arcodange/dance-lessons-coach
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

🐛 fix(ci): replace head_commit.message expression with git log (shell injection) (#38)

Browse Source 
Co-authored-by: Gabriel Radureau <arcodange@gmail.com>
Co-committed-by: Gabriel Radureau <arcodange@gmail.com>
This commit was merged in pull request #38.
This commit is contained in:
Gabriel Radureau
2026-05-05 07:29:40 +02:00
committed by arcodange
parent ee4e8b2ee1
commit 7c5f11779e
1 changed files with 5 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
.gitea/workflows/ci-cd.yaml
View File

@@ -299,13 +299,11 @@ jobs:
# Check for version bump on main branch
if [ "${{ github.ref }}" = "refs/heads/main" ]; then
echo "🔖 Checking for version bump..."
# ${{ github.event.head_commit.message }} is empty on workflow_dispatch (manual trigger).
# Fall back to the latest commit message from `git log` so the script always has input.
COMMIT_MSG="${{ github.event.head_commit.message }}"
if [ -z "$COMMIT_MSG" ]; then
# Always read from git log: ${{ github.event.head_commit.message }} expression
# is interpolated literally into the shell script, so any backtick, unbalanced
# quote, or special char in a commit body breaks the next line of the script
# (observed on PR #32-#35: 'syntax error: unexpected newline'). git log is safe.
COMMIT_MSG=$(git log -1 --pretty=%B)
echo " (using git log -1 because head_commit.message is empty - probably workflow_dispatch)"
fi
./scripts/ci-version-bump.sh "$COMMIT_MSG" --no-push
fi