From eeca731f4201ad3feaee14f1a104493df03125db Mon Sep 17 00:00:00 2001 From: SashaMIT Date: Fri, 7 Aug 2026 00:09:58 +0700 Subject: [PATCH 1/2] ci: bind version/ref inputs via env before shell in release workflows Follow-up to the docker/pypi env-binding pass: check-release-tag.yml, release-build.yml, release-publish.yml and pypi-build.yml still interpolated inputs.version / github.ref_name directly into run: blocks (script-injection class per GitHub's hardening guidance). Bind through env: and reference quoted shell variables instead. Also drops a dead duplicate CHANGELOG_VERSION assignment in release-publish.yml that ran before VERSION was set. Made-with: Cursor Changelog-None --- .github/workflows/check-release-tag.yml | 16 +++++++++++----- .github/workflows/pypi-build.yml | 4 +++- .github/workflows/release-build.yml | 7 +++++-- .github/workflows/release-publish.yml | 5 +++-- 4 files changed, 22 insertions(+), 10 deletions(-) diff --git a/.github/workflows/check-release-tag.yml b/.github/workflows/check-release-tag.yml index 1b2b3aa1e49c..f2d831814f37 100644 --- a/.github/workflows/check-release-tag.yml +++ b/.github/workflows/check-release-tag.yml @@ -28,10 +28,14 @@ jobs: - name: Validate tag matches .version file id: resolve + env: + REF_TYPE: ${{ github.ref_type }} + INPUT_VERSION: ${{ inputs.version }} + REF_NAME: ${{ github.ref_name }} run: | - if [[ "${{ github.ref_type }}" != "tag" ]]; then - echo "::notice::Not triggered by a tag push (ref_type=${{ github.ref_type }}); skipping .version check." - echo "version=${{ inputs.version }}" >> "$GITHUB_OUTPUT" + if [[ "$REF_TYPE" != "tag" ]]; then + echo "::notice::Not triggered by a tag push (ref_type=$REF_TYPE); skipping .version check." + echo "version=$INPUT_VERSION" >> "$GITHUB_OUTPUT" exit 0 fi @@ -41,7 +45,7 @@ jobs: fi FILE_VERSION="$(tr -d '[:space:]' < .version)" - TAG_VERSION="${{ github.ref_name }}" + TAG_VERSION="$REF_NAME" if [[ "$TAG_VERSION" != "$FILE_VERSION" ]]; then echo "::error::Tag '$TAG_VERSION' does not match version in .version file ('$FILE_VERSION'). Refusing to release." @@ -53,4 +57,6 @@ jobs: - name: Validate release if: ${{ !inputs.skip_validation }} - run: tools/check-release.sh --version=${{ steps.resolve.outputs.version }} + env: + RESOLVED_VERSION: ${{ steps.resolve.outputs.version }} + run: tools/check-release.sh "--version=$RESOLVED_VERSION" diff --git a/.github/workflows/pypi-build.yml b/.github/workflows/pypi-build.yml index 83f80eb7bca3..402ad36f21a9 100644 --- a/.github/workflows/pypi-build.yml +++ b/.github/workflows/pypi-build.yml @@ -34,8 +34,10 @@ jobs: uses: astral-sh/setup-uv@v8.1.0 - name: Update pyln versions + env: + INPUT_VERSION: ${{ inputs.version }} run: | - make update-pyln-versions NEW_VERSION=${{ inputs.version }} + make update-pyln-versions NEW_VERSION="$INPUT_VERSION" - name: Build distribution 📦 run: uv build --package ${{ matrix.PACKAGE }} diff --git a/.github/workflows/release-build.yml b/.github/workflows/release-build.yml index b99965dc34f6..ab2f0e9abc22 100644 --- a/.github/workflows/release-build.yml +++ b/.github/workflows/release-build.yml @@ -40,9 +40,12 @@ jobs: if: contains(matrix.target, 'Ubuntu') - name: Build release + env: + SKIP_VALIDATION: ${{ inputs.skip_validation }} + INPUT_VERSION: ${{ inputs.version }} run: | - if [[ "${{ inputs.skip_validation }}" == "true" ]]; then - tools/build-release.sh ${{ matrix.target }} --force-version "${{ inputs.version }}" --force-unclean --force-mtime "$(date +%Y-%m-%d)" + if [[ "$SKIP_VALIDATION" == "true" ]]; then + tools/build-release.sh ${{ matrix.target }} --force-version "$INPUT_VERSION" --force-unclean --force-mtime "$(date +%Y-%m-%d)" else tools/build-release.sh ${{ matrix.target }} fi diff --git a/.github/workflows/release-publish.yml b/.github/workflows/release-publish.yml index be7146ab126a..8696ea09ce62 100644 --- a/.github/workflows/release-publish.yml +++ b/.github/workflows/release-publish.yml @@ -49,9 +49,10 @@ jobs: - name: Determine release data id: release_data + env: + INPUT_VERSION: ${{ inputs.version }} run: | - CHANGELOG_VERSION=${VERSION#v} - VERSION="${{ inputs.version }}" + VERSION="$INPUT_VERSION" CHANGELOG_VERSION=${VERSION#v} CHANGELOG_TITLE=$(grep "## \[${CHANGELOG_VERSION}\]" CHANGELOG.md) RELEASE_TITLE=$(echo $CHANGELOG_TITLE | cut -d'"' -f2) From dffc9478f6ed7db4d2d06ee6dfb6655f884c28df Mon Sep 17 00:00:00 2001 From: SashaMIT Date: Fri, 7 Aug 2026 02:39:17 +0700 Subject: [PATCH 2/2] ci: bind GPG keyid via env before shell in release-publish Per review: keyid comes from crazy-max/ghaction-import-gpg parsing a repo-owned secret, so practical risk is low; bind it anyway so every run: block in the release path follows the same env-first pattern and the invariant does not depend on that action's output staying trusted. Made-with: Cursor Signed-off-by: SashaMIT --- .github/workflows/release-publish.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release-publish.yml b/.github/workflows/release-publish.yml index 8696ea09ce62..39a33324160c 100644 --- a/.github/workflows/release-publish.yml +++ b/.github/workflows/release-publish.yml @@ -35,7 +35,9 @@ jobs: trust_level: 5 - name: Set default GPG key - run: echo "default-key ${{ steps.gpg.outputs.keyid }}" >> ~/.gnupg/gpg.conf + env: + GPG_KEYID: ${{ steps.gpg.outputs.keyid }} + run: echo "default-key $GPG_KEYID" >> ~/.gnupg/gpg.conf - name: Sign release run: tools/build-release.sh --without-zip sign