cheapnud/CheapShotcutRandomizer
Watch
1
0
Fork
You've already forked CheapShotcutRandomizer
 0
Code Issues Pull requests Projects Releases 3 Packages Wiki Activity Actions

Validate the release tag before it reaches the shell #23

Merged
cheapnud merged 1 commit from b/workflow-tag-injection into master 2026-08-20 20:55:26 +00:00
Conversation 1 Commits 1 Files changed 1 +8 -2
cheapnud commented 2026-08-20 20:54:55 +00:00
Owner
Copy link
No description provided.
treat the release tag as a trust boundary: env-passed and regex-validated before hitting the shell
All checks were successful
Claude PR Review / AI Code Review (pull_request) Successful in 11s
Details
Build & Test / Build and Test (pull_request) Successful in 27s
Details
906095194e
forgejo-actions commented 2026-08-20 20:55:06 +00:00
Copy link

🤖 Claude AI Code Review

  1. Summary
    Fixes a shell-injection risk by passing the release tag via env var and validating its format before use.

  2. Code Quality ⭐⭐⭐⭐⭐
    Correctly treats the tag as a trust boundary using env vars plus a strict regex, avoiding direct interpolation.

  3. Issues

🟢 The second env:REF_NAME usage (in the vpk upload step) relies on REF_NAME being set in that step's env: block too — the diff only shows one step. Confirm the second step also defines env: REF_NAME and performs the same validation, otherwise the fix is incomplete for that step.

  1. Verdict: APPROVE

Well-scoped security fix. Just verify the vpk upload step (which appears to be a separate step) also has REF_NAME in its env: and the same validation guard.

📊 Tokens: 1411 input + 298 output | 💰 Cost: ~$0.0145
Generated by Claude Opus 4.8 via Gitea Actions

## 🤖 Claude AI Code Review 1. **Summary** Fixes a shell-injection risk by passing the release tag via env var and validating its format before use. 2. **Code Quality** ⭐⭐⭐⭐⭐ Correctly treats the tag as a trust boundary using env vars plus a strict regex, avoiding direct interpolation. 3. **Issues** 🟢 The second `env:REF_NAME` usage (in the `vpk upload` step) relies on `REF_NAME` being set in that step's `env:` block too — the diff only shows one step. Confirm the second step also defines `env: REF_NAME` and performs the same validation, otherwise the fix is incomplete for that step. 4. **Verdict**: **APPROVE** Well-scoped security fix. Just verify the `vpk upload` step (which appears to be a separate step) also has `REF_NAME` in its `env:` and the same validation guard. --- 📊 **Tokens**: 1411 input + 298 output | 💰 **Cost**: ~$0.0145 *Generated by Claude Opus 4.8 via Gitea Actions*
cheapnud merged commit 29daf1de4e into master 2026-08-20 20:55:26 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
cheapnud/CheapShotcutRandomizer!23
No description provided.