From 3ab6d6a493e3d0b3c9a31a794d1121d662af55ed Mon Sep 17 00:00:00 2001 From: Cameron G Date: Mon, 3 Aug 2026 22:35:00 -0400 Subject: [PATCH] ci: route github_release version parsing through env, not shell interpolation The Delete next version rc0 tag in the CI environment step parsed ${{ steps.version.outputs.current_release }} by interpolating it directly into a bash here-string (IFS='.' read <<< "..."). The value originates from VERSION.txt in the checked-out ref, so a poisoned VERSION.txt on a fetched branch could inject a shell token into a step that later runs git tag -d in a job with contents: write. Route the value through the step env: block and reference it as "$CURRENT_RELEASE" so the shell treats it as an opaque string. Behavior is unchanged: same IFS split, same NEXT_MINOR arithmetic, same NEXT_TAG format. Same env-var pattern used in the release workflow (#11856, #11857). --- .github/workflows/github_release.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/github_release.yml b/.github/workflows/github_release.yml index 9997f29e53..ec1c0df469 100644 --- a/.github/workflows/github_release.yml +++ b/.github/workflows/github_release.yml @@ -39,9 +39,11 @@ jobs: # This ensures release notes are correctly aggregated for the current version. # This is a workaround. Can be removed if the release process is fully aligned with reno. - name: Delete next version rc0 tag in the CI environment + env: + CURRENT_RELEASE: ${{ steps.version.outputs.current_release }} run: | # Parse version X.Y.Z and increment Y for next minor version - IFS='.' read -r MAJOR MINOR _ <<< "${{ steps.version.outputs.current_release }}" + IFS='.' read -r MAJOR MINOR _ <<< "$CURRENT_RELEASE" NEXT_MINOR=$((MINOR + 1)) NEXT_TAG="v${MAJOR}.${NEXT_MINOR}.0-rc0"