fix(ci): harden ci-issue-reporter.yml against Actions injection #353

New Issue

2026-07-16T19:09:26Z

jmiller commented

2026-07-16 19:09:26 +00:00

Summary

The ci-issue-reporter.yml reusable workflow passes workflow_call inputs directly into run: blocks via ${{ inputs.* }} interpolation. This is a known GitHub/Gitea Actions injection vector -- a crafted input string could break out of the shell argument and execute arbitrary commands.

Affected Lines

/tmp/mokocli/cli/ci_issue_reporter.sh \
  --gate "${{ inputs.gate }}" \
  --details "${{ inputs.details }}" \
  --severity "${{ inputs.severity }}" \
  --workflow "${{ inputs.workflow }}"

Also the URL interpolation in the clone step:

MOKOGIT_URL="${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}"
git clone ... "${MOKOGIT_URL}/MokoConsulting/mokocli.git"

Fix

Pass all inputs and vars through the env: block and reference them as shell variables, which are not interpolated at YAML-parse time:

- name: Report CI failure
  env:
    MOKOGIT_TOKEN: ${{ secrets.MOKOGIT_TOKEN }}
    MOKOGIT_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
    INPUT_GATE: ${{ inputs.gate }}
    INPUT_DETAILS: ${{ inputs.details }}
    INPUT_SEVERITY: ${{ inputs.severity }}
    INPUT_WORKFLOW: ${{ inputs.workflow }}
  run: |
    chmod +x /tmp/mokocli/cli/ci_issue_reporter.sh
    /tmp/mokocli/cli/ci_issue_reporter.sh \
      --gate "$INPUT_GATE" \
      --details "$INPUT_DETAILS" \
      --severity "$INPUT_SEVERITY" \
      --workflow "$INPUT_WORKFLOW"

The clone step already uses env: for MOKOGIT_URL but then overrides it with direct interpolation in the run: block. Remove the inline reassignment and use the env var directly.

Scope

This file lives in MokoCLI and is synced to all product repos via workflow-sync. Fixing it here propagates the fix everywhere on next sync.

## Summary The `ci-issue-reporter.yml` reusable workflow passes `workflow_call` inputs directly into `run:` blocks via `${{ inputs.* }}` interpolation. This is a known GitHub/Gitea Actions injection vector -- a crafted input string could break out of the shell argument and execute arbitrary commands. ## Affected Lines ```yaml /tmp/mokocli/cli/ci_issue_reporter.sh \ --gate "${{ inputs.gate }}" \ --details "${{ inputs.details }}" \ --severity "${{ inputs.severity }}" \ --workflow "${{ inputs.workflow }}" ``` Also the URL interpolation in the clone step: ```yaml MOKOGIT_URL="${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}" git clone ... "${MOKOGIT_URL}/MokoConsulting/mokocli.git" ``` ## Fix Pass all inputs and vars through the `env:` block and reference them as shell variables, which are not interpolated at YAML-parse time: ```yaml - name: Report CI failure env: MOKOGIT_TOKEN: ${{ secrets.MOKOGIT_TOKEN }} MOKOGIT_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }} INPUT_GATE: ${{ inputs.gate }} INPUT_DETAILS: ${{ inputs.details }} INPUT_SEVERITY: ${{ inputs.severity }} INPUT_WORKFLOW: ${{ inputs.workflow }} run: | chmod +x /tmp/mokocli/cli/ci_issue_reporter.sh /tmp/mokocli/cli/ci_issue_reporter.sh \ --gate "$INPUT_GATE" \ --details "$INPUT_DETAILS" \ --severity "$INPUT_SEVERITY" \ --workflow "$INPUT_WORKFLOW" ``` The clone step already uses `env:` for `MOKOGIT_URL` but then overrides it with direct interpolation in the `run:` block. Remove the inline reassignment and use the env var directly. ## Scope This file lives in MokoCLI and is synced to all product repos via workflow-sync. Fixing it here propagates the fix everywhere on next sync.

jmiller commented

2026-07-16 19:15:44 +00:00

Branch created: feature/353-fix-ci-harden-ci-issue-reporter-yml-agai

git fetch origin
git checkout feature/353-fix-ci-harden-ci-issue-reporter-yml-agai

Branch created: [`feature/353-fix-ci-harden-ci-issue-reporter-yml-agai`](https://git.mokoconsulting.tech/MokoConsulting/MokoCLI/src/branch/feature/353-fix-ci-harden-ci-issue-reporter-yml-agai) ```bash git fetch origin git checkout feature/353-fix-ci-harden-ci-issue-reporter-yml-agai ```

jmiller referenced this issue

2026-07-16 21:54:28 +00:00

refactor: MokoGitea -> MokoGit migration + workflow-sync repairs (#350 #351 #352 #354 #11 #4) #356

jmiller commented

2026-07-17 03:24:18 +00:00

Resolved: ci-issue-reporter.yml routes workflow_call inputs through env: (no inline ${{ inputs.* }} in run:), merged to all 5 template mains. Closing.

jmiller closed this issue

2026-07-17 03:24:19 +00:00

Sign in to join this conversation.

Priority Medium

Type Feature

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: MokoConsulting/MokoCLI#353