Skip to content

Commit 794ced2

Browse files
stuggiclaude
andcommitted
Remove tj-actions/branch-names from build workflow
Replace tj-actions/branch-names with github.ref_name which provides the branch name natively without a third-party action. The tj-actions GitHub namespace was compromised in March 2025 (CVE-2025-30066) and using actions from that namespace is no longer recommended. Pass the value via env: to avoid shell interpolation of untrusted input in run: blocks. Jira: OSPRH-31730 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Martin Schuppert <mschuppert@redhat.com>
1 parent 189e361 commit 794ced2

1 file changed

Lines changed: 4 additions & 6 deletions

File tree

.github/workflows/edpm-bootc.yaml

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -42,14 +42,12 @@ jobs:
4242
steps:
4343
- uses: actions/checkout@v4
4444

45-
- name: Get branch name
46-
id: branch-name
47-
uses: tj-actions/branch-names@v8
48-
4945
- name: Set latest tag for non main branch
50-
if: "${{ steps.branch-name.outputs.current_branch != 'main' }}"
46+
if: github.ref_name != 'main'
47+
env:
48+
BRANCH_NAME: ${{ github.ref_name }}
5149
run: |
52-
echo "latesttag=${{ steps.branch-name.outputs.current_branch }}-latest" >> $GITHUB_ENV
50+
echo "latesttag=${BRANCH_NAME}-latest" >> $GITHUB_ENV
5351
5452
- name: Set EDPM_* env vars
5553
run: |

0 commit comments

Comments
 (0)