From 0244104b8dc746d9bd8e7a047ee49802a920bcf5 Mon Sep 17 00:00:00 2001 From: Garry Tan Date: Sat, 1 Aug 2026 19:38:11 +0800 Subject: [PATCH] fix(ci): env-bind the release-notes version interpolation Review hardening from the #3573 gatekeeper pass: a ${{ }} inside run: is shell injection by construction; bind through env instead. Not attacker-reachable today (VERSION comes from master), correct anyway. --- .github/workflows/release.yml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 01b890c3e..33a64846c 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -108,8 +108,13 @@ jobs: with: path: artifacts - name: Extract CHANGELOG entry for release notes + # env-bound, not inlined into the script: VERSION comes from master so + # it isn't attacker-reachable today, but a `${{ }}` inside `run:` is + # shell injection by construction if that ever changes. + env: + RELEASE_VERSION: ${{ needs.version.outputs.version }} run: | - v="${{ needs.version.outputs.version }}" + v="$RELEASE_VERSION" if ! bash scripts/changelog-entry.sh "$v" > /tmp/release-notes.md || ! [ -s /tmp/release-notes.md ]; then echo "See [CHANGELOG.md](https://github.com/${GITHUB_REPOSITORY}/blob/master/CHANGELOG.md) for v$v." > /tmp/release-notes.md fi