dc-pipeline-templates job (line 280 in the same file already sets VERSION via env), matches the guidance in GitHub's Security hardening for GitHub Actions documentation, and removes one more instance of the anti-pattern the ecosystem has been scrubbing since CVE-2025-30066. Same class of hardening as #11733 (persist-credentials: false) and #11777 (dependency pinning + CodeQL). --- .github/workflows/release.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index d3a83aa9911..18f6d946a03 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -57,7 +57,8 @@ jobs: id: parse-validate env: GH_TOKEN: ${{ github.token }} - run: .github/utils/parse_validate_version.sh "${{ inputs.version }}" + VERSION: ${{ inputs.version }} + run: .github/utils/parse_validate_version.sh "$VERSION" branch-off: needs: ["parse-validate-version"]