From d727938d94fc8a8d3b4a2ea16fb7b377ffd66b91 Mon Sep 17 00:00:00 2001 From: Eric Mey Date: Wed, 1 Apr 2026 23:49:25 -0400 Subject: [PATCH] fix: prevent shell injection in auto-release commit message parsing Pass commit message via env context instead of direct interpolation to prevent shell execution of special characters in PR bodies. Also only parse the first line so the body is never evaluated. Co-Authored-By: Claude Opus 4.6 --- .github/workflows/release.yml | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index b0a0233..97d3210 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -28,13 +28,15 @@ jobs: - name: Determine bump type id: bump + env: + COMMIT_MSG: ${{ github.event.head_commit.message }} run: | - MSG="${{ github.event.head_commit.message }}" - if echo "$MSG" | grep -qE '^feat!:|BREAKING CHANGE'; then + FIRST_LINE=$(echo "$COMMIT_MSG" | head -n1) + if echo "$FIRST_LINE" | grep -qE '^feat!:|BREAKING CHANGE'; then echo "type=major" >> "$GITHUB_OUTPUT" - elif echo "$MSG" | grep -qE '^feat(\(.*\))?:'; then + elif echo "$FIRST_LINE" | grep -qE '^feat(\(.*\))?:'; then echo "type=minor" >> "$GITHUB_OUTPUT" - elif echo "$MSG" | grep -qE '^fix(\(.*\))?:'; then + elif echo "$FIRST_LINE" | grep -qE '^fix(\(.*\))?:'; then echo "type=patch" >> "$GITHUB_OUTPUT" else echo "type=patch" >> "$GITHUB_OUTPUT"