getsentry/action-release
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix: Prevent shell injection in build workflow (#319)

Browse Source 
* fix: Prevent shell injection in build workflow

Use environment variables to safely handle github context data
in run steps to prevent potential code injection attacks.

Fixes https://linear.app/getsentry/issue/VULN-1601
Fixes https://linear.app/getsentry/issue/ENG-7567

Co-Authored-By: fix-it-felix-sentry[bot] <260785270+fix-it-felix-sentry[bot]@users.noreply.github.com>

* Use in-built env vars instead of redefining them

---------

Co-authored-by: fix-it-felix-sentry[bot] <260785270+fix-it-felix-sentry[bot]@users.noreply.github.com>
Co-authored-by: Andrei Borza <[email protected]>
This commit is contained in:
fix-it-felix-sentry[bot]
2026-04-30 15:01:47 +09:00
committed by GitHub
co-authored by fix-it-felix-sentry[bot] <260785270+fix-it-felix-sentry[bot]@users.noreply.github.com> Andrei Borza
parent 6c1387acd7
commit b5f4d3a7a8
2 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/build.yml
+2 -2
View File
@@ -35,14 +35,14 @@ jobs:
- name: Get docker tag
id: docker_tag
run: |
if [[ "${{ github.ref }}" == "refs/heads/master" ]]; then
if [[ "$GITHUB_REF" == "refs/heads/master" ]]; then
echo "docker_tag=master" >> $GITHUB_OUTPUT
yarn set-docker-tag master
else
TAG=$(yq '... | select(has("uses") and .uses | test("docker://ghcr.io/getsentry/action-release-image:.*")) | .uses' action.yml | awk -F':' '{print $3}')
echo "docker_tag=$TAG" >> $GITHUB_OUTPUT
if [[ "${{ github.event_name }}" == "pull_request" ]]; then
if [[ "$GITHUB_EVENT_NAME" == "pull_request" ]]; then
if [[ "$TAG" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
echo "Error: docker_tag $TAG matching format MAJOR.MINOR.PATCH is not allowed inside pull requests."
echo "Please rename the docker tag in action.yml and try again."
action.yml
+1 -1
View File
@@ -167,7 +167,7 @@ runs:
INPUT_WORKING_DIRECTORY: ${{ inputs.working_directory }}
INPUT_DISABLE_TELEMETRY: ${{ inputs.disable_telemetry }}
INPUT_DISABLE_SAFE_DIRECTORY: ${{ inputs.disable_safe_directory }}
uses: docker://ghcr.io/getsentry/action-release-image:ab-add-dotagents
uses: docker://ghcr.io/getsentry/action-release-image:fix-eng-7567-shell-injection-vulnerability
# For actions running on macos or windows runners, we use a composite
# action approach which allows us to install the arch specific sentry-cli