fix(ci): prevent command injection in release tag workflow

[peter-matkovski]

Potential fix for https://github.com/GetStream/stream-chat-flutter/security/code-scanning/39

The safest fix is to stop embedding ${{ github.event.head_commit.message }} directly inside run: script text. Instead, pass it through an environment variable on the step and only reference the shell variable in the script. This prevents workflow-expression content from becoming executable shell code during script generation.

Best minimal change (no functional change):

• In .github/workflows/release_tag.yml, update the “🏷️ Extract Version Tag” step:
  • Add an env: block with e.g. COMMIT_MSG: ${{ github.event.head_commit.message }}.
  • Replace commit_msg="${{ github.event.head_commit.message }}" with commit_msg="$COMMIT_MSG".
• Keep all existing logic (regex match, output tag, error handling) unchanged.

No new methods, definitions, or imports are needed in this YAML workflow.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

Summary by CodeRabbit

• Chores
  • Improved release workflow handling for commit messages.
  • Enhanced reliability when creating release tags.

[coderabbitai]

Important

Review skipped

No new commits to review since the last review.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 005b91bc-1069-4dd8-8f93-cbe84b3948ae

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: preventing command injection in the release tag workflow.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}