Improve: pass the CA workflow values to the shell through env

.github/workflows/ca-template-changes.yml

@@ -41,7 +41,10 @@ jobs:
       # Python's standard library: the runner image carries no xmllint.
       - name: Check the result is still well-formed
         if: steps.changes.outputs.changed == 'true'
-        run: python3 scripts/ca-validate.py "${{ github.repository }}" "${{ github.event.repository.default_branch }}"
+        env:
+          REPO: ${{ github.repository }}
+          BASE: ${{ github.event.repository.default_branch }}
+        run: python3 scripts/ca-validate.py "$REPO" "$BASE"
 
       # The checkout keeps no credentials, so the token authenticates this one
       # push and is never left in the runner's git config.

.github/workflows/ca-template-check.yml

@@ -33,4 +33,7 @@ jobs:
       # Python's standard library, so nothing is installed. The runner image
       # carries no xmllint.
       - name: Validate the template and the profile
-        run: python3 scripts/ca-validate.py "${{ github.repository }}" "${{ github.event.repository.default_branch }}"
+        env:
+          REPO: ${{ github.repository }}
+          BASE: ${{ github.event.repository.default_branch }}
+        run: python3 scripts/ca-validate.py "$REPO" "$BASE"

test/repo/workflow-hardening.test.js

@@ -141,3 +141,26 @@ test('the lockfile is committed and CI installs from it', () => {
   }
   assert.deepEqual(loose, [], `Use npm ci so CI installs the lockfile:\n  ${loose.join('\n  ')}`);
 });
+
+/* An expression in a run script is pasted into the shell before it runs. A
+   value an outsider controls, such as a branch name, then runs as a command. */
+test('no run script holds an expression', () => {
+  const found = [];
+  for (const [f, src] of all) {
+    const lines = src.split('\n');
+    let block = -1;
+    lines.forEach((line, i) => {
+      const indent = line.match(/^\s*/)[0].length;
+      const run = line.match(/^(\s*)(- )?run:\s*(.*)$/);
+      if (run) {
+        block = /^[|>]/.test(run[3]) ? run[1].length + (run[2] ? 2 : 0) : -1;
+        if (run[3].includes('${{')) found.push(`${f}:${i + 1}`);
+        return;
+      }
+      if (block === -1) return;
+      if (line.trim() && indent <= block) block = -1;
+      else if (line.includes('${{')) found.push(`${f}:${i + 1}`);
+    });
+  }
+  assert.deepEqual(found, [], `Pass the value through env and read it as a variable:\n  ${found.join('\n  ')}`);
+});