Skip to content

ci: trunk-based release (publish on tags, single main branch) #57

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
devCluna merged 1 commit into from
Jul 2, 2026
Merged

ci: trunk-based release (publish on tags, single main branch) #57

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions .github/dependabot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ updates:
time: "09:00"
timezone: "America/Guayaquil"
open-pull-requests-limit: 10
target-branch: "development"
target-branch: "main"
groups:
strapi:
patterns:
Expand Down Expand Up @@ -37,4 +37,4 @@ updates:
time: "09:00"
timezone: "America/Guayaquil"
open-pull-requests-limit: 5
target-branch: "development"
target-branch: "main"
2 changes: 0 additions & 2 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,8 +4,6 @@ on:
push:
branches:
- main
- development
- production
pull_request:

jobs:
Expand Down
20 changes: 11 additions & 9 deletions .github/workflows/publish.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,8 +2,8 @@ name: Publish to npm

on:
push:
branches:
- production
tags:
- 'v*'

jobs:
publish:
Expand Down Expand Up @@ -63,20 +63,22 @@ jobs:
echo "tag=latest" >> $GITHUB_OUTPUT
fi

- name: Verify tag matches package version
run: |
if [ "${{ github.ref_name }}" != "v${{ steps.pkg.outputs.version }}" ]; then
echo "❌ Tag ${{ github.ref_name }} does not match package.json version v${{ steps.pkg.outputs.version }}."
exit 1
fi
Comment on lines +66 to +71

@coderabbitai coderabbitai Bot Jul 2, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Shell injection via unescaped github.ref_name interpolation.

${{ github.ref_name }} is spliced directly into the run: script body. A maliciously crafted tag name (e.g. containing quotes/backticks) can break out of the string and inject arbitrary shell commands that run with access to NPM_TOKEN/GITHUB_TOKEN. Pass the value via env instead of direct template expansion.

🔒 Proposed fix 
       - name: Verify tag matches package version
+        env:
+          REF_NAME: ${{ github.ref_name }}
+          PKG_VERSION: ${{ steps.pkg.outputs.version }}
         run: |
-          if [ "${{ github.ref_name }}" != "v${{ steps.pkg.outputs.version }}" ]; then
-            echo "❌ Tag ${{ github.ref_name }} does not match package.json version v${{ steps.pkg.outputs.version }}."
+          if [ "$REF_NAME" != "v$PKG_VERSION" ]; then
+            echo "❌ Tag $REF_NAME does not match package.json version v$PKG_VERSION."
             exit 1
           fi
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- name: Verify tag matches package version
run: |
if [ "${{ github.ref_name }}" != "v${{ steps.pkg.outputs.version }}" ]; then
echo "❌ Tag ${{ github.ref_name }} does not match package.json version v${{ steps.pkg.outputs.version }}."
exit 1
fi
- name: Verify tag matches package version
env:
REF_NAME: ${{ github.ref_name }}
PKG_VERSION: ${{ steps.pkg.outputs.version }}
run: |
if [ "$REF_NAME" != "v$PKG_VERSION" ]; then
echo "❌ Tag $REF_NAME does not match package.json version v$PKG_VERSION."
exit 1
fi
🧰 Tools
🪛 zizmor (1.26.1)

[error] 68-68: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)

[info] 68-68: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)

[error] 69-69: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)

[info] 69-69: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/publish.yml around lines 66 - 71, The tag verification
step in the publish workflow is vulnerable because github.ref_name is
interpolated directly into the shell script body. Move the tag value into an env
variable for the run step in the Verify tag matches package version block, then
compare that variable against steps.pkg.outputs.version inside the shell script
without direct template expansion. Keep the existing check logic, but reference
the env-bound value instead of github.ref_name in the script.

Source: Linters/SAST tools


- name: Publish to npm
run: npm publish --access public --tag ${{ steps.tag.outputs.tag }}
env:
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

- name: Create git tag
run: |
git tag v${{ steps.pkg.outputs.version }}
git push origin v${{ steps.pkg.outputs.version }}

- name: Create GitHub release
uses: softprops/action-gh-release@v2
with:
tag_name: v${{ steps.pkg.outputs.version }}
name: v${{ steps.pkg.outputs.version }}
tag_name: ${{ github.ref_name }}
name: ${{ github.ref_name }}
generate_release_notes: true
token: ${{ secrets.GITHUB_TOKEN }}
Loading