fix(security): prevent Actions script injection in workflows #326

Merged
jmiller merged 1 commits from fix/workflow-actions-injection into main 2026-06-29 16:19:28 +00:00
5 changed files with 20 additions and 10 deletions
+5 -2
View File
@@ -99,9 +99,11 @@ jobs:
fi
- name: Rename branch to rc
env:
HEAD_REF: ${{ github.event.pull_request.head.ref || 'dev' }}
run: |
php ${MOKO_CLI}/branch_rename.php \
--from "${{ github.event.pull_request.head.ref || 'dev' }}" --to rc \
--from "$HEAD_REF" --to rc \
--token "${{ secrets.MOKOGITEA_TOKEN }}" \
--api-base "${MOKOGITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}" \
--pr "${{ github.event.pull_request.number }}"
@@ -225,10 +227,11 @@ jobs:
- name: "Determine version bump level"
id: bump
env:
HEAD_REF: ${{ github.event.pull_request.head.ref || 'dev' }}
run: |
# Fix/patch branches: version was already bumped by pre-release, just strip suffix
# Feature/dev branches: bump minor for the new stable release
HEAD_REF="${{ github.event.pull_request.head.ref || 'dev' }}"
case "$HEAD_REF" in
fix/*|patch/*|hotfix/*|bugfix/*) BUMP="none" ;;
*) BUMP="minor" ;;
+2 -1
View File
@@ -30,8 +30,9 @@ jobs:
steps:
- name: Delete source branch
env:
BRANCH: ${{ github.event.pull_request.head.ref }}
run: |
BRANCH="${{ github.event.pull_request.head.ref }}"
API="${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}/api/v1/repos/${{ github.repository }}/branches"
ENCODED=$(php -r "echo rawurlencode('${BRANCH}');")
+8 -4
View File
@@ -59,10 +59,14 @@ jobs:
env:
MOKOGITEA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
MOKOGITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
GATE: ${{ inputs.gate }}
DETAILS: ${{ inputs.details }}
SEVERITY: ${{ inputs.severity }}
WORKFLOW: ${{ inputs.workflow }}
run: |
chmod +x /tmp/mokocli/cli/ci_issue_reporter.sh
/tmp/mokocli/cli/ci_issue_reporter.sh \
--gate "${{ inputs.gate }}" \
--details "${{ inputs.details }}" \
--severity "${{ inputs.severity }}" \
--workflow "${{ inputs.workflow }}"
--gate "$GATE" \
--details "$DETAILS" \
--severity "$SEVERITY" \
--workflow "$WORKFLOW"
+2 -1
View File
@@ -27,11 +27,12 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Create branch and comment
env:
ISSUE_TITLE: ${{ github.event.issue.title }}
run: |
TOKEN="${{ secrets.MOKOGITEA_TOKEN }}"
API="${MOKOGITEA_URL}/api/v1/repos/${{ github.repository }}"
ISSUE_NUM="${{ github.event.issue.number }}"
ISSUE_TITLE="${{ github.event.issue.title }}"
# Build slug from title: lowercase, replace non-alnum with dash, trim
SLUG=$(echo "${ISSUE_TITLE}" | tr '[:upper:]' '[:lower:]' | sed 's/[^a-z0-9]/-/g' | sed 's/--*/-/g' | sed 's/^-//;s/-$//' | cut -c1-40)
+3 -2
View File
@@ -30,9 +30,10 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Check branch merge target
env:
HEAD: ${{ github.head_ref }}
BASE: ${{ github.base_ref }}
run: |
HEAD="${{ github.head_ref }}"
BASE="${{ github.base_ref }}"
echo "PR: ${HEAD} → ${BASE}"