Potential fix for code scanning alert no. 169: Code injection

[burgholzer]

Potential fix for https://github.com/munich-quantum-toolkit/workflows/security/code-scanning/169

To address the code injection vulnerability, remove use of ${{ inputs.compiler }} inside the shell script, and instead define an intermediate environment variable (e.g., COMPILER) in the env: section. Then, in the shell script, use the shell-native $COMPILER variable for logic, ensuring environment variable expansion is used, not GitHub expression syntax.
Specifically, on line 78, change:

if [ "${{ inputs.compiler }}" == "clang" ]; then

to

if [ "$COMPILER" == "clang" ]; then

You must also add COMPILER: ${{ inputs.compiler }} to the env: section of this step.

What files/regions to change:

• The relevant changes are in the "Configure CMake" step (i.e., job step starting at line 72).
• env: must include an assignment for the COMPILER variable.
• The shell script line referencing ${{ inputs.compiler }} must be changed to use $COMPILER instead.

No new imports or methods are required.

---

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[coderabbitai]

📝 Walkthrough

Summary by CodeRabbit

• Chores
  • Updated Windows C++ test workflow configuration to improve compiler detection and CMake build configuration handling.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

Walkthrough

Modified the CMake configuration step in a Windows C++ testing workflow to introduce a COMPILER environment variable and refactored the clang compiler check to reference this variable instead of directly expanding the inputs parameter.

Changes

Cohort / File(s)	Change Summary
CI/CD Workflow Configuration .github/workflows/reusable-cpp-tests-windows.yml	Introduced COMPILER environment variable in Configure CMake step; updated clang compiler check to use [ "$COMPILER" ] instead of template expansion; maintains existing behavior of appending -T ClangCL flag for clang builds

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~5 minutes

• Single-file workflow configuration change with straightforward variable refactoring
• Logic preservation verified by comparing old and new conditional patterns
• Minimal scope with no side effects or dependent changes

Poem

🐰 A workflow once tangled in braces,
Now flows through cleaner spaces,
Variables dance where templates once stood,
Clang still compiles as it should!
Simpler, faster, yet just as good. ✨

Pre-merge checks and finishing touches

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The PR description is incomplete. It provides context and specific instructions but omits the required checklist section from the template entirely.	Add the complete checklist from the description template, with items marked as complete or incomplete to indicate the status of testing, documentation, and code review steps.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately describes the main change: addressing a code injection security vulnerability by refactoring how compiler input is handled in the workflow.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch alert-autofix-169

---

📜 Recent review details

Configuration used: CodeRabbit UI

Review profile: ASSERTIVE

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 7254ff4 and 1490472.

📒 Files selected for processing (1)

• .github/workflows/reusable-cpp-tests-windows.yml (1 hunks)

🔇 Additional comments (1)

.github/workflows/reusable-cpp-tests-windows.yml (1)

73-82: Security fix properly addresses code injection vulnerability.

The refactoring correctly mitigates the injection risk by extracting the GitHub Actions expression to a safe environment variable context rather than embedding it directly in the shell script. The quoting on line 79 is proper ("$COMPILER" prevents unintended word splitting), and the conditional logic is functionally preserved.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}