From 8fae8dd4c0936f78dec4f5b9da0f6d8d8ccd754c Mon Sep 17 00:00:00 2001 From: Benoit Tigeot Date: Wed, 29 Jul 2026 17:21:07 +0200 Subject: [PATCH] ci: pass ref name via env to block template injection Interpolating `github.ref_name` directly into the release `run` block lets an attacker-controlled ref name execute shell code. Pass it through the `GITHUB_REF_NAME` env var instead. Signed-off-by: Benoit Tigeot --- .github/workflows/release.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index af265a689..8f0a3429e 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -39,8 +39,8 @@ jobs: run: | set -eu -o pipefail - make build-cross VERSION="${{ github.ref_name }}" - make dist checksum VERSION="${{ github.ref_name }}" + make build-cross VERSION="${GITHUB_REF_NAME}" + make dist checksum VERSION="${GITHUB_REF_NAME}" - name: Set latest version run: |