[Copilot]

The release workflow was interpolating workflow_dispatch inputs directly into shell commands, which violates the GitHub Actions security guidance for untrusted input in bash scripts. This is especially relevant for version and next_version, which are used in mvn and git commands.

• Summary

  • Guard the workflow against injection via inputs.version and inputs.next_version.
  • Pass those values through environment variables and consume them from $INPUT_VERSION / $INPUT_NEXT_VERSION inside the shell.

• Changes

  • Set INPUT_VERSION in the “Determine Release Version” step and reference it instead of ${{ inputs.version }}.
  • Set INPUT_NEXT_VERSION in the “Bump to Next SNAPSHOT Version” step and reference it instead of ${{ inputs.next_version }} in the Maven and git commands.
  • Keep the workflow behavior unchanged while removing the direct interpolation pattern flagged by Sonar.

• Example

  - name: Determine Release Version
    id: version_step
    env:
      INPUT_VERSION: ${{ inputs.version }}
    run: |
      if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
        VERSION="${INPUT_VERSION}"
      else
        VERSION="${GITHUB_REF_NAME#v}"
      fi

  - name: Bump to Next SNAPSHOT Version
    if: ${{ inputs.next_version != '' }}
    env:
      INPUT_NEXT_VERSION: ${{ inputs.next_version }}
    run: |
      mvn versions:set -DnewVersion=${INPUT_NEXT_VERSION} -DgenerateBackupPoms=false --batch-mode

• Fixes Pass workflow inputs via environment variables in release.yml (Sonar S7630) #22

[Copilot]

🔵 Needs a closer look

It modifies a security-sensitive release/publish pipeline and only partially closes the injection surface, since the input-derived RELEASE_VERSION output is still interpolated directly into later run: blocks, warranting human review.

1 open finding

• Quote the VERSION env expansion for consistency · New

What changed in this PR

This PR hardens the Release & Distribute GitHub Actions workflow against shell/script injection (SonarCloud rule githubactions:S7630, issue #22). Previously, workflow_dispatch inputs (version, next_version) were interpolated directly into bash run: blocks via ${{ inputs.* }}, which allows untrusted input to be injected into the shell. The change routes those inputs through step-level env: variables and consumes them as shell variables instead, preserving behavior while removing the flagged pattern.

Changes:

• Added INPUT_VERSION env var to the "Determine Release Version" step and reference ${INPUT_VERSION} instead of ${{ inputs.version }}.
• Added INPUT_NEXT_VERSION env var to the "Bump to Next SNAPSHOT Version" step and reference ${INPUT_NEXT_VERSION} in the mvn and git commands.

File	Description
.github/​workflows/​release.yml	Passes workflow_dispatch inputs through step-level env: variables and consumes them as shell variables to avoid direct GitHub Actions template interpolation in run: blocks.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🔵 Needs a closer look

It modifies the operationally critical release/publish pipeline, which warrants human verification before approval.

0 open findings

1 resolved since last review

• Quote the VERSION env expansion for consistency

🧠 Review effort: Balanced

[Copilot]

🟢 Approved

The change consistently and correctly routes all untrusted inputs through quoted env variables with no behavioral changes or broken references.

0 open findings

🧠 Review effort: Balanced

[Copilot]

🟢 Approved

The change is a small, well-scoped security hardening that correctly routes all untrusted inputs through quoted env variables with no remaining injection vectors or behavioral changes.

0 open findings

🧠 Review effort: Balanced

[Copilot]

🟢 Approved

The change consistently applies the env-variable + quoted-expansion pattern across all shell steps, removes every injectable interpolation, and leaves workflow behavior unchanged.

0 open findings

🧠 Review effort: Balanced