Skip to content

Commit 05ca755

Browse files
vszakatsvszakats
committed
GHA: silence zizmor warnings [ci skip]
Thanks @woodruffw! One of these for each job: ``` error[template-injection]: code injection via template expansion --> .github/workflows/build.yml:67:9 | 67 | - name: 'build' | ^^^^^^^^^^^^^ this step 68 | / run: | 69 | | export CW_CONFIG='awslc-${{ github.ref_name }}-linux-a64-r64-x64' ... | 78 | | "${DOCKER_IMAGE}" \ 79 | | sh -c ./_ci-linux-debian.sh | |_______________________________________^ github.ref_name may expand into attacker-controllable code | = note: audit confidence → High ``` For this project none posed a security issue, because we limit runs to branches `main`, `dev` and `test`.
1 parent 6501eaf commit 05ca755

1 file changed

Lines changed: 17 additions & 17 deletions

File tree

‎.github/workflows/build.yml‎

Lines changed: 17 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -73,7 +73,7 @@ jobs:
7373
fetch-depth: '300'
7474
- name: 'build'
7575
run: |
76-
export CW_CONFIG='${{ github.ref_name }}-linux-a64-x64'
76+
export CW_CONFIG="${GITHUB_REF_NAME}-linux-a64-x64"
7777
export CW_REVISION='${{ github.sha }}'
7878
. ./_versions.sh
7979
docker trust inspect --pretty "${DOCKER_IMAGE}"
@@ -105,7 +105,7 @@ jobs:
105105
fetch-depth: '300'
106106
- name: 'build'
107107
run: |
108-
export CW_CONFIG='${{ github.ref_name }}-linux-a64-r64-x64-gcc'
108+
export CW_CONFIG="${GITHUB_REF_NAME}-linux-a64-r64-x64-gcc"
109109
export CW_REVISION='${{ github.sha }}'
110110
. ./_versions.sh
111111
export CW_GCCSUFFIX='-14'
@@ -138,7 +138,7 @@ jobs:
138138
fetch-depth: '300'
139139
- name: 'build'
140140
run: |
141-
export CW_CONFIG='${{ github.ref_name }}-linux'
141+
export CW_CONFIG="${GITHUB_REF_NAME}-linux"
142142
export CW_REVISION='${{ github.sha }}'
143143
DOCKER_IMAGE='debian:bookworm-slim'
144144
DOCKER_CONTENT_TRUST=1
@@ -173,7 +173,7 @@ jobs:
173173
fetch-depth: '300'
174174
- name: 'build'
175175
run: |
176-
export CW_CONFIG='${{ github.ref_name }}-linux-gcc'
176+
export CW_CONFIG="${GITHUB_REF_NAME}-linux-gcc"
177177
export CW_REVISION='${{ github.sha }}'
178178
DOCKER_IMAGE='debian:bookworm-slim'
179179
DOCKER_CONTENT_TRUST=1
@@ -208,7 +208,7 @@ jobs:
208208
fetch-depth: '300'
209209
- name: 'build'
210210
run: |
211-
export CW_CONFIG='${{ github.ref_name }}-linux-a64-r64-x64-musl'
211+
export CW_CONFIG="${GITHUB_REF_NAME}-linux-a64-r64-x64-musl"
212212
export CW_REVISION='${{ github.sha }}'
213213
. ./_versions.sh
214214
docker trust inspect --pretty "${DOCKER_IMAGE}"
@@ -240,7 +240,7 @@ jobs:
240240
fetch-depth: '300'
241241
- name: 'build'
242242
run: |
243-
export CW_CONFIG='${{ github.ref_name }}-linux-a64-r64-x64-musl-gcc'
243+
export CW_CONFIG="${GITHUB_REF_NAME}-linux-a64-r64-x64-musl-gcc"
244244
export CW_REVISION='${{ github.sha }}'
245245
. ./_versions.sh
246246
docker trust inspect --pretty "${DOCKER_IMAGE}"
@@ -272,7 +272,7 @@ jobs:
272272
fetch-depth: '300'
273273
- name: 'build'
274274
run: |
275-
export CW_CONFIG='${{ github.ref_name }}-linux-musl'
275+
export CW_CONFIG="${GITHUB_REF_NAME}-linux-musl"
276276
export CW_REVISION='${{ github.sha }}'
277277
DOCKER_IMAGE='debian:bookworm-slim'
278278
DOCKER_CONTENT_TRUST=1
@@ -307,7 +307,7 @@ jobs:
307307
fetch-depth: '300'
308308
- name: 'build'
309309
run: |
310-
export CW_CONFIG='${{ github.ref_name }}-linux-musl-gcc'
310+
export CW_CONFIG="${GITHUB_REF_NAME}-linux-musl-gcc"
311311
export CW_REVISION='${{ github.sha }}'
312312
DOCKER_IMAGE='debian:bookworm-slim'
313313
DOCKER_CONTENT_TRUST=1
@@ -342,7 +342,7 @@ jobs:
342342
fetch-depth: '300'
343343
- name: 'build'
344344
run: |
345-
export CW_CONFIG='${{ github.ref_name }}-linux'
345+
export CW_CONFIG="${GITHUB_REF_NAME}-linux"
346346
export CW_REVISION='${{ github.sha }}'
347347
DOCKER_IMAGE='alpine:latest'
348348
DOCKER_CONTENT_TRUST=1
@@ -375,7 +375,7 @@ jobs:
375375
fetch-depth: '300'
376376
- name: 'build'
377377
run: |
378-
export CW_CONFIG='${{ github.ref_name }}-linux-gcc'
378+
export CW_CONFIG="${GITHUB_REF_NAME}-linux-gcc"
379379
export CW_REVISION='${{ github.sha }}'
380380
DOCKER_IMAGE='alpine:latest'
381381
DOCKER_CONTENT_TRUST=1
@@ -410,7 +410,7 @@ jobs:
410410
env:
411411
GITHUB_TOKEN: '${{ github.token }}'
412412
run: |
413-
export CW_CONFIG='${{ github.ref_name }}-linux'
413+
export CW_CONFIG="${GITHUB_REF_NAME}-linux"
414414
export CW_REVISION='${{ github.sha }}'
415415
sh -c ./_ci-mac-homebrew.sh
416416
@@ -438,7 +438,7 @@ jobs:
438438
env:
439439
GITHUB_TOKEN: '${{ github.token }}'
440440
run: |
441-
export CW_CONFIG='${{ github.ref_name }}-mac-macuni'
441+
export CW_CONFIG="${GITHUB_REF_NAME}-mac-macuni"
442442
export CW_REVISION='${{ github.sha }}'
443443
sh -c ./_ci-mac-homebrew.sh
444444
@@ -466,7 +466,7 @@ jobs:
466466
env:
467467
GITHUB_TOKEN: '${{ github.token }}'
468468
run: |
469-
export CW_CONFIG='${{ github.ref_name }}-mac-macuni-llvm'
469+
export CW_CONFIG="${GITHUB_REF_NAME}-mac-macuni-llvm"
470470
export CW_REVISION='${{ github.sha }}'
471471
sh -c ./_ci-mac-homebrew.sh
472472
@@ -495,7 +495,7 @@ jobs:
495495
GITHUB_TOKEN: '${{ github.token }}'
496496
run: |
497497
export CW_CCSUFFIX='-14'
498-
export CW_CONFIG='${{ github.ref_name }}-mac-gcc-a64'
498+
export CW_CONFIG="${GITHUB_REF_NAME}-mac-gcc-a64"
499499
export CW_REVISION='${{ github.sha }}'
500500
sh -c ./_ci-mac-homebrew.sh
501501
@@ -524,7 +524,7 @@ jobs:
524524
CW_LLVM_MINGW_DL: '1'
525525
CW_LLVM_MINGW_ONLY: '0'
526526
run: |
527-
export CW_CONFIG='${{ github.ref_name }}-win'
527+
export CW_CONFIG="${GITHUB_REF_NAME}-win"
528528
export CW_REVISION='${{ github.sha }}'
529529
. ./_versions.sh
530530
sh -c ./_ci-mac-homebrew.sh
@@ -552,7 +552,7 @@ jobs:
552552
CW_LLVM_MINGW_DL: '1'
553553
CW_LLVM_MINGW_ONLY: '0'
554554
run: |
555-
export CW_CONFIG='${{ github.ref_name }}-win'
555+
export CW_CONFIG="${GITHUB_REF_NAME}-win"
556556
export CW_REVISION='${{ github.sha }}'
557557
. ./_versions.sh
558558
docker trust inspect --pretty "${DOCKER_IMAGE}"
@@ -587,7 +587,7 @@ jobs:
587587
CW_LLVM_MINGW_DL: '1'
588588
CW_LLVM_MINGW_ONLY: '0'
589589
run: |
590-
export CW_CONFIG='${{ github.ref_name }}-win-gcc'
590+
export CW_CONFIG="${GITHUB_REF_NAME}-win-gcc"
591591
export CW_REVISION='${{ github.sha }}'
592592
. ./_versions.sh
593593
docker trust inspect --pretty "${DOCKER_IMAGE}"

0 commit comments

Comments
 (0)