From 4f4db2341f8346157e7e5c5c28a0179f103acc96 Mon Sep 17 00:00:00 2001
From: Stefano Novelli <murdercode@gmail.com>
Date: Tue, 26 May 2026 18:19:11 +0200
Subject: [PATCH] Harden CI workflows against script injection and unpinned
 action

- build.yml: pass workflow_dispatch input and step outputs through
  `env:` instead of interpolating `${{ ... }}` directly into `run`
  blocks, so user-supplied values can't break out of the shell string.
- keepalive.yml: pin liskin/gh-workflow-keepalive to a full commit SHA
  (v1.2.1) instead of the mutable `v1` tag.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .github/workflows/build.yml     | 19 +++++++++++++------
 .github/workflows/keepalive.yml |  2 +-
 2 files changed, 14 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index c0f52af..9592dcd 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -23,9 +23,11 @@ jobs:
 
       - name: Resolve version
         id: version
+        env:
+          EMULE_VERSION_INPUT: ${{ inputs.emule_version }}
         run: |
-          if [ -n "${{ inputs.emule_version }}" ]; then
-            VER="${{ inputs.emule_version }}"
+          if [ -n "$EMULE_VERSION_INPUT" ]; then
+            VER="$EMULE_VERSION_INPUT"
             PRERELEASE=$(gh release view "eMule_v${VER}-community" --repo irwir/eMule \
               --json isPrerelease --jq '.isPrerelease')
           else
@@ -74,8 +76,9 @@ jobs:
       - name: Check if already released
         if: steps.version.outputs.skip != 'true'
         id: check
+        env:
+          VER: ${{ steps.version.outputs.version }}
         run: |
-          VER="${{ steps.version.outputs.version }}"
           if gh release view "v$VER" --repo "$GITHUB_REPOSITORY" &>/dev/null; then
             echo "skip=true" >> "$GITHUB_OUTPUT"
             echo "Release v$VER already exists — skipping build."
@@ -90,14 +93,18 @@ jobs:
 
       - name: Build .dmg
         if: steps.version.outputs.skip != 'true' && steps.check.outputs.skip == 'false'
-        run: ./build.sh "${{ steps.version.outputs.version }}"
+        env:
+          VER: ${{ steps.version.outputs.version }}
+        run: ./build.sh "$VER"
 
       - name: Create release
         if: steps.version.outputs.skip != 'true' && steps.check.outputs.skip == 'false'
+        env:
+          VER: ${{ steps.version.outputs.version }}
+          PRERELEASE: ${{ steps.version.outputs.prerelease }}
         run: |
-          VER="${{ steps.version.outputs.version }}"
           PRERELEASE_FLAG=""
-          if [ "${{ steps.version.outputs.prerelease }}" = "true" ]; then
+          if [ "$PRERELEASE" = "true" ]; then
             PRERELEASE_FLAG="--prerelease"
           fi
           gh release create "v$VER" "build/macMule-v${VER}.dmg" \
diff --git a/.github/workflows/keepalive.yml b/.github/workflows/keepalive.yml
index 682912b..5ede9f7 100644
--- a/.github/workflows/keepalive.yml
+++ b/.github/workflows/keepalive.yml
@@ -10,4 +10,4 @@ jobs:
     permissions:
       actions: write
     steps:
-      - uses: liskin/gh-workflow-keepalive@v1
+      - uses: liskin/gh-workflow-keepalive@f72ff1a1336129f29bf0166c0fd0ca6cf1bcb38c # v1.2.1