fix: prevent script injection in GitHub Actions workflows

[cschetan77]

Summary

Fixes GitHub Actions script injection vulnerabilities in the RL Scanner workflows.

Interpolating ${{ inputs.* }} directly into run: scripts allows shell metacharacters in user-controlled input to break out of the intended command context. This fix routes those values through env: variables so they are treated as data, not inline script.

Changes

• .github/actions/rl-scanner/action.yml — move inputs.artifact-path and inputs.version into env: block; reference as $ARTIFACT_PATH and $VERSION in the shell script
• .github/workflows/rl-secure.yml — move inputs.artifact-name into env: block for the tar step; replace $(pwd)/${{ inputs.artifact-name }} with ${{ github.workspace }}/${{ inputs.artifact-name }} for correct path resolution

Security impact

Before this fix, a crafted artifact-name, artifact-path, or version input value containing shell metacharacters (e.g. `, $(...), ;) could execute arbitrary shell commands in the runner context.

References

• GitHub docs: use an intermediate environment variable

Test plan

• Confirm CI passes on this branch
• Verify RL Scanner workflow runs successfully on a release branch trigger

Summary by CodeRabbit

• Bug Fixes
  • Improved reliability of artifact handling during secure scans.
  • Added safer path and version handling to help ensure scans use the intended build artifact.
  • Enhanced compatibility across workflow environments by using consistent workspace paths and quoting.

[coderabbitai]

📝 Walkthrough

Walkthrough

The RL-Secure workflow now uses environment variables and quoted workspace paths for artifact creation and scanner invocation. The composite scanner action reads artifact path and version through its environment and uses those values for existence checks and rl-wrapper arguments.

Changes

RL scanner path handling

Layer / File(s)	Summary
Artifact creation and workflow wiring .github/workflows/rl-secure.yml	The workflow derives the tarball name from ARTIFACT_NAME, quotes it for tar, and passes the artifact path from ${{ github.workspace }}.
Scanner environment inputs .github/actions/rl-scanner/action.yml	The scanner exposes artifact path and version as environment variables and uses them in the artifact check and quoted rl-wrapper arguments.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: hardening GitHub Actions workflows against script injection.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/prevent-script-injection-github-actions

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (1)

.github/actions/rl-scanner/action.yml (1)

43-58: 🔒 Security & Privacy | 🔵 Trivial | 💤 Low value

Use environment variables for all dynamically evaluated values to maintain consistency.

While github.event.repository.name, github.repository, and github.sha are restricted by GitHub and unlikely to contain shell metacharacters, it is a recommended best practice to pass all context variables to the script via env rather than using direct expression interpolation (${{ ... }}). This ensures defense-in-depth and keeps the script clean and consistent.

♻️ Proposed refactor

       env:
         RLSECURE_LICENSE: ${{ env.RLSECURE_LICENSE }}
         RLSECURE_SITE_KEY: ${{ env.RLSECURE_SITE_KEY }}
         SIGNAL_HANDLER_TOKEN: ${{ env.SIGNAL_HANDLER_TOKEN }}
         PYTHONUNBUFFERED: 1
         ARTIFACT_PATH: ${{ inputs.artifact-path }}
         VERSION: ${{ inputs.version }}
+        REPO_NAME: ${{ github.event.repository.name }}
+        REPOSITORY: ${{ github.repository }}
+        COMMIT_SHA: ${{ github.sha }}
       run: |
         if [ ! -f "$ARTIFACT_PATH" ]; then
           echo "Artifact not found: $ARTIFACT_PATH"
           exit 1
         fi

         rl-wrapper \
           --artifact "$ARTIFACT_PATH" \
-          --name "${{ github.event.repository.name }}" \
+          --name "$REPO_NAME" \
           --version "$VERSION" \
-          --repository "${{ github.repository }}" \
-          --commit "${{ github.sha }}" \
+          --repository "$REPOSITORY" \
+          --commit "$COMMIT_SHA" \
           --build-env "github_actions" \
           --suppress-output

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/actions/rl-scanner/action.yml around lines 43 - 58, Update the
rl-wrapper invocation in the action run script to source the repository name,
repository identifier, and commit SHA from environment variables rather than
directly interpolating github context expressions. Add these context values to
the step’s env configuration alongside ARTIFACT_PATH and VERSION, then reference
the new variables in the --name, --repository, and --commit arguments while
preserving existing behavior.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In @.github/actions/rl-scanner/action.yml:
- Around line 43-58: Update the rl-wrapper invocation in the action run script
to source the repository name, repository identifier, and commit SHA from
environment variables rather than directly interpolating github context
expressions. Add these context values to the step’s env configuration alongside
ARTIFACT_PATH and VERSION, then reference the new variables in the --name,
--repository, and --commit arguments while preserving existing behavior.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: ac4284a4-d2df-4686-b074-00339456aae8

📥 Commits

Reviewing files that changed from the base of the PR and between a004294 and a21d658.

📒 Files selected for processing (2)

• .github/actions/rl-scanner/action.yml
• .github/workflows/rl-secure.yml