DO-1766: Remediate GitHub Actions template injection vulnerabilities

.github/workflows/aem-sync-to-cloudmanager-repo.yml

@@ -113,12 +113,14 @@ jobs:
           echo "🧪 Running Maven tests..."
 
           verbose=""
-          if [ "${{ inputs.debug }}" = "true" ]; then
+          if [ "${INPUTS_DEBUG}" = "true" ]; then
             verbose="-X"
           fi
 
           mvn -B verify $verbose
           echo "✅ Tests completed successfully"
+        env:
+          INPUTS_DEBUG: ${{ inputs.debug }}
 
   build:
     name: 🔨 Build
@@ -150,12 +152,14 @@ jobs:
           echo "🔨 Building AEM project with Maven..."
 
           verbose=""
-          if [ "${{ inputs.debug }}" = "true" ]; then
+          if [ "${INPUTS_DEBUG}" = "true" ]; then
             verbose="-X"
           fi
 
           mvn -B clean install $verbose
           echo "✅ Build completed successfully"
+        env:
+          INPUTS_DEBUG: ${{ inputs.debug }}
 
   sync-to-cloudmanager:
     name: 📤 Sync to Cloud Manager
@@ -228,7 +232,7 @@ jobs:
             echo "| **Target Branch** | ${GITHUB_REF_NAME} |" >> $GITHUB_STEP_SUMMARY
           fi
 
-          echo "| **Git Commit** | ${{ github.sha }} |" >> $GITHUB_STEP_SUMMARY
+          echo "| **Git Commit** | ${GITHUB_SHA} |" >> $GITHUB_STEP_SUMMARY
           echo "| **Triggered By** | ${GITHUB_ACTOR} |" >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY
           echo "### ✅ Sync Complete" >> $GITHUB_STEP_SUMMARY

.github/workflows/changeset-check.yml

@@ -88,9 +88,15 @@ jobs:
 
       - name: Install dependencies
         run: |
-          debug=${{ inputs.debug && '--verbose' || '' }}
+          debug=""
+          if [ "${INPUTS_DEBUG}" = "true" ]; then
+            debug="--verbose"
+          fi
           if [ "${INPUTS_PACKAGE_MANAGER}" = "yarn" ]; then
-            lock_flag=${{ inputs.is-yarn-classic && '--frozen-lockfile' || '--immutable' }}
+            lock_flag="--immutable"
+            if [ "${INPUTS_IS_YARN_CLASSIC}" = "true" ]; then
+              lock_flag="--frozen-lockfile"
+            fi
             yarn install $lock_flag $debug
           elif [ "${INPUTS_PACKAGE_MANAGER}" = "pnpm" ]; then
             pnpm install --frozen-lockfile $debug
@@ -100,6 +106,8 @@ jobs:
         env:
           NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
           INPUTS_PACKAGE_MANAGER: ${{ inputs.package-manager }}
+          INPUTS_DEBUG: ${{ inputs.debug }}
+          INPUTS_IS_YARN_CLASSIC: ${{ inputs.is-yarn-classic }}
 
       - name: Get Changed Files
         id: changed-files

.github/workflows/changeset-release.yml

@@ -115,9 +115,15 @@ jobs:
 
       - name: Install dependencies
         run: |
-          debug=${{ inputs.debug && '--verbose' || '' }}
+          debug=""
+          if [ "${INPUTS_DEBUG}" = "true" ]; then
+            debug="--verbose"
+          fi
           if [ "${INPUTS_PACKAGE_MANAGER}" = "yarn" ]; then
-            lock_flag=${{ inputs.is-yarn-classic && '--frozen-lockfile' || '--immutable' }}
+            lock_flag="--immutable"
+            if [ "${INPUTS_IS_YARN_CLASSIC}" = "true" ]; then
+              lock_flag="--frozen-lockfile"
+            fi
             yarn install $lock_flag $debug
           elif [ "${INPUTS_PACKAGE_MANAGER}" = "pnpm" ]; then
             pnpm install --frozen-lockfile $debug
@@ -127,6 +133,8 @@ jobs:
         env:
           NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
           INPUTS_PACKAGE_MANAGER: ${{ inputs.package-manager }}
+          INPUTS_DEBUG: ${{ inputs.debug }}
+          INPUTS_IS_YARN_CLASSIC: ${{ inputs.is-yarn-classic }}
 
       - name: Run pre-publish commands
         if: inputs.pre-publish-commands != ''

.github/workflows/magento-cloud-deploy.yml

@@ -114,10 +114,10 @@ jobs:
             -H "Content-Type: application/json" \
             -d '{
               "deployment": {
-                "revision": "${{ github.sha }}",
+                "revision": "'"${GITHUB_SHA}"'",
                 "changelog": "Magento Cloud deployment started",
-                "description": "Deployment to ${INPUTS_ENVIRONMENT} environment",
-                "user": "${GITHUB_ACTOR}"
+                "description": "Deployment to '"${INPUTS_ENVIRONMENT}"' environment",
+                "user": "'"${GITHUB_ACTOR}"'"
               }
             }'
 
@@ -146,7 +146,7 @@ jobs:
           echo "🚀 Starting deployment to ${INPUTS_ENVIRONMENT}..."
 
           debug=""
-          if [ "${{ inputs.debug }}" = "true" ]; then
+          if [ "${INPUTS_DEBUG}" = "true" ]; then
             debug="--verbose"
           fi
 
@@ -172,6 +172,7 @@ jobs:
         env:
           INPUTS_ENVIRONMENT: ${{ inputs.environment }}
           INPUTS_MAGENTO_CLOUD_PROJECT_ID: ${{ inputs.magento-cloud-project-id }}
+          INPUTS_DEBUG: ${{ inputs.debug }}
 
       - name: Get deployment information
         id: deploy-info
@@ -192,14 +193,15 @@ jobs:
             --columns id --no-header | head -1)
           echo "id=$DEPLOYMENT_ID" >> "$GITHUB_OUTPUT"
 
-          if [ "${{ inputs.debug }}" = "true" ]; then
+          if [ "${INPUTS_DEBUG}" = "true" ]; then
             echo "🔍 Deployment information:"
             echo "  URL: ${URL}"
             echo "  Deployment ID: ${DEPLOYMENT_ID}"
           fi
         env:
           INPUTS_ENVIRONMENT: ${{ inputs.environment }}
           INPUTS_MAGENTO_CLOUD_PROJECT_ID: ${{ inputs.magento-cloud-project-id }}
+          INPUTS_DEBUG: ${{ inputs.debug }}
 
       - name: Generate deployment summary
         run: |
@@ -213,7 +215,7 @@ jobs:
           echo "| **Environment** | ${INPUTS_ENVIRONMENT} |" >> $GITHUB_STEP_SUMMARY
           echo "| **Deployment ID** | ${STEPS_DEPLOY_INFO_OUTPUTS_ID} |" >> $GITHUB_STEP_SUMMARY
           echo "| **Site URL** | [$DEPLOY_URL]($DEPLOY_URL) |" >> $GITHUB_STEP_SUMMARY
-          echo "| **Git Commit** | ${{ github.sha }} |" >> $GITHUB_STEP_SUMMARY
+          echo "| **Git Commit** | ${GITHUB_SHA} |" >> $GITHUB_STEP_SUMMARY
           echo "| **Deployed By** | ${GITHUB_ACTOR} |" >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY
 
@@ -283,14 +285,14 @@ jobs:
           curl -X POST "https://api.newrelic.com/v2/applications/${INPUTS_NEWRELIC_APP_ID}/deployments.json" \
             -H "X-Api-Key: $NEWRELIC_API_KEY" \
             -H "Content-Type: application/json" \
-            -d "{
-              \"deployment\": {
-                \"revision\": \"${{ github.sha }}\",
-                \"changelog\": \"${CHANGELOG}\",
-                \"description\": \"${DESCRIPTION}\",
-                \"user\": \"${GITHUB_ACTOR}\"
+            -d '{
+              "deployment": {
+                "revision": "'"${GITHUB_SHA}"'",
+                "changelog": "'"${CHANGELOG}"'",
+                "description": "'"${DESCRIPTION}"'",
+                "user": "'"${GITHUB_ACTOR}"'"
               }
-            }"
+            }'
 
           echo "✅ NewRelic deployment marker created with status: ${STEPS_DEPLOYMENT_OUTCOME}"
 
@@ -313,9 +315,9 @@ jobs:
           fi
 
           # Determine CST reporting key - input overrides workspace secret
-          CST_KEY="${{ secrets.cst-reporting-token }}"
+          CST_KEY="${SECRETS_CST_REPORTING_TOKEN_INPUT}"
           if [ -z "$CST_KEY" ]; then
-            CST_KEY="${{ secrets.CST_REPORTING_TOKEN }}"
+            CST_KEY="${SECRETS_CST_REPORTING_TOKEN}"
           fi
 
           # Check if we have all required CST configuration
@@ -365,3 +367,5 @@ jobs:
           GITHUB_EVENT_REPOSITORY_NAME: ${{ github.event.repository.name }}
           INPUTS_CST_BRANCH: ${{ inputs.cst-branch }}
           GITHUB_EVENT_REPOSITORY_DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+          SECRETS_CST_REPORTING_TOKEN_INPUT: ${{ secrets.cst-reporting-token }}
+          SECRETS_CST_REPORTING_TOKEN: ${{ secrets.CST_REPORTING_TOKEN }}

.github/workflows/node-pr.yml

@@ -155,8 +155,11 @@ jobs:
             elif [ -n "$current_key" ]; then
               current_value="$(printf '%s\n%s' "${current_value}" "${line}")"
             fi
-          done <<< "${{ secrets.ENV_VARS }}"
+          done <<< "${SECRETS_ENV_VARS}"
           flush_var
+        env:
+          # zizmor: ignore[secrets-outside-env]
+          SECRETS_ENV_VARS: ${{ secrets.ENV_VARS }}
       - name: Run pre-install commands
         if: inputs.pre-install-commands != ''
         run: |
@@ -171,10 +174,19 @@ jobs:
           INPUTS_PRE_INSTALL_COMMANDS: ${{ inputs.pre-install-commands }}
       - name: Install dependencies
         run: |
-          debug=${{ inputs.debug && '--verbose' || '' }}
+          debug=""
+          if [ "${INPUTS_DEBUG}" = "true" ]; then
+            debug="--verbose"
+          fi
           if [ "${INPUTS_PACKAGE_MANAGER}" = "yarn" ]; then
-            lock_dependencies=${{ inputs.is-yarn-classic && '--frozen-lockfile' || '--immutable' }}
-            skip_cache=${{ inputs.skip-cache && '--force' || '' }}
+            lock_dependencies="--immutable"
+            if [ "${INPUTS_IS_YARN_CLASSIC}" = "true" ]; then
+              lock_dependencies="--frozen-lockfile"
+            fi
+            skip_cache=""
+            if [ "${INPUTS_SKIP_CACHE}" = "true" ]; then
+              skip_cache="--force"
+            fi
 
             yarn config get nodeLinker
             yarn install $lock_dependencies $skip_cache $debug
@@ -184,6 +196,9 @@ jobs:
 
         env:
           INPUTS_PACKAGE_MANAGER: ${{ inputs.package-manager }}
+          INPUTS_DEBUG: ${{ inputs.debug }}
+          INPUTS_IS_YARN_CLASSIC: ${{ inputs.is-yarn-classic }}
+          INPUTS_SKIP_CACHE: ${{ inputs.skip-cache }}
 
       # Use tar to store cache so file permissions are maintained (https://github.com/actions/upload-artifact/issues/38)
       - name: Archive node_modules with tar
@@ -254,8 +269,11 @@ jobs:
             elif [ -n "$current_key" ]; then
               current_value="$(printf '%s\n%s' "${current_value}" "${line}")"
             fi
-          done <<< "${{ secrets.ENV_VARS }}"
+          done <<< "${SECRETS_ENV_VARS}"
           flush_var
+        env:
+          # zizmor: ignore[secrets-outside-env]
+          SECRETS_ENV_VARS: ${{ secrets.ENV_VARS }}
 
       - name: Register problem matchers
         uses: aligent/workflows/.github/actions/node-problem-matchers@main
@@ -268,10 +286,16 @@ jobs:
 
       - name: Build (script)
         if: steps.check-build.outputs.exists-script == 'true'
-        run: ${INPUTS_PACKAGE_MANAGER} run ${INPUTS_BUILD_COMMAND} ${{ inputs.debug && '--verbose' || '' }}
+        run: |
+          debug=""
+          if [ "${INPUTS_DEBUG}" = "true" ]; then
+            debug="--verbose"
+          fi
+          ${INPUTS_PACKAGE_MANAGER} run ${INPUTS_BUILD_COMMAND} $debug
         env:
           INPUTS_PACKAGE_MANAGER: ${{ inputs.package-manager }}
           INPUTS_BUILD_COMMAND: ${{ inputs.build-command }}
+          INPUTS_DEBUG: ${{ inputs.debug }}
 
       - name: Fetch all commits for Nx
         if: steps.check-build.outputs.exists-nx-target == 'true'
@@ -283,9 +307,15 @@ jobs:
 
       - name: Build (nx)
         if: steps.check-build.outputs.exists-script != 'true' && steps.check-build.outputs.exists-nx-target == 'true'
-        run: npx nx run-many -t ${INPUTS_BUILD_COMMAND} ${{ inputs.debug && '--verbose' || '' }}
+        run: |
+          debug=""
+          if [ "${INPUTS_DEBUG}" = "true" ]; then
+            debug="--verbose"
+          fi
+          npx nx run-many -t ${INPUTS_BUILD_COMMAND} $debug
         env:
           INPUTS_BUILD_COMMAND: ${{ inputs.build-command }}
+          INPUTS_DEBUG: ${{ inputs.debug }}
 
       - name: Skip build (command not found)
         if: steps.check-build.outputs.exists-script != 'true' && steps.check-build.outputs.exists-nx-target != 'true'
@@ -364,8 +394,11 @@ jobs:
             elif [ -n "$current_key" ]; then
               current_value="$(printf '%s\n%s' "${current_value}" "${line}")"
             fi
-          done <<< "${{ secrets.ENV_VARS }}"
+          done <<< "${SECRETS_ENV_VARS}"
           flush_var
+        env:
+          # zizmor: ignore[secrets-outside-env]
+          SECRETS_ENV_VARS: ${{ secrets.ENV_VARS }}
 
       - name: Run pre-test command
         if: inputs.pre-test-command != ''
@@ -426,26 +459,26 @@ jobs:
         id: build-commands
         run: |
           commands=()
-          if [ "${{ inputs.skip-test }}" != "true" ] && [ "${STEPS_CHECK_TEST_OUTPUTS_EXISTS}" == "true" ]; then
+          if [ "${INPUTS_SKIP_TEST}" != "true" ] && [ "${STEPS_CHECK_TEST_OUTPUTS_EXISTS}" == "true" ]; then
             commands+=("${INPUTS_TEST_COMMAND}")
           fi
-          if [ "${{ inputs.skip-lint }}" != "true" ] && [ "${STEPS_CHECK_LINT_OUTPUTS_EXISTS}" == "true" ]; then
+          if [ "${INPUTS_SKIP_LINT}" != "true" ] && [ "${STEPS_CHECK_LINT_OUTPUTS_EXISTS}" == "true" ]; then
             commands+=("${INPUTS_LINT_COMMAND}")
           fi
-          if [ "${{ inputs.skip-format }}" != "true" ] && [ "${STEPS_CHECK_FORMAT_OUTPUTS_EXISTS}" == "true" ]; then
+          if [ "${INPUTS_SKIP_FORMAT}" != "true" ] && [ "${STEPS_CHECK_FORMAT_OUTPUTS_EXISTS}" == "true" ]; then
             commands+=("${INPUTS_FORMAT_COMMAND}")
           fi
-          if [ "${{ inputs.skip-test-storybook }}" != "true" ] && \
+          if [ "${INPUTS_SKIP_TEST_STORYBOOK}" != "true" ] && \
              [ "${STEPS_CHECK_TEST_STORYBOOK_OUTPUTS_EXISTS}" == "true" ]; then
-            # Ensure playwright dependencies are installed before story blok test execution begins 
+            # Ensure playwright dependencies are installed before story blok test execution begins
             if [ "${INPUTS_PACKAGE_MANAGER}" = "yarn" ]; then
               yarn playwright install --with-deps
             else
               npx playwright install --with-deps
             fi
             commands+=("${INPUTS_TEST_STORYBOOK_COMMAND}")
           fi
-          if [ "${{ inputs.skip-check-types }}" != "true" ] && \
+          if [ "${INPUTS_SKIP_CHECK_TYPES}" != "true" ] && \
              [ "${STEPS_CHECK_CHECK_TYPES_OUTPUTS_EXISTS}" == "true" ]; then
             commands+=("${INPUTS_CHECK_TYPES_COMMAND}")
           fi
@@ -464,6 +497,11 @@ jobs:
           INPUTS_TEST_STORYBOOK_COMMAND: ${{ inputs.test-storybook-command }}
           STEPS_CHECK_CHECK_TYPES_OUTPUTS_EXISTS: ${{ steps.check-check-types.outputs.exists }}
           INPUTS_CHECK_TYPES_COMMAND: ${{ inputs.check-types-command }}
+          INPUTS_SKIP_TEST: ${{ inputs.skip-test }}
+          INPUTS_SKIP_LINT: ${{ inputs.skip-lint }}
+          INPUTS_SKIP_FORMAT: ${{ inputs.skip-format }}
+          INPUTS_SKIP_TEST_STORYBOOK: ${{ inputs.skip-test-storybook }}
+          INPUTS_SKIP_CHECK_TYPES: ${{ inputs.skip-check-types }}
 
       - name: Run checks concurrently
         uses: aligent/workflows/.github/actions/run-checks@main

.github/workflows/nx-serverless-deployment.yml

@@ -105,12 +105,12 @@ jobs:
       - name: Install dependencies
         run: |
           debug=""
-          if [ "${{ inputs.debug }}" = "true" ]; then
+          if [ "${INPUTS_DEBUG}" = "true" ]; then
             debug="--verbose"
           fi
 
           lock_dependencies="--immutable"
-          if [ "${{ inputs.is-yarn-classic }}" = "true" ]; then
+          if [ "${INPUTS_IS_YARN_CLASSIC}" = "true" ]; then
             lock_dependencies="--frozen-lockfile"
           elif [ "${INPUTS_PACKAGE_MANAGER}" = "yarn" ]; then
             debug=""
@@ -124,6 +124,8 @@ jobs:
           fi
         env:
           INPUTS_PACKAGE_MANAGER: ${{ inputs.package-manager }}
+          INPUTS_DEBUG: ${{ inputs.debug }}
+          INPUTS_IS_YARN_CLASSIC: ${{ inputs.is-yarn-classic }}
 
       - name: 🔍 Check repository type
         id: repo-type