ci: bind version/ref inputs via env before shell in release workflows - #9388
Open
SashaMIT wants to merge 2 commits into
Open
ci: bind version/ref inputs via env before shell in release workflows#9388SashaMIT wants to merge 2 commits into
SashaMIT wants to merge 2 commits into
Conversation
3 tasks
Andezion
reviewed
Aug 6, 2026
| env: | ||
| INPUT_VERSION: ${{ inputs.version }} | ||
| run: | | ||
| CHANGELOG_VERSION=${VERSION#v} |
Collaborator
There was a problem hiding this comment.
What do you think about this line? As i see keyid comes from crazy-max/ghaction-import-gpg parsing a repo-owned secret, so practical risk is very low, but maybe we should fix this aswell??
Andezion
force-pushed
the
ci/bind-release-workflow-inputs-env
branch
from
August 6, 2026 18:41
777fe36 to
64e6070
Compare
Author
|
Good spot, thank you. Agreed on the risk assessment: Bound it via |
Follow-up to the docker/pypi env-binding pass: check-release-tag.yml, release-build.yml, release-publish.yml and pypi-build.yml still interpolated inputs.version / github.ref_name directly into run: blocks (script-injection class per GitHub's hardening guidance). Bind through env: and reference quoted shell variables instead. Also drops a dead duplicate CHANGELOG_VERSION assignment in release-publish.yml that ran before VERSION was set. Made-with: Cursor Changelog-None
Per review: keyid comes from crazy-max/ghaction-import-gpg parsing a repo-owned secret, so practical risk is low; bind it anyway so every run: block in the release path follows the same env-first pattern and the invariant does not depend on that action's output staying trusted. Made-with: Cursor Signed-off-by: SashaMIT <sash.t.mitchell@gmail.com>
cdecker
force-pushed
the
ci/bind-release-workflow-inputs-env
branch
from
August 7, 2026 14:34
11d8864 to
dffc947
Compare
cdecker
approved these changes
Aug 7, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Follow-up to #9383 (thanks @Andezion for the enumeration). The four workflows feeding the release pipeline still interpolated
inputs.version/github.ref_namedirectly intorun:blocks:check-release-tag.yml:echo "version=${{ inputs.version }}",TAG_VERSION="${{ github.ref_name }}",check-release.sh --version=${{ steps...version }}release-build.yml:[[ "${{ inputs.skip_validation }}" == "true" ]],--force-version "${{ inputs.version }}"release-publish.yml:VERSION="${{ inputs.version }}"pypi-build.yml:make update-pyln-versions NEW_VERSION=${{ inputs.version }}Same class as #9383: GitHub's documented script-injection guidance is to bind workflow inputs through
env:before shell use. All four now do.Also dropped a dead duplicate
CHANGELOG_VERSION=${VERSION#v}line inrelease-publish.ymlthat executed beforeVERSIONwas set.Left untouched deliberately:
if:/name:/with:/tag_name:interpolations (expression contexts, not shell) and${{ matrix.* }}values (hardcoded in the workflow).Test plan
Made with Cursor