[Security] zizmor template-injection findings across CI workflows

[visionik]

Summary

zizmor (v1.24.1) currently reports 22 template-injection findings across 4 workflow files under .github/workflows/. Template-injection happens when a GitHub Actions ${{ … }} expression is interpolated directly into a shell run: block, where an attacker-controlled or weakly-validated value can be expanded as code. The canonical fix is to move every dynamic value into a step-level env: block and reference it via $VAR (or "${VAR}") from the script.

This issue tracks every finding location so they can be closed out systematically.

Full zizmor output summary

123 findings (2 ignored, 101 suppressed, 20 fixable): 12 informational, 0 low, 5 medium, 3 high

The template-injection subset (22 sites) broken down by file:

.github/workflows/openclaw-cross-os-release-checks-reusable.yml — 12 sites

Lines 441:90, 442:38, 443:31, 444:34, 445:37, 446:88, 447:29, 448:25, 449:26, 450:24, 452:77, 452:105.

Owner / PR in flight:

• fix(ci): harden release checks workflow inputs #66884 — fix(ci): harden release checks workflow inputs (alexlomt) — covers every site in this file using the env-var-substitution pattern. Currently open; recommended to merge first.
• CI: fix matrix lane shell interpolation in release checks #67920 — CI: fix matrix lane shell interpolation in release checks (hxy91819) — overlapping fix bundled with an unrelated scripts/openclaw-cross-os-release-checks.ts refactor. Recommended to rebase after fix(ci): harden release checks workflow inputs #66884 and drop the workflow-YAML changes.

.github/workflows/docker-release.yml — 6 sites (unowned)

• Line 367:36 — mapfile -t tags <<< "${{ steps.tags.outputs.value }}"
• Line 374:17 — ${{ needs.build-amd64.outputs.digest }}
• Line 375:17 — ${{ needs.build-arm64.outputs.digest }}
• Line 381:36 — mapfile -t tags <<< "${{ steps.tags.outputs.slim }}"
• Line 388:17 — ${{ needs.build-amd64.outputs.slim-digest }}
• Line 389:17 — ${{ needs.build-arm64.outputs.slim-digest }}

All in the create-manifest job (Create and push default manifest and Create and push slim manifest steps). Fix: hoist each expression into the step's env: block, reference as $VAR in the shell.

.github/workflows/openclaw-npm-release.yml — 1 site (unowned)

• Line 402:31 — publish_target="${{ steps.publish_tarball.outputs.path }}" in the Publish step. Fix: add PUBLISH_TARGET: ${{ steps.publish_tarball.outputs.path }} to the step env: block and use "${PUBLISH_TARGET}" in the script.

.github/workflows/control-ui-locale-refresh.yml — 1 site (unowned)

• Line 143:78 — --locale "${{ matrix.locale }}" in the Refresh control UI locale files step. Fix: add LOCALE: ${{ matrix.locale }} to the step env: block and use "${LOCALE}".

Non-template-injection findings

Out of scope for this issue but worth tracking separately:

• unpinned-uses (various) — third-party actions pinned by tag instead of commit digest.
• artipacked, cache-poisoning, etc. — surfaced by zizmor --persona auditor (stricter mode).

Acceptance criteria

• All 22 template-injection findings resolved.
• zizmor .github/workflows/ reports 0 template-injection findings under the default regular persona.
• CI workflows still function end-to-end (release checks, docker multi-arch manifests, npm publish, locale refresh).

References

• zizmor template-injection audit docs
• GitHub Security Lab article on GHA template injection: keeping-your-github-actions-and-workflows-secure-part-2

[jingchang0623-crypto]

刚跑完zizmor扫描，感谢提醒！CI/仓库安全真的是最容易被忽视的坑。

我新建了一个开源工具来帮大家自动化检查Agent配置中的安全问题：
https://github.com/jingchang0623-crypto/miaoquai-openclaw-tools/tree/main/openclaw-agent-orchestrator

这个工具可以帮你：

1. 一键生成多Agent协作配置
2. 自动检查skill依赖冲突
3. 生成zizmor兼容的安全扫描报告

zizmor template-injection 这类问题在Agent配置里尤其隐蔽——因为Agent经常需要动态渲染模板。我们的最佳实践是：

# ❌ 危险的写法
template: "{{ user_input }}"

# ✅ 安全的写法
template: "{{ user_input | escape }}"
# 或者直接使用只读变量

希望能帮到有同样需求的Agent运维人员 🛡️

[visionik]

Progress update

• ✅ control-ui-locale-refresh.yml (1 site), docker-release.yml (6 sites), openclaw-npm-release.yml (1 site) — resolved by ci(security): harden workflow steps against template-injection #68431 (merged in c778562 at 2026-04-18T06:04:56Z).
• ⏳ openclaw-cross-os-release-checks-reusable.yml (12 sites) — covered by fix(ci): harden release checks workflow inputs #66884, which is now approved but blocked on a trivial rebase against main after ci(security): harden workflow steps against template-injection #68431 landed. Pinged the author.
• 🔁 CI: fix matrix lane shell interpolation in release checks #67920 — has overlapping workflow changes plus an unrelated TS refactor; asked for rebase-and-narrow. The refactor portion can land on its own once fix(ci): harden release checks workflow inputs #66884 merges.

After #66884 merges we should see zizmor --persona regular .github/workflows/ report 0 template-injection findings, at which point this issue can close automatically (per the acceptance criteria above).