fix(security): harden run-steps against script injection; fix release gating

.github/actions/add-helm-repositories/action.yml

@@ -30,16 +30,21 @@ runs:
     - name: Add Helm repositories
       shell: bash
       if: ${{ inputs.repositories != '[]' }}
+      env:
+        HELM_USER: ${{ inputs.username }}
+        HELM_PASS: ${{ inputs.password }}
+        FORCE_UPDATE: ${{ inputs.force-update }}
+        REPOSITORIES: ${{ inputs.repositories }}
       run: |
-        echo '${{ inputs.repositories }}' | jq -c '.[]' | while IFS= read -r repo_json; do
+        echo "$REPOSITORIES" | jq -c '.[]' | while IFS= read -r repo_json; do
           repo_name=$(echo "$repo_json" | jq -r .name)
           repo_url=$(echo "$repo_json" | jq -r .url)
 
-          # Build the helm command with conditional --force-update flag
-          helm_cmd="helm repo add \"$repo_name\" \"$repo_url\" --username \"${{ inputs.username }}\" --password \"${{ inputs.password }}\""
-          if [[ "${{ inputs.force-update }}" == "true" ]]; then
-            helm_cmd="$helm_cmd --force-update"
+          # Build the helm arguments with conditional --force-update flag
+          helm_args=(repo add "$repo_name" "$repo_url" --username "$HELM_USER" --password "$HELM_PASS")
+          if [[ "$FORCE_UPDATE" == "true" ]]; then
+            helm_args+=(--force-update)
           fi
 
-          eval "$helm_cmd"
+          helm "${helm_args[@]}"
         done

.github/actions/base/add-helm-repositories/action.yml

@@ -30,16 +30,21 @@ runs:
     - name: Add Helm repositories
       shell: bash
       if: ${{ inputs.repositories != '[]' }}
+      env:
+        HELM_USER: ${{ inputs.username }}
+        HELM_PASS: ${{ inputs.password }}
+        FORCE_UPDATE: ${{ inputs.force-update }}
+        REPOSITORIES: ${{ inputs.repositories }}
       run: |
-        echo '${{ inputs.repositories }}' | jq -c '.[]' | while IFS= read -r repo_json; do
+        echo "$REPOSITORIES" | jq -c '.[]' | while IFS= read -r repo_json; do
           repo_name=$(echo "$repo_json" | jq -r .name)
           repo_url=$(echo "$repo_json" | jq -r .url)
 
-          # Build the helm command with conditional --force-update flag
-          helm_cmd="helm repo add \"$repo_name\" \"$repo_url\" --username \"${{ inputs.username }}\" --password \"${{ inputs.password }}\""
-          if [[ "${{ inputs.force-update }}" == "true" ]]; then
-            helm_cmd="$helm_cmd --force-update"
+          # Build the helm arguments with conditional --force-update flag
+          helm_args=(repo add "$repo_name" "$repo_url" --username "$HELM_USER" --password "$HELM_PASS")
+          if [[ "$FORCE_UPDATE" == "true" ]]; then
+            helm_args+=(--force-update)
           fi
 
-          eval "$helm_cmd"
+          helm "${helm_args[@]}"
         done

.github/actions/base/check-write-permission/action.yml

@@ -12,17 +12,22 @@ runs:
     - name: Check checks:write permission
       id: check
       shell: bash
+      env:
+        REPOSITORY: ${{ github.repository }}
+        EVENT_NAME: ${{ github.event_name }}
+        ACTOR: ${{ github.actor }}
+        GITHUB_TOKEN: ${{ github.token }}
       run: |
-        echo "::debug::Checking checks:write permission for repo: ${{ github.repository }}"
-        echo "::debug::Event name: ${{ github.event_name }}"
-        echo "::debug::Actor: ${{ github.actor }}"
+        echo "::debug::Checking checks:write permission for repo: $REPOSITORY"
+        echo "::debug::Event name: $EVENT_NAME"
+        echo "::debug::Actor: $ACTOR"
 
         # Test if we have checks:write permission by attempting to create a check run.
         # 422 = permission granted (invalid request body), 403 = no permission
         RESPONSE=$(curl -s -w "\n%{http_code}" -X POST \
-          -H "Authorization: Bearer ${{ github.token }}" \
+          -H "Authorization: Bearer $GITHUB_TOKEN" \
           -H "Accept: application/vnd.github+json" \
-          "https://api.github.com/repos/${{ github.repository }}/check-runs" \
+          "https://api.github.com/repos/$REPOSITORY/check-runs" \
           -d '{}')
 
         HTTP_CODE=$(echo "$RESPONSE" | tail -n1)

.github/actions/base/parse-version/action.yml

@@ -35,10 +35,12 @@ runs:
     - name: Parse version
       id: version
       shell: bash
+      env:
+        VERSION: ${{ inputs.version }}
       run: |
-        IFS=- read SEM_VER BUILD_DATE RUN_ID COMMIT_SHA <<< "${{ inputs.version }}"
+        IFS=- read SEM_VER BUILD_DATE RUN_ID COMMIT_SHA <<< "$VERSION"
 
-        cat >> $GITHUB_OUTPUT <<EOF  
+        cat >> $GITHUB_OUTPUT <<EOF
         SEM_VER=$SEM_VER
         BUILD_DATE=$BUILD_DATE
         RUN_ID=$RUN_ID
@@ -48,8 +50,10 @@ runs:
     - name: Parse SemVer
       id: semver
       shell: bash
+      env:
+        SEM_VER: ${{ steps.version.outputs.SEM_VER }}
       run: |
-        IFS=. read MAJOR MINOR PATCH <<< "${{ steps.version.outputs.SEM_VER }}"
+        IFS=. read MAJOR MINOR PATCH <<< "$SEM_VER"
 
         cat >> $GITHUB_OUTPUT <<EOF  
         MAJOR=$MAJOR

.github/actions/base/publish-checkstyle-report/action.yml

@@ -15,8 +15,10 @@ runs:
   steps:
     - name: Run Checkstyle
       shell: bash
+      env:
+        SETTINGS_FILE: ${{ inputs.settings_file }}
       run: |
-        mvn -B -V --no-transfer-progress --settings ${{ inputs.settings_file }} initialize checkstyle:check
+        mvn -B -V --no-transfer-progress --settings "$SETTINGS_FILE" initialize checkstyle:check
 
     - name: Check for Checkstyle results
       id: checkstyle_results

.github/actions/base/publish-spotbugs-report/action.yml

@@ -15,8 +15,10 @@ runs:
   steps:
     - name: Run SpotBugs
       shell: bash
+      env:
+        SETTINGS_FILE: ${{ inputs.settings_file }}
       run: |
-        mvn -B -V --no-transfer-progress --settings ${{ inputs.settings_file }} initialize spotbugs:check
+        mvn -B -V --no-transfer-progress --settings "$SETTINGS_FILE" initialize spotbugs:check
 
     - name: Check for SpotBugs results
       id: spotbugs_results

.github/actions/base/set-maven-project-version/action.yml

@@ -18,33 +18,39 @@ runs:
     - name: Set version (script)
       shell: bash
       if: ${{ inputs.script == 'true' }}
+      env:
+        VERSION: ${{ inputs.version }}
+        SETTINGS_FILE_INPUT: ${{ inputs.settings-file }}
       run: |
-        SETTINGS_FILE=$(echo "${{ inputs.settings-file }}" | tr -d '[:space:]')
+        SETTINGS_FILE=$(echo "$SETTINGS_FILE_INPUT" | tr -d '[:space:]')
 
         if [[ -n "$SETTINGS_FILE" && ! -f "$SETTINGS_FILE" ]]; then
           echo "Error: Settings file '$SETTINGS_FILE' does not exist."
           exit 1
         fi
 
         if [[ -n "$SETTINGS_FILE" ]]; then
-          MAVEN_SETTINGS_PATH="$SETTINGS_FILE" ${GITHUB_ACTION_PATH}/set-mvn-version.sh ${{ inputs.version }}
+          MAVEN_SETTINGS_PATH="$SETTINGS_FILE" ${GITHUB_ACTION_PATH}/set-mvn-version.sh "$VERSION"
         else
-          ${GITHUB_ACTION_PATH}/set-mvn-version.sh ${{ inputs.version }}
+          ${GITHUB_ACTION_PATH}/set-mvn-version.sh "$VERSION"
         fi
 
     - name: Set version (mvn plugin, custom settings)
       shell: bash
       if: ${{ inputs.script != 'true' }}
+      env:
+        VERSION: ${{ inputs.version }}
+        SETTINGS_FILE_INPUT: ${{ inputs.settings-file }}
       run: |
-        SETTINGS_FILE=$(echo "${{ inputs.settings-file }}" | tr -d '[:space:]')
+        SETTINGS_FILE=$(echo "$SETTINGS_FILE_INPUT" | tr -d '[:space:]')
 
         if [[ -n "$SETTINGS_FILE" && ! -f "$SETTINGS_FILE" ]]; then
           echo "Error: Settings file '$SETTINGS_FILE' does not exist."
           exit 1
         fi
 
         if [[ -n "$SETTINGS_FILE" ]]; then
-          mvn -B -V --no-transfer-progress versions:set -DnewVersion=${{ inputs.version }} -DgenerateBackupPoms=false --settings "$SETTINGS_FILE"
+          mvn -B -V --no-transfer-progress versions:set -DnewVersion="$VERSION" -DgenerateBackupPoms=false --settings "$SETTINGS_FILE"
         else
-          mvn -B -V --no-transfer-progress versions:set -DnewVersion=${{ inputs.version }} -DgenerateBackupPoms=false
+          mvn -B -V --no-transfer-progress versions:set -DnewVersion="$VERSION" -DgenerateBackupPoms=false
         fi

.github/actions/base/setup-npm-nexus-access/action.yml

@@ -21,11 +21,11 @@ runs:
     - name: Add Nexus NPM credentials
       shell: bash
       run: |
-        cat << EOF >> '${{ inputs.auth-file }}'
+        cat << EOF >> "$AUTH_FILE"
         //$NEXUS_URL/repository/$NPM_REPOSITORY/:_authToken=$NPM_TOKEN
         EOF
-        cat '${{ inputs.auth-file }}'
       env:
         NPM_TOKEN: ${{ inputs.token }}
         NPM_REPOSITORY: ${{ inputs.repository }}
         NEXUS_URL: ${{ inputs.nexus-url }}
+        AUTH_FILE: ${{ inputs.auth-file }}

.github/actions/copy-docker-images/action.yml

@@ -20,9 +20,14 @@ runs:
   steps:
     - name: Copy multi-arch docker image
       shell: bash
+      env:
+        SOURCE_CREDENTIALS: ${{ inputs.source_credentials }}
+        DESTINATION_CREDENTIALS: ${{ inputs.destination_credentials }}
+        SOURCE_IMAGE: ${{ inputs.source_image }}
+        DESTINATION_IMAGE: ${{ inputs.destination_image }}
       run: |
         docker run --rm quay.io/skopeo/stable:v1 copy \
           --all \
-          --src-creds ${{ inputs.source_credentials }} \
-          --dest-creds ${{ inputs.destination_credentials }} \
-          docker://${{ inputs.source_image }} docker://${{ inputs.destination_image }}
+          --src-creds "$SOURCE_CREDENTIALS" \
+          --dest-creds "$DESTINATION_CREDENTIALS" \
+          "docker://$SOURCE_IMAGE" "docker://$DESTINATION_IMAGE"

.github/actions/ensure-branch/action.yml

@@ -17,23 +17,29 @@ runs:
 
     - name: Check if branch exists
       id: branch_check
+      env:
+        BRANCH: ${{ inputs.branch }}
       run: |
-        if [[ -n $(git ls-remote --heads origin ${{ inputs.branch }}) ]]; then
+        if [[ -n $(git ls-remote --heads origin "$BRANCH") ]]; then
             echo "exists=true" >> $GITHUB_OUTPUT
         else
-            echo "exists=false" >> $GITHUB_OUTPUT          
+            echo "exists=false" >> $GITHUB_OUTPUT
         fi
       shell: bash
 
     - name: Branch exists
       if: steps.branch_check.outputs.exists == 'true'
       shell: bash
+      env:
+        BRANCH: ${{ inputs.branch }}
       run: |
-        echo "Branch '${{ inputs.branch }}' exists!"
+        echo "Branch '$BRANCH' exists!"
 
     - name: Branch does NOT exists
       if: steps.branch_check.outputs.exists == 'false'
       shell: bash
+      env:
+        BRANCH: ${{ inputs.branch }}
       run: |
-        echo "Branch '${{ inputs.branch }}' does NOT exist. Aborting..."
+        echo "Branch '$BRANCH' does NOT exist. Aborting..."
         exit 1

.github/actions/install-mvnd/action.yaml

@@ -39,10 +39,16 @@ outputs:
 runs:
   using: 'composite'
   steps:
-    - run: curl -fsSL -o mvnd.zip https://downloads.apache.org/maven/mvnd/${{ inputs.version }}/maven-mvnd-${{ inputs.version }}-${{ inputs.distribution }}.zip
+    - env:
+        VERSION: ${{ inputs.version }}
+        DISTRIBUTION: ${{ inputs.distribution }}
+      run: curl -fsSL -o mvnd.zip "https://downloads.apache.org/maven/mvnd/$VERSION/maven-mvnd-$VERSION-$DISTRIBUTION.zip"
       if: inputs.dry-run == 'false'
       shell: bash
-    - run: curl -fsSL -o mvnd.zip.sha256 https://downloads.apache.org/maven/mvnd/${{ inputs.version }}/maven-mvnd-${{ inputs.version }}-${{ inputs.distribution }}.zip.sha256
+    - env:
+        VERSION: ${{ inputs.version }}
+        DISTRIBUTION: ${{ inputs.distribution }}
+      run: curl -fsSL -o mvnd.zip.sha256 "https://downloads.apache.org/maven/mvnd/$VERSION/maven-mvnd-$VERSION-$DISTRIBUTION.zip.sha256"
       if: inputs.dry-run == 'false'
       shell: bash
     - id: integrity-check
@@ -53,7 +59,10 @@ runs:
       if: inputs.dry-run == 'false'
       shell: bash
     - id: mvnd-location
-      run: echo "mvnd-dir=/tmp/maven-mvnd-${{ inputs.version }}-${{ inputs.distribution }}/bin" >> $GITHUB_OUTPUT
+      env:
+        VERSION: ${{ inputs.version }}
+        DISTRIBUTION: ${{ inputs.distribution }}
+      run: echo "mvnd-dir=/tmp/maven-mvnd-$VERSION-$DISTRIBUTION/bin" >> $GITHUB_OUTPUT
       shell: bash
 #    - id: mvnd-opts
 #      run: echo "MVND_OPTS=-P apache-snapshots -V -e -ntp -Dmvnd.threads=2 -Daether.connector.http.connectionMaxTtl=120 -Daether.connector.requestTimeout=300000 -Daether.dependencyCollector.impl=bf -Dmaven.artifact.threads=25 -Dci.env.name=github.com -Dsurefire.rerunFailingTestsCount=2 -Dfailsafe.rerunFailingTestsCount=2" >> $GITHUB_ENV

.github/actions/parse-version/action.yml

@@ -35,10 +35,12 @@ runs:
     - name: Parse version
       id: version
       shell: bash
+      env:
+        VERSION: ${{ inputs.version }}
       run: |
-        IFS=- read SEM_VER BUILD_DATE RUN_ID COMMIT_SHA <<< "${{ inputs.version }}"
+        IFS=- read SEM_VER BUILD_DATE RUN_ID COMMIT_SHA <<< "$VERSION"
 
-        cat >> $GITHUB_OUTPUT <<EOF  
+        cat >> $GITHUB_OUTPUT <<EOF
         SEM_VER=$SEM_VER
         BUILD_DATE=$BUILD_DATE
         RUN_ID=$RUN_ID
@@ -48,8 +50,10 @@ runs:
     - name: Parse SemVer
       id: semver
       shell: bash
+      env:
+        SEM_VER: ${{ steps.version.outputs.SEM_VER }}
       run: |
-        IFS=. read MAJOR MINOR PATCH <<< "${{ steps.version.outputs.SEM_VER }}"
+        IFS=. read MAJOR MINOR PATCH <<< "$SEM_VER"
 
         cat >> $GITHUB_OUTPUT <<EOF  
         MAJOR=$MAJOR

.github/actions/release-docker-images/action.yml

@@ -27,12 +27,19 @@ runs:
     # https://help.sonatype.com/en/staging.html
     - name: Move docker images
       shell: bash
+      env:
+        NEXUS3_URL: ${{ inputs.nexus3_url }}
+        NEXUS_USER: ${{ inputs.nexus3_user }}
+        NEXUS_PW: ${{ inputs.nexus3_password }}
+        DOCKER_STAGING_REGISTRY: ${{ inputs.source_registry }}
+        DOCKER_RELEASE_REGISTRY: ${{ inputs.target_registry }}
+        TAG: ${{ inputs.tag }}
       run: |
         docker run --rm -t \
-          -v ${{ github.action_path }}:/tmp \
-          -e NEXUS3_URL="${{ inputs.nexus3_url }}" \
-          -e NEXUS_USER="${{ inputs.nexus3_user }}" \
-          -e NEXUS_PW="${{ inputs.nexus3_password }}" \
-          -e DOCKER_STAGING_REGISTRY="${{ inputs.source_registry }}" \
-          -e DOCKER_RELEASE_REGISTRY="${{ inputs.target_registry }}" \
-          peschee/zx:2.0.0 /tmp/release-nexus-tag.mjs "${{ inputs.tag }}" --quiet
+          -v "$GITHUB_ACTION_PATH:/tmp" \
+          -e NEXUS3_URL="$NEXUS3_URL" \
+          -e NEXUS_USER="$NEXUS_USER" \
+          -e NEXUS_PW="$NEXUS_PW" \
+          -e DOCKER_STAGING_REGISTRY="$DOCKER_STAGING_REGISTRY" \
+          -e DOCKER_RELEASE_REGISTRY="$DOCKER_RELEASE_REGISTRY" \
+          peschee/zx:2.0.0 /tmp/release-nexus-tag.mjs "$TAG" --quiet

.github/actions/release-jira/action.yml

@@ -21,6 +21,9 @@ runs:
     - name: Update Changelog
       env:
         JIRA_BASIC_AUTH_TOKEN: '${{ inputs.jira_basic_auth_token }}'
+        COMPONENT_NAME: ${{ inputs.component_name }}
+        SEMVER: ${{ inputs.semver }}
+        VERSION: ${{ inputs.version }}
       shell: bash
       run: |
-        ${{ github.action_path }}/jiraRelease.sh "${{ inputs.component_name }}" "${{ inputs.semver }}" "${{ inputs.version }}"
+        "$GITHUB_ACTION_PATH/jiraRelease.sh" "$COMPONENT_NAME" "$SEMVER" "$VERSION"

.github/actions/send-rocket-chat-message/action.yml

@@ -17,5 +17,9 @@ runs:
     # No need to install Node as it is available on all GitHub runners…
     - name: Send Rocket.Chat message
       shell: bash
+      env:
+        WEBHOOK_URL: ${{ inputs.webhook_url }}
+        CHANNEL: ${{ inputs.channel }}
+        MESSAGE: ${{ inputs.message }}
       run: |
-        node ${{ github.action_path }}/send-rocketchat-message.mjs ${{ inputs.webhook_url }} ${{ inputs.channel }} "${{ inputs.message }}"
+        node "$GITHUB_ACTION_PATH/send-rocketchat-message.mjs" "$WEBHOOK_URL" "$CHANNEL" "$MESSAGE"

.github/actions/set-maven-project-version/action.yml

@@ -18,33 +18,39 @@ runs:
     - name: Set version (script)
       shell: bash
       if: ${{ inputs.script == 'true' }}
+      env:
+        VERSION: ${{ inputs.version }}
+        SETTINGS_FILE_INPUT: ${{ inputs.settings-file }}
       run: |
-        SETTINGS_FILE=$(echo "${{ inputs.settings-file }}" | tr -d '[:space:]')
+        SETTINGS_FILE=$(echo "$SETTINGS_FILE_INPUT" | tr -d '[:space:]')
 
         if [[ -n "$SETTINGS_FILE" && ! -f "$SETTINGS_FILE" ]]; then
           echo "Error: Settings file '$SETTINGS_FILE' does not exist."
           exit 1
         fi
 
         if [[ -n "$SETTINGS_FILE" ]]; then
-          MAVEN_SETTINGS_PATH="$SETTINGS_FILE" ${GITHUB_ACTION_PATH}/set-mvn-version.sh ${{ inputs.version }}
+          MAVEN_SETTINGS_PATH="$SETTINGS_FILE" ${GITHUB_ACTION_PATH}/set-mvn-version.sh "$VERSION"
         else
-          ${GITHUB_ACTION_PATH}/set-mvn-version.sh ${{ inputs.version }}
+          ${GITHUB_ACTION_PATH}/set-mvn-version.sh "$VERSION"
         fi
 
     - name: Set version (mvn plugin, custom settings)
       shell: bash
       if: ${{ inputs.script != 'true' }}
+      env:
+        VERSION: ${{ inputs.version }}
+        SETTINGS_FILE_INPUT: ${{ inputs.settings-file }}
       run: |
-        SETTINGS_FILE=$(echo "${{ inputs.settings-file }}" | tr -d '[:space:]')
+        SETTINGS_FILE=$(echo "$SETTINGS_FILE_INPUT" | tr -d '[:space:]')
 
         if [[ -n "$SETTINGS_FILE" && ! -f "$SETTINGS_FILE" ]]; then
           echo "Error: Settings file '$SETTINGS_FILE' does not exist."
           exit 1
         fi
 
         if [[ -n "$SETTINGS_FILE" ]]; then
-          mvn -B -V --no-transfer-progress versions:set -DnewVersion=${{ inputs.version }} -DgenerateBackupPoms=false --settings "$SETTINGS_FILE"
+          mvn -B -V --no-transfer-progress versions:set -DnewVersion="$VERSION" -DgenerateBackupPoms=false --settings "$SETTINGS_FILE"
         else
-          mvn -B -V --no-transfer-progress versions:set -DnewVersion=${{ inputs.version }} -DgenerateBackupPoms=false
+          mvn -B -V --no-transfer-progress versions:set -DnewVersion="$VERSION" -DgenerateBackupPoms=false
         fi