Fix shell injection and test false-positive

Use bash arrays for bakery command construction in shared
workflows. Inputs are quoted via env vars and conditionally
appended, preventing word-splitting or metacharacter injection.

Fix globemaster-allium test to assert mock was called and at
least one call includes the expected channel value, preventing
false-positive pass on zero calls.

Author: bschwedler

.github/workflows/bakery-build-native.yml

@@ -105,17 +105,23 @@ jobs:
       - name: Images by Version/Platform
         id: images-by-platform
         env:
-          DEV_STREAM_FLAG: ${{ inputs['dev-stream'] != '' && format('--dev-stream {0}', inputs['dev-stream']) || '' }}
-          DEV_CHANNEL_FLAG: ${{ inputs['dev-channel'] != '' && format('--value channel={0}', inputs['dev-channel']) || '' }}
+          DEV_STREAM: ${{ inputs['dev-stream'] }}
+          DEV_CHANNEL: ${{ inputs['dev-channel'] }}
         run: |
-          echo "platform_matrix=$(bakery ci matrix --quiet --dev-versions ${{ inputs.dev-versions }} --matrix-versions ${{ inputs.matrix-versions }} $DEV_STREAM_FLAG $DEV_CHANNEL_FLAG --context ${{ inputs.context }} | jq --compact-output .)" >> $GITHUB_OUTPUT
+          ARGS=(--quiet --dev-versions "${{ inputs.dev-versions }}" --matrix-versions "${{ inputs.matrix-versions }}" --context "${{ inputs.context }}")
+          [[ -n "$DEV_STREAM" ]] && ARGS+=(--dev-stream "$DEV_STREAM")
+          [[ -n "$DEV_CHANNEL" ]] && ARGS+=(--value "channel=$DEV_CHANNEL")
+          echo "platform_matrix=$(bakery ci matrix "${ARGS[@]}" | jq --compact-output .)" >> $GITHUB_OUTPUT
       - name: Images by Version
         id: images-by-version
         env:
-          DEV_STREAM_FLAG: ${{ inputs['dev-stream'] != '' && format('--dev-stream {0}', inputs['dev-stream']) || '' }}
-          DEV_CHANNEL_FLAG: ${{ inputs['dev-channel'] != '' && format('--value channel={0}', inputs['dev-channel']) || '' }}
+          DEV_STREAM: ${{ inputs['dev-stream'] }}
+          DEV_CHANNEL: ${{ inputs['dev-channel'] }}
         run: |
-          echo "versions_matrix=$(bakery ci matrix --quiet --dev-versions ${{ inputs.dev-versions }} --matrix-versions ${{ inputs.matrix-versions }} $DEV_STREAM_FLAG $DEV_CHANNEL_FLAG --exclude platform --context ${{ inputs.context }} | jq --compact-output .)" >> $GITHUB_OUTPUT
+          ARGS=(--quiet --dev-versions "${{ inputs.dev-versions }}" --matrix-versions "${{ inputs.matrix-versions }}" --exclude platform --context "${{ inputs.context }}")
+          [[ -n "$DEV_STREAM" ]] && ARGS+=(--dev-stream "$DEV_STREAM")
+          [[ -n "$DEV_CHANNEL" ]] && ARGS+=(--value "channel=$DEV_CHANNEL")
+          echo "versions_matrix=$(bakery ci matrix "${ARGS[@]}" | jq --compact-output .)" >> $GITHUB_OUTPUT
 
   build-test:
     name: "Build/Test ${{ matrix.img.image }}:${{ matrix.img.version }} (${{ matrix.img.platform }})"

.github/workflows/bakery-build.yml

@@ -95,10 +95,13 @@ jobs:
       - name: Images
         id: images
         env:
-          DEV_STREAM_FLAG: ${{ inputs['dev-stream'] != '' && format('--dev-stream {0}', inputs['dev-stream']) || '' }}
-          DEV_CHANNEL_FLAG: ${{ inputs['dev-channel'] != '' && format('--value channel={0}', inputs['dev-channel']) || '' }}
+          DEV_STREAM: ${{ inputs['dev-stream'] }}
+          DEV_CHANNEL: ${{ inputs['dev-channel'] }}
         run: |
-          echo "matrix=$(bakery ci matrix --quiet --dev-versions ${{ inputs.dev-versions }} --matrix-versions ${{ inputs.matrix-versions }} $DEV_STREAM_FLAG $DEV_CHANNEL_FLAG --context ${{ inputs.context }} | jq --compact-output .)" >> $GITHUB_OUTPUT
+          ARGS=(--quiet --dev-versions "${{ inputs.dev-versions }}" --matrix-versions "${{ inputs.matrix-versions }}" --context "${{ inputs.context }}")
+          [[ -n "$DEV_STREAM" ]] && ARGS+=(--dev-stream "$DEV_STREAM")
+          [[ -n "$DEV_CHANNEL" ]] && ARGS+=(--value "channel=$DEV_CHANNEL")
+          echo "matrix=$(bakery ci matrix "${ARGS[@]}" | jq --compact-output .)" >> $GITHUB_OUTPUT
 
   build:
     name: "${{ matrix.img.image }}:${{ matrix.img.version }}"

posit-bakery/test/config/image/test_image.py

@@ -804,9 +804,10 @@ def test_load_dev_versions_values_override_channel_url(self):
         # The override should replace config default.
         assert i.devVersions[0].values["channel"] == "globemaster-allium"
         # The overridden value should be passed to get_product_artifact_by_stream.
-        for call in mock_get.call_args_list:
-            if call.kwargs.get("values"):
-                assert call.kwargs["values"]["channel"] == "globemaster-allium"
+        assert mock_get.called
+        assert any(
+            call.kwargs.get("values", {}).get("channel") == "globemaster-allium" for call in mock_get.call_args_list
+        )
 
     def test_render_ephemeral_version_files(self, get_tmpcontext, common_image_variants_objects):
         """Test that render_ephemeral_version_files creates the correct directory structure for an ephemeral version."""