nodes/ericmey-comfyui-immich
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix: prevent shell injection in auto-release commit message parsing

Browse Source 
Pass commit message via env context instead of direct interpolation
to prevent shell execution of special characters in PR bodies.
Also only parse the first line so the body is never evaluated.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Eric Mey
2026-04-01 23:49:25 -04:00
co-authored by Claude Opus 4.6
parent 7eddbca7d9
commit d727938d94
1 changed files with 6 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/release.yml
+6 -4
View File
@@ -28,13 +28,15 @@ jobs:
- name: Determine bump type
id: bump
env:
COMMIT_MSG: ${{ github.event.head_commit.message }}
run: |
MSG="${{ github.event.head_commit.message }}"
if echo "$MSG" | grep -qE '^feat!:|BREAKING CHANGE'; then
FIRST_LINE=$(echo "$COMMIT_MSG" | head -n1)
if echo "$FIRST_LINE" | grep -qE '^feat!:|BREAKING CHANGE'; then
echo "type=major" >> "$GITHUB_OUTPUT"
elif echo "$MSG" | grep -qE '^feat(\(.*\))?:'; then
elif echo "$FIRST_LINE" | grep -qE '^feat(\(.*\))?:'; then
echo "type=minor" >> "$GITHUB_OUTPUT"
elif echo "$MSG" | grep -qE '^fix(\(.*\))?:'; then
elif echo "$FIRST_LINE" | grep -qE '^fix(\(.*\))?:'; then
echo "type=patch" >> "$GITHUB_OUTPUT"
else
echo "type=patch" >> "$GITHUB_OUTPUT"