Skip to content

fix: ci release error #15

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
dsun0720 merged 1 commit into from
Aug 7, 2026
Merged

fix: ci release error #15

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 14 additions & 18 deletions .github/workflows/release.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,31 +17,27 @@ on:

jobs:
deploy:
permissions:
contents: write
runs-on: ubuntu-latest
environment: py-production
steps:
- uses: actions/checkout@v3
- uses: actions/checkout@v4
- name: Read current version
id: version
uses: ashley-taylor/read-json-property-action@v1.1
with:
path: ./release/package.json
property: version
- name: Read realease description
id: description
uses: juliangruber/read-file-action@v1.1.6
with:
path: ./release/description.md
run: |
python3 - <<'PY' >> "$GITHUB_OUTPUT"
import json
with open("release/package.json") as file:
print("value=%s" % json.load(file)["version"])
PY
- name: Create GitHub Release
uses: actions/create-release@latest
env:
GITHUB_TOKEN: ${{ secrets.PROJECT_RELEASE_TOKEN }}
with:
tag_name: v${{steps.version.outputs.value}}
release_name: v${{steps.version.outputs.value}}
body: ${{steps.description.outputs.content}}
draft: false
prerelease: false
GH_TOKEN: ${{ github.token }}
run: |
gh release create "v${{ steps.version.outputs.value }}" \
--title "v${{ steps.version.outputs.value }}" \
--notes-file release/description.md
Comment on lines 34 to +40

@greptile-apps greptile-apps Bot Aug 7, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 security Version output enables shell injection

When a commit on master or main supplies shell syntax in release/package.json, GitHub expands the unvalidated version directly into this script before parsing, allowing arbitrary commands to run with the contents: write token and modify repository content. Pass the output through an environment variable so the shell treats it as data. How this was verified: The workflow copies the unvalidated JSON value into a step output and expands it directly into a command executed with GH_TOKEN and contents: write.

Suggested change
- name: Create GitHub Release
uses: actions/create-release@latest
env:
GITHUB_TOKEN: ${{ secrets.PROJECT_RELEASE_TOKEN }}
with:
tag_name: v${{steps.version.outputs.value}}
release_name: v${{steps.version.outputs.value}}
body: ${{steps.description.outputs.content}}
draft: false
prerelease: false
GH_TOKEN: ${{ github.token }}
run: |
gh release create "v${{ steps.version.outputs.value }}" \
--title "v${{ steps.version.outputs.value }}" \
--notes-file release/description.md
- name: Create GitHub Release
env:
GH_TOKEN: ${{ github.token }}
VERSION: ${{ steps.version.outputs.value }}
run: |
gh release create "v${VERSION}" \
--title "v${VERSION}" \
--notes-file release/description.md
Prompt To Fix With AI 
This is a comment left during a code review.
Path: .github/workflows/release.yaml
Line: 34-40

Comment:
**Version output enables shell injection**

When a commit on `master` or `main` supplies shell syntax in `release/package.json`, GitHub expands the unvalidated version directly into this script before parsing, allowing arbitrary commands to run with the `contents: write` token and modify repository content. Pass the output through an environment variable so the shell treats it as data. **How this was verified:** The workflow copies the unvalidated JSON value into a step output and expands it directly into a command executed with `GH_TOKEN` and `contents: write`.

```suggestion
      - name: Create GitHub Release
        env:
          GH_TOKEN: ${{ github.token }}
          VERSION: ${{ steps.version.outputs.value }}
        run: |
          gh release create "v${VERSION}" \
            --title "v${VERSION}" \
            --notes-file release/description.md
```

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

- name: Set up Python
uses: actions/setup-python@v4
with:
Expand Down
Loading