From 2d96e4b945080e5f55a78c3b5eaa5988679511e8 Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 28 Aug 2026 11:40:32 +0000 Subject: [PATCH] harden: read the ref from the runner env, not a template expansion A `${{ ... }}` expression inside a `run:` block is substituted into the script before the shell parses it, so the value becomes shell source text rather than data. desktop-artifacts.yml had four such expansions of `github.ref_name` / `github.ref_type` across three steps. This file already established the right pattern: the macOS and Linux "Stamp bundle version" steps read `${GITHUB_REF_TYPE}` and `${GITHUB_REF_NAME}` straight from the runner environment, with no template expansion at all. The Windows job and the two signing gates were the outliers. They now follow the same convention: - macOS "Require signing on release tags": ${GITHUB_REF_NAME} in the ::error:: message. - Windows "Require signing on release tags": likewise. - Windows "Stamp bundle version" (pwsh): $Env:GITHUB_REF_NAME and $Env:GITHUB_REF_TYPE, matching what its macOS and Linux siblings do. GITHUB_REF_NAME and GITHUB_REF_TYPE are default Actions environment variables present on every runner, so no `env:` block is needed and the resolved values are identical. Verified: zizmor 1.29.0 over .github/workflows/, main vs branch -- High-severity template-injection 4 -> 0, every other rule count unchanged (unpinned-uses 30, artipacked 48/13, informational template-injection 29, adhoc-packages 5, misfeature 3, dangerous-triggers 2, excessive-permissions 2, cache-poisoning 1). actionlint 1.7.7 exits 0 on both. All 34 workflow files re-parsed as YAML; scripts/check_action_refs.py passes. Six lines, all inside `run:` blocks. No permission, trigger, step or action version changed -- desktop-artifacts keeps the write scopes it needs to publish releases. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01UYeD7Hs9edpH86kLibimqS --- .github/workflows/desktop-artifacts.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/desktop-artifacts.yml b/.github/workflows/desktop-artifacts.yml index 95b1e9f1ef..4782634dba 100644 --- a/.github/workflows/desktop-artifacts.yml +++ b/.github/workflows/desktop-artifacts.yml @@ -49,7 +49,7 @@ jobs: if: startsWith(github.ref, 'refs/tags/v') && env.HAS_SIGN != 'true' shell: bash run: | - echo "::error::${{ github.ref_name }} would ship an UNSIGNED macOS build. Set MACOS_SIGN_IDENTITY + MACOS_CERT_P12_BASE64." + echo "::error::${GITHUB_REF_NAME} would ship an UNSIGNED macOS build. Set MACOS_SIGN_IDENTITY + MACOS_CERT_P12_BASE64." exit 1 - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: @@ -276,7 +276,7 @@ jobs: if: startsWith(github.ref, 'refs/tags/v') && env.HAS_AZ_SIGN != 'true' && env.HAS_WIN_CERT != 'true' shell: bash run: | - echo "::error::${{ github.ref_name }} would ship an UNSIGNED Windows build. Set AZURE_CLIENT_ID + AZ_SIGN_PROFILE (Artifact Signing) or WINDOWS_CERT_PFX_BASE64." + echo "::error::${GITHUB_REF_NAME} would ship an UNSIGNED Windows build. Set AZURE_CLIENT_ID + AZ_SIGN_PROFILE (Artifact Signing) or WINDOWS_CERT_PFX_BASE64." exit 1 - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: @@ -293,8 +293,8 @@ jobs: - name: Stamp bundle version shell: pwsh run: | - $refName = "${{ github.ref_name }}" - if ("${{ github.ref_type }}" -eq "tag") { + $refName = $Env:GITHUB_REF_NAME + if ($Env:GITHUB_REF_TYPE -eq "tag") { $version = $refName.Substring(1) } else { $version = (Select-String -Path dashboard.py -Pattern '__version__ = "(.+?)"').Matches.Groups[1].Value