From 31dcb26062e8a1de41d78ed24c30c2a381bb3522 Mon Sep 17 00:00:00 2001
From: Laxman Reddy Aileni <laileni@amazon.com>
Date: Thu, 27 Aug 2026 16:54:43 +0000
Subject: [PATCH] ci: prevent script injection in Prerelease workflow

Bind user-controlled GitHub context values to step-level env vars instead
of interpolating them directly into inline run: scripts:

- github.event.inputs.tag_name (workflow_dispatch input)
- github.ref_name (feature/* and release/* branch handling)

Following GitHub Actions security-hardening guidance, the values are now
passed via env: and referenced as quoted shell variables, so a crafted
branch name or dispatch input can no longer be interpreted as script.

Resolves ACAT/GithubWorkflowIdentifier finding (script injection in GitHub
Actions workflows).
---
 .github/workflows/release.yml | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index e374fca77..9c478e12b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -39,15 +39,21 @@ jobs:
             # - if: github.event_name == 'schedule'
             #   run: echo 'TAG_NAME=prerelease' >> $GITHUB_ENV
             - if: github.event_name == 'workflow_dispatch'
-              run: echo "TAG_NAME=${{ github.event.inputs.tag_name }}" >> $GITHUB_ENV
+              env:
+                  TAG_NAME_INPUT: ${{ github.event.inputs.tag_name }}
+              run: echo "TAG_NAME=$TAG_NAME_INPUT" >> $GITHUB_ENV
             - if: startsWith(github.ref_name, 'feature/')
+              env:
+                  REF_NAME: ${{ github.ref_name }}
               run: |
-                  FEAT_NAME=$(echo ${{ github.ref_name }} | sed 's/feature\///')
+                  FEAT_NAME=$(echo "$REF_NAME" | sed 's/feature\///')
                   echo "FEAT_NAME=$FEAT_NAME" >> $GITHUB_ENV
                   echo "TAG_NAME=pre-$FEAT_NAME" >> $GITHUB_ENV
             - if: startsWith(github.ref_name, 'release/')
+              env:
+                  REF_NAME: ${{ github.ref_name }}
               run: |
-                  RC_NAME=$(echo ${{ github.ref_name }} | sed 's/release\///')
+                  RC_NAME=$(echo "$REF_NAME" | sed 's/release\///')
                   echo "FEAT_NAME=" >> $GITHUB_ENV
                   echo "TAG_NAME=$RC_NAME" >> $GITHUB_ENV
             - if: github.ref_name == 'main'