From 38fe6d16b6732c7d3a7583a16960c779d3f8444b Mon Sep 17 00:00:00 2001
From: Cameron G <cambamwham2@gmail.com>
Date: Mon, 3 Aug 2026 22:20:00 -0400
Subject: [PATCH] ci: route release create-release-tag shell through env, not
 shell interpolation

The Update VERSION.txt and create tag step in the release workflow ran
git checkout, git pull, git commit, git push, and git tag with
${{ needs.parse-validate-version.outputs.version }} and ${{ needs.parse-validate-version.outputs.release_branch }}
interpolated directly into the shell body.

Values come from .github/utils/parse_validate_version.sh, but any change
to that script (or its inputs) that let a metacharacter through would
land as a shell token in a step that already runs with a token scoped
to contents: write and secrets.HAYSTACK_BOT_TOKEN. GitHub's own
security-hardening guide flags this as a script-injection pattern and
recommends passing the values through env: so the shell sees them as
opaque strings.

Change:
- Add VERSION and RELEASE_BRANCH to the step's env: block
- Replace every ${{ ... }} in the run: body with quoted "$VERSION" and
  "$RELEASE_BRANCH"

Behavior is identical: the commit message, tag, and pushed branch are
the same strings the script would have produced before. Same env-var
pattern already merged in #11856 (release-notes reST check) and #11857
(release version input).
---
 .github/workflows/release.yml | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index ae232c3277..33610ad2e0 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -83,19 +83,21 @@ jobs:
       - name: Update VERSION.txt and create tag
         env:
           GITHUB_TOKEN: ${{ secrets.HAYSTACK_BOT_TOKEN }}
+          VERSION: ${{ needs.parse-validate-version.outputs.version }}
+          RELEASE_BRANCH: ${{ needs.parse-validate-version.outputs.release_branch }}
         run: |
           git config --global user.name "github-actions[bot]"
           git config --global user.email "github-actions[bot]@users.noreply.github.com"
 
-          git checkout ${{ needs.parse-validate-version.outputs.release_branch }}
-          git pull origin ${{ needs.parse-validate-version.outputs.release_branch }}
+          git checkout "$RELEASE_BRANCH"
+          git pull origin "$RELEASE_BRANCH"
 
-          echo "${{ needs.parse-validate-version.outputs.version }}" > VERSION.txt
+          echo "$VERSION" > VERSION.txt
           git add VERSION.txt
-          git commit -m "bump version to ${{ needs.parse-validate-version.outputs.version }}"
-          git push origin ${{ needs.parse-validate-version.outputs.release_branch }}
+          git commit -m "bump version to $VERSION"
+          git push origin "$RELEASE_BRANCH"
 
-          TAG="v${{ needs.parse-validate-version.outputs.version }}"
+          TAG="v$VERSION"
           git tag -m "$TAG" "$TAG"
           git push origin "$TAG"