From 29c157cd1a491fc55bcdcd77e79945fdb8aeddd3 Mon Sep 17 00:00:00 2001 From: Claude Date: Sun, 16 Aug 2026 09:41:17 +0000 Subject: [PATCH] Stop interpolating github.ref_name into shell source Release workflows pasted ${{ github.ref_name }} directly into run: blocks, so the tag name was substituted into the shell source before bash parsed it. Creating a tag or release needs write access, so this is defence in depth rather than an open hole -- but it is the same defect robusta-gitops fixed in ROB-1034 and it costs nothing to close. Each affected step now reads the tag from a GITHUB_REF_NAME env var and references only the quoted shell variable, matching the idiom the Windows "Set version in code" step in this same workflow already used. The awk version-rewrite previously spliced the tag into the awk *program* text by closing and reopening the shell quoting; it now passes the tag as an awk variable with -v, which is both safe and easier to read. The needs.*.outputs build hashes move to env alongside it for consistency. docker-build-on-tag.yml is unchanged: its ref_name uses are docker build-push-action `tags:` inputs, not shell source. ## Tests performed - Ran the original awk construct and the -v rewrite side by side against a sample __init__.py with tag 1.7.1: output is byte-identical. - Ran the rewrite with a tag of $(touch PWNED): the literal string is written into the file and no command executes. - Confirmed both workflows still parse as YAML and that no github.* or needs.* interpolation remains in any run: block in the repo. --- .github/workflows/build-on-release.yml | 36 ++++++++++++++++++-------- 1 file changed, 25 insertions(+), 11 deletions(-) diff --git a/.github/workflows/build-on-release.yml b/.github/workflows/build-on-release.yml index 2781c403..a5b5b6d2 100644 --- a/.github/workflows/build-on-release.yml +++ b/.github/workflows/build-on-release.yml @@ -63,9 +63,11 @@ jobs: cp $PP_PATH ~/Library/MobileDevice/Provisioning\ Profiles - name: Set version in code (Unix) - if: matrix.os == 'macos-latest' || matrix.os == 'ubuntu-latest' || matrix.os == 'macos-13' + if: matrix.os == 'macos-latest' || matrix.os == 'ubuntu-latest' || matrix.os == 'macos-13' + env: + GITHUB_REF_NAME: ${{ github.ref_name }} run: | - awk 'NR==3{$0="__version__ = \"'${{ github.ref_name }}'\""}1' ./robusta_krr/__init__.py > temp && mv temp ./robusta_krr/__init__.py + awk -v ver="$GITHUB_REF_NAME" 'NR==3{$0="__version__ = \"" ver "\""}1' ./robusta_krr/__init__.py > temp && mv temp ./robusta_krr/__init__.py cat ./robusta_krr/__init__.py - name: Set version in code (Windows) @@ -99,18 +101,22 @@ jobs: - name: Zip the application (Unix) if: matrix.os == 'macos-latest' || matrix.os == 'ubuntu-latest' || matrix.os == 'macos-13' + env: + GITHUB_REF_NAME: ${{ github.ref_name }} run: | cd dist - zip -r krr-${{ matrix.os }}-${{ github.ref_name }}.zip krr - mv krr-${{ matrix.os }}-${{ github.ref_name }}.zip ../ + zip -r "krr-${{ matrix.os }}-$GITHUB_REF_NAME.zip" krr + mv "krr-${{ matrix.os }}-$GITHUB_REF_NAME.zip" ../ cd .. - name: Zip the application (Windows) if: matrix.os == 'windows-latest' + env: + GITHUB_REF_NAME: ${{ github.ref_name }} run: | Set-Location -Path dist - Compress-Archive -Path krr -DestinationPath krr-${{ matrix.os }}-${{ github.ref_name }}.zip -Force - Move-Item -Path krr-${{ matrix.os }}-${{ github.ref_name }}.zip -Destination ..\ + Compress-Archive -Path krr -DestinationPath "krr-${{ matrix.os }}-$($env:GITHUB_REF_NAME).zip" -Force + Move-Item -Path "krr-${{ matrix.os }}-$($env:GITHUB_REF_NAME).zip" -Destination ..\ Set-Location -Path .. - name: Upload Release Asset @@ -164,7 +170,9 @@ jobs: name: krr-macos-latest-${{ github.ref_name }} - name: Calculate hash id: calc-hash - run: echo "::set-output name=MAC_BUILD_HASH::$(sha256sum krr-macos-latest-${{ github.ref_name }}.zip | awk '{print $1}')" + env: + GITHUB_REF_NAME: ${{ github.ref_name }} + run: echo "::set-output name=MAC_BUILD_HASH::$(sha256sum "krr-macos-latest-$GITHUB_REF_NAME.zip" | awk '{print $1}')" # Define Linux hash job linux-hash: @@ -182,7 +190,9 @@ jobs: name: krr-ubuntu-latest-${{ github.ref_name }} - name: Calculate hash id: calc-hash - run: echo "::set-output name=LINUX_BUILD_HASH::$(sha256sum krr-ubuntu-latest-${{ github.ref_name }}.zip | awk '{print $1}')" + env: + GITHUB_REF_NAME: ${{ github.ref_name }} + run: echo "::set-output name=LINUX_BUILD_HASH::$(sha256sum "krr-ubuntu-latest-$GITHUB_REF_NAME.zip" | awk '{print $1}')" # Define job to update homebrew formula update-formula: @@ -195,10 +205,14 @@ jobs: repository: robusta-dev/homebrew-krr token: ${{ secrets.MULTIREPO_GITHUB_TOKEN }} - name: Update krr.rb formula + env: + MAC_BUILD_HASH_IN: ${{ needs.mac-hash.outputs.MAC_BUILD_HASH }} + LINUX_BUILD_HASH_IN: ${{ needs.linux-hash.outputs.LINUX_BUILD_HASH }} + GITHUB_REF_NAME: ${{ github.ref_name }} run: | - MAC_BUILD_HASH=${{ needs.mac-hash.outputs.MAC_BUILD_HASH }} - LINUX_BUILD_HASH=${{ needs.linux-hash.outputs.LINUX_BUILD_HASH }} - TAG_NAME=${{ github.ref_name }} + MAC_BUILD_HASH="$MAC_BUILD_HASH_IN" + LINUX_BUILD_HASH="$LINUX_BUILD_HASH_IN" + TAG_NAME="$GITHUB_REF_NAME" awk 'NR==6{$0=" url \"https://github.com/robusta-dev/krr/releases/download/'"$TAG_NAME"'/krr-macos-latest-'"$TAG_NAME"'.zip\""}1' ./Formula/krr.rb > temp && mv temp ./Formula/krr.rb awk 'NR==7{$0=" sha256 \"'$MAC_BUILD_HASH'\""}1' ./Formula/krr.rb > temp && mv temp ./Formula/krr.rb awk 'NR==9{$0=" url \"https://github.com/robusta-dev/krr/releases/download/'"$TAG_NAME"'/krr-ubuntu-latest-'"$TAG_NAME"'.zip\""}1' ./Formula/krr.rb > temp && mv temp ./Formula/krr.rb