Improve the composite action security #207

5ouma · 2025-05-16T11:59:08Z

Use environment variables for the input

GitHub Actions will replace the context with plain text. If users or contributors enter the malformed text, secrets might be exposed.

# prevent this
jobs:
  job:
    runs-on: Ubuntu-Latest
    steps:
      - uses: Songmu/tagpr@<ref>
        with:
          version: \" || rm -rf / \"

Git tag may be malformed and should not be hard coded.

It prevents malformed injections since GitHub replace the text.

Songmu · 2025-05-21T14:09:42Z

Using ACTION_REF is a good idea. I didn't know about this feature, so I learned something new.

5ouma added 2 commits May 16, 2025 20:42

refactor(action): Use the executed composite action ref

c661517

Git tag may be malformed and should not be hard coded.

refactor(action): Use environment variables for the input

4bc5f04

It prevents malformed injections since GitHub replace the text.

Songmu merged commit e59de1b into Songmu:main May 21, 2025
3 checks passed

temporary-token-issuer-for-tagpr bot mentioned this pull request May 21, 2025

Release for v1.7.0 #208

Merged

5ouma deleted the refactor-action-env branch May 21, 2025 22:12

Provide feedback