Avoid shell interpretation of gpg command (#92)

* Avoid shell interpretation of gpg command

This provides the shell command with the arguments separated to avoid
interpretation by the shell.

fixes: https://github.com/codecov/test-results-action/security/code-scanning/3

* Remove unnecessary codeql checks

This is because it's configured already on the repo level.

* Retriggering build

.github/workflows/codeql-analysis.yml

@@ -1,69 +0,0 @@
-
-#
-# You may wish to alter this file to override the set of languages analyzed,
-# or to provide custom queries or build logic.
-#
-# ******** NOTE ********
-# We have attempted to detect the languages in your repository. Please check
-# the `language` matrix defined below to confirm you have the correct set of
-# supported CodeQL languages.
-#
-name: "CodeQL"
-
-on:
-  push:
-    branches: [ main ]
-  pull_request:
-    # The branches below must be a subset of the branches above
-    branches: [ main ]
-  schedule:
-    - cron: '24 6 * * 5' # Every Friday at 6:24AM
-
-jobs:
-  analyze:
-    name: Analyze
-    runs-on: ubuntu-latest
-    permissions:
-      actions: read
-      contents: read
-      security-events: write
-
-    strategy:
-      fail-fast: false
-      matrix:
-        language: [ 'javascript' ]
-        # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby' ]
-        # Learn more about CodeQL language support at https://git.io/codeql-language-support
-
-    steps:
-    - name: Checkout repository
-      uses: actions/checkout@v4
-
-    # Initializes the CodeQL tools for scanning.
-    - name: Initialize CodeQL
-      uses: github/codeql-action/[email protected]
-      with:
-        languages: ${{ matrix.language }}
-        # If you wish to specify custom queries, you can do so here or in a config file.
-        # By default, queries listed here will override any specified in a config file.
-        # Prefix the list here with "+" to use these queries and those in the config file.
-        # queries: ./path/to/local/query, your-org/your-repo/queries@main
-
-    # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
-    # If this step fails, then you should remove it and run the build manually (see below)
-    - name: Autobuild
-      uses: github/codeql-action/[email protected]
-
-    # ℹ️ Command-line programs to run using the OS shell.
-    # 📚 https://git.io/JvXDl
-
-    # ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
-    #    and modify them (or add more) to build your code if your project
-    #    uses a compiled language
-
-    #- run: |
-    #   make bootstrap
-    #   make release
-
-    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/[email protected]

dist/index.js

@@ -32363,32 +32363,30 @@ const verify = (filename, platform, version, verbose, failCi) => __awaiter(void
             }
         });
         const verifySignature = () => __awaiter(void 0, void 0, void 0, function* () {
-            const command = [
-                'gpg',
+            const args = [
                 '--logger-fd',
                 '1',
                 '--verify',
                 external_node_path_namespaceObject.join(__dirname, `${uploaderName}.SHA256SUM.sig`),
                 external_node_path_namespaceObject.join(__dirname, `${uploaderName}.SHA256SUM`),
-            ].join(' ');
+            ];
             try {
-                yield (0,external_node_child_process_namespaceObject.execSync)(command, { stdio: 'inherit' });
+                yield (0,external_node_child_process_namespaceObject.spawnSync)('gpg', args, { stdio: 'inherit' });
             }
             catch (err) {
                 setFailure(`Codecov: Error verifying gpg signature: ${err.message}`, failCi);
             }
         });
         const importKey = () => __awaiter(void 0, void 0, void 0, function* () {
-            const command = [
-                'gpg',
+            const args = [
                 '--logger-fd',
                 '1',
                 '--no-default-keyring',
                 '--import',
                 external_node_path_namespaceObject.join(__dirname, 'pgp_keys.asc'),
-            ].join(' ');
+            ];
             try {
-                yield (0,external_node_child_process_namespaceObject.execSync)(command, { stdio: 'inherit' });
+                yield (0,external_node_child_process_namespaceObject.spawnSync)('gpg', args, { stdio: 'inherit' });
             }
             catch (err) {
                 setFailure(`Codecov: Error importing gpg key: ${err.message}`, failCi);

src/validate.ts

@@ -1,4 +1,4 @@
-import {execSync} from 'node:child_process';
+import {spawnSync} from 'node:child_process';
 import * as crypto from 'node:crypto';
 import * as fs from 'node:fs';
 import * as path from 'node:path';
@@ -77,17 +77,16 @@ const verify = async (
     };
 
     const verifySignature = async () => {
-      const command = [
-        'gpg',
+      const args = [
         '--logger-fd',
         '1',
         '--verify',
         path.join(__dirname, `${uploaderName}.SHA256SUM.sig`),
         path.join(__dirname, `${uploaderName}.SHA256SUM`),
-      ].join(' ');
+      ];
 
       try {
-        await execSync(command, {stdio: 'inherit'});
+        await spawnSync('gpg', args, {stdio: 'inherit'});
       } catch (err) {
         setFailure(
             `Codecov: Error verifying gpg signature: ${err.message}`,
@@ -97,17 +96,16 @@ const verify = async (
     };
 
     const importKey = async () => {
-      const command = [
-        'gpg',
+      const args = [
         '--logger-fd',
         '1',
         '--no-default-keyring',
         '--import',
         path.join(__dirname, 'pgp_keys.asc'),
-      ].join(' ');
+      ];
 
       try {
-        await execSync(command, {stdio: 'inherit'});
+        await spawnSync('gpg', args, {stdio: 'inherit'});
       } catch (err) {
         setFailure(`Codecov: Error importing gpg key: ${err.message}`, failCi);
       }