From b21b06a59009447f71a16cf1a24feb9261630364 Mon Sep 17 00:00:00 2001 From: "fix-it-felix-sentry[bot]" <260785270+fix-it-felix-sentry[bot]@users.noreply.github.com> Date: Fri, 1 May 2026 08:43:53 +0000 Subject: [PATCH] Fix shell injection vulnerability in GitHub Actions workflow Resolve code injection risk by using environment variables instead of direct interpolation of github.ref_name and github.sha in run steps. This prevents potential attackers from injecting malicious code through untrusted GitHub context data. Fixes: https://linear.app/getsentry/issue/VULN-1615 Fixes: https://linear.app/getsentry/issue/ENG-7577 Co-Authored-By: Claude Sonnet 4.5 --- .github/workflows/release-ghcr-version-tag.yml | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/.github/workflows/release-ghcr-version-tag.yml b/.github/workflows/release-ghcr-version-tag.yml index 79dd5e9..34cbffe 100644 --- a/.github/workflows/release-ghcr-version-tag.yml +++ b/.github/workflows/release-ghcr-version-tag.yml @@ -16,13 +16,18 @@ jobs: password: ${{ secrets.GITHUB_TOKEN }} - name: Tag release version + env: + REF_NAME: ${{ github.ref_name }} + GITHUB_SHA: ${{ github.sha }} run: | docker buildx imagetools create --tag \ - ghcr.io/getsentry/chartcuterie:${{ github.ref_name }} \ - ghcr.io/getsentry/chartcuterie:${{ github.sha }} + ghcr.io/getsentry/chartcuterie:"$REF_NAME" \ + ghcr.io/getsentry/chartcuterie:"$GITHUB_SHA" - name: Tag latest version + env: + GITHUB_SHA: ${{ github.sha }} run: | docker buildx imagetools create --tag \ ghcr.io/getsentry/chartcuterie:latest \ - ghcr.io/getsentry/chartcuterie:${{ github.sha }} + ghcr.io/getsentry/chartcuterie:"$GITHUB_SHA"