From 2427f3876451579bad80c50bdff9bfe511c24caa Mon Sep 17 00:00:00 2001 From: Luc Perkins Date: Wed, 26 Aug 2026 10:16:19 -0700 Subject: [PATCH] Fix zizmor code scanning alerts in action.yml Resolves all 15 open code scanning alerts (zizmor `template-injection` and `github-env`): - Stop interpolating `${{ inputs.git-*-name/email }}` directly into a `run:` script; pass them through `env:` instead. - Replace all `GITHUB_ENV` writes with step outputs. The git identity is now computed in a single `git-identity` step (signed vs. unsigned) and the commit message in a `commit-message` step. - Pass the `GIT_AUTHOR_*`/`GIT_COMMITTER_*` values as `env:` on the `Run update-flake-lock` step, since git honors them when `nix flake update --commit-lock-file` creates the commit. - Pass `GIT_*` as `env:` on the Handlebars step so the documented `env.GIT_*` template variables in `pr-body` keep working (the action builds its `env` context from `process.env`). Co-Authored-By: Claude Fable 5 --- action.yml | 72 +++++++++++++++++++++++++++++++++++------------------- 1 file changed, 47 insertions(+), 25 deletions(-) diff --git a/action.yml b/action.yml index 80c87515..600fe6ad 100644 --- a/action.yml +++ b/action.yml @@ -124,32 +124,44 @@ runs: git_config_global: true git_user_signingkey: true git_commit_gpgsign: true - - name: Set environment variables (signed commits) - if: ${{ inputs.sign-commits == 'true' }} + - name: Determine git author and committer identity + id: git-identity shell: bash env: - GIT_AUTHOR_NAME: ${{ steps.import-gpg.outputs.name }} - GIT_AUTHOR_EMAIL: ${{ steps.import-gpg.outputs.email }} - GIT_COMMITTER_NAME: ${{ steps.import-gpg.outputs.name }} - GIT_COMMITTER_EMAIL: ${{ steps.import-gpg.outputs.email }} - TARGETS: ${{ inputs.inputs }} - run: | - echo "GIT_AUTHOR_NAME=$GIT_AUTHOR_NAME" >> $GITHUB_ENV - echo "GIT_AUTHOR_EMAIL=<$GIT_AUTHOR_EMAIL>" >> $GITHUB_ENV - echo "GIT_COMMITTER_NAME=$GIT_COMMITTER_NAME" >> $GITHUB_ENV - echo "GIT_COMMITTER_EMAIL=<$GIT_COMMITTER_EMAIL>" >> $GITHUB_ENV - - name: Set environment variables (unsigned commits) - if: ${{ inputs.sign-commits != 'true' }} - shell: bash + SIGN_COMMITS: ${{ inputs.sign-commits }} + GPG_NAME: ${{ steps.import-gpg.outputs.name }} + GPG_EMAIL: ${{ steps.import-gpg.outputs.email }} + INPUT_AUTHOR_NAME: ${{ inputs.git-author-name }} + INPUT_AUTHOR_EMAIL: ${{ inputs.git-author-email }} + INPUT_COMMITTER_NAME: ${{ inputs.git-committer-name }} + INPUT_COMMITTER_EMAIL: ${{ inputs.git-committer-email }} run: | - echo "GIT_AUTHOR_NAME=${{ inputs.git-author-name }}" >> $GITHUB_ENV - echo "GIT_AUTHOR_EMAIL=<${{ inputs.git-author-email }}>" >> $GITHUB_ENV - echo "GIT_COMMITTER_NAME=${{ inputs.git-committer-name }}" >> $GITHUB_ENV - echo "GIT_COMMITTER_EMAIL=<${{ inputs.git-committer-email }}>" >> $GITHUB_ENV + if [ "$SIGN_COMMITS" = "true" ]; then + AUTHOR_NAME="$GPG_NAME" + AUTHOR_EMAIL="$GPG_EMAIL" + COMMITTER_NAME="$GPG_NAME" + COMMITTER_EMAIL="$GPG_EMAIL" + else + AUTHOR_NAME="$INPUT_AUTHOR_NAME" + AUTHOR_EMAIL="$INPUT_AUTHOR_EMAIL" + COMMITTER_NAME="$INPUT_COMMITTER_NAME" + COMMITTER_EMAIL="$INPUT_COMMITTER_EMAIL" + fi + { + echo "author-name=$AUTHOR_NAME" + echo "author-email=<$AUTHOR_EMAIL>" + echo "committer-name=$COMMITTER_NAME" + echo "committer-email=<$COMMITTER_EMAIL>" + } >> "$GITHUB_OUTPUT" - name: Run update-flake-lock shell: bash run: node "$GITHUB_ACTION_PATH/dist/index.js" env: + # `nix flake update --commit-lock-file` creates the commit, and git honors these variables when doing so. + GIT_AUTHOR_NAME: ${{ steps.git-identity.outputs.author-name }} + GIT_AUTHOR_EMAIL: ${{ steps.git-identity.outputs.author-email }} + GIT_COMMITTER_NAME: ${{ steps.git-identity.outputs.committer-name }} + GIT_COMMITTER_EMAIL: ${{ steps.git-identity.outputs.committer-email }} # The following manually exposes all of the action inputs into INPUT_ environment variables so actionsCore.getInput works: # https://github.com/actions/toolkit/blob/ae38557bb0dba824cdda26ce787bd6b66cf07a83/packages/core/src/core.ts#L126 INPUT_BASE: ${{ inputs.base }} @@ -181,17 +193,27 @@ runs: path: pr_body.template contents: ${{ inputs.pr-body }} env: {} - - name: Set additional env variables (GIT_COMMIT_MESSAGE) + - name: Get commit message + id: commit-message shell: bash run: | DELIMITER=$(dd if=/dev/urandom bs=15 count=1 status=none | base64) COMMIT_MESSAGE="$(git log --format=%b -n 1)" - echo "GIT_COMMIT_MESSAGE<<$DELIMITER" >> $GITHUB_ENV - echo "$COMMIT_MESSAGE" >> $GITHUB_ENV - echo "$DELIMITER" >> $GITHUB_ENV + { + echo "message<<$DELIMITER" + echo "$COMMIT_MESSAGE" + echo "$DELIMITER" + } >> "$GITHUB_OUTPUT" echo "GIT_COMMIT_MESSAGE is: ${COMMIT_MESSAGE}" - name: Interpolate PR Body uses: pedrolamas/handlebars-action@2995d7eadacbc8f2f6ab8431a01d84a5fa3b8bb4 # v2.4.0 + env: + # Exposed to the `pr-body` Handlebars template as `env.GIT_*` (see README). + GIT_AUTHOR_NAME: ${{ steps.git-identity.outputs.author-name }} + GIT_AUTHOR_EMAIL: ${{ steps.git-identity.outputs.author-email }} + GIT_COMMITTER_NAME: ${{ steps.git-identity.outputs.committer-name }} + GIT_COMMITTER_EMAIL: ${{ steps.git-identity.outputs.committer-email }} + GIT_COMMIT_MESSAGE: ${{ steps.commit-message.outputs.message }} with: files: "pr_body.template" output-filename: "pr_body.txt" @@ -213,8 +235,8 @@ runs: base: ${{ inputs.base }} branch: ${{ inputs.branch }} delete-branch: true - committer: ${{ env.GIT_COMMITTER_NAME }} ${{ env.GIT_COMMITTER_EMAIL }} - author: ${{ env.GIT_AUTHOR_NAME }} ${{ env.GIT_AUTHOR_EMAIL }} + committer: ${{ steps.git-identity.outputs.committer-name }} ${{ steps.git-identity.outputs.committer-email }} + author: ${{ steps.git-identity.outputs.author-name }} ${{ steps.git-identity.outputs.author-email }} title: ${{ inputs.pr-title }} token: ${{ inputs.token }} assignees: ${{ inputs.pr-assignees }}