From 85d5bd447e9c0202fc927d85ede46fa0689c36b5 Mon Sep 17 00:00:00 2001 From: cliffhall Date: Sat, 11 Jul 2026 00:16:34 -0400 Subject: [PATCH] ci(publish): pass release tag via env to avoid script injection Re-review nit: interpolating `${{ github.event.release.tag_name }}` directly into the `run:` block is a script-injection surface (a crafted tag with shell metacharacters would splice into the script). Pass it through `env: TAG` so it arrives as a plain shell variable instead. Purely defensive; no behavior change. Co-Authored-By: Claude Opus 4.8 (1M context) Claude-Session: https://claude.ai/code/session_01BrihGWcrM9JGRyu41nzZYw --- .github/workflows/main.yml | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 6fb078f9..74c16615 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -116,10 +116,13 @@ jobs: # pack:verify) if they disagree — e.g. a release drafted without running # `npm version`, or cut from the wrong commit — since publishing is # irreversible. Tolerates the conventional leading `v` (npm version tags - # as `vX.Y.Z`). + # as `vX.Y.Z`). The tag arrives via `env:` (not spliced into the script) + # to avoid the script-injection surface of interpolating `${{ }}` into a + # `run:` block. + env: + TAG: ${{ github.event.release.tag_name }} run: | PKG="$(node -p "require('./package.json').version")" - TAG="${{ github.event.release.tag_name }}" if [ "${TAG#v}" != "$PKG" ]; then echo "Release tag '$TAG' does not match package.json version '$PKG'" exit 1