Skip to content

Harden release workflow input handling against shell injection #24

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
fupacat merged 6 commits into from
Oct 12, 2026
Merged

Harden release workflow input handling against shell injection #24

Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
ef8a862
Initial plan
Copilot Oct 12, 2026
c1447ba
Apply remaining changes
Copilot Oct 12, 2026
2149b03
Quote workflow env expansions in release job
Copilot Oct 12, 2026
2ed687c
Apply remaining changes
Copilot Oct 12, 2026
aed57e0
Merge branch 'master' into copilot/pass-workflow-inputs-via-env-vars
fupacat Oct 12, 2026
9b543b0
Merge branch 'master' into copilot/pass-workflow-inputs-via-env-vars
fupacat Oct 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 17 additions & 7 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,9 +37,11 @@ jobs:

- name: Determine Release Version
id: version_step
env:
INPUT_VERSION: ${{ inputs.version }}
run: |
if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
VERSION="${{ inputs.version }}"
VERSION="${INPUT_VERSION}"
else
VERSION="${GITHUB_REF_NAME#v}"
fi
Expand All @@ -60,8 +62,10 @@ jobs:
cache: 'maven'

- name: Bump POM Version
env:
RELEASE_VERSION: ${{ steps.version_step.outputs.RELEASE_VERSION }}
run: |
mvn versions:set -DnewVersion=${{ steps.version_step.outputs.RELEASE_VERSION }} -DgenerateBackupPoms=false --batch-mode
mvn versions:set -DnewVersion="${RELEASE_VERSION}" -DgenerateBackupPoms=false --batch-mode

- name: Run Tests and Regression Suite
run: |
Expand All @@ -72,9 +76,11 @@ jobs:
mvn package -P release -DskipTests --batch-mode

- name: Prepare GitHub Release Assets
env:
RELEASE_VERSION: ${{ steps.version_step.outputs.RELEASE_VERSION }}
run: |
mkdir -p release-assets
VERSION="${{ steps.version_step.outputs.RELEASE_VERSION }}"
VERSION="${RELEASE_VERSION}"
cp tsql-scriptdom-core/target/tsql-scriptdom-core-${VERSION}.jar release-assets/tsql-scriptdom-core-${VERSION}.jar
cp tsql-scriptdom-core/target/tsql-scriptdom-core-${VERSION}-sources.jar release-assets/tsql-scriptdom-core-${VERSION}-sources.jar
cp tsql-scriptdom-core/target/tsql-scriptdom-core-${VERSION}-javadoc.jar release-assets/tsql-scriptdom-core-${VERSION}-javadoc.jar
Expand All @@ -85,8 +91,9 @@ jobs:
- name: Create GitHub Release
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
RELEASE_VERSION: ${{ steps.version_step.outputs.RELEASE_VERSION }}
run: |
VERSION="${{ steps.version_step.outputs.RELEASE_VERSION }}"
VERSION="${RELEASE_VERSION}"
TAG_NAME="v${VERSION}"
gh release create "${TAG_NAME}" \
release-assets/* \
Expand All @@ -105,21 +112,24 @@ jobs:
SONATYPE_PASSWORD: ${{ secrets.SONATYPE_PASSWORD }}
OSSRH_GPG_SECRET_KEY: ${{ secrets.OSSRH_GPG_SECRET_KEY }}
OSSRH_GPG_PASSPHRASE: ${{ secrets.OSSRH_GPG_PASSPHRASE }}
RELEASE_VERSION: ${{ steps.version_step.outputs.RELEASE_VERSION }}
run: |
if [ -n "$SONATYPE_USERNAME" ] && [ -n "$SONATYPE_PASSWORD" ] && [ -n "$OSSRH_GPG_SECRET_KEY" ]; then
echo "Publishing to Maven Central via Sonatype Central Portal..."
echo "$OSSRH_GPG_SECRET_KEY" | gpg --batch --import
VERSION="${{ steps.version_step.outputs.RELEASE_VERSION }}"
VERSION="${RELEASE_VERSION}"
python3 scripts/publish_central.py "${VERSION}"
else
echo "Notice: Maven Central secrets (SONATYPE_USERNAME / SONATYPE_PASSWORD / OSSRH_GPG_SECRET_KEY) not configured. Skipping Maven Central deployment."
fi

- name: Bump to Next SNAPSHOT Version
if: ${{ inputs.next_version != '' }}
env:
INPUT_NEXT_VERSION: ${{ inputs.next_version }}
run: |
git config user.name "github-actions[bot]"
git config user.email "github-actions[bot]@users.noreply.github.com"
mvn versions:set -DnewVersion=${{ inputs.next_version }} -DgenerateBackupPoms=false --batch-mode
git commit -am "chore: bump version to ${{ inputs.next_version }} [skip ci]"
mvn versions:set -DnewVersion="${INPUT_NEXT_VERSION}" -DgenerateBackupPoms=false --batch-mode
git commit -am "chore: bump version to ${INPUT_NEXT_VERSION} [skip ci]"
git push origin master
Loading